Difference between revisions of "Talk:Syscon Hardware"

From PS3 Developer wiki
Jump to: navigation, search
(PS2 Mechacon vs PSP Syscon vs PS3 Syscon vs Vita Syscon vs PS4 Syscon)
(Packets, Lovely Packets)
Line 193: Line 193:
  
 
<pre>
 
<pre>
Command              Address      Permission
+
Command              Address      Permission Sub-Commands/Params Function
w                    0xf98b0000L  0xDD0C0000
+
becount              0xCA7D      0xDD0C0000 - Display bringup/shutdown count + Power-on time
r                    0xa58c0000L  0xDD0C0000
+
bepgoff              0xA4E7      0xD00C0000 - BE power grid off
w16                  0x2d8e0000  0xDD0C0000
+
bepkt                0x2435D      0xDC0C0000 show Packet permissions
r16                  0xd58e0000L  0xDD0C0000
+
set
w32                  0xed8f0000L  0xDD0C0000
+
unset
r32                  0x91910000L  0xDD0C0000
+
mode
w64                 0xa9920000L  0xDD0C0000
+
debug
r64                  0x5d930000  0xDD0C0000
+
help
r64d                 0x8f940000L  0xDD0C0000
+
bestat              0xD413      0xFD0F0000 - Get status of BE
wbe                  0x65960000  0xDD0C0000
+
boardconfig          0x99C7      0xDC0C0000 - Displays board configuration (NOT WORKING?)
rbe                  0xf9960000L  0xDD0C0000
+
bootbeep            0x1EA67      0xF0000000 stat Boot beep
boardconfig         0xc7990000L  0xDC0C0000
+
on
comm                0x19990000  0xDC0C0000
+
off
commt                0x7490200    0xDC0C0000
+
bringup              0xD597      0xFD0F0000 - Turn PS3 on
printmode            0xd9990000L  0xDC0C0000
+
bsn                 0xD805      0xF00F0000 - Get board serial number
eepromcheck          0x1d9a0000  0x000C0000
+
bstatus              0x24269      0xDD0C0000 - HDMI related status
eeprominit          0x659a0000  0x000C0000
+
buzz                 0xA4FF      0xDC0C0000 [freq] Activate buzzer
hdmi                0x399f0200  0xDD0C0000
+
buzzpattern          0xA8B7      0xDC0C0000 [freq] [pattern] [count] Buzzer pattern
xrcv                 0x13530200  0xDC0C0000
+
clear_err            0x2595B      0xDD0C0000 last Clear errors
bepkt               0x5d430200  0xDC0C0000
+
eeprom
task                 0x5500100    0xDD0C0000
+
all
duty                0x239b0000  0xDD0C0000
+
clearerrlog         0xB8CB      0xDD0C0000 - Clears error log
tsensor              0x79a20000  0xDD0C0000
+
comm                0x9919      0xDC0C0000 - Communication mode
bepgoff              0xe7a40000L  0xD00C0000
+
commt                0x24907      0xDC0C0000 help Manual BE communication
getrtc              0xf3a60000L  0xDD0C0000
+
start
rtcreset            0xbba70000L  0x000C0000
+
stop
ledmode              0xba80000    0xDC0C0000
+
send
buzzpattern          0xb7a80000L  0xDC0C0000
+
cp                  0x1E077      0xF0000000 ready CP control commands
eepcsum              0x65aa0000  0xDD0C0000
+
busy
tmp                  0x69aa0000  0xDD0C0000
+
reset
trp                  0x2fab0000  0xDD0C0000
+
beepremote
hyst                0xf5ae0000L  0xDD0C0000
+
beep2kn1n3
tshutdown            0xa1b20000L  0xDD0C0000
+
beep2kn2n3
tzone                0xe1b50000L  0xDD0C0000
+
