# PlayStation 2 Memory Card File System

## By Ross Ridge

## Public Domain

This document is a description of the file system layout as used on PlayStation 2 memory cards. It's based on the research I did while writing mymc, a utility for working with PS2 memory card images. This document tries to be comprehensive an accurate, but some details may be missing, misleading or just plain wrong. At lot of assumptions had to be made during my research, and it's hard know to what exactly Sony intended in every case. All most all of the names for structures, fields and flags were made up by me. Nothing in this document should be considered official.

For brevity, unused fields and flag bits are omitted from the tables. In most cases unused fields or flags should be assumed to be either reserved or padding and set to zero when writing. In particular, you'll need to pad out the structures to the length given at the top of the table. All values are stored on the card using the little-endian byte order.

## NAND Flash Memory Basics

### Glossary

A number of terms are used in this document that you may not familiar with or are different from other sources describing PS2 memory cards, so I've created short glossary.

block
  See "erase block".
cluster
  The unit of allocation used in the file system. A cluster is one or more pages in size.
ECC
  Error correcting code. A means of encoding data so that random bit errors can be detected and corrected.
erase block
  The basic erasable unit on a memory card.
`half`
  A two byte unsigned half-word value.
page
  The basic addressable unit on a memory card. Corresponds to page on the flash device used in the memory card, and is analogous to a sector on hard disk.
programming
  The operation of changing erased bits on a flash device from 1 to 0.
superblock
  The first page on the memory card where important information about the structure of the file system is kept.
`word`
  A four byte unsigned word value.

Since PlayStation 2 (PS2) memory cards use NAND Flash it's helpful to understand some of the basics about this kind of memory works. Flash is a non-volatile form of memory that can be electrically erased and reprogrammed. Since it's non-volatile, meaning it doesn't need power to retain data, and reprogramable, meaning the data stored can be changed, it's the ideal form memory to use in memory card. However, flash memory does have number of limitations which affect how the PS2 uses its memory cards.

One of the limitations is a relatively slow random access time. While much faster than hard disk, NAND flash is much slower than RAM at reading random bytes in memory. Reading the first byte of data from a flash device takes about 25 microseconds. Fortunately, reading on sequentially is much faster. After the first byte is read, each subsequent byte takes only about 50 nanoseconds to read. For this reason NAND flash memory is organized in to pages, similar to how a hard drive is organized into sectors. For example, with the TC58V64AFT, a flash device used in PS2 memory cards, an entire 528 byte page can be read at a sustained 10 Mb/s transfer rate. By comparison, the transfer rate for reading random bytes is much slower, only 40kb/s. Because the serial bus the PS2 uses to talk to memory cards isn't capable of 10 Mb/s, actual transfer rates will be slower.

The biggest limitation of flash devices is how they're written. Instead changing bits of memory to 0 or 1 depending on the data being written, flash memory can only change a bit from 1 to 0. Once a bit of memory has been changed to 0, it can't be changed back to 1 except by erasing it. Erasing is an operation that sets an entire range of memory, called an erase block, to all 1s. Once a block is erased, it can be written through an operation called programming which changes 1 bits to 0 bits. Since an erase block is made up of a number of pages, this makes writing a more complicated operation than it would be on a hard disk. In order to write a single page to a flash device you need to erase to the block that the page belongs to. However, since that will erase all the pages that belong to that block, not just the page being written, you first need to read in all of the other pages that are going to be erased. After the block is erased you then can program the erase block with the contents of the page you're trying to write and along with the content of all the other pages. Some flash devices work the other way, erasing sets the block to all 0s while programming changes 0s to 1s.

Another limitation is that flash memory isn't as reliable as RAM memory. A flash device will typically have a certain number of bad blocks when it ships from the factory, and it's possible for defects to appear in the media as it used. Also, a block can eventually "wear out" after a few hundred thousand program/erase cycles. For this reason each page is divided into two parts, a data area a spare area. The data area is used to store ordinary data, while the much smaller spare area is for software defined error-correcting codes (ECC), wear leveling, bad block remapping, and other functions meant to deal with defects in the media.

The flash devices used in PS2 memory cards have a 528 byte page size. This is divided into a 512 byte data area and 16 byte spare area. The spare area is used to store 12 bytes of ECC data, with the remaining 4 bytes left unused. Erase blocks are 16 pages long. The are 16384 pages, for a total combined raw data area capacity 8,388,608 bytes.

