Bios

Content

Here is an overview of what is contained in a PS2 ROM (including TOOL, DESR/PSX, ps2emu/ps2gxemu/ps2softemu (PS3), System 246 and System 256). This list isn't finished yet, so add your comments below!

File	Description	Remarks
ACDEV	Arcade ROM device service.
ADDDRV	Adds support for the DVD ROM (rom1:), via ROMDRV.
ADDROM2	Adds support for rom2 (which contains a Chinese font file), only for Chinese consoles (SCPH-50009).
APPLOAD	IOP application loader (according to a printf string found on it). Seems to be an IRX module capable of running other IRX modules, since it processes modload return values and more	system 246/256 exclusive, has debug symbols and ELF header pointer to entrypoint is null for some reason.
ATAD	The DEV9+ATAD(+Flash device) combo driver. First appearing in ROM v1.10. Has no support for the CXD9566R. Despite its similar name, it is very different from the full ATAD module.
BNNETCNF	not entirely sure what this is for, but it appears in the PS3's PS2 ROMs. Seems to be for network configuration, but why?
BOARDINF	reads in the DSW602 board's ID and sets up the values for Boot Modes 6 and 7. Only does something useful on TOOL units.
BTNB01
BUILD
CDVDFSV	The RPC server for CDVDMAN.
CDVDMAN	The CD/DVD manager.
CLEARSPU	Seems to clear/reset the SPU, but is known to cause crashes under some conditions. Not sure if it's buggy or not. Only used by the OSDSYS of the SCPH-10000 and SCPH-15000, probably retained for backward-compatibility.
CMN01
CMN02
D2ELOADP	DECI2 ELOADP extension (ERX module support).
DAEMON	Security dongle check loop. basically imports the McDetectCard2 from MCMAN (export 22) and calls it once per minute	system 246/256 exclusive. Has debug symbols. listed on arcade IOPBTCONF but commented.
DBCMAN
DECI1	DECI1 manager. Purpose of its existence is not known.
DECI1DR1	DECI1 H1500 driver. Purpose unknown.
DECI1DRP	DECI1 PIF/mini-RA driver. Purpose unknown.
DECI2	DECI2 manager.
DECI2DRP	DECI2 PIF driver
DECI2DRS	DECI2 SIF2 driver.
DECI2FILE	DECI2 host (and TTY) driver.
DECI2HSYN	DECI2 Host SYNchronization driver. Notifies the DECI2 manager when the host interface (i.e. PIF) is up.
DECI2KPRT	DECI2 KTTY driver.
DECI2LOAD	DECI2 IOP module loader.
DECKARD	The SCPH-7500x has a newer PowerPC processor in place of the IOP, and requires code to emulate the IOP.
DMACMAN	DMA Controller Manager.
DVDCNF	Contains IOP boot configuration file for the DVD player.
DVDELF	DVD player executable for expansion-bay consoles.
DVDID	DVD player ID. SCPH-70000 (ROM v2.00) and later had universal DVD ROMs, hence the existence of DVDID* files for each region.
DVDIDA
DVDIDC
DVDIDE
DVDIDJ
DVDIDM
DVDIDO
DVDIDR
DVDIDU
DVDPLA	DVD player executable for slimlines. SCPH-70000 (ROM v2.00) and later had universal DVD ROMs, hence the existence of DVDPL* files for each region.
DVDPLC
DVDPLE
DVDPLJ
DVDPLM
DVDPLO
DVDPLR
DVDPLU
DVDVER	DVD player version number. SCPH-70000 (ROM v2.00) and later had universal DVD ROMs, hence the existence of DVDVER* files for each region.
DVDVERA
DVDVERJ
DVDVERR
EECONF	Loads part of the system configuration from the MECHACON EEPROM. Also configures and resets some peripherals, depending on the model version. In slimlines, EECONF will also load the MAC address.
EELOAD	The EE ELF loader, which is loaded by LoadExecPS2() to 0x00082000 for loading ELFs.
EELOADCNF	Contains the IOP boot configuration file for EELOAD.
EENULL	The idle thread (id #0) module, loaded to 0x00081FC0.
EESYNC	For synchronizing with the EE, at the end of IOP resets. EESYNC from DNAS images are evil; they also perform a memory wipe of the region from 0x00084000 to .0x00100000.
EROMDRV	Encrypted ROM DRIver for the expansion-bay PlayStation 2 sets.
EROMDRVA	Encrypted ROM DRIver for the SCPH-70000 (ROM v2.00) and later PlayStation 2 sets.
EROMDRVC
EROMDRVE
EROMDRVJ
EROMDRVM
EROMDRVO
EROMDRVR
EROMDRVU
ESDATA
EXCEPMAN	Exception manager.
EXTINFO	Contains the "EXTINFO" for all files in the ROM image.
FILEIO	RPC server for IOMAN. Sony has greatly changed the semantics and design of FILEIO after some point. Connecting an old FILEIO EE RPC client to a newer server will result in a severe IOP crash.
FNTASCII
FNTEX000
FNTEX001
FNTEXOSD
FNTIMAGE	Contains fonts for the OSDSYS of the SCPH-18000 and newer.
FONTM	The large FONT Module, used by the OSDSYS.
FONTS	The small FONT module, used by the OSDSYS.
GB18030	Chinese FONT module, replace FONTM. Loaded from rom2: on SCPH-50009	On PS2 that use it, this file is required to boot at all.
HDDLOAD	Update loader for the HDD unit (and later includes the flash device).
HDDOSD	Not sure what this does, but it is present in the expansion-bay ROMs.
HEAPLIB	Memory HEAP LIBrary (i.e. thvpool, thfpool).
HLPB01
HLPB02
HLPB03
HLPB04
HLPB05
HLPB06
HLPB07
HLPB08
HLPB09
HLPB10
HLPB11
HLPB12
HLPB13
HLPB14
ICOBCDDA
ICOBDISC
ICOBDVDD
ICOBFBRK
ICOBFNOR
ICOBFSCE
ICOBPKST
ICOBPS1D
ICOBPS1M
ICOBPS2D
ICOBPS2M
ICOBQUES
ICOBYSYS
ICOIMAGE	Contains icons for the OSDSYS of the SCPH-18000 and newer.
IGREETING	Displays boot information (i.e. IOP boot type, EBOOTP, IBOOTP, switch positions for DSW602 and the type of DSW602 board installed).
ILINK	i.Link driver	present in only the arcade ROMs.
ILSOCK	i.Link socket driver	present in only the arcade ROMs.
INTRMANI	Interrupt Manager. According to wisi, it is for IOP mode.
INTRMANP	Interrupt Manager. According to wisi, it is for PS mode. Never used.
IOMAN	I/O Manager.
IOPBOOT	IOP bootup program.
IOPBTCON2	Boot configuration file for the IOP, for the first phase of the IOP reset (before UDNL is loaded).
IOPBTCONF	Boot configuration file for the IOP, during the final phase of the IOP reset. If no UDNL module is specified, the IOP will only have a single IOP reset in the reboot process, with the modules listed in IOPBTCONF.
KERNEL	The EE kernel.
KROM	Kanji ROM? Not sure where this is used.
KROMG
LED	Led setter module, simply calls the mechacon NCMD that would switch the blue led on retail PS2s (sceCdApplySCmd: 0x1c) probably related to the system 2x6 watchdog	system 246/256 exclusive. Has debug symbols. listed on arcade IOPBTCONF but commented.
LGBB01
LGBB02
LGBB03
LGBB04
LGBB05
LIBFI	This is not present in the boot ROM of the SCPH-10000 and SCPH-15000.
LIBSD	Sound driver library.
LOADCORE	The core of IOP module loading. Provides the lowest level of IOP module loading functions. Also handles the startup of the IOP.
LOADFILE	The RPC server for MODLOAD.
LOGO	PS1 logo?
MBROWS	The browser module as a compressed EE raw binary. Only used by the old OSDSYS program from ROM v1.00 and v1.01.
MCLOCK	The clock module as a compressed EE raw binary. Only used by the old OSDSYS program from ROM v1.00 and v1.01.
MCMAN	Memory Card Manager. (DONGLEMAN on system 246/256)
MCMANO	MCMAN (Original).Probably the version of MCMAN wich was used to create DONGLEMAN, but without changes. only auths PS2 cards on mc1:/	system 246/256 exclusive
MCSERV	RPC server for MCMAN.
MODLOAD	IOP module loader.
MOPEN	The opening module as a compressed EE raw binary. Only used by the old OSDSYS program from ROM v1.00 and v1.01.
MSGB01
MSGB02
MSGB03
MSGB04
MSGB05
MSGB06
MSGB07
MSGB08
MSGB09
MSGB10
MSGB11
MSGB12
MSGB13
MTAP
NCDVDMAN	It is a strange abomination that was introduced and used with only the SCPH-70000 series, so it was probably provided for backward-compatibility. It seems to be a heavily stripped-down CDVDMAN module, with no support for some S-command functions like sceCdRI. I don't know why this was done, but it might be a deliberate move by Sony to prevent hackers from using these system functions. Didn't really do anything, however.
NUMB01
NUMB02
NUMB03
NUMB04
NUMB05
OLDROM	Contains a subset of ROM modules that are required for the late TOOL ROM to provide DEX-like functionality (i.e. old ROM modules).
OSBROWS	Contains metadata about the browser module. Used by the old OSDSYS program from ROM v1.00/v1.01.
OSCLOCK	Contains metadata about the clock module. Used by the old OSDSYS program from ROM v1.00/v1.01.
OSDCNF	Contains the IOP boot configuration for OSDSYS (mainly listing the X prefixed modules)
OSDSND	OSD sound library. This is actually the tentative sound driver, which is called "librspu2" in the Sony SDK. The funny thing about OSDSND from the SCPH-18000 and newer is that it's newer than the one in the Sony SDK, even at release v3.02.
OSDSYS	The browser.
OSDVER	Seems to be a build number for the OSD.
OSFONTM	Contains metadata about the large font. Used by the old OSDSYS program from ROM v1.00/v1.01.
OSFONTS	Contains metadata about the small font. Used by the old OSDSYS program from ROM v1.00/v1.01.
OSOPEN	Contains metadata about the opening module. Used by the old OSDSYS program from ROM v1.00/v1.01.
PADMAN	Pad manager.
PADMAN2
