Editing Syscon Hardware

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
<div style="float:right">[[File:Syscon CXR713120-203GB DIE (detail).jpg|300px|thumb| Syscon CX'''R7131'''20-203GB DIE (detail)]]<br />[[File:Pyramid Syscon live probing.jpg|300px|thumb|Pyramid Syscon live probing]]</div>
<div style="float:right">[[File:SYSCON_GEN1.JPG|thumb|Syscon 1st Generation (BGA Packaging)]]<br />[[File:Pyramid Syscon live probing.jpg|thumb|Pyramid Syscon live probing]]</div>


= Description =
Syscon is the main power controller chip of the PS3. It is responsible for powering up the various power systems and for configuring and initialising the [[CELL BE]], [[RSX]] and [[South Bridge]]. It communicates with these devices via separate SPI busses. There is external access by JTAG (disabled from factory on retail models), an EEPROM programming interface <!-- not fully examined --> and Serial (UART). The Syscon is a SoC and consists of an ARM7TDMI (ARMv4) CPU, a 256KB EEPROM and 16KB RAM.
The PS3 syscon is the main power controller chip of the PS3. It is responsible for powering up the main 12v rail of the [[Power Supply]] and various power systems by switching different [[Talk:Regulators|voltage regulators]] in the motherboard, and for configuring and initialising the [[CELL BE|BE]], [[RSX]] and [[South Bridge|SB]] via dedicated SPI buses.


The LEDs and buttons of the [[Switch boards|Switch board]] are connected to syscon, as well as the [[Cooling|fan/s]], buzzer, etc.
= Serialnumbers per SKU =


The Syscon is a SoC and based on a ARM7TDMI-S (in the [[Mullion]] syscons) or a NEC 78K0R (in the [[Sherwood]] syscons) design. There is external access by "JTAG" (disabled from factory on retail models), an EEPROM programming interface (only on Mullion) and Serial (UART).
== Retail ==


<!--// Remote Power ON/OFF (from network, HDMI CEC commands, etc...) is managed by devices connected to the southbridge (ethernet/wifi/BT, HDMI controller, etc...) //-->
{| class="wikitable sortable"
 
== PlayStation system controllers ==
 
{| class="wikitable" style="font-size:small; line-height:105%"
! Production Start Date (<=) || PS2 Mechacon !! PSP Syscon !! PS3 Syscon !! PSVita Syscon !! PS4 Syscon !! Used IC/CPU Core
|-
| <abbr title="GH-001+">10/1999</abbr> || CXP101064 || - || - || - || - || rowspan="2" | Sony SPC970 (100 pin)
|-
| <abbr title="GH-003+">01/2000</abbr> || CXP102064 || - || - || - || -
|-
| <abbr title="GH-015+">09/2000</abbr> || CXP103049 || - || - || - || - || Sony SPC??? (136 pin)
|-
| style="padding:0px" colspan="7" |
|-
| <abbr title="TMU-001, TMU-002, TA-079, TA-081">08/2004</abbr> || - || BAR''xx'' || - || - || - || NEC <abbr title="D790019">D780032AY</abbr> (78K0/78003xA, 64 pin)
|-
| <abbr title="TA-082, TA-086">07/2005</abbr> || - || B30''x'' || - || - || - || NEC <abbr title="D79F0036">D78F0531</abbr> (78K0/KE2 V2.00, 64 pin)
|-
| <abbr title="TA-085, TA-088, TA-091, TA-094">07/2007</abbr> || - || B40''x'' / 40''xx'' || - || - || - || NEC <abbr title="D79F????">D78F0544</abbr> (78K0/KF2 V2.00, 84 pin)
|-
|-
| <abbr title="TA-090, TA-092, TA-093, TA-095, TA-096, TA-097">07/2008</abbr> || - || 3''xxx'' || - || - || - || NEC <abbr title="D79F????">D78F0534</abbr> (78K0/KE2 V2.00, 64 pin)
! [[SKU Models|Model]] !! [[Product Sub Code]] !! [[Motherboard Revisions|Motherboard]] !! [[Syscon Hardware|Syscon<br />part no.]] !! Syscon<br />[[More System Information#First_section|Soft ID]] !! Notes
|-
|-
| style="padding:0px" colspan="7" |
| [[CECHAxx]]<br />[[CECHBxx]] || 0x01<br />0x02 || [[COK-00x#COK-001|COK-001]] || [[CXR713120-201GB]] || 0B8E ||  
|-
|-
| <abbr title="GH-023+, XPD-001, XPD-005">03/2003</abbr> || CXR706080 || - || - || - || - || rowspan="3" | Sony SR11 (ARM7TDMI)<br>PS2 (''Dragon''): 164 pin<br>PS3 (''Donkey''): 200 pin
| [[CECHCxx]]<br />[[CECHExx]] || 0x03<br />0x04 || [[COK-00x#COK-002|COK-002]] or<br />[[COK-00x#COK-002W|COK-002W]] || [[CXR713120-201GB]] or<br />[[CXR713120-202GB]] || 0C16 ||  
|-
|-
| <abbr title="GH-032+">09/2004</abbr> || CXR716080 || - || CXR713120 || - || -
| [[CECHGxx]] || 0x05 || [[SEM-00x|SEM-001]] || [[CXR713120-201GB]] or<br />[[CXR713120-202GB]] or<br />[[CXR713120-203GB]] || 0D52 ||
|-
|-
| <abbr title="GH-061+">07/2007</abbr> || CXR726080 || - || CXR714120 || - || -
| [[CECHHxx]] || 0x06 || [[DIA-00x#DIA-001|DIA-001]] || [[CXR714120-301GB]] || 0DBF ||
|-
|-
| style="padding:0px" colspan="7" |
| [[CECHJxx]]<br />[[CECHKxx]] || 0x07 || [[DIA-00x#DIA-002|DIA-002]] || [[CXR714120-301GB]] or<br />[[CXR714120-302GB]] || 0E69 ||  
|-
|-
| 03/2008 || - || - || SW || - || - || NEC <abbr title="D79F0073">D78F11AA</abbr> (78K0R/KH3 V3.40, 128 pin)
| [[CECHLxx]]<br />[[CECHMxx]]<br />[[CECHPxx]]<br />[[CECHQxx]] || 0x08 || [[VER-00x|VER-001]] || [[SW-301]] or<br />[[SW-302]] || 065D ||
|-
|-
| 05/2009 || - || - || SW2 || - || - || NEC <abbr title="D79F0086">D78F11BB</abbr> (78K0R/KH3 V1.00, 128 pin)
| [[CECH-20xx]] || 0x09 || [[DYN-00x|DYN-001]] || [[SW2-301]] || 0832 ||  
|-
|-
| <abbr title="IRT-001, IRT-002, IRS-002, IRS-1001, DOL-1001, DOL-1002">07/2010</abbr> || - || - || - || <abbr title="No official name">"SC"</abbr> || - || NEC <abbr title="No/Matching internal name">D79F0109</abbr> (<abbr title="Mix between 78K0R/KH3 and 78K0R/Kx3-L">78K0R/KH3-L</abbr> V1.00, 121 pin)
| [[CECH-21xx]] || 0x0A || [[SUR-00x|SUR-001]] || [[SW2-301]] or<br />[[SW2-302]] || 08A0 ||  
|-
|-
| 06/2011 || - || - || SW3 || - || - || NEC <abbr title="D79F0123">D78F11CC</abbr> (78K0R/KG3 V1.00, 100 pin)
| [[CECH-25xx]] || 0x0B || [[JTP-00x|JTP-001]] or<br />[[JSD-00x|JSD-001]] || [[SW2-301]] or<br />[[SW2-302]]&nbsp;&nbsp;or<br />[[SW2-303]] || 08C2 ||
|-
|-
| style="padding:0px" colspan="7" |
| [[CECH-30xx]] || 0x0C || [[KTE-00x|KTE-001]] || [[SW2-301]] or<br />[[SW2-302]] or<br />[[SW2-303]] or<br />[[SW3-301]] || 0918 ||  
|-
|-
| <abbr title="CVN-001, SAA-001, SAB-001">07/2013</abbr> || - || - ||- || - || C0L || Renesas R5F100PL (RL78/G13 V3.03, 100 pin)
| [[CECH-40xx]] || 0x0D || [[MSX-00x|MSX-001]] or<br />[[MPX-00x|MPX-001]] || [[SW3-302]] || 098F ||  
|-
|-
| <abbr title="USS-1001, USS-1002">08/2013</abbr> || - || - ||- || A0''xxx'' || - || Renesas R5F1ZCRK (RL78/G13 V3.03, 121 pin)
| [[CECH-42xx]]A || ? || [[PQX-00x|PQX-001]] || [[SW3-304]] || ? ||  
|-
| <abbr title="SAC-001, SAD-001, SAD-002, SAD-003, SAE-001, SAE-002, SAE-003, SAE-004, SAF-004, SAF-006, HAC-001, NVA-001, NVB-003, NVB-004, NVG-001, NVG-002">04/2015</abbr> || - || - ||- || - || C0L2 || Renesas R5F101LL (RL78/G13 V3.03, 64 pin)
|-
|-
|}
|}