csum                 0xD687      0xFF0F0000 - Firmware checksum
errlog              0xedb70000L  0xFF0C0000
+
devpm               0xD053      0xDD0C0000 ata/pci/pciex/rsx Device power management
lasterrlog           0xffb70000L  0xDD0C0000
+
diag                 0x9AAD      0xD00C0000 ... Diag (execute without param to show help) (NOT WORKING?)
geterrlog            0x4fb80000  0xDD0C0000
+
disp_err            0x25911      0xDD0C0000 - Displays errors
clearerrlog          0xcbb80000L  0xDD0C0000
+
duty                0x9B23      0xDD0C0000 get/set Fan policy
stoplogerrtsk        0xd9b80000L  0xDD0C0000
+
get/setmin
startlogerrtsk       0xe7b80000L  0xDD0C0000
+
get/setmax
stoplogerrtoeep     0xf5b80000L  0xDD0C0000
+
get/setinimin
restartlogerrtoeep  0x3b90000    0xDD0C0000
+
get/setinimax
trace                0x51b90000  0xDD0C0000
+
dve                  0x2995D      0xDC0C0000 help DVE chip parameters
disp_err             0x11590200  0xDD0C0000
+
set
clear_err            0x5b590200  0xDD0C0000
+
save
printpatch           0x4fd90000  0xDD0C0000
+
show
patchverram          0x65d90000  0xDD0C0000
+
eepcsum              0xAA65      0xDD0C0000 - Does nothing
patchcsum            0xf7d90000L  0xDD0C0000
+
eepromcheck          0x9A1D      0x000C0000 [id] Check eeprom
patchvereep          0xb1d90000L  0xDD0C0000
+
eeprominit          0x9A65      0x000C0000 [id] Init eeprom
portscan            0xdda0000    0xDD0C0000
+
ejectsw              0xD611      0xFD0F0000 - Eject switch
powupcause           0x21b60000  0xDD0C0000
+
errlog              0xB7ED      0xFF0C0000 - Gets the error log
syspowdown           0xe9b60000L  0xDD0C0000
+
fancon              0xD26D      0x0D000000 - Does nothing
powbtnmode           0x11b90000  0xDC0C0000
+
fanconautotype      0xC075      0xDD0C0000 - Does nothing
dve                  0x5d990200  0xDC0C0000
+
fanconmode          0xBF35      0xDD0C0000 get Fan control mode
fanconpolicy        0xc9bb0000L  0xDD0C0000
+
fanconpolicy        0xBBC9      0xDD0C0000 get/set Fan control policy
fanconmode           0x35bf0000  0xDD0C0000
+
getini/setini
fanconautotype       0x75c00000  0xDD0C0000
+
fandiag              0x1E91B      0xF0000000 - Fan test
fantbl              0x87c00000L  0xDD0C0000
+
faninictrl           0xD3D9      0x0D000000 - Does nothing
tshutdowntime        0x5dc90000  0xDD0C0000
+
fanpol              0xCA31      0xDD0C0000 - Does nothing
fanservo            0x29bf0000  0xDD0C0000
+
fanservo            0xBF29      0xDD0C0000 - Does nothing
thrm                 0x1dbf0000  0xDD0C0000
+
fantbl              0xC087      0xDD0C0000 get/set Fan table
fanpol              0x31ca0000  0xDD0C0000
+
getini/setini
thermfatalmode      0x3bca0000  0xDD0C0000
+
getselect/setselect
becount             0x7dca0000   0xDD0C0000
+
firmud              0xD61D      0xFDFF0000 - Firmware update
wmmto               0x3bcb0000  0xDC0C0000
+
geterrlog            0xB84F      0xDD0C0000 [id] Gets error log
ltstest             0x97cb0000L  0xDD0C0000
+
getrtc              0xA6F3       0xDD0C0000 - Gets rtc
fancon               0x6dd20000  0x0D000000
+
halt                0x1E107      0xF0000000 - Halts syscon
powerstate          0x6fce0000  0xDD0C0000
