From 2b1ed3a2162bf66f045ebba3387dfcf9a52e2175 Mon Sep 17 00:00:00 2001 From: pegasus-claude Date: Sun, 23 Aug 2026 22:12:44 +0300 Subject: [PATCH] bios: add SCPH5552 (EU v3.0 01/06/97) BIOS build profile Retail SCPH-5502/5552 Europe image, SHA-256 1faaa18f... ROM 0x0000-0x17FFF is byte-identical to US SCPH-1001 v2.2 (71af94d1...), so every kernel anchor of bios/SCPH1001.toml carries over; the EU shell differs and has no seeds, so the shell window runs in the dirty-RAM interpreter (-DPSX_SHELLWIN_INTERP=ON). Profile authored by the pegasus-claude T32 claimant session (98528efb) and adopted unchanged by the operator-attended T32 session. No ROM bytes tracked. Task: T32 MGS PAL (pegasus-claude lane). (cherry picked from commit 4685b33f79e8688ad7d7321a3127eb9ad81e1ef8) --- bios/SCPH5552.toml | 86 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 bios/SCPH5552.toml diff --git a/bios/SCPH5552.toml b/bios/SCPH5552.toml new file mode 100644 index 000000000..7e4fa3331 --- /dev/null +++ b/bios/SCPH5552.toml @@ -0,0 +1,86 @@ +# bios/SCPH5552.toml — BIOS build profile for the retail Sony SCPH-5502/5552 +# (Europe) v3.0 01/06/97 image ("System ROM Version 3.0 01/06/97 E", +# SHA-256 1faaa18fa820a0225e488d9f086296b8e6c46df739666093987ff7d8fd352c09). +# +# Derived from bios/SCPH1001.toml. ROM 0x0000-0x17FFF (boot + Kernel Part 1/2) +# is byte-identical to the US SCPH-1001 v2.2 image, so every kernel anchor +# below (copy windows, install slot, deliver_event_ret, shell entry) carries +# over unchanged. The shell (ROM 0x18000+) DIFFERS from the US image; this +# profile therefore has no shell seeds (recompiler/seeds/ +# phase2_ghidra_seeds_SCPH5552.json = the SCPH1001 corpus filtered through +# tools/filter_bios_seeds.py, kernel region only) and the shell window runs +# through the dirty-RAM interpreter (build with -DPSX_SHELLWIN_INTERP=ON) until +# an EU-shell seed corpus exists. +# +# The .BIN image itself stays untracked (bios/* gitignore rule) — profiles are +# the only tracked contents of this directory. + +[program] +name = "Sony SCPH-5552 BIOS (Europe, v3.0 01/06/97)" +id = "SCPH-5552" +rom = "bios/SCPH5552.BIN" +load_address = "0xBFC00000" +entry_pc = "0xBFC00000" +text_size = "0x80000" + +[recompiler] +seeds = "recompiler/seeds/phase2_ghidra_seeds_SCPH5552.json" +out_dir = "generated" +out_stem = "SCPH5552" +strict = true + +# The BIOS's boot-time bulk copies of CODE out of ROM into RAM. Single source +# of truth for every relocation window in the recompiler AND in the C it +# emits (the generated dispatch's normalize(), the kernel-bless guard, the +# game/shell-overlap tests). Each entry is a CLAIM that the copy is +# byte-verbatim; the runtime's kernel-bless memcmp enforces it for the +# bless window. All bounds are [lo, hi) with hi EXCLUSIVE. +# +# dispatch_key = "ram": functions in the window are keyed by RAM address +# (normalize folds ROM -> RAM). +# dispatch_key = "rom": functions keep their ROM key (normalize folds the +# RAM alias back to ROM). +[recompiler.address_model] +normalize_mask = "0x1FFFFFFF" + +[[recompiler.address_model.copy]] +name = "Kernel Part 2" +rom_lo = "0x1FC10000" +rom_hi = "0x1FC18000" +ram_lo = "0x00000500" +runtime_base = "0x00000500" # KUSEG — the kernel executes uncached-region code cached at 0x500 +dispatch_key = "ram" +kernel_bless = true + +[[recompiler.address_model.copy]] +name = "Shell" +rom_lo = "0x1FC18000" +rom_hi = "0x1FC43000" +ram_lo = "0x00030000" +runtime_base = "0x80030000" # KSEG0 — LoadRunShell jumps to 0x80030000 +dispatch_key = "rom" +kernel_bless = false +# NOTE (do not "fix" without evidence): runtime/src/bios_hle.c documents the +# actual LoadRunShell copy as 0x67FF0 bytes (ROM 0xBFC18000 -> RAM 0x30000.. +# 0x97FF0). Every pre-profile window constant covered only 0x2B000 of that, +# and dirty_ram_interp.c tracks live RAM in [0x5B000,0x8F000) as an open +# class-B bug. Widening this window is a REAL BEHAVIOR CHANGE requiring its +# own evidence-backed commit — it is not a parameterization cleanup. + +# Kernel-RAM PCs the BIOS overwrites with 4-instruction dispatch stubs at +# runtime (CLAUDE.md rule 18; docs/dynamic_handler_install.md). The emitter +# plants a dirty-check hook at these PCs so the installed stub executes. +[[recompiler.install_slots]] +ram_addr = "0x00000CF0" # SIO data-byte handler dispatch slot + +# Per-image anchors couriered into the generated C (psx_bios_image) for the +# runtime HLE tier. Values are FACTS about this image, not tunables: the +# shell entry is where LoadRunShell (ROM 0xBFC06FF0) jumps after its copy; +# deliver_event_ret is the instruction after the kernel DeliverEvent loop's +# `jalr v0` (kernel RAM 0x1718), the $ra a delivered event callback returns +# through. Omit a key on a BIOS that has no such anchor — the runtime then +# treats that HLE feature as structurally unavailable instead of firing on a +# wrong address. +[recompiler.runtime_exports] +shell_entry_phys = "0x00030000" +deliver_event_ret = "0x80001720"