Talk:Syscon Firmware

LV1 - System Controller (SC) manager

• sc_mgr_get_srh (0x9001)
• sc_mgr_set_srh (0x9002)
• sc_mgr_encrypt (0x9003)
• sc_mgr_decrypt (0x9004)
• Init For VTRM (0x9005)
• sc_mgr_get_region_data (0x9006)
• sc_mgr_set_region_data (0x9007)
• Set RTC (0x9008)
• Get Time (0x9009)
• Set Time (0x900A)
• sc_mgr_read_eprom (0x900B)
• sc_mgr_write_eprom (0x900C)
• Init For Updater (0x900D)
• sc_mgr_get_sc_status (0x900E)
• sc_iso_header (sc_iso_sc_binary_patch - 0x9011)
• SC RTC Factory (0x9012)
• Correct RTC Factory (0x9013)
• Set SC Status (0x9014)
• Backup Root Info (0x9015)
• Restore Root Info (0x9016)
• Read System Data From SC EEPROM - Indi Info Manager 0x17007)

SC - sc_iso.self

• sc_iso_sc_binary_patch
• sc_iso_get_sc_status
• sc_iso_get_property
• sb_iso_get_rnd
• sb_iso_encdec_key
• sc_iso_module::calculate_drift_time
• sc_iso_module::generate_key
• sc_iso_module::generate_all_key
• sc_iso_module::authenticate
• sc_iso_module::change_to_old_key
• sc_iso_module::do_process
• sc_iso_module::get_system_info
• sc_iso_module::get_system_version
• sc_iso_module::do_set_rtc_status
• sc_iso_module::do_get_rtc_status
• sc_iso_module::do_set_rtc2
• sc_iso_module::set_rtc
• sc_iso_module::do_set_drift_time
• sc_iso_module::do_get_time
• sc_iso_module::set_time
• sc_iso_module::get_time
• sc_iso_module::read_data2
• sc_iso_module::write_data2
• sc_iso_module::write_binary_patch
• sc_iso_module::read_data
• sc_iso_module::write_data
• sc_iso_module::write_region_data
• sc_iso_module::set_region_data
• sc_iso_module::write_srh
• sc_iso_module::set_srh
• sc_iso_module::write_key
• sc_iso_module::write_mngblk
• sc_iso_module::initialize_updater_block
• sc_iso_module::read_region_data
• sc_iso_module::get_region_data
• sc_iso_module::get_srh
• sc_iso_module::read_key
• sc_iso_module::do_crypt
• sc_iso_module::decrypt
• sc_iso_module::encrypt
• sc_iso_module::read_mngblk
• sc_iso_module::set_sc_status
• sc_iso_module::get_sc_status
• sc_iso_module::init_for_updater
• sc_iso_module::init_for_vtrm
• sc_iso_module::start

This should be a good starting point but leaves enough to explore yourself though: http://pastebin.com/NxVkGCdp (for version 1.02)

See Graf's PSGroove Payload and HV page #0x9000 - SC_Manager / HVpage #System Controller

---

Updater log lines related to syscon

Updater log lines related to Syscon just after BD firmware, Multi-Card controller, BlueTooth firmware (in this case CEX 3.55) just before post processing and cleanup update status :

Update System controller firmware
read SC patch package (4864 bytes) elapsed = 3 msec
read SC patch package (4864 bytes) elapsed = 3 msec
read SC patch package (4864 bytes) elapsed = 3 msec
read SC patch package (4864 bytes) elapsed = 2 msec
read SC patch package (4864 bytes) elapsed = 2 msec
read SC patch package (4864 bytes) elapsed = 3 msec
read SC patch package (4864 bytes) elapsed = 2 msec
read SC patch package (4864 bytes) elapsed = 3 msec
Update System controller firmware done(0x8002f000)

PS3 Retail == PS3 TEST != PS3 TOOL I try to get PS3 TOOL SC Firmwares.

