Undocumented SPU Channels

Channels 64, 72 and 73

Used for storing the version.

Reading/writing the data:

void read_ch73(u32 skip, u32 *buf, u32 len) {	u32 i;	spu_wrch(64, 0x10000);	for(i = 0; i < skip; i++)	spu_rdch(73);	for(i = 0; i < len; i++)	buf[i] = spu_rdch(73); } void write_ch72(u32 skip, u32 *buf, u32 len) {	u32 i:	spu_wrch(64, 0x10000);	for(i = 0; i < skip; i++)	spu_wrch(72, spu_rdch(73));	for(i = 0; i < len; i++)	spu_wrch(72, buf[i]); } 

lv1ldr writes the version:

s64 lv1ldr_main(...) {	//...	u64 ldr_ver = 0x0003004100000000;	write_ch72(0, &ldr_ver, 2);	//... } 

Other isolated binaries check the version:

s64 check_version(u64 ldr_ver) {	u64 stored_ver;	read_ch73(0, &stored_ver, 2);	//... } s64 load_isoself(...) {	ldr_ver = 0x0003004100000000;	if(check_version(ldr_ver) != 0)	return 0x30;	//... } 

Seems lv1ldr 3.60+ storing root scramble key with its version to this buffer:

example for version 3.66: version: 00 03 00 66 00 00 00 00 00 00 00 00 rootkey: 86 51 28 F7 45 84 59 47 A0 CE finalbuf: 86 03 51 66 28 F7 45 84 59 47 A0 CE 

Channels 69, 70, and 71

Performance monitor related. Described in rpcs3 source code. Link

SPU_Set_Bkmk_Tag = 69, // Causes an event that can be logged in the performance monitor logic if enabled in the SPU. // ps2_netemu VU1 and PS2-SPU2 spe programs write something to that channel. SPU_PM_Start_Ev = 70, // Starts the performance monitor event if enabled SPU_PM_Stop_Ev = 71, // Stops the performance monitor event if enabled spu_rdchcnt() returns 1 for all of them. 

Channel 74

Returns random data. Mostly used as a seed to feed a FIPS 186 PRNG with it.
Official name is CH_RNG

Sample data (256 MB): https://mega.co.nz/#!gNc0hQrR!4rC-Stz5yqi7yqvp6OWOQcxB_XhlrOadoE_fE5fyDxE

A bitmap generated from RNG samples: