Playstation CPU reversing [56k Warning]

Members research, findings and information that can be useful towards the PlayStation 1.
User avatar
sickle
Verified
C Programming Expert
C Programming Expert
Posts: 257
Joined: Jul 17, 2013
I am a: Chocolate-fueled pug fetish robot.
Location: Scotland

Post by sickle » May 6th, 2015, 3:17 am

TriMesh wrote:I'm also pretty sure that the big block diagram of the PSX that Sony used in their early developer presentations had the GTE drawn as part of the CPU block, but I can't seem to find a copy of it online to check.
Page 11: (suggests that might be the case)
http://www.elisanet.fi/6581/PSX/doc/Pla ... rdware.pdf

TapamN
What is PSXDEV?
What is PSXDEV?
Posts: 1
Joined: May 09, 2015

Post by TapamN » May 9th, 2015, 9:35 am

There are official, labeled die shots of the CPU in this Hot Chips presentation that show GTE is on the same die.

User avatar
TriMesh
Verified
PSX Aptitude
PSX Aptitude
Posts: 225
Joined: Dec 20, 2013
PlayStation Model: DTL-H1202
Location: Hong Kong

Post by TriMesh » May 10th, 2015, 1:51 am

TapamN wrote:There are official, labeled die shots of the CPU in this Hot Chips presentation that show GTE is on the same die.
Thank you for that - I remembered seeing that once, but I could never recall where.

org
Curious PSXDEV User
Curious PSXDEV User
Posts: 10
Joined: Sep 11, 2013

Post by org » July 2nd, 2015, 11:29 pm

GTE location is confirmed at bottom-left corner of the chip (Part 02).

Source:
Image

Almost all cells of this area are identified. There are total 6600 cells (Part 02), but some of them are used by MDEC YUV-RGB circuit (Akari working on it).

Left part contain some misc circuit with MUX'es to exchange between GTE registers (those Units at the left) and internal state vars.

Middle part contain crazy random logic (2/3 of cells are located here).

Right part is multiplier or similar circuit. It contain lot of Full Adders, MUX Arrays and WS1/WS2 helper cells.

Akari
PSX Aficionado
PSX Aficionado
Posts: 39
Joined: Mar 20, 2014

Post by Akari » December 6th, 2015, 4:25 pm

I continued working on chip. Now my main target is DMA controller. I started from buffer which has 7 blocks with 8bits size. It has 3 address wire and that callow us to store and read 8 different bytes in each block. 8x8x7 bits in total.

All data went to this buffer through flip-flops and multiplexors from data bus 1 (processor has 2 data buses 32 bits each.)

Image
Image

org
Curious PSXDEV User
Curious PSXDEV User
Posts: 10
Joined: Sep 11, 2013

Post by org » January 23rd, 2016, 9:34 am

Latest progress on my side.

I was focused to improvement of chip reversing toolkit.

In last few month two dedicated tools was developed.

First one is patterns, used to identify standard cells over source image of polysilicon/diffusion layer.

Image

Result data is exported as XML and can be used together with the second tool.

The second tool is called deroute. This tool is purposed to trace wire interconnections between standard cells. It has many neat features, including multiple image layers and basic wire recognition.

Image

Both tools can be downloaded by following links:

http://psxdev.ru/files/patterns_latest.zip

http://psxdev.ru/files/deroute_latest.zip

Source code is available at github:

https://github.com/ogamespec/psxdev/tree/master/tools

Besides, I already identified almost all cells (PSX CPU has around 37600 cells of 150 different types) and constructed color map, where each cell is colored by type:

Image

Image

Yet, it still contain unknown cells :) More things to do :)

wisi
Curious PSXDEV User
Curious PSXDEV User
Posts: 11
Joined: Jan 27, 2016

Post by wisi » January 27th, 2016, 6:27 pm

Hello. How far has work on the DMA controller come?
There are unused bit fields at the top (bits 31:28) of the DPCR (0x1F8010F0) register. They might belong to a DMA channel, controlled not through the standard registers in the DMAC range, but through dedicated registers in the address space of the device. Was anything found about that?

Akari
PSX Aficionado
PSX Aficionado
Posts: 39
Joined: Mar 20, 2014

Post by Akari » February 12th, 2016, 9:53 pm

wisi wrote:Hello. How far has work on the DMA controller come?
There are unused bit fields at the top (bits 31:28) of the DPCR (0x1F8010F0) register. They might belong to a DMA channel, controlled not through the standard registers in the DMAC range, but through dedicated registers in the address space of the device. Was anything found about that?
I'm still working on datapaths. Bit0-22 traced. 23-31 left. After data paths will be finished i will trace control lines and may be find registers data.

Image

At the same moment I work on MDEC. I fixed few errors in MDEC circuits and working to understand and describe control state mashine of MDEC. Small part of it looks like this:

Image

laxer3a
Interested PSXDEV User
Interested PSXDEV User
Posts: 9
Joined: Aug 25, 2019

Post by laxer3a » September 8th, 2019, 8:44 pm

Hi !

Bumping the thread a bit. I have a question about RLE stream in MDEC.

Logically the stop condition is FE00 (OEB = End Of Block) or index reach 63.

I am sorry but I have hard time finding the adder (curr index = prev index + 1 + offset) stuff in this schematics from the page 2 of this thread :
http://psxdev.ru/files/IC103/02_RLE_sce ... -06-02.png

I have a feeling that it is 6 bit counter only (not 7 bit). But if some offset jump add too much, the counter could over flow (try to go higher than 63 but roll). In this case, I would suppose that the hardware does continue to work until index == 63 or EOB (adder can overflow as long as you like... until reach 63).

Hope to get an answer. Thanks !

Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests