Bios

From PS2 Developer wiki
Jump to navigation Jump to search

Content[edit | edit source]

Here is an overview of what is contained in a PS2 ROM (including TOOL, DESR/PSX, ps2emu/ps2gxemu/ps2softemu (PS3), System 246 and System 256). This list isn't finished yet, so add your comments below!

File Description Remarks
ACDEV Arcade ROM device service.
ADDDRV Adds support for the DVD ROM (rom1:), via ROMDRV.
ADDROM2 Adds support for rom2 (which contains a Chinese font file), only for Chinese consoles (SCPH-50009).
APPLOAD IOP application loader (according to a printf string found on it). Seems to be an IRX module capable of running other IRX modules, since it processes modload return values and more system 246/256 exclusive, has debug symbols and ELF header pointer to entrypoint is null for some reason.
ATAD The DEV9+ATAD(+Flash device) combo driver. First appearing in ROM v1.10. Has no support for the CXD9566R. Despite its similar name, it is very different from the full ATAD module.
BNNETCNF not entirely sure what this is for, but it appears in the PS3's PS2 ROMs. Seems to be for network configuration, but why? Needs to be at a fixed offset in ROM.
BOARDINF reads in the DSW602 board's ID and sets up the values for Boot Modes 6 and 7. Only does something useful on TOOL units.
BTNB01
BUILD
CDVDFSV The RPC server for CDVDMAN.
CDVDMAN The CD/DVD manager.
CLEARSPU Clears/resets the SPU2 by setting the registers to a known state and zeroing SPU2 memory. If the SPU2 asserts an interrupt when this library is active, it will cause a bus error due to the fact that the callback function is set to NULL. Only used by the OSDSYS of the SCPH-10000 and SCPH-15000, probably retained for backward-compatibility. Appears to use an older version of the libspu2 library.
CMN01 EE code overlay for DVD player loaded after DVDPL* (after 256 byte alignment)
CMN02 EE code overlay for DVD player loaded at a location after CMN01
D2ELOADP DECI2 ELOADP extension (ERX module support).
DAEMON Security dongle check loop. basically imports the McDetectCard2 from MCMAN (export 22) and calls it once per minute system 246/256 exclusive. Has debug symbols. listed on arcade IOPBTCONF but commented.
DBCMAN
DECI1 DECI1 manager. Purpose of its existence is not known.
DECI1DR1 DECI1 H1500 driver. Purpose unknown.
DECI1DRP DECI1 PIF/mini-RA driver. Purpose unknown.
DECI2 DECI2 manager.
DECI2DRP DECI2 PIF driver
DECI2DRS DECI2 SIF2 driver.
DECI2FILE DECI2 host (and TTY) driver.
DECI2HSYN DECI2 Host SYNchronization driver. Notifies the DECI2 manager when the host interface (i.e. PIF) is up.
DECI2KPRT DECI2 KTTY driver.
DECI2LOAD DECI2 IOP module loader.
DECKARD The SCPH-7500x has a newer PowerPC processor in place of the IOP, and requires code to emulate the IOP. Needs to be at a fixed offset in ROM.
DMACMAN DMA Controller Manager.
DVDCNF Contains IOP boot configuration file for the DVD player.
DVDELF DVD player executable for expansion-bay consoles.
DVDID DVD player ID. SCPH-70000 (ROM v2.00) and later had universal DVD ROMs, hence the existence of DVDID* files for each region.
DVDIDA
DVDIDC
DVDIDE
DVDIDJ
DVDIDM
DVDIDO
DVDIDR
DVDIDU
DVDPLA DVD player executable for slimlines. SCPH-70000 (ROM v2.00) and later had universal DVD ROMs, hence the existence of DVDPL* files for each region.
DVDPLC
DVDPLE
DVDPLJ
DVDPLM
DVDPLO
DVDPLR
DVDPLU
DVDVER DVD player version number. SCPH-70000 (ROM v2.00) and later had universal DVD ROMs, hence the existence of DVDVER* files for each region.
DVDVERA
DVDVERJ
DVDVERR
EECONF Loads part of the system configuration from the MECHACON EEPROM. Also configures and resets some peripherals, depending on the model version. In slimlines, EECONF will also load the MAC address.
EELOAD The EE ELF loader, which is loaded by LoadExecPS2() to 0x00082000 for loading ELFs.
