Editing POPS

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 13: Line 13:
| PS1 RAM || 0x9800000 || 0x200000 || Seems to be used only for reads/writes, never executed.
| PS1 RAM || 0x9800000 || 0x200000 || Seems to be used only for reads/writes, never executed.
|-
|-
| Recompiled Code || 0x9C00000 || 0x200000(?) ||
| PS1 RAM || 0x9C00000 || 0x200000 || Seems to be used only for code execution, code analyzer can patch and hook it if needed
|-
|-
| PS1 ROM || 0x9E00000 || 0x80000 || Seems to be used only for code execution, code analyzer can patch and hook it if needed
| PS1 ROM || 0x9E00000 || 0x80000 || Seems to be used only for code execution, code analyzer can patch and hook it if needed
Line 45: Line 45:
  bit:
  bit:
     0 = Used in GP0(E3-E4h) handler.
     0 = Used in GP0(E3-E4h) handler.
    1 = Related to Drawing Area right X2 coordinate (it seems to crop right side of drawing area by 1 pixel)
     2 = Used in GP0(A0h) handler.
     2 = Used in GP0(A0h) handler.
     3 = Force NTSC timings. While this setting should only affect PAL releases, sony for some reason used it also on 5 NTSC releases.
     3 = Used in vblank related function.
        FUTURE COP L.A.P.D, NUCLEAR SRTIKE, SOVIET STRIKE, VIB RIBBON and WING COMMANDER IV. This could be simply copy paste error from PAL releases (NUCLEAR STRIKE's config is copied over from SOVIET STRIKE). Use only in conjunction with command 0x0B, otherwise no image is displayed.
     4 = Used in gpu dma related function.
     4 = Used in gpu dma related function.
     5 = Used in GP0(2x-3xh) commands handler.
     5 = Used in GP0(2x-3xh) commands handler.
     6 = Skip GP0(80h) / GP0(A0h) commands (if cmd != 0x80000000) or (if cmd != 0xA0000000).
     6 = Skip GP0(80h) / GP0(A0h) commands (if cmd != 0x80000000) or (if cmd != 0xA0000000).
         Probably game accidentally send trash data, and that activate VRAM2VRAM copy. Real PS2 use something similar for Final Fantasy Tactics with 80h cmd.
         Probably game accidentally send trash data, and that activate VRAM2VRAM copy. Real PS2 use something similar for Final Fantasy Tactics with 80h cmd.
     7 = Spu irq address (0x1F801DA4) related setting.
     7 = Spu related setting.
     8 = Spu reverb related setting.
     8 = Spu related setting.
     9 = Spu dma related setting. Return 1 instead of transferred size. Probably hack to make SPU DMA chunk transfer to always take 1 cycle.
     9 = Spu dma related setting.
   10 = Cdrom Play cmd related, active only when cdr mode REPORT bit is enabled.
   10 = Cdrom related, when enabled seems to update msf/lba more frequently.
   12 = While this bit is used in Timers event related function, it's really affecting SPU code. When bit is active SPU related internal counters are not updated.
   12 = Counters/timers related setting.
        Worth to add that mentioned SPU counters are also not updated if currently checked Timer counter is 0x4000 or lower at this point,
        but are updated for example on applying volume by cdr register write... Seems to be very specific hack.
   13 = Cdrom related setting. When enabled max_disc_lba_without_lead_out is used instead of second_track_lba in one function.
   13 = Cdrom related setting. When enabled max_disc_lba_without_lead_out is used instead of second_track_lba in one function.
        This config practically does what cdda enabler plugin did, same branch that is patched by cdda enabler is forced to be true here.
        Warning! This bit is patched to be ALWAYS ENABLED for custom eboots in Vita Adrenaline. This is bad idea and can affect compatibility.
  15 = Allows discs to be swapped when game didn't request to change ps1 gpu drawing parameters for long enough (60x this check).
   16 = Skip some additional checks for Pause/ReadS/ReadN/GetTN/Setmode cmds during cdrom command processing.