## File System Organization

### Standard Memory
Card Layout

`0x0000` | Superblock
`0x0001` | Unused
`0x0010` | Indirect FAT Table
`0x0012` | FAT Table
`0x0052` | Allocatable Clusters
`0x3ED2` | Reserved Clusters
`0x3FE0` | Backup Block 2
`0x3FF0` | Backup Block 1
`0x3FFF`

The PS2 memory card file system has a fairly simple design, with some allowances made for the limitations of flash memory. Its overall structure is similar to the well known MS-DOS FAT file system. It uses a file allocation table (FAT) to keep track of allocated space and a hierarchical directory system where all of a file's metadata is stored in its directory entry. Like the FAT file system, which groups disk sectors into clusters, the PS2 memory card file system groups flash memory pages in to clusters. On standard PS2 memory cards, the cluster size 1024 bytes, or 2 pages long.

### The Superblock

The key to the PS2 memory card file system is the superblock. Located in the first page of the memory, this is the only part of the file system with a fixed location. While some things like the do end up in fixed locations on standard 8M memory cards, you shouldn't rely on this.

Superblock (340 bytes)
Offset | Name | Type | Default | Description
--- | --- | --- | --- | ---
`0x00` | `magic` | `byte[28]` | `-` | Identifies the card as being formatted. Set to the ASCII string "`Sony PS2 Memory Card Format` ".
`0x1C` | `version` | `byte﻿[12]` | `1.X.0.0` | Version number of the format used. Version 1.2 indicates full support for `bad_block_list`.
`0x28` | `page_len` | `half` | `512` | Size in bytes of a memory card page.
`0x2A` | `pages_per_cluster` | `half` | `2` | The number of pages in a cluster.
`0x2C` | `pages_per_block` | `half` | `16` | The number of pages in an erase block.
`0x2E` | `-` | `half` | `0xFF00` | Doesn't seem to be used
`0x30` | `clusters_per_card` | `word` | `8192` | The total size of the card in clusters.
`0x34` | `alloc_offset` | `word` | `41` | Cluster offset of the first allocatable cluster. Cluster values in the FAT and directory entries are relative to this. This is the cluster immediately after the FAT
`0x38` | `alloc_end` | `word` | `8135` | The cluster after the highest allocatable cluster. Relative to `alloc_offset`. Not used.
`0x3C` | `rootdir_cluster` | `word` | `0` | First cluster of the root directory. Relative to `alloc_offset`. Must be zero.
`0x40` | `backup_block1` | `word` | `1023` | Erase block used as a backup area during programming. Normally the the last block on the card, it may have a different value if that block was found to be bad.
`0x44` | `backup_block2` | `word` | `1022` | This block should be erased to all ones. Normally the the second last block on the card.
`0x50` | `ifc_list` | `word[32]` | `8` | List of indirect FAT clusters. On a standard 8M card there's only one indirect FAT cluster.
`0xD0` | `bad_block_list` | `word[32]` | `-1` | List of erase blocks that have errors and shouldn't be used.
`0x150` | `card_type` | `byte` | `2` | Memory card type. Must be 2, indicating that this is a PS2 memory card.
`0x151` | `card_flags` | `byte` | `0x52` | Physical characteristics of the memory card.

Card Flags
Mask | Name | Description
--- | --- | ---
`0x01` | `CF_USE_ECC` | Card supports ECC.
`0x08` | `CF_BAD_BLOCK` | Card may have bad blocks.
`0x10` | `CF_ERASE_ZEROES` | Erased blocks have all bits set to zero.

Most of the fields in the superblock should be self-explanatory. The fields `page_len`, `pages_per_cluster`, `pages_per_block,` and `clusters_per_card` define the basic geometry of the file system. The FAT can be accessed using `ifc_list` and `rootdir_cluster` gives the first cluster of the root directory. Cluster offsets in FAT and directory entries are all relative to `alloc_offset`

File systems ment to be compatible with the PS2's memory card drivers have a fairly restricted set of geometry options. The field `page_size` can be either 512 or 1024. If the page size is 512 then `pages_per_cluster` can either be 1 or 2, otherwise it can only be 1. The limit on `pages_per_block` is 16. There doesn't seem to be any upper limit on `clusters_per_card`, however because of the size of `ifc_list` there can be no more than 8,388,608 allocatable clusters. While the clusters the make up the FAT can be located anywhere, the value of `rootdir_cluster` must be 0, indicating that the first allocatable cluster is the first cluster of the root directory.