EELOADCNF Contains the IOP boot configuration file for EELOAD.
EENULL The idle thread (id #0) module, loaded to 0x00081FC0.
EESYNC For synchronizing with the EE, at the end of IOP resets. EESYNC from DNAS images are evil; they also perform a memory wipe of the region from 0x00084000 to .0x00100000.
EROMDRV Encrypted ROM DRIver for the expansion-bay PlayStation 2 sets.
EROMDRVA Encrypted ROM DRIver for the SCPH-70000 (ROM v2.00) and later PlayStation 2 sets.
EROMDRVC
EROMDRVE
EROMDRVJ
EROMDRVM
EROMDRVO
EROMDRVR
EROMDRVU
ESDATA
EXCEPMAN Exception manager.
EXTINFO Contains the "EXTINFO" for all files in the ROM image.
FILEIO RPC server for IOMAN. Sony has greatly changed the semantics and design of FILEIO after some point. Connecting an old FILEIO EE RPC client to a newer server will result in a severe IOP crash.
FNTASCII
FNTEX000
FNTEX001
FNTEXOSD
FNTHANCH Unknown. along GB18030, they're the only files inside rom2
FNTIMAGE Contains fonts for the OSDSYS of the SCPH-18000 and newer.
FONTM The large FONT Module, used by the OSDSYS.
FONTS The small FONT module, used by the OSDSYS.
GB18030 Chinese FONT module, replace FONTM. Loaded from rom2: on SCPH-50009 On PS2 that use it, this file is required to boot at all.
HDDLOAD Update loader for the HDD unit (and later includes the flash device).
HDDOSD Appears to perform a similar function as the OSD update for SCPH-1xxxx systems. Most likely a build artifact for testing purposes. SCPH-3xxxx exclusive
HEAPLIB Memory HEAP LIBrary (i.e. thvpool, thfpool).
HLPB01
HLPB02
HLPB03
HLPB04
HLPB05
HLPB06
HLPB07
HLPB08
HLPB09
HLPB10
HLPB11
HLPB12
HLPB13
HLPB14
ICOBCDDA
ICOBDISC
ICOBDVDD
ICOBFBRK
ICOBFNOR
ICOBFSCE
ICOBPKST
ICOBPS1D
ICOBPS1M
ICOBPS2D
ICOBPS2M
ICOBQUES
ICOBYSYS
ICOIMAGE Contains icons for the OSDSYS of the SCPH-18000 and newer.
IGREETING Displays boot information (i.e. IOP boot type, EBOOTP, IBOOTP, switch positions for DSW602 and the type of DSW602 board installed).
ILINK i.Link driver present in only the arcade ROMs.
ILSOCK i.Link socket driver present in only the arcade ROMs.
INTRMANI Interrupt Manager. According to wisi, it is for IOP mode.
INTRMANP Interrupt Manager. According to wisi, it is for PS mode. Never used.
IOMAN I/O Manager.
IOPBOOT IOP bootup program. Needs to be at a fixed offset in ROM.
IOPBTCON2 Boot configuration file for the IOP, for the first phase of the IOP reset (before UDNL is loaded).
IOPBTCONF Boot configuration file for the IOP, during the final phase of the IOP reset. If no UDNL module is specified, the IOP will only have a single IOP reset in the reboot process, with the modules listed in IOPBTCONF. In addition to listing modules to be loaded, this file can also tell the parser to parse another file. It is also capable of declaring a load address for the SYSMEM module
KERNEL The EE kernel.
KROM Kanji ROM? Not sure where this is used. Needs to be at a fixed offset in ROM.
KROMG Needs to be at a fixed offset in ROM.
LED Led setter module, simply calls the mechacon NCMD that would switch the blue led on retail PS2s (sceCdApplySCmd: 0x1c) probably related to the system 2x6 watchdog system 246/256 exclusive. Has debug symbols. listed on arcade IOPBTCONF but commented.
LGBB01
LGBB02
LGBB03
LGBB04
LGBB05
LIBFI This is not present in the boot ROM of the SCPH-10000 and SCPH-15000.
LIBSD Sound driver library.
LOADCORE The core of IOP module loading. Provides the lowest level of IOP module loading functions. Also handles the startup of the IOP.
LOADFILE The RPC server for MODLOAD.
LOGO PS1 logo?
MBROWS The browser module as a compressed EE raw binary. Only used by the old OSDSYS program from ROM v1.00 and v1.01.
MCLOCK The clock module as a compressed EE raw binary. Only used by the old OSDSYS program from ROM v1.00 and v1.01.
