IOP/Deckard: Difference between revisions

From PS2 Developer wiki
Jump to navigation Jump to search
(38 intermediate revisions by 9 users not shown)
Line 1: Line 1:
===IOP===
==MIPS==


I/O processor - MIPS R3000A (PS1 main processor) used in PS2 since SCPH-100XX to SCPH-700XX. Later replaced by PowerPC 405 and DECKARD IOP emulator.
I/O processor - MIPS R3000A (PS1 main processor) used in PS2 since SCPH-10000 to SCPH-700XX. Runs at a 36.864 MHz or a 33.8688 MHz (underclocked when in compatibility mode) clock speed. It is connected to an external 2 MB EDO-RAM chip. Later got replaced by a new IOP based around a PowerPC 405 core, but with an additional MIPS core.


===DECKARD===
=== Revisions ===
* 1.5 : CXD9553GB  (GH-001, GH-003)
* 1.15: CXD9619GB  (GH-004 - GH-014, GH-016)
* 2.0 : CXD9660GB  (early GH-015)
* 2.1 : CXD9697GP  (late GH-015, erroneously listed as "CXD9697GB" in service manuals?)
* 2.1 : CXD9732GP  (very late GH-015, GH-017 - GH-022)
* 2.2 : CXD9783GP  (GH-023)
* 2.4 : CXD9798GP  (some GH-026 boards, maybe J-chassis GH-029?)
* 2.4 : CXD9799GP  (PSX XPD-001/XPD-005, Namco System 256, some K-chassis slim boards, some GH-026 boards, maybe J-chassis GH-029?)
* 2.4 : CXD9799AGP (some K-chassis slim boards, Namco System 147, Namco System 148)


PowerPC 405 chip that replaced IOP. Chip include 4MB SDRAM. In IOP emulator mode 2MB are used as a IOP memory. In PS2 used since SCPH-750XX model. New chip require some compatibility tweaks that are done per title by xparam file found in PS2 ROM.
==PowerPC==
 
PowerPC 405 chip that replaced IOP and [[SPEED]] since SCPH-750XX model. It is connected to an external 4 MB DDR-SDRAM chip. The first 2Mb were reserved to be used as the RAM of the emulated IOP, the other 2Mb are used by the DECKARD emulator, however, between the emulator itself and some lookup tables found on RAM, it doesn't consume all available RAM.
If these lookup tables get relocated,  up to 966kb of free RAM can be obtained without breaking the DECKARD emulator.
 
Note: There is some support hardware inside the PPC IOP for the emulation. It's note purely software emulation.


[https://www2.informatik.hu-berlin.de/~fwinkler/psvfpga/amirix/405_um.pdf Documentation]
[https://www2.informatik.hu-berlin.de/~fwinkler/psvfpga/amirix/405_um.pdf Documentation]
[http://psx-scene.com/forums/f19/deckard-ppc-iop-discussion-157416/#post1215298 More info]
[http://psx-scene.com/forums/f19/deckard-ppc-iop-discussion-157416/#post1215298 More info]


