Missing dsp patch for Pikmin (PAL)?

[GoogleCodeExporter]

What steps will reproduce the problem?
1. Loading Pikmin PAL with nintendont v1.69 or lower. (Game freezes immediatley 
since v1.70)

What is the expected output? What do you see instead?
Since all dsp versions are implemented I would expect either working audio or 
no audio in the game's menu.
What I hear instead is garbled audio in the game's menu

What revision of Nintendont are you using? On what system Wii/Wii U?
I used v1.69, cause the game freezes immediatly since v1.70. But even on newer 
versions, you can hear the garbled audio when the nintendo logo appears, right 
before the game freezes.

Please provide any additional information below.
I verified my iso at redump.org. It's a clean dump. I applied crediar's dspscan 
tool to the iso and got no return message (not even a error or something, just 
no return message at all). I checked my ndebug.log and it says that Pikmin PAL 
has dsp Unknown.
All this information matches with the compatibility list, so I'm not the only 
one experiencing this issue.
Interestingly the NTSC version of Pikmin has dsp v10 (according to the 
compatibility list), which is kinda odd, because I would expect the dsp version 
to be independent from the games region.

Here's a video made. Unfortunatly the sound is not the best, but you can 
clearly hear the garbled sound at the nintendo logo and main screen.

You can also see that the sound is only garbled in the menu and not in the game 
itself.

https://www.youtube.com/watch?v=CJZueMIEYyQ&feature=youtu.be

Original issue reported on code.google.com by peter.wa...@gmail.com on 15 Jun 2014 at 9:27

[GoogleCodeExporter]

If you can get me more information, I might be able to fix it.
You'll need to compile Dolphin or get someone to do it for you.
Note in the code for Dolphin in Ucodes.cpp this line:
    case 0x267fd05a: // Pikmin PAL
We need to dump this DSP.  

#if defined(_DEBUG) || defined(DEBUGFAST)
    char binFile[MAX_PATH];
    sprintf(binFile, "%sDSP_UC_%08X.bin", File::GetUserPath(D_DUMPDSP_IDX).c_str(), ector_crc);

    File::IOFile pFile(binFile, "wb");
    pFile.WriteArray((u8*)Memory::GetPointer(m_CurrentUCode.m_RAMAddress), m_CurrentUCode.m_Length);
#endif

Delete the #if line and the #endif line. Compile Dolphin.
Run the game with Dolphin.
It should create a file called DSP_UC_267FD05A.bin
I need the following from this file:
First 0x10 (16 bytes).
Size in bytes.
SHA-1 of the file.

HxD can get all of these.

If you get this far, we can identify the DSP version.  Next we need to make the 
patch.  If anyone gets this far post here.

Original comment by greyro...@gmail.com on 17 Jun 2014 at 12:27

• Changed state: Accepted

[GoogleCodeExporter]

The code in Dolphin to modify is in UCode_Rom.cpp.

Original comment by greyro...@gmail.com on 17 Jun 2014 at 12:31

[GoogleCodeExporter]

Hi greyrogue,

I've read your post at gbatemp. I can give you all the information you need 
tomorrow afternoon. But today I was simply too busy to do this.

Original comment by peter.wa...@gmail.com on 17 Jun 2014 at 10:28

[GoogleCodeExporter]

Hi greyrogue,

sorry to say that, but it seems I need further instructions. I downloaded the 
source from
https://github.com/dolphin-emu/dolphin
and managed to compile it (it had a bunch of compiling warnings but no errors) 
and the programm itself works. Then I changed the lines in Ucodes.cpp and 
compiled it again. I ran Pikmin, but unfortunately no bin file was created.
You wrote I have to modify the lines also in UCode_Rom.cpp. Well, in the latest 
version there is no file, which is named UCode_Rom.cpp. Then I tried to compile 
an old version and got around 50 compile errors. Will give it another try later,

Original comment by peter.wa...@gmail.com on 18 Jun 2014 at 3:06

[GoogleCodeExporter]

Hi greyrogue,

I got it.

