Editing Talk:PS2 Emulation

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
==Game CONFIG commands (notepad and worklog)==
==Game CONFIG commands (notepad and worklog)==
Moved to [[Talk:PS2_Emulation/PS2_Config_Commands]]
All info here related with commands needs to be moved to frontpage at some point
==XMB messages related with PS2 Emulation==
 
{{Boxcode|title=explore_category_sysconf.rco\Text\English.xml|code=<syntaxhighlight lang="xml">
===ps2_netemu command 0x1===
  <Text name="msg_ps_ps2_upconvert">PS/PS2 - Upscaler</Text>
There are some additional internal patches using CONFIG cmd id 0x01, using subs not available in 0x3B list
  <Text name="msg_ps_upconvert">PS - Upscaler</Text>
condition: 0xBBB5F800, 0x3B949C00, 0x42133A90
   
setting:
  <Text name="msg_ps_ps2_smoothing">PS/PS2 - Smoothing</Text>
  0x18E1F0, sub_4670C (4.70)
  <Text name="msg_ps_smoothing">PS - Smoothing</Text>
  0x348EC8, sub_44338 (4.70)
  <Text name="msg_ps_ps2_smoothing_explanation">Reduces the roughness of the displayed image.</Text>
 
</syntaxhighlight>}}
====Function Mapping====
 
ps2_netemu.self contains a table (with entry_length=8 and entry_number=variable) where are listed the function offsets used by config command 0x01
{{Boxcode|title=game_ext_plugin.rco\Text\English.xml|code=<syntaxhighlight lang="xml">
 
This table is used to assign a funct_id to a funct_offset. The funct_id is given by the position of the entry in the table, so the first entry in the table is funct_id=0x00, second entry is funct_id=0x01 and so on
 
The purpose of this table is to be able use the same funct_id values in the external CONFIG files for netemu, this way even if the func_offset changes in between versions (internally inside the ps2_netemu.self file structure) the funct_id will be the same. The other ps2 emulator types doesnt have this table (doesnt needs it because doesnt uses external CONFIG files)
 
 
*funct_offset_table location by ps2_netemu versions:
**Table v1 (the table contains the same data)
***Firmware:370-374 offset:0x897ED8 length:0x1C8
**Table v2 (the table contains the same data)
***Firmware:400-401 offset:0x8970E8 length:0x1C8
**Table v3 (the table contains the same data)
***Firmware:410-411 offset:0x8971E8 length:0x1C8
***Firmware:420-425 offset:0x8972F8 length:0x1C8
**Table v4
***Firmwares 4.30 up to 4.76 was not tested (if someone wants to add this info do it here)
**Table vX (latest)
***Firmware:478-488 offset:0x8063f8 length:0x1E0
 
Example from ps2_netemu.self 4.88
<pre>
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 
008063F0                          00 00 00 00 00 04 2F 70          ....../p
00806400  00 00 00 00 00 04 30 34 00 00 00 00 00 04 47 C0  ......04......GÀ
00806410  00 00 00 00 00 04 46 E0 00 00 00 00 00 04 33 84  ......Fà......3„
00806420  00 00 00 00 00 04 74 5C 00 00 00 00 00 04 6D 20  ......t\......m
00806430  00 00 00 00 00 04 7C 1C 00 00 00 00 00 04 31 00  ......|.......1.
00806440  00 00 00 00 00 04 31 D8 00 00 00 00 00 04 34 48  ......1Ø......4H
00806450  00 00 00 00 00 04 35 20 00 00 00 00 00 04 45 E8  ......5 ......Eè
00806460  00 00 00 00 00 04 45 0C 00 00 00 00 00 04 44 30  ......E.......D0
00806470  00 00 00 00 00 04 42 54 00 00 00 00 00 04 41 70  ......BT......Ap
00806480  00 00 00 00 00 04 40 8C 00 00 00 00 00 04 60 FC  ......@Œ......`ü
00806490  00 00 00 00 00 04 35 E4 00 00 00 00 00 04 7F C4  ......5ä.......Ä
008064A0  00 00 00 00 00 04 5A 1C 00 00 00 00 00 04 55 90  ......Z.......U.
008064B0  00 00 00 00 00 04 6A DC 00 00 00 00 00 04 5F A8  ......jÜ......_¨
008064C0  00 00 00 00 00 04 7A 88 00 00 00 00 00 04 5C 6C  ......zˆ......\l
008064D0  00 00 00 00 00 04 54 C0 00 00 00 00 00 04 53 F0  ......TÀ......Sð
008064E0  00 00 00 00 00 04 53 20 00 00 00 00 00 04 52 50  ......S ......RP
008064F0  00 00 00 00 00 04 51 80 00 00 00 00 00 04 50 B0  ......Q€......P°
00806500  00 00 00 00 00 04 4F E0 00 00 00 00 00 04 4F 10  ......Oà......O.
00806510  00 00 00 00 00 04 4E 40 00 00 00 00 00 04 4D 70  [email protected]
00806520  00 00 00 00 00 04 4C A0 00 00 00 00 00 04 4B D0  ......L ......KÐ
00806530  00 00 00 00 00 04 4B 00 00 00 00 00 00 04 4A 30  ......K.......J0
00806540  00 00 00 00 00 04 49 60 00 00 00 00 00 04 48 90  ......I`......H.
00806550  00 00 00 00 00 04 66 2C 00 00 00 00 00 04 71 14  ......f,......q.
00806560  00 00 00 00 00 04 6F 9C 00 00 00 00 00 04 6E 24  ......oœ......n$
00806570  00 00 00 00 00 04 59 2C 00 00 00 00 00 04 58 48  ......Y,......XH
00806580  00 00 00 00 00 04 57 64 00 00 00 00 00 04 56 80  ......Wd......V€
00806590  00 00 00 00 00 04 75 60 00 00 00 00 00 00 00 00  ......u`........
008065A0  00 00 00 00 00 04 62 18 00 00 00 00 00 04 36 B4  ......b.......6´
008065B0  00 00 00 00 00 04 7D 28 00 00 00 00 00 04 72 98  ......}(......r˜
008065C0  00 00 00 00 00 04 76 74 00 00 00 00 00 04 6B D4  ......vt......kÔ
008065D0  00 00 00 00 00 04 3F AC                          ......?¬
</pre>
 
{| class="wikitable" style="float:left; font-size:xx-small; line-height:100%; margin:5px"
! colspan="5" | netemu 0x01 !! gxemu 0x00 !! softemu 0x00
|-
! [[3.70_CEX|3.70]]~{{latestPS3}} !! [[3.70_CEX|3.70]]~[[3.74_CEX|3.74]] !! [[4.00_CEX|4.00]]~[[4.01_CEX|4.01]] !! [[4.10_CEX|4.10]]~[[4.25_CEX|4.25]] !! [[4.78_CEX|4.78]]~[[4.88_CEX|4.88]] !! [[4.78_CEX|4.78]]~[[4.82_CEX|4.82]] !! [[3.72_CEX|3.72]]~[[4.01_CEX|4.01]]
|-
! funct_id !! funct_offset !! funct_offset !! funct_offset !! funct_offset !! funct_offset !! funct_offset
|-
| 0x00 || 0x46720 || 0x42E00 || 0x42EB8 || 0x42F70 || 0x36B40 || 0x2FEF0
|-
| 0x01 || 0x42DB0 || 0x42EC4 || 0x42F7C || 0x43034 || 0x35FB0 || 0x31E38
|-
| 0x02 || 0x44394 || 0x4456C || 0x44560 || 0x447C0 || 0x34068 || 0x30220
|-
| 0x03 || 0x442B4 || 0x4448C || 0x44480 || 0x446E0 || 0x34144 || 0x302FC
|-
| 0x04 || 0x43100 || 0x43214 || 0x432CC || 0x43384 || 0x33F98 ? || 0x30150
|-
| 0x05 || 0x46A90 || 0x46DB4 || 0x47184 || 0x4745C || 0x36CF8 || 0x31D08
|-
| 0x06 || 0x46D64 || 0x46AE0 || 0x46934 || 0x46D20 || 0x34224 || 0x303DC
|-
| 0x07 || 0x47134 || 0x47154 || 0x47524 || 0x47C1C || 0x37850 ||
|-
| 0x08 || 0x42E7C || 0x42F90 || 0x43048 || 0x43100 || 0x33DFC<!--0x33E00 ? (old)--> || 0x2FFB4
|-
| 0x09 || 0x42F54 || 0x43068 || 0x43120 || 0x431D8 || 0x36C04 || 0x31C14
|-
| 0x0A || 0x431C4 || 0x432D8 || 0x43390 || 0x43448 || 0x36EF0 || 0x31FCC
|-
| 0x0B || 0x4329C || 0x433B0 || 0x43468 || 0x43520 || 0x34354 ||
|-
| 0x0C || 0x441BC || 0x44394 || 0x44388 || 0x445E8 || 0x34424 || 0x30518
|-
| 0x0D || 0x440E0 || 0x442B8 || 0x442AC || 0x4450C || 0x34520 ||
|-
| 0x0E || 0x44004 || 0x441DC || 0x441D0 || 0x44430 || 0x345FC || 0x306F0
|-
| 0x0F || 0x43E28 || 0x44000 || 0x43FF4 || 0x44254 || 0x365F0 || 0x31124
|-
| 0x10 || 0x43D44 || 0x43F1C || 0x43F10 || 0x44170 || 0x36510 || 0x31044
|-
| 0x11 || 0x43C64 || 0x43E3C || 0x43E30 || 0x4408C || 0x36430 || 0x30F64
|-
| 0x12 || 0x45CD4 || 0x45EAC || 0x46EA0 || 0x460FC || 0x34DD0<!--0x366C4 ? (old)--> || 0x311F8<!--0x30C28 ? (old)-->
|-
| 0x13 || 0x469C0 || 0x43474 || 0x46864 || 0x435E4 || 0x366C4 || 0x30C28
|-
| 0x14 || 0x4777C || 0x4779C || 0x478CC || 0x47FC4 || 0x34EDC || 0x31304
|-
| 0x15 || 0x455F0 || 0x457C8 || 0x457BC || 0x45A1C || 0x3795C || 0x327B4
|-
| 0x16 || 0x45164 || 0x4533C || 0x45330 || 0x45590 || 0x3521C || 0x31580
|-
| 0x17 || 0x468C8 || 0x469DC || 0x4676C || 0x46ADC || 0x347D0 || 0x308C4
|-
| 0x18 || 0x45B80 || 0x45D58 || 0x45D48 || 0x45FA8 || 0x35300<!--0x373FC ? (old)--> || 0x31664
|-
| 0x19 || 0x4706C || 0x46FC0 || 0x4745C || 0x47A88 || 0x36E28 || 0x31F04
|-
| 0x1A || 0x45844 || 0x45A1C || 0x45A0C || 0x45C6C || 0x37614 || 0x325B4
|}
 