====TLB Entries====
<pre>
User-defined storage attribute Un n=[0-3]----\
Guarded--------\ |
Memory Coherence-----\ | |
Cache Inhibit-----\ | | |
Write-Through--\ | | | |
Read/Write/eXecute------\ | | | | |
Endian (Big/little)--\ | | | | | |
| | | | | | |
Virtual Physical Size | | | | | | |
| | | | | | |
0xFFE00000 0xFFE00000 0x00100000 B RX 1 0 0 0 - DECKARD's BOOT ROM PPC440 BOOT ROM: 0xFFE00000 - 0xFFFFFFFF (2MB)
0xFFF00000 0xFFF00000 0x00100000 B RX 1 0 0 0 - DECKARD's BOOT ROM
0x00000000 0x00200000 0x00100000 l RW 1 0 0 0 2 IOP RAM low 1MB mirror virtual R3000 IOP instructions use
0x00100000 0x00300000 0x00100000 l RW 1 0 0 0 2 IOP RAM high 1MB mirror
0x00200000 0x00200000 0x00100000 IOP RAM low 1MB mirror
0x00300000 0x00300000 0x00100000 IOP RAM high 1MB mirror
0x00400000 0x00200000 0x00100000 IOP RAM low 1MB mirror
0x00500000 0x00300000 0x00100000 IOP RAM high 1MB mirror
0x00600000 0x00200000 0x00100000 IOP RAM low 1MB mirror
0x00700000 0x00300000 0x00100000 IOP RAM high 1MB mirror
0xDFE00000 0x00200000 0x00100000 l R 1 0 0 0 2 IOP RAM low 1MB mirror NOT:EE SIF (SBUS) IOP mem. window ? most likely:DECKARD 'supervisor' ??
0xDFF00000 0x00300000 0x00100000 l R 1 0 0 0 2 IOP RAM high 1MB mirror
0x00000000 0x00000000 0x00100000 l RW 0 1 0 0 - 1MB Invalid these two segments are the same! one maps to 0x00200000 and the other to 0  Switcing the valid entries is done in code.
0x00100000 0x00100000 0x00100000 l RW 0 1 0 0 - 1MB Invalid
0x00200000 0x00000000 0x00100000 lit
0x00300000 0x00100000 0x00100000 lit
0x00400000 0x00000000 0x00100000 lit
0x00500000 0x00100000 0x00100000 lit
0x00600000 0x00000000 0x00100000 lit
0x00700000 0x00100000 0x00100000 lit
0xDFE00000 0x00000000 0x00100000 l R 0 1 0 0 - 1MB Invalid
0xDFF00000 0x00100000 0x00100000 l R 0 1 0 0 - 1MB Invalid
0x00A00000 0x00A00000 0x00100000 B RWX1 0 0 0 - 1MB DECKARD file RAM loading segment (code & data)
0x00BE0000 0x00B60000 0x00001000 B RW 0 0 0 0 - 4kB Some variables and flags...?
0x00BFF000 0x00B7F000 0x00001000 B RW 0 0 0 0 - 4kB PPC stack?
0x00BDF000 0x00B7F000 0x00001000 B R 0 0 0 0 - 4kB
0x00B40000 0x00B40000 0x00000400 l RW 0 1 0 0 - 1kB
0x00B40400 0x00B40400 0x00000400 l RW 0 1 0 0 - 1kB
0x00B40C00 0x00FFFC00 0x00000400 l RW 0 1 0 0 - 1kB The physical addr. of this is in the last 1kB of the 16MB of IOP RAM.
0x01000000 0x40000000 0x00000400 B RW 0 1 0 1 - 1kB PPC devices: PPC UART is here
0x40000000 0x00200000 0x00100000 l RW 1 0 0 0 2 1MB IOP RAM low 1MB mirror
0x40100000 0x00300000 0x00100000 l RW 1 0 0 0 2 1MB IOP RAM high 1MB mirror
0x40200000 0x00200000 0x00100000 l RW 1 0 0 0 2 1MB IOP RAM low 1MB mirror
0x40300000 0x00300000 0x00100000 l RW 1 0 0 0 2 1MB IOP RAM high 1MB mirror
0x40400000 0x00200000 0x00100000 l RW 1 0 0 0 2 1MB IOP RAM low 1MB mirror
0x40500000 0x00300000 0x00100000 l RW 1 0 0 0 2 1MB IOP RAM high 1MB mirror
0x40600000 0x00200000 0x00100000 l RW 1 0 0 0 2 1MB IOP RAM low 1MB mirror
0x40700000 0x00300000 0x00100000 l RW 1 0 0 0 2 1MB IOP RAM high 1MB mirror


0x12000000 0x10000000 0x01000000 l RW 0 1 0 1 2 16MB IOP devices - Dev#10 Dev9_2, Dev#12 Dev9_3 ??
PPC monitor, a homebrew application that runs on this CPU, has some documentation about it, how it works and how to run code on it along the DECKARD emulator.
0x13000000 0x11000000 0x01000000 l RW 0 1 0 1 2 16MB Dev9/SPEED - placed here sor some reason rather than at 0x10000000.
https://israpps.github.io/PPC-Monitor/


0x1D000000 0x1D000000 0x00000400 l RW 0 1 0 1 2 1kB SIF SBUS BDn regs on EE, accessed through SBUS
===Compatibility modes===
The addition of this PPC CPU required some compatibility modes added. They're enabled/disabled by the rom0:XPARAM IRX module. The console had a database of games that needed compatibility modes, rom0:PS2LOGO was in charge of looking at this database and applying the patches. Games were also capable of providing compatibility modes on their own by adding a '''PARAM2''' field on their system.cnf file. Wich consisted on the XPARAM config value followed by an MD5 checksum for integrity checks (to avoid applying the XPARAM if the data was corrupted).
There were only found two revisions of this compatibility mode database, one included on SCPH-750xx, and the second one was used on SCPH-770xx and never got updated again.


