Editing Syscon Hardware

[[File:SYSCON_GEN1.JPG|thumb|Syscon 1st Generation (BGA Packaging)]]
Syscon is the main power controller chip. It is responsible for powering up the various power systems and for configuring and initialising the [[CELL BE]], [[RSX]] and [[South Bridge]]. It communicates with these devices via seperate SPI busses. There is external access by JTAG (disabled at factory by blowing a fuse), an EEPROM programming interface <!-- not fully examined --> and Serial (UART). The Syscon is a SoC and consists of an ARM7TDMI (ARMv4) CPU, a 256KB EEPROM and 16KB RAM.

= Serialnumbers @ SKU =

== Retail ==
{| class="wikitable sortable"
|-
! [[SKU Models|Model]] !! [[IDPS|Type]] !! [[Motherboard Revisions|Board]] !! [[Syscon Hardware|Syscon<br />part no.]] !! Syscon<br />[[More System Information#First_section|Soft ID]] !! Notes
|-
| [[CECHAxx]]<br />[[CECHBxx]] || 0x01<br />0x02 || [[COK-00x#COK-001|COK-001]] || [[CXR713120-201GB]] || 0B8E || 
|-
| [[CECHCxx]]<br />[[CECHExx]] || 0x03<br />0x04 || [[COK-00x#COK-002|COK-002]] or<br />[[COK-00x#COK-002W|COK-002W]] || [[CXR713120-201GB]] or<br />[[CXR713120-202GB]] || 0C16 || 
|-
| [[CECHGxx]] || 0x05 || [[SEM-00x|SEM-001]] || [[CXR713120-201GB]] or<br />[[CXR713120-202GB]] or<br />[[CXR713120-203GB]] || 0D52 ||
|-
| [[CECHHxx]] || 0x06 || [[DIA-00x#DIA-001|DIA-001]] || [[CXR714120-301GB]] || 0DBF ||
|-
| [[CECHJxx]]<br />[[CECHKxx]] || 0x07 || [[DIA-00x#DIA-002|DIA-002]] || [[CXR714120-301GB]] or<br />[[CXR714120-302GB]] || 0E69 || 
|-
| [[CECHLxx]]<br />[[CECHMxx]]<br />[[CECHPxx]]<br />[[CECHQxx]] || 0x08 || [[VER-00x|VER-001]] || [[SW-301]] or<br />[[SW-302]] || 065D ||
|-
| [[CECH-20xx]] || 0x09 || [[DYN-00x|DYN-001]] || [[SW2-301]] || 0832 || 
|-
| [[CECH-21xx]] || 0x0A || [[SUR-00x|SUR-001]] || [[SW2-301]] or<br />[[SW2-302]] || 08A0 || 
|-
| [[CECH-25xx]] || 0x0B || [[JTP-00x|JTP-001]] or<br />[[JSD-00x|JSD-001]] || [[SW2-301]] or<br />[[SW2-302]]&nbsp;&nbsp;or<br />[[SW2-303]] || 08C2 || 
|-
| [[CECH-30xx]] || 0x0C || [[KTE-00x|KTE-001]] || [[SW2-301]] or<br />[[SW2-302]] or<br />[[SW2-303]] || 0918 || 
|-
| [[CECH-40xx]] || 0x0D || [[MSX-00x|MSX-001]] or<br />[[MPX-00x|MPX-001]] || [[SW3-302]] || 098F || 
|-
|}

