PlayStation 2

Architecture and Programming

Rafael GarcÍa Moreno <bladecoder@gmx.net> May 9, 2003
Board index
1. Introduction 2. PS2 Architecture 2.1. Emotion Engine. . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . 2.2. IO Processor. . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3. Graphic Synthesizer
(GS). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 June 5 August
8
3. PS2 copy protection and modchips 10 3.1. Copy protection. . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . 10 3.2. The data partition. . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . 12 3.3. CogSwap method to
avoid the copy protection. . . . . . . . . . . . . . . 13 3.4. Nosolder chips.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 3.5. Modc
hips. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
15 3.6. Backups of games under linux and create CDs for the PS2. . . . . . . . .
. . 15 4. Programming Methods 18 PS2
4.1. Sony Development Kit. . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . 18 4.2. Linux kit. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . 19 4.3. Programming RAW. . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . 20 5. Installation of the programming environment 22 RA
W
5.1. Preparing the environment. . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . 22 5.2. Emotion Engine. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . 23 5.3. Vector Units. . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . 25 5.4. IOP. . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . 27 5.5. Newlib and ps2lib. . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 5.6. Compiling a de
mo. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . January 28
Chapter 1 Introduction
The PlayStation 2 (PS2), was one of the most anticipated products of 2001. The t
echnical features of the console are impressive. This console has been designed
from a basic spread with a clear objective: 3D games. That's why all the hardwar
e is intended to make games that can take the user to an immersion in a visual w
orld in three dimensions. The PS2 is the evolution of the first console develope
d by Sony, the Playstation (PSX), which was put on the market in 1995. The PSX w
as the first console whose games were distributed in support CDROM. The PS2 game
s are distributed on DVD but is also capable of playing PSX games on CDROM. Than
ks to the great capacity of DVDs (4.7 GB), the PS2 games are full of videos, mus
ic and 3D sound. In addition to games, the PS2 can play audio CDs and DVD movies
so it's a complete entertainment platform. The front panel contains, besides th
e tray for DVDs / CDs: 2 slots for memory cards that are 8 MB normally, although
the format is the same as those of the PSX as interchangeable. 2 slots for the
new controls, older controls also operate the PSX. Two USB ports that can be use
d with any USB compatible device such as keyboards, mice, printers, etc. A high-
speed Firewire port The back contains connectors for TV output for HDTV and surr
ound sound output, DTS and Dolby Digital 5.1. 2
CHAPTER 1. INTRODUCTION
3
Figure 1.1: Playstation 2 The standard controls, Dual Shock 2, have 15 buttons,
all are analog, except Analog, Start and Select.
Figure 1.2: Dual Shock 2 controller consists of: four directional buttons arrang
ed like cursors (top left) Analog buttons, Start and Select (middle) 4 action bu
ttons of different colors (above right)
CHAPTER 1. INTRODUCTION
4 action buttons, L1, L2 (front left) and R1, R2 (front-right) 2 analog joystick
s with force-feedback (top-left and top-right)
4
The following comparative table shows some commercially available consoles in th
e year of filing of the PS2 and the latest consoles. Data provided by Sony and M
icrosoft are not realistic, is the data maximum, while Nintendo and Sega are mea
sured in a real game: Console
Playstation Playstation 2 XBox Gamecube Dreamcast Nintendo 64
Polygons / sec frequency
150 million 75 million 3 million 6-12 million 360.000 150.000 Mhz 300 Mhz 733 Mh
z 485 Mhz 200 Mhz 33.86 Mhz 93.75
Main Memory
32 MB RAMBUS DRAM + 4MB video RAM 64 MB unified SRAM 24Mb +16 Mb DRAM video +3 M
b SRAM 1 Mb 2 Mb + 16 Mb + 8 MB video 4 Mb RAMBUS Direct
The high degree of parallelism of the PS2 architecture enables superior performa
nce to the latest consoles running at a lower clock speed.
Chapter 2 Architecture PS2
The architecture of the PS2 consists of four main parts: Processor Input / Outpu
t (IOP): IOP handles USB, FireWire, and all traffic from the controls of the gam
e. The IOP sends the input of the control knobs to the Emotion Engine so that it
can update the status of the game properly. Emotion Engine (EE): The Emotion En
gine is the heart of the PS2, and the part that makes it unique. The Emotion Eng
ine performs the following functions: â ¢ geometric calculations: transformations,
translations, etc. â ¢ Behavior of the 3D world: enemy AI, collisions, and overal
l physical world that is simulated. â ¢ General functions: Control program and the
overall direction of play. The result of the work of the Emotion Engine are dis
play lists, that is, scripts that are sent to rendering graphic synthesizer (GS)
. Graphic Synthesizer (GS): The graphic synthesizer includes the display list se
nt by the U.S. and represents them on screen. It's what would be the "graphics c
ard" of the PS2. Sound processor (SP): The SP is what would be the "sound card"
of the PS2. It is capable of playing digital 3D.