0x1E000000 0x1E000000 0x01000000 l RW 0 1 0 1 2 16MB Dev#1 ROM-DVD /CS1
Information about this database and the actual databases can be found on some notes that got recently added to the [https://github.com/ps2homebrew/Open-PS2-Loader/tree/master/notes/xparam OpenPS2Loader repository]


0x1F402000 0x1F402000 0x00000400 l RW 0 1 0 1 2 1kB Dev#5 CDVD /CS5


0x1F7FFC00 0x00B00400 0x00000400 l RW 0 1 0 1 2 1kB Cache ?
=== Revisions ===
* 3.0 : CXD9796GP (SCPH-750XX series/L-chassis)
**As the only IOP revision to do so, '''this revision needs heatsinking!'''
*3.0 : CXD9209GP (most SCPH-770XX series/M-chassis)


0x00BDE800 0x00B00000 0x00000400 l R 0 0 0 0 - 1kB Cache. Status reg?
Starting with N-chassis/SCPH-790XX, the IOP was integrated into the new main SoC ([[Emotion Engine#Revisions|CXD2976GB]]) together with its RAM. It still reports as version 3.0 in software.
0x00BDEC00 0x00B00400 0x00000400 l R 0 0 0 0 - 1kB Cache. Status reg?
<br>Note: IOP revision (3.0) is taken from COP0 PRid which on models with PowerPC is actually emulated. So returned revision is just hardcoded value from DECKARD software IOP emulator file.


0x1F801000 0x1F801000 0x00001000 l RW 0 1 0 1 2 4kB IOP devices (DMAC, SSBUSC,...) and Dev#4 SPU /CS4
although the DECKARD emulator reports different compilation dates across different slim models (compilation date is printed at emulator startup over it's UART), it seems Sony never updated the emulator, just recompiled it.


0x1F802000 0x1F802000 0x00001000 l RW 0 1 0 1 2 4kB Dev#8 Exp2 /EXTR (PIO)
=== UART ===
0x1F803000 0x1F803000 0x00001000 l RW 0 1 0 1 2 4kB Dev#8 Exp2 /EXTR (PIO)
The PowerPC CPU also had an UART. Unlike the EE UART, Sony had no actual use for it, so the pads aren't even tinned.


0x1F808000 0x1F808000 0x00000400 l RW 0 1 0 1 2 1kB SIO2, iLink
The signals use 3.5V logic levels and baud rate of 57600 bps


0x1F900000 0x1F900000 0x00001000 l RW 0 1 0 1 2 4kB Dev#4 Hard-wired (not through SSBUSC address reg.) SPU2 regs.
[[File:PPC-UART.png|200px]]


0x1FC00000 0x1FC00000 0x00100000 l RW 0 1 0 1 2 1MB Dev#2 ROM-BOOT /CS2 0x1FC00000-0x1FFFFFFF 4MB
=== AUX Coprocessor===
0x1FD00000 0x1FD00000 0x00100000 l RW 0 1 0 1 2 1MB Dev#2 ROM-BOOT /CS2
PowerPC series 4xx offer AUX port which functionality is similar to MIPS "COPx" solution. Not much is known about this component publicly. PS2 scene mentioned things like "[https://www.psx-place.com/threads/eject-tray-elf.19072/page-2#post-216993 Deckard SDK] " or dumping bootrom for this chip. This suggest that chip was fully reverse engineered in private circle.
0x1FE00000 0x1FE00000 0x00100000 l RW 0 1 0 1 2 1MB Dev#2 ROM-BOOT /CS2
0x1FF00000 0x1FF00000 0x00100000 l RW 0 1 0 1 2 1MB Dev#2 ROM-BOOT /CS2


TLB entries = 54 (55?) up to here, of 64 maximum.
====Opcodes Encoding====
At this point the code gets the number of remaining TLB entries = 10 and disables them.
Guessed from assembly code, this section can be highly inaccurate.
Then it sets-up 4 more entries, starting from 60:


0x5F800400 0x00B00400 0x00000400 l RW 0 1 0 1 2 1kB IOP Cache / Scratchpad
Bits      Description
0x5F800000 0x00B00000 0x00000400 l RW 0 1 0 1 2 1kB
0x1F800400 0x00B00400 0x00000400 l RW 0 1 0 1 2 1kB
00...05 - PPC OP identificator (all 0 for aux)
0x1F800000 0x00B00000 0x00000400 l RW 0 1 0 1 2 1kB
06...10 - A = Destination register for result from aux
</pre>
11...15 - B = Source register for arg to Aux
16...20 - C = Seems to be used as second arg register
21...27 - Function ?
28...29 - Unknown, always 1 is opcodes used by Deckard emulator
30...31 - Unknown, always 0 is opcodes used by Deckard emulator
                                  OP    A    B    C    func.  unk
For example, opcode 0x0003020C (000000 00000 00011 00000 0000010 1100) is used to set IOP/PS1 PC on Aux side using r3 PPC register as a source.