PATAD	ATAD module for DESR systems used in its OSDSYS program.
PCDVDFSV	CDVDFSV module for DESR systems used in its OSDSYS program.
PCDVDMAN	CDVDMAN module for DESR systems used in its OSDSYS program.
PDEV9	DEV9 module for DESR systems used in its OSDSYS program.
PEESYNC	EESYNC module for DESR systems used in its OSDSYS program.
PFILEIO	FILEIO module for DESR systems used in its OSDSYS program.
PFLASH	FLASH module for DESR systems used in its OSDSYS program.
PFLSLOAD	Flash load module for DESR systems used in its OSDSYS program.
PHDD	TIMEMAN module for DESR systems used in its OSDSYS program.
PHDDLOAD	HDDLOAD module for DESR systems used in its OSDSYS program.
PIOMAN	IOMAN module for DESR systems used in its OSDSYS program.
PIOPRP	IOPRP 3.1.0 used for the PS3 ps2_emu OSDSYS program.
PLIBSD	LIBSD module for DESR systems used in its OSDSYS program.
PLOADCORE	LAODCORE module for DESR systems used in its OSDSYS program.
PLOADFILE	LOADFILE module for DESR systems used in its OSDSYS program.
PMCMAN	MCMAN module for DESR systems used in its OSDSYS program.
PMCSERV	MCSERV module for DESR systems used in its OSDSYS program.
PMODHSYN	MODHSYN (part of CSL) module for DESR systems used in its OSDSYS program.
PMODLOAD	MODLOAD module for DESR systems used in its OSDSYS program.
PMODMIDI	MODMIDI module (part of CSL) for DESR systems used in its OSDSYS program.
PMODSESQ	MODSESQ module (part of CSL) for DESR systems used in its OSDSYS program.
PMTAPMAN	MTAPMAN module for DESR systems used in its OSDSYS program.
POWEROFF
PPADMAN	PADMAN module for DESR systems used in its OSDSYS program.
PRMMAN2	RMMAN2 module for DESR systems used in its OSDSYS program.
PROMDRV	ROMDRV module for DESR systems used in its OSDSYS program.
PS1DRV	The PlayStation driver. Sets up the EE for GPU emulation and resets the IOP into PS1 mode.
PS1ID	Only found in newer boot ROMs
PS1VER
PS1VERA
PS2LOGO	Displays the PlayStation 2 logo from the inserted disc. For newer consoles, if the logo cannot be decrypted properly, it will fall back to the browser. Not actually required to boot games, but the Sony OSDSYS boots PS2 games through this program. on DECKARD Systems it is also in charge of operating rom0:XPARAM
PSDRDRV	SDRDRV module for DESR systems used in its OSDSYS program.
PSIFCMD	SIFCMD module for DESR systems used in its OSDSYS program.
PSIFMAN	SIFMAN module for DESR systems used in its OSDSYS program.
PSIO2MAN	SIO2MAN module for DESR systems used in its OSDSYS program.
PSTDIO	STDIO module for DESR systems used in its OSDSYS program.
PSXVER	Version of the ROM for DESR system.
PSYSCLIB	SYSCLIB module for DESR systems used in its OSDSYS program.
PSYSMEM	SYSMEM module for DESR systems used in its OSDSYS program.
PTHREADMAN	THREADMAN module for DESR systems used in its OSDSYS program.
PTIMEMANI	TIMEMAN module for DESR systems used in its OSDSYS program.
PXATAPI	ATAPI driver for the (the DVD writer of the) PSX. TXATAPI is used by TESTMODE of the PSX.
PXFROMMAN	Dev9 flash filesystem driver for DESR systems used in its OSDSYS program.
RDRAM	Provides a RDRAM test for the EE at power-on. This is run from RESET.
RDRAM1
RDRAM2
REBOOT	The reboot service. Receives IOP reset packets from the EE, from across the SIF.
RESET	Bootstrap code for the EE and IOP.
RMMAN	ReMote-con MANager for the external IR receiver.
RMMAN2	ReMote-con MANager for the internal IR receiver (SCPH-50000 and later).
RMRESET	ReMote controller reset.
ROMDIR	The ROMDIR part of the ROM image.
ROMDRV	ROM driver. Provides access to the boot ROM (rom0).
ROMGSCRT	First appeared in ROM 1.60. Provides a portable method for manipulating GS screen modes. The SCPH-10000 and SCPH-15000 do not have this.
ROMVER	ROM version. specifies ROM version, console region letter, machine type letter and a date (presuably packing date?)
SBIN	PS1 BIOS kernel memory COFF file. This is loaded into kernel memory at 0x80000500 (-0x90 header), and contain A0/B0/C0 vector handlers, and more. On real PS1 this code is located at 0xBFC10000, and later also copied to 0x80000500 during bios initialization.
SDRDRV	Library for allowing the EE to remotely access the SPU2 via libsd.
SECRMAN	Security Manager. Signing is NOT done with the one in ROM, but with a special version that comes with the utility discs. Debug stations , TOOL, and PS3 units have a different SECRMAN module from retail sets. SECRMAN from System246/256 is the same than special secrman, but with an extra function wich performs the security dongle auth routine.
