Editing Syscon Hardware

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
<div style="float:right">[[File:Syscon CXR713120-203GB DIE (detail).jpg|300px|thumb| Syscon CX'''R7131'''20-203GB DIE (detail)]]<br />[[File:Pyramid Syscon live probing.jpg|300px|thumb|Pyramid Syscon live probing]]</div>
<div style="float:right">[[File:SYSCON_GEN1.JPG|thumb|Syscon 1st Generation (BGA Packaging)]]<br />[[File:Pyramid Syscon live probing.jpg|thumb|Pyramid Syscon live probing]]</div>


= Description =
Syscon is the main power controller chip. It is responsible for powering up the various power systems and for configuring and initialising the [[CELL BE]], [[RSX]] and [[South Bridge]]. It communicates with these devices via seperate SPI busses. There is external access by JTAG (disabled from factory on retail models), an EEPROM programming interface <!-- not fully examined --> and Serial (UART). The Syscon is a SoC and consists of an ARM7TDMI (ARMv4) CPU, a 256KB EEPROM and 16KB RAM.
The PS3 syscon is the main power controller chip of the PS3. It is responsible for powering up the main 12v rail of the [[Power Supply]] and various power systems by switching different [[Talk:Regulators|voltage regulators]] in the motherboard, and for configuring and initialising the [[CELL BE|BE]], [[RSX]] and [[South Bridge|SB]] via dedicated SPI buses.


The LEDs and buttons of the [[Switch boards|Switch board]] are connected to syscon, as well as the [[Cooling|fan/s]], buzzer, etc.
= Serialnumbers @ SKU =


The Syscon is a SoC and based on a ARM7TDMI-S (in the [[Mullion]] syscons) or a NEC 78K0R (in the [[Sherwood]] syscons) design. There is external access by "JTAG" (disabled from factory on retail models), an EEPROM programming interface (only on Mullion) and Serial (UART).
== Retail ==
 
{| class="wikitable sortable"
<!--// Remote Power ON/OFF (from network, HDMI CEC commands, etc...) is managed by devices connected to the southbridge (ethernet/wifi/BT, HDMI controller, etc...) //-->
 
== PlayStation system controllers ==
 
{| class="wikitable" style="font-size:small; line-height:105%"
! Production Start Date (<=) || PS2 Mechacon !! PSP Syscon !! PS3 Syscon !! PSVita Syscon !! PS4 Syscon !! Used IC/CPU Core
|-
| <abbr title="GH-001+">10/1999</abbr> || CXP101064 || - || - || - || - || rowspan="2" | Sony SPC970 (100 pin)
|-
| <abbr title="GH-003+">01/2000</abbr> || CXP102064 || - || - || - || -
|-
| <abbr title="GH-015+">09/2000</abbr> || CXP103049 || - || - || - || - || Sony SPC??? (136 pin)
|-
| style="padding:0px" colspan="7" |
|-
| <abbr title="TMU-001, TMU-002, TA-079, TA-081">08/2004</abbr> || - || BAR''xx'' || - || - || - || NEC <abbr title="D790019">D780032AY</abbr> (78K0/78003xA, 64 pin)
|-
| <abbr title="TA-082, TA-086">07/2005</abbr> || - || B30''x'' || - || - || - || NEC <abbr title="D79F0036">D78F0531</abbr> (78K0/KE2 V2.00, 64 pin)
|-
| <abbr title="TA-085, TA-088, TA-091, TA-094">07/2007</abbr> || - || B40''x'' / 40''xx'' || - || - || - || NEC <abbr title="D79F????">D78F0544</abbr> (78K0/KF2 V2.00, 84 pin)
|-
| <abbr title="TA-090, TA-092, TA-093, TA-095, TA-096, TA-097">07/2008</abbr> || - || 3''xxx'' || - || - || - || NEC <abbr title="D79F????">D78F0534</abbr> (78K0/KE2 V2.00, 64 pin)
|-
|-
| style="padding:0px" colspan="7" |
! [[SKU Models|Model]] !! [[IDPS|Type]] !! [[Motherboard Revisions|Board]] !! [[Syscon Hardware|Syscon<br />part no.]] !! Syscon<br />[[More System Information#First_section|Soft ID]] !! Notes
|-
|-
| <abbr title="GH-023+, XPD-001, XPD-005">03/2003</abbr> || CXR706080 || - || - || - || - || rowspan="3" | Sony SR11 (ARM7TDMI)<br>PS2 (''Dragon''): 164 pin<br>PS3 (''Donkey''): 200 pin
| [[CECHAxx]]<br />[[CECHBxx]] || 0x01<br />0x02 || [[COK-00x#COK-001|COK-001]] || [[CXR713120-201GB]] || 0B8E ||  
|-
|-
| <abbr title="GH-032+">09/2004</abbr> || CXR716080 || - || CXR713120 || - || -
| [[CECHCxx]]<br />[[CECHExx]] || 0x03<br />0x04 || [[COK-00x#COK-002|COK-002]] or<br />[[COK-00x#COK-002W|COK-002W]] || [[CXR713120-201GB]] or<br />[[CXR713120-202GB]] || 0C16 ||  
|-
|-
| <abbr title="GH-061+">07/2007</abbr> || CXR726080 || - || CXR714120 || - || -
| [[CECHGxx]] || 0x05 || [[SEM-00x|SEM-001]] || [[CXR713120-201GB]] or<br />[[CXR713120-202GB]] or<br />[[CXR713120-203GB]] || 0D52 ||
|-
|-
| style="padding:0px" colspan="7" |
| [[CECHHxx]] || 0x06 || [[DIA-00x#DIA-001|DIA-001]] || [[CXR714120-301GB]] || 0DBF ||
|-
|-
| 03/2008 || - || - || SW || - || - || NEC <abbr title="D79F0073">D78F11AA</abbr> (78K0R/KH3 V3.40, 128 pin)
| [[CECHJxx]]<br />[[CECHKxx]] || 0x07 || [[DIA-00x#DIA-002|DIA-002]] || [[CXR714120-301GB]] or<br />[[CXR714120-302GB]] || 0E69 ||  
|-
|-
| 05/2009 || - || - || SW2 || - || - || NEC <abbr title="D79F0086">D78F11BB</abbr> (78K0R/KH3 V1.00, 128 pin)
| [[CECHLxx]]<br />[[CECHMxx]]<br />[[CECHPxx]]<br />[[CECHQxx]] || 0x08 || [[VER-00x|VER-001]] || [[SW-301]] or<br />[[SW-302]] || 065D ||
|-
|-
| <abbr title="IRT-001, IRT-002, IRS-002, IRS-1001, DOL-1001, DOL-1002">07/2010</abbr> || - || - || - || <abbr title="No official name">"SC"</abbr> || - || NEC <abbr title="No/Matching internal name">D79F0109</abbr> (<abbr title="Mix between 78K0R/KH3 and 78K0R/Kx3-L">78K0R/KH3-L</abbr> V1.00, 121 pin)
| [[CECH-20xx]] || 0x09 || [[DYN-00x|DYN-001]] || [[SW2-301]] || 0832 ||  
|-
|-
| 06/2011 || - || - || SW3 || - || - || NEC <abbr title="D79F0123">D78F11CC</abbr> (78K0R/KG3 V1.00, 100 pin)
| [[CECH-21xx]] || 0x0A || [[SUR-00x|SUR-001]] || [[SW2-301]] or<br />[[SW2-302]] || 08A0 ||  
|-
|-
| style="padding:0px" colspan="7" |
| [[CECH-25xx]] || 0x0B || [[JTP-00x|JTP-001]] or<br />[[JSD-00x|JSD-001]] || [[SW2-301]] or<br />[[SW2-302]]&nbsp;&nbsp;or<br />[[SW2-303]] || 08C2 ||  
|-
|-
| <abbr title="CVN-001, SAA-001, SAB-001">07/2013</abbr> || - || - ||- || - || C0L || Renesas R5F100PL (RL78/G13 V3.03, 100 pin)
| [[CECH-30xx]] || 0x0C || [[KTE-00x|KTE-001]] || [[SW2-301]] or<br />[[SW2-302]] or<br />[[SW2-303]] or<br />[[SW3-301]] || 0918 ||  
|-
|-
| <abbr title="USS-1001, USS-1002">08/2013</abbr> || - || - ||- || A0''xxx'' || - || Renesas R5F1ZCRK (RL78/G13 V3.03, 121 pin)
| [[CECH-40xx]] || 0x0D || [[MSX-00x|MSX-001]] or<br />[[MPX-00x|MPX-001]] || [[SW3-302]] || 098F ||  
|-
|-
| <abbr title="SAC-001, SAD-001, SAD-002, SAD-003, SAE-001, SAE-002, SAE-003, SAE-004, SAF-004, SAF-006, HAC-001, NVA-001, NVB-003, NVB-004, NVG-001, NVG-002">04/2015</abbr> || - || - ||- || - || C0L2 || Renesas R5F101LL (RL78/G13 V3.03, 64 pin)
| [[CECH-42xx]]A || ? || [[PQX-00x|PQX-001]] || [[SW3-304]] || ? ||  
|-
|-
|}
|}