MCMAN Memory Card Manager. (DONGLEMAN on system 246/256)
MCMANO MCMAN (Original).Probably the version of MCMAN wich was used to create DONGLEMAN, but without changes. only auths PS2 cards on mc1:/ system 246/256 exclusive
MCSERV RPC server for MCMAN.
MODLOAD IOP module loader.
MOPEN The opening module as a compressed EE raw binary. Only used by the old OSDSYS program from ROM v1.00 and v1.01.
MSGB01
MSGB02
MSGB03
MSGB04
MSGB05
MSGB06
MSGB07
MSGB08
MSGB09
MSGB10
MSGB11
MSGB12
MSGB13
MTAP
NCDVDMAN It is a strange abomination that was introduced and used with only the SCPH-70000 series, so it was probably provided for backward-compatibility. It seems to be a heavily stripped-down CDVDMAN module, with no support for some S-command functions like sceCdRI. I don't know why this was done, but it might be a deliberate move by Sony to prevent hackers from using these system functions. Didn't really do anything, however.
NUMB01
NUMB02
NUMB03
NUMB04
NUMB05
OLDROM Contains a subset of ROM modules that are required for the late TOOL ROM to provide DEX-like functionality (i.e. old ROM modules).
OSBROWS Contains metadata about the browser module. Used by the old OSDSYS program from ROM v1.00/v1.01.
OSCLOCK Contains metadata about the clock module. Used by the old OSDSYS program from ROM v1.00/v1.01.
OSDCNF Contains the IOP boot configuration for OSDSYS (mainly listing the X or P prefixed modules)
OSDSND OSD sound library. This is a combination of the tentative libraries "libspu2", "libsnd2", "rspu2drv" from the PS2 runtime library, which are mostly ports from the PS1 runtime library. The changes to OSDSND from SCPH-18000 and newer is that it contains improvements to SPU2 AutoDMA code, larger thread stack size, more waits, and a fix to the timer quit code. However, it does not contain the VSync/Alarm based callback code that is in libsnd2 in SDK 1600.
OSDSYS The browser.
OSDVER Seems to be a build number for the OSD.
OSFONTM Contains metadata about the large font. Used by the old OSDSYS program from ROM v1.00/v1.01.
OSFONTS Contains metadata about the small font. Used by the old OSDSYS program from ROM v1.00/v1.01.
OSOPEN Contains metadata about the opening module. Used by the old OSDSYS program from ROM v1.00/v1.01.
PADMAN Pad manager.
PADMAN2
PATAD ATAD module for DESR systems used in its OSDSYS program.
PCDVDFSV CDVDFSV module for DESR systems used in its OSDSYS program.
PCDVDMAN CDVDMAN module for DESR systems used in its OSDSYS program.
PDEV9 DEV9 module for DESR systems used in its OSDSYS program.
PEESYNC EESYNC module for DESR systems used in its OSDSYS program; code identical to IOPRP 2.8.0.
PFILEIO FILEIO module for DESR systems used in its OSDSYS program.
PFLASH FLASH module for DESR systems used in its OSDSYS program.
PFLSLOAD Flash load module for DESR systems used in its OSDSYS program.
PHDD TIMEMAN module for DESR systems used in its OSDSYS program.
PHDDLOAD HDDLOAD module for DESR systems used in its OSDSYS program.
PIOMAN IOMAN module for DESR systems used in its OSDSYS program; code identical to IOPRP 2.8.0.
PIOPRP IOPRP 3.1.0 used for the PS3 ps2_emu OSDSYS program.
PLIBSD LIBSD module for DESR systems used in its OSDSYS program.
PLOADCORE LOADCORE module for DESR systems used in its OSDSYS program; code identical to IOPRP 2.8.0.
PLOADFILE LOADFILE module for DESR systems used in its OSDSYS program; code identical to IOPRP 2.8.0.
PMCMAN MCMAN module for DESR systems used in its OSDSYS program.
PMCSERV MCSERV module for DESR systems used in its OSDSYS program.
PMODHSYN MODHSYN (part of CSL) module for DESR systems used in its OSDSYS program.
PMODLOAD MODLOAD module for DESR systems used in its OSDSYS program; code identical to IOPRP 2.8.0.
PMODMIDI MODMIDI module (part of CSL) for DESR systems used in its OSDSYS program.