* The SPC900 core was designed by Texas Instruments ([https://www.linkedin.com/in/hirakawa-katsunobu-55b09b2])
== Non retail ==
* ''CXP101064'', ''CXP102064'' are similar to CXP97 (''CXP971000'', ''CXP972032'', '''CXP973064''', ''CXP973F064''), the ''CXP103049'' matches no COTS because of its OCD support
** In-Circuit-Emulator: Mitek NICE-SPC970 ([http://www.hitechfacility.co.jp/details.php?id=E0001913]); Debug software: SVD970; Flash programmer: SFP-2
* A ''F'' inside the model name specifies that the IC contains flash memory.
** Mass-produced CXR/SW units don't have/use program flash memory for updates, instead an encrypted firmware patch is stored on the data-"EEPROM"
* CXR7 series uses Sony SR11 CPU (ARM7TDMI)
** Models with public datasheet: ''CXR702080'', ''CXR702F080'', ''CXR704060'' (datasheet: [http://www.alldatasheet.com/datasheet-pdf/pdf/294279/SONY/CXR704060.html 1])
* Prototype PS3 Syscon's:
** [[CXR713F120A]] Syscon used on (early) pre-release prototypes, e.g. [[CEB-2030]], [[DECR-1000]], [[DEH-H1001-D]], [[DEH-H1000A-E]]
** [[DEH-FH1500J-A]] with [[VERTIGO-02]] board and SW series prototype ''[[Media:DEH-FH1500J-A_-_VERTIGO-02_-_Syscon_Hardware.jpg|D79F0073]]''
** [[CBEH-H2001]] with [[SUR-00x#SURTEES-03|SURTEES-03]] board and SW2 series prototype ''D79F0086''
** [[DEH-ML00AK-G]] with MPX-001 (Prototype) board and SW3 series prototype ''[[Media:DEH-ML00AK-G_Board_4.jpg|D79F0123]]''
 