### File Allocation Table

The file allocation table is used for keeping track of which clusters are in use and form a linked-list of the clusters that belong to each file. Each entry in the table is a 32-bit value. If the the cluster corresponding to the entry is free then the most significant bit will be clear. Otherwise, it will be set and the lower 31-bits of the value are the index of the next cluster in the file. These indexes are relative to `alloc_offset` given in the superblock. A value of `0xFFFFFFFF` indicates that this entry is the last cluster in the file.

Unlike the MS-DOS FAT file system, the table isn't required to to be in single contiguous range of clusters. Instead a system of double-indirect indexing is used that allows the clusters that make up the file allocation table to be scattered across file system. The `ifc_list` in the superblock contains a table 32-bit cluster indexes (relative to the start of the card). The entries in the `ifc_list` point to the clusters that make up the indirect table. The indirect table is also a table 32-bit cluster indexes and these indexes point to the clusters that make up the file allocation table.

So assuming a cluster size of 1024, code to access an entry in the FAT might look something like this:

`fat_offset = fat_index % 256
indirect_index = fat_index / 256
indirect_offset = indirect_index % 256
dbl_indirect_index = indirect_index / 256
indirect_cluster_num = superblock.ifc_table[dbl_indirect_index]
indirect_cluster = read_cluster(indirect_cluster_num)
fat_cluster_num = indirect_cluster[indirect_offset]
fat_cluster = read_cluster(fat_cluster_num)
entry = fat_cluster[fat_offset]`

### Directories

Directories are for the most part like regular files, except that they contain directory entries rather than data. The root directory is as its name suggests, the root of the card's hierarchical directory structure. The first cluster of the root directory is given in the `rootdir_cluster` field of the superblock, and subsequent clusters (if any) can be found by following chain of linked clusters in the FAT.

Directory Entry Mode Flags
Mask | Name | Description
--- | --- | ---
`0x0001` | `DF_READ` | Read permission.
`0x0002` | `DF_WRITE` | Write permission.
`0x0004` | `DF_EXECUTE` | Execute permission. Unused
`0x0008` | `DF_PROTECTED` | Directory is copy protected. Meaningful only to the browser.
`0x0010` | `DF_FILE` | Regular file.
`0x0020` | `DF_DIRECTORY` | Directory.
`0x0040` | `-` | Used internally to create directories.
`0x0080` | `-` | Copied?
`0x0100` | `-` | -
`0x0200` | `O_CREAT` | Used to create files.
`0x0400` | `DF_0400` | Set when files and directories are created, otherwise ignored.
`0x0800` | `DF_POCKETSTN` | PocketStation application save file.
`0x1000` | `DF_PSX` | PlayStation save file.
`0x2000` | `DF_HIDDEN` | File is hidden.
`0x4000` | `-` | -
`0x8000` | `DF_EXISTS` | This entry is in use. If this flag is clear, then the file or directory has been deleted.

Directory Entry (512 bytes)
Offset | Name | Type | Description
--- | --- | --- | ---
`0x00` | `mode` | `half` | See directory mode table.
`0x04` | `length` | `word` | Length in bytes if a file, or entries if a directory.
`0x08` | `created` | `byte[8]` | Creation time.
`0x10` | `cluster` | `word` | First cluster of the file, or `0xFFFFFFFF` for an empty file. In "." entries this the first cluster of this directory's parent directory instead. Relative to `alloc_offset`.
`0x14` | `dir_entry` | `word` | Only in "." entries. Entry of this directory in its parent's directory.
`0x18` | `modified` | `byte[8]` | Modification time.
`0x20` | `attr` | `word` | User defined attribute
`0x40` | `name` | `byte[32]` | Zero terminated name for this directory entry.

The first two directory entries in any directory are always two dummy entries named "." and "..", in that order. In path names, these two directory entries represent the current directory and the parent directory, as they do in Unix, but they serve different purposes in the file system. The first directory entry, the "." entry, is used to store a link to the parent directory. The second entry serves no purpose except as a place holder. The fields these entries do not reflect state of the directories that they are supposed to refer to. The `length` and `cluster` fields are always set 0 and the `modified` time never changes.