+
hdmi                0x29F39     0xDD0C0000 ... HDMI (various commands, use help)
devpm                0x53d00000  0xDD0C0000
+
hdmiid              0x29D1D      0xDC0F0000 - Get HDMI id's
wrsxc                0x79d20000  0xDD0C0000
+
hdmiid2              0x29D81      0xDC0F0000 - Get HDMI id's
rrsxc                0x13d30000  0xDD0C0000
+
hversion             0x2422F      0xDD0C0000 - Platform ID
faninictrl           0xd9d30000L  0x0D000000
+
hyst                0xAEF5      0xDD0C0000 get/set Temperature zones
therrclr            0xe5d30000L  0xDD0C0000
+
getini/setini
poll                0xe3400200L  0xDD0C0000
+
lasterrlog           0xB7FF      0xDD0C0000 - Last error from log
recv                0x35410200  0xDD0C0000
+
ledmode              0xA80B      0xDC0C0000 [id] [id] Get led mode
send                 0x6f410200  0xDD0C0000
+
LS                  0x2421B      0xDD0C0000 - LabStation Mode
LS                  0x1b420200  0xDD0C0000
+
ltstest              0xCB97      0xDD0C0000 get/set be/rsx ?Temp related? values
hversion            0x2f420200  0xDD0C0000
+
osbo                0x1EA3F      0xF0000000 - Sets 0x2000F60
bstatus              0x69420200  0xDD0C0000
+
patchcsum            0xD9F7      0xDD0C0000 - Patch checksum
buzz                0xffa40000L  0xDC0C0000
+
patchvereep          0xD9B1      0xDD0C0000 - Patch version eeprom
diag                0xad9a0000L  0xD00C0000
+
patchverram          0xD965      0xDD0C0000 - Patch version ram
xdrdiag             0x11e70100  0xF0000000
+
poll                0x240E3      0xDD0C0000 - Poll log
xiodiag              0x75e80100  0xF0000000
+
portscan            0xDA0D      0xDD0C0000 [port] Scan port (NOT WORKING?)
fandiag              0x1be90100  0xF0000000
+
powbtnmode           0xB911      0xDC0C0000 [mode (0/1)] Power button mode
osbo                0x3fea0100  0xF0000000
+
powerstate           0xCE6F      0xDD0C0000 - Get power state
bestat              0x13d40000  0xFD0F0000
+
powersw              0xD5F9      0xFD0F0000 - Power switch
bringup             0x97d50000L  0xFD0F0000
+
powupcause           0xB621      0xDD0C0000 - Power up cause
shutdown            0xc5d50000L  0xFD0F0000
+
printmode            0x99D9      0xDC0C0000 [mode (0/1/2/3)] Set printmode
powersw              0xf9d50000L  0xFD0F0000
+
printpatch           0xD94F      0xDD0C0000 - Prints patch
resetsw              0x5d60000    0xFC0F0000
+
r                    0x8CA5       0xDD0C0000 [offset] [length] Read byte from SC
ejectsw              0x11d60000  0xFD0F0000
+
r16                  0x8ED5      0xDD0C0000 [offset] [length] Read word from SC
thalttest            0x13d80000  0x000F0000
+
r32                  0x9191      0xDD0C0000 [offset] [length] Read dword from SC
bsn                 0x5d80000    0xF00F0000
+
r64                  0x935D      0xDD0C0000 [offset] [length] Read qword from SC
firmud              0x1dd60000  0xFDFF0000
+
r64d                 0x948F      0xDD0C0000 [offset] [length] Read ?qword data? from SC
hdmiid              0x1d9d0200  0xDC0F0000
+
rbe                  0x96F9      0xDD0C0000 [offset] Read from BE
hdmiid2             0x819d0200L  0xDC0F0000
+