= PS3 Syscon models =
{| class="wikitable" style="font-size:small; line-height:105%"
|-
! colspan="10" | [[Mullion]] [[Syscon Hardware|Syscons]] !! rowspan="13" style="padding:1px" | !! colspan="8" | [[SKU Models|PS3 model]] & [[Motherboard Revisions|Motherboard]] compatibility by [[Platform ID]]
|-
! Model !! [[Syscon Firmware|Rev.]] !! [[Syscon Firmware|Ver.]] !! <abbr title="Syscon Firmware build date">Year</abbr> !! Package !! ROM !! FLASH !! colspan="2" | [[SC_EEPROM|EEPROM]] !! RAM
! DEH-R10xx<br>[[DECR-1000]] !! [[SKU Models Nonretail|Prototypes]] !! [[CECHAxx]]<br>[[CECHBxx]] !! [[CECHCxx]]<br>[[CECHExx]] !! [[CECHGxx]] !! [[CECHHxx]] !! [[CECHJxx]]<br>[[CECHKxx]] !! [[DECR-1400]]
|-
! style="width:115px; border-top:hidden" | !! style="width:35px; border-top:hidden" | !! style="width:55px; border-top:hidden" | !! style="width:30px; border-top:hidden" | !! style="width:60px; border-top:hidden" | !! style="width:40px; border-top:hidden" | !! style="width:40px; border-top:hidden" | !! style="width:35px" | Total !! style="width:35px" | Used !! style="width:35px; border-top:hidden" |
! [[TMU-510]]<br>[[TMU-520]] !! <!--[[MPU-501]]<br>-->[[COOKIE-13]]<br>[[COK-001 (Prototype)|COK Proto]] !! [[COK-001]] !! [[COK-002]] !! [[SEM-001]] !! [[DIA-001]] !! [[DIA-002]] !! [[DEB-001]]
|-
| colspan="18" style="padding:1px" |
|-
! [[CXR713F120A]]
| colspan="3" style="text-align:center; background:#999; color:#fff" | <abbr title="Depends of the syscon firmware version installed in it">ANY</abbr> || rowspan="8" | [[Template:Syscon pinout BGA 200 pads|BGA 200]] || <abbr title="0x20000>128KB</abbr> || <abbr title="0x60000>384KB</abbr> || rowspan="4" | <abbr title="0x8000>32KB</abbr> || rowspan="3" | <abbr title="0x8000>32KB</abbr> || rowspan="8" | <abbr title="0x10000>64KB</abbr> || {{yes}}, factory || {{yes}}, factory || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}}
|-
! [[CXR713120-201GB]]
| 0B8E || v1.0.0_k1 || 2006 || rowspan="7" | <abbr title="0x60000>384KB</abbr> || rowspan="7" style="text-align:center; background:lightgrey;" | N/A || {{YES}} ? || {{YES}} ? || {{yes}}, factory || {{no}} || {{no}} || {{no}} || {{no}} || {{no}}
|-
! [[CXR713120-202GB]]
| 0C16 || v1.1.3_k1 || 2006 || {{YES}} ? || {{YES}} ? || {{YES}} || {{yes}}, factory || {{no}} || {{no}} || {{no}} || {{no}}
|-
! [[CXR713120-203GB]]
| 0D52 || v1.2.3_k1 || 2007 || rowspan="5" | <abbr title="0x5000>20KB</abbr> || {{YES}} ? || {{YES}} ? || {{YES}} || {{YES}} || {{yes}}, factory || {{no}} || {{no}} || {{no}}
|-
! [[CXR714120-301GB]]
| 0DBF || v1.3.3_k1 || 2007 || rowspan="4" | <abbr title="0x5000>20KB</abbr> || {{YES}} ? || {{YES}} ? || {{YES}} || {{yes}}, <abbr title="Found in a CECHE01 MG (Metal Gear Solid 4 edition)">rare</abbr> || {{yes}}, factory || {{yes}}, factory || {{no}} || {{no}}
|-
! [[CXR714120-302GB]]
| 0E69 || v1.4.4_k2 || 2007 || {{YES}} ? || {{YES}} ? || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{yes}}, factory || {{yes}}, factory
|-
! [[CXR714120-303GB]]
| 0F29 || v1.5.0_k2 || 2009 || {{YES}} ? || {{YES}} ? || {{YES}} || {{yes}}, <abbr title="Found in a refurbished CECHCxx/COK-002 with a 65nm RSX">refurb</abbr> || {{YES}} || {{YES}} || {{YES}} || {{YES}}
|-
! [[CXR714120-304GB]]
| 0F38 || v1.5.1_k2 || 2010 || {{YES}} ? || {{YES}} ? || {{yes}}, <abbr title="Found in a refurbished CECHAxx/COK-001 with a 40nm RSX">refurb</abbr> || {{YES}} || {{YES}} || {{yes}}, <abbr title="Found in a refurbished CECHHxx/DIA-001 with a 40nm RSX">refurb</abbr> || {{YES}} || {{YES}}
|}