{| class="wikitable" style="float:left; font-size:xx-small; line-height:100%; margin:5px"
! colspan="5" | netemu 0x01 !! gxemu 0x00 !! softemu 0x00
|-
! [[3.70_CEX|3.70]]~{{latestPS3}} !! [[3.70_CEX|3.70]]~[[3.74_CEX|3.74]] !! [[4.00_CEX|4.00]]~[[4.01_CEX|4.01]] !! [[4.10_CEX|4.10]]~[[4.25_CEX|4.25]] !! [[4.78_CEX|4.78]]~[[4.88_CEX|4.88]] !! [[4.78_CEX|4.78]]~[[4.82_CEX|4.82]] !! [[3.72_CEX|3.72]]~[[4.01_CEX|4.01]]
|-
! funct_id !! funct_offset !! funct_offset !! funct_offset !! funct_offset !! funct_offset !! funct_offset
|-{{cellcolors|#ddddff}}
| 0x1B || 0x45094 || 0x4526C || 0x45260 || 0x454C0 || 0x35434 || 0x31798
|-{{cellcolors|#ddddff}}
| 0x1C || 0x44FC4 || 0x4519C || 0x45190 || 0x453F0 || 0x354F8 || 0x30A88
|-{{cellcolors|#bbbbff}}
| 0x1D || 0x44EF4 || 0x450CC || 0x450C0 || 0x45320 || 0x355BC ||
|-{{cellcolors|#bbbbff}}
| 0x1E || 0x44E24 || 0x44FFC || 0x44FF0 || 0x45250 || 0x35680 ||
|-{{cellcolors|#ddddff}}
| 0x1F || 0x44D54 || 0x44F2C || 0x44F20 || 0x45180 || 0x35744 ||
|-{{cellcolors|#ddddff}}
| 0x20 || 0x44C84 || 0x44E5C || 0x44E50 || 0x450B0 || 0x35808 ||
|-{{cellcolors|#bbbbff}}
| 0x21 || 0x44BB4 || 0x44D8C || 0x44D80 || 0x44FE0 || 0x358CC ||
|-{{cellcolors|#bbbbff}}
| 0x22 || 0x44AE4 || 0x44CBC || 0x44CB0 || 0x44F10 || 0x35990 ||
|-{{cellcolors|#ddddff}}
| 0x23 || 0x44A14 || 0x44BEC || 0x44BE0 || 0x44E40 || 0x35A54 ||
|-{{cellcolors|#ddddff}}
| 0x24 || 0x44944 || 0x44B1C || 0x44B10 || 0x44D70 || 0x35B18 ||
|-{{cellcolors|#bbbbff}}
| 0x25 || 0x44874 || 0x44A4C || 0x44A40 || 0x44CA0 || 0x35BDC ||
|-{{cellcolors|#bbbbff}}
| 0x26 || 0x447A4 || 0x4497C || 0x44970 || 0x44BD0 || 0x35CA0 ||
|-{{cellcolors|#ddddff}}
| 0x27 || 0x446D4 || 0x448AC || 0x448A0 || 0x44B00 || 0x35D64 ||
|-{{cellcolors|#ddddff}}
| 0x28 || 0x44604 || 0x447DC || 0x447D0 || 0x44A30 || 0x35E28 ||
|-{{cellcolors|#bbbbff}}
| 0x29 || 0x44534 || 0x4470C || 0x44700 || 0x44960 || 0x35EEC ||
|-{{cellcolors|#bbbbff}}
| 0x2A || 0x44464 || 0x4463C || 0x44630 || 0x44890 || 0x35158 ||
|-
| 0x2B || 0x467E4 || 0x463DC || 0x46688 || 0x4662C || 0x34994 ||
|-
| 0x2C || 0x465D0 || 0x464B4 || 0x46D28 || 0x47114 || 0x36FC8 ||
|-
| 0x2D || 0x47384 || 0x473A4 || 0x46BB0 || 0x46F9C || 0x3607C ||
|-
| 0x2E || 0x47234 || 0x47254 || 0x46A38 || 0x46E24 ||  ||
|-
| 0x2F || 0x45500 || 0x456D8 || 0x456CC || 0x4592C || 0x34A70 ||
|-
| 0x30 || 0x4541C || 0x455F4 || 0x455E8 || 0x45848 || 0x34B48 ||
|-
| 0x31 || 0x45338 || 0x45510 || 0x45504 || 0x45764 || 0x34C20 ||
|-
| 0x32 || 0x45254 || 0x4542C || 0x45420 || 0x45680 || 0x34CF8 ||
|-
| 0x33 || 0x46E74 || 0x46EB8 || 0x47288 || 0x47560 || 0x37714 ||
|-
| 0x34 || {{cellcolors|#CC5555}} 0x00000 || {{cellcolors|#CC5555}} 0x00000 || {{cellcolors|#CC5555}} 0x00000 || {{cellcolors|#CC5555}} 0x00000 ||  ||
|-
| 0x35 || 0x45DF0 || 0x45FC8 || 0x46274 || 0x46218 ||  ||
|-
| 0x36 || 0x4336C || 0x43544 || 0x43538 || 0x436B4 ||  ||
|-
| 0x37 || 0x474E0 || 0x47500 || 0x47630 || 0x47D28 ||  ||
|-
| 0x38 || 0x46BA0 || 0x46BF0 || 0x46FC0 || 0x47298 ||  ||
|-
| 0x39 || {{no}} || {{no}} || {{no}} || 0x47674 ||  ||
|-
| 0x3A || {{no}} || {{no}} || {{no}} || 0x46BD4 ||  ||
|-
| 0x3B || {{no}} || {{no}} || {{no}} || 0x43FAC ||  ||
|}{{clear}}
 
====Function 0x0D====
What is the purpose of this function? Could it be used as a potential fix for the various DMA issues (similar to the EE timing hack in PCSX2)? I may be wrong, but I think the majority of netemu's emulation problems are caused by DMA issues, which are unfortunately hard to fix.
* This hack allow to run all spe cores while doing nothing on ppe side. Is like giving spe more time (100 msec). This can be used to fix some timing issues here or there. But if you know game offset that you want to use it, you probably can already fix it in different way. Also this probably won't affect "emulation cycles", so is not like pcsx2 EE timing hack. About pcsx2 EE timing hack.. This is really stupid hack if you ask me. Hack make all events listed [[https://github.com/PCSX2/pcsx2/blob/5bdec2f532e94065655032eb6cf7f7715c075e3b/pcsx2/R5900.h#L403 here]] to take 8 cycles. No matter that really it was 1, or 2000 cycles, it will make all of that 8 cycles. Idea of that hack is not bad itself, but it is terrible implementation that make a lot of things random. I think that ps2 emu on ps4 do this much better, as you can select only one event, and set cycles for it. While on pcsx2 if you want DMAC_FROM_IPU to take 8 cycles, you also make ALL OTHER events to take 8 cycles. I don't know how lucky that hack is to not break other stuff. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 07:47, 12 March 2022 (UTC)
 
====Function 0x12====
The 0x4FC500 EE memory offset is not hardcoded, isn't it? Since this hook fixes other Traveller's Tales games, like Wrath of Cortex, the memory offset should be taken from the opcode itself (if I remember correctly, it is "load word from global pointer").--[[User:Agrippa|Agrippa]] ([[User talk:Agrippa|talk]]) 11:48, 2 October 2022 (UTC)
*Fun(?)fact, it is hardcoded.
oris r0, r0, 0x204F
ori r0, r0, 0xC500.
But i think i know what happen. hook land here (on finding nemo):
lw          $s0, dword_4FC500
bnez        $s0, loc_187568
Notice that config beside 0x4FC500, set $s0 to zero. And here is another fun fact. At least on Nemo this is only place that read from that address. Making patch to 4FC500 meaningless, and not really needed. Assuming that other game doesn't use that exact address, this config is just additionally corrupting some random thing at 0x4FC500. I think that is probably the case also for other Nemo games. To be honest that config can be replaced to just nop that branch there and should do exactly the same thing. ¯\_(ツ)_/¯ --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 12:23, 2 October 2022 (UTC)
** Hmm, or not exactly the same thing as it also check that COP0 and DMAC stuff. Anyway, i think that patch to EE address do nothing there.
*** NET config for Finding Nemo (SLES-51755) seems to have a 0x42 replacement for 0x01 hook, including the COP0 and D_STAT checks you have mentioned.--[[User:Agrippa|Agrippa]] ([[User talk:Agrippa|talk]]) 13:33, 2 October 2022 (UTC)
 
====Function 0x35====
''Ninkyouden: Toseinin Ichidaiki'' (SLPM-66274) is using command 0x1 with function 0x35 at 0x13ED94...it seems like its executed at the VSync function of the game. This hook is also not in gxemu judging from the table above. No immediate change with or without the command that I can tell. Any idea on what this is doing?
* Function check some bits in GIF, but i don't know what exactly (offset 0x300/0x310 in fe SPU). When bits are 0 command end. When bits are not 0, PPU side of PS3 sleeps 256 cycles, and then check again fe SPU. That loop won't ends unless bits are 0. Just small tip about hooks that are close to VSync. This is not always related to VSync per se. Of course can be, but don't really need to. I mean, if you want to run hook in predictable place, and with similar time steps. VSync is where you hook game code then. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 05:31, 22 August 2022 (UTC)
** Yes, I first thought it would be VSync related, but I figured it could be something executed at every VSync like you said. Thanks for checking in on this hook. I am thinking of testing games like Tenchu: Wrath of Heaven and Street Fighter EX3 with this hook to see if anything changes (at least Tenchu's issue is directly related to GIF, SFEX3 not too sure). --[[User:Mrjaredbeta|Mrjaredbeta]] ([[User talk:Mrjaredbeta|talk]]) 00:54, 23 August 2022 (UTC)
 
