Talk:Syscon Hardware: Difference between revisions
| Line 316: | Line 316: | ||
|printmode || 0x99D9 || 0xDC0C0000 || [mode (0/1/2/3)] || Set printmode | |printmode || 0x99D9 || 0xDC0C0000 || [mode (0/1/2/3)] || Set printmode | ||
|- | |- | ||
|printpatch | |printpatch || 0xD94F || 0xDD0C0000|| - || Prints patch | ||
|- | |- | ||
|r || 0x8CA5 || 0xDD0C0000 || [offset] [length] || Read byte from SC | |r || 0x8CA5 || 0xDD0C0000 || [offset] [length] || Read byte from SC | ||
|- | |- | ||
|r16 || 0x8ED5 || 0xDD0C0000 || [offset] [length] || Read word from SC | |r16 || 0x8ED5 || 0xDD0C0000 || [offset] [length] || Read word from SC | ||
|- | |- | ||
|r32 || 0x9191 || 0xDD0C0000 || [offset] [length] || Read dword from SC | |r32 || 0x9191 || 0xDD0C0000 || [offset] [length] || Read dword from SC | ||
|- | |- | ||
|r64 || 0x935D || 0xDD0C0000 || [offset] [length] || Read qword from SC | |r64 || 0x935D || 0xDD0C0000 || [offset] [length] || Read qword from SC | ||
Revision as of 09:30, 5 October 2019
Problem with syscon pinout numeration in wiki in the SWX-xxx series (128 pins package)
In all the SWX-xxx series pages the pinout is numered starting with the pin1 at bottom-left corner (when viewing the syscon in the same orientation than the printed texts) this way:
- """pin 1 left bottom at mark, counter clockwise from south (pins 1-38) to east (pins 39-64), north (pins 65-102), west (103-128))"""
In the first SW series is barelly visible (in the photos it looks is not marked) but in newer series is more visible, and is located at bottom-rigth corner, see this photos i marked: http://666kb.com/i/cnj3qic8k412x3p8r.jpg
- All photos are taken from wiki visibles in his respective pages... look for the original photo to see it in better resolution (when posible because there are not much photos of syscons in wiki or internet)
If this is correct, is needed to change the info about the pinout in all the affected pinout tables (in all SWX-xxx pages)
PowerON/off HDMI/CEC, WiFi, Bluetooth, GbLAN, buttons etc
There is no seperate communication processor on the PS3. Powering is handled by syscon.
- Power and eject buttons/switchs are connected with syscon (indirectly), there is no protocol involved, the syscon pins related with this buttons has 2 posible states: 3.3v (when button is not pressed)... or 0v (when button is pressed)
Multipage Correction
<TizzyT> eussnl my syscon is CXR714120-301GB its different form what the wiki says CECHH / DIA-001
Package
http://pastie.org/private/tkcfjwit37huzyzoie7z5g BGA
ball count: 4x16 + 8x14 + 2x12 = 64+112+24 = 200 pads
new QF package is 26 * 38 = 128 pins
Clocks
SysCon clocks:
T4 XTAL / T5 EXTAL goes to [X4001] of 16.9344 MHz C16 OSCIN / B16 OSCOUT goes to [X4002] of 32.768 kHz
http://oi52.tinypic.com/2s9ziw0.jpg
Backup Mode / Diag
BACKUP_MODE / DIAG_MODE pins on Gen 2 might be pins 110 and 111. They are pulled low. Not completely sure, but looking at those pins in relation to what's around them seems like it could be those two.
SEM-001 CECHG
Pink is N15 BACKUP_MODE Blue is N16 DIAG_MODE
picture: http://psx-scene.com/forums/attachments/f149/26456d1300550098-brick-recovery-research-untitled-1.jpg source: http://psx-scene.com/forums/780185-post344.html !unverified!
According to schematics, DIAG and BACKUP_MODE are are shown in the following picture for COK-001 and COK-002 Motherboards - http://goput.it/69k.jpg These pins are tied to 3.3v so grounding them should enable each mode respectively. !unverified!
SoftID
Note: moved from seperate page, as there are already over 8 different syscon pages and the very same info is mention in depth on the SC firmware and SC hardware page (and in 150 wiki edits on the sysinfo page :/) we dont have a sperate page for every SELF flag either ;) (although there are >4 pages describing SELF :/)
a SoftID is just a 0x4 code that tells you the hardware revision of the syscon.
