Wifi

From PS3 Developer wiki
Revision as of 10:56, 3 November 2011 by Euss (talk | contribs) (→‎CWI-002)
Jump to navigation Jump to search

Wireless Networking

BlueTooth and Wifi channels

The PS3 contains two wireless technologies, Wi-Fi 802.11b/g and Bluetooth 2.0. It is not possible for both to be used at the same time, so the PS3 alternates between Wi-Fi and Bluetooth communication at a very fast frequency using time division multiplexing (note, see:Marvell-WiFi-Bluetooth-Coexistence.pdf). Both wireless capabilities are powered by the Marvell 88W8580 chip, used on both daughterboards CWI-001 (CECHA, CECHB, CECHC) and UWB-001 (CECHH, CECHJ, CECHK). In SKU Models CECHL and later, this wireless module updated with Marvell 88W8780 and became part of the motherboard (no longer on a separate daughterboard).


Hardware

IEEE 802.11b/g wireless network and BlueTooth 2.0 EDR controller chip: Marvell 88W8580 / Marvell 88W8780. See: Bluetooth

The Wi-Fi module uses two internal antennas and allows the PS3 to communicate with access points (normal mode) and Wi-Fi devices like the Sony PSP (AP mode for Remote Play). The Wi-Fi module contains a 16MB ISSI SDRAM memory chip, and a 64KB SPI Serial Interface NOR Macronix flash chip.

Type Size Speed Voltage Packaging Manufacturer Serialnumber Description
ARMv5TE-compliant ?8kbit EEPROM? 50MHz ?3.3V? 256-ball BGA Marvell 88W8580-BAN1 PS3 Fat Wi-Fi controller chip
ARMv5TE-compliant ?8kbit EEPROM? ?50MHz? ?3.3V? ?256-ball BGA? Marvell 88W8780-BIE2 PS3 Slim Wi-Fi controller chip
NOR Flash 64KB 85MHz 3V 8-pin Macronix MX25L512MC-12G PS3 Fat Wi-Fi firmware chip
NOR Flash 4Mbit 85MHz 3V 8-pin Macronix MX25L4005AM2I-12G PS3 Slim Wi-Fi firmware chip
SDRAM 16MB 166MHz, 6ns 3.3V 90-ball ISSI IS42S32400B-6BL PS3 Wi-Fi working memory chip
SDRAM 16MB (8Mx16) 166MHz, 6ns CAS3 3.3V 400mil 54-PIN TSOP-II Nanya NT5SV8M16FS-6K PS3 Wi-Fi working memory chip (CECHJ and later models)


Seperate Wifi/BT boards on PS3 Fat

CWI-001

part no. 1-871-870-21, CWI-001 (CECHA, CECHB, CECHC)
part no. 1-871-870-31, CWI-001 (CECHE)

Wifi/Bluetooth board (CWI-001 / 1-871-870-21) CECHA, CECHB, CECHC - TOP

Wifi/Bluetooth board (CWI-001 / 1-871-870-21) CECHA, CECHB, CECHC - BOTTOM
PS3 Wifi subboard with Marvell 88W8580-BAN1 controller, Marvell 88W8010-NNB1 driver, Macronix MX25L512MC-12G flash, ISSI IS42S32400B-6BL DRAM

PS3 Wifi subboard with Marvell 88W8580-BAN1 controller, Marvell 88W8010-NNB1 driver, Macronix MX25L512MC-12G flash, ISSI IS42S32400B-6BL DRAM
CWI-001/1-871-870-21 diagram

Marvell 88W8500 (not 88W8580) Blockschematic)
Marvell 88W8580-BAN1 (Wifi/Bluetooth controller)
256-ball BGA
Marvell 88W8580-BAN1

Datasheet: -
Product Flyer: 88W8500-ProductFlyer.pdf (154.81 KB)

A B C D E F G J K L M N P R T
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
A B C D E F G J K L M N P R T
Marvell 88W8010-NNB1 (Wifi driver)
Marvell 88W8010-NNB1 (Wifi driver) inside Wifi subboard

Package: TSOP-48

Macronix MX25L512MC-12G (Flash)
8pin SOP
Macronix MX25L512MC-12G

Datasheet: Macronix_MX25L512MC-12G.pdf (1.87 MB)

Pad # Name Description
1 CS# Chip Select
2 SO Serial Data Output
3 WP# Write Protection
4 GND Ground
5 SI Serial Data Input
6 SCLK Clock Input
7 HOLD# Hold, to pause the device without deselecting the device
8 VCC +3.3V Power Supply
ISSI IS42S32400B-6BL (DRAM)
90-ball FBGA
ISSI IS42S32400B-6BL

Datasheet: ISSI_IS42S32400B-6BL.pdf (675.22 KB)

Pad # Description
A0-A11 Row Address Input
A0-A7 Column Address Input
BA0, BA1 Bank Select Address
DQ0 to DQ31 Data I/O
CLK System Clock Input
CKE Clock Enable
CS Chip Select
RAS Row Address Strobe Command
CAS Column Address Strobe Command
WE Write Enable
DQM0-DQM3 x32 Input/Output Mask
VDD Power
Vss Ground
VDDQ Power Supply for I/O Pin
VssQ Ground for I/O Pin
NC No Connection
Nanya NT5SV8M16FS-6K (DRAM)
54-pin TSOP-II
Nanya NT5SV8M16FS-6K