First 16 Bytes:

02 9f 00 12 00 00 00 00 02 ff 00 00 02 ff 00 00

Size in Bytes:

0x1A5F

SHA-1:

800160DF89019EE3E8F7472CE01FF680E985B024

I could attach the file, but I guess it's copyrighted?
Hopefully I made evything right.

Original comment by peter.wa...@gmail.com on 18 Jun 2014 at 3:51

[GoogleCodeExporter]

No wait. My Hexeditor starts numbering the bytes with 0, so the size is 
actually 0x1A60.

Original comment by peter.wa...@gmail.com on 18 Jun 2014 at 3:52

[GoogleCodeExporter]

Great. These look like I expect. Can you build Nintendont?  If so, pull down 
v1.69 if you know that version boots correctly.  Then we need to modify Patch.c.
Using the information you sent, we need to replace the commented out lines 
85-87 in v69 of Patch.c with the SHA-1 here so:
      {
              0x21, 0xD0, 0xC0, 0xEE, 0x25, 0x3D, 0x8C, 0x9E, 0x02, 0x58, 0x66, 0x7F, 0x3C, 0x1B, 0x11, 0xBC, 0x90, 0x1F, 0x33, 0xE2,                 //      12 Dolphin=0x267fd05a=Pikmin PAL
      },
Then we add lines at the end DSPPattern, line 125
        {
                0x02, 0x9f, 0x00, 0x12, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x00, 0x00, 0x02, 0xff, 0x00, 0x00,         //      11 Hash 12
        },
and a line  to the end of DSPLength, line 142
        0x00001A60,             //      11

With these changes Nintendont should now identify the DSP as v12.

Original comment by greyro...@gmail.com on 18 Jun 2014 at 9:53

[GoogleCodeExporter]

Whoops I didn't paste in your SHA-1 correctly. Line 86 should be
              0x80, 0x01, 0x60, 0xDF, 0x89, 0x01, 0x9E, 0xE3, 0xE8, 0xF7, 0x47, 0x2C, 0xE0, 0x1F, 0xF6, 0x80, 0xE9, 0x85, 0xB0, 0x24,                 //      12 Dolphin=0x267fd05a=Pikmin PAL

Original comment by greyro...@gmail.com on 18 Jun 2014 at 9:55

[GoogleCodeExporter]

Now we need to make the patch.  Dolphin has an executable called DSPTool.  We 
need to run this on the bin file.  The command is "DSPTool.exe -d -o 
DSP_UC_267FD05A.txt DSP_UC_267FD05A.bin".  This will disassemble the code.  
We're looking for access to any of these:
ACCAH, ACCSH, and ACCEH.  If I remeber correctly all the Zelda ucode games have 
two references to ACCAH and one reference each to ACCSH and ACCEH near one of 
the ACCAH references.  I need the line of code before and the line of code at 
both of these groups (including the line numbers e.g. 06a0).
 0653 009e ffff lri         $AC0.M, #0xffff
 0655 2ed6      srs         @ACEAH, $AC0.M

 069f 02ca      lsrn        
 06a0 00fe ffd8 sr          @ACCAH, $AC0.M

Then we need to find somewhere to put our patches.  The best place would be at 
the end if there's room.  How many 00s (nops) are there at the end?  Give me 
the first line of these at the end, e.g.
 0e66 0000      nop         
We need 6 to make our patch.  If there's not room at the end look for a halt 
line that comes after setting dmbh, dmbl and dirq.
We're almost done after this.

Original comment by greyro...@gmail.com on 18 Jun 2014 at 10:29

[GoogleCodeExporter]

Sorry I meant we need 10 nops.

Original comment by greyro...@gmail.com on 18 Jun 2014 at 10:32

[GoogleCodeExporter]

Also, make it the two lines before and the line at the groups.

Original comment by greyro...@gmail.com on 18 Jun 2014 at 10:41

[GoogleCodeExporter]

OK. I compiled nintendont with the changes to patch.c and Pikmin's dsp really 
gets identified as v12 in the ndebug.log, so the data I sent you was right.