This info can be get through the More System Information method.
You can find them also inside the SYS_CON_FIRMWARE_*********.pkg (Syscon_Firmware) at the offset 0x28E (In this link you can found the list of the Syscon update packages)
every SoftID is associated with the ps3 mainboard. this means that you can know if a SC is compatible with your board without opening a PS3 ( Syscon Hardware)
| SoftID | SC Generation | notes | |
|---|---|---|---|
| Phats | |||
| 0B8E | 1 | - | |
| 0C16 | 2 | - | |
| 0D52 | 3 | - | |
| 0DBF | 4 | - | |
| 0E69 | 5 | - | |
| 0F29 | 6 | - | |
| 0F38 | 7 | - | |
| 065D | 8 | - | |
| Slims | |||
| 0832 | 9 | - | |
| 08C2 | 10 | - | |
| 0918 | 11 | - | |
Datasheet of SoC similar to syscon
COK-002 with 0DBF syscon
Information: https://lh5.googleusercontent.com/-UiaHRjhdt50/UesKSGuxdFI/AAAAAAAAGOU/0FV8Fazyl60/s800/TV2013072019053700.jpg
Board type: https://lh6.googleusercontent.com/-K1sc66WzJxo/Ue1Mdr5mHeI/AAAAAAAAGO8/rnqlidQAVfY/s800/DSC01591.JPG
Syscon: https://lh6.googleusercontent.com/-OTxjx3qJV0M/Ue1L2itOfRI/AAAAAAAAGO0/Bv6zli_xQQg/s800/DSC01590.JPG
Talk
-This breaks lot of standards/pages/tables in wiki, can you add some notes please ?. E.g: the board came from official repair service, bought in a normal shop, or is a frankenstein made at home ?, it boots correctly and allows firmware updates ?. If it works normally i think this proves CXR713120-20xGB and CXR714120-30xGB shares the same pinout, but the fact that is using 0DBF SoftID is a bit shocking (maybe because is the minimal SoftID allowed by CXR714120-30xGB ?... check SoftID examples in this table) --Sandungas 22:07, 24 July 2013 (MSK)
-The console is a CECHE01 MG (Metal Gear Solid 4 edition) and came with a 3rd generation BD drive (the first type with 2 lens). It had never been to SONY for service. It works normally, correctly and as you could see, has a minimum version which is compatible with the motherboard type. --l_oliveira
SHA1 hashes stored at eeprom
from http://www.edepot.com/playstation3.html
"Files finally stored into the FLASH regions have their associated SHA-1 hash value stored in the SYSCON EEPROM for authentication and verification purposes. "
What happens if we change those hashes to something a 3.55 ofw would have? (assuming we were doing this experiment on a hackable console?)
PS2 Mechacon vs PSP Syscon vs PS3 Syscon vs Vita Syscon vs PS4 Syscon
| Production Start Date (<=) | PS2 Mechacon | PSP Syscon | PS3 Syscon | Vita Syscon | PS4 Syscon | Used IC/CPU Core |
|---|---|---|---|---|---|---|
| 10/1999 | CXP101064 | - | - | - | - | Sony SPC970 (100 pin) |
| 01/2000 | CXP102064 | - | - | - | - | |
| 09/2000 | CXP103049 | - | - | - | - | Sony SPC??? (136 pin) |
| 08/2004 | - | BARxx | - | - | - | NEC D790019 / D780032AY (78K0/78003xA, 64 pin) |
| 07/2005 | - | B30x | - | - | - | NEC D79F0036 / D78F????? (78K0/KE2, 64 pin) |
| 07/2007 | - | B40x | - | - | - | NEC D79F???? / D78F????? (78K0/???, 84 pin) |
| 07/2008 | - | 3Axx | - | - | - | NEC D79F???? / D78F????? (78K0/???, ?? pin) |