   16 = Skip some additional checks for Pause/ReadS/ReadN/GetTN/Setmode cmds during cdrom command processing.
   17 = Used in MDEC related functions.
   17 = Used in MDEC related functions.  
  18 = Load/Store opcodes related. When other conditions are met, skips some code.
   20 = Use second nBuf in sceCtrlPeekBufferNegative instead of first one.
  19 = Skip great chunk of code in Load/Store opcodes emitter, but only if rs is 29 (when load/store use stack pointer as base address).
   20 = Use second nBuf in sceCtrlPeekBufferNegative instead of first one and change controller sampling cycles from 0 to 8341 in sceCtrlSetSamplingCycle.
   23 = Allows discs to be swapped at any time, regardless of game prompting to or not.
   23 = Allows discs to be swapped at any time, regardless of game prompting to or not.
   24 = In GP0(02h) - Fill Rectangle in VRAM command. Top Left Corner X position & 0x3F0, without command Top Left Corner X position & 0x3FF.
   24 = In GP0(02h) - Fill Rectangle in VRAM command. Top Left Corner X position & 0x3F0, without command Top Left Corner X position & 0x3FF.
   25 = Used GP0(<=67h) handler.
   25 = Used GP0(<=67h) handler.
   27 = Used in function which is handling reading GPUSTAT.
   27 = Used in function which is handling reading GPUSTAT.
  28 = Related to cycle counting, when enabled 1 is used instead of unknown value.
   29 = Used in vblank related function.
   29 = Used in vblank related function.
|-
|-
| 0x00 || Yes || Code analyzer flags, 16 bits usable, but only 6 bits seems to have any effect. Cfg 0x0C and 0x0D override this setting when used (only for selected pc). When set to 0xFFFFFFFF (default), value 3 (bit 0-1) is used.
| 0x00 || Yes || Only bits 0-1 seems to be used
bit:
    0 = Force code cache clear in one of recompiler functions.
    1 = Skips check if opcode rd is $zero (seems to be related to branches/jumps).
    2 = Analyze grater address range at once. PC + 0x2000, instead of default PC + 0xC00.
    3 = Skips chunk of code during branches/jumps analyze. For now is unknown what this code is supposed to do.
  14 = When enabled, value 0xFFFF is used instead of one from cfg 0x0A at some point.
        0x0A at this point is either custom set value or 0xFFFF or 2 (if bit 2 of cfg 0x00 is also active).
  15 = Address is in PS1 ROM range (While this can be set manually here, is really not recommended to do so, there is no point to do this).
|-
|-
| 0x01 || No || Set minimal "Y2" drawing area. This setting overrides what game set in GP0(E4h) command (Set Drawing Area bottom Y2 coordinate). Setting is used only when given value is lower than what game originally sends. In simple words, this work as a crop for the bottom of drawing area. ''Warning! This setting can have bad effect when copied straight from PAL to NTSC game and vice versa.''
| 0x01 || No ||
|-
|-
| 0x02 || No || Set minimal "Y1" drawing area. Value is rows of pixels to crop from top of screen.
| 0x02 || Unk ||
|-
|-
| 0x03 || No || Crop MDEC video drawing only. Value is rows of pixels to crop from top of screen.
| 0x03 || Unk ||
|-
|-
| 0x04 || Yes || This config is multi-command for cdrom behavior. Value is bitfield, but not usual one. This config default value is 0xFFFFFFFF, to "enable" bits we need to really disable them. Windows programmer mode calculator in dword mode should shed some light here. To see enabled bits just use NOT operator. Vita use 3 additional (10/11/12) bits not available on PSP.
| 0x04 || Yes || This config is multi-command for cdrom behavior. Value is bitfield, but not usual one. This config default value is 0xFFFFFFFF, to "enable" bits we need to really disable them. Windows programmer mode calculator in dword mode should shed some light here. To see enabled bits just use NOT operator.
bit:
    0 = Used in function which perform seek to sector.
    1 = Used in function which perform seek to sector. When enabled fast seek takes 3 times more cycles, and slow seek takes 8 times more cycles.