* The SPC900 core was designed by Texas Instruments ([https://www.linkedin.com/in/hirakawa-katsunobu-55b09b2])
==Non retail==
* ''CXP101064'', ''CXP102064'' are similar to CXP97 (''CXP971000'', ''CXP972032'', '''CXP973064''', ''CXP973F064''), the ''CXP103049'' matches no COTS because of its OCD support
{| class="wikitable sortable"
** In-Circuit-Emulator: Mitek NICE-SPC970 ([http://www.hitechfacility.co.jp/details.php?id=E0001913]); Debug software: SVD970; Flash programmer: SFP-2
* A ''F'' inside the model name specifies that the IC contains flash memory.
** Mass-produced CXR/SW units don't have/use program flash memory for updates, instead an encrypted firmware patch is stored on the data-"EEPROM"
* CXR7 series uses Sony SR11 CPU (ARM7TDMI)
** Models with public datasheet: ''CXR702080'', ''CXR702F080'', ''CXR704060'' (datasheet: [http://www.alldatasheet.com/datasheet-pdf/pdf/294279/SONY/CXR704060.html 1])
* Prototype PS3 Syscon's:
** [[CXR713F120A]] Syscon used on (early) pre-release prototypes, e.g. [[CEB-2030]], [[DECR-1000]], [[DEH-H1001-D]], [[DEH-H1000A-E]]
** [[DEH-FH1500J-A]] with [[VERTIGO-02]] board and SW series prototype ''[[Media:DEH-FH1500J-A_-_VERTIGO-02_-_Syscon_Hardware.jpg|D79F0073]]''
** [[CBEH-H2001]] with [[SUR-00x#SURTEES-03|SURTEES-03]] board and SW2 series prototype ''D79F0086''
** [[DEH-ML00AK-G]] with MPX-001 (Prototype) board and SW3 series prototype ''[[Media:DEH-ML00AK-G_Board_4.jpg|D79F0123]]''
 
= PS3 Syscon models =
{| class="wikitable" style="font-size:small; line-height:105%"
|-
! colspan="10" | [[Mullion]] [[Syscon Hardware|Syscons]] !! rowspan="13" style="padding:1px" | !! colspan="8" | [[SKU Models|PS3 model]] & [[Motherboard Revisions|Motherboard]] compatibility by [[Platform ID]]
|-
! Model !! [[Syscon Firmware|Rev.]] !! [[Syscon Firmware|Ver.]] !! <abbr title="Syscon Firmware build date">Year</abbr> !! Package !! ROM !! FLASH !! colspan="2" | [[SC_EEPROM|EEPROM]] !! RAM
! DEH-R10xx<br>[[DECR-1000]] !! [[SKU Models Nonretail|Prototypes]] !! [[CECHAxx]]<br>[[CECHBxx]] !! [[CECHCxx]]<br>[[CECHExx]] !! [[CECHGxx]] !! [[CECHHxx]] !! [[CECHJxx]]<br>[[CECHKxx]] !! [[DECR-1400]]
|-
! style="width:115px; border-top:hidden" | !! style="width:35px; border-top:hidden" | !! style="width:55px; border-top:hidden" | !! style="width:30px; border-top:hidden" | !! style="width:60px; border-top:hidden" | !! style="width:40px; border-top:hidden" | !! style="width:40px; border-top:hidden" | !! style="width:35px" | Total !! style="width:35px" | Used !! style="width:35px; border-top:hidden" |
! [[TMU-510]]<br>[[TMU-520]] !! <!--[[MPU-501]]<br>-->[[COOKIE-13]]<br>[[COK-001 (Prototype)|COK Proto]] !! [[COK-001]] !! [[COK-002]] !! [[SEM-001]] !! [[DIA-001]] !! [[DIA-002]] !! [[DEB-001]]
|-
| colspan="18" style="padding:1px" |
|-
|-
! [[CXR713F120A]]
! [[SKU Models|Model]] !! [[IDPS|Type]] !! [[Motherboard Revisions|Board]] !! [[Syscon Hardware|Syscon<br />part no.]] !! Syscon<br />[[More System Information#First_section|Soft ID]] !! Active JTAG !! Notes
| colspan="3" style="text-align:center; background:#999; color:#fff" | <abbr title="Depends of the syscon firmware version installed in it">ANY</abbr> || rowspan="8" | [[Template:Syscon pinout BGA 200 pads|BGA 200]] || <abbr title="0x20000>128KB</abbr> || <abbr title="0x60000>384KB</abbr> || rowspan="4" | <abbr title="0x8000>32KB</abbr> || rowspan="3" | <abbr title="0x8000>32KB</abbr> || rowspan="8" | <abbr title="0x10000>64KB</abbr> || {{yes}}, factory || {{yes}}, factory || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}}
|-
|-
! [[CXR713120-201GB]]
| [[CEB-2040]] || - || [[MPU-501]] || [[CXR713F120|CXR713F120GB-000]] || ? || ?No? || Retail prototype
| 0B8E || v1.0.0_k1 || 2006 || rowspan="7" | <abbr title="0x60000>384KB</abbr> || rowspan="7" style="text-align:center; background:lightgrey;" | N/A || {{YES}} ? || {{YES}} ? || {{yes}}, factory || {{no}} || {{no}} || {{no}} || {{no}} || {{no}}
|-
|-
! [[CXR713120-202GB]]
| [[DECR-1000|DECR1000(A/J)]] || 0x01 || [[TMU-520]] || [[CXR713F120A]] || 03FB || No || Reference tool
| 0C16 || v1.1.3_k1 || 2006 || {{YES}} ? || {{YES}} ? || {{YES}} || {{yes}}, factory || {{no}} || {{no}} || {{no}} || {{no}}
|-
|-
! [[CXR713120-203GB]]
| [[DEH-H1001-D]] || 0x01 || [[COOKIE-13]] || [[CXR713F120A]] || 0B67 || No || Preproduction
| 0D52 || v1.2.3_k1 || 2007 || rowspan="5" | <abbr title="0x5000>20KB</abbr> || {{YES}} ? || {{YES}} ? || {{YES}} || {{YES}} || {{yes}}, factory || {{no}} || {{no}} || {{no}}
|-
|-
! [[CXR714120-301GB]]
| [[DEH-H1000A(S)(-E(S))]] || 0x01 || [[COK-001 (Prototype)]] || [[CXR713F120A]] || 0B67 || No || Preproduction
| 0DBF || v1.3.3_k1 || 2007 || rowspan="4" | <abbr title="0x5000>20KB</abbr> || {{YES}} ? || {{YES}} ? || {{YES}} || {{yes}}, <abbr title="Found in a CECHE01 MG (Metal Gear Solid 4 edition)">rare</abbr> || {{yes}}, factory || {{yes}}, factory || {{no}} || {{no}}
|-
|-
! [[CXR714120-302GB]]
| [[DEH-FH1500J-A]] || 0x08 || [[VERTIGO-02]] || D79F0073 ([[SW-301]]) || 0658 || ?Yes? || Preproduction
| 0E69 || v1.4.4_k2 || 2007 || {{YES}} ? || {{YES}} ? || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{yes}}, factory || {{yes}}, factory
|-
|-
! [[CXR714120-303GB]]
| [[DEH-ML00AK-G]] || 0x0D || [[MPX-001 (Prototype) ]] || D79F0123 ([[SW3-302]]) || 098F || ?No? || Preproduction
| 0F29 || v1.5.0_k2 || 2009 || {{YES}} ? || {{YES}} ? || {{YES}} || {{yes}}, <abbr title="Found in a refurbished CECHCxx/COK-002 with a 65nm RSX">refurb</abbr> || {{YES}} || {{YES}} || {{YES}} || {{YES}}
|-
|-
! [[CXR714120-304GB]]
<!-- Not Prototype debug units - see retail -->
| 0F38 || v1.5.1_k2 || 2010 || {{YES}} ? || {{YES}} ? || {{yes}}, <abbr title="Found in a refurbished CECHAxx/COK-001 with a 40nm RSX">refurb</abbr> || {{YES}} || {{YES}} || {{yes}}, <abbr title="Found in a refurbished CECHHxx/DIA-001 with a 40nm RSX">refurb</abbr> || {{YES}} || {{YES}}
|}
|}
<br/>
----