| 03/2009 | - | 3Bxx | - | - | - | NEC D79F???? / D78F????? (78K0/???, ?? pin) |
| 05/2009 | - | 40xx | - | - | - | NEC D79F???? / D78F????? (78K0/???, ?? pin) |
| 03/2003 | CXR706080 | - | - | - | - | Sony SR11 PS2 (Dragon): 164 pin PS3 (Donkey): 200 pin |
| 09/2004 | CXR716080 | - | CXR713120 | - | - | |
| 07/2007 | CXR726080 | - | CXR714120 | - | - | |
| 03/2008 | - | - | SW | - | - | NEC D79F0073 / D78F11AA (78K0R/KH3, 128 pin) |
| 05/2009 | - | - | SW2 | - | - | NEC D79F0086 / D78F11BB (78K0R/KH3, 128 pin) |
| 07/2010 | - | - | - | "SC" | - | NEC D79F0109 / D78F???? (78K0R/???, 121 pin) |
| 06/2011 | - | - | SW3 | - | - | NEC D79F0123 / D78F11CC (78K0R/KG3, 100 pin) |
| 07/2013 | - | - | - | - | C0L | Renesas R5F100PL (RL78/G13, 100 pin) |
| 08/2013 | - | - | - | A0xxx | - | Renesas ?R5F120PL? (RL78/???, ?100? pin) |
| 04/2015 | - | - | - | - | C0L2 | Renesas R5F101LL (RL78/G13, 64 pin) |
- The SPC900 core was designed by Texas Instruments [[1]]
- CXP101064, CXP102064 are similar to CXP97 (CXP971000, CXP972032, CXP973064, CXP973F064)
- In-Circuit-Emulator: Mitek NICE-SPC970 [[2]]; Debug software: SVD970; Flash programmer: SFP-2
- A F inside the model name specifies if the IC contains flash memory.
- Mass-produced units don't have/use program flash memory, instead a encrypted firmware patch is stored on the data-"EEPROM"
- CXR7 series uses Sony SR11 CPU (ARM7TDMI)
- Models with public datasheet: CXR702080, CXR702F080, CXR704060
- Maybe based on the Texas Instruments TMS470R1 series (derived from TMS470R1B512 ?)
- Prototype PS3 Syscon's:
- CXR713F120A Syscon used on (early) pre-release prototypes, e.g. CEB-2030, DECR-1000, DEH-H1001-D, DEH-H1000A-E
- DEH-FH1500J-A with VERTIGO-02 board and SW series prototype D79F0073
- CBEH-H2001 with SURTEES-03 board and SW2 series prototype D79F0086
- DEH-ML00AK-G with MPX-001 (Prototype) board and SW3 series prototype D79F0123
Packets, Lovely Packets
| Command | Address | Perms | SubCommands | Description | |
|---|---|---|---|---|---|
| becount | 0xCA7D | 0xDD0C0000 | - | Display bringup/shutdown count + Power-on time | |
| bepgoff | 0xA4E7 | 0xD00C0000 | - | BE power grid off | |
| bepkt | 0x2435D | 0xDC0C0000 | show/set/unset/mode/debug/help | Packet permissions | |
| bestat | 0xD413 | 0xFD0F0000 | - | Get status of BE | |
| boardconfig | 0x99C7 | 0xDC0C0000 | - | Displays board configuration (NOT WORKING?) | |
| bootbeep | 0x1EA67 | 0xF0000000 | stat/on/off | Boot beep | |
| bringup | 0xD597 | 0xFD0F0000 | - | Turn PS3 on | |
| bsn | 0xD805 | 0xF00F0000 | - | Get board serial number | |
| bstatus | 0x24269 | 0xDD0C0000 | - | HDMI related status | |
| buzz | 0xA4FF | 0xDC0C0000 | [freq] | Activate buzzer | |
| buzzpattern | 0xA8B7 | 0xDC0C0000 | [freq] [pattern] [count] | Buzzer pattern | |
| clear_err | 0x2595B | 0xDD0C0000 | last/eeprom/all | Clear errors | |
| clearerrlog | 0xB8CB | 0xDD0C0000 | - | Clears error log | |
| comm | 0x9919 | 0xDC0C0000 | - | Communication mode | |