==Non retail==
{| class="wikitable sortable"
|-
! [[SKU Models|Model]] !! [[IDPS|Type]] !! [[Motherboard Revisions|Board]] !! [[Syscon Hardware|Syscon<br />part no.]] !! Syscon<br />[[More System Information#First_section|Soft ID]] !! Active JTAG !! Notes
|-
| [[CEB-2040]] || - || [[MPU-501]] || [[CXR713F120|CXR713F120GB-000]] ||  || Yes || Retail prototype
|-
| [[DECR-1000|DECR1000(A/J)]] || 0x01 || [[TMU-520]] || [[CXR713F120A]] || 03FB || ? <!-- PS3NEWS says yes, but no proof --> || Reference tool
|-
| [[DEH-H1000A(S)(-E(S))]] || 0x01 || [[COK-001 (Prototype)]] || [[CXR713F120A]] || 0B67 || ? <!-- same SC, so yes --> || Preproduction
|-
| [[DEH-H1001-D]] || 0x01 || [[COOKIE-13]] || [[CXR713F120A]] || ?0B67? || ? <!-- PS3NEWS says yes, but no proof --> || Preproduction
|-
| [[DEH-FH1500J-A]] ||  || [[VERTIGO-02]] ||  ||  ||  || Preproduction
|-
 <!-- Not Prototype debug units - see retail -->
|}
<br/>
----

Not mentioned:<pre>
0F29 - ?
0F38 - ?</pre>

= Syscon Externalised Ports =
'''Note:''' for more specific information per model, see the links to each subppage in the Serialnumbers @ SKU table.

== Syscon UART packets ==

=== SCUART daemon (SCUARTD) packet structure ===

SCUARTD packets includes header of 0x3 bytes and optional payload (depending on the command).
Packet IDs are not important, they are used only by clients and processed by SCUART daemon.

{| class="wikitable"
|-
! Offset !! Size !! Description
|-
| 0x00 || 0x01 || Magic?
|-
| 0x01 || 0x01 || Payload size
|-
| 0x02 || 0x01 || Command
|-
| 0x03 || Payload size || Payload data
|-
|}

=== Packets ===

{| class="wikitable"
! Packet ID !! Command !! Description !! Notes
|-
| 0x00 || '''version''' || ||
|-
| 0x01 || '''bringup''' || || <!--// Standby->ON (Remote Power ON using an UART package, from [[Communication Processor]] ?) //-->
|-
| 0x02 || '''shutdown''' || || <!--// ON->Standby (Remote Power OFF using an UART package, from [[Communication Processor]] ?) //-->
|-
| 0x03 || '''firmud''' || Firmware update || It actually notifies syscon for starting a firmware update operation and calls SX program which implements ZMODEM protocol for transfer
|-
| 0x04 || '''bsn''' || ||
|-
| 0x05 || '''halt''' || ||
|-
| 0x06 || '''cp ready''' || || <!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]]  //-->
|-
| 0x07 || '''cp busy''' || || <!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]] //-->
|-
| 0x08 || '''cp reset''' || || <!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]] //-->
|-
| 0x09 || '''bestat''' || ||
|-
|}

Real syscon packets have an ASCII form instead of bytes above.
An implementation of *MODEM transfer protocols used by Sony: https://github.com/jnavila/lrzsz/tree/master/src

== Syscon UART ==
{| class="wikitable"
! BGA !! Name !! Description
|-
| P16 || UART0_TxD || Serial Transmit
|-
| P15 || UART0_RxD || Serial Receive
|-
|}

You can attach a 3.3v TTL cable (LV-TTL) to the UART on syscon (UART0_TxD, UART0_RxD). Baud rate is 57600. There is a simple plaintext protocol involved. This varies on different syscon models. Example:

'''<command>:<hash>'''

Where the hash is the sum of command bytes & 0xFF

you should terminate commands with \r\n, the syscon messages are only terminated with \n

Here are some of the commands/messages encountered:
<pre>
Messages:
Power applied (standby mode)
OK 00000000:3A

Power on
# (PowerOn State):7F

Power off (Hard shutdown)
# (PowerOff State):DD

After Fan test:
# (PowerOff State) (Fatal):36

No text, invalid hash:
NG F0000002:4D

Commands:
VER:ED
OK 00000000 S1E 00 00 065D:A4

ERRLOG:CB
OK 00000000:3A

DATE:1E
NG F0000003:4E
</pre>


bruteforcing commands:<!--// LOL //-->
<syntaxhighlight lang="c">
#include <windows.h>
#include <stdio.h>

