Talk:Syscon Hardware

Problem with syscon pinout numeration in wiki in the SWX-xxx series (128 pins package)

In all the SWX-xxx series pages the pinout is numered starting with the pin1 at bottom-left corner (when viewing the syscon in the same orientation than the printed texts) this way:

• """pin 1 left bottom at mark, counter clockwise from south (pins 1-38) to east (pins 39-64), north (pins 65-102), west (103-128))"""

In the first SW series is barelly visible (in the photos it looks is not marked) but in newer series is more visible, and is located at bottom-rigth corner, see this photos i marked: http://666kb.com/i/cnj3qic8k412x3p8r.jpg

• All photos are taken from wiki visibles in his respective pages... look for the original photo to see it in better resolution (when posible because there are not much photos of syscons in wiki or internet)

If this is correct, is needed to change the info about the pinout in all the affected pinout tables (in all SWX-xxx pages)

PowerON/off HDMI/CEC, WiFi, Bluetooth, GbLAN, buttons etc

There is no seperate communication processor on the PS3. Powering is handled by syscon.

• Power and eject buttons/switchs are connected with syscon (indirectly), there is no protocol involved, the syscon pins related with this buttons has 2 posible states: 3.3v (when button is not pressed)... or 0v (when button is pressed)

Multipage Correction

<TizzyT> eussnl my syscon is CXR714120-301GB its different form what the wiki says
CECHH / DIA-001

Package

http://pastie.org/private/tkcfjwit37huzyzoie7z5g BGA

ball count: 4x16 + 8x14 + 2x12 = 64+112+24 = 200 pads

new QF package is 26 * 38 = 128 pins

Clocks

SysCon clocks:

T4 XTAL / T5 EXTAL goes to [X4001] of 16.9344 MHz
C16 OSCIN / B16 OSCOUT goes to [X4002] of 32.768 kHz

http://oi52.tinypic.com/2s9ziw0.jpg

Backup Mode / Diag

BACKUP_MODE / DIAG_MODE pins on Gen 2 might be pins 110 and 111. They are pulled low. Not completely sure, but looking at those pins in relation to what's around them seems like it could be those two.

---

SEM-001 CECHG

Pink is N15 BACKUP_MODE
Blue is N16 DIAG_MODE

picture: http://psx-scene.com/forums/attachments/f149/26456d1300550098-brick-recovery-research-untitled-1.jpg source: http://psx-scene.com/forums/780185-post344.html !unverified!

According to schematics, DIAG and BACKUP_MODE are are shown in the following picture for COK-001 and COK-002 Motherboards - http://goput.it/69k.jpg These pins are tied to 3.3v so grounding them should enable each mode respectively. !unverified!

---

SoftID

Note: moved from seperate page, as there are already over 8 different syscon pages and the very same info is mention in depth on the SC firmware and SC hardware page (and in 150 wiki edits on the sysinfo page :/) we dont have a sperate page for every SELF flag either ;) (although there are >4 pages describing SELF :/)

a SoftID is just a 0x4 code that tells you the hardware revision of the syscon.
This info can be get through the More System Information method.
You can find them also inside the SYS_CON_FIRMWARE_*********.pkg (Syscon_Firmware) at the offset 0x28E (In this link you can found the list of the Syscon update packages)
every SoftID is associated with the ps3 mainboard. this means that you can know if a SC is compatible with your board without opening a PS3 ( Syscon Hardware)

SoftID	SC Generation	notes
Phats
0B8E	1	-
0C16	2	-
0D52	3	-
0DBF	4	-
0E69	5	-
0F29	6	-
0F38	7	-
065D	8	-
Slims
0832	9	-
08C2	10	-
0918	11	-

Datasheet of SoC similar to syscon

• Sony CXR704060 datasheet.pdf mirror

COK-002 with 0DBF syscon

Information: https://lh5.googleusercontent.com/-UiaHRjhdt50/UesKSGuxdFI/AAAAAAAAGOU/0FV8Fazyl60/s800/TV2013072019053700.jpg

Min ver: https://lh5.googleusercontent.com/-iUOuidm6v3g/UexEQily6TI/AAAAAAAAGOk/zSfBMpYDRAM/s800/TV2013072117272000.jpg

Board type: https://lh6.googleusercontent.com/-K1sc66WzJxo/Ue1Mdr5mHeI/AAAAAAAAGO8/rnqlidQAVfY/s800/DSC01591.JPG

Syscon: https://lh6.googleusercontent.com/-OTxjx3qJV0M/Ue1L2itOfRI/AAAAAAAAGO0/Bv6zli_xQQg/s800/DSC01590.JPG

Talk

-This breaks lot of standards/pages/tables in wiki, can you add some notes please ?. E.g: the board came from official repair service, bought in a normal shop, or is a frankenstein made at home ?, it boots correctly and allows firmware updates ?. If it works normally i think this proves CXR713120-20xGB and CXR714120-30xGB shares the same pinout, but the fact that is using 0DBF SoftID is a bit shocking (maybe because is the minimal SoftID allowed by CXR714120-30xGB ?... check SoftID examples in this table) --Sandungas 22:07, 24 July 2013 (MSK)

-The console is a CECHE01 MG (Metal Gear Solid 4 edition) and came with a 3rd generation BD drive (the first type with 2 lens). It had never been to SONY for service. It works normally, correctly and as you could see, has a minimum version which is compatible with the motherboard type. --l_oliveira

SHA1 hashes stored at eeprom

from http://www.edepot.com/playstation3.html

"Files finally stored into the FLASH regions have their associated SHA-1 hash value stored in the SYSCON EEPROM for authentication and verification purposes. "

What happens if we change those hashes to something a 3.55 ofw would have? (assuming we were doing this experiment on a hackable console?)

