Update time!
MAX17320 fuel gauge & protector:
I received the PCB I designed around the MAX17320 and got one populated. The basic driver for it is up and running, it’s essential function right now is to get the battery properties: SOC, remaining capacity, cell and pack voltage, battery temperature, current, time to empty, time to full, and total system power draw.
On top of that it gets the status and fault registers of the chip. There is also a function to program the NVM with the exported configuration from the MAX17320 development software. Right now, I’m only displaying the data I read in the debug terminal, but the plan is to use the alert interrupts of the MAX, BQ and STUSB to handle charging/discharging faults.
I will think about which bits make sense to determine fault states and how I should process the analog readings in the firmware. This also includes handling charge termination, battery cutoff, and error recovery. Planning that takes a lot of time and effort, as I’m not a very experienced programmer, so I’m not done with that anytime soon.
SysCon:
I finally decided for a microcontroller to use in the SysCon: the RP2040. Looking at the price, popularity and availability, it’s hard to find arguments against using it.
There is only one major drawback though, which is the development toolchain. In the last 3 weeks I was fighting with CMake, gcc, Eclipse, VSC and the pico SDK and it was not a great experience. Coming from the CubeIDE, my natural first step was to install Eclipse according to the “getting started” guide. I spent 2 weeks on that and it couldn’t even compile the example projects at the end.
Thankfully,
@StonedEdge provided me with a link to a nice package for developing on the pico. It provides what the Raspberry Pi Foundation apparently cannot do: a development tool that pretty much works out of the box.
Nevertheless, I made a copy of the SysCon project and started porting the code. Thankfully only one file contained STM32 HAL functions (on purpose), so changing it was very straight forward. It took 2 evenings to port the project and now it’s finally working!
A pleasant surprise is that the pico debugger seems much more stable than the STLink. I can now plug and unplug chargers while debugging, even resetting the uC works while debugging. It makes testing and troubleshooting much easier!
There are some workarounds in the code currently, mainly involving the open drain outputs (or the lack of real OD outputs on the RP2040). The I2C write function is also quite quirky right now, because the pico SDK expects the register address to be in byte 0 of the RW buffer (on the STM32 it was handled separately). Now I have to move all bytes up by 1 in the RW array to make space for the register address, to avoid changing all my drivers.
The fact that all I2C and SPI functions of the pico SDK are blocking might create headaches in the future though. Overall, it works well and I will continue using it.
Gamepad:
Not much happened here, yesterday I started looking into the DS2 communication protocol and writing down commands and states. In the next weeks I will try to get some code working.
Customized BIOS:
I still can’t believe we got this one working! I was contacted 2 weeks ago by
@Epaminondas, who is working on a modified BIOS to get rid of modchips and FMCB.
Hats off to you and thanks for sharing, your work is simply incredible!
He had the idea to patch the BIOS with the “PS2 Basic Bootloader, PS2BBL” to boot any application at startup, without requiring FMCB or a modchip. Apparently, there is some unused memory in the BIOS, so this could be done without breaking any functionality. It’s not enough to include OPL in the BIOS, but more than enough for PS2BBL.
It took us 2 troubleshooting sessions, but we got it working in the end! Unbelievable!
PS2BBL is the first thing to boot and it is searching for a config file on MC0/MC1/USB to get the paths for launching applications.
- Keep in mind, PS2BBL is installed on the bios chip and not loading from USB / MC
In the first example I put the config file on a USB stick to boot into OSDSYS by pressing start during the PS2BBL logo. It will actually continue working like a normal PS2, it even keeps compatibility with FMCB. In the second example I put the config file and OPL on MC0, so it will automatically launch OPL upon boot, without requiring FMCB or any user interaction.
Epaminondas is developing a script to patch the BIOS automatically (and even change the BIOS region), I hope you will share it one day! From what I heard, he was able to include the config file in the bios too with the latest mod, so only OPL is required!
The drawback of this solution is that you still need OPL on either a USB stick or memory card. It is also required to put the config file on one of the attached storage devices. Another drawback of this exact BIOS mod in general is that the PS2 will most likely lose the ability to play disc games. Let me explain:
During our debugging we discovered that the BIOS chip is actually 64M. It includes the BIOS (rom0) in the lower 32M and the DVD ROM (rom1) in the upper 32M. By exchanging the chip with a 32M NOR flash, I accidentally removed the DVD ROM entirely without noticing (which is good, that’s why we know that we don’t need it…). After discovering that, we had the idea to recover the DVD ROM and to use it to store OPL/ULE.
For that I had to do some reverse engineering again. We knew that CE1 should read the DVD ROM and CE2 should read the BIOS, as seen in the 70k service manual. We also knew that the PS2 reads the BIOS in 8-bit mode and the DVD ROM in 16-bit mode. We were suspecting that the BIOS chip has some sort of CE decoding that required some further tests to find out which decoding is needed to successfully drive a NOR flash. The biggest question mark was the byte# and the A22 pin, as the CE of the chip can be tied to GND (by using the 560R resistors on the data lines, as proposed by
@mixa232323).
The byte# and A22 pin needs to be LOW for reading the BIOS and HIGH for reading the DVD ROM.
The candidates for driving the byte# pin were CE1, CE2, pin 12, pin13 and A22 of the original chip. I ran a couple of tests while sniffing these pins with the logic analyzer, mainly to find out the states of the pins under various conditions. Also playing with the byte# and A22 to see where the boot would get stuck and where the console would crash. I finally found a functional connection by sending the inverted CE1 to byte# and A22. You may ask yourself why I’m not just using the uninverted CE2, but it doesn’t work. It seems like the console is trying to access the BIOS, even when both CE1 and CE2 are HIGH, so in that case both byte# and A22 must be LOW. They must be HIGH when CE1 is LOW and they must be LOW when CE2 is LOW.
D15 was a bit tricky, as it is used as A-1 or D15 by the NOR flash, depending on the byte# pin state. The original ROM has a dedicated pin for A-1 and doesn’t share it with D15. Here is the working diagram:
I didn’t test disc games, as I don’t have a slim with working disk drive, but PS2Ident seems to detect the DVD ROM. To test it I dumped a stock 79k rom0 and rom1, merged them, flashed them and dumped them again using PS2Ident. Both files match.
The sad reality is that (currently) it’s not possible to launch applications stored on rom1. Epaminondas has the theory that it features some kind of encryption and/or partitioning, so we’re stuck with rom0 for now. So that mod is kind of useless, unless you really want to play discs.
For the 32M mod (removing the rom1) we found later during testing that by inverting CE1 you could also successfully drive the CE of the NOR flash to get rid of the resistors. Previously I did it using the inverted XHCS of the DSP, but using CE1 is possible too and more elegent.
Huge thanks at this point to
@Epaminondas for making this work! It takes a lot of skill and knowledge about the PS2 hardware to do such modifications to the BIOS. I’m really excited to see what you come up with when you receive your flash chips and I hope you will share your progress!
That's it!