Editing Syscon Hardware
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
[[File:SYSCON_GEN1.JPG|thumb|Syscon 1st Generation (BGA Packaging)]] | |||
Syscon is the main power controller chip. It is responsible for powering up the various power systems and for configuring and initialising the [[CELL BE]], [[RSX]] and [[South Bridge]]. It communicates with these devices via seperate SPI busses. There is external access by JTAG (disabled at factory by blowing a fuse), an EEPROM programming interface <!-- not fully examined --> and Serial (UART). The Syscon is a SoC and consists of an ARM7TDMI (ARMv4) CPU, a 256KB EEPROM and 16KB RAM. | |||
= | = Serialnumbers @ SKU = | ||
== Retail == | |||
{| class="wikitable sortable" | |||
== | |||
{| class="wikitable" | |||
|- | |- | ||
| < | ! [[SKU Models|Model]] !! [[IDPS|Type]] !! [[Motherboard Revisions|Board]] !! [[Syscon Hardware|Syscon<br />part no.]] !! Syscon<br />[[More System Information#First_section|Soft ID]] !! Notes | ||
|- | |- | ||
| < | | [[CECHAxx]]<br />[[CECHBxx]] || 0x01<br />0x02 || [[COK-00x#COK-001|COK-001]] || [[CXR713120-201GB]] || 0B8E || | ||
|- | |- | ||
| < | | [[CECHCxx]]<br />[[CECHExx]] || 0x03<br />0x04 || [[COK-00x#COK-002|COK-002]] or<br />[[COK-00x#COK-002W|COK-002W]] || [[CXR713120-201GB]] or<br />[[CXR713120-202GB]] || 0C16 || | ||
|- | |- | ||
| | | [[CECHGxx]] || 0x05 || [[SEM-00x|SEM-001]] || [[CXR713120-201GB]] or<br />[[CXR713120-202GB]] or<br />[[CXR713120-203GB]] || 0D52 || | ||
|- | |- | ||
| | | [[CECHHxx]] || 0x06 || [[DIA-00x#DIA-001|DIA-001]] || [[CXR714120-301GB]] || 0DBF || | ||
|- | |- | ||
| < | | [[CECHJxx]]<br />[[CECHKxx]] || 0x07 || [[DIA-00x#DIA-002|DIA-002]] || [[CXR714120-301GB]] or<br />[[CXR714120-302GB]] || 0E69 || | ||
|- | |- | ||
| < | | [[CECHLxx]]<br />[[CECHMxx]]<br />[[CECHPxx]]<br />[[CECHQxx]] || 0x08 || [[VER-00x|VER-001]] || [[SW-301]] or<br />[[SW-302]] || 065D || | ||
|- | |- | ||
| | | [[CECH-20xx]] || 0x09 || [[DYN-00x|DYN-001]] || [[SW2-301]] || 0832 || | ||
|- | |- | ||
| | | [[CECH-21xx]] || 0x0A || [[SUR-00x|SUR-001]] || [[SW2-301]] or<br />[[SW2-302]] || 08A0 || | ||
|- | |- | ||
| | | [[CECH-25xx]] || 0x0B || [[JTP-00x|JTP-001]] or<br />[[JSD-00x|JSD-001]] || [[SW2-301]] or<br />[[SW2-302]] or<br />[[SW2-303]] || 08C2 || | ||
|- | |- | ||
| | | [[CECH-30xx]] || 0x0C || [[KTE-00x|KTE-001]] || [[SW2-301]] or<br />[[SW2-302]] or<br />[[SW2-303]] || 0918 || | ||
|- | |- | ||
| | | [[CECH-40xx]] || 0x0D || [[MSX-00x|MSX-001]] or<br />[[MPX-00x|MPX-001]] || [[SW3-302]] || 098F || | ||
|- | |||
|- | |- | ||
|} | |} | ||
==Non retail== | |||
{| class="wikitable sortable" | |||
= | |||
{| class="wikitable" | |||
|- | |- | ||
! [[ | ! [[SKU Models|Model]] !! [[IDPS|Type]] !! [[Motherboard Revisions|Board]] !! [[Syscon Hardware|Syscon<br />part no.]] !! Syscon<br />[[More System Information#First_section|Soft ID]] !! Active JTAG !! Notes | ||
| | |||
|- | |- | ||
| [[CEB-2040]] || - || [[MPU-501]] || [[CXR713F120|CXR713F120GB-000]] || || Yes || Retail prototype | |||
| | |||
|- | |- | ||
| [[DECR-1000|DECR1000(A/J)]] || 0x01 || [[TMU-520]] || [[CXR713F120A]] || 03FB || ? <!-- PS3NEWS says yes, but no proof --> || Reference tool | |||
| | |||
|- | |- | ||
| [[DEH-H1000A(S)(-E(S))]] || 0x01 || [[COK-001 (Prototype)]] || [[CXR713F120A]] || 0B67 || ? <!-- same SC, so yes --> || Preproduction | |||