    2 = Used in cdr Pause command. When enabled something takes 6 times more cycles than normally.
        Seems to be related to motor stop timing, maybe how long it takes on idle before motor is stopped?
    4 = Used in function which perform seek to sector. Seems to force seek time to take no longer than 1185408 cycles.
    5 = Used in function which perform seek to sector.
    6 = Used in Read commands. Enabled adds 5419008 cycles, but only if there is no pending setloc. 
    7 = Used in Setmode cdr command. When new bits of mode register request speed change and motor is on,
        unknown event (likely speed change) will take 10000 instead of 33868800 cycles.
    8 = Unknown, used in GetlocP cdr command.
vita only bits:
  10 = When reading cdr status register if BFRD bit of request register is active force DRQSTS bit in status register to 1.
        This can be easily replaced by patch to game code for PSP.
  11 = Weird hack for even weirder value. This bit force result of psp sceKernelGetSystemTimeLow to 0. This value is later used in few cdr commands.
        Hard to tell what purpose of that is, none of open-source emulators use something similar in their code.
  12 = On cdr Setfilter command force unknown value related to ADCPM to 1.
        This value is not bool itself but if not 0 ADPBUSY bit is set to 1 when reading cdr status register.
        Only game that can be potentially affected beside Parappa is "underwater music in R-Type Delta". 
|-
|-
| 0x05 || No || Value is PS1 cpu cycles that will be added to currently passed cycles, eventually triggering events test earlier. Config is used only on BLEZ/BGTZ/BEQ/BNE/B PS1 opcodes. Emulator adds 1 to this value before using it, so default 0xFFFFFFFF = 0.  
| 0x05 || No || Value is PS1 cpu cycles that will be added to currently passed cycles, eventually triggering events test earlier. Config is used only on some specific PS1 opcodes, not for all of them.
|-
|-
| 0x06 || No || Import memory card from existing game installation. Used for example to unlock additional content in Arc The Lad games [[https://arcthelad.fandom.com/wiki/Save_Transfers#List_of_transfer_rewards]]. Value is pointer to emulator memory which value holds pointer to different DISC ID. Possibly bugged for NTSC-U Arc The Lad III because checks for NTSC-J Arc The Lad II save version. JPN releases should be fine.   
| 0x06 || No || Import memory card from existing game installation. Used for example to unlock additional content in Arc The Lad games [[https://arcthelad.fandom.com/wiki/Save_Transfers#List_of_transfer_rewards]]. Value is pointer to emulator memory which value holds different DISC ID. Possibly bugged for NTSC-U Arc The Lad III because checks for NTSC-J Arc The Lad II save version. JPN releases should be fine.   
|-
|-
| 0x07 || No || Memory card related. Value is pointer to emulator memory which value holds different DISC ID. Only game that uses it seems to read savedata from different ID to unlock in-game features. Available DISC IDs in 6.61 POPS are:
| 0x07 || No || When value is not -1, then run some additional code.
*0xF18AC = SLPM86637
*0xF18B8 = SLPS00097
*0xF18C4 = SLPS02982
*0xF18D0 = SCPS10026
*0xF18DC = SCPS10008
|-
|-
| 0x08 || No || Alternative GE Dither Matrix settings. Valid values are 0 or 1, when one of them is detected display list is patched directly before sending to GE. More info about mentioned settings [[https://hitmen.c02.at/files/yapspd/psp_doc/chap11.html#sec11.5.185]]
| 0x08 || No || Alternative GE Dither Matrix settings. Valid values are 0 or 1, when one of them is detected display list is patched directly before sending to GE. More info about mentioned settings [[https://hitmen.c02.at/files/yapspd/psp_doc/chap11.html#sec11.5.185]]
Line 136: Line 93:
| 0x0A || No ||
| 0x0A || No ||
|-
|-
| 0x0B || No || 2x u16 value. Lower bits value is used as a Divider at some point, upper 16 bits (actually 15 bits, because value & 0x7FFF) is substrated from lower 16 bits and practically used only to trigger cfg as active if result is more than 0.