5
CHAPTER 2. ARCHITECTURE OF THE PS2
6
Figure 2.1: Architecture of the PS2
2.1. Emotion Engine
The Emotion Engine is the heart of the Playstation, a CPU 128-bit RISC developed
by Sony and Toshiba. It implements a subset of instructions of MIPS-IV processo
r. The CPU operates with a clock speed of 300 MHz for the massive process of mul
timedia information at high speeds, both the data bus, such as cache memory and
registers are 128-bits. Everything is integrated into a single chip LSI to 0.18
microns. The Emotion Engine CPU was the first fully developed 128-bits. The abil
ity to calculate floating point is much higher than the current personal compute
rs. The CPU has two integer units (IU) of 64-bits, a 128-bit SIMD unit with 107
instructions for multimedia processing, two independent units of computation of
floating-point vectors (VU0, VU1), an MPEG decoder circuit -2 and high-performan
ce DMA controllers. There are three components that can perform floating point o
perations in parallel: an FPU co-processor with 1 and 1 FDIV FMAC1
1
Multiplication and accumulation unit floating point
CHAPTER 2. ARCHITECTURE OF THE PS2
7
Figure 2.2: Architecture of Emotion Engine Coprocessor 2 VU0 4 FMAC and FDIV a v
ector processing unit 5 and 2 FMAC FDIV The combined output of all these element
s enables complex physical load, NURBS surface generation and 3D geometric trans
formations. In addition to processing the data to 128-bits, and transfer to proc
ess massive amounts of multimedia data. The 32 MB of RAM main memory supporting
the CPU speed is Direct Rambus DRAM in two channels to achieve a bandwidth of 3.
2 GB / sec. About four times the performance of PC-100 reports that were mounted
in recent PCs when the PS2 was released. With the addition of MPEG-2 decoder ch
ip, to process data in parallel high-resolution 3D graphics and high-quality DVD
images. With a capacity of floating-point calculation of 6.2 GFLOPS / sec, the
performance of the CPU reaches a few supercomputers. When applied to the process
ing of perspective and geometric transformations, which are normally used for th
e calculation of 3D graphics, the yield reaches 66 million polygons per second.
This performance is comparable with graphics workstations used in the production
of animated films.
CHAPTER 2. ARCHITECTURE OF THE PS2
8
2.2. IO Processor
The IOP is the processor that had the 'old' PSX. With the inclusion of this proc
essor in the PS2 has achieved 100% compatible with the PSX. In addition, the pro
cessor has added support for IEEE 1394, also known as Firewire and USB as these
are the new standards interocnectividad. The new IOP also incorporates the follo
wing news on the PSX CPU: improved cache memory, a new high-performance DMA arch
itecture that allows up to 4 times increase in data transfer. The serial interfa
ce has also been updated and is about 20 times faster than the PSX. The USB inte
rface is compatible with OHCI (Open Host Controller Interface) and can handle da
ta transfers from 1.5 Mbps to 12 Mbps IEEE 1394 can handle data rates from 100 M
bps to 400 Mbps€The use of these interfaces allow for future connectivity to th
e PS2 to a wide variety of other systems such as VCR, Digital Cameras, Printers,
Joysticks, Keyboards, Mice, etc..
2.3. Graphic Synthesizer (GS)
The graphic synthesizer developed by Sony incorporates a parallel rendering engi
ne that contains a data bus width of 2560 bits which is about 20 times the size
of accelerator cards for PCs pixel fill rates and very high performance in drawn
is achieved through embedded DRAM. The PS2 introduces the Graphic Synthesizer c
oncent by calculating real-time 3D drawing objects. The rendering function has b
een specially optimized to generate television images that support NTSC / PAL, h
igh-resolution digital television (HDTV) and the VESA standard. The quality of t
he resulting image on screen is comparable to the quality of the 3D animation mo
vie in real time. In the system design graphics rendering capacity is defined by
the bandwidth between memory and motor pixels video memory. Conventional system
s use external VRAM memory achieved through a bus external to the chip that limi
ts overall system performance. However, in the case of the new GS is a bandwidth
 of 48 Gigabytes which has been achieved through the integration of memory and t
he rendering engine on the same chip. When children draw polygons, the peak perf
ormance is 75 million polygon
CHAPTER 2. ARCHITECTURE OF THE PS2
9
us for the second and the system can draw 150 million particles per second. With
this capability, it is possible to generate film-quality images. It can reach 2
0 million polygons drawn on a sustained basis using Z-buffering, textures, light
s and transparencies. This new architecture can run multi-pass processing of rec
ursively filtering operations at high speed without assistance from the main CPU
or access to the main bus.
Chapter 3 of the PS2 copy protection and modchips
3.1. Copy protection
The details of the copy protection that Sony uses for its PS2 not been published
ever known data have been made through reverse engineering by the creators of a
nti-copy systems. Due to legal problems and / or business interests is difficult
to find published information obtained by reverse engineering so that the descr
iption may still not be entirely accurate. The PS2 supports CDR audio formats, s
o XA2 CDROM, DVD-Video and DVD-ROM. The PS2 does not provide any protection sche
me Audio CDR backups and uses the standard protection for DVD-video.