| | |||
|- | |- | ||
| [[DEH-H1001-D]] || 0x01 || [[COOKIE-13]] || [[CXR713F120A]] || ?0B67? || ? <!-- PS3NEWS says yes, but no proof --> || Preproduction | |||
| | |||
|- | |- | ||
| [[DEH-FH1500J-A]] || || [[VERTIGO-02]] || || || || Preproduction | |||
| | |||
|- | |- | ||
! | <!-- Not Prototype debug units - see retail --> | ||
|} | |} | ||
<br/> | |||
---- | |||
Not mentioned:<pre> | |||
0F29 - ? | |||
0F38 - ?</pre> | |||
= Syscon Externalised Ports = | = Syscon Externalised Ports = | ||
'''Note:''' for more specific information per model, see the links to each subppage in the Serialnumbers @ SKU table. | |||
'''Note:''' for more specific information per model, see the links to each | |||
== Syscon UART packets == | == Syscon UART packets == | ||
Line 168: | Line 65: | ||
SCUARTD packets includes header of 0x3 bytes and optional payload (depending on the command). | SCUARTD packets includes header of 0x3 bytes and optional payload (depending on the command). | ||
Packet IDs are not important, they are used only by clients and processed by SCUART daemon. SCUART daemon opens terminal file /dev/ttyS0 and use it to send commands and receive responses. | Packet IDs are not important, they are used only by clients and processed by SCUART daemon. SCUART daemon opens terminal file /dev/ttyS0 and use it to send commands and receive responses. | ||
Line 190: | Line 86: | ||
! Packet ID !! Command/Action !! Description !! Notes | ! Packet ID !! Command/Action !! Description !! Notes | ||
|- | |- | ||
| 0x00 || '''version''' || Firmware version || Gets installed syscon's firmware version | | 0x00 || '''version''' || Firmware version || Gets installed syscon's firmware version | ||
|- | |- | ||
| 0x01 || '''bringup''' || | | 0x01 || '''bringup''' || || <!--// Standby->ON (Remote Power ON using an UART package, from [[Communication Processor]] ?) //--> | ||
|- | |- | ||
| 0x02 || '''shutdown''' || | | 0x02 || '''shutdown''' || || <!--// ON->Standby (Remote Power OFF using an UART package, from [[Communication Processor]] ?) //--> | ||
|- | |- | ||
| 0x03 || '''firmud''' || Firmware update || Notifies about firmware update operation | | 0x03 || '''firmud''' || Firmware update || Notifies about firmware update operation | ||
Line 200: | Line 96: | ||
| 0x04 || '''bsn''' || Board Serial Number || Retrieves syscon's Board Serial Number | | 0x04 || '''bsn''' || Board Serial Number || Retrieves syscon's Board Serial Number | ||
|- | |- | ||
| 0x05 || '''halt''' || | | 0x05 || '''halt''' || || Used at start of firmware update operation | ||
|- | |- | ||
| 0x06 || '''cp ready''' || | | 0x06 || '''cp ready''' || || <!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]] //--> | ||
|- | |- | ||
| 0x07 || '''cp busy''' || | | 0x07 || '''cp busy''' || || <!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]] //--> | ||
|- | |- | ||
| 0x08 || '''cp reset''' || | | 0x08 || '''cp reset''' || || <!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]] //--> | ||
|- | |- | ||
| 0x09 || '''bestat''' || Cell B.E. status || Retrieves Cell B.E. status | | 0x09 || '''bestat''' || Cell B.E. status || Retrieves Cell B.E. status | ||
|- | |- | ||
| 0x0A || '''powersw''' || Power switch || | | 0x0A || '''powersw''' || <!-- Power switch ? --> || | ||
|- | |- | ||