recv                0x24135      0xDD0C0000 - Receive something
version              0x5fd60000  0xFFFF0000
+
resetsw             0xD605      0xFC0F0000 - Reset switch
csum                0x87d60000L  0xFF0F0000
+
restartlogerrtoeep   0xB903      0xDD0C0000 - Reenable error logging to eeprom
revision            0xe1d70000L  0xFFFF0000
+
revision            0xD7E1      0xFFFF0000 - Get softid
cp                  0x77e00100  0xF0000000
+
rrsxc               0xD313      0xDD0C0000 [offset] [length] Read from RSX
halt                 0x7e10100    0xF0000000
+
rtcreset            0xA7BB      0x000C0000 - Reset RTC
bootbeep            0x67ea0100  0xF0000000
+
scagv2              0xE24F      0xFF000000 - Auth related?
scopen              0x21e10000  0xFF000000
+
scasv2              0xE207      0xDD000000 - Auth related?
scclose              0xefe10000L  0xFF000000
+
scclose             0xE1EF      0xFF000000 - Auth related?
scasv2              0x7e20000    0xDD000000
+
scopen               0xE121      0xFF000000 - Auth related?
scagv2              0x4fe20000  0xFF000000
+
send                0x2416F      0xDD0C0000 [variable] Send something
 +
shutdown            0xD5C5      0xFD0F0000 - PS3 shutdown
 +
startlogerrtsk      0xB8E7      0xDD0C0000 - Start error log task
 +
stoplogerrtoeep      0xB8F5      0xDD0C0000 - Stop error logging to eeprom
 +
stoplogerrtsk        0xB8D9      0xDD0C0000 - Stop error log task
 +
syspowdown           0xB6E9      0xDD0C0000 3 params System power down
 +
task                0x15005      0xDD0C0000 - Print tasks
 +
thalttest            0xD813      0x000F0000 - Does nothing
 +
thermfatalmode      0xCA3B      0xDD0C0000 canboot/cannotboot Set thermal boot mode
 +
therrclr            0xD3E5      0xDD0C0000 - Thermal register clear
 +
thrm                 0xBF1D      0xDD0C0000 - Does nothing
 +
tmp                  0xAA69      0xDD0C0000 [zone] Get temperature
 +
trace                0xB951      0xDD0C0000 ... Trace tasks (use help)
 +
trp                  0xAB2F      0xDD0C0000 get/set Temperature zones
 +
getini/setini
 +
tsensor             0xA279      0xDD0C0000 [sensor] Get raw temperature
 +
tshutdown            0xB2A1      0xDD0C0000 get/set Thermal shutdown
 +
getini/setini
 +
tshutdowntime        0xC95D      0xDD0C0000 [time] Thermal shutdown time
 +
tzone                0xB5E1      0xDD0C0000 - Show thermal zones
 +
version             0xD65F      0xFFFF0000 - SC firmware version
 +
w                    0x8BF9      0xDD0C0000 [offset] [value] Write byte to SC
 +
w16                  0x8E2D      0xDD0C0000 [offset] [value] Write word to SC
 +
w32                  0x8FED      0xDD0C0000 [offset] [value] Write dword to SC
 +
w64                  0x92A9      0xDD0C0000 [offset] [value] Write qword to SC
 +
wbe                 0x9665      0xDD0C0000 [offset] [value] Write to BE
 +
wmmto                0xCB3B      0xDC0C0000 get Get watch dog timeout
 +
wrsxc                0xD279      0xDD0C0000 [offset] [value] Write to RSX
 +
xdrdiag             0x1E711      0xF0000000 start XDR diag
 +
info
 +
result
 +
xiodiag              0x1E875      0xF0000000 - XIO diag
 +
xrcv                 0x25313      0xDC0C0000 - Xmodem receive
 
</pre>
 
</pre>

Revision as of 18:42, 12 September 2019

Problem with syscon pinout numeration in wiki in the SWX-xxx series (128 pins package)

In all the SWX-xxx series pages the pinout is numered starting with the pin1 at bottom-left corner (when viewing the syscon in the same orientation than the printed texts) this way:

  • """pin 1 left bottom at mark, counter clockwise from south (pins 1-38) to east (pins 39-64), north (pins 65-102), west (103-128))"""

In the first SW series is barelly visible (in the photos it looks is not marked) but in newer series is more visible, and is located at bottom-rigth corner, see this photos i marked: http://666kb.com/i/cnj3qic8k412x3p8r.jpg

  • All photos are taken from wiki visibles in his respective pages... look for the original photo to see it in better resolution (when posible because there are not much photos of syscons in wiki or internet)

If this is correct, is needed to change the info about the pinout in all the affected pinout tables (in all SWX-xxx pages)

PowerON/off HDMI/CEC, WiFi, Bluetooth, GbLAN, buttons etc

There is no seperate communication processor on the PS3. Powering is handled by syscon.

  • Power and eject buttons/switchs are connected with syscon (indirectly), there is no protocol involved, the syscon pins related with this buttons has 2 posible states: 3.3v (when button is not pressed)... or 0v (when button is pressed)

Multipage Correction

<TizzyT> eussnl my syscon is CXR714120-301GB its different form what the wiki says
CECHH / DIA-001

Package

http://pastie.org/private/tkcfjwit37huzyzoie7z5g BGA

ball count: 4x16 + 8x14 + 2x12 = 64+112+24 = 200 pads

new QF package is 26 * 38 = 128 pins

Clocks

SysCon clocks:

T4 XTAL / T5 EXTAL goes to [X4001] of 16.9344 MHz
C16 OSCIN / B16 OSCOUT goes to [X4002] of 32.768 kHz

http://oi52.tinypic.com/2s9ziw0.jpg

Backup Mode / Diag

BACKUP_MODE / DIAG_MODE pins on Gen 2 might be pins 110 and 111. They are pulled low. Not completely sure, but looking at those pins in relation to what's around them seems like it could be those two.


SEM-001 CECHG

Pink is N15 BACKUP_MODE
Blue is N16 DIAG_MODE

picture: http://psx-scene.com/forums/attachments/f149/26456d1300550098-brick-recovery-research-untitled-1.jpg source: http://psx-scene.com/forums/780185-post344.html !unverified!

According to schematics, DIAG and BACKUP_MODE are are shown in the following picture for COK-001 and COK-002 Motherboards - http://goput.it/69k.jpg These pins are tied to 3.3v so grounding them should enable each mode respectively. !unverified!


SoftID

Note: moved from seperate page, as there are already over 8 different syscon pages and the very same info is mention in depth on the SC firmware and SC hardware page (and in 150 wiki edits on the sysinfo page :/) we dont have a sperate page for every SELF flag either ;) (although there are >4 pages describing SELF :/)

a SoftID is just a 0x4 code that tells you the hardware revision of the syscon.
This info can be get through the More System Information method.
You can find them also inside the SYS_CON_FIRMWARE_*********.pkg (Syscon_Firmware) at the offset 0x28E (In this link you can found the list of the Syscon update packages)
every SoftID is associated with the ps3 mainboard. this means that you can know if a SC is compatible with your board without opening a PS3 ( Syscon Hardware)

SoftID SC Generation notes
Phats
0B8E 1 -
0C16 2 -
0D52 3 -
0DBF 4 -
0E69 5 -
0F29 6 -
0F38 7 -
065D 8 -
Slims
0832 9 -
08C2 10 -
0918 11 -

Datasheet of SoC similar to syscon

COK-002 with 0DBF syscon

Information: https://lh5.googleusercontent.com/-UiaHRjhdt50/UesKSGuxdFI/AAAAAAAAGOU/0FV8Fazyl60/s800/TV2013072019053700.jpg

Min ver: https://lh5.googleusercontent.com/-iUOuidm6v3g/UexEQily6TI/AAAAAAAAGOk/zSfBMpYDRAM/s800/TV2013072117272000.jpg

Board type: https://lh6.googleusercontent.com/-K1sc66WzJxo/Ue1Mdr5mHeI/AAAAAAAAGO8/rnqlidQAVfY/s800/DSC01591.JPG

Syscon: https://lh6.googleusercontent.com/-OTxjx3qJV0M/Ue1L2itOfRI/AAAAAAAAGO0/Bv6zli_xQQg/s800/DSC01590.JPG


Talk

-This breaks lot of standards/pages/tables in wiki, can you add some notes please ?. E.g: the board came from official repair service, bought in a normal shop, or is a frankenstein made at home ?, it boots correctly and allows firmware updates ?. If it works normally i think this proves CXR713120-20xGB and CXR714120-30xGB shares the same pinout, but the fact that is using 0DBF SoftID is a bit shocking (maybe because is the minimal SoftID allowed by CXR714120-30xGB ?... check SoftID examples in this table) --Sandungas 22:07, 24 July 2013 (MSK)

-The console is a CECHE01 MG (Metal Gear Solid 4 edition) and came with a 3rd generation BD drive (the first type with 2 lens). It had never been to SONY for service. It works normally, correctly and as you could see, has a minimum version which is compatible with the motherboard type. --l_oliveira


SHA1 hashes stored at eeprom

from http://www.edepot.com/playstation3.html

"Files finally stored into the FLASH regions have their associated SHA-1 hash value stored in the SYSCON EEPROM for authentication and verification purposes. "

What happens if we change those hashes to something a 3.55 ofw would have? (assuming we were doing this experiment on a hackable console?)