===ps2_netemu command 0x5===
The external config format used by ps2_netemu.self doesnt supports command ID 0x5. But this same command with a different ID (0x4) was used by this game configs embedded inside ps2_gxemu.self: Grand Theft Auto: Liberty City Stories (SLES-54135, SLES-54136, SLUS-21423), Grand Theft Auto: Vice City Stories (SLES-54622, SLES-54623, SLUS-21590), Hunter: The Reckoning Wayward (SLES-51823), Onimusha: Dawn of Dreams (SLPM-66275), Shinseiki Evangelion: Ayanami Ikusei Keikaku with Asuka Hokan Keikaku (SLPM-65340), Tekken Tag Tournament (SLUS-20001). The reason why this command is not supported in the external config files is because the related emulator code is enabled permanently in ps2_netemu.self for all games
 
This command patches EEDMA SPE program during emulator init (0x1F77C in latest netemu) to set different handling for DIRECT/DIRECTHL VIF1 commands. Weird solution, wasn't better to just change pointers in spe program instead of patching that on init?
* Is there any way to patch the emulator to prevent that command to apply? I wonder if it is affecting the behaviour of some games.--[[User:Agrippa|Agrippa]] ([[User talk:Agrippa|talk]]) 20:00, 11 March 2022 (UTC)
** Yeah, you can patch it on decrypted emu.
Find
91 48 00 00 90 09 00 1C 90 09 00 10 90 09 00 14 90 09 00 18 90 0b 00 1C 90 0b 00 10 90 0b 00 14 90 0b 00 18
Replace
91 48 00 00 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00 60 00 00 00
 
And find
E9 42 8C 20 3C 00 00 01 60 00 72 80 E9 2A 00 00
replace
4E 80 00 20 3C 00 00 01 60 00 72 80 E9 2A 00 00
 
Now you need to encrypt it with scetool, using original emu as a template.
scetool --template orig_ps2_netemu.self --sce-type=SELF --compress-data=TRUE --encrypt ps2_netemu.elf ps2_netemu.self
Remember to delete netemu from flash, then copy new one. Overwriting can fail as there is not enough space on dev_flash. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 07:35, 12 March 2022 (UTC)
 
===ps2_netemu command 0x0B===
 
SRS:Street Racing Syndicate - sector to patch: 3021/1392496 (1.03) or 1402736 (2.00), offset correction: no, PCSX2 log:
CDRead: Reading Sector 0003021 (008 Blocks of Size 2048) at Speed=4x(CAV) Spindle=83
WRC: Rally Evolved - sector to patch: 3235/1792256 (1.01), offset correction: no, PCSX2 log:
CDRead: Reading Sector 0003235 (008 Blocks of Size 2048) at Speed=4x(CAV) Spindle=83
Notice the CDRead command instead of DvdRead.
* Not sure this is the case here. But PCSX2 have bug in fastboot, where it always fallback to CDRead for few first reads. To confirm you can launch game with fastboot disabled, pcsx2 now should read those sectors with proper mode. At the second hand.. Maybe that's what happen on PS3? Probably no, as far as i know netemu bios perform something similar to fullboot. But maybe, sony can break unbreakable, and this actually seems to be reasonable explanation. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 05:18, 22 August 2022 (UTC)
** That is how it does look like on the newest PCSX2 build at the moment of posting it. It does use a CDRead for few reads after loading an ELF file, even in the full boot mode. --[[User:Agrippa|Agrippa]] ([[User talk:Agrippa|talk]]) 17:27, 22 August 2022 (UTC)
Emulator does panic itself, when two separate 0x0B commands are used.--[[User:Agrippa|Agrippa]] ([[User talk:Agrippa|talk]]) 20:25, 15 November 2022 (UTC)
 
===ps2_netemu command 0x0C===
 
These pairs of parameters: 0x0001 and 0x0400; 0x0001 and 0x0800; 0x0001 and 0x0180 fix few missing sound effects in the Klonoa 2. The side effect is slightly longer loading times in general. This game is known for its various audio buffer issues related to the CDVD speed.
* I actually suspected this can be some delay for reads, but default value is (1, 0x1000) so doesn't really fit for delay. Since Shadowman 2 use it, and have known CD issue. Testing Shadowman2 without config can be interesting, if i'm right there will be a lot of broken textures right after you take control of main character. With broken Shadowman2 it will be easy to know that lower values are "better" or higher values are "better". That should help to understand what's going on. Assuming that SM2 really break without config... --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 19:10, 3 March 2022 (UTC)
** Tested Shadowman with and without config. No texture corruption either way, but it seems like the config helps with frame rate issues maybe caused by streaming in contents from the disc? Either that or placebo. --[[User:Mrjaredbeta|Mrjaredbeta]] ([[User talk:Mrjaredbeta|talk]]) 02:39, 4 March 2022 (UTC)
*** Well that's "unfortunate" because Shadowman2 would be perfect test case here. I noticed that Shadowma2 have hardcoded bios settings "CDVD_READ_DELAY", so maybe is handled there. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 19:11, 4 March 2022 (UTC)
 
It seems like this command can further improve FMVs that still have stuttering issues with command 0x21 enabled. The Fear's opening FMVs are heavily improved with command 0x21 set at 1, but there is still some video slowdown and audio stuttering and popping remaining. With the addition of command 0x0C set to 0x1 and 0x400, the slowdown and stutter is completely fixed. I have only tested 0x400 as a value so far.
 
The ingame FMVs with the graphic overlay are still stuttering heavily, though, and I am still unsure why. It seems like the shorter FMVs run fine, and the longer they are they more they have slowdown/stutter. This only applies to the "ingame" FMVs and not the opening ones.
 
I did some work on it, and it seems to modify read speed. Higher values should give faster read speed. Eventually higher values will give more frequent event checks, but read speed modifier seems to be more probable now when we know default values. To get faster read speed we should use (1, x > 0x400) for CD, and (1, x > 0x1000) for DVD. At this point Shadowman 2 is good test candidate again, just with some really high value. All configs from GX emu looks like they slowing down reads, because values for DVD are below 0x1000, Shadowman2 without config doesn't change anything because this config use default value... Burnout 3 is interesting here, only config that seems to use 0 (yolo read speed) option. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 22:24, 3 July 2023 (CEST) <br>
void MECHA_on_state_3(__int64* mecha)
{
  ReadSectorSize = *(mecha + 0x70);
  if ( !ReadSectorSize )
    panic(1u);
   
  do
    current_tb = get_current_timebase()
  while ( !current_tb );
 
  readed_sectors_count = readed_size_in_bytes / ReadSectorSize;
  readed_sectors_count_mul_by_79800000 = 79800000LL * readed_sectors_count
  tb_for_seek_and_read = *(mecha + 0x18);
  skip = current_tb - tb_for_seek_and_read >= readed_sectors_count_mul_by_79800000 / val_from_cmd_0x0C_1)
 
  if ( cmd_0x0C_0 != 1 || val_from_cmd_0x0C_1 == 0 || skip )
  {
    if ( *(mecha + 0xD4) <= BytesToRead && !*(mecha + 0xE4) )
    {
      *(mecha + 0xD4) = readed_size_in_bytes;
      *mecha_state = 4; // Reading done here. Going to next step.
      return;
    }
    panic(1u);
  }
  set_scheduler(
    5uLL,                                                                              // 5 - CDVD event
    tb_for_seek_and_read + readed_sectors_count_mul_by_79800000 / val_from_cmd_0x0C_1,  // When
    &syscall8_200,                                                                      // Event Handler.
    0LL);                                                                              // unk
}
 
* Netemu does crash when the first param is set to 0x2.--[[User:Agrippa|Agrippa]] ([[User talk:Agrippa|talk]]) 21:03, 7 July 2023 (CEST)
** No idea why, function that check config compare to 2 and panic if greater than. So '''2''' is accepted at least there. This config is used in 4 places. All of them use next part of config only if this one is '''1'''. 3 places check explicitly for '''1''', one place check for '''0'''. Setting '''2''' is weird from code point of view because it's almost like 0, but allow code to do one check in read function, and to be honest this doesn't look like intentional behavior because similar check is performed earlier in previous N command state, and there is handled properly including setting 1F402006 to error code instead of panic. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 22:31, 7 July 2023 (CEST)
 
===ps2_netemu command 0x12===
 
====type 1====
Playground discussion, unsure about clrlslwi  r11, r0, 16,3 result
 
<pre>
Syphon Filter The Omega Strain
298  00 00 00 00
29C  00 00 00 00
2A0  01 00>02 00< Type1, Count 2
2A4  31 00 99 18 
2A8  32 00 B6 18
 
 
type 1: (Syphon Filter The Omega Strain )
*0x48  | ptr to 1st value *0x2A4 (0x15F)
*0x50  | count of type values
 
        (0x18990031 >> 0xC) & 0xFFFF0 = 0x18990
        (0x18B60032 >> 0xC) & 0xFFFF0 = 0x18B60
 
store value in [0x18990 + ??? ]
seg017:0000000000198498 next_value:                            # CODE XREF: read_id0x12_type_1+120�j
seg017:0000000000198498                lwz      r0, 0(r10)    # -> 0x18990031
seg017:000000000019849C                addi      r8, r8, 1    # counter
seg017:00000000001984A0                ld        r29, 0(r31)
seg017:00000000001984A4                addi      r10, r10, 4  # ptr to next value
seg017:00000000001984A8                rlwinm    r28, r0, 20,12,27 # r28 = (r0 >> 12) & 0xFFFF0 = (0x18990031 >> 12) & 0xFFFF0 = 0x18990
seg017:00000000001984AC                clrlslwi  r11, r0, 16,3 # r11 = 0x0031 << 3 = 0x188
seg017:00000000001984B0                add      r26, r28, r29 # r26 = 0x18990 + ??
seg017:00000000001984B4                stw      r11, 4(r26)  # store 0x62000? or 0x188? in r26
seg017:00000000001984B8                lwz      r5, 0x50(r31) # count
seg017:00000000001984BC                cmplw    cr6, r5, r8
seg017:00000000001984C0                bgt      cr6, next_value
</pre>
<br>
Leaving old info for now as it have good explanation of code itself. Command patch vu0_jit_data memory directly. For example above patch will write 0x188 to 0x1C018994 address. vu0 jit mem hold info about microprograms, like how many cycles will run, where program start/end, where is ebit, etc. For now is unknown which info is patched, but shift by 3 suggest it will be vu0 address related info. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 12:23, 14 June 2023 (CEST)
 
====type 2====
 
Fix for interlocking/synchronization EE with VU0 in micro mode. Usually used with games that are m bit sensitive, or loop endlessly on VU0 due to lack of sync with EE core.
 
