Talk:Syscon Hardware: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
mNo edit summary
 
(68 intermediate revisions by 7 users not shown)
Line 1: Line 1:
== Problem with syscon pinout numeration in wiki in the SWX-xxx series (128 pins package) ==
== Notes ==
In all the SWX-xxx series pages the pinout is numered starting with the pin1 at bottom-left corner (when viewing the syscon in the same orientation than the printed texts) this way:
*The SoftID (Syscon firmware build id) of retail chips is a 1:1 mapping to the syscon model. So each syscon model does have a unique SoftID.
*"""pin 1 left bottom at mark, counter clockwise from south (pins 1-38) to east (pins 39-64), north (pins 65-102), west (103-128))"""
*Every syscon within a series (CXR, SW, SW2, SW3) is backwards compatible, e.g. every CXR Syscon works on the COK-001, but only 202GB and newer on a COK-002.
In the first SW series is barelly visible (in the photos it looks is not marked) but in newer series is more visible, and is located at bottom-rigth corner, see this photos i marked:
*The SW and the SW2 are not interchangable (because of the CEC handling which uses hardcoded HDMI stuff).
http://666kb.com/i/cnj3qic8k412x3p8r.jpg
*The actual platform configuration which defines the board on the which Syscon resides is stored in the EEPROM (CXR) or Flash data section (SW), it can be mapped to the platform id.
*In theory even the SW(1) chips work on Mullion boards if you adapt them.


*All photos are taken from wiki visibles in his respective pages... look for the original photo to see it in better resolution (when posible because there are not much photos of syscons in wiki or internet)
== Prototype sherwoods ==
 
The sherwood table already have a row for D79F0073, should we add a couple more rows for D79F0086 and D79F0123 ?
If this is correct, is needed to change the info about the pinout in all the affected pinout tables (in all SWX-xxx pages)
 
== PowerON/off HDMI/CEC, WiFi, Bluetooth, GbLAN, buttons etc ==
There is no seperate communication processor on the PS3. Powering is handled by syscon.
 
*Power and eject buttons/switchs are connected with syscon (indirectly), there is no protocol involved, the syscon pins related with this buttons has 2 posible states: 3.3v (when button is not pressed)... or 0v (when button is pressed)
 
== Multipage Correction ==
<TizzyT> eussnl my syscon is CXR714120-301GB its different form what the wiki says
CECHH / DIA-001
 
=== Package ===
http://pastie.org/private/tkcfjwit37huzyzoie7z5g BGA
 
ball count: 4x16 + 8x14 + 2x12 = 64+112+24 = 200 pads
 
new QF package is 26 * 38 = 128 pins
 
=== Clocks ===
SysCon clocks:
T4 XTAL / T5 EXTAL goes to [X4001] of 16.9344 MHz
C16 OSCIN / B16 OSCOUT goes to [X4002] of 32.768 kHz
http://oi52.tinypic.com/2s9ziw0.jpg
 
=== Backup Mode / Diag ===
BACKUP_MODE / DIAG_MODE pins on Gen 2 might be pins 110 and 111. They are pulled low.
Not completely sure, but looking at those pins in relation to what's around them seems like it could be those two.
 
----
 
SEM-001 CECHG
Pink is N15 BACKUP_MODE
Blue is N16 DIAG_MODE
picture: http://psx-scene.com/forums/attachments/f149/26456d1300550098-brick-recovery-research-untitled-1.jpg
source: http://psx-scene.com/forums/780185-post344.html !unverified!
 
According to schematics, DIAG and BACKUP_MODE are are shown in the following picture for COK-001 and COK-002 Motherboards - http://goput.it/69k.jpg
These pins are tied to 3.3v so grounding them should enable each mode respectively.
!unverified!
 
----
=== SoftID ===
''Note: moved from seperate page, as there are already over 8 different syscon pages and the very same info is mention in depth on the SC firmware and SC hardware page (and in 150 wiki edits on the sysinfo page :/) we dont have a sperate page for every SELF flag either ;) (although there are >4 pages describing SELF :/)''
 
a SoftID is just a 0x4 code that tells you the hardware revision of the syscon.<br />
This info can be get through the [[More System Information]] method.<br />
You can find them also inside the SYS_CON_FIRMWARE_*********.pkg ([[Syscon_Firmware]]) at the offset '''0x28E''' (In this link you can found the list of the [[Syscon_Firmware#Known_Retail_syscon_update_packages| Syscon update packages]])<br />
every SoftID is associated with the ps3 mainboard. this means that you can know if a SC is compatible with your board without opening a PS3 ([[Syscon_Hardware#Serialnumbers_.40_SKU| Syscon Hardware]])
 