The first directory entry in the root directory is special case. It fills the role of the root directory's own directory entry. Unlike the "." entry in other directories, the fields in this entry are used and reflect the state of the root directory. In particular, the `length` field contains the number of directory entries root directory. The exception is the `cluster` field which isn't used.

Time of Day (8 bytes)
Offset | Name | Type | Description
--- | --- | --- | ---
`0x01` | `sec` | `byte` | seconds
`0x02` | `min` | `byte` | minutes
`0x03` | `hour` | `byte` | hours
`0x04` | `day` | `byte` | day of the month
`0x05` | `month` | `byte` | month (1-12)
`0x06` | `year` | `word` | year

The `created` and `modified` fields use the time format given in the Time of Day table. All time stamps use the Japan timezone (+9 UTC), regardless of the timezone the PS2 console was configured to use. A four digit year used.

Most of the mode flags don't serve any purpose in the structure of the file system and only have meaning to higher level software, like the PS2 browser. The `DF_PSX` flag indicates that file was copied from a PSX memory card. If the `DF_POCKETSTN` flag is set as well, the file is a PocketStation application file copied from a PocketStation.

Each directory entry is a massive 512 bytes long, so only two entries fit in each 1024 cluster. The unused bytes at the end of directory could be used for a longer name, but normally names are truncated to only 32 bytes. File names are case sensitive, and the characters "`?`", "`*`", and "`/`" along with all ASCII control characters are illegal in files.

## Error Management

A number of strategies are employed in the file system to handle errors are likely to occur when using memory cards.

### Error Correction Code

The first line defence is the use of error correcting codes to deal with any defects in the card's flash media. The 512 byte data area of each page is divided into 128 byte long chunks and for each chunk a simple 20-bit Hamming code is calculated. This code allows a single bit error in a chunk to be both detected and corrected. A total of three bytes are used to store this 20-bit Hamming code. The first byte contains the column (or bit-wise) parity bits, with the even groups in the lower nibble and the odd groups in the upper nibble. The second and third bytes contain the even and odd groups respectively for the line (or byte-wise) parity bits. The three ECC bytes for each of the four 128-byte chunks of a page are stored in order in the page's spare area.

### Backup Blocks

Two complete erase blocks are reserved to deal with the possibility of the memory card being removed by the user when data is being saved. Since writing a single cluster to card requires erasing and reprogramming the entire erase block the cluster belongs to, a failure during programming could destroy more then just data being written. The two backup blocks are used to ensure the an program operation completes atomically. Either programming completes successfully and no data is lost, or the erase block being programmed is left unchanged and only the new data being written is lost.

Before programming an erase block, both `backup_block1` and `backup_block2` are erase. Then `backup_block1` programmed with a backup copy of the new data for block, and the number of the erase block being programmed is written at the start of the `backup_block2`. The erase block being programmed is then erased and programmed. Finally, `backup_block2` is erased.

Recovery from failed program operation caused by removal of the memory card is implemented whenever a memory card is inserted into the PS2. First `backup_block2` is checked, if it's in a erased state then the last programming operation completed successfully and nothing else is done. If it's not erased, then programming is assumed to have not been completed. The contents of `backup_block1` are then copied to the erase block given in the first word of `backup_block2`. Then `backup_block2` is erased.

### Bad Sector List

The last defence against errors is a list of bad erase blocks kept in the superblock. If any part of an erase block is found to be defective it can be added to `bad_block_list`. No new clusters in this block should be allocated, however clusters already allocated in the block can still continue to be used.

### Reserved Clusters

The standard PS2 memory card drivers artificially reduce the number allocatable clusters by rounding the number down to the nearest 1000s clusters. Since clusters in blocks in the `bad_block_list` don't count as against the limit, this effectively creates a range of reserved replacement clusters. As blocks are marked as bad, clusters in reserved range become available and so the apparent capacity of the memory card remains the same. This was probably implemented so that memory cards shipped with varying numbers of bad blocks would all appear to have the same amount of free space in the PS2 browser.

## See Also

### NAND Flash Memory

Micron: NAND Flash 101: An Introduction to NAND Flash and How to Design It In to Your Next Product
Wikipedia: Flash memory

### Error Correction Codes

STMicroelectronics: Error Correction Code in Single Level Cell NAND Flash memories
Micron: Hamming Codes for NAND Flash Memories
Hanimar: Sample code for calculating ECC values in C