Datasheet: Nanya NT5SV8M16FS-6K (128 Mbit, 16 MB) : NTC-SDR-128M-F-R13.pdf

Pin # Description
CK Clock Input
CKE (CKE0, CKE1) Clock Enable
CS Chip Select
RAS Row Address Strobe
CAS Column Address Strobe
WE Write Enable
BA1, BA0 Bank Select
A0 - A11 Address Inputs
DQ0-DQ15 Data Input/Output
DQM, LDQM, UDQM Data Mask
VDD Power (+3.3V)
VSS Ground
VDDQ Power for DQs (+3.3V)
VSSQ Ground for DQs
NC No Connection



CWI-002

part no. 1-875-387-11, CWI-002 (CECHG)

Wifi/Bluetooth board (CWI-002 / 1-875-387-11) CECHG - TOP
Wifi/Bluetooth board (CWI-002 / 1-875-387-11) CECHG - BOTTOM
Wifi/Bluetooth board (CWI-002 / 1-875-387-11) CECHG - SUBBOARD 1-802-252-11 rev1.0

UWB-001

part no. 1-875-939-21, UWB-001 (CECHH, CECHJ, CECHK)

Wifi/Bluetooth USB board (UWB-001 / 1-875-939-21) CECHH, CECHJ, CECHK - TOP
Wifi/Bluetooth USB board (UWB-001 / 1-875-939-21) CECHH, CECHJ, CECHK - BOTTOM
Marvell 88W8580-BAN1 (Wifi/Bluetooth controller)

Wifi#Marvell_88W8580-BAN1_.28Wifi.2FBluetooth_controller.29

Nanya NT5SV8M16FS-6K (DRAM)

Wifi#Nanya_NT5SV8M16FS-6K_.28DRAM.29

1-802-252-21 Rev 2.0 driver

No pics from inside (yet), please add if possible.

Sony CXN1502-3AAL 752D34S (BT driver subboard on UWB-001)

Bluetooth#Sony_CXN1502-3AAL_752D34S_.28BT_driver_subboard_on_UWB-001.29

Genesys GL852 (USB Hub)

see USB

Integrated Wifi/BT boards on PS3 Slim

PS3 Wifi subboard as seen integrated on the mobo of CECH-2001A
part.nr: 1-474-178-11 Rev. 1.0
SP88W8780-MA0
E200050406-0bL2
PS3 Wifi subboard with
Marvell 88W8780-BIE2,
Macronix MX25L4005AM2I-12G
Marvell 88W8782 (not 88W8780) Blockschematic
Difference: dual 2.4+5GHz versus 2.4GHz single band


Marvell 88W8780-BIE2 (Wifi/BT controller)

256-ball BGA
Marvell 88W8780-BIE2

Datasheet: -
Product Flyer: -

A B C D E F G J K L M N P R T
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
A B C D E F G J K L M N P R T

Macronix MX25L4005AM2I-12G (Flash)

8pin SOP
Macronix MX25L4005AM2I-12G

Datasheet: Macronix_MX25L4005AM2I-12G.pdf (1.5 MB)

Pad # Name Description
1 CS# Chip Select
2 SO Serial Data Output
3 WP# Write Protection
4 GND Ground
5 SI Serial Data Input
6 SCLK Clock Input
7 HOLD# Hold, to pause the device without deselecting the device
8 VCC +3.3V Power Supply

Software

eCos is used to provide the Playstation's Wi-Fi support. eCos is an open source real-time operating system (RTOS). It is licensed under a modified version of GPL that allows the use of non GPL licensed code to be linked with eCos.

References: 

http://www.ecoscentric.com/ecos/
http://ecos.sourceware.org/


GameOS firmware file

Filename: eurus_fw.bin
Location: /dev_flash/sys/internal and inside CoreOS package

example from FW 2.40

Header: 

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  01 00 00 00 00 00 F0 D0 B4 05 00 00 E5 63 86 B6  ......ðд...åc†¶
00000010  18 F0 9F E5 18 F0 9F E5 18 F0 9F E5 18 F0 9F E5  .ðŸå.ðŸå.ðŸå.ðŸå
00000020  18 F0 9F E5 00 00 A0 E1 18 F0 9F E5 18 F0 9F E5  .ðŸå.. á.ðŸå.ðŸå
00000030  58 00 F0 D0 40 00 F0 D0 44 00 F0 D0 48 00 F0 D0  X.ðÐ@.ðÐD.ðÐH.ðÐ
00000040  4C 00 F0 D0 00 00 00 00 50 00 F0 D0 54 00 F0 D0  L.ðÐ....P.ðÐT.ðÐ
00000050  FE FF FF EA FE FF FF EA FE FF FF EA FE FF FF EA  þÿÿêþÿÿêþÿÿêþÿÿê

only readable part: 