Protection of DVD-video formats
The DVD-video is the standard to handle MPEG 2 video stream with associated audi
o for that can be read by DVD players. DVDVideo specification provides copy prot
ection to protect the products of major studios. The protection of DVD-video is
reinforced by a contract to be signed by all manufacturers of DVD players both h
ardware and software that forces them to implement a series of protections, incl
uding protecting the digital outputs, implement the separation regions , impleme
nt obfuscation techniques to make reverse engineering difficult, etc. The protec
tion of DVD-video is part of the Content Protection System Architecture. Aun10
CHAPTER 3. COPY OF THE PROTECTION AND PS2 Modchips
11
DVD format that predates the CPSA and therefore not fully implemented. The speci
fication of the CPSA can be found in [8]. Currently all DVD protections have bee
n broken.
Game Protection
In principle, the system of protection of PS2 games on CD-ROM and DVD is the sam
e as the PSX and is generating incorrect code ECC and EDC of certain sectors of
the CD or DVD. The specification of the structure of CDROM / XA is in the yellow
book [9], this paper divides the structure of the cd in sectors of 2352 bytes e
ach. At the end of each sector are the byte codes ECC (Error Correction Codes) a
nd EDC (Error Detection Codes) that employ redundant information on the sector t
o detect and correct reading failures. Both EDC and ECC codes are calculated by
the recorder at the time of writing the sectors. The protection is based on usin
g a special tape recorders that can change these codes ECC and EDC, in the case
of the Playstation, the codes of the first 16 disk sectors have been tampered wi
th. These sectors contain zeros in the information for the EDC and ECC. Normal b
urners trying to copy these discs,€corrected EDC and ECC codes automatically. T
he Playstation unable to find the zeros in these sectors, means that we have int
roduced a music CD and displays the audio menu or tell us that the CD is invalid
. On the other hand, the data tracks are stored in the ISO9660 file system [10].
When any data track is followed by an audio track, there must be a continued se
paration of data from at least 150 sectors (2 seconds.). Playstation applied to
the disc we have 150 sectors are always filled with zeroes (0s) behind the game
track. The purpose of this separation 'physical' is to have a buffer to 'help' C
D players are not always able to skip audio data or vice versa without a minimum
separation. In addition, when an audio track follows a file is to start with an
other separation of at least 150 sectors serving the same purpose as the postgap
: separate data and audio tracks. In the PlayStation, are normally found pregaps
150 sectors (2 seconds) or 300 sectors (4 seconds). When pregaps separate two a
udio tracks can be from 0 to 150 sectors as the disk. Finally, the LeadOut is wr
itten directly by the recorder (except for some models)
CHAPTER 3. COPY OF THE PROTECTION AND PS2 Modchips
12
and its contents are not modified by the user. Nor is it possible to read the Le
adOut a CD from a reader 'domestic' CD-ROMs.
Regional block
In addition to protection against illegal copying, the console uses a system of
'regional block. " This is done because Sony has agreements in various Asian mar
kets, American and European and then have to protect the games can be used not o
nly in the geographic area for which they were distributed. The regional block w
orks as follows: The first five sectors (000000-000004) containing the informati
on of the area for which a particular game is released. Basically the CD identif
ied as Japanese, American or European. If the information you send the CD does n
ot match the console that is stored again we notice that the CD entered is inval
id.
3.2. The data partition
As seen in the previous section, the data partition is stored in ISO9660 format
[10]. The Playstation does not support Rock Ridge or Joliet extensions, this inv
olves a number of limitations. The most important are that there is no distincti
on between the case-sensitive file names and the length of filenames must sergui
r DOS format, ie a maximum of 8 characters for name and 3 for the extension. The
games consist of a series of executable binary files and data files. The execut
able files compiled for the Emotion Engine are in ELF format [11] which is the s
tandard format in many operating systems, including Linux. The code input / outp
ut that runs on the IOP is usually in separate binary files with extension IRX E
LF format but also compiled for MIPS-I. PS2 games we can ride on our operating s
ystem and access the file system. In the boot process, the PS2 reads the CD tabl
e of contents and find a file called SYSTEM.CNF. This file indicates the name of
the executable to load. The Playstation operating system parses the file and ru
n the binary as indicated. In addition to physical safeguards imposed by Sony. T
he producers of games add extra protection mechanisms using cryptographic librar
ies in the games, checking the physical format that is running the game, etc.. V
irtually all of these protections have been broken
CHAPTER 3. COPY OF THE PROTECTION AND PS2 Modchips
13
Algorithm 1 Handling file system from Linux # mount / mnt / cdrom # cd / mnt / c
drom # ls chall.ngh eorps2io.irx mcman.irx sles_512.57 data padman.irx ioprp254.
img mcserv.irx sdrdrv.irx story. NGH default.ngh libsd.irx mtapman.irx sio2man.i
rx sles_512.57 sles_512.57 SYSTEM.CNF # file: ELF 32-bit MIPS-III LSB executable
, MIPS, version 1 (SYSV), statically linked, stripped # file Not mcserv.irx mcse
rv.irx: ELF 32-bit LSB MIPS-I-specific processor, MIPS, version 1 MathCoPro / FP
U / MAU Required (SYSV), stripped Not SYSTEM.CNF Algorithm 2 game THE SIMS boot2
= cdrom0: \ SLES_512 57, 1 VER = 1.02 vmode = PAL
and easy to find specific patches for each game Internet and disables the protec
tion of that game by allowing its copy.