---

It is suggested that the Syscon EEPROM is 512KB and the full (encrypted) firmware is <400KB (on Ref.Tool the Syscon is updated by overwiting the whole Syscon firmware : e.g. v1.0.5c1_TMU510_u.bin 384KB)

Syscon commands

Syscon commands:

ver
errlog
auth1
auth2
fandiag
xdrdiag
xiodiag
bestat
sysdiag
syslog

bringup (PowerOn State)
shutdown (PowerOff State)
powersw
resetsw
bootbeep
stat
bootbeep on BOOT BEEP ON: DONE
bootbeep off BOOT BEEP OFF: DONE
xdrdiag
start
errlog tmpforcp
cp beepremote
cp beep2kn1n3
cp beep2kn2n3 /usr/bin/sx
halt HALT: OK
version
firmud Done.
cp ready CP READY: OK
cp busy CP BUSY: OK
cp reset CP RESET: OK
bestat
xdrdiag info
xdrdiag result
xiodiag
fandiag 
diagnose

The diag commands are usually for the backup bank, the main only supports firmud

CP root pass on Ref.Tool: cytology

---

sc auth keys old

sc auth keys old:
See: Keys#sc_iso

sc auth key seeds:
auth_1_0x00: 63DCA7D3FEE47F749A408363F1104E8F
auth_2_0x00: 4D10094324009CC8E6B69C70328E34C5
auth_1_0x01: D97949BAD8DA69D0E01BF31523732832
auth_2_0x01: C9D1DD3CE27E356697E26C12A7B316A8
auth_1_0x06: 4420ED722FEA35021955AB40C78EE6DF
auth_2_0x06: 3E67C2D9432E15D09BEF0E6C6492455D
the new auth keys are generated involving 256bit aes encryption (iv is all zeroes)

dump sysrom

dump_sysrom.pkg of dump-flash+syscon.rar (280.51 KB) (http://git.gitbrew.org/ps3/?p=otheros-utils/dump_sysrom.git) seems to output wrong on MFW315:

 Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
 00000000  FF FF FF FF 80 01 00 03 FF FF FF FF 80 01 00 03  ÿÿÿÿ€...ÿÿÿÿ€...
 00000010  FF FF FF FF 80 01 00 03 FF FF FF FF 80 01 00 03  ÿÿÿÿ€...ÿÿÿÿ€...
 ...   ...   ...   
 0003FFE0  FF FF FF FF 80 01 00 03 FF FF FF FF 80 01 00 03  ÿÿÿÿ€...ÿÿÿÿ€...
 0003FFF0  FF FF FF FF 80 01 00 03 FF FF FF FF 80 01 00 03  ÿÿÿÿ€...ÿÿÿÿ€...

Updating Syscon on Tool/DECR

Q: How is syscon updated on Reference Tool / DECR models?
There are no syscon PKG's in the DECR PUPs and CP .bin file contains one large binary encrypted gibberish. it is suggested it uses full syscon updates, but how are files like "v1.0.5c1_TMU510_u.bin" send to syscon for updating? With/via Communication Processor?

A: In DECR-1000A Syscon is located on the motherboard. The Communication Processor talks to it through UART and updates it with the firmud command.

• List of main IC's on the motherboard:
  • SCEI CXR713F120A (Syscon)
  • SCEI CXD4302GB (Starship2)
• List of main IC's on the CP board:
  • 1x Samsung K9F2G08U0M (Flash)
  • SCEI CXD9790GG (?) "helps handle communication between the Communication Processor, and the system controller, and southbridge. Using this path, the CP can talk to the System Controller, and bring the system up, down, and change its boot settings."
  • Etc...
    

archaic source1 archaic source2

The SysCon Bootloader

• This is what the BL does at startup (DECR). One of these flags could enable JTAG