{| class="wikitable" style="font-size:small; line-height:105%"
{| class="wikitable sortable"
|-
|-
! colspan="10" | [[Sherwood]] [[Syscon Hardware|Syscons]] !! rowspan="17" style="padding:1px" | !! colspan="10" | [[SKU Models|PS3 model]] & [[Motherboard Revisions|Motherboard]] compatibility by [[Platform ID]]
! [[SKU Models|Model]] !! [[Product Sub Code]] !! [[Motherboard Revisions|Motherboard]] !! [[Syscon Hardware|Syscon<br />part no.]] !! Syscon<br />[[More System Information#First_section|Soft ID]] !! Active JTAG !! Notes
|-
|-
! Model !! [[Syscon Firmware|Rev.]] !! [[Syscon Firmware|Ver.]] !! <abbr title="Syscon Firmware build date">Year</abbr> !! Package !! ROM !! FLASH !! colspan="2" | [[SC_EEPROM|EEPROM]] !! RAM
| [[CEB-2040]] || - || [[MPU-501]] || [[CXR713F120|CXR713F120GB-000]] || ? || ?No? || Retail prototype
! [[SKU Models Nonretail|Prototypes]] !! [[CECHLxx]]<br>[[CECHMxx]]<br>[[CECHPxx]]<br>[[CECHQxx]] || [[SKU Models Nonretail|Prototypes]] || [[CECH-20xx]] !! [[CECH-21xx]] !! [[CECH-25xx]] !! [[SKU Models Nonretail|Prototypes]] || [[CECH-30xx]] !! [[CECH-40xx]] !! [[CECH-42xx]]<br>[[CECH-43xx]]
|-
|-
! style="width:115px; border-top:hidden" | !! style="width:35px; border-top:hidden" | !! style="width:55px; border-top:hidden" | !! style="width:30px; border-top:hidden" | !! style="width:60px; border-top:hidden" | !! style="width:40px; border-top:hidden" | !! style="width:40px; border-top:hidden" | !! style="width:35px" | Total !! style="width:35px" | Used !! style="width:35px; border-top:hidden" |
| [[DECR-1000|DECR1000(A/J)]] || 0x01 || [[TMU-520]] || [[CXR713F120A]] || 03FB || No || Reference tool
! [[VERTIGO-02|VERTIGO]]<br><small>prototype</small> !! [[VER-001]] !! [[SUR-00x#SURTEES-03|SURTEES]]<br><small>prototype</small> !! [[DYN-001]] !! [[SUR-001]] !! [[JTP-001]]<br>[[JSD-001]] !! [[MPX-001]]<br><small>prototype</small> !! [[KTE-001]] !! [[MSX-001]]<br>[[MPX-001]]<br>[[NPX-001]] !! [[PPX-001]]<br>[[PQX-001]]<br>[[RTX-001]]<br>[[REX-001]]
|-
|-
| colspan="18" style="padding:1px" |  
| [[DECR-1400|DECR1400(A/J)]] || 0x01 || [[DEB-001]] || [[CXR714120-302GB]] || ? || ? || Reference tool
|-
|-
! [[Media:DEH-FH1500J-A_-_VERTIGO-02_-_Syscon_Hardware.jpg|D79F0073]]
| [[DEH-H1001-D]] || 0x01 || [[COOKIE-13]] || [[CXR713F120A]] || 0B67 || No || Preproduction
| colspan="3" style="text-align:center; background:#999; color:#fff" | <abbr title="Depends of the syscon firmware version installed in it">ANY</abbr> || rowspan="7" | [[Template:Syscon pinout LQFP 128 pins|LQFP 128]] || rowspan="12" style="text-align:center; background:lightgrey;" | N/A || rowspan="3" | <abbr title="0x80000>512KB</abbr> || rowspan="12" style="text-align:center; background:lightgrey;" | N/A || rowspan="12" style="text-align:center; background:lightgrey;" | <abbr title="0x8000 Emulated inside FLASH">32KB</abbr> || rowspan="12" | <abbr title="0xC800>50KB</abbr> || {{yes}}, factory || {{YES}} || colspan="4" rowspan="3" style="text-align:center; background:#CC5555; color:#FFFFFF;" | No (<abbr title="Different HDMI/CEC handling">HDMI Incompatible</abbr>) || colspan="4" rowspan="7" style="text-align:center; background:#CC5555; color:#FFFFFF;" | No (different package)
|-
|-
! [[SW-301]]
| [[DEH-H1000A(S)(-E(S))]] || 0x01 || [[COK-001 (Prototype)]] || [[CXR713F120A]] || 0B67 || No || Preproduction
| 065D || 0.17.0 || 2008 || {{YES}} ? || {{yes}}, factory
|-
|-
! [[SW-302]]
| [[DEH-FH1500J-A]] || 0x08 || [[VERTIGO-02]] || D79F0073 ([[SW-301]]) || 0658 || ?Yes? || Preproduction
| <abbr title="Please help wiki by reporting this ID"><span style="background:#ff4444; color:#ffff00;">'''????'''</span></abbr> || <abbr title="Please help wiki by reporting this ID"><span style="background:#ff4444; color:#ffff00;">'''?.??.?'''</span></abbr> || 2008 || {{YES}} ? || {{yes}}, factory
|-
|-
! D79F0086
| [[DEH-ML00AK-G]] || 0x0D || [[MPX-001 (Prototype) ]] || D79F0123 ([[SW3-302]]) || 098F || ?No? || Preproduction
| colspan="3" style="text-align:center; background:#999; color:#fff" | <abbr title="Depends of the syscon firmware version installed in it">ANY</abbr> || rowspan="9" | <abbr title="0xC0000>768KB</abbr> || colspan="2" rowspan="4" style="text-align:center; background:#CC5555; color:#FFFFFF;" | No (<abbr title="Different HDMI/CEC handling">HDMI Incompatible</abbr>) || {{yes}}, factory || {{YES}} || {{YES}} || {{YES}}
|-
|-
! [[SW2-301]]
| [[DECHA|DECHA00A/J]] || 0x01 || [[COK-001]] || [[CXR713120-201GB]] ? || 0C16 || No || Found when searching for 40nm RSX
| 0832 || 1.11.0 || 2009 || {{YES}} ? || {{yes}}, factory || {{no}} || {{no}}
|-
|-
! [[SW2-302]]
| colspan="7" {{cellcolors|lightblue}}
| 08A0 || 1.16.0 || 2009 || {{YES}} ? || {{YES}} || {{yes}}, factory || {{no}}
|-
|-
! [[SW2-303]]
| [[CECHCxx]]<br />[[CECHExx]]|| 0x03<br />0x04 ? || [[COK-00x#COK-002|COK-002]] || [[CXR714120-303GB]] || 0F29 || ?No? || Refurbished, new 65nm RSX, new syscon
| 08C2 || 1.21.0 || 2010 || {{YES}} ? || {{YES}} || {{YES}} || {{yes}}, factory
|-
|-
! [[Media:DEH-ML00AK-G_Board_4.jpg|D79F0123]]
| [[CECHAxx]]<br />[[CECHBxx]]? || 0x01<br />0x02 ? || [[COK-00x#COK-001|COK-001]] || [[CXR714120-304GB]] || 0F38 || ?No? || Refurbished, new 40nm RSX, new syscon
| colspan="3" style="text-align:center; background:#999; color:#fff" | <abbr title="Depends of the syscon firmware version installed in it">ANY</abbr> || rowspan="5" | [[Template:Syscon pinout LQFP 100 pins|LQFP 100]] || colspan="6" rowspan="5" style="text-align:center; background:#CC5555; color:#FFFFFF;" | No (different package) || {{yes}}, factory || {{YES}} || {{YES}} || {{YES}}
|-
|-
! [[SW3-301]]
<!-- Not Prototype debug units - see retail -->
| 0918 || 2.3.0 || 2011 || {{YES}} ? || {{yes}}, factory || {{no}} || {{no}}
|-
! [[SW3-302]]
| 098F || 2.12.0 || 2012 || {{YES}} ? || {{YES}} || {{yes}}, factory || {{no}}
|-
! [[SW3-303]]
| <abbr title="Please help wiki by reporting this ID"><span style="background:#ff4444; color:#ffff00;">'''????'''</span></abbr> || <abbr title="Please help wiki by reporting this ID"><span style="background:#ff4444; color:#ffff00;">'''?.??.?'''</span></abbr> || 2013 || {{YES}} ? || {{YES}} || ? || ?
|-
! [[SW3-304]]
| 09A4 || 2.21.0 || 2013 || {{YES}} ? || {{YES}} || {{YES}} || {{yes}}, factory
|}
|}