3.3. CogSwap method to avoid the copy protection
There are several commercial programs that can run games on the Playstation modi
fying their behavior. Typically used to add infinite lives, immunity and other s
pecial feature you games.€Such programs are the most popular Action Replay 2 (A
R2) for PAL and GameShark 2 (GS2) NTSC leg, both from the same company. We can h
arness the ability to load other games of this program to run copies of games wi
thout skip protection. The program presents a menu and one option is to load a g
ame. If we introduce a game and click on this option, the game will load wheneve
r an original copy because every time we introduce a game, the PS2 makes bad sec
tors tests, verification of load region and the table of contents in memory CD /
DVD inserted. The method involves starting with the AR2 and open the CD / DVD i
n the PS2 but the PS2 will get the notification, exchange the disc and click on
the menu run. Of
CHAPTER 3. COPY OF THE PROTECTION AND PS2 Modchips
This will run the game without carrying out the check copy.
14
There are several methods to open the tray without being notified to the PS2, th
e methods ranging from force plate with a knife to make a special lever for this
function. The method is discussed in detail in [12]. This method has several di
sadvantages that can break apart the tray. These drawbacks are that the table of
contents of the new disc is not read, so the PS2 has the data from the previous
album. This means that the file copy SYSTEM.CNF must be in the same position it
has in the AR2. This position is LBA 12 231. Therefore we must patch the ISO im
age before passing it to CD. There are several programs that are responsible for
moving the SYSTEM.CNF to the corresponding position and fill the gap left with
zeros if necessary. In [1] we can find several programs that perform this functi
on. From version 1.3, the AR2 uses a different set of load and is no longer nece
ssary for the SYSTEM.CNF is in the position 12 231. Another disadvantage is that
the Playstation will not read more the size of AR2. Each version of AR2 has a s
ize, for example, the limit of version 2 is 74 min. The only advantage of this m
ethod with respect to the chips, do not lose the guarantee of the PS2 since it d
oes not open.
3.4. Nosolder chips
To avoid the hassle of CogSwap and damage to it can make to the console, there a
re some chips that without soldering, can be installed on the PS2 and preventing
the occurrence of the CD insert notification to the console . These types of ch
ips have the same limitations as CogSwap adding that the security is lost becaus
e you have to open the PS2 for installation. You can find information about inst
allation in [13], in this same site you can check the price and make an order vi
a the Internet. With this chip and AR2 v1.3 or higher is theoretically possible
to load any copies of the game without having to patch it (if the game does not
implement a hardware or software protection).
CHAPTER 3. COPY OF THE PROTECTION AND PS2 Modchips
15
3.5. Modchips
The most comfortable but also more complicated to install, is the use of Modchip
s. The intercept Modchips copy protection data sent by the disk and sends the Pl
aystation expected. In this way, simply enter the copy and the Playstation autom
atically recognize it as valid. This method has no limitations in the methods of
 the swap, the only drawback is that, depending on the type of chip, there to ta
ke up to 40 welds at various points in order to fool the BIOS. The most reliable
modchip to date is the Messiah 2. The use and sale of these chips is perfectly
legal in Spain, so it can be found in various shops for about 40 E, there are ev
en stores that sell the Playstation with the chip installed, yes, without warran
ty.
3.6. Games under linux backups and creating CDs for PS2
Since the entire development environment is easily installed under the Linux ope
rating system (although you can install under Windows using Cygwin), then descri
bes the various methods of creating a CD under this system may be operative to r
ead by the PS2. To back the quickest method is by using the cdrdao program [14],
this program makes an identical copy of the CD structure. The program also come
s with two scripts, read-write-psx psx and allow us to directly read and write C
Ds for PSX. The program is also able to write images .cue / .bin generated by th
e CDR-Win. You can use the write-psx script to write the image or directly use t
he following command: # cdrdao write fichero.cue If you have the image file syst
em (iso9660) we can use the cdrecord [15] to burn the CD,€the command is: # cdr
ecord-dev = 0,0,0-multi fichero.iso or # cdrecord-dev = 0,0,0-XA1 fichero.iso
CHAPTER 3. COPY OF THE PROTECTION AND PS2 Modchips
16
To build the system files on the CD with the files we are developing programs th
at will use the mkisofs that comes with the cdrtools along with cdrecord. To gen
erate the image with our program, we put all the files that will go on the CD in
a directory and use the following command: # mkisofs-o fichero.iso directory If
you want the CD generated work with swap methods must patch it for the SYSTEM.C
NF be in the proper position. Normally the files are stored in alphabetical orde
r the ISO image. In the case of our test programs, being small, the SYSTEM.CNF w
ill be below 12 231 sector of the image. To view the position where the iso file
, use the command isoinfo found in the same package with mkisofs. Normally we ha
ve to generate an empty file to push the SYSTEM.CNF to the desired position. As
an example we see the process of creating an iso for starsim demo. Once we have
compiled the demo executable file starsim.elf this file is the recording onto th
e CD along with the SYSTEM.CNF that we have to generate for the occasion. # Ls #
cd starsim starsim.elf SYSTEM.CNF # cat SYSTEM.CNF boot2 = cdrom0: \ STARSIM.EL
F; 1 VER = 1.10 vmode = PAL # cd .. # Mkisofs-o starsim.iso starsim # isoinfo-l-
i starsim.iso Directory listing of / d --------- 0 0 0 2048 June 2003 May [23 02
]. d --------- 0 0 0 2048 June 2003 May [23 02] .. ---------- 0 0 0 126615 May 6
2003 [24 00] STARSIM.ELF; 1 ---------- 0 0 0 56 May June 2003 [86 00] SYSTEM.CN
F , 1 As you can see, the SYSTEM.CNF is set to 86. Each sector of the iso image
is 2048 bytes. There will therefore be to move the SYSTEM.CNF 12231-86 = 12 145
sectors. We create the file for that call to put an 0.0 for the first and regene
rate the iso.