| 0x0B || '''resetsw''' || Reset switch || | | 0x0B || '''resetsw''' || <!-- Reset switch ? --> || | ||
|- | |- | ||
| 0x0C || '''bootbeep stat''' || | | 0x0C || '''bootbeep stat''' || || | ||
|- | |- | ||
| 0x0D || '''bootbeep on''' || | | 0x0D || '''bootbeep on''' || || | ||
|- | |- | ||
| 0x0E || '''bootbeep off''' || | | 0x0E || '''bootbeep off''' || || | ||
|- | |- | ||
| 0x0F || ''Reset syscon'' || Reset | | 0x0F || ''Reset syscon'' || Reset || Resets syscon | ||
|- | |- | ||
| 0x10 || '''xdrdiag info''' || XDR diagnostics | | 0x10 || '''xdrdiag info''' || XDR diagnostics || | ||
|- | |- | ||
| 0x11 || '''xdrdiag start''' || XDR diagnostics | | 0x11 || '''xdrdiag start''' || XDR diagnostics || Starts XDR diagnostics | ||
|- | |- | ||
| 0x12 || '''xdrdiag result''' || XDR diagnostics | | 0x12 || '''xdrdiag result''' || XDR diagnostics || Gets a result of XDR diagnostics | ||
|- | |- | ||
| 0x13 || '''xiodiag''' || XIO diagnostics || Starts XIO diagnostics and gets a result of it | | 0x13 || '''xiodiag''' || XIO diagnostics || Starts XIO diagnostics and gets a result of it | ||
Line 234: | Line 130: | ||
| 0x15 || '''errlog''' || Error log || Retrieves a list of codes (with timestamps) of latest errors | | 0x15 || '''errlog''' || Error log || Retrieves a list of codes (with timestamps) of latest errors | ||
|- | |- | ||
| 0x16 || ''Read line'' || | | 0x16 || ''Read line'' || || | ||
|- | |- | ||
| | | 0x17 || '''tmpforcp <zone ID>''' || Reference Tool's temperature || Gets the temperature of reference tool | ||
|- | |- | ||
| | | 0x18 || || || | ||
|- | |- | ||
| | | 0x19 || || || | ||
|- | |- | ||
| 0x20 || '''cp beepremote''' || | | 0x20 || '''cp beepremote''' || || | ||
|- | |- | ||
| 0x21 || '''cp beep2kn1n3''' || || | | 0x21 || '''cp beep2kn1n3''' || || | ||
|- | |- | ||
| 0x22 || '''cp beep2kn2n3''' || || | | 0x22 || '''cp beep2kn2n3''' || || | ||
|- | |- | ||
|} | |} | ||
Notes: | |||
* Some commands are unavailable on earlier firmwares, for example, tmpforcp is only supported on 1.3.3+. | * Some commands are unavailable on earlier firmwares, for example, tmpforcp is only supported on 1.3.3+. | ||
* Some commands are divided into several strings, the first part (if exists) describes a command group, the second part describes the actual command and other parts describes command arguments. | * Some commands are divided into several strings, the first part (if exists) describes a command group, the second part describes the actual command and other parts describes command arguments. | ||
Line 388: | Line 178: | ||
move $a0, $zero | move $a0, $zero | ||
</syntaxhighlight> | </syntaxhighlight> | ||
* An actual firmware update process (without halting and resetting steps) takes about 1 minute. | * An actual firmware update process (without halting and resetting steps) takes about 1 minute. | ||
== Syscon UART == | == Syscon UART == | ||
Line 419: | Line 189: | ||
|- | |- | ||
|} | |} | ||
You can attach a 3.3v TTL cable (LV-TTL) to the UART on syscon (UART0_TxD, UART0_RxD). Baud rate is 57600. There is a simple plaintext protocol involved. This varies on different syscon models. Example: | You can attach a 3.3v TTL cable (LV-TTL) to the UART on syscon (UART0_TxD, UART0_RxD). Baud rate is 57600. There is a simple plaintext protocol involved. This varies on different syscon models. Example: | ||
Line 439: | Line 194: | ||