PS2 Mechacon vs PSP Syscon vs PS3 Syscon vs Vita Syscon vs PS4 Syscon

Production Start Date (<=)	PS2 Mechacon	PSP Syscon	PS3 Syscon	Vita Syscon	PS4 Syscon	Used IC/CPU Core
10/1999	CXP101064	-	-	-	-	Sony SPC970 (100 pin)
01/2000	CXP102064	-	-	-	-
09/2000	CXP103049	-	-	-	-	Sony SPC??? (136 pin)
08/2004	-	BARxx	-	-	-	NEC D790019 / D780032AY (78K0/78003xA, 64 pin)
07/2005	-	B30x	-	-	-	NEC D79F0036 / D78F????? (78K0/KE2, 64 pin)
07/2007	-	B40x	-	-	-	NEC D79F???? / D78F????? (78K0/???, 84 pin)
07/2008	-	3Axx	-	-	-	NEC D79F???? / D78F????? (78K0/???, ?? pin)
03/2009	-	3Bxx	-	-	-	NEC D79F???? / D78F????? (78K0/???, ?? pin)
05/2009	-	40xx	-	-	-	NEC D79F???? / D78F????? (78K0/???, ?? pin)
03/2003	CXR706080	-	-	-	-	Sony SR11 PS2 (Dragon): 164 pin PS3 (Donkey): 200 pin
09/2004	CXR716080	-	CXR713120	-	-
07/2007	CXR726080	-	CXR714120	-	-
03/2008	-	-	SW	-	-	NEC D79F0073 / D78F11AA (78K0R/KH3, 128 pin)
05/2009	-	-	SW2	-	-	NEC D79F0086 / D78F11BB (78K0R/KH3, 128 pin)
07/2010	-	-	-	"SC"	-	NEC D79F0109 / D78F???? (78K0R/???, 121 pin)
06/2011	-	-	SW3	-	-	NEC D79F0123 / D78F11CC (78K0R/KG3, 100 pin)
07/2013	-	-	-	-	C0L	Renesas R5F100PL (RL78/G13, 100 pin)
08/2013	-	-	-	A0xxx	-	Renesas ?R5F120PL? (RL78/???, ?100? pin)
04/2015	-	-	-	-	C0L2	Renesas R5F101LL (RL78/G13, 64 pin)

• The SPC900 core was designed by Texas Instruments [[1]]
• CXP101064, CXP102064 are similar to CXP97 (CXP971000, CXP972032, CXP973064, CXP973F064)
  • In-Circuit-Emulator: Mitek NICE-SPC970 [[2]]; Debug software: SVD970; Flash programmer: SFP-2
• A F inside the model name specifies if the IC contains flash memory.
  • Mass-produced units don't have/use program flash memory, instead a encrypted firmware patch is stored on the data-"EEPROM"
• CXR7 series uses Sony SR11 CPU (ARM7TDMI)
  • Models with public datasheet: CXR702080, CXR702F080, CXR704060
  • Maybe based on the Texas Instruments TMS470R1 series (derived from TMS470R1B512 ?)
• Prototype PS3 Syscon's:
  • CXR713F120A Syscon used on (early) pre-release prototypes, e.g. CEB-2030, DECR-1000, DEH-H1001-D, DEH-H1000A-E
  • DEH-FH1500J-A with VERTIGO-02 board and SW series prototype D79F0073
  • CBEH-H2001 with SURTEES-03 board and SW2 series prototype D79F0086
  • DEH-ML00AK-G with MPX-001 (Prototype) board and SW3 series prototype D79F0123