{| class="wikitable" style="font-size:small; line-height:105%"
Not mentioned:<pre>
|-
0F29 - ?
! colspan="10" | [[Sherwood]] [[Syscon Hardware|Syscons]] !! rowspan="17" style="padding:1px" | !! colspan="10" | [[SKU Models|PS3 model]] & [[Motherboard Revisions|Motherboard]] compatibility by [[Platform ID]]
0F38 - ?</pre>
|-
! Model !! [[Syscon Firmware|Rev.]] !! [[Syscon Firmware|Ver.]] !! <abbr title="Syscon Firmware build date">Year</abbr> !! Package !! ROM !! FLASH !! colspan="2" | [[SC_EEPROM|EEPROM]] !! RAM
! [[SKU Models Nonretail|Prototypes]] !! [[CECHLxx]]<br>[[CECHMxx]]<br>[[CECHPxx]]<br>[[CECHQxx]] || [[SKU Models Nonretail|Prototypes]] || [[CECH-20xx]] !! [[CECH-21xx]] !! [[CECH-25xx]] !! [[SKU Models Nonretail|Prototypes]] || [[CECH-30xx]] !! [[CECH-40xx]] !! [[CECH-42xx]]<br>[[CECH-43xx]]
|-
! style="width:115px; border-top:hidden" | !! style="width:35px; border-top:hidden" | !! style="width:55px; border-top:hidden" | !! style="width:30px; border-top:hidden" | !! style="width:60px; border-top:hidden" | !! style="width:40px; border-top:hidden" | !! style="width:40px; border-top:hidden" | !! style="width:35px" | Total !! style="width:35px" | Used !! style="width:35px; border-top:hidden" |
! [[VERTIGO-02|VERTIGO]]<br><small>prototype</small> !! [[VER-001]] !! [[SUR-00x#SURTEES-03|SURTEES]]<br><small>prototype</small> !! [[DYN-001]] !! [[SUR-001]] !! [[JTP-001]]<br>[[JSD-001]] !! [[MPX-001]]<br><small>prototype</small> !! [[KTE-001]] !! [[MSX-001]]<br>[[MPX-001]]<br>[[NPX-001]] !! [[PPX-001]]<br>[[PQX-001]]<br>[[RTX-001]]<br>[[REX-001]]
|-
| colspan="18" style="padding:1px" |
|-
! [[Media:DEH-FH1500J-A_-_VERTIGO-02_-_Syscon_Hardware.jpg|D79F0073]]
| colspan="3" style="text-align:center; background:#999; color:#fff" | <abbr title="Depends of the syscon firmware version installed in it">ANY</abbr> || rowspan="7" | [[Template:Syscon pinout LQFP 128 pins|LQFP 128]] || rowspan="12" style="text-align:center; background:lightgrey;" | N/A || rowspan="3" | <abbr title="0x80000>512KB</abbr> || rowspan="12" style="text-align:center; background:lightgrey;" | N/A || rowspan="12" style="text-align:center; background:lightgrey;" | <abbr title="0x8000 Emulated inside FLASH">32KB</abbr> || rowspan="12" | <abbr title="0xC800>50KB</abbr> || {{yes}}, factory || {{YES}} || colspan="4" rowspan="3" style="text-align:center; background:#CC5555; color:#FFFFFF;" | No (<abbr title="Different HDMI/CEC handling">HDMI Incompatible</abbr>) || colspan="4" rowspan="7" style="text-align:center; background:#CC5555; color:#FFFFFF;" | No (different package)
|-
! [[SW-301]]
| 065D || 0.17.0 || 2008 || {{YES}} ? || {{yes}}, factory
|-
! [[SW-302]]
| <abbr title="Please help wiki by reporting this ID"><span style="background:#ff4444; color:#ffff00;">'''????'''</span></abbr> || <abbr title="Please help wiki by reporting this ID"><span style="background:#ff4444; color:#ffff00;">'''?.??.?'''</span></abbr> || 2008 || {{YES}} ? || {{yes}}, factory
|-
! D79F0086
| colspan="3" style="text-align:center; background:#999; color:#fff" | <abbr title="Depends of the syscon firmware version installed in it">ANY</abbr> || rowspan="9" | <abbr title="0xC0000>768KB</abbr> || colspan="2" rowspan="4" style="text-align:center; background:#CC5555; color:#FFFFFF;" | No (<abbr title="Different HDMI/CEC handling">HDMI Incompatible</abbr>) || {{yes}}, factory || {{YES}} || {{YES}} || {{YES}}
|-
! [[SW2-301]]
| 0832 || 1.11.0 || 2009 || {{YES}} ? || {{yes}}, factory || {{no}} || {{no}}
|-
! [[SW2-302]]
| 08A0 || 1.16.0 || 2009 || {{YES}} ? || {{YES}} || {{yes}}, factory || {{no}}
|-
! [[SW2-303]]
| 08C2 || 1.21.0 || 2010 || {{YES}} ? || {{YES}} || {{YES}} || {{yes}}, factory
|-
! [[Media:DEH-ML00AK-G_Board_4.jpg|D79F0123]]
| colspan="3" style="text-align:center; background:#999; color:#fff" | <abbr title="Depends of the syscon firmware version installed in it">ANY</abbr> || rowspan="5" | [[Template:Syscon pinout LQFP 100 pins|LQFP 100]] || colspan="6" rowspan="5" style="text-align:center; background:#CC5555; color:#FFFFFF;" | No (different package) || {{yes}}, factory || {{YES}} || {{YES}} || {{YES}}
|-
! [[SW3-301]]
| 0918 || 2.3.0 || 2011 || {{YES}} ? || {{yes}}, factory || {{no}} || {{no}}
|-
! [[SW3-302]]
| 098F || 2.12.0 || 2012 || {{YES}} ? || {{YES}} || {{yes}}, factory || {{no}}
|-
! [[SW3-303]]
| <abbr title="Please help wiki by reporting this ID"><span style="background:#ff4444; color:#ffff00;">'''????'''</span></abbr> || <abbr title="Please help wiki by reporting this ID"><span style="background:#ff4444; color:#ffff00;">'''?.??.?'''</span></abbr> || 2013 || {{YES}} ? || {{YES}} || ? || ?
|-
! [[SW3-304]]
| 09A4 || 2.21.0 || 2013 || {{YES}} ? || {{YES}} || {{YES}} || {{yes}}, factory
|}


= Syscon Externalised Ports =
= Syscon Externalised Ports =
 
'''Note:''' for more specific information per model, see the links to each subppage in the Serialnumbers @ SKU table.
'''Note:''' for more specific information per model, see the links to each subpage in the Serialnumbers per SKU table.


== Syscon UART packets ==
== Syscon UART packets ==
Line 168: Line 70:


SCUARTD packets includes header of 0x3 bytes and optional payload (depending on the command).
SCUARTD packets includes header of 0x3 bytes and optional payload (depending on the command).
Packet IDs are not important, they are used only by clients and processed by SCUART daemon. SCUART daemon opens terminal file /dev/ttyS0 and use it to send commands and receive responses.
Packet IDs are not important, they are used only by clients and processed by SCUART daemon. SCUART daemon opens terminal file /dev/ttyS0 and use it to send commands and receive responses.