PS2 Mechacon vs PSP Syscon vs PS3 Syscon vs Vita Syscon vs PS4 Syscon

Production Start Date (<=) PS2 Mechacon PSP Syscon PS3 Syscon Vita Syscon PS4 Syscon Used IC/CPU Core
10/1999 CXP101064 - - - - Sony SPC970 (100 pin)
01/2000 CXP102064 - - - -
09/2000 CXP103049 - - - - Sony SPC??? (136 pin)
08/2004 - BARxx - - - NEC D790019 / D780032AY (78K0/78003xA, 64 pin)
07/2005 - B30x - - - NEC D79F0036 / D78F????? (78K0/KE2, 64 pin)
07/2007 - B40x - - - NEC D79F???? / D78F????? (78K0/???, 84 pin)
07/2008 - 3Axx - - - NEC D79F???? / D78F????? (78K0/???, ?? pin)
03/2009 - 3Bxx - - - NEC D79F???? / D78F????? (78K0/???, ?? pin)
05/2009 - 40xx - - - NEC D79F???? / D78F????? (78K0/???, ?? pin)
03/2003 CXR706080 - - - - Sony SR11
PS2 (Dragon): 164 pin
PS3 (Donkey): 200 pin
09/2004 CXR716080 - CXR713120 - -
07/2007 CXR726080 - CXR714120 - -
03/2008 - - SW - - NEC D79F0073 / D78F11AA (78K0R/KH3, 128 pin)
05/2009 - - SW2 - - NEC D79F0086 / D78F11BB (78K0R/KH3, 128 pin)
07/2010 - - - "SC" - NEC D79F0109 / D78F???? (78K0R/???, 121 pin)
06/2011 - - SW3 - - NEC D79F0123 / D78F11CC (78K0R/KG3, 100 pin)
07/2013 - - - - C0L Renesas R5F100PL (RL78/G13, 100 pin)
08/2013 - - - A0xxx - Renesas ?R5F120PL? (RL78/???, ?100? pin)
04/2015 - - - - C0L2 Renesas R5F101LL (RL78/G13, 64 pin)
  • The SPC900 core was designed by Texas Instruments [[1]]
  • CXP101064, CXP102064 are similar to CXP97 (CXP971000, CXP972032, CXP973064, CXP973F064)
    • In-Circuit-Emulator: Mitek NICE-SPC970 [[2]]; Debug software: SVD970; Flash programmer: SFP-2
  • A F inside the model name specifies if the IC contains flash memory.
    • Mass-produced units don't have/use program flash memory, instead a encrypted firmware patch is stored on the data-"EEPROM"
  • CXR7 series uses Sony SR11 CPU (ARM7TDMI)
    • Models with public datasheet: CXR702080, CXR702F080, CXR704060
    • Maybe based on the Texas Instruments TMS470R1 series (derived from TMS470R1B512 ?)
  • Prototype PS3 Syscon's:

Packets, Lovely Packets

Command              Address      Permission	Sub-Commands/Params			Function
becount              0xCA7D       0xDD0C0000	-							Display bringup/shutdown count + Power-on time
bepgoff              0xA4E7       0xD00C0000	-							BE power grid off
bepkt                0x2435D      0xDC0C0000	show						Packet permissions
												set
												unset
												mode
												debug
												help
bestat               0xD413       0xFD0F0000	-							Get status of BE
boardconfig          0x99C7       0xDC0C0000	-							Displays board configuration				(NOT WORKING?)
bootbeep             0x1EA67      0xF0000000	stat						Boot beep
												on
												off
bringup              0xD597       0xFD0F0000	-							Turn PS3 on
bsn                  0xD805       0xF00F0000	-							Get board serial number
bstatus              0x24269      0xDD0C0000	-							HDMI related status
buzz                 0xA4FF       0xDC0C0000	[freq]						Activate buzzer
buzzpattern          0xA8B7       0xDC0C0000	[freq] [pattern] [count]	Buzzer pattern
clear_err            0x2595B      0xDD0C0000	last						Clear errors
												eeprom
												all
clearerrlog          0xB8CB       0xDD0C0000	-							Clears error log
comm                 0x9919       0xDC0C0000	-							Communication mode
commt                0x24907      0xDC0C0000	help						Manual BE communication
												start
												stop
												send
cp                   0x1E077      0xF0000000	ready						CP control commands
												busy
												reset
												beepremote
												beep2kn1n3
												beep2kn2n3
csum                 0xD687       0xFF0F0000	-							Firmware checksum
devpm                0xD053       0xDD0C0000	ata/pci/pciex/rsx			Device power management
diag                 0x9AAD       0xD00C0000	...							Diag (execute without param to show help)	(NOT WORKING?)
disp_err             0x25911      0xDD0C0000	-							Displays errors
duty                 0x9B23       0xDD0C0000	get/set						Fan policy
												get/setmin
												get/setmax
												get/setinimin
												get/setinimax
dve                  0x2995D      0xDC0C0000	help						DVE chip parameters
												set
												save
												show
eepcsum              0xAA65       0xDD0C0000	-							Does nothing
eepromcheck          0x9A1D       0x000C0000	[id]						Check eeprom
eeprominit           0x9A65       0x000C0000	[id]						Init eeprom
ejectsw              0xD611       0xFD0F0000	-							Eject switch
errlog               0xB7ED       0xFF0C0000	-							Gets the error log
fancon               0xD26D       0x0D000000	-							Does nothing
fanconautotype       0xC075       0xDD0C0000	-							Does nothing
fanconmode           0xBF35       0xDD0C0000	get							Fan control mode			
fanconpolicy         0xBBC9       0xDD0C0000	get/set						Fan control policy
												getini/setini
fandiag              0x1E91B      0xF0000000	-							Fan test			
faninictrl           0xD3D9       0x0D000000	-							Does nothing
fanpol               0xCA31       0xDD0C0000	-							Does nothing
fanservo             0xBF29       0xDD0C0000	-							Does nothing
fantbl               0xC087       0xDD0C0000	get/set						Fan table
												getini/setini
												getselect/setselect
firmud               0xD61D       0xFDFF0000	-							Firmware update
geterrlog            0xB84F       0xDD0C0000	[id]						Gets error log
getrtc               0xA6F3       0xDD0C0000	-							Gets rtc
halt                 0x1E107      0xF0000000	-							Halts syscon
hdmi                 0x29F39      0xDD0C0000	...							HDMI (various commands, use help)
hdmiid               0x29D1D      0xDC0F0000	-							Get HDMI id's
hdmiid2              0x29D81      0xDC0F0000	-							Get HDMI id's
hversion             0x2422F      0xDD0C0000	-							Platform ID
hyst                 0xAEF5       0xDD0C0000	get/set						Temperature zones
												getini/setini
lasterrlog           0xB7FF       0xDD0C0000	-							Last error from log
ledmode              0xA80B       0xDC0C0000	[id] [id]					Get led mode
LS                   0x2421B      0xDD0C0000	-							LabStation Mode
ltstest              0xCB97       0xDD0C0000	get/set be/rsx				?Temp related? values