Here are the lines with ACCAH:

 04b4 1f98      mrr         $AC0.L, $AX0.L
 04b5 147f      lsr         $ACC0, #-1
 04b6 2ed8      srs         @ACCAH, $AC0.M

 0503 7900      decm        $AC1.M
 0504 02ca      lsrn        
 0505 2ed8      srs         @ACCAH, $AC0.M

Unfortunately there are no lines with ACCEH and ACCSH after the first and 
second ACCAH is ACCAL.

There are only 5 nops at the end, so here is the only halt with DMBH, DMBL and 
DIRQ before:

 0547 16fc dcd1 si          @DMBH, #0xdcd1
 0549 16fd 0002 si          @DMBL, #0x0002
 054b 16fb 0001 si          @DIRQ, #0x0001
 054d 0021      halt  

Original comment by peter.wa...@gmail.com on 19 Jun 2014 at 7:51

[GoogleCodeExporter]

Just saw that you have ACEAH in your example so I guess might need those, too.

ACEAH:

 04ae 4c00      add         $ACC0, $ACC1
 04af 0200 0030 addi        $AC0.M, #0x0030
 04b1 2ed6      srs         @ACEAH, $AC0.M

 04fb 4c00      add         $ACC0, $ACC1
 04fc 0200 0030 addi        $AC0.M, #0x0030
 04fe 2ed6      srs         @ACEAH, $AC0.M

And I have also two lines with ACSAH:

 04a8 1f5e      mrr         $AX0.H, $AC0.M
 04a9 1f1c      mrr         $AX0.L, $AC0.L
 04aa 2ed4      srs         @ACSAH, $AC0.M

 04f4 1f1c      mrr         $AX0.L, $AC0.L
 04f5 0200 0010 addi        $AC0.M, #0x0010
 04f7 2ed4      srs         @ACSAH, $AC0.M

Original comment by peter.wa...@gmail.com on 19 Jun 2014 at 8:55

[GoogleCodeExporter]

Great.  This looks like it matches Dsp v10 and v11.  Assuming that the line 
04f3 is the same as 04a8, we actually only need one patch that we call twice.  
That means we only need 5 nops.
The size of the code is 0x1a60.  If I did my math right, that means the first 
nop is at d2b.
So, in Patch.c line 632 (between case 11 and default) our new patch code looks 
like this:
                case 12:                // Pikmin PAL
                {
                        // D2B - unused
                        W32((u32)ptr + (0x0D2B + 0) * 2, 0x02601000); // ori $AC0.M, 0x1000
                        Tmp = R32((u32)ptr + (0x04A8 + 0) * 2); // original instructions at 0x4A8/0x4F3
                        W32((u32)ptr + (0x0D2B + 2) * 2, Tmp); // original instructions at 0x4A8/0x4F3
                        Tmp = R32((u32)ptr + (0x0D2B + 4) * 2); // original instructions at 0xD2F/0xD30
                        Tmp = (Tmp & 0x0000FFFF) | 0x02DF0000;
                        W32((u32)ptr + (0x0D2B + 4) * 2, Tmp); // ret/original instruction

                        // 4A8
                        W32((u32)ptr + (0x04A8 + 0) * 2, 0x02BF0D2B); // call 0x0D2B

                        // 4F3
                        W32((u32)ptr + (0x04F3 + 0) * 2, 0x02BF0D2B); // call 0x0D2B

                } break;

Because we're right at the end of the code, we have to be careful with data at 
d30, which is why this looks slightly different than the ones for v10,v11.
If it actually matches v10 and v11 and I did everything right, that should do 
it.  Let me know if it works.

Original comment by greyro...@gmail.com on 19 Jun 2014 at 11:43

[GoogleCodeExporter]

Hi greyrogue,

you did it! The sound is perfect now. Thank you for your time!

Original comment by peter.wa...@gmail.com on 19 Jun 2014 at 12:10

[GoogleCodeExporter]

Fixed in r95 (v1.94)

Original comment by greyro...@gmail.com on 20 Jun 2014 at 3:26

• Changed state: Fixed