Playstation CPU reversing [56k Warning]

[sickle]

I'm also pretty sure that the big block diagram of the PSX that Sony used in their early developer presentations had the GTE drawn as part of the CPU block, but I can't seem to find a copy of it online to check.

Page 11: (suggests that might be the case)
http://www.elisanet.fi/6581/PSX/doc/Pla ... rdware.pdf

[TapamN]

There are official, labeled die shots of the CPU in this Hot Chips presentation that show GTE is on the same die.

[TriMesh]

There are official, labeled die shots of the CPU in this Hot Chips presentation that show GTE is on the same die.

Thank you for that - I remembered seeing that once, but I could never recall where.

[org]

GTE location is confirmed at bottom-left corner of the chip (Part 02).

Source:


Almost all cells of this area are identified. There are total 6600 cells (Part 02), but some of them are used by MDEC YUV-RGB circuit (Akari working on it).

Left part contain some misc circuit with MUX'es to exchange between GTE registers (those Units at the left) and internal state vars.

Middle part contain crazy random logic (2/3 of cells are located here).

Right part is multiplier or similar circuit. It contain lot of Full Adders, MUX Arrays and WS1/WS2 helper cells.

[Akari]

I continued working on chip. Now my main target is DMA controller. I started from buffer which has 7 blocks with 8bits size. It has 3 address wire and that callow us to store and read 8 different bytes in each block. 8x8x7 bits in total.

All data went to this buffer through flip-flops and multiplexors from data bus 1 (processor has 2 data buses 32 bits each.)

[org]

Latest progress on my side.

I was focused to improvement of chip reversing toolkit.

In last few month two dedicated tools was developed.

First one is patterns, used to identify standard cells over source image of polysilicon/diffusion layer.



Result data is exported as XML and can be used together with the second tool.

The second tool is called deroute. This tool is purposed to trace wire interconnections between standard cells. It has many neat features, including multiple image layers and basic wire recognition.



Both tools can be downloaded by following links:

http://psxdev.ru/files/patterns_latest.zip

http://psxdev.ru/files/deroute_latest.zip

Source code is available at github:

https://github.com/ogamespec/psxdev/tree/master/tools

Besides, I already identified almost all cells (PSX CPU has around 37600 cells of 150 different types) and constructed color map, where each cell is colored by type:





Yet, it still contain unknown cells More things to do

[wisi]

Hello. How far has work on the DMA controller come?
There are unused bit fields at the top (bits 31:28) of the DPCR (0x1F8010F0) register. They might belong to a DMA channel, controlled not through the standard registers in the DMAC range, but through dedicated registers in the address space of the device. Was anything found about that?

[Akari]

Hello. How far has work on the DMA controller come?
There are unused bit fields at the top (bits 31:28) of the DPCR (0x1F8010F0) register. They might belong to a DMA channel, controlled not through the standard registers in the DMAC range, but through dedicated registers in the address space of the device. Was anything found about that?

I'm still working on datapaths. Bit0-22 traced. 23-31 left. After data paths will be finished i will trace control lines and may be find registers data.



At the same moment I work on MDEC. I fixed few errors in MDEC circuits and working to understand and describe control state mashine of MDEC. Small part of it looks like this:

[laxer3a]

Hi !

Bumping the thread a bit. I have a question about RLE stream in MDEC.

Logically the stop condition is FE00 (OEB = End Of Block) or index reach 63.

I am sorry but I have hard time finding the adder (curr index = prev index + 1 + offset) stuff in this schematics from the page 2 of this thread :
http://psxdev.ru/files/IC103/02_RLE_sce ... -06-02.png

I have a feeling that it is 6 bit counter only (not 7 bit). But if some offset jump add too much, the counter could over flow (try to go higher than 63 but roll). In this case, I would suppose that the hardware does continue to work until index == 63 or EOB (adder can overflow as long as you like... until reach 63).

Hope to get an answer. Thanks !