{| class="wikitable sortable"
|-
! SoftID !! SC Generation !! notes
|-
! colspan="4" id="null"| Phats
|-
| 0B8E || 1 || -
|-
| 0C16 || 2 || -
|-
| 0D52 || 3 || -
|-
| 0DBF || 4 || -
|-
| 0E69 || 5 || -
|-
| 0F29 || 6 || -
|-
| 0F38 || 7 || -
|-
| 065D || 8 || -
|-
! colspan="4" id="null"| Slims
|-
| 0832 || 9 || -
|-
| 08C2 || 10 || -
|-
| 0918 || 11 || -
|-
|}
 
=== Datasheet of SoC similar to syscon ===
* [http://www.alldatasheet.com/datasheet-pdf/pdf/294279/SONY/CXR704060.html Sony CXR704060 datasheet.pdf] [http://mir.cr/LJOMNBFO mirror]
 
== COK-002 with 0DBF syscon ==
 
Information:
https://lh5.googleusercontent.com/-UiaHRjhdt50/UesKSGuxdFI/AAAAAAAAGOU/0FV8Fazyl60/s800/TV2013072019053700.jpg
 
Min ver:
https://lh5.googleusercontent.com/-iUOuidm6v3g/UexEQily6TI/AAAAAAAAGOk/zSfBMpYDRAM/s800/TV2013072117272000.jpg
 
Board type:
https://lh6.googleusercontent.com/-K1sc66WzJxo/Ue1Mdr5mHeI/AAAAAAAAGO8/rnqlidQAVfY/s800/DSC01591.JPG
 
Syscon:
https://lh6.googleusercontent.com/-OTxjx3qJV0M/Ue1L2itOfRI/AAAAAAAAGO0/Bv6zli_xQQg/s800/DSC01590.JPG
 
 
'''Talk'''
 
-This breaks lot of standards/pages/tables in wiki, can you add some notes please ?. E.g: the board came from official repair service, bought in a normal shop, or is a frankenstein made at home ?, it boots correctly and allows firmware updates ?. If it works normally i think this proves CXR713120-20xGB and CXR714120-30xGB shares the same pinout, but the fact that is using 0DBF SoftID is a bit shocking (maybe because is the minimal SoftID allowed by CXR714120-30xGB ?... [[Talk:More_System_Information | check SoftID examples in this table]]) --[[User:Sandungas|Sandungas]] 22:07, 24 July 2013 (MSK)
 
-The console is a CECHE01 MG (Metal Gear Solid 4 edition) and came with a 3rd generation BD drive (the first type with 2 lens). It had never been to SONY for service. It works normally, correctly and as you could see, has a minimum version which is compatible with the motherboard type. --l_oliveira
 
 
== SHA1 hashes stored at eeprom ==
 
from http://www.edepot.com/playstation3.html
 
"Files finally stored into the FLASH regions have their associated SHA-1 hash value stored in the SYSCON EEPROM for authentication and verification purposes. "
 
What happens if we change those hashes to something a 3.55 ofw would have? (assuming we were doing this experiment on a hackable console?)
 