CHAPTER 3. COPY OF THE PROTECTION AND PS2 Modchips
# Dd if = / dev / zero of = starsim/0.0 bs = 2048 count = 12 145 # mkisofs-o sta
rsim.iso starsim # isoinfo-l-i starsim.iso d --------- 0 0 0 2048 May 8 2003 [Fe
bruary 23]
17
. 0.0; 1
d --------- 0 0 0 2048 May August 2003 [23 02] .. ---------- 0 0 0 24872960 May
8 2003 [24 00]
---------- 0 0 0 126615 May 6 2003 [12 169 00] STARSIM.ELF; 1 ---------- 0 0 0 5
6 May June 2003 [12 231 00] SYSTEM.CNF ; a patched iso image is recording onto t
he CD with cdrecord. There is a program, with source code, called arpatch that f
rom iso image automatically calculates the size of the file and generates 0.0. T
he program is also able to patch the file SYSTEM.CNF. Studying the sources of th
e program can verify that the patch that makes the SYSTEM.CNF is that if less th
an 56 bytes, 0x0A characters added to the end until it reaches that size. The pr
ogram can be found in [2, 1]. The purpose of this amendment to SYSTEM.CNF not un
derstand it. Theoretically, these steps should create a valid image to swap meth
ods. In reality, with new versions of mkisofs does not work. Comparing iso image
s that work with those generated by this method, I have seen that mkisofs genera
tes a section for booting from CD, but this section is not used. The problem is
that this section takes a sector and therefore the root directory starts at sect
or 23. As the Action Replay does not have this boot sector root directory starts
at sector 22. Since the PS2 is not aware of change and as disk caches is the lo
cation where the root directory, the image does not work, one sector would have
to move around the file system boot sector crushing and rewriting the position o
f root directory in the description of the main volume which is what really is i
n cache and contains all the limitations of the method swap. The program ps2mkis
ofs [1], generated the iso image to the root directory in the correct position,
so the isos generated by this program works perfectly on the PS2. From version 1
.3 of AR2, the charging system has changed and is not necessary that the SYSTEM.
CNF direction is in the area 12 231, so images without patching work if the root
directory starts at sector 22 iso.
Chapter 4 Programming Methods PS2
4.1. Sony Development Kit
Sony Computer Entertainment Sony sells the DTL-T10000 Development Kit to develop
programs and games for the PS2. The unit cost is about $ 20,000, making it inac
cessible to normal users€even for small companies as they usually can work on a
kit 1 or 2 people, so for a development team will have to buy several kits with
the subsequent disbursement. The kit contains two development PS2: The PS2 TEST
, just like a normal PS2 but can read cdr without modchips. The PS2 TOOL, is muc
h bigger than a normal PS2 because of the increase of the components on this, in
cluding differences include: â ¢ 128 MB RAM â ¢ Hard disk â ¢ Sony Network card provid
es developers with this machine so that your code compiles and runs on the hardw
are of the PS2. Sony only provides the hardware and libraries as well as advice
and examples. There are a number of commercial development environments. Between
them the two best known: the Snsys Prodger. They have different modules, includ
ing a very interesting one called Proview which allows using the firewire interf
ace to connect a PS2 model DTL-H 18
CHAPTER 4. PROGRAMMING METHODS PS2
19
Figure 4.1: Unit Test Development Kit to a PC. This model of PS2 is unusual in t
hat it is able to read and run cdr (no chip or anything like that because it is
a unit testing for developers). Snsys Proview provides you with an iso files tha
t runs on the PS2 as a monitor program allowing communication with the software
that runs on the PC. And for what the hell is this? So very easy to upload the c
ode that you compile and run it directly without having to burn a cd for each te
st. It also has a true tool for debug to redirect the output to the PC side to f
acilitate development. Metrowerks CodeWarrior. Like Snsys provides a complete de
velopment environment with many tools. To access these tools have to be Sony's o
fficial developer and registered as such.
4.2. Linux Kit
Linux kit for PS2 [7] lets you run a Linux distribution on the PS2. This makes t
he console into a fully functional desktop computer. The Linux kit contains:
CHAPTER 4. PROGRAMMING METHODS PS2
an internal hard drive 40 GB USB keyboard mouse usb network card 10/100 Base-T t
wo-disc DVD
20
The first contains the runtime environment (RTE) and the manuals in the PS2 that
Sony generally included in the SDK. The second disc contains all the software d
istribution that can be installed on the hard disk. The Linux kernel contains dr
ivers that hide the hardware and prevent direct access to the IOP. Sony provides
only the binaries of these drivers so there are limitations when programming th
e PS2 with this kit. For example, these drivers do not provide interface with Fi
rewire port, so it is impossible to set this port. The kit comes with the GNU gc
c compiler, the xfree and many other utilities. So we have a complete developmen
t environment. Although the programs or games that build on Linux kit can only b
e run on a PS2 that has the kit.