#define BUFFER_SIZE 1024
char LastCmd[BUFFER_SIZE];
char DataCharacters[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ ";

bool IncreaseChar(char* ptr, DWORD index)
{
    char curchar[2];

    curchar[0] = ptr[index];
    curchar[1] = 0;
    if (curchar[0] == DataCharacters[sizeof(DataCharacters) - 2]) 
    {
        if (index == 0) 
        {
            ptr[index] = DataCharacters[0];
            return false;
        }
        else
        {
            ptr[index] = DataCharacters[0];
            return IncreaseChar(ptr, index - 1);
        }
    }
    else
    {
        char* temp = strstr(DataCharacters, curchar);
        ptr[index] = *(temp + 1);
    }

    return true;
}

bool GenerateNextCommand(char* ptr, DWORD* size)
{
    if (*size == 0) 
    {
        ptr[*size] = DataCharacters[0];
        *size = 1;
        ptr[*size] = 0;
    }
    
    if (!IncreaseChar(ptr, *size - 1))
    {
        if (*size < BUFFER_SIZE - 1)
        {
            ptr[*size] = DataCharacters[0];
            *size += 1;
            ptr[*size] = 0;
            return IncreaseChar(ptr, *size - 1);
        }
        else 
        {
            return false;
        }
    }

    return true;
}

bool SysconError(char* ptr, DWORD size)
{
    return !memcmp(ptr, "E:4E:NG F0000003", size - 1);
}

char GenerateChecksum(char* ptr,DWORD size)
{
    char checksum = 0;
    for(DWORD i = 0; i < size; i++)
    {
        checksum += ptr[i];
    }

    return checksum;
}

void SendCommand(HANDLE Comport, char* ptr, DWORD size)
{
    char Buffer[1024];
    DWORD BytesWritten;
    _OVERLAPPED OverlapDesc;

    memset(&OverlapDesc, 0, sizeof(_OVERLAPPED));
    
    sprintf_s(Buffer, 1024, "C:%02X:%s\r\n", GenerateChecksum(ptr, size) & 0xFF, ptr);
    size = strlen(Buffer);
    strcpy_s(LastCmd, BUFFER_SIZE, Buffer);
    WriteFile(Comport, Buffer, size, &BytesWritten, &OverlapDesc);
}

void main(int argc, char *argv[])
{

    char Buffer[BUFFER_SIZE];
    DWORD BytesRead;
    char Command[BUFFER_SIZE];
    DWORD CommandSize;
    HANDLE Comport;
    _DCB Config;
    COMMTIMEOUTS Timeouts;
    bool UserCommands;
    OVERLAPPED OverlapDesc;

    memset(&OverlapDesc, 0, sizeof(OverlapDesc));
    UserCommands = false;
    if (argc > 2) {
        if (!strcmp(argv[2],"UserCmd")) {
            UserCommands = true;
            printf("User commands active.\n");
        } else {
            sprintf_s(Command, BUFFER_SIZE, argv[2]);
        }
    } else {
        sprintf_s(Command, BUFFER_SIZE, "A");
    }

    if(!UserCommands)
    {
        printf("Starting at:%s\n\n",Command);
        CommandSize = strlen(Command);
    }

    Comport = CreateFileA( 
        argv[1],
        GENERIC_READ | GENERIC_WRITE,
        0,
        NULL,
        OPEN_EXISTING,
        0,
        //FILE_FLAG_OVERLAPPED | FILE_FLAG_NO_BUFFERING ,
        NULL
        );

    if (Comport == INVALID_HANDLE_VALUE) 
    {
        printf("Could not open comport\n");
        return;
    }

    OverlapDesc.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);

    Timeouts.ReadIntervalTimeout = 1;
    Timeouts.ReadTotalTimeoutMultiplier = 1;
    Timeouts.ReadTotalTimeoutConstant = 1;
    Timeouts.WriteTotalTimeoutMultiplier = 1;
    Timeouts.WriteTotalTimeoutConstant = 1;
    if (!SetCommTimeouts(Comport, &timeouts)) {
        printf("Could not set timeouts.\n");
        return;
    }

    if (GetCommState(Comport, &Config) == 0)
    {
       printf("Get configuration port failed.\n");
       return;
    }