Packets, Lovely Packets

Command              Address      Permission
w                    0xf98b0000L  0xDD0C0000
r                    0xa58c0000L  0xDD0C0000
w16                  0x2d8e0000   0xDD0C0000
r16                  0xd58e0000L  0xDD0C0000
w32                  0xed8f0000L  0xDD0C0000
r32                  0x91910000L  0xDD0C0000
w64                  0xa9920000L  0xDD0C0000
r64                  0x5d930000   0xDD0C0000
r64d                 0x8f940000L  0xDD0C0000
wbe                  0x65960000   0xDD0C0000
rbe                  0xf9960000L  0xDD0C0000
boardconfig          0xc7990000L  0xDC0C0000
comm                 0x19990000   0xDC0C0000
commt                0x7490200    0xDC0C0000
printmode            0xd9990000L  0xDC0C0000
eepromcheck          0x1d9a0000   0x000C0000
eeprominit           0x659a0000   0x000C0000
hdmi                 0x399f0200   0xDD0C0000
xrcv                 0x13530200   0xDC0C0000
bepkt                0x5d430200   0xDC0C0000
task                 0x5500100    0xDD0C0000
duty                 0x239b0000   0xDD0C0000
tsensor              0x79a20000   0xDD0C0000
bepgoff              0xe7a40000L  0xD00C0000
getrtc               0xf3a60000L  0xDD0C0000
rtcreset             0xbba70000L  0x000C0000
ledmode              0xba80000    0xDC0C0000
buzzpattern          0xb7a80000L  0xDC0C0000
eepcsum              0x65aa0000   0xDD0C0000
tmp                  0x69aa0000   0xDD0C0000
trp                  0x2fab0000   0xDD0C0000
hyst                 0xf5ae0000L  0xDD0C0000
tshutdown            0xa1b20000L  0xDD0C0000
tzone                0xe1b50000L  0xDD0C0000
errlog               0xedb70000L  0xFF0C0000
lasterrlog           0xffb70000L  0xDD0C0000
geterrlog            0x4fb80000   0xDD0C0000
clearerrlog          0xcbb80000L  0xDD0C0000
stoplogerrtsk        0xd9b80000L  0xDD0C0000
startlogerrtsk       0xe7b80000L  0xDD0C0000
stoplogerrtoeep      0xf5b80000L  0xDD0C0000
restartlogerrtoeep   0x3b90000    0xDD0C0000
trace                0x51b90000   0xDD0C0000
disp_err             0x11590200   0xDD0C0000
clear_err            0x5b590200   0xDD0C0000
printpatch           0x4fd90000   0xDD0C0000
patchverram          0x65d90000   0xDD0C0000
patchcsum            0xf7d90000L  0xDD0C0000
patchvereep          0xb1d90000L  0xDD0C0000
portscan             0xdda0000    0xDD0C0000
powupcause           0x21b60000   0xDD0C0000
syspowdown           0xe9b60000L  0xDD0C0000
powbtnmode           0x11b90000   0xDC0C0000
dve                  0x5d990200   0xDC0C0000
fanconpolicy         0xc9bb0000L  0xDD0C0000
fanconmode           0x35bf0000   0xDD0C0000
fanconautotype       0x75c00000   0xDD0C0000
fantbl               0x87c00000L  0xDD0C0000
tshutdowntime        0x5dc90000   0xDD0C0000
fanservo             0x29bf0000   0xDD0C0000
thrm                 0x1dbf0000   0xDD0C0000
fanpol               0x31ca0000   0xDD0C0000
thermfatalmode       0x3bca0000   0xDD0C0000
becount              0x7dca0000   0xDD0C0000
wmmto                0x3bcb0000   0xDC0C0000
ltstest              0x97cb0000L  0xDD0C0000
fancon               0x6dd20000   0x0D000000
powerstate           0x6fce0000   0xDD0C0000
devpm                0x53d00000   0xDD0C0000
wrsxc                0x79d20000   0xDD0C0000
rrsxc                0x13d30000   0xDD0C0000
faninictrl           0xd9d30000L  0x0D000000
therrclr             0xe5d30000L  0xDD0C0000
poll                 0xe3400200L  0xDD0C0000
recv                 0x35410200   0xDD0C0000
send                 0x6f410200   0xDD0C0000
LS                   0x1b420200   0xDD0C0000
hversion             0x2f420200   0xDD0C0000
bstatus              0x69420200   0xDD0C0000
buzz                 0xffa40000L  0xDC0C0000
diag                 0xad9a0000L  0xD00C0000
xdrdiag              0x11e70100   0xF0000000
xiodiag              0x75e80100   0xF0000000
fandiag              0x1be90100   0xF0000000
osbo                 0x3fea0100   0xF0000000
bestat               0x13d40000   0xFD0F0000
bringup              0x97d50000L  0xFD0F0000
shutdown             0xc5d50000L  0xFD0F0000
powersw              0xf9d50000L  0xFD0F0000
resetsw              0x5d60000    0xFC0F0000
ejectsw              0x11d60000   0xFD0F0000
thalttest            0x13d80000   0x000F0000
bsn                  0x5d80000    0xF00F0000
firmud               0x1dd60000   0xFDFF0000
hdmiid               0x1d9d0200   0xDC0F0000
hdmiid2              0x819d0200L  0xDC0F0000
version              0x5fd60000   0xFFFF0000
csum                 0x87d60000L  0xFF0F0000
revision             0xe1d70000L  0xFFFF0000
cp                   0x77e00100   0xF0000000
halt                 0x7e10100    0xF0000000
bootbeep             0x67ea0100   0xF0000000
scopen               0x21e10000   0xFF000000
scclose              0xefe10000L  0xFF000000
scasv2               0x7e20000    0xDD000000
scagv2               0x4fe20000   0xFF000000