SIFCMD	SIF command module. Contains the SIF command and SIF RPC functions.
SIFINIT	Initializes the SIF.
SIFMAN	SIF manager.
SIO2D
SIO2MAN	SIO2 manager. Provides access to the SIO2 interface.
SNDBOOTB
SNDBOOTH
SNDBOOTS
SNDCLOKS
SNDIMAGE	Sound image. Contains sounds for the OSDSYS of the SCPH-18000 and newer.
SNDLOGOS
SNDOSDDB
SNDOSDDH
SNDRCLKS
SNDTM60S
SNDTNNLS
SNDWARNS
SSBUSC	SSBUS Controller library. The SSBUS seems to be the bus that all peripherals get connected to. It seems to have the power to control the mapping of the device registers, as well as access timing.
SSDATA
SSND	Arcade sound driver	System 246/256 exclusive, has debug symbols
STDIO	Standard I/O library.
SYSCLIB	System C Library.
SYSMEM	System Memory Manager.
TBIN	PS1 BIOS. This is started by RESET, when the IOP is in PS1 mode.
TDEV9	Dev9 driver for the DESR used in TESTMODE.
TDVRDRV	DVR Driver for the DESR used in TESTMODE.
TDVRMISC	Miscellaneous DVR functionality driver for the DESR used in TESTMODE.
TESTMODE	Test mode program. The EE will boot this module from EELOAD, if the console is put into service mode by the SONY service jig. For expansion bay sets, it is a device that goes into the expansion bay, but connects to the chassis from within it (it does not connect to the expansion connector).
TESTSPU	Used by the TESTMODE program for testing the SPU.
TEXBARRW
TEXBBTTN
TEXBCDPB
TEXBCPAR
TEXBICHI
TEXBNAV1
TEXBNAV2
TEXBOVAL
TEXCBINV
TEXCBLUR
TEXCBUMP
TEXCFLOW
TEXCKABE
TEXCKLFN
TEXCKLFP
TEXCKLGN
TEXCKLGP
TEXCMARU
TEXCNAVI
TEXCREFA
TEXCSMOK
TEXCSTSL
TEXIMAGE	Texture image. Contains textures for the OSDSYS of the SCPH-18000 and newer.
TEXOBLP
TEXOBLPR
TEXOCRBL
TEXOCRLE
TEXOFLAR
TEXOFOG0
TEXOFOG1
TEXOFOG2
TEXOFOG3
TEXOFOG4
TEXOPNGD
TEXOPNGE
TEXOPNGF
TEXOPNGG
TEXOPNGI
TEXOPNGP
TEXOPNGS
TEXOREF
TEXOSCE
TEXOWAL0
THMON	Simple THread MONitor. Exists only in the late TOOL's ROM and system 246/256.
THPERF	Found on the system 246/256 bios
THREADMAN	IOP thread manager.
TIMEMANI	Timer Manager (IOP mode)
TIMEMANP	Timer Manager (PS mode)
TIOPIMG	IOPRP 2.8.0x used in DESR TESTMODE.
TPADMAN	PADMAN used by rom0:TESTMODE.
TSIO2MAN	SIO2MAN used by rom0:TESTMODE.
TXATAPI	ATAPI driver for the (the DVD writer of the) PSX. TXATAPI is used by TESTMODE of the PSX.
TZLIST	Timezone list, used by the OSD. Not present in the SCPH-10000 and SCPH-15000, which only saw a Japan-only release.
UDFIO	UDF driver used by the DVD Player.
UDNL	SilverBull calls this an UpDate DownLoader. Basically, it is responsible for selecting the modules and starting the IOP, during the final phase of the IOP reset where the desired modules are to be loaded into the IOP.
USBD	USB driver, which shows up in System 2x6 systems.
VBLANK	V-Blank management.
VERSTR	Version string. I think that the PS1 ROM will use this because I learned that this string is also present in PlayStation consoles.
XCDVDFSV	CDVDFSV module used in OSDSYS.
XCDVDMAN	CDVDMAN module used in OSDSYS.
XDEV9	A cut down version of DEV9 used in OSDSYS.
XDEV9SERV	A RPC service for accessing the DEV9 driver directly. Presumably to obtain things like the MAC address.
XFILEIO	FILEIO module used in OSDSYS.
XFLASH	dev9 flash module used in OSDSYS.	SCPH-50xxx exclusive
XFROMMAN	dev9 flash filesystem module used in OSDSYS.	SCPH-50xxx exclusive
XLOADFILE	LOADFILE module used in OSDSYS.
XMCMAN	MCMAN module used in OSDSYS.
XMCSERV	MCSERV module used in OSDSYS.
XMTAPMAN	Multi-Tap Manager. XMTAPMAN is used by the expansion bay OSDSYS program.
XPADMAN	PADMAN module used in OSDSYS.
XPARAM	Updated module. File store per title ID settings. OSDSYS call XPARAM to check ID list for currently executed game/app. If ID is found on list, settings/flags are applied.
XPARAM2	Updated module that seems to be used only in PS3. File store per title ID settings. OSDSYS call XPARAM2 to check ID list for currently executed game/app. If ID is found on list, settings/flags are applied.
XRMMAN2	Module handling the IR sensor controlled by the Mechacon, used in OSDSYS.
XSHA1	this only present in PS3. It is used as additional antipiracy check. It seems that it calculate disc main elf checksum and compares it with some database.
XSIFCMD	SIFCMD module used in OSDSYS.
XSIO2MAN	SIO2MAN module used in OSDSYS.

