Talk:Syscon Firmware: Difference between revisions
Jump to navigation
Jump to search
m (→dump syscon) |
|||
| (23 intermediate revisions by 4 users not shown) | |||
| Line 72: | Line 72: | ||
This should be a good starting point but leaves enough to explore yourself though: http://pastebin.com/NxVkGCdp (for version 1.02) | This should be a good starting point but leaves enough to explore yourself though: http://pastebin.com/NxVkGCdp (for version 1.02) | ||
See [[Graf's PSGroove Payload]] and [ | See [[Graf's PSGroove Payload]] and [[Hypervisor_Reverse_Engineering]] #SC_Manager, #System_Controller | ||
---- | ---- | ||
== Updater log lines related to syscon == | == Updater log lines related to syscon == | ||
| Line 157: | Line 141: | ||
== sc auth keys old == | == sc auth keys old == | ||
'''sc auth keys old:''' | |||
See: [[Keys#sc_iso]] | |||
'''sc auth key seeds:''' | '''sc auth key seeds:''' | ||
auth_1_0x00: 63DCA7D3FEE47F749A408363F1104E8F | auth_1_0x00: 63DCA7D3FEE47F749A408363F1104E8F | ||
| Line 174: | Line 152: | ||
auth_2_0x06: 3E67C2D9432E15D09BEF0E6C6492455D | auth_2_0x06: 3E67C2D9432E15D09BEF0E6C6492455D | ||
''the new auth keys are generated involving 256bit aes encryption (iv is all zeroes)'' | ''the new auth keys are generated involving 256bit aes encryption (iv is all zeroes)'' | ||
== dump sysrom == | == dump sysrom == | ||
| Line 189: | Line 165: | ||
== Updating Syscon on Tool/DECR == | == Updating Syscon on Tool/DECR == | ||
'''Q: How is syscon updated on Reference Tool / DECR models?''' <br /> | '''Q: How is syscon updated on Reference Tool / DECR models?''' <br /> | ||
| Line 196: | Line 170: | ||
it is suggested it uses full syscon updates, but how are files like "v1.0.5c1_TMU510_u.bin" send to syscon for updating? With/via Communication Processor? | it is suggested it uses full syscon updates, but how are files like "v1.0.5c1_TMU510_u.bin" send to syscon for updating? With/via Communication Processor? | ||
'''A: In DECR-1000A Syscon is located on the motherboard. The Communication Processor talks to it through UART and updates it with the firmud command.''' | '''A: In DECR-1000A Syscon is located on the motherboard. The Communication Processor talks to it through UART and updates it with the firmud command.''' | ||
List of main IC's on the | * List of main IC's on the motherboard: | ||
* SCEI CXR713F120A ([[Syscon Hardware]]) | ** SCEI [[CXR713F120A]] ([[Syscon Hardware|Syscon]]) | ||
* 1x Samsung K9F2G08U0M ([ | ** SCEI [[CXD4302GB]] ([[Starship2]]) | ||
* SCEI | * List of main IC's on the CP board: | ||
** 1x Samsung [[K9F2G08U0M]] ([[Flash_(Hardware)|Flash]]) | |||
** SCEI [[CXD9790GG]] (?) "helps handle communication between the Communication Processor, and the system controller, and southbridge. Using this path, the CP can talk to the System Controller, and bring the system up, down, and change its boot settings." | |||
** Etc...<br> | |||
[http://www.ps3news.com/ps3-hacks-jailbreak/ps3-tool-decr-1000a-system-controller-flash-chips-detailed/ archaic source1] [http://www.ps3news.com/ps3-hacks-jailbreak/ps3-tool-decr-1000a-internals-the-communication-processor/ archaic source2] | [http://www.ps3news.com/ps3-hacks-jailbreak/ps3-tool-decr-1000a-system-controller-flash-chips-detailed/ archaic source1] [http://www.ps3news.com/ps3-hacks-jailbreak/ps3-tool-decr-1000a-internals-the-communication-processor/ archaic source2] | ||
== The SysCon Bootloader == | |||
* This is what the BL does at startup (DECR). One of these flags could enable JTAG | |||
<pre> | |||
--- BL | |||
*0x3100004 = 0x03 | |||
Check 0x3101080 & 1 | |||
*0x3803000 = 0x1020000 or 0x1001000 | |||
*0x3803004 = 0x00 | |||
*0x3803008 = 0x18000 or 0x8000 | |||
*0x3803044 = 0x00 | |||
*0x380300C = 0x2CC001 | |||
*0x3803040 = 0x01 | |||
*0x3800004 = 0x02 | |||
*0x310FFFC = 0xFFFF | |||
--- FW | |||
*0x3100004 = 0x03 | |||
*0x3100008 = 0x0A | |||
*0x3100008 = 0x03 | |||
*0x3100020 = 0x86 | |||
*0x3100028 = 0x10 | |||
WAIT 152 cycles | |||
*0x3100010 = 0x01 | |||
*0x3100008 = 0x0A | |||
*0x3100008 = 0x06 | |||
*0x3100004 = 0x00 | |||
*0x3808070 = 0x00 | |||
*0x3808064 = 0x0F | |||
*0x3005404 = 0x0C67 | |||
*0x3005400 = 0x0C | |||
</pre> | |||
== Syscon patches template == | |||
This template started as something experimental, eventually could be refurbished to use it in the frontpage | |||
{{Syscon Patches}} | |||
== NonRetail syscon == | |||
Remember, Debug/DEX consoles are normal retail consoles with different TargetID, so only those that have a nonretail board have deviating patches (like the CXR713F120A found on the [[DECR-1000A]] TOOL/DECR). | |||
Tool/DECR don't have patches, they flash entire firmwares.<br /> | |||
Factory cp comes with 0.8.8 (corresponds to syscon fw size 0x60000)<br> | |||
it is VERY likely that it is not possible to go below this point, so any smaller size would likely cause a brick (see [[Talk:Communication_Processor]] for more info on how to downgrade)<br> | |||
DECR samples: [https://mega.co.nz/#!g50S1LRD!g8n1C191ax61YibnLEHJCQ63fT_ye1hA4Dhhrfulfs0] [https://mega.co.nz/#!jgVVCYZC!HaUXkeKFJNbzxAVkbO-Aj5LC2-yriY7rmUWKljlEQ40 mirror]: | |||
v0.6.1c8_TMU510_u.bin | CRC16:FAE0 | CRC32:590D9A21 | SHA1:DC8AEA0DDC6C5B813FE9861C972AAE111DA6FCAB | MD5:50794942BD9FAB7CC04A81BD8D220BA1 | 7379733103B15C07EC051E9B44D90BDF 07AD575D86B3937CFA8B3D331BE958DDB40EDFBE | |||
v0.6.10c4_TMU510_u.bin | CRC16:B58A | CRC32:DB8A00BF | SHA1:5D52289960151E2543EBEAA805963B7B88C35DD8 | MD5:14C288A576690C587E95C8542EDC2A70 | 7379733160AF70F9CF5DF54F30D5C77C 5F360CD146EEC3A7B5026151C396C4A5F7F1EC91 | |||
v0.6.11c4_TMU510_u.bin | CRC16:8A51 | CRC32:289B15F3 | SHA1:D45214E907A104BCC6BC91D78B7B471263AB0699 | MD5:B7CFA6536329F0DFF1AAD7905627F15F | 73797331F283602B666562012850612E 3FABA6E4FE1D70724164A23886199F36A02EDB0D | |||
v0.6.12c5_TMU510_u.bin | CRC16:31B2 | CRC32:1A1F141B | SHA1:403BF55314C4E785ED90D03A8F2E90B67CC235EA | MD5:1B19B55924445E4BBB2D970410AD6366 | 737973316E5C037615E4727464B2D929 2D2EB7DADEF6B24C4E959235E5B11917D352F9D5 | |||
v0.6.14c4_TMU510_u.bin | CRC16:FB1B | CRC32:079EF389 | SHA1:6EF7067FAD939D0B0DFC0B9418A6F4C7509104E5 | MD5:11E9F6270A5D79D0B76614B1C6FE622B | 73797331DCEAC9FA0F1B2449F332C4A9 1CBFF6FE43BDCA3B0A5AAFCE9A98D7176D951A49 | |||
v0.8.4c8_TMU510_u.bin | CRC16:2949 | CRC32:81EFA508 | SHA1:5963B333361123782848E3639D9FA585A728691A | MD5:564D5479F5B98E244C1EA7B56BACC873 | 73797331E8A9ADD15036B33AB8E8AB17 FDCC981DA58B9F44E9331C9708C01D924D78DB3E | |||
v0.9.9c1_TMU510_u.bin | CRC16:172A | CRC32:EBB2D78A | SHA1:D5E693D2E22FD99CF3E330AC442CD9B07D01DB66 | MD5:216B258115F25B13C9969AF35BFCAC20 | 7379733116E6DD5F054442FACFA15A5C 5E62E8FC8059F864A91CAD142BC30BDAE77D9464 | |||