<pre>
Primal
298  00 00 00 04
29C  00 00 00 00 
2A0  02 00>03 00< Type 2, Count 3
2A4  5F 01 00 00
2A8  8D BD 6F 2C
2AC  67 03 00 00 
2B0  02 00>03 00< Type 2, Count 3
2B4  6B 01 00 00
2B8  31 35 70 E9
2BC  72 03 00 00 
2C0  03 00>02 00< Type 3, Count 2
2C4  60 9B 39 10
2C8  18 9C 39 10
2CC
 
type 2:
*0x20C | counter
*0x210 | 1st value: 0x15F      -> only gets compared, if passed check 2nd value
*0x214 | 2nd value: 0x2C6FBD8D -> only gets compared, if passed use *0x218 + *0x21C
*0x218 | 1 ( = count - 2)
        *0x21C | ptr to 3rd value *0x2AC (0x367)
 
First value is VU0 microprogram start address, multiply by 8 to get correct offset in VU0 micro mem. That one is confirmed,
and you can check CMSAR0 register status in pcsx2 when EE hit address from type 3 command to make sure. Now some guessing.
Second value is probably hash of microprogram (from start address to e bit end).
Third value can be run cycles before program is force stopped, for example to wait on m bit for EE side to catch, or to stop endless
loop that normally should already end if VU0 didn't run ahead of EE.
Fourth and next values if available can be run cycles for next program runs.
A lot of guessing here. But looking at games that use it, there is high possibility that is correct.
This command is always used with type 3, or 4. This is probably not required, but without notifying EE side type 2 is useless.
</pre>
 
====type 3====
 
<pre>
Example Primal
*0x11B4| counter
*0x11B8| -1 -> 0x399B60?
*0x11BC| 0 -> 0x399B60?
*0x11C0| ptr to *0x2C4 values
*0x11C4| count (2)
 
r11 = r0 & 0xFFFFFFF = 0x10399B60 & 0xFFFFFFF = 0x399B60
0x10399C18 & 0xFFFFFFF = 0x399C18
 
r3 = r31 >> 28 = 0x10399B60 >> 0x1C = 1
a check if 1,2
</pre>
 
====type 4====
 
        cmpwi    cr7, r0, 4
        bne      cr7, panic_dword_1967BC
        srwi      r9, r6, 1    # r9 = r6 >> 1 = count >> 1
        addi      r11, r4, 4
        stw      r9, 0x1238(r31) save count>>1
        std      r11, 0x1240(r31) save ptr to table values start
 
One correct entry is 2x 32 bit. First 32 bits are EE Opcode in little endian, second 32 bits are the same as first 4 bits of type 3 (interlocking). This type of config work in conjunction with type 2 config, and was required because R&C series use EE memory overlays. So type 3 config can't be used here as EE offset change per game level.
 
Here is alternative config for Rayman 3 (SLUS_206.01), this time using type 4 instead of 3. Just to confirm above is true. Untested, because i have no ability to do that.
<pre>
12 00 00 00 0C 00 00 00 00 00 00 04 00 00 00 00
02 00 04 00 00 00 00 00 AE B3 4E 5D 20 02 00 00
46 02 00 00 04 00 04 00 00 30 D3 48 01 00 00 00
00 30 C8 48 01 00 00 00
</pre>
 
===ps2_netemu command 0x17===
This command is used only in Bully which is only known game by R* Vancouver, there is a chance that is only game which need it. But just in case, what game do is MTC0 $zero, Count <br>
And read that at some point. Since we are in recompiler, count is updated only on events. This can create situation where game retrieve 0 value from count reg. Which according to pcsx2 source is wrong ([[https://github.com/PCSX2/pcsx2/blob/b3590430c97e8df170df0c00ebf466ce848edbf9/pcsx2/COP0.cpp#L56 | referred as TIMR]]). To be honest I'm not 100% sure that is issue here. Only other problem i can imagine is potential divide by 0 in emu itself. Anyway, if game do MTC0 zero, Count (00 48 80 40), or any weird operations with Count. This config should be tested.
 
===ps2_netemu command 0x21===
Well, i don't know where to start.. This command with param 0 or 1 at some point prevent writes to TagLo register. Not with MTC0 tho, but during different opcode that is handled separately. I got this unresolved yet, but it seems that is CACHE opcode. That potentially mean ps2_netemu support some parts of instruction cache. But this need to be tested on real hardware. Good candidate here is WRC4. When command 0x21 with 0 or 1 is added to standard config, game should fail to load at all (unless game getting lucky like described in emu bugs section).
*I assume the cache handling would be the cause for games panicking/shutting down when 0x21 is set at 0? I cannot remember correctly if WRC panics (Agrippa would know better), but games like Shadow Hearts 2/3 will shut down after loading a save when instructions are being loaded in the EE memory from outside the main executable. My mind is blanking on other games besides those two, but surely a handful of games I have tested have had shutdowns caused by this command.--[[User:Mrjaredbeta|Mrjaredbeta]] ([[User talk:Mrjaredbeta|talk]]) 20:13, 1 October 2022 (UTC)
** Yes, since that command disable cache handling only partially. There could be some unexpected issues. Problem is that 0x21 do little bit more, and little bit weird. Not gonna lie, cache is new territory for me since i never worked with any emu that support it. PCSX2 support good chunk of cache, but only in interpreter mode, and usually i just patched games to not rely on cache. This is what i got for now.
*** If my memory serves me right:
**** WRC4 - panic at the loading of stages (0x21-0)
**** VP2 - panic at the switching to the battle mode (0x21-0) or player models fail to load in the battle mode (0x21-1)
**** MGS3 - frame rate improvement, at the expense of awfully longer loading times (0x21-0).--[[User:Agrippa|Agrippa]] ([[User talk:Agrippa|talk]]) 11:40, 2 October 2022 (UTC)
**Since it’s worth mentioning, 0x21 set to 0 also fixes the camera angle issue in Radiata Stories after one or two battle sequences.--[[User:Mrjaredbeta|Mrjaredbeta]] ([[User talk:Mrjaredbeta|talk]]) 15:02, 2 October 2022 (UTC)
***I think the issue is not related to the camera at all. It looks similar to the VP2 case I posted earlier - the models fail to load on the post battle screen (shadows are drawn, though). Moreover, various models do disappear for a second in the battle mode too, if I remember correctly. Just a guess, as both games share the same engine.--[[User:Agrippa|Agrippa]] ([[User talk:Agrippa|talk]]) 18:22, 4 October 2022 (UTC)
I messed little bit with this code today, and 0x21_1, plus 0x03 at the same time seems to be most aggressive combo to remove instruction cache emulation. Not sure about compatibility, but this two configs together skip most cache code in emulator. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 10:21, 21 October 2022 (UTC)
*Quick test with this, random game (ATV Offroad Fury 4). It seems like 0x21_0 still gave a better improvement to menu FMV playback/stutter than 0x21_1 and 0x03. I didn't notice any change in performance with 0x21_1 in this scenario. Caching is still enabled with IHIN/IXIN with 0x21_0?--[[User:Mrjaredbeta|Mrjaredbeta]] ([[User talk:Mrjaredbeta|talk]]) 00:15, 22 October 2022 (UTC)
**Whoops, sorry i meant 0x21_0 and 0x03. 0x21_1 actually create a lot of additional recompiled code. 0x21_0 is so fast because it skips lookup for cached addresses also outside of general cache opcodes (that how it looks like, i need to do little bit more work here). IHIN/IXIN (hit/index invalidation) can be totally disabled only with 0x03. 0x21 (0/1) still generate a lot of code for IHIN/IXIN when 0x03 is not used, even more that without 0x21. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 06:53, 22 October 2022 (UTC)
***Okay, that makes sense. It is difficult to tell if adding 0x03 with 0x21_0 made any difference with this game as FMV is fixed with just 0x21_0, but it may be beneficial to test games that still have FMV playback issues with 0x21_0 enabled (slight desync still with Shadow Hearts).--[[User:Mrjaredbeta|Mrjaredbeta]] ([[User talk:Mrjaredbeta|talk]]) 15:05, 22 October 2022 (UTC)
<br><br>'''Emotion Engine Cache support'''<br>
Apparently, emulator support some parts of cache. More precisely instruction cache. Implementation seems to be simple and not 100% accurate, and there is no data cache support (obviously - speed). Still impressive there is something at all in recompiler.
 