== PS2 Mechacon vs PSP Syscon vs PS3 Syscon vs Vita Syscon vs PS4 Syscon ==
 
{| class="wikitable"
! Production Start Date (<=) || PS2 Mechacon !! PSP Syscon !! PS3 Syscon !! Vita Syscon !! PS4 Syscon !! Used IC/CPU Core
|-
| <abbr title="GH-001+">10/1999</abbr> || CXP101064 || - || - || - || - || rowspan="2" | Sony SPC970 (100 pin)
|-
| <abbr title="GH-003+">01/2000</abbr> || CXP102064 || - || - || - || -
|-
| <abbr title="GH-015+">09/2000</abbr> || CXP103049 || - || - || - || - || Sony SPC??? (136 pin)
|- bgcolor="#CCCCCC"
| colspan="7" |
|-
| <abbr title="TMU-001, TMU-002, TA-079, TA-081">08/2004</abbr> || - || BAR''xx'' || - || - || - || NEC D790019 / D780032AY (78K0/78003xA, 64 pin)
|-
| <abbr title="TA-082, TA-086">07/2005</abbr> || - || B30''x'' || - || - || - || NEC D79F0036 / D78F????? (78K0/KE2, 64 pin)
|-
| <abbr title="TA-085, TA-088">07/2007</abbr> || - || B40''x'' || - || - || - || NEC D79F???? / D78F????? (78K0/???, 84 pin)
|-
| <abbr title="TA-090, TA-092">07/2008</abbr> || - || 3A''xx'' || - || - || - || NEC D79F???? / D78F????? (78K0/???, ?? pin)
|-
| <abbr title="TA-093, TA-095, TA-096, TA-097">03/2009</abbr> || - || 3B''xx'' || - || - || - || NEC D79F???? / D78F????? (78K0/???, ?? pin)
|-
| <abbr title="TA-091, TA-094">05/2009</abbr> || - || 40''xx'' || - || - || - || NEC D79F???? / D78F????? (78K0/???, ?? pin)
|-
|- bgcolor="#CCCCCC"
| colspan="7" |
|-
| <abbr title="GH-023+, XPD-001, XPD-005">03/2003</abbr> || CXR706080 || - || - || - || - || rowspan="3" | Sony SR11<br>PS2 (''Dragon''): 164 pin<br>PS3 (''Donkey''): 200 pin
|-
| <abbr title="GH-032+">09/2004</abbr> || CXR716080 || - || CXR713120 || - || -
|-
| <abbr title="GH-061+">07/2007</abbr> || CXR726080 || - || CXR714120 || - || -
|- bgcolor="#CCCCCC"
| colspan="7" |
|-
| 03/2008 || - || - || SW || - || - || NEC D79F0073 / D78F11AA (78K0R/KH3, 128 pin)
|-
| 05/2009 || - || - || SW2 || - || - || NEC D79F0086 / D78F11BB (78K0R/KH3, 128 pin)
|-
| <abbr title="IRT-001, IRT-002, IRS-002, IRS-1001, DOL-1001, DOL-1002">07/2010</abbr> || - || - || - || <abbr title="No official name">"SC"</abbr> || - || NEC D79F0109 / D78F???? (78K0R/???, 121 pin)
|-
| 06/2011 || - || - || SW3 || - || - || NEC D79F0123 / D78F11CC (78K0R/KG3, 100 pin)
|-
|- bgcolor="#CCCCCC"
| colspan="7" |
|-
| <abbr title="CVN-001, SAA-001, SAB-001">07/2013</abbr> || - || - ||- || - || C0L || Renesas R5F100PL (RL78/G13, 100 pin)
|-
| <abbr title="USS-1001, USS-1002">08/2013</abbr> || - || - ||- || A0''xxx'' || - || Renesas {{unk|R5F120PL}} (RL78/???, {{unk|100}} pin)
|-
| <abbr title="SAC-001, SAD-001, SAD-002, SAD-003, SAE-001, SAE-002, SAE-003, SAE-004, HAC-001, NVA-001, NVB-003, NVB-004, NVG-001, NVG-002">04/2015</abbr> || - || - ||- || - || C0L2 || Renesas R5F101LL (RL78/G13, 64 pin)
|-
|}
 
* The SPC900 core was designed by Texas Instruments [[https://www.linkedin.com/in/hirakawa-katsunobu-55b09b2]]
* ''CXP101064'', ''CXP102064'' are similar to CXP97 (''CXP971000'', ''CXP972032'', '''CXP973064''', ''CXP973F064'')
** In-Circuit-Emulator: Mitek NICE-SPC970 [[http://www.hitechfacility.co.jp/details.php?id=E0001913]]; Debug software: SVD970; Flash programmer: SFP-2
* A ''F'' inside the model name specifies if the IC contains flash memory.
** Mass-produced units don't have/use program flash memory, instead a encrypted firmware patch is stored on the data-"EEPROM"
* CXR7 series uses Sony SR11 CPU (ARM7TDMI)
** Models with public datasheet: ''CXR702080'', ''CXR702F080'', ''CXR704060''
** Maybe based on the Texas Instruments TMS470R1 series (derived from TMS470R1B512 ?)
* Prototype PS3 Syscon's:
** ''CXR713F120A'' Syscon used on (early) pre-release prototypes, e.g. [[CEB-2030]], [[DECR-1000]], [[DEH-H1001-D]], [[DEH-H1000A-E]]
** [[DEH-FH1500J-A]] with [[VERTIGO-02]] board and SW series prototype ''D79F0073''
** [[CBEH-H2001]] with [[SUR-00x#SURTEES-03|SURTEES-03]] board and SW2 series prototype ''D79F0086''
** [[DEH-ML00AK-G]] with [[MPX-001 (Prototype)]] board and SW3 series prototype ''D79F0123''
 