v0.9.14c1_TMU510_u.bin | CRC16:2A2C | CRC32:330CB685 | SHA1:30B19BB8B78E60D81848E8FDF6C4A79537CFBE66 | MD5:7AA5BFE64D15F8BD61EB80B999FE4343 | 73797331807BAF3D6E1B6A3CA5FDF30D 7CCE3B0E739A19C9C431D4D8C59CF1513DAF25E9 | |||
v1.0.1c1_TMU510_u.bin | CRC16:3FD1 | CRC32:A7C7E313 | SHA1:F0DCA7130074E023FFAF58EBD06A61EE73C94907 | MD5:C95C57DC20D9AC5473C1EC914744352F | 73797331F362AE579EA3D864E27334CC 3EAB05DEC5328E885EED3295954999BD518ABFDF | |||
v1.0.3c1_TMU510_u.bin | CRC16:636E | CRC32:32942DFD | SHA1:83BE56F92A93B911D2BBE12DD1F6AF9CCD1EC11B | MD5:642C0E6615AACBF180C367F7927D1E30 | 737973312D08051E9F5AA1AAF2647EC0 44EE5DF74D92DDB81B1099430B0B5A243FFDA44E | |||
v1.0.4c1_TMU510_u.bin | CRC16:528F | CRC32:A0FBA694 | SHA1:1A5E5F97D66A754C2C7436618DC911C1C57B9FEA | MD5:6641B03FC6193E35380D681152226275 | 73797331E40325B060CDE461D250058D 8AF478F0A1C1B4B9DECA01C8770F8A9010F0A513 | |||
v1.0.5c1_TMU510_u.bin | CRC16:59F8 | CRC32:87316EBF | SHA1:8ED74829973F740C1B825FD976F7926A95ACBE8B | MD5:717DC4187A6E446C30DACAC129090656 | 737973316856FC96CA6FA4D4652D4985 F9E998439D4C23DA9C1BA8F5C44611D826DA1CFE | |||
=== dev/hda === | |||
dev_hda.image from [[DECR-1000A]] CP: [http://mega/content/secure.html#!shd2VBwI!aElpZXIMqxdAP0hw775sNhmkwJewVXafQvdFUGQ5Lgo dev_hda.image] [https://mega.co.nz/#!y8kWmSqR!4PPNen3bukLWt-EZm_zENT9G8Ey-Fi0YcaLHNey41m0 dev_hda.image.7z] | |||
==== Partitions ==== | |||
{| class="wikitable sortable" | |||
|- | |||
! device file !! size !! type | |||
|- | |||
| /dev/loop0p1 || 51 MB (50577408 bytes) || 0x89 | |||
|- | |||
| /dev/loop0p2 || 8,7 MB (8650752 bytes) || Linux | |||
|- | |||
| /dev/loop0p3 || 32 MB (31981568 bytes) || Linux | |||
|- | |||
| /dev/loop0p4 || 35 MB (35127296 bytes) || Extended | |||
|- | |||
| /dev/loop0 || 4,9 MB (4883968 bytes) || Unassigned | |||
|- | |||
|} | |||
== Syscon UART commands available on Cytology and Cookie (internal Mullion) == | |||
{| class="wikitable sortable" | |||
! Command !! v0.4.5_b4 !! v0.6.1_c8 !! v0.6.10_c4 !! v0.6.11_c4 !! v0.6.12_c5<br>v0.6.12_c7 !! v0.6.14_c4 !! v0.8.4_c8 !! v0.9.9_c1<br>v0.9.14_c1<br>v1.0.1_c1 !! v0.9.13_k1<br>v1.0.0_k1<br>{{unk|v1.1.3_k1}} !! v1.0.3_c1<br>v1.0.4_c1<br>v1.0.4_c2<br>v1.0.5_c1 !! {{unk|v1.2.3_k1}}<br>v1.3.3_k1<br>v1.4.4_k2<br>{{unk|v1.5.0_k2}}<br>v1.5.1_k2 !! Protected? | |||
|- | |||
| w || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| r || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| w16 || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| r16 || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| w32 || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| r32 || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| w64 || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| r64 || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| r64d || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| wbe || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| rbe || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| boardconfig || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| comm || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| commt || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| printmode || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| eepromcheck || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| eeprominit || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| memtest || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} | |||
|- | |||
| targethw || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} | |||
|- | |||
| hdmi || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| xrcv || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| bepkt || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| task || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| duty || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| tsensor || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| bepgoff || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| getrtc || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| rtcreset || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| ledmode || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| buzzpattern || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| eepcsum || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| tmp || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| trp || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| hyst || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| tshutdown || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| tzone || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| errlog || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| lasterrlog || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| geterrlog || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| clearerrlog || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| stoplogerrtask || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| startlogerrtask || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| stoplogerrtoeep || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| restartlogerrtoeep || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| trace || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| disp_err || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| clear_err || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| print_patch || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} | |||
|- | |||
| printpatch || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| patchverram || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| patchcsum || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| patchvereep || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| portscan || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| powupcause || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| syspowdown || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| powbtnmode || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| dve || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| fanconpolicy || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| fanconmode || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| fanconautotype || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| fantbl || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| fanservo || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| thrm || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| thalttest || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| tshutdowntime || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| fanpol || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| thermfatalmode || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| becount || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| wmmto || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| ltstest || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| fancon || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| powerstate || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| devpm || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| wrsxc || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| rrsxc || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| faninictrl || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| therrlcr || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| poll || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| recv || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| send || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| LS || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| hversion || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| bstatus || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| buzz || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| diag || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} | |||
|- | |||
| xdrdiag || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} ||{{NO}} || {{YES}} || {{NO}} || {{NO}} | |||
|- | |||
| xiodiag || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{NO}} | |||
|- | |||
| fandiag || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{NO}} | |||
|- | |||
| osbo || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{NO}} | |||
|- | |||
| scopen || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| scclose || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| scasv2 || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| scagv2 || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| bestat || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| bringup || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| shutdown || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| powersw || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| resetsw || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| ejectsw || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| btnemus || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} | |||
|- | |||
| btnemua || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} | |||
|- | |||
| bsn || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| firmud || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| hdmiid || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| hdmiid2 || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} | |||
|- | |||
| version || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| revision || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| csum || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} | |||
|- | |||
| cp || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{NO}} | |||
|- | |||
| halt || {{NO}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{YES}} || {{NO}} || {{YES}} || {{NO}} || {{NO}} | |||
|- | |||
| bootbeep || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{NO}} || {{NO}} | |||
|- | |||
| nonfatalerror || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{NO}} || {{YES}} || {{YES}} | |||
|- | |||
|} | |||
= Sherwood patch name versioning and SoftID = | |||
For a backtrack of this talk see the section named "sherwood names format" at the end of [https://www.psdevwiki.com/ps3/index.php?title=System_Controller_Firmware&diff=58966&oldid=58927 this edit], the request for a confirmation [https://www.psdevwiki.com/ps3/index.php?title=System_Controller_Firmware&diff=58971&oldid=58968 here], and the answer [https://www.psdevwiki.com/ps3/index.php?title=System_Controller_Firmware&diff=58973&oldid=58971 here] | |||
The patch naming and versioning for mullion is straightforward, both the value displayed in the [[More System Information]] screen and the PKG filename itself contains the 4 integer values of the: "major version", "minor version", "major revision", and "minor revision" that appears in the header of the decrypted patch structure [[Syscon Firmware#Mullion Patch Content]]. Filename SYS_CON_FIRMWARE_0'''1'''0'''1'''0'''3'''0'''3'''.pkg is patch v1.1.3.3. But we cant apply the same rules for sherwood<br> | |||
The only official patch filename sample we have for sherwood is ''SYS_CON_FIRMWARE_S1_000'''1'''000'''2'''0'''83E'''0'''832'''.pkg''. There are many photos in the [[Talk:More System Information]] where can be seen that is displayed as ''0832.000'''1'''000'''2'''0'''83E'''0'''832'''@SC''<br> | |||
The first 2 integers seems to follow the rules for mullion ("major version" and "minor version") and indicates v1.2... but it seems the base firmware is 1.11... so im wondering if the patch "updates" the firmware to 1.2 (base firmware v1.11 overlayed with the patch becomes v1.2)<br> | |||
The last 2 values are the most weird, but also the most interesing, the '''0832''' is the SoftID of the real '''base''' firmware... and im wondering if after applying the patch it becomes '''083E'''. Note both values are very close to each other, the algorythm used by syscon to calculate checksums makes them similar if we change only a few bytes as can be seen when playing around with the "eepcsum" command<br> | |||
Long story short... im wondering if all the SoftID's are checksums of the base syscon firmware build (not counting the EEPROM areas used for per-console configurations as the "platform config" area or others). And for sherwoods is also a checksum of the resulting data after applying the patch (so in this case is a checksum based in the data in syscon RAM), the header of the decrypted patch structure for sherwoods changed [[Syscon Firmware#Sherwood Patch Content]] and includes 2 new values "data checksum" (the checksum of the syscon base firmware = SoftID '''before''' aplying the patch ?), and "patch checksum" (the checksum of the syscon base firmware overlayed with the patch data = SoftID '''after''' aplying the patch ?)<br> | |||
So the filename for sherwoods is "major version" (of the patched data), "minor version" (of the patched data), "patch checksum" (of base firmware + patch), "data checksum" (of base firmware) | |||
--[[User:Sandungas|Sandungas]] ([[User talk:Sandungas|talk]]) 19:32, 1 May 2021 (UTC) | |||
---- | |||