4.3. RAW Programming
RAW programming consists of writing programs for the PS2 without using a develop
ment kit from Sony, or the Linux kit. The development is done on a PC using cros
s compilers. We need to work with the following processors: The main processor i
s a MIPS R5900 [16], this processor implements all the instructions of the MIPS
III ISA, some MIPS IV and a set of multimedia instructions owner. Information on
the instruction set and its use can be found in [17, 18] Vector Units (VU0, VU1
) IOP is a MIPS R3000
CHAPTER 4. PROGRAMMING METHODS PS2
21
There are free development tools can generate code free for all processors of th
e PS2. These tools are: binutils tools is a collection of platform to work with
executable files, among which are: ld, the GNU linker as, the GNU assembler gcc
is the GNU Compiler Collection. These compilers are able to generate code for a
large number of platforms. We especially like the C compiler ps2lib is an open-s
ource library to develop directly to the PS2. This library has been developed ba
sed on reverse engineering. The library provides a large number of basic functio
ns to access the hardware of the PS2. As the PS2 has two CPUs (EE and IOP), the
library consists of two parts, each with functions for CPU. Newlib is the librar
y that implements the standard C functions (libc) and mathematical functions (li
bm). Cygnus is a library used in many embedded systems because of their small si
ze that has been adapted for the PS2. When RAW started programming the PS2,€to
test the programs that were being developed had to burn to a CD and run with any
of the methods previously seen. This was very cumbersome (and expensive) develo
pment. Over time, programs have emerged that by connecting the PS2 to the PC can
send the compiled programs from PC to the PS2 for this run. In this way the dev
elopment process has accelerated considerably. There are three such programs, on
e for each way to connect the PS2 to the PC [19]: Pukklink / Inlink, which uses
the network card that is in the Linux kit to transmit the executable. Naplink, u
se a USB <-> USB The most common method, being the cheapest, is to do with the N
aplink. The only problem with this method is that you must use a USB cable that
has the chip or PL-2301 PL-2302. Once we have the cable, connect the PC to the P
S2. In the PS2 Naplink run the server, we have to be recorded on a CD, and run t
he Naplink PC client. Since the client can tell the PS2 to load the executable.
There are client versions for Windows and Linux.
Chapter 5 Installing the programming environment RAW
In this chapter we will see how to install the development environment to begin
programming the PS2. The development environment consists of cross-C compiler an
d assembler for the EE and IOP. Also compile the binutils so that you can progra
m the unit vector assembler. Finally, we should install the libraries that we wi
ll make it easier to access the hardware. The installation method is for Unix ma
chines, but can also be installed on Windows using the Cygwin environment to sim
ulate a Unix environment in Windows.
5.1. Preparing the environment
The first is to choose the directory where you are installing the programming en
vironment and create the directory structure that will house our utilities and c
ompilers for the PS2. In this case we will install all the components in the / o
pt/ps2dev. Create the directory structure with: # cd / opt # mkdir ps2dev # cd #
mkdir ee iop ps2dev newlib ps2lib The functionality of the directories created
is evident.
22
CHAPTER 5. INSTALLATION OF RAW PROGRAMMING ENVIRONMENT
23
Then create the script that will ps2dev.sh in / opt/ps2dev and will serve to put
the necessary environment variables to compile. We will have to run this script
before you begin programming. Not a bad idea to include the environment variabl
es in. Bashrc so they are always loaded. The contents of the script is as follow
s: PS2DEV = / opt/ps2dev EE = $ PS2DEV/ee IOP = $ PS2DEV/iop PS2LIB = $ PS2DEV/p
s2lib PS2DEV/newlib newlib = $ PATH = $ PATH: $ PS2DEV/bin: $ EE / bin: $ IOP /
IOP EE PS2DEV bin export PATH newlib PS2LIB Let's look at the process of install
ing the necessary compilers.