Line 192: Line 93:
| 0x00 || '''version''' || Firmware version || Gets installed syscon's firmware version (Note: backup bank contains version 0.4.5_b4 !! On CEB-2030 it is 0.3.0 )
| 0x00 || '''version''' || Firmware version || Gets installed syscon's firmware version (Note: backup bank contains version 0.4.5_b4 !! On CEB-2030 it is 0.3.0 )
|-
|-
| 0x01 || '''bringup''' || Bring up || <!--// Standby->ON (Remote Power ON using an UART package, from [[Communication Processor]] ?) //-->
| 0x01 || '''bringup''' || || <!--// Standby->ON (Remote Power ON using an UART package, from [[Communication Processor]] ?) //-->
|-
|-
| 0x02 || '''shutdown''' || Shutdown || <!--// ON->Standby (Remote Power OFF using an UART package, from [[Communication Processor]] ?) //-->
| 0x02 || '''shutdown''' || || <!--// ON->Standby (Remote Power OFF using an UART package, from [[Communication Processor]] ?) //-->
|-
|-
| 0x03 || '''firmud''' || Firmware update || Notifies about firmware update operation
| 0x03 || '''firmud''' || Firmware update || Notifies about firmware update operation
Line 200: Line 101:
| 0x04 || '''bsn''' || Board Serial Number || Retrieves syscon's Board Serial Number
| 0x04 || '''bsn''' || Board Serial Number || Retrieves syscon's Board Serial Number
|-
|-
| 0x05 || '''halt''' || Halt || Used at start of firmware update operation
| 0x05 || '''halt''' || || Used at start of firmware update operation
|-
|-
| 0x06 || '''cp ready''' || Communication Processor Ready || <!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]]  //-->
| 0x06 || '''cp ready''' || || <!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]]  //-->
|-
|-
| 0x07 || '''cp busy''' || Communication Processor Busy || <!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]] //-->
| 0x07 || '''cp busy''' || || <!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]] //-->
|-
|-
| 0x08 || '''cp reset''' || Communication Processor Reset || <!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]] //-->
| 0x08 || '''cp reset''' || || <!--// [[Communication Processor]] related, for [[SKU_Models_Nonretail#Reference_Tool_.28Tool.2FDECR.29 | Tool/DECR models]] //-->
|-
|-
| 0x09 || '''bestat''' || Cell B.E. status || Retrieves Cell B.E. status
| 0x09 || '''bestat''' || Cell B.E. status || Retrieves Cell B.E. status
|-
|-
| 0x0A || '''powersw''' || Power switch || toggles power switch button short pressing
| 0x0A || '''powersw''' || <!-- Power switch ? --> ||
|-
|-
| 0x0B || '''resetsw''' || Reset switch || toggles reset switch button holding
| 0x0B || '''resetsw''' || <!-- Reset switch ? --> ||
|-
|-
| 0x0C || '''bootbeep stat''' || Boot Beep Status ||
| 0x0C || '''bootbeep stat''' || ||
|-
|-
| 0x0D || '''bootbeep on''' || Boot Beep On ||
| 0x0D || '''bootbeep on''' || ||
|-
|-
| 0x0E || '''bootbeep off''' || Boot Beep Off ||
| 0x0E || '''bootbeep off''' || ||
|-
|-
| 0x0F || ''Reset syscon'' || Reset Syscon || Resets syscon
| 0x0F || ''Reset syscon'' || Reset || Resets syscon
|-
|-
| 0x10 || '''xdrdiag info''' || XDR diagnostics Information ||
| 0x10 || '''xdrdiag info''' || XDR diagnostics ||
|-
|-
| 0x11 || '''xdrdiag start''' || XDR diagnostics Start || Starts XDR diagnostics
| 0x11 || '''xdrdiag start''' || XDR diagnostics || Starts XDR diagnostics
|-
|-
| 0x12 || '''xdrdiag result''' || XDR diagnostics Result || Gets a result of XDR diagnostics
| 0x12 || '''xdrdiag result''' || XDR diagnostics || Gets a result of XDR diagnostics
|-
|-
| 0x13 || '''xiodiag''' || XIO diagnostics || Starts XIO diagnostics and gets a result of it
| 0x13 || '''xiodiag''' || XIO diagnostics || Starts XIO diagnostics and gets a result of it
Line 234: Line 135:
| 0x15 || '''errlog''' || Error log || Retrieves a list of codes (with timestamps) of latest errors
| 0x15 || '''errlog''' || Error log || Retrieves a list of codes (with timestamps) of latest errors
|-
|-
| 0x16 || ''Read line'' || Read Line ||
| 0x16 || ''Read line'' || ||
|-
|-
| 0x17 || '''tmpforcp <zone ID>''' || Reference Tool's temperature For Communication Processor || Gets the temperature of reference tool
| 0x17 || '''tmpforcp <zone ID>''' || Reference Tool's temperature || Gets the temperature of reference tool
|-
|-
| 0x18 || rowspan="8" colspan="3" style="background:lightgrey; color:#ff0000; text-align: center;" | Invalid CMDs
| 0x18 || rowspan="7" colspan="3" style="background:lightgrey; color:#ff0000; text-align: center;" | Invalid CMDs
|-
|-
| 0x19
| 0x19
Line 247: Line 148:
|-
|-
| 0x1C
| 0x1C
|-
| 0x1D
|-
|-
| 0x1E
| 0x1E
Line 254: Line 153:
| 0x1F
| 0x1F
|-
|-
| 0x20 || '''cp beepremote''' || Communication Processor Beep Remote ||
| 0x20 || '''cp beepremote''' || ||
|-
|-
| 0x21 || '''cp beep2kn1n3''' || ||
| 0x21 || '''cp beep2kn1n3''' || ||
Line 260: Line 159:
| 0x22 || '''cp beep2kn2n3''' || ||
| 0x22 || '''cp beep2kn2n3''' || ||
|-
|-
| ?? || '''csum''' || Checksum || Calculates the Checksum of something (No packet ID listing on scuartd)
| ?? || '''csum''' || Checksum ?? || Calculates the Checksum of something (No packet ID listing on scuartd)
|-
| ?? || '''osbo''' || ?Operating System Boot? || No idea what this does, but returns <pre>done</pre> when it's sent <!--Operative System Boot Order ?... something related with gameOS/otherOS boot flag ? -->
|-
|-
| ?? || '''scopen''' || Syscon Open || returns SC_READY or ERROR 1
| ?? || '''osbo''' || ??? || No idea what this does, but returns <pre>done</pre> when it's sent <!--Operative System Boot Order ?... something related with gameOS/otherOS boot flag ? -->
|-
|-
| ?? || '''scclose''' || Syscon Close || ???
| ?? || '''scopen''' || returns SC_READY or ERROR 1 || ???
|-
|-
| ?? || '''ejectsw''' || Eject Switch || toggles eject switch button pressing (3 beeps)
| ?? || '''scclose''' || || ???
|-
|-
|}
|}
Line 277: Line 174:
! Packet ID !! Command/Action !! Logs !! Notes
! Packet ID !! Command/Action !! Logs !! Notes
|-
|-
| 0x00 || '''version''' || version\nv1.0.4_c2\n  (END) ||
| 0x00 || '''version''' || <pre>  version\nv1.0.4_c2\n  (END) </pre> ||
|-
|-
| 0x01 || '''bringup''' || (END) ||
| 0x01 || '''bringup''' || <pre>  (END) </pre> ||
|-
|-
| 0x02 || '''shutdown''' || Do nothing. (PowerOff State)\n (END) || Returns (END) if the system is on  
| 0x02 || '''shutdown''' || <pre> Do nothing. (PowerOff State)\n (END) </pre> || Returns (END) if the system is on  
|-
|-
| 0x03 || '''firmud''' || Start...\nErase User Program Area\n  (END) || This will brick your SYSCON if you don't feed it any argument or feed to it the wrong argument!
| 0x03 || '''firmud''' || <pre> Start...\nErase User Program Area\n  (END) </pre> || This will brick your SYSCON if you don't feed it any argument or feed to it the wrong argument!
|-
|-