    Config.DCBlength = 0x1c;
    Config.BaudRate = 57600;
    Config.StopBits = 0;
    Config.Parity = 0;
    Config.ByteSize = 8;
    Config.fDtrControl = 0;
    Config.fRtsControl = 0;
    
    if (SetCommState(Comport, &Config) == 0)
    {
       printf("Set configuration port failed.\n");
       return;
    }

    printf("listening\n");
    memset(Buffer,0,BUFFER_SIZE);

    //while (ReadFile(Comport, Buffer, BUFFER_SIZE, &BytesRead, &OverlapDesc))
    while (ReadFile(Comport, Buffer, BUFFER_SIZE, &BytesRead, NULL))
    {
        if (UserCommands)
        {
            if (BytesRead != 0)
            {
                printf("%s\n",Buffer);
            }

            printf("inp:");
            gets_s(Command, BUFFER_SIZE);
            SendCommand(Comport, Command, strlen(Command));
            printf(LastCmd);
            Sleep(30);
            memset(Buffer,0,BytesRead);
            continue;
        }

        if (BytesRead == 0) 
        {
            SendCommand(Comport, Command, CommandSize);
            Sleep(30);
            continue;
        }

        
        if (!SysconError(Buffer, BytesRead))
        {
            printf("Command:%s", LastCmd);
            printf("Response:%s\n\n", Buffer);
            
        }

        if (GenerateNextCommand(Command, &CommandSize)) 
        {
            SendCommand(Comport, Command, CommandSize);
            Sleep(30);
        }
        else
        {
            return;
        }

        memset(Buffer,0,BytesRead);
    }

    printf("%08X\n",GetLastError());
    getchar();
}
</syntaxhighlight>
http://pastebin.com/CNei0xbC

*More info:
**http://www.ps3hax.net/showthread.php?t=74886

== Syscon (SPI) EEPROM ==
{| class="wikitable"
! BGA !! Name !! Description
|-
| F16 || CSB || Chip Select (needs to be low)
|-
| H16 || DO || Serial Data Output
|-
| G16 || DI || Serial Data Input
|-
| E16 || SKB || Serial Data Clock
|-
| J15 || WCB || Write Protect
|-
| J16 || RBB || Ready/Busy
|-
| G11 || VDDep || + 3.3V
|-
| C15 || VSSep || GND
|-
|}

== Syscon JTAG ==
disabled in factory after production on retailmodels
{| class="wikitable"
! BGA !! Name !! Description
|-
| L8 || JRTCK || Return Test Clock
|-
| K8 || JTCK || Test Clock
|-
| K9 || JTDO || Test Data Out
|-
| L9 || JTMS || Test Mode State / Test Mode Select
|-
| K7 || JTDI || Test Data In
|-
| L7 || JNTRST || Test Reset
|-
|}

= Syscon Underlaying ports =
== Syscon Cell SPI Bus ==
{| class="wikitable"
! BGA !! Name !! Description
|-
| M2 || /BE_SPI_CS || Chip Select
|-
| N2 || BE_SPI_DO || Serial Data Output
|-
| M1 || BE_SPI_DI || Serial Data Input
|-
| N1 || BE_SPI_CLK || Serial Data Clock
|-
| P2 || /BE_RESET || CellBE Reset
|-
| P1 || BE_POWGOOD  || CellBE PowerGood
|-
| T2 || /BE_INT || CellBE Interrupt
|-
|}

== Syscon Southbridge SPI Bus ==
{| class="wikitable"
! BGA !! Name !! Description
|-
| B9 || /SB_SPI_CS || Chip Select
|-
| B8 || SB_SPI_DO || Serial Data Output
|-
| A9 || SB_SPI_DI || Serial Data Input
|-
| A8 || SB_SPI_CLK || Serial Data Clock
|-
|}

<!--// Remote Power ON/OFF (from network, HDMI CEC commands, etc...) is managed by devices connected to the southbridge (ethernet/wifi/BT, HDMI controller, etc...) //-->


{{Motherboard Components}}<noinclude>[[Category:Main]]</noinclude>