Syscon doesn't use the PatchID internally - I guess it's just saved in the patch header for identification purposes. The only thing it's checking is the SoftID.<br> | |||
The SoftID (I call it BuildID) is incremental ([[Syscon_Firmware#Syscon_firmwares|see here]]), like for example the [[Index.dat#build|build id]].<br> | |||
The checksums in the Sherwood patch are just for the data saved in the patch (for "integrity" = bad crypto reasons), the HDMI patch on the Mullion syscon does also have a checksum.<br>[[User:M4j0r|M4j0r]] ([[User talk:M4j0r|talk]]) 19:46, 1 May 2021 (UTC) | |||
---- | |||
= Device list = | |||
Mullion firmware versions: v1.0.0_k1, v1.1.3_k1, v1.2.3_k1, v1.3.3_k1 (the list is identical in all this syscon firmware versions) | |||
<pre> | |||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | |||
00000000 55 53 42 20 00 41 43 2F 44 43 20 00 32 6E 64 20 USB .AC/DC .2nd | |||
00000010 48 44 44 20 00 31 73 74 20 48 44 44 20 00 47 62 HDD .1st HDD .Gb | |||
00000020 45 20 00 47 44 44 52 33 20 56 52 20 00 42 45 20 E .GDDR3 VR .BE | |||
00000030 56 52 20 00 58 44 52 20 56 52 20 00 52 53 58 20 VR .XDR VR .RSX | |||
00000040 56 52 20 00 45 45 2B 47 53 20 00 6D 69 73 63 20 VR .EE+GS .misc | |||
00000050 00 49 4F 49 46 30 20 74 72 61 63 65 20 00 49 4F .IOIF0 trace .IO | |||
00000060 49 46 31 20 74 72 61 63 65 20 00 58 49 4F 20 74 IF1 trace .XIO t | |||
00000070 72 61 63 65 20 00 41 69 72 20 49 6E 74 61 6B 65 race .Air Intake | |||
00000080 20 00 69 6E 73 69 64 65 20 63 68 61 73 69 73 20 .inside chasis | |||
00000090 00 42 44 20 53 65 63 6F 6E 64 61 72 79 20 00 42 .BD Secondary .B | |||
000000A0 44 20 50 72 69 6D 61 72 79 20 00 31 73 74 20 42 D Primary .1st B | |||
000000B0 45 20 50 72 69 6D 61 72 79 20 00 58 44 52 20 50 E Primary .XDR P | |||
000000C0 72 69 6D 61 72 79 20 00 52 53 58 20 50 72 69 6D rimary .RSX Prim | |||
000000D0 61 72 79 20 00 ary . | |||
</pre> | |||
Sherwood firmware version: v0.17.0 (only)<br> | |||
The strings was reorganized, and was added "SB" | |||
<pre> | |||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | |||
00000000 31 73 74 20 42 45 20 50 72 69 6D 61 72 79 20 00 1st BE Primary . | |||
00000010 52 53 58 20 50 72 69 6D 61 72 79 20 00 58 44 52 RSX Primary .XDR | |||
00000020 20 50 72 69 6D 61 72 79 20 00 42 45 20 56 52 20 Primary .BE VR | |||
00000030 00 52 53 58 20 56 52 20 00 47 44 44 52 33 20 56 .RSX VR .GDDR3 V | |||
00000040 52 20 00 58 44 52 20 56 52 20 00 41 43 2F 44 43 R .XDR VR .AC/DC | |||
00000050 20 00 42 44 20 50 72 69 6D 61 72 79 20 00 42 44 .BD Primary .BD | |||
00000060 20 53 65 63 6F 6E 64 61 72 79 20 00 41 69 72 20 Secondary .Air | |||
00000070 49 6E 74 61 6B 65 20 00 69 6E 73 69 64 65 20 63 Intake .inside c | |||
00000080 68 61 73 69 73 20 00 58 49 4F 20 74 72 61 63 65 hasis .XIO trace | |||
00000090 20 00 49 4F 49 46 30 20 74 72 61 63 65 20 00 49 .IOIF0 trace .I | |||
000000A0 4F 49 46 31 20 74 72 61 63 65 20 00 47 62 45 20 OIF1 trace .GbE | |||
000000B0 00 55 53 42 20 00 6D 69 73 63 20 00 31 73 74 20 .USB .misc .1st | |||
000000C0 48 44 44 20 00 32 6E 64 20 48 44 44 20 00 53 42 HDD .2nd HDD .SB | |||
000000D0 20 00 45 45 2B 47 53 20 00 .EE+GS . | |||
</pre> | |||
Sherwood firmware version: v1.11.0 (or newer)<br> | |||
All the strings was removed, except 2 of them | |||
<pre> | |||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | |||
00000000 31 73 74 20 42 45 20 50 72 69 6D 61 72 79 00 52 1st BE Primary.R | |||
00000010 53 58 20 50 72 69 6D 61 72 79 00 SX Primary. | |||
</pre> | |||
Latest revision as of 09:02, 8 May 2022
LV1 - System Controller (SC) manager[edit source]
- sc_mgr_get_srh (0x9001)
- sc_mgr_set_srh (0x9002)
- sc_mgr_encrypt (0x9003)
- sc_mgr_decrypt (0x9004)
- Init For VTRM (0x9005)
- sc_mgr_get_region_data (0x9006)
- sc_mgr_set_region_data (0x9007)
- Set RTC (0x9008)
- Get Time (0x9009)
- Set Time (0x900A)
- sc_mgr_read_eprom (0x900B)
- sc_mgr_write_eprom (0x900C)
- Init For Updater (0x900D)
- sc_mgr_get_sc_status (0x900E)
- sc_iso_header (sc_iso_sc_binary_patch - 0x9011)
- SC RTC Factory (0x9012)
- Correct RTC Factory (0x9013)
- Set SC Status (0x9014)
- Backup Root Info (0x9015)
- Restore Root Info (0x9016)
- Read System Data From SC EEPROM - Indi Info Manager 0x17007)
SC - sc_iso.self[edit source]
- sc_iso_sc_binary_patch
- sc_iso_get_sc_status
- sc_iso_get_property
- sb_iso_get_rnd
- sb_iso_encdec_key
- sc_iso_module::calculate_drift_time
- sc_iso_module::generate_key
- sc_iso_module::generate_all_key
- sc_iso_module::authenticate
- sc_iso_module::change_to_old_key
- sc_iso_module::do_process
- sc_iso_module::get_system_info
- sc_iso_module::get_system_version
- sc_iso_module::do_set_rtc_status
- sc_iso_module::do_get_rtc_status
- sc_iso_module::do_set_rtc2
- sc_iso_module::set_rtc
- sc_iso_module::do_set_drift_time
- sc_iso_module::do_get_time
- sc_iso_module::set_time
- sc_iso_module::get_time
- sc_iso_module::read_data2
- sc_iso_module::write_data2
- sc_iso_module::write_binary_patch
- sc_iso_module::read_data
- sc_iso_module::write_data
- sc_iso_module::write_region_data
- sc_iso_module::set_region_data
- sc_iso_module::write_srh
- sc_iso_module::set_srh
- sc_iso_module::write_key
- sc_iso_module::write_mngblk
- sc_iso_module::initialize_updater_block
- sc_iso_module::read_region_data
- sc_iso_module::get_region_data
- sc_iso_module::get_srh
- sc_iso_module::read_key
- sc_iso_module::do_crypt
- sc_iso_module::decrypt
- sc_iso_module::encrypt
- sc_iso_module::read_mngblk
- sc_iso_module::set_sc_status
- sc_iso_module::get_sc_status
- sc_iso_module::init_for_updater
- sc_iso_module::init_for_vtrm
- sc_iso_module::start
This should be a good starting point but leaves enough to explore yourself though: http://pastebin.com/NxVkGCdp (for version 1.02)
See Graf's PSGroove Payload and Hypervisor_Reverse_Engineering #SC_Manager, #System_Controller
[edit source]
Updater log lines related to Syscon just after BD firmware, Multi-Card controller, BlueTooth firmware (in this case CEX 3.55) just before post processing and cleanup update status :
Update System controller firmware read SC patch package (4864 bytes) elapsed = 3 msec read SC patch package (4864 bytes) elapsed = 3 msec read SC patch package (4864 bytes) elapsed = 3 msec read SC patch package (4864 bytes) elapsed = 2 msec read SC patch package (4864 bytes) elapsed = 2 msec read SC patch package (4864 bytes) elapsed = 3 msec read SC patch package (4864 bytes) elapsed = 2 msec read SC patch package (4864 bytes) elapsed = 3 msec Update System controller firmware done(0x8002f000)
PS3 Retail == PS3 TEST != PS3 TOOL I try to get PS3 TOOL SC Firmwares.