| 0x04 || '''bsn''' || bsn\nNANNNNNNNNNA\n  (END) || N is digit and A is char (removed for privacy)
| 0x04 || '''bsn''' || <pre> bsn\nNANNNNNNNNNA\n  (END) </pre> || N is digit and A is char (removed for privacy)
|-
|-
| 0x05 || '''halt''' || halt\n  (END) ||
| 0x05 || '''halt''' || <pre> halt\n  (END)</pre> ||
|-
|-
| 0x06 || '''cp ready''' || cp ready\nCP READY: OK\n  (END) ||  
| 0x06 || '''cp ready''' || <pre> cp ready\nCP READY: OK\n  (END) </pre> ||  
|-
|-
| 0x07 || '''cp busy''' || cp ready\nCP BUSY: OK\n  (END) || STATUS light blinks forever
| 0x07 || '''cp busy''' || <pre> cp ready\nCP BUSY: OK\n  (END) </pre> || STATUS light blinks forever
|-
|-
| 0x08 || '''cp reset''' || No response || Should reset CP to factory settings
| 0x08 || '''cp reset''' || No response || Should reset CP to factory settings
|-
|-
| 0x09 || '''bestat''' || (PowerOff State)\n (END) ||
| 0x09 || '''bestat''' || <pre> (PowerOff State)\n (END) </pre>||
|-
|-
| 0x0A || '''powersw''' || (END) ||
| 0x0A || '''powersw''' || <pre>  (END) </pre> ||
|-
|-
| 0x0B || '''resetsw''' || (END) ||
| 0x0B || '''resetsw''' || <pre>  (END) </pre> ||
|-
|-
| 0x0C || '''bootbeep stat''' || BOOT BEEP: ON\n  (END) || when it's off BOOT BEEP status changes to OFF
| 0x0C || '''bootbeep stat''' || <pre> BOOT BEEP: ON\n  (END) </pre> || when it's off BOOT BEEP status changes to OFF
|-
|-
| 0x0D || '''bootbeep on''' || BOOT BEEP ON: DONE\n  (END) ||  
| 0x0D || '''bootbeep on''' || <pre> BOOT BEEP ON: DONE\n  (END) </pre> ||  
|-
|-
| 0x0E || '''bootbeep off''' || BOOT BEEP OFF: DONE\n  (END) ||
| 0x0E || '''bootbeep off''' || <pre> BOOT BEEP OFF: DONE\n  (END) </pre> ||
|-
|-
| 0x0F || '''Reset syscon''' || ||
| 0x0F || '''Reset syscon''' || ||
|-
|-
| 0x10 || '''xdrdiag info''' || 32\n  (END) ||
| 0x10 || '''xdrdiag info''' || <pre> 32\n  (END) </pre> ||
|-
|-
| 0x11 || '''xdrdiag start''' || DIAG START\n  (END) ||
| 0x11 || '''xdrdiag start''' || <pre> DIAG START\n  (END) </pre> ||
|-
|-
| 0x12 || '''xdrdiag result''' || XDR OK\n  (END) || will return ERROR NOT STARTED if xdrdiag start wasn't run previously
| 0x12 || '''xdrdiag result''' || <pre> XDR OK\n  (END) </pre> || will return ERROR NOT STARTED if xdrdiag start wasn't run previously
|-
|-
| 0x13 || '''xiodiag''' || 0 903\n  (END) ||
| 0x13 || '''xiodiag''' || <pre> 0 903\n  (END) </pre> ||
|-
|-
| 0x14 || '''fandiag''' || ERROR FAN ACTIVE\n  (END) ||
| 0x14 || '''fandiag''' || <pre> ERROR FAN ACTIVE\n  (END) </pre> ||
|-
|-
| 0x15 || '''errlog''' || ofst[ %d]:err_code:0x%08X, clock:0x%08X  YYYY/MM/DD HH:MM:SS || bunch of error logs. ends with (END) once they're over
| 0x15 || '''errlog''' || <pre> ofst[ %d]:err_code:0x%08X, clock:0x%08X  YYYY/MM/DD HH:MM:SS </pre> || bunch of error logs. ends with (END) once they're over
|-
|-
| 0x16 || '''Read line''' || ||
| 0x16 || '''Read line''' || ||
Line 325: Line 222:
| 0x17 || '''tmpforcp <zone ID>''' ||  
| 0x17 || '''tmpforcp <zone ID>''' ||  
|-
|-
| 0x20 || '''cp beepremote''' || (END) ||
| 0x20 || '''cp beepremote''' || <pre>  (END)</pre> ||
|-
|-
| 0x21 || '''cp beep2kn1n3''' || (END) || sends a beep different than SYSCON beep :)
| 0x21 || '''cp beep2kn1n3''' || <pre>  (END)</pre> || sends a beep different than SYSCON beep :)
|-
|-
| 0x22 || '''cp beep2kn2n3''' || (END) || sends two beeps different than SYSCON beeps :)
| 0x22 || '''cp beep2kn2n3''' || <pre>  (END)</pre> || sends two beeps different than SYSCON beeps :)
|-
|-
| rowspan="8" | ?? || rowspan="8" | '''csum''' || Checksum: [027460C9] [68269779] [C19A855E]\n  (END) || displays 3 hexadecimal numbers inside rect parenthesis. the numbers are always the same, except when syscon version changes (v1.0.5_c1)  
| ?? || '''csum''' || <pre>Checksum: [027460C9] [68269779] [C19A855E]\n  (END)</pre> || displays 3 hexadecimal numbers inside rect parenthesis. the numbers are always the same, except when syscon version changes (v1.0.5_c1)  
|-
|-
| Checksum: [02746F91] [682F04DA] [27688CF5]\n  (END) || Another response (v1.0.4_c2)
| ?? || '''csum''' || <pre>Checksum: [02746F91] [682F04DA] [27688CF5]\n  (END)</pre> || Another response (v1.0.4_c2)
|-
|-
| Checksum: [0274C877] [684DA659] [EA426BB1]\n  (END) || Another response (v1.0.4_c1)
| ?? || '''csum''' || <pre>Checksum: [0274C877] [684DA659] [EA426BB1]\n  (END)</pre> || Another response (v1.0.4_c1)
|-
|-
| Checksum: [027B4064] [6B450C64] [4FBF6DA3]\n  (END) || Another response (v1.0.3_c1)
| ?? || '''csum''' || <pre>Checksum: [027B4064] [6B450C64] [4FBF6DA3]\n  (END)</pre> || Another response (v1.0.3_c1)
|-
|-
| Checksum: [027E1B71] [6CDA9F25] [E0C67065]\n  (END) || Another response (v1.0.1_c1)
| ?? || '''csum''' || <pre>Checksum: [027E1B71] [6CDA9F25] [E0C67065]\n  (END)</pre> || Another response (v1.0.1_c1)
|-
|-
| Checksum: [02812855] [6E83917C] [D40F70A5]\n  (END) || Another response (v0.9.14_c1)
| ?? || '''csum''' || <pre>Checksum: [02812855] [6E83917C] [D40F70A5]\n  (END)</pre> || Another response (v0.9.14_c1)
|-
|-
| Checksum: [02835059] [6FC5C632] [BB9BBEC3]\n  (END) || Another response (v0.9.9_c1)
| ?? || '''csum''' || <pre>Checksum: [02835059] [6FC5C632] [BB9BBEC3]\n  (END)</pre> || Another response (v0.9.9_c1)
|-
|-
| Checksum: [026F7951] [66CB09FF] [4EA06B56]\n  (END) || Another response (v0.8.4_c8)
| ?? || '''csum''' || <pre>Checksum: [026F7951] [66CB09FF] [4EA06B56]\n  (END)</pre> || Another response (v0.8.4_c8)
|-
|-
| ?? || '''osbo''' || done\n  (END) ||
| ?? || '''osbo''' || <pre>done\n  (END)</pre> ||
|-
|-
| ?? || '''scopen''' || SC_READY\nERROR 1\n\n*** Invalid Argument ***\n\n[mullion]$ ||
| ?? || '''scopen''' || <pre>SC_READY\nERROR 1\n\n*** Invalid Argument ***\n\n[mullion]$</pre> ||
|-
|-
| ?? || '''scclose''' || \n\n\nSC_SUCCESS\n\n[mullion]$ ||
| ?? || '''scclose''' || <pre>\n\n\nSC_SUCCESS\n\n[mullion]$</pre> ||
|-
|-
|}
|}
Line 388: Line 285:
move    $a0, $zero
move    $a0, $zero
</syntaxhighlight>
</syntaxhighlight>
* An actual firmware update process (without halting and resetting steps) takes about 1 minute.
* An actual firmware update process (without halting and resetting steps) takes about 1 minute.
* You cannot install a corrupted firmware with scfirmup unless you corrupt the header! It seems there is a hash of sorts (possibly of the plaintext) in the header preventing scfirmup from installing something corrupt
* You cannot install a corrupted firmware with scfirmup unless you corrupt the header! It seems there is a hash of sorts (possibly of the plaintext) in the header preventing scfirmup from installing something corrupt
Line 408: Line 304:
li      $a0, 1
li      $a0, 1
</syntaxhighlight>
</syntaxhighlight>
* You can use this bruteforcer to try your luck when finding new packets: https://hastebin.com/vomogesaru.cpp
 