Line 238: Line 147:
| 0x17 || '''tmpforcp <zone ID>''' || Reference Tool's temperature For Communication Processor || Gets the temperature of reference tool
| 0x17 || '''tmpforcp <zone ID>''' || Reference Tool's temperature For Communication Processor || Gets the temperature of reference tool
|-
|-
| 0x18 || rowspan="8" colspan="3" style="background:lightgrey; color:#ff0000; text-align: center;" | Invalid CMDs
| 0x18 || rowspan="7" colspan="3" style="background:lightgrey; color:#ff0000; text-align: center;" | Invalid CMDs
|-
|-
| 0x19
| 0x19
Line 247: Line 156:
|-
|-
| 0x1C
| 0x1C
|-
| 0x1D
|-
|-
| 0x1E
| 0x1E
Line 277: Line 184:
! Packet ID !! Command/Action !! Logs !! Notes
! Packet ID !! Command/Action !! Logs !! Notes
|-
|-
| 0x00 || '''version''' || version\nv1.0.4_c2\n  (END) ||
| 0x00 || '''version''' || <pre>  version\nv1.0.4_c2\n  (END) </pre> ||
|-
|-
| 0x01 || '''bringup''' || (END) ||
| 0x01 || '''bringup''' || <pre>  (END) </pre> ||
|-
|-
| 0x02 || '''shutdown''' || Do nothing. (PowerOff State)\n (END) || Returns (END) if the system is on  
| 0x02 || '''shutdown''' || <pre> Do nothing. (PowerOff State)\n (END) </pre> || Returns (END) if the system is on  
|-
|-
| 0x03 || '''firmud''' || Start...\nErase User Program Area\n  (END) || This will brick your SYSCON if you don't feed it any argument or feed to it the wrong argument!
| 0x03 || '''firmud''' || <pre> Start...\nErase User Program Area\n  (END) </pre> || This will brick your SYSCON if you don't feed it any argument or feed to it the wrong argument!
|-
|-
| 0x04 || '''bsn''' || bsn\nNANNNNNNNNNA\n  (END) || N is digit and A is char (removed for privacy)
| 0x04 || '''bsn''' || <pre> bsn\nNANNNNNNNNNA\n  (END) </pre> || N is digit and A is char (removed for privacy)
|-
|-
| 0x05 || '''halt''' || halt\n  (END) ||
| 0x05 || '''halt''' || <pre> halt\n  (END)</pre> ||
|-
|-
| 0x06 || '''cp ready''' || cp ready\nCP READY: OK\n  (END) ||  
| 0x06 || '''cp ready''' || <pre> cp ready\nCP READY: OK\n  (END) </pre> ||  
|-
|-
| 0x07 || '''cp busy''' || cp ready\nCP BUSY: OK\n  (END) || STATUS light blinks forever
| 0x07 || '''cp busy''' || <pre> cp ready\nCP BUSY: OK\n  (END) </pre> || STATUS light blinks forever
|-
|-
| 0x08 || '''cp reset''' || No response || Should reset CP to factory settings
| 0x08 || '''cp reset''' || No response || Should reset CP to factory settings
|-
|-
| 0x09 || '''bestat''' || (PowerOff State)\n (END) ||
| 0x09 || '''bestat''' || <pre> (PowerOff State)\n (END) </pre>||
|-
|-
| 0x0A || '''powersw''' || (END) ||
| 0x0A || '''powersw''' || <pre>  (END) </pre> ||
|-
|-
| 0x0B || '''resetsw''' || (END) ||
| 0x0B || '''resetsw''' || <pre>  (END) </pre> ||
|-
|-
| 0x0C || '''bootbeep stat''' || BOOT BEEP: ON\n  (END) || when it's off BOOT BEEP status changes to OFF
| 0x0C || '''bootbeep stat''' || <pre> BOOT BEEP: ON\n  (END) </pre> || when it's off BOOT BEEP status changes to OFF
|-
|-
| 0x0D || '''bootbeep on''' || BOOT BEEP ON: DONE\n  (END) ||  
| 0x0D || '''bootbeep on''' || <pre> BOOT BEEP ON: DONE\n  (END) </pre> ||  
|-
|-
| 0x0E || '''bootbeep off''' || BOOT BEEP OFF: DONE\n  (END) ||
| 0x0E || '''bootbeep off''' || <pre> BOOT BEEP OFF: DONE\n  (END) </pre> ||
|-
|-
| 0x0F || '''Reset syscon''' || ||
| 0x0F || '''Reset syscon''' || ||
|-
|-
| 0x10 || '''xdrdiag info''' || 32\n  (END) ||
| 0x10 || '''xdrdiag info''' || <pre> 32\n  (END) </pre> ||
|-
|-
| 0x11 || '''xdrdiag start''' || DIAG START\n  (END) ||
| 0x11 || '''xdrdiag start''' || <pre> DIAG START\n  (END) </pre> ||
|-
|-
| 0x12 || '''xdrdiag result''' || XDR OK\n  (END) || will return ERROR NOT STARTED if xdrdiag start wasn't run previously
