The PlayStation 2 Busses + DEV9

Discussion in 'Sony Programming and Development' started by sp193, Dec 31, 2017.

  1. sp193

    sp193 Site Soldier

    Mar 29, 2012
    Likes Received:
    EDIT 2018/01/18: Added link to @wisi's research regarding SSBUSC Delay Registers. Replaced unofficial "DEV9_2", "DEV9_3" and "DEV9_1" names with "DEV9I", "DEV9M" and "DEV9C".
    EDIT 2018/01/01: Corrected device table - SPU2 uses DACK8 and DREQ8 (of DEV8). DEV3 & DEV7 assignments are unknown.

    Introduction to the Busses

    @wisi has done wonderful research and experiments regarding the SSBUS. And I think it is good to have a thread to consolidate everything that we have ever discussed and gained.

    The PlayStation 2 has a couple of data buses. Between the EE and IOP is the SBUS, while the IOP and its peripherals are connected via SSBUS. The EE is able to have access to the SSBUS peripherals, which allows a program from the EE to access IOP peripherals.
         SBUS          SSBUS
    EE <-----> IOP <--------> IOP Perherals
    I have not found any official documentation that explains what "SBUS" and "SSBUS" really stand for, but they may stand for System Bus and Sub-System Bus respectively.

    On the PlayStation, the relationship between the various busses has an uncanny similarity:
           Main-bus          Sub-bus
    GPU <----------> CPU <---------> Peripherals
    SSBUS Peripherals

    SSBUS peripherals are assigned a device number. Each device has its own signals (/CSx, /INTx, /DACKx, /DREQx etc), and may have a SSBUS address and timing control register each. For now, we know:
    • DEV1: DVD ROM
    • DEV2: BOOT ROM
    • DEV4: SPU
    • DEV5: CD/DVD DSP
    • DEV8: DREQ8 and DACK8 are used by SPU2. CS8 and INT8 are not connected.
    • DEV9: Expansion Bus
    • EXTR:
      • Unused on most PlayStation 2 consoles. Exists as part of an unpopulated connector (CN505/CN5505).
      • Even when CN5505 was removed, this set of signals still existed on mainboards.
      • Finally removed from the last PlayStation 2 models (estimated to be the SCPH-90000 series).
      • This interface is used on the TOOL, to connect the MRP to the IOP via the PIF.
      • The /INTEX signal is routed to the INUM_EXTR interrupt.

    CN505/CN5505 is unlabelled in most service manuals. This connector provides connections to a lot of signals that run on the PlayStation 2, and was designed to allow the console's functionality to be extended.
    Officially, only one PlayStation 2 model had this connector utilized: the SCPH-18000 GH-003 had a replacement BOOT+DVD ROM connected there. In the system 246, proprietary hardware connects through CN505, to replace the SSBUS I/F Controller/DEV9C device.

    This appears to be the PIO interface from the PlayStation, and was removed from the late PlayStation 2 models (estimated to be the SCPH-79000 series).

    Expansion Bus
    DEV9 is connected to the SSBUS I/F Controller (CXD9611-compatible in expansion-bay consoles, while the A-chassis models have the CXD9566R). dev9.irx is used to set up and provide a software interface for software to communicate with the SPEED via DEV9.

    On the SCPH-75000 and later, the SSBUS I/F Controller logic was integrated into the IOP. And so it is no longer possible to implement a custom expansion device to connect to.

    In the network adaptor, there is the SPEED (CXD9624GG, CXP9731GP, etc), which implements the various network-adaptor functions like the ATA and network (SMAP) controller.