It is suggested that the Syscon EEPROM is 512KB and the full (encrypted) firmware is <400KB (on Ref.Tool the Syscon is updated by overwiting the whole Syscon firmware : e.g. v1.0.5c1_TMU510_u.bin 384KB)
Syscon commands[edit source]
Syscon commands:
ver errlog auth1 auth2 fandiag xdrdiag xiodiag bestat sysdiag syslog
bringup (PowerOn State) shutdown (PowerOff State) powersw resetsw bootbeep stat bootbeep on BOOT BEEP ON: DONE bootbeep off BOOT BEEP OFF: DONE xdrdiag start errlog tmpforcp cp beepremote cp beep2kn1n3 cp beep2kn2n3 /usr/bin/sx halt HALT: OK version firmud Done. cp ready CP READY: OK cp busy CP BUSY: OK cp reset CP RESET: OK bestat xdrdiag info xdrdiag result xiodiag fandiag diagnose
The diag commands are usually for the backup bank, the main only supports firmud
CP root pass on Ref.Tool: cytology
sc auth keys old[edit source]
sc auth keys old: See: Keys#sc_iso
sc auth key seeds: auth_1_0x00: 63DCA7D3FEE47F749A408363F1104E8F auth_2_0x00: 4D10094324009CC8E6B69C70328E34C5 auth_1_0x01: D97949BAD8DA69D0E01BF31523732832 auth_2_0x01: C9D1DD3CE27E356697E26C12A7B316A8 auth_1_0x06: 4420ED722FEA35021955AB40C78EE6DF auth_2_0x06: 3E67C2D9432E15D09BEF0E6C6492455D the new auth keys are generated involving 256bit aes encryption (iv is all zeroes)
dump sysrom[edit source]
dump_sysrom.pkg of dump-flash+syscon.rar (280.51 KB) (http://git.gitbrew.org/ps3/?p=otheros-utils/dump_sysrom.git) seems to output wrong on MFW315:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000000 FF FF FF FF 80 01 00 03 FF FF FF FF 80 01 00 03 ÿÿÿÿ€...ÿÿÿÿ€... 00000010 FF FF FF FF 80 01 00 03 FF FF FF FF 80 01 00 03 ÿÿÿÿ€...ÿÿÿÿ€... ... ... ... 0003FFE0 FF FF FF FF 80 01 00 03 FF FF FF FF 80 01 00 03 ÿÿÿÿ€...ÿÿÿÿ€... 0003FFF0 FF FF FF FF 80 01 00 03 FF FF FF FF 80 01 00 03 ÿÿÿÿ€...ÿÿÿÿ€...
Updating Syscon on Tool/DECR[edit source]
Q: How is syscon updated on Reference Tool / DECR models?
There are no syscon PKG's in the DECR PUPs and CP .bin file contains one large binary encrypted gibberish.
it is suggested it uses full syscon updates, but how are files like "v1.0.5c1_TMU510_u.bin" send to syscon for updating? With/via Communication Processor?
A: In DECR-1000A Syscon is located on the motherboard. The Communication Processor talks to it through UART and updates it with the firmud command.
- List of main IC's on the motherboard:
- SCEI CXR713F120A (Syscon)
- SCEI CXD4302GB (Starship2)
- List of main IC's on the CP board:
- 1x Samsung K9F2G08U0M (Flash)
- SCEI CXD9790GG (?) "helps handle communication between the Communication Processor, and the system controller, and southbridge. Using this path, the CP can talk to the System Controller, and bring the system up, down, and change its boot settings."
- Etc...
archaic source1 archaic source2
The SysCon Bootloader[edit source]
- This is what the BL does at startup (DECR). One of these flags could enable JTAG
--- BL *0x3100004 = 0x03 Check 0x3101080 & 1 *0x3803000 = 0x1020000 or 0x1001000 *0x3803004 = 0x00 *0x3803008 = 0x18000 or 0x8000 *0x3803044 = 0x00 *0x380300C = 0x2CC001 *0x3803040 = 0x01 *0x3800004 = 0x02 *0x310FFFC = 0xFFFF --- FW *0x3100004 = 0x03 *0x3100008 = 0x0A *0x3100008 = 0x03 *0x3100020 = 0x86 *0x3100028 = 0x10 WAIT 152 cycles *0x3100010 = 0x01 *0x3100008 = 0x0A *0x3100008 = 0x06 *0x3100004 = 0x00 *0x3808070 = 0x00 *0x3808064 = 0x0F *0x3005404 = 0x0C67 *0x3005400 = 0x0C
Syscon patches template[edit source]
This template started as something experimental, eventually could be refurbished to use it in the frontpage
| PS3 Model | PS3 Type | Motherboard | Syscon Hardware | SoftID.SysconPatch@SC | Syscon Firmware Patches | Notes | ||
|---|---|---|---|---|---|---|---|---|
| File Name | Version | Installed from | ||||||
| DECR-1000 | 0x01 | TMU-520 | CXR713F120A | 0F3B.0000000000000000@SC | v1.0.5c1_TMU510_u.bin | v1.0.5 c 1 | CP ver 1.33 | Full firmware overwrite from Communication Processor |
| DEH-H1001-D | 0x01 | COOKIE-13 | CXR713F120A | 0B67.0000000000000000@SC | n/a | n/a | n/a | |
| DEH-H1000A | 0x01 | COK-001 (proto) | CXR713F120A | 0B67.0000000000000000@SC | n/a | n/a | n/a | |
| CECHAxx | 0x01 | COK-001 | CXR713120 series | 0B8E.0001000000000004@SC 0B8E.0001000000000005@SC 0B8E.0001000000000006@SC |
SYS_CON_FIRMWARE_01000004.pkg SYS_CON_FIRMWARE_01000005.pkg SYS_CON_FIRMWARE_01000006.pkg |
v1.0.0 release 4 v1.0.0 release 5 v1.0.0 release 6 |
1.30 Firmware 1.81 Firmware 3.40 Firmware |
|
| CECHBxx | 0x02 | |||||||
| CECHCxx | 0x03 | COK-002 | 0C16.0001000100030002@SC 0C16.0001000100030003@SC |
SYS_CON_FIRMWARE_01010302.pkg SYS_CON_FIRMWARE_01010303.pkg |
v1.1.3 release 2 v1.1.3 release 3 |
1.81 Firmware 3.40 Firmware | ||
| CECHExx | 0x04 | |||||||
| CECHGxx | 0x05 | SEM-001 | 0D52.0001000200030002@SC | SYS_CON_FIRMWARE_01020302.pkg | v1.2.3 release 2 | 3.40 Firmware | ||
| CECHHxx | 0x06 | DIA-001 | CXR714120 series | 0DBF.0001000300030002@SC | SYS_CON_FIRMWARE_01030302.pkg | v1.3.3 release 2 | 3.40 Firmware | |
| CECHJxx | 0x07 | DIA-002 | 0E69.0001000400040001@SC 0E69.0001000400040002@SC |
n/a SYS_CON_FIRMWARE_01040402.pkg |
v1.4.4 release 1 v1.4.4 release 2 |
Factory ? 3.40 Firmware |
||
| CECHKxx | ||||||||
| DECR-1400 | 0x09 | DEB-001 | CXR713120 series | 0E69.0001000400040001@SC | n/a | v1.4.4 release 1 | Factory ? | |
| CECHCxx | 0x03 | COK-002 with 65nm RSX | CXR714120 series | 0F29.0001000500000002@SC | SYS_CON_FIRMWARE_01050002.pkg | v1.5.0 release 2 | 3.40 Firmware | Refurbished, new 65nm RSX, new syscon |
| CECHAxx | 0x01 | COK-001 with 40nm RSX | CXR714120 series | 0F38.0001000500010001@SC | SYS_CON_FIRMWARE_01050101.pkg | v1.5.1 release 1 | 3.41 Firmware | Refurbished, new 40nm RSX, new syscon |
| CECHLxx | 0x08 | VER-001 | SW-30x series | 065D.0000000000000000@SC | n/a | n/a | Factory | No patches availables in System Firmware |
| CECHMxx | ||||||||
| CECHPxx | ||||||||
| CECHQxx | ||||||||
| CECH-20xx | 0x09 | DYN-001 | SW2-30x series | 0832.00010002083E0832@SC | SYS_CON_FIRMWARE_S1_00010002083E0832.pkg | ??? | 3.00 Firmware | |