--- BL
*0x3100004 = 0x03
Check 0x3101080 & 1
*0x3803000 = 0x1020000 or 0x1001000
*0x3803004 = 0x00
*0x3803008 = 0x18000 or 0x8000
*0x3803044 = 0x00
*0x380300C = 0x2CC001
*0x3803040 = 0x01
*0x3800004 = 0x02

*0x310FFFC = 0xFFFF

--- FW
*0x3100004 = 0x03
*0x3100008 = 0x0A
*0x3100008 = 0x03
*0x3100020 = 0x86
*0x3100028 = 0x10
WAIT 152 cycles
*0x3100010 = 0x01
*0x3100008 = 0x0A
*0x3100008 = 0x06
*0x3100004 = 0x00

*0x3808070 = 0x00
*0x3808064 = 0x0F

*0x3005404 = 0x0C67
*0x3005400 = 0x0C

Syscon patches template

This template started as something experimental, eventually could be used in frontpage

Syscon Patches

PS3 Model	PS3 Type	Motherboard	Syscon Hardware	SoftID.SysconPatch@SC	Syscon Firmware Patches			Notes
					File Name	Version	Installed from
DECR-1000	0x01	TMU-520	CXR713F120A	0F3B.0000000000000000@SC	v1.0.5c1_TMU510_u.bin	v1.0.5 c 1	CP ver 1.33	Full firmware overwrite from Communication Processor
DEH-H1001-D	0x01	COOKIE-13	CXR713F120A	0B67.0000000000000000@SC	n/a	n/a	n/a
DEH-H1000A	0x01	COK-001 (proto)	CXR713F120A	0B67.0000000000000000@SC	n/a	n/a	n/a
CECHAxx	0x01	COK-001	CXR713120 series	0B8E.0001000000000004@SC 0B8E.0001000000000005@SC 0B8E.0001000000000006@SC	SYS_CON_FIRMWARE_01000004.pkg SYS_CON_FIRMWARE_01000005.pkg SYS_CON_FIRMWARE_01000006.pkg	v1.0.0 release 4 v1.0.0 release 5 v1.0.0 release 6	1.30 Firmware 1.81 Firmware 3.40 Firmware
CECHBxx	0x02
CECHCxx	0x03	COK-002		0C16.0001000100030002@SC 0C16.0001000100030003@SC	SYS_CON_FIRMWARE_01010302.pkg SYS_CON_FIRMWARE_01010303.pkg	v1.1.3 release 2 v1.1.3 release 3	1.81 Firmware 3.40 Firmware
CECHExx	0x04
CECHGxx	0x05	SEM-001		0D52.0001000200030002@SC	SYS_CON_FIRMWARE_01020302.pkg	v1.2.3 release 2	3.40 Firmware
CECHHxx	0x06	DIA-001	CXR714120 series	0DBF.0001000300030002@SC	SYS_CON_FIRMWARE_01030302.pkg	v1.3.3 release 2	3.40 Firmware
CECHJxx	0x07	DIA-002		0E69.0001000400040001@SC 0E69.0001000400040002@SC	n/a SYS_CON_FIRMWARE_01040402.pkg	v1.4.4 release 1 v1.4.4 release 2	Factory ? 3.40 Firmware
CECHKxx
DECR-1400	0x09	DEB-001	CXR713120 series	0E69.0001000400040001@SC	n/a	v1.4.4 release 1	Factory ?
CECHCxx	0x03	COK-002 with 65nm RSX	CXR714120 series	0F29.0001000500000002@SC	SYS_CON_FIRMWARE_01050002.pkg	v1.5.0 release 2	3.40 Firmware	Refurbished, new 65nm RSX, new syscon
CECHAxx	0x01	COK-001 with 40nm RSX	CXR714120 series	0F38.0001000500010001@SC	SYS_CON_FIRMWARE_01050101.pkg	v1.5.1 release 1	3.41 Firmware	Refurbished, new 40nm RSX, new syscon
CECHLxx	0x08	VER-001	SW-30x series	065D.0000000000000000@SC	n/a	n/a	Factory	No patches availables in System Firmware
CECHMxx
CECHPxx
CECHQxx
CECH-20xx	0x09	DYN-001	SW2-30x series	0832.00010002083E0832@SC	SYS_CON_FIRMWARE_S1_00010002083E0832.pkg	???	3.00 Firmware
CECH-21xx	0x0A	SUR-001		08A0.0000000000000000@SC	n/a	n/a	Factory	No patches availables in System Firmware
CECH-25xx	0x0B	JTP-001 or JSD-001		08C2.0000000000000000@SC	n/a	n/a	Factory	No patches availables in System Firmware
CECH-30xx	0x0C	KTE-001	SW3-30x series	0918.0000000000000000@SC	n/a	n/a	Factory	No patches availables in System Firmware
CECH-40xx	0x0D	MSX-001 or MPX-001 or NPX-001	SW3-30x series	098F.0000000000000000@SC	n/a	n/a	Factory	No patches availables in System Firmware
CECH-42xx	?	?	?	?	?	?	?	No patches availables in System Firmware
CECH-43xx	?	?	?	?	?	?	?	No patches availables in System Firmware
Rows marked in grey are "reference tool" models
Rows marked in blue are "preproduction" models
Rows marked in red are "refurbished" models