    IOP <---> DEV9 <---> SSBUS I/F Controller <---> SPEED <---> ATA, SMAP, DVR, Flash, UART
    SSBUSC Register Layout
    ID  - PS2 Function - PS Function - Address     - Delay (Configuration)
    0     - Exp1       - Exp1        - 0xBF801000 - 0xBF801008
    1     - DVD ROM    - Exp3        - 0xBF801400 - 0xBF80100C
    2     - Boot ROM   - Boot ROM    - -          - 0xBF801010
    3     - ???        - ???         - -
    4     - SPU        - SPU         - 0xBF801404 - 0xBF801014
    5     - CD/DVD     - CD-ROM      - 0xBF801408 - 0xBF801018
    6     - ???        - ???         - -          - -
    7     - ???        - ???         - -          - -
    8     - Exp2       - Exp2        - 0xBF801004 - 0xBF80101C
    9     - SPU2       - N/A         - 0xBF80140C - 0xBF801414
    10    - DEV9I      - N/A         - -          - 0xBF801418
    11    - DEV9M      - N/A         - 0xBF801410 - 0xBF80141C
    12    - DEV9C      - N/A         - -          - 0xBF801420
    Common Delay register: 0xBF801020
    DEV9 has multiple memory regions (unlike other devices, it has three control channels).

    Note: DEV9C is an unofficial name. But the ATAD module from some boot ROMs identify the SSBUS I/F Controller (CXD9611-compatible) as the "DEV9C", as well as the service manuals.

    According to various hints in official software like PS2Linux, the first two DEV9 control register sets are DEV9I and DEV9M. The 'I' and 'M' represent "I/O" and "Memory" windows. It is possible that they were brought over from an older PS2 design, which carried a more native PCMCIA interface design.

    As of the first PlayStation 2 model (contains the CXD9566R), the PC CARD interface is managed through DEV9M.
    DEV9I seems to be used for controlling the AIF (On TOOLs) and the I2C interface to the DVE.
    DEV9C seems to affect access to the DEV9 Controller/SSBUS I/F Controller (CXD9566R or CXD9611-compatible).

    For more information, please refer to the documentation that @wisi drafted (see below for related links).

    SSBUS I/F Controller Models

    Also found within the documentation by @wisi, but slightly more updated. This list is incomplete and may have some inaccuracies.
        -           - Exp Device    - Applicable   -
    Rev - Model     - Form-Factor   - Models       - Description
    1.4 - CXD9546R  - PC-CARD       - DTL-T10000   - DTL-T10000 (non-H)
    2.0 - CXD9566R  - PC-CARD       - A, AB & A+
    3.0 - CXD9611R  - Exp.Bay       - B & C        - without SIG3(pin3) = reg. 146C/bit3.
    3.1 - CXD9611AR - Exp.Bay       - D            - without SIG3(pin3) = reg. 146C/bit3.
    3.1 - CXD9611BR - Exp.Bay       - F            - with SIG3(pin3) = reg. 146C/bit3.
    ??? - CXD9686R  - Exp.Bay       - G
    3.1 - CXD9686AR - Exp.Bay
    3.1 - CXD9686BR - Exp.Bay
    3.2 - CXD2955R  - Exp.Bay       - H, I & J     - Integrated with SPU2
    The SCPH-70000 (K-chassis) was the final PlayStation 2 model to have an actual SSBUS I/F Controller. Subsequent models (SCPH-75000 series and later) had this device integrated into the DECKARD IOP, which reports a revision of 0x31.

    I once had a SCPH-39001 with the CXD9686R, but did not make a dump of its data... so I have no idea what its ID was.

    Thanks to @Armorant, it appears that at least his DTL-T10000 has a CXD9546R, which identifies itself as v1.4. Such a low version number is unsupported by all known dev9 modules, which would explain why Sony wrote that the T10K has "no support" for the network adaptor.

    Related Links/Posts
    Special Thanks to @wisi, @Shuji, @l_oliveira and @AKuHAK
    Last edited: Jan 18, 2018
    Anonamous, wisi, ps2netbox and 11 others like this.
  2. HI_Ricky

    HI_Ricky Intrepid Member

    Jun 7, 2007
    Likes Received:
    nice info
    ppl still make DEV9 stuff
    this is new one USB on EXP Bay....
    no idea how to do, but it happen....
    ps2netbox likes this.
  3. sp193

    sp193 Site Soldier

    Mar 29, 2012
    Likes Received:
    Honestly, that is why I am pushing to have all available information consolidated. So that people like @ps2netbox may be able to benefit from it.