| CECH-21xx | 0x0A | SUR-001 | 08A0.0000000000000000@SC | n/a | n/a | Factory | No patches availables in System Firmware | |
| CECH-25xx | 0x0B | JTP-001 or JSD-001 |
08C2.0000000000000000@SC | n/a | n/a | Factory | No patches availables in System Firmware | |
| CECH-30xx | 0x0C | KTE-001 | SW3-30x series | 0918.0000000000000000@SC | n/a | n/a | Factory | No patches availables in System Firmware |
| CECH-40xx | 0x0D | MSX-001 or MPX-001 or NPX-001 |
SW3-30x series | 098F.0000000000000000@SC | n/a | n/a | Factory | No patches availables in System Firmware |
| CECH-42xx | ? | ? | ? | ? | ? | ? | ? | No patches availables in System Firmware |
| CECH-43xx | ? | ? | ? | ? | ? | ? | ? | No patches availables in System Firmware |
| Rows marked in grey are "reference tool" models | ||||||||
| Rows marked in blue are "preproduction" models | ||||||||
| Rows marked in red are "refurbished" models | ||||||||
NonRetail syscon[edit source]
Remember, Debug/DEX consoles are normal retail consoles with different TargetID, so only those that have a nonretail board have deviating patches (like the CXR713F120A found on the DECR-1000A TOOL/DECR).
Tool/DECR don't have patches, they flash entire firmwares.
Factory cp comes with 0.8.8 (corresponds to syscon fw size 0x60000)
it is VERY likely that it is not possible to go below this point, so any smaller size would likely cause a brick (see Talk:Communication_Processor for more info on how to downgrade)
DECR samples: [1] mirror: v0.6.1c8_TMU510_u.bin | CRC16:FAE0 | CRC32:590D9A21 | SHA1:DC8AEA0DDC6C5B813FE9861C972AAE111DA6FCAB | MD5:50794942BD9FAB7CC04A81BD8D220BA1 | 7379733103B15C07EC051E9B44D90BDF 07AD575D86B3937CFA8B3D331BE958DDB40EDFBE v0.6.10c4_TMU510_u.bin | CRC16:B58A | CRC32:DB8A00BF | SHA1:5D52289960151E2543EBEAA805963B7B88C35DD8 | MD5:14C288A576690C587E95C8542EDC2A70 | 7379733160AF70F9CF5DF54F30D5C77C 5F360CD146EEC3A7B5026151C396C4A5F7F1EC91 v0.6.11c4_TMU510_u.bin | CRC16:8A51 | CRC32:289B15F3 | SHA1:D45214E907A104BCC6BC91D78B7B471263AB0699 | MD5:B7CFA6536329F0DFF1AAD7905627F15F | 73797331F283602B666562012850612E 3FABA6E4FE1D70724164A23886199F36A02EDB0D v0.6.12c5_TMU510_u.bin | CRC16:31B2 | CRC32:1A1F141B | SHA1:403BF55314C4E785ED90D03A8F2E90B67CC235EA | MD5:1B19B55924445E4BBB2D970410AD6366 | 737973316E5C037615E4727464B2D929 2D2EB7DADEF6B24C4E959235E5B11917D352F9D5 v0.6.14c4_TMU510_u.bin | CRC16:FB1B | CRC32:079EF389 | SHA1:6EF7067FAD939D0B0DFC0B9418A6F4C7509104E5 | MD5:11E9F6270A5D79D0B76614B1C6FE622B | 73797331DCEAC9FA0F1B2449F332C4A9 1CBFF6FE43BDCA3B0A5AAFCE9A98D7176D951A49 v0.8.4c8_TMU510_u.bin | CRC16:2949 | CRC32:81EFA508 | SHA1:5963B333361123782848E3639D9FA585A728691A | MD5:564D5479F5B98E244C1EA7B56BACC873 | 73797331E8A9ADD15036B33AB8E8AB17 FDCC981DA58B9F44E9331C9708C01D924D78DB3E v0.9.9c1_TMU510_u.bin | CRC16:172A | CRC32:EBB2D78A | SHA1:D5E693D2E22FD99CF3E330AC442CD9B07D01DB66 | MD5:216B258115F25B13C9969AF35BFCAC20 | 7379733116E6DD5F054442FACFA15A5C 5E62E8FC8059F864A91CAD142BC30BDAE77D9464 v0.9.14c1_TMU510_u.bin | CRC16:2A2C | CRC32:330CB685 | SHA1:30B19BB8B78E60D81848E8FDF6C4A79537CFBE66 | MD5:7AA5BFE64D15F8BD61EB80B999FE4343 | 73797331807BAF3D6E1B6A3CA5FDF30D 7CCE3B0E739A19C9C431D4D8C59CF1513DAF25E9 v1.0.1c1_TMU510_u.bin | CRC16:3FD1 | CRC32:A7C7E313 | SHA1:F0DCA7130074E023FFAF58EBD06A61EE73C94907 | MD5:C95C57DC20D9AC5473C1EC914744352F | 73797331F362AE579EA3D864E27334CC 3EAB05DEC5328E885EED3295954999BD518ABFDF v1.0.3c1_TMU510_u.bin | CRC16:636E | CRC32:32942DFD | SHA1:83BE56F92A93B911D2BBE12DD1F6AF9CCD1EC11B | MD5:642C0E6615AACBF180C367F7927D1E30 | 737973312D08051E9F5AA1AAF2647EC0 44EE5DF74D92DDB81B1099430B0B5A243FFDA44E v1.0.4c1_TMU510_u.bin | CRC16:528F | CRC32:A0FBA694 | SHA1:1A5E5F97D66A754C2C7436618DC911C1C57B9FEA | MD5:6641B03FC6193E35380D681152226275 | 73797331E40325B060CDE461D250058D 8AF478F0A1C1B4B9DECA01C8770F8A9010F0A513 v1.0.5c1_TMU510_u.bin | CRC16:59F8 | CRC32:87316EBF | SHA1:8ED74829973F740C1B825FD976F7926A95ACBE8B | MD5:717DC4187A6E446C30DACAC129090656 | 737973316856FC96CA6FA4D4652D4985 F9E998439D4C23DA9C1BA8F5C44611D826DA1CFE
dev/hda[edit source]
dev_hda.image from DECR-1000A CP: dev_hda.image dev_hda.image.7z
Partitions[edit source]
| device file | size | type |
|---|---|---|
| /dev/loop0p1 | 51 MB (50577408 bytes) | 0x89 |
| /dev/loop0p2 | 8,7 MB (8650752 bytes) | Linux |
| /dev/loop0p3 | 32 MB (31981568 bytes) | Linux |
| /dev/loop0p4 | 35 MB (35127296 bytes) | Extended |
| /dev/loop0 | 4,9 MB (4883968 bytes) | Unassigned |
Syscon UART commands available on Cytology and Cookie (internal Mullion)[edit source]
| Command | v0.4.5_b4 | v0.6.1_c8 | v0.6.10_c4 | v0.6.11_c4 | v0.6.12_c5 v0.6.12_c7 |
v0.6.14_c4 | v0.8.4_c8 | v0.9.9_c1 v0.9.14_c1 v1.0.1_c1 |
v0.9.13_k1 v1.0.0_k1 ?v1.1.3_k1? |
v1.0.3_c1 v1.0.4_c1 v1.0.4_c2 v1.0.5_c1 |
?v1.2.3_k1? v1.3.3_k1 v1.4.4_k2 ?v1.5.0_k2? v1.5.1_k2 |
Protected? |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| w | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| r | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| w16 | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| r16 | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| w32 | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| r32 | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| w64 | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| r64 | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| r64d | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| wbe | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| rbe | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| boardconfig | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| comm | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| commt | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| printmode | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| eepromcheck | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| eeprominit | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| memtest | NO | NO | NO | YES | YES | YES | YES | NO | NO | NO | NO | YES |
| targethw | NO | YES | YES | YES | YES | YES | YES | NO | NO | NO | NO | YES |
