Liberate your PS1!

Project Source Here: codeberg.org/kaybarkbark/ps1_bios_carriers

I love Libreboot. All my Thinkpads are Librebooted. If your machine has a closed source BIOS, you ain’t livin. While browsing the Libreboot wiki one day (as you do) I came across this page

Someone made a libre BIOS for the PS1? I had to give this a shot.

OpenBIOS

OpenBIOS is a super cool project maintained by the PCSX team. The PS1 BIOS is closed source and copyrighted, making it illegal to distribute. Unfortunately, it is also necessary for the system to function. You are legally allowed to desolder the mask ROM from your PS1, make a backup of it for use in emulators, and use it to play games (that you own of course) and you also legally backed up. This is a huge barrier to entry, however, and requires a bunch of hardware knowledge and the possibility of damaging your PS1. Another option is to reverse engineer the BIOS and write your own that mimics the behavior as close as physically possible (bugs and all). This is essentially what OpenBIOS is.

OpenBIOS seeks to mimic the original BIOS as much as possible, bugs and all. I encourage you to read some of the source code, it’s well commented and documented and lists some interesting quicks of the hardware and other bugs that were discovered by throwing the BIOS blob into Ghidra. Reverse engineering a BIOS is also just a good idea because it teaches you a lot about the hardware and how it works, and even the behavior of some games that rely on special quirks that the BIOS does. OpenBIOS is, of course, Open Source and distributed with the GPL-2.0 license, which makes it legal to distribute source and blobs.

Unfortunately, it is missing some core functionality of the stock BIOS. At time of writing, you cannot play music CDs and there is no memory card utility that allows you to copy and delete save games. It also is not tested with 100% of games and may not have perfect compatibility. It’s possible that there are still undocumented quirks/bugs of the original BIOS that some games require in order to function. Some of these have been accounted for, but more may still exist.

So why flash it? To free your PS1! Surely there is no nobler cause.

Designing a Carrier Board

The original PS1 bios is on something called a mask ROM. This is a chip that has the program physically etched into the silicon itself. It cannot be reprogrammed to something else. These are only ordered in mass quantities by large companies when they have a bunch of the same exact product to make. Since we can’t reprogram the BIOS chip, we’ll need to remove it and solder on one that we can program.

Another problem arises though. They don’t really make memory chips in this form factor any more, at least not supported ones you can easily buy. We’ll need to take a modern chip and put it on some kind of adapter board so it will fit into the PS1.

The Memory Interface

There are lots of ways you can talk to memory chips like this. Most ones these days use some kind of serial interface, like SPI or QSPI. SPI and QSPI use a small amount of pins, which means a smaller, simpler package that costs less. It’s also a bit more complicated to interface with, and wasn’t so common in computers of old (like the PS1).

The PS1 BIOS chip uses a parallel interface. These are absolutely dead simple to interface with and can often just be plonked directly onto the address and data bus. Downside is they use a whole lot more pins than a serial chip, which means more complexity and cost. They are still made, but are getting a lot less common as time goes on.

Picking a Chip

I am documenting this here in detail because you will probably need to re-do my work in the future! Lots of people have made carrier boards for flash chips that fit into the PS1, but the chips the carrier boards support are all old and the parts they work with are obselete and can’t be easily purchased.

The Voltage Level

Different computers interface with chips at different voltages. The PS1 considers 3.3v to be a ‘1’ and 0.0v to be a ‘0’. We need to find a chip that works within these constaints. Luckily for us, 3.3v is a pretty common logic level to work with, and likely will be for a long time.

Address Bus Size

The original PS1 BIOS chip had 20 address pins, A0 through A19. This means it could hold 2^20, or 1048576 bytes (about 1 megabyte) of information. We don’t need that much data for OpenBIOS, just 2^19 or 524288 bytes (512 kilobytes) of information. This means you can pick any parallel flash chip that has at least 19 address pins. These pins are almost always labelled A0 - A18. If your chip has extra address pins (A19, A20, etc) you can just tie them to ground.

Very early versions of the PS1 had a mask ROM that had 19 address pins, and later versions had ones with 20. It does not look like that extra address pin was ever used in any retail BIOS. More on the two variants of mask ROM chips later.