| 0x0B || No || Value is used as an Divider at some point, only u16 is used.
|-
|-
| 0x0C || No || Value is PS1 memory address. Set code analyzer memory range end address. This config has some restrictions and outcome depends on bit 2 of cfg 0x00. Pseudocode looks like this:
| 0x0C || No || Value is r3000 memory address. In known configs command is always used in conjunction with 0x0D command using the same address.
code_analyzer_end_pc = pc + 0x2000;
if (cfg_0x00_bit2 == 0)
    code_analyzer_end_pc = pc + 0xC00;
if (pc < cfg_0x0C && cfg_0x0C < code_analyzer_end_pc)
    code_analyzer_end_pc = cfg_0x0C;
|-
|-
| 0x0D || No || Value is PS1 memory address. When PC match config value, bits 0,1,2,14 from cfg 0x00 are atcive for current memory range.
| 0x0D || No || Value is r3000 memory address.
|-
|-
| 0x0E || Unk ||
| 0x0E || Unk ||
Line 153: Line 105:
| 0x10 || No || Cdrom GetlocP/GetlocL related.
| 0x10 || No || Cdrom GetlocP/GetlocL related.
|-
|-
| 0x11 || No || Value is PS1 memory address. When address & 0xFFFFFFFE match currently recompiled address, emulator emit code which set flag at 0x101C0 to 1. Flag seems to be used only in one place in whole emu, and when set to 1 or higher results in clearing current code cache. This command performs additional check if (address & 1 == 1) and additionally force events check if true.
| 0x11 || No || Value is r3000 memory address. When address & 0xFFFFFFFE match currently recompiled address, emulator emit code which set flag at 0x101C0 to 1. Flag seems to be used only in one place in whole emu, and when set to 1 or higher results in clearing current code cache. This command performs additional check if (address & 1 == 1) and additionally force events check if true.
|-
|-
| 0x12 || No || When value is 0 or higher substrat 2 from it, and store on addr.
| 0x12 || No || When value is 0 or higher substrat 2 from it, and store on addr.
Line 159: Line 111:
| 0x13 || No || When value is 0 or higher, store it on addr. Only u8 seems to be used.
| 0x13 || No || When value is 0 or higher, store it on addr. Only u8 seems to be used.
|-
|-
| 0x14 || Partially || SPU emulation related command. Command use 2x u8 value.
| 0x14 || No || SPU emulation related command.
value1 = cmdValue & 0xFF        // Used only to compare for equality with some value at some point.
value2 = (cmdValue >> 8) & 0xFF // Used if compare mentioned above is true.
If whole s16 cmd is higher than 0 different code path is used in SPU DMA handler.
Additionally on Vita this command has "hidden" setting by bit 18. This setting is seeming to be not available on PSP
|-
|-
| 0x15 || No || Set shell open for little longer during disc swap. Some games take a while to realize that shell is opened, this setting helps them. Value is multiplier for predefined value, 1 is taking around 3,5 seconds, 2 around 7 seconds, etc.
| 0x15 || No || Cdrom related.
|-
|-
| 0x16 || No || When value is not less than 0, run some additional code related to vblank (seems to be scheduling some event).
| 0x16 || No || When value is not less than 0, run some additional code related to vblank (seems to be scheduling some event).
Line 180: Line 127:
| 0x1B || No || Initialize PSX scratchpad memory to given value + 1. Similar setting is found in ps1_netemu on PS3. Only one game seems to rely on it.
| 0x1B || No || Initialize PSX scratchpad memory to given value + 1. Similar setting is found in ps1_netemu on PS3. Only one game seems to rely on it.
|-
|-
| 0x1C || Unk || Vita only.
| 0x1C || Unk || Seems to be unused.
|-
|-
| 0x1D || Unk || Vita only. Drawing area related.
| 0x1D || Unk || Seems to be unused.
|-
|-
| 0x1E || Yes || Vita only. Multi command
| 0x1E || Unk || Seems to be unused.
bit:
    2 = SPU related
    3 = SPU related
    4 = SPU related
    5 = Enable to trigger additional checks for SPU status register, and eventually raise IRQ if needed.