Known Sherwood Syscon firmwares

SoftID	Firmware version	Build target	Build date	Adds support for Platform IDs	Dumped?
0658	??.??	-	2008	CokF10	NO
065D	00.17	SW-301	2008	-	YES
????	??.??	SW-302	2008	-	NO
0832	01.11	SW2-301	2009	CokG10, CokG11	YES
08A0	??.??	SW2-302	2009	CokH10, CokH11	NO
08C2	??.??	SW2-303	2010	CokJ13, CokJ20	NO
0918	02.03	SW3-301	2011	CokK10	NO
098F	??.??	SW3-302	2012	CokM20, CokM40	NO
????	??.??	SW3-303	2013	CokN10, CokN30	NO
????	??.??	SW3-304	2013	-	PARTIALLY

NonRetail syscon

Remember, Debug/DEX consoles are normal retail consoles with different TargetID, so only those that have a nonretail board have deviating patches (like the CXR713F120A found on the DECR-1000A TOOL/DECR).

Tool/DECR don't have patches, they flash entire firmwares.

Factory cp comes with 0.8.8 (corresponds to syscon fw size 0x60000)
it is VERY likely that it is not possible to go below this point, so any smaller size would likely cause a brick (see Talk:Communication_Processor for more info on how to downgrade)

DECR samples: [1] mirror:
v0.6.1c8_TMU510_u.bin  | CRC16:FAE0 | CRC32:590D9A21 | SHA1:DC8AEA0DDC6C5B813FE9861C972AAE111DA6FCAB | MD5:50794942BD9FAB7CC04A81BD8D220BA1 | 7379733103B15C07EC051E9B44D90BDF 07AD575D86B3937CFA8B3D331BE958DDB40EDFBE
v0.6.10c4_TMU510_u.bin | CRC16:B58A | CRC32:DB8A00BF | SHA1:5D52289960151E2543EBEAA805963B7B88C35DD8 | MD5:14C288A576690C587E95C8542EDC2A70 | 7379733160AF70F9CF5DF54F30D5C77C 5F360CD146EEC3A7B5026151C396C4A5F7F1EC91
v0.6.11c4_TMU510_u.bin | CRC16:8A51 | CRC32:289B15F3 | SHA1:D45214E907A104BCC6BC91D78B7B471263AB0699 | MD5:B7CFA6536329F0DFF1AAD7905627F15F | 73797331F283602B666562012850612E 3FABA6E4FE1D70724164A23886199F36A02EDB0D
v0.6.12c5_TMU510_u.bin | CRC16:31B2 | CRC32:1A1F141B | SHA1:403BF55314C4E785ED90D03A8F2E90B67CC235EA | MD5:1B19B55924445E4BBB2D970410AD6366 | 737973316E5C037615E4727464B2D929 2D2EB7DADEF6B24C4E959235E5B11917D352F9D5