| commt | 0x24907 | 0xDC0C0000 | help/start/stop/send | Manual BE communication | |
| cp | 0x1E077 | 0xF0000000 | ready/busy/reset/beepremote/beep2kn1n3/beep2kn2n3 | CP control commands | |
| csum | 0xD687 | 0xFF0F0000 | - | Firmware checksum | |
| devpm | 0xD053 | 0xDD0C0000 | ata/pci/pciex/rsx | Device power management | |
| diag | 0x9AAD | 0xD00C0000 | ... | Diag (execute without param to show help) (NOT WORKING?) | |
| disp_err | 0x25911 | 0xDD0C0000 | - | Displays errors | |
| duty | 0x9B23 | 0xDD0C0000 | get/set/getmin/setmin/getmax/setmax/getinmin/setinmin/getinmax/setinmax | Fan policy | |
| dve | 0x2995D | 0xDC0C0000 | help/set/save/show | DVE chip parameters | |
| eepcsum | 0xAA65 | 0xDD0C0000 | - | Does nothing | |
| eepromcheck | 0x9A1D | 0x000C0000 | [id] | Check eeprom | |
| eeprominit | 0x9A65 | 0x000C0000 | [id] | Init eeprom | |
| ejectsw | 0xD611 | 0xFD0F0000 | - | Eject switch | |
| errlog | 0xB7ED | 0xFF0C0000 | - | Gets the error log | |
| fancon | 0xD26D | 0x0D000000 | - | Does nothing | |
| fanconautotype | 0xC075 | 0xDD0C0000 | - | Does nothing | |
| fanconmode | 0xBF35 | 0xDD0C0000 | get | Fan control mode | |
| fanconpolicy | 0xBBC9 | 0xDD0C0000 | get/set/getini/setini | Fan control policy | |
| fandiag | 0x1E91B | 0xF0000000 | - | Fan test | |
| faninictrl | 0xD3D9 | 0x0D000000 | - | Does nothing | |
| fanpol | 0xCA31 | 0xDD0C0000 | - | Does nothing | |
| fanservo | 0xBF29 | 0xDD0C0000 | - | Does nothing | |
| fantbl | 0xC087 | 0xDD0C0000 | get/set/getini/setini/gettable/settable | Fan table | |
| firmud | 0xD61D | 0xFDFF0000 | - | Firmware update | |
| geterrlog | 0xB84F | 0xDD0C0000 | [id] | Gets error log | |
| getrtc | 0xA6F3 | 0xDD0C0000 | - | Gets rtc | |
| halt | 0x1E107 | 0xF0000000 | - | Halts syscon | |
| hdmi | 0x29F39 | 0xDD0C0000 | ... | HDMI (various commands, use help) | |
| hdmiid | 0x29D1D | 0xDC0F0000 | - | Get HDMI id's | |
| hdmiid2 | 0x29D81 | 0xDC0F0000 | - | Get HDMI id's | |
| hversion | 0x2422F | 0xDD0C0000 | - | Platform ID | |
| hyst | 0xAEF5 | 0xDD0C0000 | get/set/getini/setini | Temperature zones | |
| lasterrlog | 0xB7FF | 0xDD0C0000 | - | Last error from log | |
| ledmode | 0xA80B | 0xDC0C0000 | [id] [id] | Get led mode | |
| LS | 0x2421B | 0xDD0C0000 | - | LabStation Mode | |
| ltstest | 0xCB97 | 0xDD0C0000 | get/set be/rsx | ?Temp related? values | |
| osbo | 0x1EA3F | 0xF0000000 | - | Sets 0x2000F60 | |
| patchcsum | 0xD9F7 | 0xDD0C0000 | - | Patch checksum | |
| patchvereep | 0xD9B1 | 0xDD0C0000 | - | Patch version eeprom | |
| patchverram | 0xD965 | 0xDD0C0000 | - | Patch version ram | |
| poll | 0x240E3 | 0xDD0C0000 | - | Poll log | |
| portscan | 0xDA0D | 0xDD0C0000 | [port] | Scan port (NOT WORKING?) | |
| powbtnmode | 0xB911 | 0xDC0C0000 | [mode (0/1)] | Power button mode | |
| powerstate | 0xCE6F | 0xDD0C0000 | - | Get power state | |
| powersw | 0xD5F9 | 0xFD0F0000 | - | Power switch | |
| powupcause | 0xB621 | 0xDD0C0000 | - | Power up cause | |
| printmode | 0x99D9 | 0xDC0C0000 | [mode (0/1/2/3)] | Set printmode | |