PMODSESQ MODSESQ module (part of CSL) for DESR systems used in its OSDSYS program.
PMTAPMAN MTAPMAN module for DESR systems used in its OSDSYS program.
POWEROFF
PPADMAN PADMAN module for DESR systems used in its OSDSYS program.
PRMMAN2 RMMAN2 module for DESR systems used in its OSDSYS program.
PROMDRV ROMDRV module for DESR systems used in its OSDSYS program; code identical to IOPRP 2.8.0.
PS1DRV The PlayStation driver. Sets up the EE for GPU emulation and resets the IOP into PS1 mode.
PS1ID Only found in newer boot ROMs
PS1VER
PS1VERA
PS2LOGO Displays the PlayStation 2 logo from the inserted disc. For newer consoles, if the logo cannot be decrypted properly, it will fall back to the browser. Not actually required to boot games, but the Sony OSDSYS boots PS2 games through this program. on DECKARD Systems it is also in charge of operating rom0:XPARAM
PSDRDRV SDRDRV module for DESR systems used in its OSDSYS program.
PSIFCMD SIFCMD module for DESR systems used in its OSDSYS program; code identical to IOPRP 2.8.0.
PSIFMAN SIFMAN module for DESR systems used in its OSDSYS program; code identical to IOPRP 2.8.0.
PSIO2MAN SIO2MAN module for DESR systems used in its OSDSYS program.
PSTDIO STDIO module for DESR systems used in its OSDSYS program; code identical to IOPRP 2.8.0.
PSXVER Version of the ROM for DESR system.
PSYSCLIB SYSCLIB module for DESR systems used in its OSDSYS program; code identical to IOPRP 2.8.0.
PSYSMEM SYSMEM module for DESR systems used in its OSDSYS program; code identical to IOPRP 2.8.0.
PTHREADMAN THREADMAN module for DESR systems used in its OSDSYS program; code identical to IOPRP 2.8.0.
PTIMEMANI TIMEMAN module for DESR systems used in its OSDSYS program; code identical to IOPRP 2.8.0.
PXATAPI ATAPI driver for the (the DVD writer of the) PSX. TXATAPI is used by TESTMODE of the PSX.
PXFROMMAN Dev9 flash filesystem driver for DESR systems used in its OSDSYS program.
RDRAM Provides a RDRAM test for the EE at power-on. This is run from RESET.
RDRAM1 Needs to be at a fixed offset in ROM.
RDRAM2 Needs to be at a fixed offset in ROM.
REBOOT The reboot service. Receives IOP reset packets from the EE, from across the SIF.
RESET Bootstrap code for the EE and IOP. Needs to be at a fixed offset in ROM.
RMMAN ReMote-con MANager for the external IR receiver.
RMMAN2 ReMote-con MANager for the internal IR receiver (SCPH-50000 and later).
RMRESET ReMote controller reset.
ROMDIR The ROMDIR part of the ROM image.
ROMDRV ROM driver. Provides access to the boot ROM (rom0).
ROMGSCRT First appeared in ROM 1.60. Provides a portable method for manipulating GS screen modes. The SCPH-10000 and SCPH-15000 do not have this. Needs to be at a fixed offset in ROM.
ROMVER ROM version. specifies ROM version, console region letter, machine type letter and a date (presuably packing date?) Needs to be at a fixed offset in ROM.
S147CTRL System 147/148 control
S147MDEV System 147/148 storage manager providing the "atfile" device
S147NAND System 147/148 NAND/Flash driver interfaces with S147MDEV
S147NETB System 147/148 an986 USB-Ethernet network booting using driver files from "atfile10" filesystem provided by S147MDEV
S147USBM System 147/148 USB memory driver interfaces with S147MDEV
SBIN PS1 BIOS kernel memory COFF file. This is loaded into kernel memory at 0x80000500 (-0x90 header), and contain A0/B0/C0 vector handlers, and more. On real PS1 this code is located at 0xBFC10000, and later also copied to 0x80000500 during bios initialization.
SDRDRV Library for allowing the EE to remotely access the SPU2 via libsd.
SECRMAN Security Manager. Signing is NOT done with the one in ROM, but with a special version that comes with the utility discs. Debug stations , TOOL, and PS3 units have a different SECRMAN module from retail sets.