| 0x12 || '''xdrdiag result''' || <pre> XDR OK\n  (END) </pre> || will return ERROR NOT STARTED if xdrdiag start wasn't run previously
|-
|-
| 0x13 || '''xiodiag''' || 0 903\n  (END) ||
| 0x13 || '''xiodiag''' || <pre> 0 903\n  (END) </pre> ||
|-
|-
| 0x14 || '''fandiag''' || ERROR FAN ACTIVE\n  (END) ||
| 0x14 || '''fandiag''' || <pre> ERROR FAN ACTIVE\n  (END) </pre> ||
|-
|-
| 0x15 || '''errlog''' || ofst[ %d]:err_code:0x%08X, clock:0x%08X  YYYY/MM/DD HH:MM:SS || bunch of error logs. ends with (END) once they're over
| 0x15 || '''errlog''' || <pre> ofst[ %d]:err_code:0x%08X, clock:0x%08X  YYYY/MM/DD HH:MM:SS </pre> || bunch of error logs. ends with (END) once they're over
|-
|-
| 0x16 || '''Read line''' || ||
| 0x16 || '''Read line''' || ||
Line 325: Line 232:
| 0x17 || '''tmpforcp <zone ID>''' ||  
| 0x17 || '''tmpforcp <zone ID>''' ||  
|-
|-
| 0x20 || '''cp beepremote''' || (END) ||
| 0x20 || '''cp beepremote''' || <pre>  (END)</pre> ||
|-
|-
| 0x21 || '''cp beep2kn1n3''' || (END) || sends a beep different than SYSCON beep :)
| 0x21 || '''cp beep2kn1n3''' || <pre>  (END)</pre> || sends a beep different than SYSCON beep :)
|-
|-
| 0x22 || '''cp beep2kn2n3''' || (END) || sends two beeps different than SYSCON beeps :)
| 0x22 || '''cp beep2kn2n3''' || <pre>  (END)</pre> || sends two beeps different than SYSCON beeps :)
|-
|-
| rowspan="8" | ?? || rowspan="8" | '''csum''' || Checksum: [027460C9] [68269779] [C19A855E]\n  (END) || displays 3 hexadecimal numbers inside rect parenthesis. the numbers are always the same, except when syscon version changes (v1.0.5_c1)  
| ?? || '''csum''' || <pre>Checksum: [027460C9] [68269779] [C19A855E]\n  (END)</pre> || displays 3 hexadecimal numbers inside rect parenthesis. the numbers are always the same, except when syscon version changes (v1.0.5_c1)  
|-
|-
| Checksum: [02746F91] [682F04DA] [27688CF5]\n  (END) || Another response (v1.0.4_c2)
| ?? || '''csum''' || <pre>Checksum: [02746F91] [682F04DA] [27688CF5]\n  (END)</pre> || Another response (v1.0.4_c2)
|-
|-
| Checksum: [0274C877] [684DA659] [EA426BB1]\n  (END) || Another response (v1.0.4_c1)
| ?? || '''csum''' || <pre>Checksum: [0274C877] [684DA659] [EA426BB1]\n  (END)</pre> || Another response (v1.0.4_c1)
|-
|-
| Checksum: [027B4064] [6B450C64] [4FBF6DA3]\n  (END) || Another response (v1.0.3_c1)
| ?? || '''csum''' || <pre>Checksum: [027B4064] [6B450C64] [4FBF6DA3]\n  (END)</pre> || Another response (v1.0.3_c1)
|-
|-
| Checksum: [027E1B71] [6CDA9F25] [E0C67065]\n  (END) || Another response (v1.0.1_c1)
| ?? || '''csum''' || <pre>Checksum: [027E1B71] [6CDA9F25] [E0C67065]\n  (END)</pre> || Another response (v1.0.1_c1)
|-
|-
| Checksum: [02812855] [6E83917C] [D40F70A5]\n  (END) || Another response (v0.9.14_c1)
| ?? || '''csum''' || <pre>Checksum: [02812855] [6E83917C] [D40F70A5]\n  (END)</pre> || Another response (v0.9.14_c1)
|-
|-
| Checksum: [02835059] [6FC5C632] [BB9BBEC3]\n  (END) || Another response (v0.9.9_c1)
| ?? || '''csum''' || <pre>Checksum: [02835059] [6FC5C632] [BB9BBEC3]\n  (END)</pre> || Another response (v0.9.9_c1)
|-
|-
| Checksum: [026F7951] [66CB09FF] [4EA06B56]\n  (END) || Another response (v0.8.4_c8)
| ?? || '''csum''' || <pre>Checksum: [026F7951] [66CB09FF] [4EA06B56]\n  (END)</pre> || Another response (v0.8.4_c8)
|-
|-
| ?? || '''osbo''' || done\n  (END) ||
| ?? || '''osbo''' || <pre>done\n  (END)</pre> ||
|-
|-
| ?? || '''scopen''' || SC_READY\nERROR 1\n\n*** Invalid Argument ***\n\n[mullion]$ ||
| ?? || '''scopen''' || <pre>SC_READY\nERROR 1\n\n*** Invalid Argument ***\n\n[mullion]$</pre> ||
|-
|-
| ?? || '''scclose''' || \n\n\nSC_SUCCESS\n\n[mullion]$ ||
| ?? || '''scclose''' || <pre>\n\n\nSC_SUCCESS\n\n[mullion]$</pre> ||
|-
|-
|}
|}
Line 411: Line 318:


== Syscon UART ==
== Syscon UART ==
{| class="wikitable"
{| class="wikitable"
! BGA !! Name !! Description
! BGA !! Name !! Description
Line 420: Line 328:
|}
|}


<gallery>
You can attach a 3.3v TTL cable (LV-TTL) to the UART on syscon (UART0_TxD, UART0_RxD). (Convenient solder points are available on JSD-001 / JTP-001 by the NOR test points. They are marked as '?' in [[:File:JSD-001 NOR - nor testpoints.png|marcan' noraliser / judges' NORway install picture]], closest to the ground at the bottom - RX is left, TX is right) Baud rate is 57600. There is a simple plaintext protocol involved. This varies on different syscon models. Example:
File:COK-001 SC UART testpads.jpg|[[COK-001]] SC UART testpads
File:COK-002 SC UART testpads.jpg|[[COK-002]] SC UART testpads
File:SEM-001 SC UART testpads.jpg|[[SEM-001]] SC UART testpads
File:DIA-001 SC UART testpads.jpg|[[DIA-001]] SC UART testpads
File:DIA-002 SC UART testpads.jpg|[[DIA-002]] SC UART testpads
File:VER-001 SC UART testpads.jpg|[[VER-001]] SC UART testpads
File:DYN-001 SC UART testpads.jpg|[[DYN-001]] SC UART testpads
File:SUR-001 SC and SB UART testpads.jpg|[[SUR-001]] SC and SB UART testpads
File:JTP-001 SC and SB UART testpads.jpg|[[JTP-001]] SC and SB UART testpads
File:JSD-001 SC and SB UART testpads.jpg|[[JSD-001]] SC and SB UART testpads
File:KTE-001 SC and SB UART testpads.jpg|[[KTE-001]] SC and SB UART testpads
File:SW3 SC UART testpads.jpg|SW3 SC UART testpads
</gallery>
 
You can attach a 3.3v TTL cable (LV-TTL) to the UART on syscon (UART0_TxD, UART0_RxD). Baud rate is 57600. There is a simple plaintext protocol involved. This varies on different syscon models. Example:


'''<command>:<hash>'''
'''<command>:<hash>'''
Line 536: Line 429:
* Max size of a command on DECR is 135, 140 if you count with C:<hash>:
* Max size of a command on DECR is 135, 140 if you count with C:<hash>:


== Pinouts ==
== Syscon EEPROM (SPI) ==
See:
*https://www.psdevwiki.com/ps3/Template:Syscon_pinout_BGA_200_pads
*https://www.psdevwiki.com/ps3/Template:Syscon_pinout_LQFP_128_pins
*https://www.psdevwiki.com/ps3/Template:Syscon_pinout_LQFP_100_pins


{| class="wikitable" style="float:left; margin:5px;"
{| class="wikitable"
|+Syscon EEPROM (SPI)
! BGA !! Name !! Description
! BGA !! Name !! Description
|-
|-
Line 564: Line 452:
|}
|}


{| class="wikitable" style="float:left; margin:5px;"
== Syscon JTAG ==
|+Syscon BE SPI Bus
! BGA !! Name !! Description
|-
| M2 || BE_SPI_CS || Chip Select
|-
| N2 || BE_SPI_DO || Serial Data Output
|-
| M1 || BE_SPI_DI || Serial Data Input
|-
| N1 || BE_SPI_CLK || Serial Data Clock
|-
| colspan="3" {{cellcolors|lightblue}}
|-
| P2 || BE_RESET || CellBE Reset
|-
| P1 || BE_POWGOOD  || CellBE PowerGood
|-
| T2 || BE_INT || CellBE Interrupt
|-
|}
 
{| class="wikitable" style="float:left; margin:5px;"
|+Syscon RSX SPI Bus
! BGA !! Name !! Description
|-
| E2 || RSX_SPI_CS || Chip Select
|-
| F2 || RSX_SPI_DO || Serial Data Output
|-
| F1 || RSX_SPI_DI || Serial Data Input
|-
| G1 || RSX_SPI_CLK || Serial Data Clock
|-
| colspan="3" {{cellcolors|lightblue}}
|-
| G2 || RSX_RESET || RSX Reset
|-
| J2 || RSX_INT || RSX Interrupt
|-
|}


{| class="wikitable" style="float:left; margin:5px;"
It is disabled in factory after production on retail models.
|+Syscon SB SPI Bus
! BGA !! Name !! Description
|-
| B9 || SB_SPI_CS || Chip Select
|-
| B8 || SB_SPI_DO || Serial Data Output
|-
| A9 || SB_SPI_DI || Serial Data Input
|-
| A8 || SB_SPI_CLK || Serial Data Clock
|-
| colspan="3" {{cellcolors|lightblue}}
|-
| D11 || SB_RESET || SB Reset
|-
| D9 || SB_INT || SB Interrupt
|-
|}