'''Supported opcodes:'''
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"
|-
! Opcode || Info
|-
|r5900 CACHE BXLBT ||  Unsupported, store 0 on COP0 TagLo and TagHi
|-
|r5900 CACHE DXLDT ||  Unsupported, store 0 on COP0 TagLo
|-
|r5900 CACHE DXLTG || Unsupported, store 0 on COP0 TagLo
|-
|r5900 CACHE IXLDT ||  Unsupported, store 0 on COP0 TagLo
|-
|r5900 CACHE IXLTG ||  Supported, cmd 0x21 (0,1) skip function and store 0 on COP0 TagLo
|-
|r5900 CACHE DXWBIN || Not supported at all, empty function.
|-
|r5900 CACHE DXIN  ||  Not supported at all, empty function.
|-
|r5900 CACHE DHWBIN || Not supported at all, empty function.
|-
|r5900 CACHE DHIN  ||  Not supported at all, empty function.
|-
|r5900 CACHE DHWOIN || Not supported at all, empty function.
|-
|r5900 CACHE IHIN  ||  Full support, cmd 0x21 (0,1) change path of that opcode, 0x03 practically skip whole op.
|-
|r5900 CACHE IXIN  ||  Full support, cmd 0x21 (0,1) change path of that opcode, 0x03 practically skip whole op.
|-
|r5900 CACHE misc  ||  Do something, but function is little bit complicated to tell for now that it is something that make sense.
|}
--[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 21:03, 1 October 2022 (UTC)
 
Example of recompiled code with enabled cache emulation:  https://pastebin.com/sDwc1MLX
* Every operation with r15 and following r7/r8 loads, compares, and cr operations will be skipped by emitter with 0x21 --> 0
* r15 is loaded with current address (page?), to get full value shift it left by 6 eg.  0x808710 << 6 = 0x2021C400 (shift left by 6 = multiplying by 0x40)
* For small part of code posted on pastebin, cache check is performed 33 times * 8 opcodes = 264 opcodes from 801 are cache checks! A lot of work, a lot of code mostly for nothing.
* Conclusion. Use 0x21 --> 0 whenever you can. iCache emulation is pointless for 99% of games.
* Small oftopic. Every opcode that write to r13 increase emulated cycles. Every opcode writing to r14 modify current r5900 pc. Every branch to 0x3800 mean that event test will be performed.
* Problematic games (have issues with 0x21 enabled): Shadow Hearts 3, Jak & Daxter, VP2, Hot Shots series, Kingdom Hearts. Any game that load additional code overlays and do that custom way, for example Shadow Hearts 3 load code from bin files hidden in cpx files. All those games doesn't really need iCache emulation to work, but emulator seems to have issue with code invalidation. Only small amount of games used this method of loading, so it still should be fine for 99% of games.
--[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 07:32, 22 May 2023 (CEST)
* Radiata does not crash. English patch for FFXII IZJS does crash though (0x21 fixes stuttering in turbo mode).--[[User:Agrippa|Agrippa]] ([[User talk:Agrippa|talk]]) 20:33, 22 May 2023 (CEST)
** Whoops, my bad. Fixed. :P --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 09:44, 23 May 2023 (CEST)
*** Actually, the icache invalidation issues could explain why the infamous Maori VP2 overlay anti-protection patch is not working on the netemu.--[[User:Agrippa|Agrippa]] ([[User talk:Agrippa|talk]]) 22:14, 15 June 2023 (CEST)
**** His patch is basically self modifying code, so its possible. You can try cmd 0x01 with 0x0E subcommand hook at 0x01feb1c0. This invalidate whole mem every time offset is hit, ensuring that new code that is written from patcher is not in conflict with cache. Also remember that 0x42 is applied only on syscall 7, so if game modify 0x1feb1c0 - 0x1feb2e0 region, it will wipe patcher. And games often memzero whole data memory right after start. This issue don't exist on pcsx2 because it will reapply it on next vsync, while on netemu only 0x09/0x0A patches are reapplied. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 15:37, 16 June 2023 (CEST)
 
===ps2_netemu command 0x22===
Weird command. Sets something 1 (CDVD/MECHA), but seems to never use it.
 
===ps2_netemu command 0x28===
This command is heavily stripped version of command from gxemu. On netemu only option that seems to change anything is 0. From what i gathered in emu, when set to 0 SEEK ncmd will to be ignored and instant command ack is set. When 0 is used cdvd.SeekToSector is not updated from NCMD params. For emulated vm this mean next read command will perform seek to sector from position where last read end. Not sure if i'm understanding that correctly, it seems to be very hacky solution.
 
After some more work, its either skip seek, or make seek instant. Still a hack, but may give some loading boosts here and there (and break a lot of stuff too).
 
===ps2_netemu command 0x2A===
Any idea what this command is doing? It seems to be directly related to IPU. I thought it only fixed black screen issues on certain games, but it also fixes Mystery Mayhem’s glitching/freezing/stuttering FMVs.
* This config skip check of another value, which finally make one of functions to never run. This affect "SYS" thread, and value that is checked seems to be related to EE/COP2 recompilers (pure guess by addresses that write there...). Nothing related directly to IPU, that's for sure. But this is part of emu that i have basically untouched, so i can't tell what its really skipped here. Function that is skipped trigger other functions which read cached mips code. So maybe something related to recompiler flushing, or constant propagation. Hard to tell at this point. For sure this is something i want to look more into, but not yet. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 05:56, 8 July 2022 (UTC)
** Gotcha. So, I guess it is indirectly affecting the IPU? Or at least something EE/COP2 touches after IPU stuff. The current games that this command fixes are: All Star Baseball 2004 (GX config), Scooby-Doo! Mystery Mayhem (fixes repeating audio and FMV slowdown), Pro Evolution Soccer 6 (PAL v2.00 and NTSC-J only, unneeded in other versions, fixes black screen after opening FMV), and SCORE International Baja 1000 (fixes black screen after career mode FMV). These are all the currently known uses of the command. --[[User:Mrjaredbeta|Mrjaredbeta]] ([[User talk:Mrjaredbeta|talk]]) 02:15, 10 July 2022 (UTC)
 
===ps2_netemu command 0x2E===
Without this command applied there is a black screen and no sound after the PS2LOGO, but the game (Growlanser Generations) is working in the background. Pressing the "PS" button fixes it. After applying this command (0x172 parameter) everything works correctly.
* this (like most "mecha" commands) is messing with timing.
lwz      r0, 0x2C(r31)          # cmd_0x2E
cmpwi    cr7, r0, 0
beq      cr7, cdvd_error_1349B4  # skip cdvd error if cmd not 0.
nop
loc_134988:
mftb      r9
cmpwi    cr7, r9, 0
beq      cr7, loc_134988        # Loop until timebase is not 0
clrldi    r0, r0, 32
add      r0, r0, r9
li        r9, 5
std      r0, 0x20(r31)          # cmd_0x2E + timebase
stw      r9, 0(r31)
b        end_134844
Value from 0x20(r31) is later used in compare. That result in cdvd error, or in setting which seems schedule event to happen after time from timebase pass. This event is netemu syscall 8 (0x200) which is related to all ps2 cdvd reads. Tl;dr is that value give emulator some more time before cdvd error. Weird thing is that PS button fix it.. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 07:05, 7 March 2022 (UTC)
 
===ps2_netemu command 0x4D===
Leaving this here just in case. Fixed comments version.
0xD7F8 RGBAQ_01_and_11:
0xD7F8
0xD800 move      r80, r3              ; move new values to r80
0xD820 ilhu      r19, 0x7FFF
0xD824 lqr      r20, Q_val_cfg_plus4
0xD82C iohl      r19, 0xFFFF
0xD834 and      r17, r80, r19        ; r17 = Q & 0x7FFFFFFF
0xD840 ceqi      r15, r17, 0          ; if r17 == 0, r15 = 0xFFFFFFF, else 0
0xD844 lqr      r10, ST_Q
0xD84C cwd      r9, 0x30+var_30+8(sp) ; Prepare correct write
0xD850 rotqbyi  r16, r20, 4          ; load cmd value from config to r16
0xD858 and      r12, r15, r16        ; r15 & value_from_cfg
0xD860 or        r5, r80, r12          ; r80(Q) | r12(value from cfg or 0)
0xD868 shufb    r7, r5, r10, r9      ; select ST bits + new Q
0xD870 stqr      r7, ST_Q              ; store result as Q value in STQ
 
===ps2_gxemu command 0x19===
Command disable reads/writes to selected IOP HW registers. Disabled regs are:
 
* 0x10000000 - 0x10003FFF (DEV9/SPEED/ATA/SMAP)
* 0x1F801460 - 0x1F80147F (Unknown)
 
