Southbridge

From PS4 Developer wiki
Revision as of 04:29, 18 September 2022 by CelesteBlue (talk | contribs)
Jump to navigation Jump to search

PS4 southbridge contains two processors named EMC and EAP on the same die that are mainly used on boot, during rest mode and for servicing.

Components

Southbridge processors

The two processors are on the same die. It is a SoC (System on Chip).

EMC

EMC could stand for External Micro Controller. EMC was named MediaCon by some people when its name was still unknown.

The role of EMC is to load EMC Initial Program Loader, to be an interface for icc for the main APU kernel and Syscon and to offer a debug interface via UART that does not rely on Syscon or main APU. EMC runs its own FreeBSD kernel. It is a Marvell Armada, an ARM-based SoC. Sony stuck a PCIe bridge on it. It exposes ARM peripherals to the x86 side. There is some extra stuff (e.g. HPET, ACPI stuff).

EMC cpuid = 412FC231 (ARM Cortex-M3 r2p1). CPU clock: maybe about 100MHz.

EMC Initial Program Loader

EMC Initial Program Loader is stored encrypted in a SLB2 container in PS4 Serial Flash.

EAP

EAP could stand for External Application Processor.

The role of EAP is to handle media (online Wireless/GbLAN, Bluray Drive and Harddrive) even when the PS4 is in standby mode. EAP runs its own FreeBSD kernel in standby mode, activated to handle tasks such as downloading games updates while the PS4 is in standby.

It handles several tasks to offload the APU:

EAP consists of Marvell PJ4C B0 rev 1 cores, ARMv7 CORTEX-A8 running FreeBSD 9 kernel. CPU clock: 500MHz. DDR clock: 800MHz.

As EAP Core software is unsigned, unencrypted and easily replaceable on PS4 HDD with a PS4 kernel exploit, it is possible to run homebrew code on EAP processor. See eapdev by Bigboss (psxdev).

EAP Kernel Boot Loader

EAP Kernel Boot Loader is stored encrypted in a SLB2 container in PS4 Serial Flash. The role of EAP Kernel Boot Loader is to decrypt then uncompress the EAP Kernel. The encrypted EAP Kernel is stored at virtual address 0xC1000000 and the decrypted and uncompressed EAP Kernel is located at virtual address 0xC3000000.

EAP Kernel

EAP Kernel is located at virtual address 0xC3000000. Encrypted EAP Kernel is mounted on device da0x2.

EAP Core

EAP Core is the usermode executable running on EAP. It is stored unencrypted in the EAP filesystem in SceEapCore.elf.

Southbridge RAM

Southbridge chip is connected to its own DDR3 SDRAM. It is named "sbram" as in SouthBridge RAM.

PS4 Fat and Slim

PS4 Fat and Slim Southbridge has one Samsung K4B2G1646E-BCK0, K4B2G1646F-BCMA or K4B2G1646Q-BCMA, giving a total of 256MB of memory.

PS4 Pro

PS4 Pro Southbridge has two Samsung K4B4G0846E-BYMA or H5TQ4G83CFR-RDC (K4B4G1646E-BYK0 on PS4 Pro DevKit), giving a total of 1GB of memory.

Serial Flash

Southbridge contains a 256MB Serial flash.

Aeolia has Macronix MX25L25635FMI-10G.

Auxiliary components

Southbridge is connected to the main APU by PCI-Express x4 and to Syscon by SPI.

Aeolia has SATA bridge MB86C311B, GbLAN controller 88EC060-NN82.

Southbridge revisions

There are three major hardware revisions, named Aeolia, Belize and Baikal.

See also Aeolia.

Southbridge revisions per chassis

Model (chassis) Motherboards Southbridge Codename Southbridge Labeling
D1000 All CVN Aeolia CXD90025G
1000 All SAA Aeolia CXD90025G
1100 All SAB Aeolia CXD90025G
1200 All SAC Belize CXD90036G
2000 All SAD Belize CXD90036G
D7000 All HAC Belize CXD90036G
7000 All NVA Belize / ?Belize 2? CXD90036G / ?CXD90046GG?
2100 All SAE Belize 2 / Baikal CXD90046GG
2200 All SAF Baikal CXD90042GG
7100 All NVB Baikal CXD90042GG
7200 All NVG Baikal CXD90042GG

Motherboards per southbridge revisions

Southbridge Codename Southbridge Labeling Motherboards
Aeolia CXD90025G

CVN-K12
SAA-001
SAB-001

Belize CXD90036G

SAC-001
SAD-001
SAD-003
HAC-001
NVA-001

Belize 2 CXD90046GG

NVB-003
NVG-001
SAE-001

Baikal CXD90042GG

NVB-004
SAD-002
SAE-002
SAE-003
SAE-004
SAF-003
SAF-004