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00001B90  00 00 00 00 60 01 00 00 49 6E 76 61 6C 69 64 20  ....`...Invalid 
00001BA0  4F 70 65 72 61 74 69 6F 6E 00 00 00 02 00 00 08  Operation.......
00001BB0  44 69 76 69 64 65 20 42 79 20 5A 65 72 6F 00 00  Divide By Zero..
00001BC0  4F 76 65 72 66 6C 6F 77 00 00 00 00 55 6E 64 65  Overflow....Unde
00001BD0  72 66 6C 6F 77 00 00 00 49 6E 65 78 61 63 74 20  rflow...Inexact 
00001BE0  52 65 73 75 6C 74 00 00 3A 20 48 65 61 70 20 6D  Result..: Heap m
00001BF0  65 6D 6F 72 79 20 63 6F 72 72 75 70 74 65 64 00  emory corrupted.
00001C00  55 6E 6B 6E 6F 77 6E 20 73 69 67 6E 61 6C 00 00  Unknown signal..
00001C10  78 47 00 00 1E FF 2F E1 78 47 00 00 10 40 2D E9  xG...ÿ/áxG...@-é
00001C20  E9 FE FF EB 04 00 80 E2 10 40 BD E8 1E FF 2F E1  éþÿë..€â.@½è.ÿ/á
00001C30  08 B5 00 AB 18 70 03 20 69 46 AB DF 01 B0 08 BC  .µ.«.p. iF«ß.°.¼
00001C40  18 47 00 00 00 C0 9F E5 1C FF 2F E1 21 14 F0 D0  .G...ÀŸå.ÿ/á!.ðÐ
00001C50  78 47 00 00 10 40 2D E9 EF FF FF EB 00 10 A0 E3  xG...@-éïÿÿë.. ã
00001C60  00 10 80 E5 10 40 BD E8 1E FF 2F E1 41 62 6E 6F  ..€å.@½è.ÿ/áAbno
00001C70  72 6D 61 6C 20 74 65 72 6D 69 6E 61 74 69 6F 6E  rmal termination
00001C80  00 00 00 41 72 69 74 68 6D 65 74 69 63 20 65 78  ...Arithmetic ex
00001C90  63 65 70 74 69 6F 6E 3A 20 00 49 6C 6C 65 67 61  ception: .Illega
00001CA0  6C 20 69 6E 73 74 72 75 63 74 69 6F 6E 00 00 00  l instruction...
00001CB0  00 49 6E 74 65 72 72 75 70 74 20 72 65 63 65 69  .Interrupt recei
00001CC0  76 65 64 00 00 00 00 00 49 6C 6C 65 67 61 6C 20  ved.....Illegal 
00001CD0  A3 33 63 EF 01 00 00 00 70 1C F0 D0 B4 05 00 00  £3cï....p.ðд...
00001CE0  05 FC E6 C7 61 64 64 72 65 73 73 00 00 00 00 00  .üæÇaddress.....
00001CF0  00 00 00 54 65 72 6D 69 6E 61 74 69 6F 6E 20 72  ...Termination r
00001D00  65 71 75 65 73 74 00 00 00 00 53 74 61 63 6B 20  equest....Stack 
00001D10  6F 76 65 72 66 6C 6F 77 00 00 00 00 00 00 00 00  overflow........
00001D20  00 52 65 64 69 72 65 63 74 3A 20 63 61 6E 27 74  .Redirect: can't
00001D30  20 6F 70 65 6E 3A 20 00 4F 75 74 20 6F 66 20 68   open: .Out of h
00001D40  65 61 70 20 6D 65 6D 6F 72 79 00 00 00 00 00 55  eap memory.....U
00001D50  73 65 72 2D 64 65 66 69 6E 65 64 20 73 69 67 6E  ser-defined sign
00001D60  61 6C 20 31 00 00 55 73 65 72 2D 64 65 66 69 6E  al 1..User-defin
00001D70  65 64 20 73 69 67 6E 61 6C 20 32 00 00 50 75 72  ed signal 2..Pur
00001D80  65 20 76 69 72 74 75 61 6C 20 66 6E 20 63 61 6C  e virtual fn cal
00001D90  6C 65 64 00 43 2B 2B 20 6C 69 62 72 61 72 79 20  led.C++ library 
00001DA0  65 78 63 65 70 74 69 6F 6E 00 00 00 00 00 00 00  exception.......

Tail: 

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000709A0  3E CA D7 EA C7 4C 7A 6B A7 8F 5A E5 7B 91 BB F8  >Ê×êÇLzk§.Zå{‘»ø
000709B0  58 A7 4D AA E6 7C 72 D0 A4 8B C3 26 05 3F C7 EB  X§Mªæ|rФ‹Ã&.?Çë
000709C0  79 BB 09 DE 2E DC E0 A3 8B BC 4D 13 D7 FF 1B 00  y».Þ.Ü࣋¼M.×ÿ..
000709D0  60 40 00 D0 04 00 00 00 EC 47 9E 14 54 8A ED C0  `@.Ð....ìGž.TŠíÀ
000709E0  04 00 00 00 00 00 F0 D0 00 00 00 00 3C 1A ED 79  ......ðÐ....<.íy

Other References

Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Wifi&oldid=6451"