Media Engine vs Graphics Processor

KPOT0B · Post by **KPOT0B** » Thu Jun 01, 2006 7:03 am

Both(?) has MIPS cores.
Flash connected to Graphics Processor. What for?
DDR also connected to Graphics Processor. Reasonable.

Is the Media Engine just slave to Graphics Processor?
Or those are peers?

Where OS is executed? Which chip executes decrypted IPL? Which does decryption?

Do we have dual cpu system or singe processor with co-processor?

groepaz · Post by **groepaz** » Thu Jun 01, 2006 7:22 am

there are two cpus, then main cpu which executes the OS (and executes th ipl) and the media engine (ME). the graphics processor (GU) isnt a cpu. both media engine and GU have their local ram. decryption is initiated by the main cpu and handled by "KIRK", the decryption engine.

KPOT0B · Post by **KPOT0B** » Thu Jun 01, 2006 8:10 am

According to http://hitmen.c02.at/files/yapspd/index.html

CXD2926 listed as Graphic Processor Chip
CXD1876 as ME

What is actually what? First one has GPU and CPU then? And ME just co-proc?

groepaz · Post by **groepaz** » Thu Jun 01, 2006 8:39 am

What is actually what? First one has GPU and CPU then? And ME just co-proc?

ME is a second CPU, not a coprocessor. and what actually is in what chip package is more or less speculation :)

hitchhikr · Post by **hitchhikr** » Fri Jun 02, 2006 9:46 pm

groepaz: talking about the ME, is there a way to access it from game mode ? I know about the vector address being unreachable from this mode but there must be another way to do it using an already loaded library via a syscall or something ?

Btw: you may want to change the "mov" instruction into "move" in your IDA plugin.

groepaz · Post by **groepaz** » Sat Jun 03, 2006 4:38 am

talking about the ME, is there a way to access it from game mode ? I know about the vector address being unreachable from this mode but there must be another way to do it using an already loaded library via a syscall or something ?

as far as i am aware there is no way for the "user" (as in usermode) to upload custom code to the ME.

you may want to change the "mov" instruction into "move" in your IDA plugin.

uhm well, its not a standard instruction anyway :)

Kojima · Post by **Kojima** » Mon Jul 10, 2006 9:18 pm

How far has Media Engine coding got? I saw an old thread and people were pretty excited by running code on it, but has it be refined? Is it safe to code for the me in asm without fear of bricking your psp?

groepaz · Post by **groepaz** » Mon Jul 10, 2006 9:38 pm

Is it safe to code for the me in asm without fear of bricking your psp?

yes ofcourse, just play around :)

PSP250 · Post by **PSP250** » Tue Oct 17, 2006 8:35 am

hitchhikr wrote:groepaz: talking about the ME, is there a way to access it from game mode ? I know about the vector address being unreachable from this mode but there must be another way to do it using an already loaded library via a syscall or something ?

You might try to research how the sce(Video|Audio)codec* range of user mode functions work. They seem to be an usermode API layer which interacts with the ME.

Things like sceVideocodecGetEDRAM, sceVideocodecSetMemory and similar seem to make use of the ME to store the "codec program".

Since this thread is from July, I guess someone has already dissected these functions ;)

hitchhikr · Post by **hitchhikr** » Tue Oct 17, 2006 9:49 am

Yes the issue has been resolved.

groepaz · Post by **groepaz** » Wed Oct 18, 2006 1:14 am

there is also some kind of lowlevel interface which only handles semaphores between the two cores....i *think* part of it can be seen in my irq-handler reversing.

Post by **TyRaNiD** » Wed Oct 18, 2006 1:52 am

Well for pure interest sake, and we know how groepaz likes low level stuff ;)

The RPC works by posting an interrupt to the other processor using the following code:

Code: Select all

 asm&#40;"sync\n"&#41;;
    _sw&#40;1, 0xBC100044&#41;;
    asm&#40;"sync\n"&#41;;

If you do that on the SC you interrupt (I think interrupt 31) the ME, on the ME is does the reverse. On the SC side that is wrapped up in sceSysregInterruptToOther.

Now as for semaphores there seems to be a shared lock register at 0xBC100048 which both the ME and the SC can write to and it used as a spin lock. Not tested it properly myself mind but still ;)

Have fun :P