| hdmi | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| xrcv | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| bepkt | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| task | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| duty | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| tsensor | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| bepgoff | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| getrtc | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| rtcreset | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| ledmode | NO | NO | NO | NO | NO | NO | YES | YES | NO | YES | NO | YES |
| buzzpattern | NO | NO | NO | NO | NO | NO | YES | YES | NO | YES | NO | YES |
| eepcsum | NO | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES |
| tmp | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| trp | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| hyst | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| tshutdown | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| tzone | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| errlog | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | NO |
| lasterrlog | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES |
| geterrlog | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES |
| clearerrlog | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES |
| stoplogerrtask | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES |
| startlogerrtask | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES |
| stoplogerrtoeep | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES |
| restartlogerrtoeep | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES |
| trace | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| disp_err | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| clear_err | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| print_patch | NO | NO | NO | NO | NO | YES | YES | NO | NO | NO | NO | YES |
| printpatch | NO | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES |
| patchverram | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES | YES |
| patchcsum | NO | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES |
| patchvereep | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES | YES |
| portscan | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| powupcause | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| syspowdown | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| powbtnmode | NO | NO | NO | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| dve | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| fanconpolicy | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| fanconmode | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| fanconautotype | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| fantbl | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| fanservo | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| thrm | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| thalttest | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| tshutdowntime | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| fanpol | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| thermfatalmode | NO | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES |
| becount | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| wmmto | NO | NO | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| ltstest | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES |
| fancon | NO | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| powerstate | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES |
| devpm | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES |
| wrsxc | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES |
| rrsxc | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES |
| faninictrl | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES |
| therrlcr | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES |
| poll | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| recv | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| send | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| LS | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| hversion | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| bstatus | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| buzz | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| diag | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | YES |
| xdrdiag | NO | NO | NO | NO | NO | NO | NO | YES | NO | YES | NO | NO |
| xiodiag | NO | NO | NO | NO | NO | NO | NO | YES | NO | YES | NO | NO |
| fandiag | NO | NO | NO | NO | NO | NO | NO | YES | NO | YES | NO | NO |
| osbo | NO | NO | NO | NO | NO | NO | NO | YES | NO | YES | NO | NO |
| scopen | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | NO |
| scclose | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | NO |
| scasv2 | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | YES |
| scagv2 | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | NO |
| bestat | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | NO |
| bringup | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | NO |
| shutdown | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | NO |
| powersw | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | NO |
| resetsw | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | NO |
| ejectsw | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | NO |
| btnemus | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | YES | YES |
| btnemua | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | YES | YES |
| bsn | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | NO |
| firmud | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | NO |
| hdmiid | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| hdmiid2 | NO | NO | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES |
| version | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | NO |