Command is auto applied to titles listed here (duplicates are really there in emu too):
    Hash          ID                Name
0x0CD1298155  SLES_540.13  World Snooker Championship 2007
0x12C93199A5  SLES_518.40  NHL Hitz Pro
0x15C93199AD  SLES_549.13  Pro Evolution Soccer 2008
0x24D92589A5  SLUS_211.86  NBA Ballers - Phenom
0x2CD12D8125  SLUS_212.35  MLB 2K6
0x34C9359935  SLUS_211.38  X-Men Legends II - Rise of Apocalypse
0x34C93599E5  SLUS_211.28  Blitz - The League
0x34C93599E5  SLUS_211.28  Blitz - The League
0x449961C9E5  SLES_542.10  NBA 2K7
0x4C9169C1CD  SLES_542.46  FIFA '07
0x4C9169C1D5  SLES_542.45  NHL '07
0x4C9169C1DD  SLES_542.44  FIFA '07
0x4C9169C1E5  SLES_542.43  FIFA '07
0x4C9169C1F5  SLES_542.41  FIFA '07
0x4C9169C1FD  SLES_542.40  FIFA '07
0x4CB14DE12D  SLUS_213.74  Marvel - Ultimate Alliance
0x54A955F915  SLUS_212.74  Outrun 2006 - Coast 2 Coas
0x5CA15DF165  SLUS_213.01  World Series of Poker
0x5CA15DF1FD  SLUS_212.86  WWE SmackDown! vs RAW 2006
0x5CA15DF1FD  SLUS_212.86  WWE SmackDown! vs RAW 2006
0x649965C94D  SLUS_214.63  Tom Clancy's Ghost Recon 2
0x649965C955  SLUS_214.60  NBA Live '07
0x649965C95D  SLUS_214.61  NASCAR '07
0x649965C965  SLUS_214.58  NHL '07
0x649965C96D  SLUS_214.59  NCAA Football '07
0x6BB149E15D  SLES_531.04  Tom Clancy's Rainbow Six - Lockdown
0x6C916DC165  SLUS_214.91  World Series of Poker - Tournament of Champions
0x6C916DC1A5  SLUS_214.83  Tiger Woods PGA Tour '07
0x6C916DC1AD  SLUS_214.82  NFL Street 3
0x6C916DC1B5  SLUS_214.81  NCAA March Madness '07
0x6C916DC1D5  SLUS_214.77  Madden NFL '07 [Hall of Fame Edition]
0x6C916DC1DD  SLUS_214.76  Madden NFL '07
0x748975D9DD  SLUS_213.83  Fight Night - Round 3
0x7C817DD125  SLUS_214.33  FIFA Soccer '07
0x7C817DD165  SLUS_214.25  NHL 2K7
0x7C817DD16D  SLUS_214.24  NBA 2K7
0x7C817DD175  SLUS_214.27  WWE SmackDown! vs RAW 2007
0x7C817DD1CD  SLUS_214.12  World Championship Poker featuring Howard Lederer - All-In
0x84798529BD  SLUS_205.65  Champions of Norrath
0x8559A109AD  uuunnnnnkkk 
0x8579852915  SLUS_215.68  Arena Football - Road to Glory
0x8579852965  SLUS_215.82  MVP '07 - NCAA Baseball
0x8D51A90145  SLES_545.11  UEFA Champions League
0x8D51A901B5  SLES_545.13  UEFA Champions League
0x8D51A901BD  SLES_545.12  UEFA Champions League
0x8D718D21BD  SLUS_216.20  NCAA Football '08
0x9C619D31E5  SLUS_205.41  NBA Ballers
0x9D41B911AD  SLES_544.48  World Series of Poker - Tournament of Champions
0x9D619D31C5  SLUS_215.61  Major League Baseball 2K7
0x9F29357805  SCUS_975.44  NBA '07 featuring The Life Vol.2
0x9F293578E5  SCUS_975.56  MLB '07 - The Show
0xB549B51915  SLUS_216.38  Madden NFL '0
0xB549B51925  SLUS_216.32  NHL 2K8
0xB549B5195D  SLUS_216.47  NHL '08
0xB549B519A5  SLUS_216.48  FIFA Soccer '08
0xB549B519AD  SLUS_216.49  NBA Live '08
0xBC61793025  SCES_532.85  Ratchet - Gladiator
0xBD41BD1105  SLUS_216.69  NBA 2K8
0xC439C569F5  SLUS_208.20  Tom Clancy's Ghost Recon - Jungle Storm
0xC7716D20D5  SCUS_974.01  Hot Shots Golf FORE!
0xC7716D20D5  SCUS_974.01  Hot Shots Golf FORE!
0xCA11E941F5  SLES_516.97  SSX 3
0xCF7965285D  SCUS_973.53  Ratchet and Clank - Up Your Arsenal
0xCF7965285D  SCUS_973.53  Ratchet and Clank - Up Your Arsenal
0xD20911582D  SCES_515.93  Hardware Online Arena [Beta, Promo & Full Release]
0xD7617D308D  SCUS_973.28  Gran Turismo 4
0xE339C1695D  SLES_525.45  Star Wars Battlefront
0xE794CCB06D  PCPX_980.42  Minna no Tennis
0xEA3129608D  SCES_515.78  Network Access Disc [Original, v4.02 & v4.03]
0xEC11ED4115  SLUS_209.73  Champions - Return to Arms
0xEF594508D5  SCUS_975.00  MLB '06 - The Show
0xF409F559AD  SLUS_208.89  MLB Slugfest - Loaded
0xF7415D10E5  SCUS_974.65  Ratchet - Deadlocked
0xF7415D10E5  SCUS_974.65  Ratchet - Deadlocked
As a result config disable HDD/NET capabilities.
 
==XMB messages related with PS2 Emulation==
{{Boxcode|title=explore_category_sysconf.rco\Text\English.xml|code=<syntaxhighlight lang="xml">
  <Text name="msg_ps_ps2_upconvert">PS/PS2 - Upscaler</Text>
  <Text name="msg_ps_upconvert">PS - Upscaler</Text>
   
  <Text name="msg_ps_ps2_smoothing">PS/PS2 - Smoothing</Text>
  <Text name="msg_ps_smoothing">PS - Smoothing</Text>
  <Text name="msg_ps_ps2_smoothing_explanation">Reduces the roughness of the displayed image.</Text>
</syntaxhighlight>}}
 
{{Boxcode|title=game_ext_plugin.rco\Text\English.xml|code=<syntaxhighlight lang="xml">
  <Text name="msg_error_cannot_play_ps2disc_scee">This title is not currently compatible with the PS3™ system. Please visit faq.eu.playstation.com/bc for a list of PlayStation®2 format software titles that are compatible, and to update the System Software that will enable your PS3™ system to play additional PlayStation®2 format software titles.</Text>
  <Text name="msg_error_cannot_play_ps2disc_scee">This title is not currently compatible with the PS3™ system. Please visit faq.eu.playstation.com/bc for a list of PlayStation®2 format software titles that are compatible, and to update the System Software that will enable your PS3™ system to play additional PlayStation®2 format software titles.</Text>
  <Text name="msg_error_cannot_play_ps2disc_scea">This title is not currently compatible with the PS3™ system. If you update your system software the title may become compatible with your system. Please visit http://www.us.playstation.com/Support/CompatibleStatus to check whether a specific PlayStation®2 format software title is compatible with the PS3™ system.</Text>
  <Text name="msg_error_cannot_play_ps2disc_scea">This title is not currently compatible with the PS3™ system. If you update your system software the title may become compatible with your system. Please visit http://www.us.playstation.com/Support/CompatibleStatus to check whether a specific PlayStation®2 format software title is compatible with the PS3™ system.</Text>
Line 1,266: Line 1,882:


== Emu Patches ==
== Emu Patches ==
===Remove PCRTC Blur for Netemu===
Adds new config 0x4F (no param) which disables PCRTC blur offset which many games use. Patch additionally changes debug menu entry XOR CSR to NO BLUR setting. XOR CSR from file CONFIG is unaffected and still work as expected. I decided to add this entry in menu because it's nice way to compare how good this setting is when game use blur offset. While games which need XOR CSR have very obvious screen corruptions so there is no need for "live" view for it. New config obviously not work on HEN, but CONFIG files which include 0x4F work fine on HEN, command is just skipped, this keeps configs compatible with all current hacks. Big thanks to mrjaredbeta for testing all of this!
Under the hood code compares DISPLAY1 and DISPLAY2 registers and when DX and DY difference is not greater than 6 it mirrors DISPLAY1 to DISPLAY2. Many checks are added to prevent false detection: PMODE need to have enabled 2 circuits, any of DISPLAY registers can't be all 0's, etc. Detection also works for different DW/DH, for games like Soul Calibur 3. Results really vary per game, many games stays unaffected because they modify OFFSET by GIF 0x18/0x19 commands. Good example of game that is nicely improved is Kingdom Hearts 2.
<br><br>Patch is for Evilnat 4.90 ps2_netemu.elf file.
<br>https://www.mediafire.com/file/s83lt9zkwlyhpc2/No_Blur.ppf/file
<br><br>MD5 before patch is applied:
70D22D79A5BB876B8EA2D0FE55D046C7
MD5 after patch is applied:
0B632F05371215AA6BE2C976924737AE
Preview:
https://ibb.co/9sSjmCm (default netemu)
https://ibb.co/G7t11Nq (No Blur enabled)


===Display current PC/RA values for r5900===
===Display current PC/RA values for r5900===
Line 1,372: Line 1,975:
  B452CCB51348127DAF8A931B621E5E39
  B452CCB51348127DAF8A931B621E5E39
DL: https://www.mediafire.com/file/kpno5mubyy7q9p0/gx_cfg_ext.ppf/file
DL: https://www.mediafire.com/file/kpno5mubyy7q9p0/gx_cfg_ext.ppf/file
===Patch System Manager to allow PS2 emulators Fan Control===
Patch is for LV1 file, should be 4.75+ but it's based on 4.78 LV1 file. '''Don't try to modify your LV1 without hardware flasher!''' This patch enables ability to get fan readings and to set fan speed and policy. This patch doesn't implement fan controls from webman to work in ps2 mode, additional code needs to be patched on PS2 emulators side to make something useful from it.
Search for (4.78 LV1):
E8 03 01 C8 54 00 05 EE  2F A0 00 00 41 9E 00 E4
Replace to (4.78 LV1):
E8 03 01 C8 54 00 05 EE  2F A0 00 00 60 00 00 00
==Inject LIBSD into netemu Bios==
This patch improves compatibility with homebrew. Many homebrews still need hex edits and supplying X modules on disc. But this patch takes care of LIBSD at least. For example, Multiloader 1.41 with midi player mod now works out of the box.
Offsets for unpacked elf file.
0x893470: string TBIN --> LIBSD
0x8DC200: Paste LIBSD file here (Ctrl-B in HxD to overwrite old data).
TBIN file which is replaced is not used in PS2 mode, we can safely patch it. Same can be done for other emulators, just need correcting offsets.