osbo                 0x1EA3F      0xF0000000	-							Sets 0x2000F60
patchcsum            0xD9F7       0xDD0C0000	-							Patch checksum
patchvereep          0xD9B1       0xDD0C0000	-							Patch version eeprom
patchverram          0xD965       0xDD0C0000	-							Patch version ram
poll                 0x240E3      0xDD0C0000	-							Poll log
portscan             0xDA0D       0xDD0C0000	[port]						Scan port									(NOT WORKING?)
powbtnmode           0xB911       0xDC0C0000	[mode (0/1)]				Power button mode
powerstate           0xCE6F       0xDD0C0000	-							Get power state
powersw              0xD5F9       0xFD0F0000	-							Power switch
powupcause           0xB621       0xDD0C0000	-							Power up cause
printmode            0x99D9       0xDC0C0000	[mode (0/1/2/3)]			Set printmode
printpatch           0xD94F       0xDD0C0000	-							Prints patch
r                    0x8CA5       0xDD0C0000	[offset] [length]			Read byte from SC		
r16                  0x8ED5       0xDD0C0000	[offset] [length]			Read word from SC	
r32                  0x9191       0xDD0C0000	[offset] [length]			Read dword from SC	
r64                  0x935D       0xDD0C0000	[offset] [length]			Read qword from SC	
r64d                 0x948F       0xDD0C0000	[offset] [length]			Read ?qword data? from SC
rbe                  0x96F9       0xDD0C0000	[offset]					Read from BE
recv                 0x24135      0xDD0C0000	-							Receive something
resetsw              0xD605       0xFC0F0000	-							Reset switch
restartlogerrtoeep   0xB903       0xDD0C0000	-							Reenable error logging to eeprom
revision             0xD7E1       0xFFFF0000	-							Get softid
rrsxc                0xD313       0xDD0C0000	[offset] [length]			Read from RSX							
rtcreset             0xA7BB       0x000C0000	-							Reset RTC
scagv2               0xE24F       0xFF000000	-							Auth related?
scasv2               0xE207       0xDD000000	-							Auth related?
scclose              0xE1EF       0xFF000000	-							Auth related?
scopen               0xE121       0xFF000000	-							Auth related?
send                 0x2416F      0xDD0C0000	[variable]					Send something
shutdown             0xD5C5       0xFD0F0000	-							PS3 shutdown
startlogerrtsk       0xB8E7       0xDD0C0000	-							Start error log task
stoplogerrtoeep      0xB8F5       0xDD0C0000	-							Stop error logging to eeprom
stoplogerrtsk        0xB8D9       0xDD0C0000	-							Stop error log task
syspowdown           0xB6E9       0xDD0C0000	3 params					System power down
task                 0x15005      0xDD0C0000	-							Print tasks
thalttest            0xD813       0x000F0000	-							Does nothing
thermfatalmode       0xCA3B       0xDD0C0000	canboot/cannotboot			Set thermal boot mode		
therrclr             0xD3E5       0xDD0C0000	-							Thermal register clear
thrm                 0xBF1D       0xDD0C0000	-							Does nothing
tmp                  0xAA69       0xDD0C0000	[zone]						Get temperature
trace                0xB951       0xDD0C0000	...							Trace tasks (use help)
trp                  0xAB2F       0xDD0C0000	get/set						Temperature zones
												getini/setini
tsensor              0xA279       0xDD0C0000	[sensor]					Get raw temperature
tshutdown            0xB2A1       0xDD0C0000	get/set						Thermal shutdown
												getini/setini
tshutdowntime        0xC95D       0xDD0C0000	[time]						Thermal shutdown time
tzone                0xB5E1       0xDD0C0000	-							Show thermal zones
version              0xD65F       0xFFFF0000	-							SC firmware version
w                    0x8BF9       0xDD0C0000	[offset] [value]			Write byte to SC
w16                  0x8E2D       0xDD0C0000	[offset] [value]			Write word to SC
w32                  0x8FED       0xDD0C0000	[offset] [value]			Write dword to SC
w64                  0x92A9       0xDD0C0000	[offset] [value]			Write qword to SC
wbe                  0x9665       0xDD0C0000	[offset] [value]			Write to BE
wmmto                0xCB3B       0xDC0C0000	get							Get watch dog timeout
wrsxc                0xD279       0xDD0C0000	[offset] [value]			Write to RSX
xdrdiag              0x1E711      0xF0000000	start						XDR diag
												info
												result
xiodiag              0x1E875      0xF0000000	-							XIO diag
xrcv                 0x25313      0xDC0C0000	-							Xmodem receive