{| class="wikitable" style="float:left; margin:5px;"
{| class="wikitable"
|+Syscon JTAG (disabled in factory after production on retail models)
! BGA !! Name !! Description
! BGA !! Name !! Description
|-
|-
Line 644: Line 473:
|}
|}


= Testpads and alternative solder points =
= Syscon underlying ports =
*The identification of the syscon UART testpads can be made by grouping the motherboard models in a similar way we was doing with the [[Teensy%2B%2B_2.0#Schematics_by_motherboard_.28retail.29| layouts]] of the hardware flashers, there are 7 retail testpads layouts:
**Layout 1 = COK-001, COK-002 (fat, mullion, NAND)
**Layout 2 = SEM-001 (fat, mullion, NAND)
**Layout 3 = DIA-001, DIA-002 (fat, mullion, NOR)
**Layout 4 = VER-001 (fat, sherwood, NOR)
**Layout 5 = DYN-001 (slim, sherwood, NOR)
**Layout 6 = SUR-001, JTP-001, JSD-001, KTE-001 (slim, sherwood, NOR)
**Layout 7 = MSX-001, MPX-001, NPX-001, PPX-001, PQX-001, RTX-001, REX-001 (superslim, sherwood, NOR/eMMC)


== DIA-001 and DIA-002 ==
== Syscon Cell SPI Bus ==
This points are availables to intercept signals by soldering wires, attaching probes, osciloscopes, etc... The photos are only orientatives to follow the traces, there's no need to remove the SYSCON to intercept this signals so can be done while its working


All this points has been hardware reverse engineered from a [[CECHHxx|CECHH02]]/[[DIA-00x#DIA-001|DIA-001]] motherboard
{| class="wikitable"
{{clear}}
! BGA !! Name !! Description
 
=== Topside Pinout ===
<div style="float:right">[[File:syscon_top.jpg|thumbnail|Syscon Top Pinouts<br />[[CECHHxx|CECHH02]]/[[DIA-00x#DIA-001|DIA-001]]]]</div>
 
{|class="wikitable"
! Pin #
! Name
! Description
|-
|-
!B3
| M2 || /BE_SPI_CS || Chip Select
|SW_10
|Unknown
|-
|-
!A6
| N2 || BE_SPI_DO || Serial Data Output
|MC_RESERVED2
|Unknown
|-
|-
!E10
| M1 || BE_SPI_DI || Serial Data Input
|MUL_CHKSTP_OUT
|Unknown
|-
|-
!C15
| N1 || BE_SPI_CLK || Serial Data Clock
|VSS
|Power Ground
|-
|-
!B16
| P2 || /BE_RESET || CellBE Reset
|OSCOUT
|Goes to unpopulated crystal
|-
|-
!C16
| P1 || BE_POWGOOD  || CellBE PowerGood
|OSCIN
|From unpupulated crystal
|-
|-
!B15
| T2 || /BE_INT || CellBE Interrupt
|POW_FAIL
|Power Failure Signal
|-
|-
!H1
|PN5
|Unknown
|-
!H2
|PN6
|Unknown
|-
!R1
|PM7
|Unknown
|-
!R2
|PM6
|Unknown
|-
!M4
|SW9
|Unknown
|-
!M10
|XDR_FET_SCK
|Unknown
|}
|}


=== Bottomside Pinout ===
== Syscon Southbridge SPI Bus ==
<div style="float:right">[[File:DIA-001 SysCon EPROM Interface.png|thumbnail|[[DIA-001]] [[CECHHxx]] [[SC EEPROM]] Interface]]<br />[[File:syscon_bottom.jpg|thumbnail|Syscon Bottom Pinouts<br />[[CECHHxx|CECHH02]]/[[DIA-00x#DIA-001|DIA-001]]]]<br />[[File:Syscon uart soldered on dia-002.jpg|thumbnail|Syscon UART soldered<br />[[CECHJxx]]/[[CECHKxx]] [[DIA-00x#DIA-002|DIA-002]]]]</div>


{|class="wikitable"
{| class="wikitable"
! Pin #
! BGA !! Name !! Description
! Name
! Description
|-
|-
!R5
| B9 || /SB_SPI_CS || Chip Select
|VDD
| +3.3v
|-
|-
!R7
| B8 || SB_SPI_DO || Serial Data Output
|DVDD
| +1.8v
|-
|-
!C15
| A9 || SB_SPI_DI || Serial Data Input
|VSS
|Power Ground
|-
|-
!N16
| A8 || SB_SPI_CLK || Serial Data Clock
|DIAG_MODE
|Unknown
|-
!N15
|BACKUP_MODE
|Unknown
|-
!P16
|UART0_TxD
|Serial
|-
!P15
|UART0_RxD
|Serial
|-
|-
!R9
|PQ1
|Unknown
|-
!B12
|POW_SW
|Power Switch
|-
!A12
|EJECT_SW
|Eject Switch
|-
!L7
|JNTAST
|JTAG
|-
!L8
|JRTCK
|JTAG
|-
!L9
|JTMS
|JTAG
|-
!K7
|JTDI
|JTAG
|-
!K8
|JTCK
|JTAG
|-
!K9
|JTDO
|JTAG
|-
!M6
|SW_7_B
|Unknown
|-
!M8
|FANPWM1
|Unknown
|-
!E5
|GX_VSRT
|Unknown
|-
!B5
|DVE_RST
|Unknown
|-
!G4
|HDMI_RST1
|Unknown
|-
!D4
|XDR_FET_RST
|Unknown
|}
|}
<!--// Remote Power ON/OFF (from network, HDMI CEC commands, etc...) is managed by devices connected to the southbridge (ethernet/wifi/BT, HDMI controller, etc...) //-->


{{Motherboard Components}}<noinclude>[[Category:Main]]</noinclude>
{{Motherboard Components}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)