| revision | NO | YES | YES | YES | YES | YES | YES | YES | YES | YES | YES | NO |
| csum | NO | NO | NO | NO | NO | NO | YES | YES | YES | YES | YES | NO |
| cp | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | NO |
| halt | NO | YES | YES | YES | YES | YES | YES | YES | NO | YES | NO | NO |
| bootbeep | NO | NO | NO | NO | NO | NO | NO | NO | NO | YES | NO | NO |
| nonfatalerror | NO | NO | NO | NO | NO | NO | NO | NO | NO | NO | YES | YES |
Sherwood patch name versioning and SoftID[edit source]
For a backtrack of this talk see the section named "sherwood names format" at the end of this edit, the request for a confirmation here, and the answer here
The patch naming and versioning for mullion is straightforward, both the value displayed in the More System Information screen and the PKG filename itself contains the 4 integer values of the: "major version", "minor version", "major revision", and "minor revision" that appears in the header of the decrypted patch structure Syscon Firmware#Mullion Patch Content. Filename SYS_CON_FIRMWARE_01010303.pkg is patch v1.1.3.3. But we cant apply the same rules for sherwood
The only official patch filename sample we have for sherwood is SYS_CON_FIRMWARE_S1_00010002083E0832.pkg. There are many photos in the Talk:More System Information where can be seen that is displayed as 0832.00010002083E0832@SC
The first 2 integers seems to follow the rules for mullion ("major version" and "minor version") and indicates v1.2... but it seems the base firmware is 1.11... so im wondering if the patch "updates" the firmware to 1.2 (base firmware v1.11 overlayed with the patch becomes v1.2)
The last 2 values are the most weird, but also the most interesing, the 0832 is the SoftID of the real base firmware... and im wondering if after applying the patch it becomes 083E. Note both values are very close to each other, the algorythm used by syscon to calculate checksums makes them similar if we change only a few bytes as can be seen when playing around with the "eepcsum" command
Long story short... im wondering if all the SoftID's are checksums of the base syscon firmware build (not counting the EEPROM areas used for per-console configurations as the "platform config" area or others). And for sherwoods is also a checksum of the resulting data after applying the patch (so in this case is a checksum based in the data in syscon RAM), the header of the decrypted patch structure for sherwoods changed Syscon Firmware#Sherwood Patch Content and includes 2 new values "data checksum" (the checksum of the syscon base firmware = SoftID before aplying the patch ?), and "patch checksum" (the checksum of the syscon base firmware overlayed with the patch data = SoftID after aplying the patch ?)
So the filename for sherwoods is "major version" (of the patched data), "minor version" (of the patched data), "patch checksum" (of base firmware + patch), "data checksum" (of base firmware)
--Sandungas (talk) 19:32, 1 May 2021 (UTC)
Syscon doesn't use the PatchID internally - I guess it's just saved in the patch header for identification purposes. The only thing it's checking is the SoftID.
The SoftID (I call it BuildID) is incremental (see here), like for example the build id.
The checksums in the Sherwood patch are just for the data saved in the patch (for "integrity" = bad crypto reasons), the HDMI patch on the Mullion syscon does also have a checksum.
M4j0r (talk) 19:46, 1 May 2021 (UTC)
Device list[edit source]
Mullion firmware versions: v1.0.0_k1, v1.1.3_k1, v1.2.3_k1, v1.3.3_k1 (the list is identical in all this syscon firmware versions)
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000000 55 53 42 20 00 41 43 2F 44 43 20 00 32 6E 64 20 USB .AC/DC .2nd 00000010 48 44 44 20 00 31 73 74 20 48 44 44 20 00 47 62 HDD .1st HDD .Gb 00000020 45 20 00 47 44 44 52 33 20 56 52 20 00 42 45 20 E .GDDR3 VR .BE 00000030 56 52 20 00 58 44 52 20 56 52 20 00 52 53 58 20 VR .XDR VR .RSX 00000040 56 52 20 00 45 45 2B 47 53 20 00 6D 69 73 63 20 VR .EE+GS .misc 00000050 00 49 4F 49 46 30 20 74 72 61 63 65 20 00 49 4F .IOIF0 trace .IO 00000060 49 46 31 20 74 72 61 63 65 20 00 58 49 4F 20 74 IF1 trace .XIO t 00000070 72 61 63 65 20 00 41 69 72 20 49 6E 74 61 6B 65 race .Air Intake 00000080 20 00 69 6E 73 69 64 65 20 63 68 61 73 69 73 20 .inside chasis 00000090 00 42 44 20 53 65 63 6F 6E 64 61 72 79 20 00 42 .BD Secondary .B 000000A0 44 20 50 72 69 6D 61 72 79 20 00 31 73 74 20 42 D Primary .1st B 000000B0 45 20 50 72 69 6D 61 72 79 20 00 58 44 52 20 50 E Primary .XDR P 000000C0 72 69 6D 61 72 79 20 00 52 53 58 20 50 72 69 6D rimary .RSX Prim 000000D0 61 72 79 20 00 ary .
Sherwood firmware version: v0.17.0 (only)
The strings was reorganized, and was added "SB"
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000000 31 73 74 20 42 45 20 50 72 69 6D 61 72 79 20 00 1st BE Primary . 00000010 52 53 58 20 50 72 69 6D 61 72 79 20 00 58 44 52 RSX Primary .XDR 00000020 20 50 72 69 6D 61 72 79 20 00 42 45 20 56 52 20 Primary .BE VR 00000030 00 52 53 58 20 56 52 20 00 47 44 44 52 33 20 56 .RSX VR .GDDR3 V 00000040 52 20 00 58 44 52 20 56 52 20 00 41 43 2F 44 43 R .XDR VR .AC/DC 00000050 20 00 42 44 20 50 72 69 6D 61 72 79 20 00 42 44 .BD Primary .BD 00000060 20 53 65 63 6F 6E 64 61 72 79 20 00 41 69 72 20 Secondary .Air 00000070 49 6E 74 61 6B 65 20 00 69 6E 73 69 64 65 20 63 Intake .inside c 00000080 68 61 73 69 73 20 00 58 49 4F 20 74 72 61 63 65 hasis .XIO trace 00000090 20 00 49 4F 49 46 30 20 74 72 61 63 65 20 00 49 .IOIF0 trace .I 000000A0 4F 49 46 31 20 74 72 61 63 65 20 00 47 62 45 20 OIF1 trace .GbE 000000B0 00 55 53 42 20 00 6D 69 73 63 20 00 31 73 74 20 .USB .misc .1st 000000C0 48 44 44 20 00 32 6E 64 20 48 44 44 20 00 53 42 HDD .2nd HDD .SB 000000D0 20 00 45 45 2B 47 53 20 00 .EE+GS .
Sherwood firmware version: v1.11.0 (or newer)
All the strings was removed, except 2 of them
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000000 31 73 74 20 42 45 20 50 72 69 6D 61 72 79 00 52 1st BE Primary.R 00000010 53 58 20 50 72 69 6D 61 72 79 00 SX Primary.