5.2. Emotion Engine
The GNU version of binutils and gcc do not support the full set of instructions
from the U.S. so we have to download the customized versions of this CPU. We can
find the binutils and gcc for EE [20]. After downloading the file, these are th
e steps to compile and install the compiler and assembler of EE: # source / # ta
r xzvf opt/ps2dev/ps2dev.sh gnu-ee-binutils-gcc-1.1.tar.gz # cd gnu-ee-binutils-
gcc #. / configure - prefix = $ EE - target = mips64r5900-sf-elf # make LANGUAGE
S = "c" # make install This version has some problems to compile with the latest
compilers, These are the changes I had to do to compile on my computer: gperf p
ackage must be installed in the file gcc / c-lex.c must delete the line:
CHAPTER 5. INSTALLATION OF RAW PROGRAMMING ENVIRONMENT
# Include "rtl.h" in the file gcc / cppobscure.c, change the line: # include <sy
s/utime.h> by: # include <utime.h> In the cpp file / cpplib.c, change the line :
extern int devstudioflag; by: int devstudioflag; in the file gcc / Makefile, ch
ange the line: STMP-fixproto: STMP-headers fixproto fixhdr.ready by: STMP-fixpro
to: fixhdr.ready STMP-headers in the file gcc / cp / pt.c, delete the line: # in
clude "parse.h"
24
Create symbolic links to the newly compiled program to more manageable names: #
cd / # ln-s opt/ps2dev/ee/bin mips64r5900-sf-elf-ee-addr2line addr2line # ln-s m
ips64r5900-sf-elf- ar ee-ar # ln-s mips64r5900-sf-elf-as ee-as # ln-s mips64r590
0-sf-elf-c + + filt ee-c + + filt # ln-s mips64r5900-sf-elf-gasp ee -gasp
CHAPTER 5. INSTALLATION OF RAW PROGRAMMING ENVIRONMENT
# Ln-s mips64r5900-sf-elf-gcc ee-gcc # ln-s mips64r5900-sf-elf-ld ee-ld # ln-s m
ips64r5900-sf-elf-nm-nm ee # ln-s-sf-mips64r5900 ee-elf-objcopy objcopy mips64r5
900 # ln-s-sf-elf-ee-objdump objdump # ln-s mips64r5900-sf-elf-ee-protoize proto
ize # ln-s mips64r5900-sf-elf-ranlib ee-ranlib # ln mips64r5900-sf-s-ee-elf-read
elf readelf mips64r5900 # ln-s-sf-elf-size-size ee # ln-s mips64r5900-sf-elf-str
ings-strings ee # ln-s mips64r5900-sf-elf- ee-strip strip # ln-s mips64r5900-sf-
elf-ee-unprotoize unprotoize already have the compiler assembler, ee-ace, and C,
ee-gcc, ready for operation.
25
5.3. Vector Units
The vector units can be programmed in interactive mode or by sending a program a
nd saying that you run it. For the second form, you need a compiler to generate
vector code for these units. First, the gnu-ee-binutils-gcc/config.sub file, fin
d the line that contains: tahoe | i860 | ia64 | m32r | m68k | M68000 | m88k ...
and between "tahoe" and "i860" introduce "dvp" tahoe | dvp | i860 | ia64 | m32r
| m68k | M68000 ... And execute the following to generate the assembler compiler
: # cd libiberty # sh. / Configure - target = dvp-elf - prefix = $ EE # make all
# make install # cd .. / bfd
CHAPTER 5. INSTALLATION OF RAW PROGRAMMING ENVIRONMENT
# Sh. / Configure - target = dvp-elf - prefix = $ EE # make all # make install #
cd .. / opcodes # sh. / Configure - target = dvp-elf - prefix = $ EE # make all
# make install # cd .. / binutils # sh. / configure - target = dvp-elf - prefix
= $ EE # make all # make install # cd .. / ld # sh. / configure - target = dvp
-elf - prefix = $ EE # make all # make install # cd .. / gas # sh. / configure -
target = dvp-elf - prefix = $ EE # make all # make install You just need to bui
ld links more manageable corresponding names: # cd $ EE / bin # ln-s dvp-elf-add
r2line dvp-addr2line # ln-s dvp dvp-elf-ar-ar # ln-s dvp-elf-as-as # ln dvp -s d
vp-elf-c + + filt dvp-c + + filt # ln-s dvp-elf-gasp dvp-gasp # ln-s dvp dvp-elf
-ld-ld # ln-s dvp dvp-elf-nm -nm # ln-s dvp-elf-objcopy dvp-objcopy # ln-s dvp-e
lf-objdump objdump dvp-# ln-s dvp-elf-ranlib dvp-ranlib # ln-s dvp-elf-dvp-reade
lf readelf # ln-s dvp-elf-size dvp-size # ln-s dvp-elf-strip-strip dvp
26
CHAPTER 5. INSTALLATION OF RAW PROGRAMMING ENVIRONMENT
27
5.4. IOP
The IOP processor is supported by the standard of the GNU utilities, so we'll us
e the gcc [23] and decreases binutils GNU site [22].
Compiling binutils
# Tar xzvf binutils-2.11.2.tar.gz #. / Configure - prefix = $ IOP - target = mip
sel-sf-elfl # make # su # make install
Compile gcc
# Cd .. # Tar xzvf gcc-2.95.2.tar.gz # cd gcc-2.95.2 #. / Configure - prefix = $
IOP - target = mipsel-sf-elfl - with-gnu-ld - with-gnu -as - disable-shared - e
nable-languages = "c" - with-newlib all-gcc # make # su # make install Create th
e symlinks: # cd $ IOP # ln-s-elfl mipsel-sf- iop-addr2line addr2line # ln-s elf
l mipsel-sf-iop-ar-ar # ln-s-elfl mipsel-sf-as iop-as # ln-s elfl mipsel-sf-iop-
gasp-gasp ln-s # elfl mipsel-sf-iop-gcc-gcc # ln-s elfl mipsel-sf-iop-ld-ld # ln
-s elfl mipsel-sf-iop-nm-nm # ln-s elfl mipsel-sf-iop-objcopy -objcopy
CHAPTER 5. INSTALLATION OF RAW PROGRAMMING ENVIRONMENT
# Ln-s-elfl mipsel-sf-iop-objdump objdump # ln-s-sf-mipsel-ranlib elfl iop-ranli
b # ln-s-mipsel-sf-readelf elfl iop-readelf # ln-s-mipsel-sf elfl iop-size-size
# ln-s elfl mipsel-sf-iop-strings-strings # ln-s elfl mipsel-sf-iop-strip-strip
28
5.5. Newlib and ps2lib
The easiest way to install these libraries are precompiled and lowering them. Fi
les-1.9.tar.gz ps2lib and ee-newlib-binary-1.81.tar.gz to be found in [24] inclu
de these libraries. To install simply have to descompirmirlas in / opt/ps2dev. T
he directories include and lib should be stated explicitly to the compiler with
the-I and-L to find the libraries when we compile our programs.