== SPE programs dumper ==
== SPE programs dumper ==
Line 1,397: Line 1,984:
== Random ps2_netemu notes ==
== Random ps2_netemu notes ==


* Some members of pcsx2 team think that emulator is heavily based on early pcsx2. After some reversing this seems to be far away from true. But COP2 and VU0 (and only that for now) really are familiar here and there. To the point where i was able to use pcsx2 code to find names/usage of some variables (mVUbranch for example). But VU0/COP2 is for now only part that have obvious pcsx2 similarities. For example VU1 is different story, and don't even share code with VU0 part of emulator as far as i see.
* Emulator not only patch SPU programs on init, but also patch own PPU code. Which is hard to understand when you can just make changes in source code... eg. 0x1F128 - 0x1F134 in latest emu.
* Emulator not only patch SPU programs on init, but also patch own PPU code. Which is hard to understand when you can just make changes in source code... eg. 0x1F128 - 0x1F134 in latest emu.
* GUI seems to be tied to GIF/GS emulation. That research was inspired by Dolphin progress report, and it seems to be correct. Fe/be (frontend/backend) spus are involved here. Which explain some UI slowdowns on GIF intensive games.
* GUI seems to be tied to GIF/GS emulation. That research was inspired by Dolphin progress report, and it seems to be correct. Fe/be (frontend/backend) spus are involved here. Which explain some UI slowdowns on GIF intensive games.
* Emulator is full of unused functions. Everything that is compiled inline its also there as separate unreachable function.
* Emulator is full of unused functions. Everything that is compiled inline its also there as separate unreachable function.
* DEV9 registers are not implemented. Reads return 0, writes are void. In simple words Net and PS2 HDD emulation is impossible. Fun fact is that emu perform meaningless check for HDD supported titles.
* USB registers are IMPLEMENTED and seems to be fully functional on ppe and spe side. We are missing something else here, not sure what.
===Registers===
===Registers===
It seems that emulator try to keep lower 64 bits of some r5900 registers in specific ppc registers. At least at the time when recompiler is running, also when 0x01 command run.
It seems that emulator try to keep lower 64 bits of some r5900 registers in specific ppc registers. At least at the time when recompiler is running, also when 0x01 command run.
Line 1,441: Line 2,027:
  Register that handle ACC is taken from different pool (same pool as all vfXX regs when in COP2 mode) with param 32 as reg nr (not real reg, probably part of one of vXX regs).
  Register that handle ACC is taken from different pool (same pool as all vfXX regs when in COP2 mode) with param 32 as reg nr (not real reg, probably part of one of vXX regs).
  Most likely those regs are flushed to memory when COP2 opcode is running, for sure they are flushed when VU0 microprogram is running.
  Most likely those regs are flushed to memory when COP2 opcode is running, for sure they are flushed when VU0 microprogram is running.
=== EE Timers Count Read ===
Emulator have bizarre behavior for EE Tx Count read (0x10000000, 10000800, etc). In specific situation (related to pending edge triggered irq) instead of Count value emulator returns Mode value. This doesn't look like programming error and can be some kind of ps2 undocumented behavior implementation.
=== DataStorage vector hook ===
What normally should work as DataStorage exception handler is hacked into very ugly dispatcher for EE related handlers. This code is used for example to read/write IPU registers. At the time when vector is reached:
* Emulator preserves few registers on custom stack at 0x800000. Registers seems to be little random, but they are not. This code is launched from recompiled mips code.
* srr0 is backed up to r3 register (address where exception occurred + 4, rfid opcode jump to address from that reg) and since now it is also used as argument for next steps.
* srr0 is given new value of 0x2EFCC which is custom "dispatcher", link register changes to 0x28F8C8 which is return from that custom piece of... code.
* rfid is hit, let's go to our newly hooked srr0 with 0x2EFCC address.
* Time to use address preserved in r3. This address going thru few checks, it needs to be in 0x10000000- 0x12FFFFFF range (EE JIT Code).
* From this address emulator get single word, that word is used to figure out what mips code wanted to do. This isn't simple offset but some kind of custom identifier.
* When matching identifier is found, task is performed. Some tasks just jump to function and do what is needed, some continue that hackfest and instead are injected into recompiled code as branches to functions that will perform what game want them to do.
* blr is hit, remember that link register is patched earlier to 0x28F8C8
* This function restores previously backed up regs and set link register to value returned by hook. That's all.
=== Free sapce in config parser ===
Since CELL B.E. is big endian machine is only natural to Sony to use little endian for CONFIG files and byte reverse every single word for them. :) What's more important for us, CELL have special opcodes for situation like that one, lwbrx and stwbrx (load/store word byte reversed indexed). But compiler decided that it will be better to do old fashioned 8 opcodes load/swap by shifts and masks and 'or'. This leaves us a lot of space when implementing new configs, making things nice and clean without need to jump outside of function, etc. This code:
seg020:000000000012EECC        lwzx      r0, r9, r31
seg020:000000000012EED0        srwi      r11, r0, 24
seg020:000000000012EED4        rlwinm    r9, r0, 8,8,15
seg020:000000000012EED8        slwi      r3, r0, 24
seg020:000000000012EEDC        rlwinm    r0, r0, 24,16,23
seg020:000000000012EEE0        or        r3, r3, r9
seg020:000000000012EEE4        or        r0, r0, r11
seg020:000000000012EEE8        or        r3, r3, r0
seg020:000000000012EEEC        clrldi    r3, r3, 32
Can be replaced by simple:
seg020:000000000012EECC        lwbrx    r3, r9, r31
seg020:000000000012EED0        clrldi    r3, r3, 32


== RSX workload on the netemu ==
== RSX workload on the netemu ==
Line 1,504: Line 2,060:
  ld        r0, -0x6BF0(r0) # load to r0 from address 0xFFFFFFFFFFFF9410, no matter what r0 actually is at the moment.
  ld        r0, -0x6BF0(r0) # load to r0 from address 0xFFFFFFFFFFFF9410, no matter what r0 actually is at the moment.
  ld        r4, 0x3008(r0) # load to r4 from address 0x3008, no matter what r0 actually is at the moment.
  ld        r4, 0x3008(r0) # load to r4 from address 0x3008, no matter what r0 actually is at the moment.
== Communication with Graphics Synthesizer in ps2_gxemu ==
Communication from emu level is done with rw to special addresses of what seems to be RSX ports.
Emu includes thin translation layer that intercept rw operations to GS privilaged registers.
Emulator to write or read GS register first need to write register number that we want to access. To do that we use one of two exposed 32 bit ports, separate for reads and writes.
To write GS register first write 64 bit data to write buffer. Separate for lower 32 bit (0xA000304C) and upper (0xA0003048) part of GS write. GS regs are 64 bit while RSX operate on 32 ports.
Finally write translated register number to 0xA0003040. This write starts transfer to GS. To ensure everything went ok emulator performs 32 bit read from 0xA0003000 and check if bit 1 is active.
This operation is performed in loop up to 1000 times until bit 1 is not 0, if that is not the case in mentioned 1000 loops panic is called.
To read GS register first write translated register number to 0xA0003050, then wait for bit 1 of 0xA0003000 to be active. Emulator wait up to 1000 read loops if GS didn't answered in that time emu panic.
Now when bit 1 is not 0, data can be read from 0xA0003058 for upper 32 bits and 0xA000305C for lower 32 bits.
Emulator translate almost all reads to CSR. Only SIGLBLID is readable beside CSR. This is real PS2 GS behavior. Although there is unused runtime that allow read any register. Behavior in that case is unknown.
0x00 = PMODE
0x01 = SMODE1
0x02 = SMODE2
0x03 = SRFSH
0x04 = SYNCH1
0x05 = SYNCH2
0x06 = SYNCV
0x07 = DISPFB1
0x08 = DISPLAY1
0x09 = DISPFB2
0x0A = DISPLAY2
0x0B = EXTBUF
0x0C = EXTDATA
0x0D = EXTWRITE
0x0E = BDCOLOR
0x40 = CSR
0x41 = IMR
0x44 = BUSDIR
0x48 = SIGLBLID


== ps2_gxemu external bios/rom loading. ==
== ps2_gxemu external bios/rom loading. ==
Line 1,547: Line 2,068:


Note: This code don't exist in ps2_netemu.
Note: This code don't exist in ps2_netemu.
== Shin Sangoku Musou config ==
This config does something with sceGsSyncPath by storing 0x4 to INTC_STAT before jumping to it (from one of the main function, so only a specific jump to sceGsSyncPath). I am thinking it fixes this: WhECT9RGZ0k (YouTube link)
What could be happening internally for something like this to be fixed? Interrupt delay to avoid an infinite loop or something? The freeze looks similar to something like the Ecole games (Melty Blood) where the game can move slightly after the freeze, or even break out of it entirely (rare).
* It does write an interrupt request for the start of the VBlank. Looks like the game does sync with the refresh rate and the game logic (at least the specific function you have mentioned) does break itself when the timing is not right.--[[User:Agrippa|Agrippa]] ([[User talk:Agrippa|talk]]) 14:59, 10 August 2022 (UTC)
** Writing to INTC_STAT remove vblank start bit in this case (acknowledge that interrupt happened). But yeah, generally this is timing issue. Probably similar issue to what pcsx2 have: [[https://github.com/PCSX2/pcsx2/issues/5369#issuecomment-1146042222 | here.]] But affect different games due to other differences in emulator. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 19:38, 10 August 2022 (UTC)


== Universal DNAS anti-wipe patch ==
== Universal DNAS anti-wipe patch ==
Line 1,675: Line 2,204:
* '''Dance Summit 2001: Bust-a-Move'''
* '''Dance Summit 2001: Bust-a-Move'''
** Front buffer is not flushed most of the time. Game seems to apply additional effects there, apart from the downsampling.
** Front buffer is not flushed most of the time. Game seems to apply additional effects there, apart from the downsampling.
* '''Snowblind Engine 2003+ games'''
** Shows the very last "interlaced" frame when switching back to the interlaced mode from progressive one. I thought it could be a VBLANK issue, but that old frame should be long gone by then. The issue seems to be related to the PCRTC. The SMODE2 register is updated in the VBLANK handler. That old frame is shown when the FFMD bit is switched to 1. Looking for better workarounds than delaying the VSYNC or lowering the resolution in 60 fps mode. By the way, the 0x20 command does work with negative values too. Moreover, the max positive value for NTSC is something like 0x106. Anything higher makes the screen freeze on PS2 logo (but the game is working in the background).