SECRMAN from System246/256 is the same than special secrman, but with an extra function wich performs the security dongle auth routine.

SIFCMD SIF command module. Contains the SIF command and SIF RPC functions.
SIFINIT Initializes the SIF.
SIFMAN SIF manager.
SIO2D
SIO2MAN SIO2 manager. Provides access to the SIO2 interface.
SNDBOOTB
SNDBOOTH
SNDBOOTS
SNDCLOKS
SNDIMAGE Sound image. Contains sounds for the OSDSYS of the SCPH-18000 and newer.
SNDLOGOS
SNDOSDDB
SNDOSDDH
SNDRCLKS
SNDTM60S
SNDTNNLS
SNDWARNS
SSBUSC SSBUS Controller library. The SSBUS seems to be the bus that all peripherals get connected to. It seems to have the power to control the mapping of the device registers, as well as access timing.
SSDATA
SSND Arcade sound driver. Uses the libspu2 library. System 246/256 exclusive, has debug symbols
STDIO Standard I/O library.
SYSCLIB System C Library.
SYSMEM System Memory Manager.
TBIN PS1 BIOS. This is started by RESET, when the IOP is in PS1 mode. Needs to be at a fixed offset in ROM.
TDEV9 Dev9 driver for the DESR used in TESTMODE.
TDVRDRV DVR Driver for the DESR used in TESTMODE.
TDVRMISC Miscellaneous DVR functionality driver for the DESR used in TESTMODE.
TESTMODE Test mode program. The EE will boot this module from EELOAD, if the console is put into service mode by the SONY service jig. For expansion bay sets, it is a device that goes into the expansion bay, but connects to the chassis from within it (it does not connect to the expansion connector).
TESTSPU Used by the TESTMODE program for testing the SPU. Depends on libsd.
TEXBARRW
TEXBBTTN
TEXBCDPB
TEXBCPAR
TEXBICHI
TEXBNAV1
TEXBNAV2
TEXBOVAL
TEXCBINV
TEXCBLUR
TEXCBUMP
TEXCFLOW
TEXCKABE
TEXCKLFN
TEXCKLFP
TEXCKLGN
TEXCKLGP
TEXCMARU
TEXCNAVI
TEXCREFA
TEXCSMOK
TEXCSTSL
TEXIMAGE Texture image. Contains textures for the OSDSYS of the SCPH-18000 and newer.
TEXOBLP
TEXOBLPR
TEXOCRBL
TEXOCRLE
TEXOFLAR
TEXOFOG0
TEXOFOG1
TEXOFOG2
TEXOFOG3
TEXOFOG4
TEXOPNGD
TEXOPNGE
TEXOPNGF
TEXOPNGG
TEXOPNGI
TEXOPNGP
TEXOPNGS
TEXOREF
TEXOSCE
TEXOWAL0
THMON Simple THread MONitor. Exists only in the late TOOL's ROM and system 246/256.
THPERF Found on the system 246/256 bios
THREADMAN IOP thread manager.
TIMEMANI Timer Manager (IOP mode)
TIMEMANP Timer Manager (PS mode)
TIOPIMG Modified IOPRP 2.8.0 used in DESR TESTMODE.
TPADMAN PADMAN used by rom0:TESTMODE.
TSIO2MAN SIO2MAN used by rom0:TESTMODE.
TXATAPI ATAPI driver for the (the DVD writer of the) PSX. TXATAPI is used by TESTMODE of the PSX.
TZLIST Timezone list, used by the OSD. Not present in the SCPH-10000 and SCPH-15000, which only saw a Japan-only release.
UDFIO UDF driver used by the DVD Player.
UDNL SilverBull calls this an UpDate DownLoader. Basically, it is responsible for selecting the modules and starting the IOP, during the final phase of the IOP reset where the desired modules are to be loaded into the IOP.
USBD USB driver, which shows up in System 2x6 systems.
VBLANK V-Blank management.
VERSTR Version string. I think that the PS1 ROM will use this because I learned that this string is also present in PlayStation consoles. Needs to be at a fixed offset in ROM.
XCDVDFSV CDVDFSV module used in OSDSYS.
XCDVDMAN CDVDMAN module used in OSDSYS.
XDEV9 A cut down version of DEV9 used in OSDSYS.
XDEV9SERV A RPC service for accessing the DEV9 driver directly. Presumably to obtain things like the MAC address.
XFILEIO FILEIO module used in OSDSYS.
XFLASH dev9 flash module used in OSDSYS. SCPH-50xxx exclusive
XFROMMAN dev9 flash filesystem module used in OSDSYS. SCPH-50xxx exclusive
XLOADFILE LOADFILE module used in OSDSYS.
XMCMAN MCMAN module used in OSDSYS.
XMCSERV MCSERV module used in OSDSYS.
XMTAPMAN Multi-Tap Manager. XMTAPMAN is used by the expansion bay OSDSYS program.
XPADMAN PADMAN module used in OSDSYS.
XPARAM Updated module. File store per title ID settings. OSDSYS call XPARAM to check ID list for currently executed game/app. If ID is found on list, settings/flags are applied.
XPARAM2 Updated module that seems to be used only in PS3. File store per title ID settings. OSDSYS call XPARAM2 to check ID list for currently executed game/app. If ID is found on list, settings/flags are applied.
XRMMAN2 Module handling the IR sensor controlled by the Mechacon, used in OSDSYS.
XSHA1 this only present in PS3. It is used as additional antipiracy check. It seems that it calculate disc main elf checksum and compares it with some database.
XSIFCMD SIFCMD module used in OSDSYS.
XSIO2MAN SIO2MAN module used in OSDSYS.