5.6. Compiling a demo
To test our environment, we will disembark funslower demo of [25] and try to com
pile. The demo contains a file called crt0.s. This file is ee-ld needs to functi
on. Many demos and libraries bring it. We will compile it and put it in a place
where you will always find the charger: # ee-as-mcpu = 5900-EL-o crt0.s crt0.o #
cp crt0.o $ EE/mips64r5900-sf-elf/lib also is required to compile a script for
ld to indicate the starting position of executable code, the alignment of the se
ctions and some parameters as default values are not correct LD. This file is ca
lled linkfile and also comes with the demo. The file-Tlinkfile be added in the l
inker command. We will have to edit the Makefile to indicate the names of our pr
ofits. Should be changed: cPath = ../ee-bin/bin/mips64r5900-sce-elf-
CHAPTER 5. INSTALLATION OF RAW PROGRAMMING ENVIRONMENT
CC = $ (cPath) gcc.exe VAS = $ (cPath) as.exe dvp-AS = $ (cPath) as.exe LD = $ (
cPath) objcopy ld.exe = $ (cPath) objcopy.exe by: cPath = $ (EE) / bin CC = $ (c
Path) / ee-gcc VAS = $ (cPath) / dvp-as AS = $ (cPath) / ee-as LD = $ (cPath) /
ee-ld = $ objcopy (cPath) / ee-objcopy
29
We must also compile using the normal file rawasm.c our machine to be used to co
nvert an image from the demo to asm: # gcc-o rawasm rawasm.c then we can try to
compile the program: # make If all went well, the executable will be generated m
ain.elf. We test the demo with Naplink, if we have the appropriate cable or reco
rding the executable along with a SYSTEM.CNF we have to create a CD and testing
it directly.
Bibliography
[1] PS2DEV network. http://ps2dev.livemedia.com.au [2] PS2DEV. http://ps2dev.sou
rceforge.net [3] PS2 Reality. http://www.ps2reality.net [4] The Other Side. http
://www.elotrolado.net [5] Specs for Freeware Developers. http://www.ccs.neu.edu/
home/bchafy/cdb/info/info.html [6] Technologys Protection. http://www.goldenpi.n
o-ip.org/drm/protection.shtml [7] Playstation 2 Linux Comunity. http://playstati
on2-linux.com [8] Specification CPSA. http://www.goldenpi.no-ip.org/drm/pdf/cpsa
081.pdf. [9] Yellow Book specification CDROM. http://www.ecma.ch/ecma1/stand/ecm
a130.htm [10] Specification of the ISO9660 filesystem. http://www.ecma-internati
onal.org/publications/files/ecma-st/Ecma-119.pdf [11] Executable and Linkable Fo
rmat (ELF) ftp://ftp.opennet.ru/pub/docs/program / elf.ps.gz Specification (Prog
rammer Guide).
[12] Method CogSwap detailed. http://www.elotrolado.net/showthread.php?s=c951dd4
0188a330e6d21ead49a60bed2&threadid=92424 [13] Chips No solder. http://www.chipsp
ain.com/guias/v5-v6.htm [14] Homepage of cdrdao. http://cdrdao.sourceforge.net/
30
REFERENCES
[15] Homepage of cdrecord and cdrtools.
31
http://www.fokus.fhg.de/research/cc/glone/employees/joerg.schilling/private/cdre
cord.html [16] MIPS processors. www.mips.com [17] MIPS ISA. http://www.mips.com/
publications/index.html [18] A set of programming instructions and MIPS III. htt
p://decstation.unixag.org/docs/ic_docs/3715.pdf [19] Other methods of loading. h
ttp://ps2dev.livemedia.com.au/kb/kb.asp?T=863 [20] compiler and binutils to EE.
http://ps2dev.sourceforge.net/downloads/ee/gnu-eebinutils-gcc-1.1.tar.gz [21] EE
patches for the compiler and binutils linux kit. http://www.cip.informatik.unim
uenchen.de/ bolzer/ps2linux/src ~ / [22] Download of binutils 2.11. ftp://ftp.gn
u.org/gnu/binutils/binutils-2.11.2.tar.gz [23] Download gcc 2.95.2. ftp://ftp.gn
u.org/gnu/gcc/gcc-2.95.2.tar.gz [24] and ps2lib Newlib. http://ps2dev.sourceforg
e.net/ps2lib.html [25] Demo Funslower. http://ps2dev.livemedia.com.au/kb//files/
FSsource.zip