Data Bus Size

The Original PS1 BIOS chip had an 8 bit data bus. You will also need to find a flash chip that has an 8 bit data bus. You can tell it has an 8 bit data bus if it has 8 data pins. These are often labelled Q0-7 or D0-7. A flash chip with a 16 or 32 bit data bus might work, but it will need to be byte addressable and not word addressable.

The Chip I Picked

After putting all of these constraints into DigiKey, the best choice ended up being the MX29LV040CTI-70G.

If you can get ahold of this chip, I can confirm that it works. Libreboot currently recommends the SST39VF040-70, but that chip is considered obselete at time of writing and I was unable to get one for a reasonable price from a trustworthy source. It also will not work with the carrier board that I designed.`

Mask ROM Variants

There are two documented mask ROM variants in the PS1. Extremely early revisions of the PS1 had a 40 pin mask ROM. This was changed very quickly to a 32 pin mask ROM. The 40 pin chip has 19 address pins and only holds 512 kilobytes of data.

The pinout of this variant is not documented well, most schematics use the 32 pin one. The 32 pin mask ROM had space for an extra address pin, and indeed it is hooked up. If Sony wanted, they could start shipping an updated PS1 with a 1 megabyte BIOS. However, it does not seem like this ever happened.

At time of writing, I have not tested the 40 pin variant. If you are reading this, I still have not tested it because I don’t want to mess up my super early revision japanese PS1 I found in the basement of a Hard Off for 500 yen. The rest of this page will be documented with the 32 pin mask ROM variant.

Ordering a Carrier Board

The carrier board I designed can be ordered at pretty much any PCB fab, but you’ll need to order it with some special options. It absolutely needs castellated holes so it can be soldered to the existing mask ROM SMD footprint. I do not recommend trying to castellate the holes yourself, it sucks and is not worth your time. Just get the board house to do it. It is not required, but I recommend that the carrier board be manufactured to be 1mm thick. This is thinner than the standard 1.6mm of most PCBs, and mimics the height of the original chip. It is likely though that a normal 1.6mm board will still fit. I just haven’t tested it.

You may use the gerbers I generated in the repo. These were generated to PCBWay’s specs, and will likely work for other board houses too. However, you can always just regenerate the gerbers directly from KiCad if your board house requires something different.

Generated gerbers can be found in the repo here

Assembling the Carrier Board

The carrier board has a very small amount of parts, just the NOR flash memory chip and a resistor or two. The resistor is required to pull the WE or Write Enable pin high to disable it, ensuring the PS1 does not accidentally start to write to its own BIOS. I designed this for a gentle 10K pull up resistor, but I didn’t have one of of those on hand when testing and used a wire here instead. You really should use a 10k or 1k resistor here though.

When soldering such a finely pin pitched component like the memory chip, remember to use lots of flux. It also doesn’t hurt to do it under a rework microscope, if you have one.

Removing the Existing Mask ROM

You can desolder the original mask ROM with a hot air gun. If you decide to remove the chip this way, try to shield surrounding components with tinfoil or something similar. It’s easy to accidentally roast something else you didn’t intend to heat.

I really don’t like using hot air for big chips like this, and decided to use SMD removal solder instead. This is a special solder that stays molten for a long time at very low temperatures. You just flood all the pins with it, heat them a bit with an iron, and carefully pull the chip off with tweezers while the solder stays molten. It’s sold by Chipquik, and they don’t pay me to say that. I just like it. The part number for it is CHIPQUIK SMD8NL.

The only downside of this particular technique is it’s easy to get the low temp solder on other components, either shorting them out or accidentally removing them as well. While taking photos for this post, I accidentally got some low temp solder on a nearby capacitor and knocked it loose. It wasn’t a big deal to put back, but please keep mistakes like this in mind when doing the rework yourself.

After removing the chip, clean up the excess low temp solder with a solder wick and then scrub the clean pads with rubbing alcohol to remove the excess flux.

Soldering the New Board

Soldering the new board is much easier than removing the old one. I like to tack down a corner, then nudge the chip into place and tack another corner. Then just solder the remaining pads

Check for any shorts, clean up the flux, and get ready to test it!

Testing

Testing is super easy. If you turn it on and see a slowly rotating cube, it works!