==== Packets, Lovely Packets ====
 
<pre>
Command              Address      Permission Sub-Commands/Params Function
becount              0xCA7D      0xDD0C0000 - Display bringup/shutdown count + Power-on time
bepgoff              0xA4E7      0xD00C0000 - BE power grid off
bepkt                0x2435D      0xDC0C0000 show Packet permissions
set
unset
mode
debug
help
bestat              0xD413      0xFD0F0000 - Get status of BE
boardconfig          0x99C7      0xDC0C0000 - Displays board configuration (NOT WORKING?)
bootbeep            0x1EA67      0xF0000000 stat Boot beep
on
off
bringup              0xD597      0xFD0F0000 - Turn PS3 on
bsn                  0xD805      0xF00F0000 - Get board serial number
bstatus              0x24269      0xDD0C0000 - HDMI related status
buzz                0xA4FF      0xDC0C0000 [freq] Activate buzzer
buzzpattern          0xA8B7      0xDC0C0000 [freq] [pattern] [count] Buzzer pattern
clear_err            0x2595B      0xDD0C0000 last Clear errors
eeprom
all
clearerrlog          0xB8CB      0xDD0C0000 - Clears error log
comm                0x9919      0xDC0C0000 - Communication mode
commt                0x24907      0xDC0C0000 help Manual BE communication
start
stop
send
cp                  0x1E077      0xF0000000 ready CP control commands
busy
reset
beepremote
beep2kn1n3
beep2kn2n3
csum                0xD687      0xFF0F0000 - Firmware checksum
devpm                0xD053      0xDD0C0000 ata/pci/pciex/rsx Device power management
diag                0x9AAD      0xD00C0000 ... Diag (execute without param to show help) (NOT WORKING?)
disp_err            0x25911      0xDD0C0000 - Displays errors
duty                0x9B23      0xDD0C0000 get/set Fan policy
get/setmin
get/setmax
get/setinimin
get/setinimax
dve                  0x2995D      0xDC0C0000 help DVE chip parameters
set
save
show
eepcsum              0xAA65      0xDD0C0000 - Does nothing
eepromcheck          0x9A1D      0x000C0000 [id] Check eeprom
eeprominit          0x9A65      0x000C0000 [id] Init eeprom
ejectsw              0xD611      0xFD0F0000 - Eject switch
errlog              0xB7ED      0xFF0C0000 - Gets the error log
fancon              0xD26D      0x0D000000 - Does nothing
fanconautotype      0xC075      0xDD0C0000 - Does nothing
fanconmode          0xBF35      0xDD0C0000 get Fan control mode
fanconpolicy        0xBBC9      0xDD0C0000 get/set Fan control policy
getini/setini
fandiag              0x1E91B      0xF0000000 - Fan test
faninictrl          0xD3D9      0x0D000000 - Does nothing
fanpol              0xCA31      0xDD0C0000 - Does nothing
fanservo            0xBF29      0xDD0C0000 - Does nothing
fantbl              0xC087      0xDD0C0000 get/set Fan table
getini/setini
getselect/setselect
firmud              0xD61D      0xFDFF0000 - Firmware update
geterrlog            0xB84F      0xDD0C0000 [id] Gets error log
getrtc              0xA6F3      0xDD0C0000 - Gets rtc
halt                0x1E107      0xF0000000 - Halts syscon
hdmi                0x29F39      0xDD0C0000 ... HDMI (various commands, use help)
hdmiid              0x29D1D      0xDC0F0000 - Get HDMI id's
hdmiid2              0x29D81      0xDC0F0000 - Get HDMI id's
hversion            0x2422F      0xDD0C0000 - Platform ID
hyst                0xAEF5      0xDD0C0000 get/set Temperature zones
getini/setini
lasterrlog          0xB7FF      0xDD0C0000 - Last error from log
ledmode              0xA80B      0xDC0C0000 [id] [id] Get led mode
LS                  0x2421B      0xDD0C0000 - LabStation Mode
ltstest              0xCB97      0xDD0C0000 get/set be/rsx ?Temp related? values
osbo                0x1EA3F      0xF0000000 - Sets 0x2000F60
patchcsum            0xD9F7      0xDD0C0000 - Patch checksum
patchvereep          0xD9B1      0xDD0C0000 - Patch version eeprom
patchverram          0xD965      0xDD0C0000 - Patch version ram
poll                0x240E3      0xDD0C0000 - Poll log
portscan            0xDA0D      0xDD0C0000 [port] Scan port (NOT WORKING?)
powbtnmode          0xB911      0xDC0C0000 [mode (0/1)] Power button mode
powerstate          0xCE6F      0xDD0C0000 - Get power state
powersw              0xD5F9      0xFD0F0000 - Power switch
powupcause          0xB621      0xDD0C0000 - Power up cause