Description source: https://gist.github.com/uyjulian/25291080f083987d3f3c134f593483c5

Boot Process[edit | edit source]

Since ROM is mapped for both IOP and EE reset vectors at the same address (0xBFC00000), Sony implements cpu detection based on PRid COP0 register value. First thing executed by either IOP or EE is MFC0 fetching PRid and performing check if ID is 0x58 or lower, if true, r3000 code will run (branch to 0xBFC02000), otherwise r5900 code is executed (branch to 0xBFC00800). From there both cpus perform respective tasks with code compatible to cpu architecture they run already. IOP code performs few tasks like clearing caches and setting up them depending on if it is PS1/PS2 mode. Now checks 0xBF801450 bit 3 again for PS1/PS2 mode detection, and search in ROM for either IOPBOOT or TBIN and jump to execution of one of those files. TBIN is real PS1 rom, and from time when it is executed r3000 side acts like PS1 CPU. Worth to note that r3000 side of PS2 ROM perform additional check for PRid 0x0F or lower (real PS1) and jumps to TBIN without 0xBF801450 bit 3 PS1/PS2 mode detection. Which suggest that if we flash first 512KB of PS2 rom into PS1, hardware should be functional to at least run games.

Known Issues[edit | edit source]

Flush Cache t5/t6 corruption[edit | edit source]

PS1 mode FlushCache (A0:44) is altered comparing to one from PS1 bios. New version disables DMA by zero write to DCPR for the time when function run. This isn't issue per se, but to do that function use registers t5 and t6. While temp registers should be preserved by caller if needed, there is at least 1 game that rely on them to stay intact after returning from FlushCache. Mortal Kombat Trilogy (NTSC-U). This affect every PS2 model, also PS3 emulators since they use stripped PS2 bios to run PS1 games. Solution: On PS2 patch game image, on PS3 either patch game image or bios itself.