    @wisi did a lot of research between 2015 (perhaps even before) and now. The thread that I linked to, has more detailed documents on the DEV9 and SPEED. The SSBUS I/F also appears to also allow some behaviour to be changed. For example, it seems to allow the MECHACON (DEV5) to be overriden. This could perhaps be used to implement a DVD emulator (as on the TOOL).

    I am personally hoping that ps2netbox's work can be compatible with the standard modules. With the current implementation, only software meant for his hardware can be used. Neither can his work be supported by the PS2 for booting (cannot be used with FHDB or the PS2 browser either).

    But for now, there is still the SSBUS Delay register bit definitions that are undocumented.
    uyjulian and pool7 like this.
  4. ps2netbox

    ps2netbox Spirited Member

    Dec 26, 2017
    Likes Received:
    Thank you for your kindness and information .
    PS2 Fat can boot from PS2USB, becase a hdd (with mbr.kelf from FHCB ,osdmain.elf (really my custom OPL) on it) is emulated. After my OPL get to run ,it switch the adapter to USB mode.
    The main design goal is user friendly ,so I chose exfat hdd format instead of (but compatible with) PS2 format.
  5. sp193

    sp193 Site Soldier

    Mar 29, 2012
    Likes Received:
    Thank you for working on this challenging console.

    Does this mean that you do not need a custom dev9.irx & atad.irx module? If so, then I was wrong and it is a very good thing! :D

    But if that is true, then perhaps there may be one more possibility to check, if you still cannot get POPS to support your hardware: since POPS was officially made to support the HDD, loading dev9.irx again (from within your fake usbhdfsd.irx module) may cause problems because POPS has dev9.irx included within itself. So perhaps you could also try without dev9.irx.

    But because this thread is not about POPStarter, we should continue this discussion about POPStarter in the POPStarter thread.
  6. ps2netbox

    ps2netbox Spirited Member

    Dec 26, 2017
    Likes Received:
    The emulated hdd is just for BOOT. Hdd requests are translated to internal flash to access MBR.KELF and a simple PS2 Filesystem ( osdmain.elf). USB must be accessed through custom irx .

    One can add ps2netbox/ps2usb support to some software in two method .
    If source code is public, just recompile to include custom irx.
    If no source code ,need crack/patch to include the irx .
    For popstater/pops , since it load usbxx.irx, I write one . But this seems very odd :
    POPS -> pfs0,pfs1 -> redirect to mass0 -> redirect to ps2netbox/ps2usb.
    Hardware emulation is possible ,but is very complex . So I use software method .

    Let us talk about popstater in it's thread.
  7. wisi

    wisi Rising Member

    Apr 16, 2016
    Likes Received:
    Attached is the document on the SSBUSC. It describes the SSBUS configuration (registers) and timing, determined through tests and measurements with an oscilloscope.
    It also includes some newly-found capabilities of some of the SSBUSC channels - like the possibility to remap Dev4 (SPU1) in the IOP RAM range, the purpose of which is yet unknown, and the alleged use of the Dev9 SSBUSC channel to connect a PCMCIA card in a more direct way, than the one applied in the SCPH-1xxxx models.
    This document is particularly useful when interfacing peripheral devices to the SSBUS.
    A good deal of the information is based on psx-spx: , which is a very useful resource when working with the IOP, because it derives many of its characteristics from the PS1 CPU even in PS2 mode.

    Attached Files:

  8. sp193

    sp193 Site Soldier

    Mar 29, 2012
    Likes Received:
    I cannot update the first post, but I want to say that the CXD9546R is revision 1.2 (0x12), not 1.4.
    Somehow I remembered it wrong as 1.4, and it stayed that way ever since.

    PS2Ident has it currently recorded as 1.4, so I will correct that later on.
    uyjulian and AlGollan84 like this.

Share This Page