    6 = SPU related
    7 = SPU related
    8 = Used in GPU GP0(2x-3xh and 6x-7xh) commands handler.
  10 = Different handling for JR/JALR opcodes
  11 = Used in GPU GP0(?) commands handler.
  12 = Used in GPU DMA related function.
  14 = Used in GPU GP0(6x-7xh) commands handler.
  29 = GPU related, used close to code which use command 0x01
  31 = Used in GPU GP0(E3h) command handler. Drawing Area top left X1 related.
        Very specific hack which check if Y drawing are starts at 0, and X at 0x401 (which is invalid value for this setting),
        and force X to 0x001 if conditions are met.
|-
|-
| 0x1F || Unk || Unused(?)
| 0x1F || Unk || Seems to be unused.
|-
|-
|}
|}
Line 6,325: Line 6,256:
*Offset 0x428 is parameter for first config command. That one is special and in official table is referred as command -1 (0xFFFFFFFF)
*Offset 0x428 is parameter for first config command. That one is special and in official table is referred as command -1 (0xFFFFFFFF)
*Offset 0x42C  is parameter for config command number 0x00, next 0x430 is parameter for 0x01, etc. up to 0x1F on offset 0x4A8
*Offset 0x42C  is parameter for config command number 0x00, next 0x430 is parameter for 0x01, etc. up to 0x1F on offset 0x4A8
*This repeats again starting from command 0xFFFFFFFF up to 0x1F in next bytes (0x4AC for -1 up to 0x52C for 0x1F). This part seems to be used only by PS Vita internal PSP emulator.
*This repeats again starting from command 0xFFFFFFFF up to 0x1F in next bytes (0x4AC for -1 up to 0x52C for 0x1F). This part seems to be unused, but is better to keep it like original eboots do.
*For unused configs value 0xFFFFFFFF need to be set, except cfgs: -0x01, 0x10, 0x17, 0x18, 0x1D, 0x1E (0x428, 0x46C, 0x488, 0x48C, 0x4A0, 0x4A4) which should be set to 0x00000000 for unused config
*For unused configs value 0xFFFFFFFF need to be set, except cfgs: -0x01, 0x10, 0x17, 0x18, 0x1D, 0x1E (0x428, 0x46C, 0x488, 0x48C, 0x4A0, 0x4A4) which should be set to 0x00000000 for unused config
*Commands 0x1C/0x1D/0x1E/0x1F seems to be supported only on PS Vita. Original POPS on PSP copy them, but never use.
*Command 6 is not really unsupported. Because parameter for this command is emulator memory offset with hardcoded data.
*Command 6 is not really unsupported. Because parameter for this command is emulator memory offset with hardcoded data.
*There is some special handling if TITLE ID is set to PSRM, but that just set predefined values, we shouldn't care too much about it.
*There is some special handling if TITLE ID is set to PSRM, but that just set predefined values, we shouldn't care too much about it.
Line 6,357: Line 6,287:
==Embed PS1 BIOS==
==Embed PS1 BIOS==
Embed PS1 bios version "System ROM Version 4.5 05/25/00 J" ("CEX-3000/1001/1002 by K.S."). POPS don't patch region character like PS1 on PS3 emu does, which suggest internal patch for "region free" was applied to it. POPS apply heavy 90400 bytes patch to bios if 3rd character of TITLE ID is "P" (Mostly JPN region games, but also PBPX demos...). Patch is applied to raw offset 0x18000, for now is unknown what it does.
Embed PS1 bios version "System ROM Version 4.5 05/25/00 J" ("CEX-3000/1001/1002 by K.S."). POPS don't patch region character like PS1 on PS3 emu does, which suggest internal patch for "region free" was applied to it. POPS apply heavy 90400 bytes patch to bios if 3rd character of TITLE ID is "P" (Mostly JPN region games, but also PBPX demos...). Patch is applied to raw offset 0x18000, for now is unknown what it does.
