Syscon Hardware
Syscon is the main power controller chip. It is responsible for powering up the various power systems and for configuring and initialising the CELL BE, RSX and South Bridge. It communicates with these devices via seperate SPI busses. There is external access by JTAG (disabled at factory by blowing a fuse), an EEPROM programming interface and Serial (UART). The Syscon is a SoC and consists of an ARM7TDMI (ARMv4) CPU, a 256KB EEPROM and 16KB RAM.
Serialnumbers @ SKU
Retail
Model | Type | Board | Syscon part no. |
Syscon Soft ID |
Notes |
---|---|---|---|---|---|
CECHAxx CECHBxx |
0x01 0x02 |
COK-001 | CXR713120-201GB | 0B8E | |
CECHCxx CECHExx |
0x03 0x04 |
COK-002 or COK-002W |
CXR713120-201GB or CXR713120-202GB |
0C16 | |
CECHGxx | 0x05 | SEM-001 | CXR713120-201GB or CXR713120-202GB or CXR713120-203GB |
0D52 | |
CECHHxx | 0x06 | DIA-001 | CXR714120-301GB | 0DBF | |
CECHJxx CECHKxx |
0x07 | DIA-002 | CXR714120-301GB or CXR714120-302GB |
0E69 | |
CECHLxx CECHMxx CECHPxx CECHQxx |
0x08 | VER-001 | SW-301 or SW-302 |
065D | |
CECH-20xx | 0x09 | DYN-001 | SW2-301 | 0832 | |
CECH-21xx | 0x0A | SUR-001 | SW2-301 or SW2-302 |
08A0 | |
CECH-25xx | 0x0B | JTP-001 or JSD-001 |
SW2-301 or SW2-302 or SW2-303 |
08C2 | |
CECH-30xx | 0x0C | KTE-001 | SW2-301 or SW2-302 or SW2-303 |
0918 | |
CECH-40xx | 0x0D | MSX-001 or MPX-001 |
SW3-302 | 098F |
Non retail
Model | Type | Board | Syscon part no. |
Syscon Soft ID |
Active JTAG | Notes |
---|---|---|---|---|---|---|
CEB-2040 | - | MPU-501 | CXR713F120GB-000 | Yes | Retail prototype | |
DECR1000(A/J) | 0x01 | TMU-520 | CXR713F120A | 03FB | ? | Reference tool |
DEH-H1000A(S)(-E(S)) | 0x01 | COK-001 (Prototype) | CXR713F120A | 0B67 | ? | Preproduction |
DEH-H1001-D | 0x01 | COOKIE-13 | CXR713F120A | ?0B67? | ? | Preproduction |
DEH-FH1500J-A | VERTIGO-02 | Preproduction |
Not mentioned:
0F29 - ? 0F38 - ?
Syscon Externalised Ports
Note: for more specific information per model, see the links to each subppage in the Serialnumbers @ SKU table.
Syscon UART packets
SCUART daemon (SCUARTD) packet structure
SCUARTD packets includes header of 0x3 bytes and optional payload (depending on the command). Packet IDs are not important, they are used only by clients and processed by SCUART daemon. SCUART daemon opens terminal file /dev/ttyS0 and use it to send commands and receive responses.
Offset | Size | Description |
---|---|---|
0x00 | 0x01 | Magic? |
0x01 | 0x01 | Payload size |
0x02 | 0x01 | Command |
0x03 | Payload size | Payload data |
Packets
Packet ID | Command/Action | Description | Notes |
---|---|---|---|
0x00 | version | Firmware version | Gets installed syscon's firmware version |
0x01 | bringup | ||
0x02 | shutdown | ||
0x03 | firmud | Firmware update | Notifies about firmware update operation |
0x04 | bsn | Board Serial Number | Retrieves syscon's Board Serial Number |
0x05 | halt | Used at start of firmware update operation | |
0x06 | cp ready | ||
0x07 | cp busy | ||
0x08 | cp reset | ||
0x09 | bestat | Cell B.E. status | Retrieves Cell B.E. status |
0x0A | powersw | ||
0x0B | resetsw | ||
0x0C | bootbeep stat | ||
0x0D | bootbeep on | ||
0x0E | bootbeep off | ||
0x0F | Reset syscon | Reset | Resets syscon |
0x10 | xdrdiag info | XDR diagnostics | |
0x11 | xdrdiag start | XDR diagnostics | Starts XDR diagnostics |
0x12 | xdrdiag result | XDR diagnostics | Gets a result of XDR diagnostics |
0x13 | xiodiag | XIO diagnostics | Starts XIO diagnostics and gets a result of it |
0x14 | fandiag | Fan diagnostics | Retrieves RPMs of fans |
0x15 | errlog | Error log | Retrieves a list of codes (with timestamps) of latest errors |
0x16 | Read line | ||
0x17 | tmpforcp <zone ID> | Reference Tool's temperature | Gets the temperature of reference tool |
0x20 | cp beepremote | ||
0x21 | cp beep2kn1n3 | ||
0x22 | cp beep2kn2n3 |
Notes:
- Some commands are unavailable on earlier firmwares, for example, tmpforcp is only supported on 1.3.3+.