Description source: https://gist.github.com/uyjulian/25291080f083987d3f3c134f593483c5

Boot Process

Since ROM is mapped for both IOP and EE reset vectors at the same address (0xBFC00000), Sony implements cpu detection based on PRid COP0 register value. First thing executed by either IOP or EE is MFC0 fetching PRid and performing check if ID is 0x58 or lower, if true, r3000 code will run (branch to 0xBFC02000), otherwise r5900 code is executed (branch to 0xBFC00800). From there both cpus perform respective tasks with code compatible to cpu architecture they run already. IOP code performs few tasks like clearing caches and setting up them depending on if it is PS1/PS2 mode. Now checks 0xBF801450 bit 3 again for PS1/PS2 mode detection, and search in ROM for either IOPBOOT or TBIN and jump to execution of one of those files. TBIN is real PS1 rom, and from time when it is executed r3000 side acts like PS1 CPU. Worth to note that r3000 side of PS2 ROM perform additional check for PRid 0x0F or lower (real PS1) and jumps to TBIN without 0xBF801450 bit 3 PS1/PS2 mode detection. Which suggest that if we flash first 512KB of PS2 rom into PS1, hardware should be functional to at least run games.

Known Issues

Flush Cache t5/t6 corruption

PS1 mode FlushCache (A0:44) is altered comparing to one from PS1 bios. New version disables DMA by zero write to DCPR for the time when function run. This isn't issue per se, but to do that function use registers t5 and t6. While temp registers should be preserved by caller if needed, there is at least 1 game that rely on them to stay intact after returning from FlushCache. Mortal Kombat Trilogy (NTSC-U). This affect every PS2 model, also PS3 emulators since they use stripped PS2 bios to run PS1 games. Solution: On PS2 patch game image, on PS3 either patch game image or bios itself.