Revision as of 11:24, 18 April 2024

MIPS

I/O processor - MIPS R3000A (PS1 main processor) used in PS2 since SCPH-10000 to SCPH-700XX. Runs at a 36.864 MHz or a 33.8688 MHz (underclocked when in compatibility mode) clock speed. It is connected to an external 2 MB EDO-RAM chip. Later got replaced by a new IOP based around a PowerPC 405 core, but with an additional MIPS core.

Revisions

  • 1.5 : CXD9553GB (GH-001, GH-003)
  • 1.15: CXD9619GB (GH-004 - GH-014, GH-016)
  • 2.0 : CXD9660GB (early GH-015)
  • 2.1 : CXD9697GP (late GH-015, erroneously listed as "CXD9697GB" in service manuals?)
  • 2.1 : CXD9732GP (very late GH-015, GH-017 - GH-022)
  • 2.2 : CXD9783GP (GH-023)
  • 2.4 : CXD9798GP (some GH-026 boards, maybe J-chassis GH-029?)
  • 2.4 : CXD9799GP (PSX XPD-001/XPD-005, Namco System 256, some K-chassis slim boards, some GH-026 boards, maybe J-chassis GH-029?)
  • 2.4 : CXD9799AGP (some K-chassis slim boards, Namco System 147, Namco System 148)

PowerPC

PowerPC 405 chip that replaced IOP and SPEED since SCPH-750XX model. It is connected to an external 4 MB DDR-SDRAM chip. The first 2Mb were reserved to be used as the RAM of the emulated IOP, the other 2Mb are used by the DECKARD emulator, however, between the emulator itself and some lookup tables found on RAM, it doesn't consume all available RAM. If these lookup tables get relocated, up to 966kb of free RAM can be obtained without breaking the DECKARD emulator.

Note: There is some support hardware inside the PPC IOP for the emulation. It's note purely software emulation.

Documentation More info


PPC monitor, a homebrew application that runs on this CPU, has some documentation about it, how it works and how to run code on it along the DECKARD emulator. https://israpps.github.io/PPC-Monitor/

Compatibility modes

The addition of this PPC CPU required some compatibility modes added. They're enabled/disabled by the rom0:XPARAM IRX module. The console had a database of games that needed compatibility modes, rom0:PS2LOGO was in charge of looking at this database and applying the patches. Games were also capable of providing compatibility modes on their own by adding a PARAM2 field on their system.cnf file. Wich consisted on the XPARAM config value followed by an MD5 checksum for integrity checks (to avoid applying the XPARAM if the data was corrupted). There were only found two revisions of this compatibility mode database, one included on SCPH-750xx, and the second one was used on SCPH-770xx and never got updated again.

Information about this database and the actual databases can be found on some notes that got recently added to the OpenPS2Loader repository


Revisions

  • 3.0 : CXD9796GP (SCPH-750XX series/L-chassis)
    • As the only IOP revision to do so, this revision needs heatsinking!
  • 3.0 : CXD9209GP (most SCPH-770XX series/M-chassis)

Starting with N-chassis/SCPH-790XX, the IOP was integrated into the new main SoC (CXD2976GB) together with its RAM. It still reports as version 3.0 in software.
Note: IOP revision (3.0) is taken from COP0 PRid which on models with PowerPC is actually emulated. So returned revision is just hardcoded value from DECKARD software IOP emulator file.

although the DECKARD emulator reports different compilation dates across different slim models (compilation date is printed at emulator startup over it's UART), it seems Sony never updated the emulator, just recompiled it.

UART

The PowerPC CPU also had an UART. Unlike the EE UART, Sony had no actual use for it, so the pads aren't even tinned.

The signals use 3.5V logic levels and baud rate of 57600 bps

PPC-UART.png

AUX Coprocessor

PowerPC series 4xx offer AUX port which functionality is similar to MIPS "COPx" solution. Not much is known about this component publicly. PS2 scene mentioned things like "Deckard SDK " or dumping bootrom for this chip. This suggest that chip was fully reverse engineered in private circle.

Opcodes Encoding

Guessed from assembly code, this section can be highly inaccurate. 

Bits      Description

00...05 - PPC OP identificator (all 0 for aux)
06...10 - A = Destination register for result from aux
11...15 - B = Source register for arg to Aux
16...20 - C = Seems to be used as second arg register
21...27 - Function ?
28...29 - Unknown, always 1 is opcodes used by Deckard emulator
30...31 - Unknown, always 0 is opcodes used by Deckard emulator
                                  OP     A     B     C    func.  unk
For example, opcode 0x0003020C (000000 00000 00011 00000 0000010 1100) is used to set IOP/PS1 PC on Aux side using r3 PPC register as a source.
Retrieved from "http://www.psdevwiki.com/ps2/index.php?title=IOP/Deckard&oldid=3955"