'''<command>:<hash>''' | '''<command>:<hash>''' | ||
Where the hash is the sum of command bytes & 0xFF | Where the hash is the sum of command bytes & 0xFF | ||
you should terminate commands with \r\n, the syscon messages are only terminated with \n | |||
=== Samples === | === Samples === | ||
Here are some of the commands/messages encountered: | Here are some of the commands/messages encountered: | ||
Line 464: | Line 218: | ||
Commands: | Commands: | ||
<pre> | <pre>VER:ED | ||
VER:ED | |||
OK 00000000 S1E 00 00 065D:A4 | OK 00000000 S1E 00 00 065D:A4 | ||
ERRLOG:CB | ERRLOG:CB | ||
Line 478: | Line 229: | ||
C:F1:BUZ | C:F1:BUZ | ||
E:4F:NG F0000004 | E:4F:NG F0000004 | ||
C:D0:CID | C:D0:CID | ||
E:50:NG F0000005 | E:50:NG F0000005 | ||
C:DA:EEP | C:DA:EEP | ||
E:50:NG F0000005 | E:50:NG F0000005 | ||
C:D5:FAN | C:D5:FAN | ||
E:50:NG F0000005 | E:50:NG F0000005 | ||
Line 511: | Line 246: | ||
C:F8:SPU | C:F8:SPU | ||
E:50:NG F0000005 | E:50:NG F0000005</pre> | ||
more [[Talk:System_Controller_Firmware#Syscon_commands|Syscon commands]] | |||
bruteforcing commands:<!--// LOL //--> http://pastebin.com/CNei0xbC | |||
< | |||
== Syscon (SPI) EEPROM == | |||
{| class="wikitable" | |||
== | |||
{| class="wikitable" | |||
! BGA !! Name !! Description | ! BGA !! Name !! Description | ||
|- | |- | ||
Line 564: | Line 274: | ||
|} | |} | ||
{| class="wikitable" | == Syscon JTAG == | ||
disabled in factory after production on retailmodels | |||
{| class="wikitable" | |||
! BGA !! Name !! Description | ! BGA !! Name !! Description | ||
|- | |- | ||
| | | L8 || JRTCK || Return Test Clock | ||
|- | |- | ||
| | | K8 || JTCK || Test Clock | ||
|- | |- | ||
| | | K9 || JTDO || Test Data Out | ||
|- | |- | ||
| | | L9 || JTMS || Test Mode State / Test Mode Select | ||
|- | |- | ||
| | | K7 || JTDI || Test Data In | ||
|- | |- | ||
| | | L7 || JNTRST || Test Reset | ||
|- | |- | ||
|} | |} | ||
{| class="wikitable" | = Syscon Underlaying ports = | ||
== Syscon Cell SPI Bus == | |||
{| class="wikitable" | |||
! BGA !! Name !! Description | ! BGA !! Name !! Description | ||
|- | |- | ||
| | | M2 || /BE_SPI_CS || Chip Select | ||
|- | |- | ||
| | | N2 || BE_SPI_DO || Serial Data Output | ||
|- | |- | ||
| | | M1 || BE_SPI_DI || Serial Data Input | ||
|- | |- | ||
| | | N1 || BE_SPI_CLK || Serial Data Clock | ||
|- | |- | ||
| | | P2 || /BE_RESET || CellBE Reset | ||
|- | |- | ||
| | | P1 || BE_POWGOOD || CellBE PowerGood | ||
|- | |- | ||
| | | T2 || /BE_INT || CellBE Interrupt | ||
|- | |- | ||
|} | |} | ||
{| class="wikitable" | == Syscon Southbridge SPI Bus == | ||
{| class="wikitable" | |||
! BGA !! Name !! Description | ! BGA !! Name !! Description | ||
|- | |- | ||
| B9 || SB_SPI_CS || Chip Select | | B9 || /SB_SPI_CS || Chip Select | ||
|- | |- | ||
| B8 || SB_SPI_DO || Serial Data Output | | B8 || SB_SPI_DO || Serial Data Output | ||
Line 617: | Line 325: | ||
|- | |- | ||
| A8 || SB_SPI_CLK || Serial Data Clock | | A8 || SB_SPI_CLK || Serial Data Clock | ||
|- | |- | ||
|} | |} | ||
<!--// Remote Power ON/OFF (from network, HDMI CEC commands, etc...) is managed by devices connected to the southbridge (ethernet/wifi/BT, HDMI controller, etc...) //--> | |||
{{Motherboard Components}}<noinclude>[[Category:Main]]</noinclude> | {{Motherboard Components}}<noinclude>[[Category:Main]]</noinclude> |