v0.6.14c4_TMU510_u.bin | CRC16:FB1B | CRC32:079EF389 | SHA1:6EF7067FAD939D0B0DFC0B9418A6F4C7509104E5 | MD5:11E9F6270A5D79D0B76614B1C6FE622B | 73797331DCEAC9FA0F1B2449F332C4A9 1CBFF6FE43BDCA3B0A5AAFCE9A98D7176D951A49
v0.8.4c8_TMU510_u.bin  | CRC16:2949 | CRC32:81EFA508 | SHA1:5963B333361123782848E3639D9FA585A728691A | MD5:564D5479F5B98E244C1EA7B56BACC873 | 73797331E8A9ADD15036B33AB8E8AB17 FDCC981DA58B9F44E9331C9708C01D924D78DB3E
v0.9.9c1_TMU510_u.bin  | CRC16:172A | CRC32:EBB2D78A | SHA1:D5E693D2E22FD99CF3E330AC442CD9B07D01DB66 | MD5:216B258115F25B13C9969AF35BFCAC20 | 7379733116E6DD5F054442FACFA15A5C 5E62E8FC8059F864A91CAD142BC30BDAE77D9464
v0.9.14c1_TMU510_u.bin | CRC16:2A2C | CRC32:330CB685 | SHA1:30B19BB8B78E60D81848E8FDF6C4A79537CFBE66 | MD5:7AA5BFE64D15F8BD61EB80B999FE4343 | 73797331807BAF3D6E1B6A3CA5FDF30D 7CCE3B0E739A19C9C431D4D8C59CF1513DAF25E9
v1.0.1c1_TMU510_u.bin  | CRC16:3FD1 | CRC32:A7C7E313 | SHA1:F0DCA7130074E023FFAF58EBD06A61EE73C94907 | MD5:C95C57DC20D9AC5473C1EC914744352F | 73797331F362AE579EA3D864E27334CC 3EAB05DEC5328E885EED3295954999BD518ABFDF
v1.0.3c1_TMU510_u.bin  | CRC16:636E | CRC32:32942DFD | SHA1:83BE56F92A93B911D2BBE12DD1F6AF9CCD1EC11B | MD5:642C0E6615AACBF180C367F7927D1E30 | 737973312D08051E9F5AA1AAF2647EC0 44EE5DF74D92DDB81B1099430B0B5A243FFDA44E
v1.0.4c1_TMU510_u.bin  | CRC16:528F | CRC32:A0FBA694 | SHA1:1A5E5F97D66A754C2C7436618DC911C1C57B9FEA | MD5:6641B03FC6193E35380D681152226275 | 73797331E40325B060CDE461D250058D 8AF478F0A1C1B4B9DECA01C8770F8A9010F0A513
v1.0.5c1_TMU510_u.bin  | CRC16:59F8 | CRC32:87316EBF | SHA1:8ED74829973F740C1B825FD976F7926A95ACBE8B | MD5:717DC4187A6E446C30DACAC129090656 | 737973316856FC96CA6FA4D4652D4985 F9E998439D4C23DA9C1BA8F5C44611D826DA1CFE

dev/hda

dev_hda.image from DECR-1000A CP: dev_hda.image dev_hda.image.7z

Partitions

device file	size	type
/dev/loop0p1	51 MB (50577408 bytes)	0x89
/dev/loop0p2	8,7 MB (8650752 bytes)	Linux
/dev/loop0p3	32 MB (31981568 bytes)	Linux
/dev/loop0p4	35 MB (35127296 bytes)	Extended
/dev/loop0	4,9 MB (4883968 bytes)	Unassigned