PC Engine CD BIOS Devlog: Reaching BIOS API Entry Points in Local Retail Disc Traces

I'm developing oss-pce-cd-bios, an open-source project aiming to replace the PC Engine / TurboGrafx-CD System Card firmware.

The previous update covered a multi-sector synthetic IPL loader running through a separate 256 KiB development image on a pinned Geargrafx core.

Since then, the most interesting result isn't a larger test count. Local traces of two commercial CDs now reach BIOS API entry points after the IPL, rather than stopping at the earlier media-layout mismatch.

To be precise: neither disc reached a title screen, and no retail-game compatibility is claimed. The observed calls still lead to unimplemented development stubs.

Getting beyond the pre-API blocker

The original diagnostic loader used a synthetic disc-layout assumption. On the locally held commercial CUE/BIN media, that assumption could place the IPL information-sector selection incorrectly, producing a PRE_API_BLOCKER_OBSERVED result before the BIOS interface could even be studied.

PR #728 introduced explicit opt-in local CUE discovery. The --commercial mode only considers local media under ./rom/; the public CI suite does not search for or consume private commercial images.

PR #730 then added a CUE-aware automatic loader configuration:

• Parse the selected CUE text and derive the data track's INDEX 01 position using file-size metadata without reading the BIN payload.
• Apply that position to a purpose-built PUBLIC diagnostic loader, with separate DEV behavior preserved.
• Reject unsupported or ambiguous layouts and unsafe destination-overflow cases.
• Keep names, absolute paths, media content, hashes, and private sector coordinates out of the public manifest and evidence.

The resulting local measurements, made with a pinned Geargrafx core in cold and warm configurations, were:

One disc reached a JSR into candidate slot $02; another reached a sequence of API calls followed by a stub halt. The observer checks the call/return sequence before classifying a result as confirmed.

This is an instrumentation milestone, not a functioning replacement BIOS. The commercial bytes stay local, and no private traces or game-derived content are published to the repository or CI.

Investigating CD_BASE without pretending the ABI is known

The candidate at slot $02 is being investigated as CD_BASE, but that identification and its precise ABI are not verified.

PR #731 builds a host-side discriminator for competing address-coordinate models: absolute LBA, track-relative, INDEX 00-relative, and other caller-adjusted interpretations.

PR #733 adds a sanitized observation catalogue and fail-closed schema, while PR #736 rejects unknown or unsupported host-side CD_BASE conditions.

None of these PRs execute the proprietary reference entry point. The candidate's register behavior, side effects, error contract, and LBA origin remain unresolved. A model that can distinguish hypotheses is not a measurement that proves one hypothesis correct.

Better refusal boundaries and stronger evidence gates

PR #734 improves the synthetic multi-sector loader by probing its final target sector before performing the first load-area write. Some end-of-media failures that previously occurred after partial copying are now rejected with zero copied bytes.

This is still a reachability probe, not a guarantee that all sectors belong to the intended data track. Other failure modes and the media track-length contract remain open.

Separately, the pinned-core ST/IRQ/MMIO diagnostic in PR #732 was merged after additional no-resume, instruction-fetch, and side-effect validation.

The E1–E3, E4–E5, and unified host judge work is also merged. These components exercise synthetic pre-block and device-access decisions, but their fixture-level PASS is not permission to execute reference firmware. The production gate remains blocked.

The development ROM now has 15 entries

Finally, PR #748 added a project-defined EX_JOYREP implementation at candidate slot $22. The DEV contract returns while preserving the tested CPU state, stack, and page registers; pinned Geargrafx regression tests and an intentionally broken mutant check the behavior.

As of the November 10 main snapshot (890c149):

Upcoming work includes safely characterizing the first required CD-related API contracts, replacing one stub at a time, and refining IPL address-range handling. Work in open draft PRs, including wider LBA support, is not counted as a merged capability.

The project is still far from a distributable, compatible System Card. But reaching an observable BIOS call boundary on real local disc layouts provides a more concrete target for the next implementation step than merely improving synthetic boot tests.

Repository: https://github.com/mao2009/oss-pce-cd-bios

Implementation evidence: https://github.com/mao2009/oss-pce-cd-bios/blob/main/docs/status.md

This is an independent project, unaffiliated with NEC, Hudson Soft, Konami, or other rights holders. It does not distribute proprietary BIOS images, retail game data, or extracted commercial code.