* You can use this bruteforcer to try your luck when finding new packets : https://hastebin.com/vomogesaru.cpp


== Syscon UART ==
== Syscon UART ==
Line 420: Line 317:
|}
|}


<gallery>
You can attach a 3.3v TTL cable (LV-TTL) to the UART on syscon (UART0_TxD, UART0_RxD). (Convenient solder points are available on JSD/JTP-001 by the NOR test points. They are marked as '?' in [[:File:JSD-001 NOR - nor testpoints.png|marcan' noraliser / judges' NORway install picture]], closest to the ground at the bottom - RX is left, TX is right) Baud rate is 57600. There is a simple plaintext protocol involved. This varies on different syscon models. Example:
File:COK-001 SC UART testpads.jpg|[[COK-001]] SC UART testpads
File:COK-002 SC UART testpads.jpg|[[COK-002]] SC UART testpads
File:SEM-001 SC UART testpads.jpg|[[SEM-001]] SC UART testpads
File:DIA-001 SC UART testpads.jpg|[[DIA-001]] SC UART testpads
File:DIA-002 SC UART testpads.jpg|[[DIA-002]] SC UART testpads
File:VER-001 SC UART testpads.jpg|[[VER-001]] SC UART testpads
File:DYN-001 SC UART testpads.jpg|[[DYN-001]] SC UART testpads
File:SUR-001 SC and SB UART testpads.jpg|[[SUR-001]] SC and SB UART testpads
File:JTP-001 SC and SB UART testpads.jpg|[[JTP-001]] SC and SB UART testpads
File:JSD-001 SC and SB UART testpads.jpg|[[JSD-001]] SC and SB UART testpads
File:KTE-001 SC and SB UART testpads.jpg|[[KTE-001]] SC and SB UART testpads
File:SW3 SC UART testpads.jpg|SW3 SC UART testpads
</gallery>
 
You can attach a 3.3v TTL cable (LV-TTL) to the UART on syscon (UART0_TxD, UART0_RxD). Baud rate is 57600. There is a simple plaintext protocol involved. This varies on different syscon models. Example:


'''<command>:<hash>'''
'''<command>:<hash>'''


Where the hash is the sum of command bytes & 0xFF.
Where the hash is the sum of command bytes & 0xFF


You should terminate commands with \r\n, the syscon messages are only terminated with \n.
you should terminate commands with \r\n, the syscon messages are only terminated with \n


=== Samples ===
=== Samples ===
Here are some of the commands/messages encountered:
Here are some of the commands/messages encountered:


Line 464: Line 345:


Commands:
Commands:
<pre>
<pre>VER:ED
VER:ED
OK 00000000 S1E 00 00 065D:A4
OK 00000000 S1E 00 00 065D:A4
OK 00000000 S1E 01 0B 00 0832:A3 (on DYN-001 board)
OK 00000000 S1E 02 03 00 0918:9A (on KTE-001 board)


ERRLOG:CB
ERRLOG:CB
Line 524: Line 402:
C:34:BOOT
C:34:BOOT
E:50:NG F0000005
E:50:NG F0000005
</pre>
</pre>
more [[Talk:System_Controller_Firmware#Syscon_commands|Syscon commands]]


See also [[Talk:System_Controller_Firmware#Syscon_commands|Syscon commands]].
bruteforcing commands:<!--// LOL //--> http://pastebin.com/CNei0xbC<br>
 
Bruteforcing commands:<!--// LOL //--> http://pastebin.com/CNei0xbC


VERY IMPORTANT:
VERY IMPORTANT:
* Max size of a command is 11 characters, 16 if you count with C:<hash>:
* Max size of a command is 11 characters,16 if you count with C:<hash>:
* Sending a command with 11 chars results in NO OUTPUT
* Sending a command with 11 chars results in NO OUTPUT
* Sending a command with more than 11 chars results in NG F0000002
* Sending a command with more than 11 chars results in NG F0000002
* Max size of a command on DECR is 135, 140 if you count with C:<hash>:
* Max size of a command on DECR is 135, 140 if you count with C:<hash>:


== Pinouts ==
== Syscon (SPI) EEPROM ==
See:
{| class="wikitable"
*https://www.psdevwiki.com/ps3/Template:Syscon_pinout_BGA_200_pads
*https://www.psdevwiki.com/ps3/Template:Syscon_pinout_LQFP_128_pins
*https://www.psdevwiki.com/ps3/Template:Syscon_pinout_LQFP_100_pins
 
{| class="wikitable" style="float:left; margin:5px;"
|+Syscon EEPROM (SPI)
! BGA !! Name !! Description
! BGA !! Name !! Description
|-
|-
Line 564: Line 436:
|}
|}


{| class="wikitable" style="float:left; margin:5px;"
== Syscon JTAG ==
|+Syscon BE SPI Bus
disabled in factory after production on retailmodels
{| class="wikitable"
! BGA !! Name !! Description
! BGA !! Name !! Description
|-
|-
| M2 || BE_SPI_CS || Chip Select
| L8 || JRTCK || Return Test Clock
|-
|-
| N2 || BE_SPI_DO || Serial Data Output
| K8 || JTCK || Test Clock
|-
|-
| M1 || BE_SPI_DI || Serial Data Input
| K9 || JTDO || Test Data Out
|-
|-
| N1 || BE_SPI_CLK || Serial Data Clock
| L9 || JTMS || Test Mode State / Test Mode Select
|-
|-
| colspan="3" {{cellcolors|lightblue}}
| K7 || JTDI || Test Data In
|-
|-
| P2 || BE_RESET || CellBE Reset
| L7 || JNTRST || Test Reset
|-
| P1 || BE_POWGOOD  || CellBE PowerGood
|-
| T2 || BE_INT || CellBE Interrupt
|-
|-
|}
|}