- Some commands are divided into several strings, the first part (if exists) describes a command group, the second part describes the actual command and other parts describes command arguments.
- Real syscon commands have an ASCII form (a bold text in the 2nd column) instead of bytes above.
- Packet with ID *0x03* notifies syscon and calls SX program (based on ZMODEM protocol) to send firmware, syscon have custom or original implementation of RX program to receive firmware. An implementation of ZMODEM protocol used by Sony: http://oss.sony.net/Products/Linux/Others/Download/DECR-1000/mips_fp_le-lrzsz-0.12.20-devtool.1.src.rpm
A syscon's update operation in SCUARTD consists of following steps:
- 1. Check if SX program presents in /usr/bin/sx. It should be a regular file.
- 2. Check if specified firmware file is a regular file.
- 3. Halt syscon by sending command halt to UART, then wait some time until it prints HALT: OK.
- 4. Reset syscon by sending byte 0x30 to GPIO register SC_PI0_DIPSW, byte 0x30 to GPIO register SC_RSTX, waiting 1 second and writing byte 0x31 to GPIO register SC_RSTX.
- 5. Get current syscon's firmwave version by sending command version to UART. After receiving it, look for a character after the first _ (underscore) symbol from the left side of string and if it equals to the character b, then proceed to the next step, otherwise go to the (8) step. (It is possible to patch this step to allow upgrading or downgrading at will)
- 6. Prepare syscon for an update by sending command firmud to UART, then fork the current process; the current process won't finish until a message Done from UART arrives (it is the end of update operation).
- 7. In the forked process start SX program and pass firmware file path to it. SX program reads firmware file and transfer each chunk of it to syscon.
- 8. After successful update operation reset syscon (a different way) by sending byte 0x31 to GPIO register SC_PI0_DIPSW, byte 0x30 to GPIO register SC_RSTX, waiting 1 second and writing byte 0x31 to GPIO register SC_RSTX.
Syscon UART
BGA | Name | Description |
---|---|---|
P16 | UART0_TxD | Serial Transmit |
P15 | UART0_RxD | Serial Receive |
You can attach a 3.3v TTL cable (LV-TTL) to the UART on syscon (UART0_TxD, UART0_RxD). Baud rate is 57600. There is a simple plaintext protocol involved. This varies on different syscon models. Example:
<command>:<hash>
Where the hash is the sum of command bytes & 0xFF
you should terminate commands with \r\n, the syscon messages are only terminated with \n
Samples
Here are some of the commands/messages encountered:
Messages:
Power applied (standby mode) OK 00000000:3A Power on # (PowerOn State):7F Power off (Hard shutdown) # (PowerOff State):DD After Fan test: # (PowerOff State) (Fatal):36 No text, invalid hash: NG F0000002:4D
Commands:
VER:ED OK 00000000 S1E 00 00 065D:A4 ERRLOG:CB OK 00000000:3A DATE:1E NG F0000003:4E C:F1:BUZ E:4F:NG F0000004 C:D0:CID E:50:NG F0000005 C:DA:EEP E:50:NG F0000005 C:D5:FAN E:50:NG F0000005 C:F4:KSV E:50:NG F0000005 C:ED:REV E:50:NG F0000005 C:F8:SPU E:50:NG F0000005
more Syscon commands
bruteforcing commands: http://pastebin.com/CNei0xbC
Syscon (SPI) EEPROM
BGA | Name | Description |
---|---|---|
F16 | CSB | Chip Select (needs to be low) |
H16 | DO | Serial Data Output |
G16 | DI | Serial Data Input |
E16 | SKB | Serial Data Clock |
J15 | WCB | Write Protect |
J16 | RBB | Ready/Busy |
G11 | VDDep | + 3.3V |
C15 | VSSep | GND |
Syscon JTAG
disabled in factory after production on retailmodels
BGA | Name | Description |
---|---|---|
L8 | JRTCK | Return Test Clock |
K8 | JTCK | Test Clock |
K9 | JTDO | Test Data Out |
L9 | JTMS | Test Mode State / Test Mode Select |
K7 | JTDI | Test Data In |
L7 | JNTRST | Test Reset |
Syscon Underlaying ports
Syscon Cell SPI Bus
BGA | Name | Description |
---|---|---|
M2 | /BE_SPI_CS | Chip Select |
N2 | BE_SPI_DO | Serial Data Output |
M1 | BE_SPI_DI | Serial Data Input |
N1 | BE_SPI_CLK | Serial Data Clock |
P2 | /BE_RESET | CellBE Reset |
P1 | BE_POWGOOD | CellBE PowerGood |
T2 | /BE_INT | CellBE Interrupt |
Syscon Southbridge SPI Bus
BGA | Name | Description |
---|---|---|
B9 | /SB_SPI_CS | Chip Select |
B8 | SB_SPI_DO | Serial Data Output |
A9 | SB_SPI_DI | Serial Data Input |
A8 | SB_SPI_CLK | Serial Data Clock |
|