== Stuntman/Driv3r research ==
== Stuntman/Driv3r research ==
Line 1,765: Line 2,292:
*PS2 Memory and Hardware Mapped Registers Layout
*PS2 Memory and Hardware Mapped Registers Layout
*Video Modes
*Video Modes
*<s>Config related info</s> Done.
*Config related info


'''Video Modes''' listed there are not even supported by emulators without GS, and likely to fail even on PS3 with GS. This is really info for PS2 wiki in my opinion. '''PS2 Memory and Hardware Mapped Registers Layout''' also fit more in PS2 wiki. This is more like general PS2 dev knowledge than emulation related stuff. Eventually keep them as a links to ps2tek or ps2 devwiki, or something. Let me know if you think this is/isn't good idea. For example PS1 page don't list stuff like this, same goes for PSP page. In case of Config stuff. This is crucial part of this page, but i feel that harm general readability. Due to complicated nature of PS2 config descriptions are getting bigger, and bigger. Honestly this is still missing a lot of info because many times we are limiting ourself to not make descriptions too extensive. All that to not flood page too much. Maybe it's time to move most of that to new dedicated page? We can leave some basic info, like that small table, plus some '''BOLD''' link to "advanced page". This should allow to wikify and move some non-config stuff from talk page. This are only ideas, i expect not everyone will be happy about all of them. Lets talk. :P --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 08:21, 16 January 2023 (UTC)
'''Video Modes''' listed there are not even supported by emulators without GS, and likely to fail even on PS3 with GS. This is really info for PS2 wiki in my opinion. '''PS2 Memory and Hardware Mapped Registers Layout''' also fit more in PS2 wiki. This is more like general PS2 dev knowledge than emulation related stuff. Eventually keep them as a links to ps2tek or ps2 devwiki, or something. Let me know if you think this is/isn't good idea. For example PS1 page don't list stuff like this, same goes for PSP page. In case of Config stuff. This is crucial part of this page, but i feel that harm general readability. Due to complicated nature of PS2 config descriptions are getting bigger, and bigger. Honestly this is still missing a lot of info because many times we are limiting ourself to not make descriptions too extensive. All that to not flood page too much. Maybe it's time to move most of that to new dedicated page? We can leave some basic info, like that small table, plus some '''BOLD''' link to "advanced page". This should allow to wikify and move some non-config stuff from talk page. This are only ideas, i expect not everyone will be happy about all of them. Lets talk. :P --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 08:21, 16 January 2023 (UTC)
Line 1,786: Line 2,313:
Cycles are count in function located at 0x17C9D0 (latest netemu). Emitter with addi to r13 register is what we are looking for. Since pcsx2 use different "unit", lets just call cycles here a... unit.
Cycles are count in function located at 0x17C9D0 (latest netemu). Emitter with addi to r13 register is what we are looking for. Since pcsx2 use different "unit", lets just call cycles here a... unit.


   _________________________________________________
   ________________________________________________
  |  Opcode type  |   Netemu/Gxemu  |    PCSX2  |
  |  Opcode type  | Netemu/Gxemu  |    PCSX2  |
  |----------------|------------------|-------------|
  |----------------|-----------------|-------------|
  | Default opcode |    1 unit       |    9 units  |
  | Default opcode |    1 unit     |    9 units  |
  | Load/Store    |    2 units     |  14 units  |
  | Load/Store    |    2 units     |  14 units  |
  | Multiply      |    4 units     |  16 units  |
  | Multiply      |    4 units     |  16 units  |
  | Divide        |    37 units     |  112 units  |
  | Divide        |    37 units     |  112 units  |
  | COP 0          |    1 unit       |    7 units  |
  | COP 0          |    1 unit     |    7 units  |
  | COP 1          |  1 unit(some 2) |    7 units  |
  | COP 1          |  1 unit(some 2) |    7 units  |
  | COP 2          |    1 unit       |    7 units  |
  | COP 2          |    1 unit     |    7 untis |
| NOP            |  0 units(!!!)  |  7? units |
  --------------------------------------------------
  ---------------------------------------------------
   
   
  Additionally pcsx2 use different cycles for many other opcodes that ps3 emus just count as one.  
  Additionally pcsx2 use different cycles for many other opcodes that ps3 emus just count as one.  
Line 1,806: Line 2,332:
   
   
  At the second hand gx/net emu do some weird shenigans with cycles based on... Opcode number, this is still small unknown here. Yeah...
  At the second hand gx/net emu do some weird shenigans with cycles based on... Opcode number, this is still small unknown here. Yeah...
  It turns out that emu is not counting nop cycles. Weird shenigans mentioned above check if opcode number is 1, which belongs to ee NOP in internal emu table.
  When opcode is NOP then emulator is not adding even single cycle. This explains a lot of issues with dma and why EE always seemed too fast for DMA and other components.
  This code takes 2 cycles (units) per loop in emu:
loop_here:
  addiu v0, -1
  nop
  nop
  nop
  nop
  nop
  bnez v0, loop_here
I still need to fully confirm that nop isn't handled in some special way elsewhere but looks like it's not.
   
   
  Underclocking/Overclocking could be done by modifying opcodes at 0x17CEB0, 0x17CFF8, 0x17D4C8.
  Underclocking/Overclocking could be done by modifying opcodes at 0x17CEB0, 0x17CFF8, 0x17D4C8.
Line 2,741: Line 3,253:
===Emu===
===Emu===
Ps2emu have available 14 fragment shaders, and 8 vertex shaders. All of them don't give any hint about name or usage.
Ps2emu have available 14 fragment shaders, and 8 vertex shaders. All of them don't give any hint about name or usage.
== Custom command ideas ==
* '''Disable GS downloads.'''<br>
It is definitely a performance improvement for many titles. In theory, easy to implement (force 0x3 TRXDIR value for every 0x1 write instead). The point is, per-game patches are superior and more robust.<br>
* '''Disable PCRTC blur.'''<br>
PCRTC merge circuits are mostly used for pathetic blurry anti-aliasing. Looks awful on modern TV screens (ToCA 3 is unreadable completely). Blending settings are controlled through the PMODE privileged register. Partially implemented here: [[Talk:PS2_Emulation#Remove_PCRTC_Blur_for_Netemu|Link]]
===Discussion===
GS download config is partially done, need little bit more than TRXDIR patch. But this is something we can patch per-game too. Games do very obvious things to reverse VIF1 FIFO, and also BUSDIR write. From there you can disable whole function that need it. Config will be better of course, but HEN users... Anti Blur is kinda easy to do. Writes to DISPLAY1 can write also to 2 and write to 2 also to 1. So they always match, and config implementation will be rather easy. Most games just offset DX/DY, and never touch those regs again. For games that mess with it, more serious approach is needed. But again HEN users are out of luck if we create command for that. It doesn't help that this can be done by EE patches too. What need to be done is removing offset between DISPLAY1 and DISPLAY2.
*Example for TOCA3 SLUS which use hard coded offset:
004C55F0 00000000
004C55F4 00000000
I'm not saying no, but for now i'm kinda lacking of motivation if not so small HEN user base will be out of luck. But more ideas can help with motivation. :P --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 22:00, 8 August 2023 (CEST)
== IOP Handling in ps2_emu? (CECHA/CECHB) ==
So, I was reading about how the emulation works here, but I'm not sure how the hardware-based emulation works in the IOP part.
The chart clearly shows that IOP is being 100% emulated via software (Cell) on ps2_gxemu and ps2_netemu, but what about ps2_emu? Is it being emulated using hardware like the EE and GS? Or is it software? I couldn't find any physical chip leading to believe the hardware IOP is there (although the PS2 Bridge has a very similar number model), but I'm aware that some games which have IOP issues on ps2_gxemu and ps2_netemu are not affected in ps2_emu. Also some games that could go online were working fine on ps2_emu, but not so in ps2_gxemu and ps2_netemu.
Is the IOP really fully emulated via software in CECHA/CECHB consoles?
* It's emulated. While other emus use new IOP emulator that is fully running on SPE, ps2_emu use IOP emulator running mostly on PPE core. Emulated IOP ram is mapped to 0x100000000 address of emulator memory, and it's accessible by whole emu. Interpreter is quite simple but handle all needed stuff. IOP hardware registers are mapped in emulator memory and read/write handlers are all PPE functions (that includes DEV9, USB, etc.). IOP Timers run on one of SPE cores, which is interesting solution. SPU2 is running on separate SPE core too. IOP side of SIF communication is done thru "SIF" named SPE program, this program is communicating directly with CXD9208GP hardware. This includes 0x1D0000XX, SIF DMAs, etc. That part is generally not part of IOP per se, I'm just mentioning it for clarity. About compatibility. IOP emus in other PS2 emulators on PS3 were rewritten from scratch, i guess that's why they are less accurate. Plus, fact that with real EE Sony was able to drive most timings inside emu by EE vblk/hblk, which simplifies emulated communication. There is not much to do with accurate IOP when your emulated EE timings are off. --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 20:19, 24 September 2024 (CEST)
* Thank you very much. all of that is pretty informative and fully answers my questions. The last one I have, does this means then that the software emulation that ps2_emu is doing to the IOP part is more accurate than the one DECKARD does on Slims PS2 right? I tried games like Beyond Good & Evil and it seems to run well without the sounds issues that game has on slims models.
** Yeah, looks like it is. Possibly that wasn't the case back in the release days. PS2 emu has been updated many times since launch in 2006, who knows why... You may want to check this compatibility list: https://en.everybodywiki.com/List_of_PlayStation_2_games_compatible_with_PlayStation_3 It's not that accurate because for example Persona 4 entry is partially bullshit because issue with the bar in the lower left-hand corner just can't exist on real EE. But generally, it will give you some info what doesn't worked back then. Entries like Battle Stadium D.O.N, Naruto Shippuden: Ultimate Ninja 5, Orphen: Scion of Sorcery, Wild Arms 5 or Ibara are really interesting, but I'm not sure if they are correct. Back then people recognized PS3 model by HDD size, You can imagine that it's not most accurate way to do that. :D --[[User:Kozarovv|Kozarovv]] ([[User talk:Kozarovv|talk]]) 08:32, 25 September 2024 (CEST)
***Of course, the HDD size is not the reliable way to identify models, especially when you can just swap the HDD haha. Thanks, you gave me a lot of interesting info, checking the compatibility list I saw a lot of interesting cases, perhaps if one day I'm bored enough I will try the examples of games you gave me, and also try some others. Would be fun if ps2_gxemu could be run on CECHA/B models, I'm aware its not possible, at least not right now (I also tried by swapping them in dev_blind with no success, just a black screen crash, but since it's looking for different hardware on the motherboard this was kind of the expected behavior).
In the end, I guess that games like Ratchet & Clank or Tekken Tag Tournament which runs really slow on ps2_gxemu is because Cell can't keep up with the EE emulation.
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/Talk:PS2_Emulation"