printmode            0x99D9      0xDC0C0000 [mode (0/1/2/3)] Set printmode
printpatch          0xD94F      0xDD0C0000 - Prints patch
r                    0x8CA5      0xDD0C0000 [offset] [length] Read byte from SC
r16                  0x8ED5      0xDD0C0000 [offset] [length] Read word from SC
r32                  0x9191      0xDD0C0000 [offset] [length] Read dword from SC
r64                  0x935D      0xDD0C0000 [offset] [length] Read qword from SC
r64d                0x948F      0xDD0C0000 [offset] [length] Read ?qword data? from SC
rbe                  0x96F9      0xDD0C0000 [offset] Read from BE
recv                0x24135      0xDD0C0000 - Receive something
resetsw              0xD605      0xFC0F0000 - Reset switch
restartlogerrtoeep  0xB903      0xDD0C0000 - Reenable error logging to eeprom
revision            0xD7E1      0xFFFF0000 - Get softid
rrsxc                0xD313      0xDD0C0000 [offset] [length] Read from RSX
rtcreset            0xA7BB      0x000C0000 - Reset RTC
scagv2              0xE24F      0xFF000000 - Auth related?
scasv2              0xE207      0xDD000000 - Auth related?
scclose              0xE1EF      0xFF000000 - Auth related?
scopen              0xE121      0xFF000000 - Auth related?
send                0x2416F      0xDD0C0000 [variable] Send something
shutdown            0xD5C5      0xFD0F0000 - PS3 shutdown
startlogerrtsk      0xB8E7      0xDD0C0000 - Start error log task
stoplogerrtoeep      0xB8F5      0xDD0C0000 - Stop error logging to eeprom
stoplogerrtsk        0xB8D9      0xDD0C0000 - Stop error log task
syspowdown          0xB6E9      0xDD0C0000 3 params System power down
task                0x15005      0xDD0C0000 - Print tasks
thalttest            0xD813      0x000F0000 - Does nothing
thermfatalmode      0xCA3B      0xDD0C0000 canboot/cannotboot Set thermal boot mode
therrclr            0xD3E5      0xDD0C0000 - Thermal register clear
thrm                0xBF1D      0xDD0C0000 - Does nothing
tmp                  0xAA69      0xDD0C0000 [zone] Get temperature
trace                0xB951      0xDD0C0000 ... Trace tasks (use help)
trp                  0xAB2F      0xDD0C0000 get/set Temperature zones
getini/setini
tsensor              0xA279      0xDD0C0000 [sensor] Get raw temperature
tshutdown            0xB2A1      0xDD0C0000 get/set Thermal shutdown
getini/setini
tshutdowntime        0xC95D      0xDD0C0000 [time] Thermal shutdown time
tzone                0xB5E1      0xDD0C0000 - Show thermal zones
version              0xD65F      0xFFFF0000 - SC firmware version
w                    0x8BF9      0xDD0C0000 [offset] [value] Write byte to SC
w16                  0x8E2D      0xDD0C0000 [offset] [value] Write word to SC
w32                  0x8FED      0xDD0C0000 [offset] [value] Write dword to SC
w64                  0x92A9      0xDD0C0000 [offset] [value] Write qword to SC
wbe                  0x9665      0xDD0C0000 [offset] [value] Write to BE
wmmto                0xCB3B      0xDC0C0000 get Get watch dog timeout
wrsxc                0xD279      0xDD0C0000 [offset] [value] Write to RSX
xdrdiag              0x1E711      0xF0000000 start XDR diag
info
result
xiodiag              0x1E875      0xF0000000 - XIO diag
xrcv                0x25313      0xDC0C0000 - Xmodem receive
</pre>

Latest revision as of 19:25, 4 November 2021

Notes[edit source]

  • The SoftID (Syscon firmware build id) of retail chips is a 1:1 mapping to the syscon model. So each syscon model does have a unique SoftID.
  • Every syscon within a series (CXR, SW, SW2, SW3) is backwards compatible, e.g. every CXR Syscon works on the COK-001, but only 202GB and newer on a COK-002.
  • The SW and the SW2 are not interchangable (because of the CEC handling which uses hardcoded HDMI stuff).
  • The actual platform configuration which defines the board on the which Syscon resides is stored in the EEPROM (CXR) or Flash data section (SW), it can be mapped to the platform id.
  • In theory even the SW(1) chips work on Mullion boards if you adapt them.

Prototype sherwoods[edit source]

The sherwood table already have a row for D79F0073, should we add a couple more rows for D79F0086 and D79F0123 ?

Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Talk:Syscon_Hardware&oldid=63117"