{| class="wikitable" style="float:left; margin:5px;"
= Syscon Underlaying ports =
|+Syscon RSX SPI Bus
== Syscon Cell SPI Bus ==
{| class="wikitable"
! BGA !! Name !! Description
! BGA !! Name !! Description
|-
|-
| E2 || RSX_SPI_CS || Chip Select
| M2 || /BE_SPI_CS || Chip Select
|-
|-
| F2 || RSX_SPI_DO || Serial Data Output
| N2 || BE_SPI_DO || Serial Data Output
|-
|-
| F1 || RSX_SPI_DI || Serial Data Input
| M1 || BE_SPI_DI || Serial Data Input
|-
|-
| G1 || RSX_SPI_CLK || Serial Data Clock
| N1 || BE_SPI_CLK || Serial Data Clock
|-
|-
| colspan="3" {{cellcolors|lightblue}}
| P2 || /BE_RESET || CellBE Reset
|-
|-
| G2 || RSX_RESET || RSX Reset
| P1 || BE_POWGOOD  || CellBE PowerGood
|-
|-
| J2 || RSX_INT || RSX Interrupt
| T2 || /BE_INT || CellBE Interrupt
|-
|-
|}
|}


{| class="wikitable" style="float:left; margin:5px;"
== Syscon Southbridge SPI Bus ==
|+Syscon SB SPI Bus
{| class="wikitable"
! BGA !! Name !! Description
! BGA !! Name !! Description
|-
|-
| B9 || SB_SPI_CS || Chip Select
| B9 || /SB_SPI_CS || Chip Select
|-
|-
| B8 || SB_SPI_DO || Serial Data Output
| B8 || SB_SPI_DO || Serial Data Output
Line 617: Line 487:
|-
|-
| A8 || SB_SPI_CLK || Serial Data Clock
| A8 || SB_SPI_CLK || Serial Data Clock
|-
| colspan="3" {{cellcolors|lightblue}}
|-
| D11 || SB_RESET || SB Reset
|-
| D9 || SB_INT || SB Interrupt
|-
|-
|}
|}


{| class="wikitable" style="float:left; margin:5px;"
<!--// Remote Power ON/OFF (from network, HDMI CEC commands, etc...) is managed by devices connected to the southbridge (ethernet/wifi/BT, HDMI controller, etc...) //-->
|+Syscon JTAG (disabled in factory after production on retail models)
! BGA !! Name !! Description
|-
| L8 || JRTCK || Return Test Clock
|-
| K8 || JTCK || Test Clock
|-
| K9 || JTDO || Test Data Out
|-
| L9 || JTMS || Test Mode State / Test Mode Select
|-
| K7 || JTDI || Test Data In
|-
| L7 || JNTRST || Test Reset
|-
|}
 
= Testpads and alternative solder points =
*The identification of the syscon UART testpads can be made by grouping the motherboard models in a similar way we was doing with the [[Teensy%2B%2B_2.0#Schematics_by_motherboard_.28retail.29| layouts]] of the hardware flashers, there are 7 retail testpads layouts:
**Layout 1 = COK-001, COK-002 (fat, mullion, NAND)
**Layout 2 = SEM-001 (fat, mullion, NAND)
**Layout 3 = DIA-001, DIA-002 (fat, mullion, NOR)
**Layout 4 = VER-001 (fat, sherwood, NOR)
**Layout 5 = DYN-001 (slim, sherwood, NOR)
**Layout 6 = SUR-001, JTP-001, JSD-001, KTE-001 (slim, sherwood, NOR)
**Layout 7 = MSX-001, MPX-001, NPX-001, PPX-001, PQX-001, RTX-001, REX-001 (superslim, sherwood, NOR/eMMC)
 
== DIA-001 and DIA-002 ==
This points are availables to intercept signals by soldering wires, attaching probes, osciloscopes, etc... The photos are only orientatives to follow the traces, there's no need to remove the SYSCON to intercept this signals so can be done while its working
 
All this points has been hardware reverse engineered from a [[CECHHxx|CECHH02]]/[[DIA-00x#DIA-001|DIA-001]] motherboard
{{clear}}
 
=== Topside Pinout ===
<div style="float:right">[[File:syscon_top.jpg|thumbnail|Syscon Top Pinouts<br />[[CECHHxx|CECHH02]]/[[DIA-00x#DIA-001|DIA-001]]]]</div>


{|class="wikitable"
! Pin #
! Name
! Description
|-
!B3
|SW_10
|Unknown
|-
!A6
|MC_RESERVED2
|Unknown
|-
!E10
|MUL_CHKSTP_OUT
|Unknown
|-
!C15
|VSS
|Power Ground
|-
!B16
|OSCOUT
|Goes to unpopulated crystal
|-
!C16
|OSCIN
|From unpupulated crystal
|-
!B15
|POW_FAIL
|Power Failure Signal
|-
!H1
|PN5
|Unknown
|-
!H2
|PN6
|Unknown
|-
!R1
|PM7
|Unknown
|-
!R2
|PM6
|Unknown
|-
!M4
|SW9
|Unknown
|-
!M10
|XDR_FET_SCK
|Unknown
|}
=== Bottomside Pinout ===
<div style="float:right">[[File:DIA-001 SysCon EPROM Interface.png|thumbnail|[[DIA-001]] [[CECHHxx]] [[SC EEPROM]] Interface]]<br />[[File:syscon_bottom.jpg|thumbnail|Syscon Bottom Pinouts<br />[[CECHHxx|CECHH02]]/[[DIA-00x#DIA-001|DIA-001]]]]<br />[[File:Syscon uart soldered on dia-002.jpg|thumbnail|Syscon UART soldered<br />[[CECHJxx]]/[[CECHKxx]] [[DIA-00x#DIA-002|DIA-002]]]]</div>
{|class="wikitable"
! Pin #
! Name
! Description
|-
!R5
|VDD
| +3.3v
|-
!R7
|DVDD
| +1.8v
|-
!C15
|VSS
|Power Ground
|-
!N16
|DIAG_MODE
|Unknown
|-
!N15
|BACKUP_MODE
|Unknown
|-
!P16
|UART0_TxD
|Serial
|-
!P15
|UART0_RxD
|Serial
|-
!R9
|PQ1
|Unknown
|-
!B12
|POW_SW
|Power Switch
|-
!A12
|EJECT_SW
|Eject Switch
|-
!L7
|JNTAST
|JTAG
|-
!L8
|JRTCK
|JTAG
|-
!L9
|JTMS
|JTAG
|-
!K7
|JTDI
|JTAG
|-
!K8
|JTCK
|JTAG
|-
!K9
|JTDO
|JTAG
|-
!M6
|SW_7_B
|Unknown
|-
!M8
|FANPWM1
|Unknown
|-
!E5
|GX_VSRT
|Unknown
|-
!B5
|DVE_RST
|Unknown
|-
!G4
|HDMI_RST1
|Unknown
|-
!D4
|XDR_FET_RST
|Unknown
|}


{{Motherboard Components}}<noinclude>[[Category:Main]]</noinclude>
{{Motherboard Components}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)