==PS1 cycles counting==
Emulator count cycles for every PS1 opcode. Here are values that are used.
{| class="wikitable"
|-
! Cycles !! Opcodes
|-
| 1 || sll, srl, sra, jr, jalr, jal, j, branches, mfhi, mthi, mflo, mtlo, add, sub, sllv, srlv, srav, addu, subu, and, or, xor, nor, slt, sltu,
lui, addi, addiu, slti, sltiu, andi, ori, xori, mtc0, mfc0, rfe, swc0, lwc0, sb, sh, sw, swl, swr, bad opcode
|-
| 3 || ctc2, cfc2, mtc2, mfc2
|-
| 4 || swc2
|-
| 5 || lb, lh, lw, lbu, lhu, lwl, lwr, sqr(sf), avsz3, gpf(sf), gpl(sf)
|-
| 6 || op(sf), avsz4
|-
| 8 || lwc2, nclip, dpcs, intpl, mvmva, dcpt
|-
| 11 || mult, multu, cc
|-
| 13 || cdp, dcpl
|-
| 14 || ncs
|-
| 15 || rtps
|-
| 17 || nccs
|-
| 19 || ncds
|-
| 23 || rtpt
|-
| 24 || div, divu
|-
| 31 || nct
|-
| 39 || ncct
|-
| 44 || ncdt
|-
|}
Additionally, emulator adds "penalty" cycles for every opcode if currently executed memory is not PS1 main memory. 2 cycles are added to every opcode when emu is running PS1 ROM (0x1FC00000 - 0x1FC80000), and 5 cycles are added when emu is running PS1 Scratchpad (is that even possible?).
==Version Differences==
Known version differences. Obviously, info here is missing many code changes. Only already known info is here.
===3.30===
*Fast GTE math using VFPU is no longer available for RTPT/RTPS/MVMVA (so it's also no longer default option for RTPS/RTPT). Now integer math is used instead.
*Config system changes, totally different -1 cmd. Options like accurate RTPS/RTPT and fast MVMVA no longer available.
===3.50===
*Disc IDs in configs list are now hashed with simple algo. There is no longer simple way to check which game use which compatibility settings.
===3.71===
*Changed compiler used for POPS, new type of relocations used (possibly affected all firmware files, not only pops).
*Added special config for PSRM Disc ID. This is not real PS1 ID, currently is unknown what can it be.
===3.80===
*All handwritten assembly or patched code is now placed before entry point (start) function in memory.
*SPU emulator moved to start of ELF file.
===3.95===
*While playing PSone games on your PSP, you can now customize how the buttons are assigned by going to [Controller Settings] > [Assign Buttons] and select [Custom].
===4.01===
*Changes to config system.
*New SPU emulator available. Now we have 2... Selectable thru cfg -01 bit 25.
===5.00===
*Removed additional SPU emulator and option to enable it thru cfg. Changes to SPU emulator itself, code looks much closer to what can be found in latest POPS.
===6.00===
*Screen mode "Custom" has been added in pops with PSOne Classics for perfect zooming.
*Added new separate pops_04g.prx file for 4th generation PSP (TA-093 board)
===6.10===
*Added new separate pops_05g.prx file for 5th generation PSP (TA-091/TA-094 board)
===6.35===
*Removed pops.prx completely, now every retail PSP motherboard version use separate pops_XXg.prx. Version available are:
**pops_01g.prx - used for TA-079, TA-081, TA-082, TA-086 boards.
**pops_02g.prx - used for TA-085, TA-088, TA-090v1 boards.
**pops_03g.prx - used for TA-090v2, TA-090v3, TA-092 boards.
**pops_04g.prx - used for TA-093 boards.
**pops_05g.prx - used for TA-091, TA-094 boards.
**pops_07g.prx - used for TA-095v3/TA-095v4 boards.
**pops_09g.prx - used for TA-095v1/TA-095v2 boards.
===6.50===
*Added pops_11g.prx used for TA-096, TA-097 boards.
Please note that all contributions to PSP Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PSP Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/psp/POPS"