| printpatch | 0xD94F | 0xDD0C0000 | - | Prints patch | |
| r | 0x8CA5 | 0xDD0C0000 | [offset] [length] | Read byte from SC | |
| r16 | 0x8ED5 | 0xDD0C0000 | [offset] [length] | Read word from SC | |
| r32 | 0x9191 | 0xDD0C0000 | [offset] [length] | Read dword from SC | |
| r64 | 0x935D | 0xDD0C0000 | [offset] [length] | Read qword from SC | |
| r64d | 0x948F | 0xDD0C0000 | [offset] [length] | Read ?qword data? from SC | |
| rbe | 0x96F9 | 0xDD0C0000 | [offset] | Read from BE | |
| recv | 0x24135 | 0xDD0C0000 | - | Receive something | |
| resetsw | 0xD605 | 0xFC0F0000 | - | Reset switch | |
| restartlogerrtoeep 0xB903 | 0xDD0C0000 | - | Reenable error logging to eeprom | ||
| revision | 0xD7E1 | 0xFFFF0000 | - | Get softid | |
| rrsxc | 0xD313 | 0xDD0C0000 | [offset] [length] | Read from RSX | |
| rtcreset | 0xA7BB | 0x000C0000 | - | Reset RTC | |
| scagv2 | 0xE24F | 0xFF000000 | - | Auth related? | |
| scasv2 | 0xE207 | 0xDD000000 | - | Auth related? | |
| scclose | 0xE1EF | 0xFF000000 | - | Auth related? | |
| scopen | 0xE121 | 0xFF000000 | - | Auth related? | |
| send | 0x2416F | 0xDD0C0000 | [variable] | Send something | |
| shutdown | 0xD5C5 | 0xFD0F0000 | - | PS3 shutdown | |
| startlogerrtsk | 0xB8E7 | 0xDD0C0000 | - | Start error log task | |
| stoplogerrtoeep | 0xB8F5 | 0xDD0C0000 | - | Stop error logging to eeprom | |
| stoplogerrtsk | 0xB8D9 | 0xDD0C0000 | - | Stop error log task | |
| syspowdown | 0xB6E9 | 0xDD0C0000 | 3 params | System power down | |
| task | 0x15005 | 0xDD0C0000 | - | Print tasks | |
| thalttest | 0xD813 | 0x000F0000 | - | Does nothing | |
| thermfatalmode | 0xCA3B | 0xDD0C0000 | canboot/cannotboot | Set thermal boot mode | |
| therrclr | 0xD3E5 | 0xDD0C0000 | - | Thermal register clear | |
| thrm | 0xBF1D | 0xDD0C0000 | - | Does nothing | |
| tmp | 0xAA69 | 0xDD0C0000 | [zone] | Get temperature | |
| trace | 0xB951 | 0xDD0C0000 | ... | Trace tasks (use help) | |
| trp | 0xAB2F | 0xDD0C0000 | get/set/getini/setini | Temperature zones | |
| tsensor | 0xA279 | 0xDD0C0000 | [sensor] | Get raw temperature | |
| tshutdown | 0xB2A1 | 0xDD0C0000 | get/set/getini/setini | Thermal shutdown | |
| tshutdowntime | 0xC95D | 0xDD0C0000 | [time] | Thermal shutdown time | |
| tzone | 0xB5E1 | 0xDD0C0000 | - | Show thermal zones | |
| version | 0xD65F | 0xFFFF0000 | - | SC firmware version | |
| w | 0x8BF9 | 0xDD0C0000 | [offset] [value] | Write byte to SC | |
| w16 | 0x8E2D | 0xDD0C0000 | [offset] [value] | Write word to SC | |
| w32 | 0x8FED | 0xDD0C0000 | [offset] [value] | Write dword to SC | |
| w64 | 0x92A9 | 0xDD0C0000 | [offset] [value] | Write qword to SC | |
| wbe | 0x9665 | 0xDD0C0000 | [offset] [value] | Write to BE | |
| wmmto | 0xCB3B | 0xDC0C0000 | get | Get watch dog timeout | |
| wrsxc | 0xD279 | 0xDD0C0000 | [offset] [value] | Write to RSX | |
| xdrdiag | 0x1E711 | 0xF0000000 | start/info/result | XDR diag | |
| xiodiag | 0x1E875 | 0xF0000000 | - | XIO diag | |
| xrcv | 0x25313 | 0xDC0C0000 | - | Xmodem receive |