Talk:Service Connectors

From PS3 Developer wiki
Jump to navigation Jump to search

A special CP Board can be used to connect via the Service Connector to the PS3

PLAYSTATION3 Tool Service Manager for Cookie
Version: 1.3.1 <built 17:20:03, 01/17/11 JST>
Where did you get this message from ? did you just run the Tool's TSM on top of the cookie board or is it from another CP board somehow ?
-Mathieulh
I patched the tsm::is_cytology(void) function to "return" false; however, if I would know the pinout of the CP Connector (CN4403) I would test it because I haven't found a single (Tool) syscon UART command that doesn't work on my COK-001 (Prototype). The problem is, that the CN4403 has over 100 pins and the COOKIE/COK Service Connector only 30 ;).
-Strike Venom
Are you running the TSM on an actual CP board ? If so you are quite daring to take a reftool appart and connect the CP board elsewhere, I never attempted this but I am quite interested as I never could exploit the retail version of the system controller firmware and doing this might allow it to happen, depending on what is allowed.
I am quite sure the Tool board has extra pins for the CP, if there is a CP for retail boards, then it is probably much more limited, in fact it is probably meant to be a diag board, I doubt TSM is meant to run on retail hardware, CPs were however quite common on internal revisions of the CEB hardware (while 3rd parties did not have access to it), back then the CP board would connect to a pci express port on the motherboard which was unpopulated on 3rd party versions (despite the fact that the cell was 00 paired on 3rd party CEB devices)
I believe TSM did run on the CEB and DEH consoles and as such a check as added later to make sure it only runs on cytology (the current reftool).
The fact that you see the TSM output just means that the diag board uses the same UART than the CP does (which makes sense, in fact on reftool, the CP is used for diag as well and has a full set of diag binaries available to it, I assume you can run all/most of them on a board attached to retail hardware. Is there an interface to SB from the service connector as well ?
-Mathieulh
SB_UART (and SB_TRG diag on serv.con.) is present on DEH-H1000A-E, DEH-H1001-D COOKIE-13 and Retail models' service connector and PCI pads
Euss
I'm running the TSM on a TCP-520 CP Board, but the TSM halts after the patched tsm::is_cytology(void) check (which makes sense because it's running on a cytology or there's no code for the cookie target :D). If I want to connect the TCP-520 to a cookie board, I need to patch the CP Firmware, as (for example) loading the GPIO driver on the South Bridge would just crash the PS3.
-Strike Venom


http://i.imgur.com/mekmGAZ.png needs some documenting Zecoxao 05:04, 2 January 2015

glad I won't have to ask for a more fuzzy vague picture of an unpopulated CN6504 SC JTAG /sarcasm - Euss (talk) 03:14, 2 January 2015 (EST)
You're the one with the 24MP camera :D (but seriously now, i just need a picture of the Service Connector in this page)

DECR pinout

CN6504 (JTAG)

Pin Pogo-Pin Con. Name Connected to Function Group
1 - - - - -
2 - - - - -
3 NO +3.3V_EVER DC-DC Regulator +3.3V line -
4 - JRTCK Syscon Return Test Clock Syscon JTAG
5 - JTCK Syscon Test Clock
6 - JTMS Syscon Test Mode Select
7 - JTDO Syscon Test Data Out
8 - JTDI Syscon Test Data In
9 - JNTRST Syscon Test Reset
10 (JL7500) SC_RESET? Syscon System Reset (nSRST)? -

pins are labeled from left to right.

Diag/Backup

Pin Pogo-Pin Con. Name Connected to Function Group
- (JL7401) Backup Mode SysCon Backup Mode -
- (JL7402) Diag Mode SysCon Diagnose Mode -
  • There are 4 traces that lead to L7402 (which is probably related with JL7402)

UART

Pin Pogo-Pin Con. Name Connected to Function Standby Voltage Group
- (JL6839) +3.3V_EVER? DC-DC Regulator +3.3V line 3.3 -
- (JL6838) Rx? Syscon Receive UART 0 Syscon UART
- (JL6837) Tx? Syscon Transfer UART 3.14
- (JL6836) GND? DC-DC Regulator Ground line 0 -

pins are labeled from left to right, Unknown so far, needs testing

Pictures (Traces)

unpopulated connector, near jig-pin machine testpoints for NOR layot 4

In this photo, the unknown testpoint with 3 question marks over the text RY and located in the middle of a wide trace is 3.3V_EVER_A (connected to pin 8 of voltage regulator mitsumi 463A)

http://www.psdevwiki.com/ps3/File:JSD-001_NOR_-_nor_testpoints.png

DECR SYSCON Testpoint Voltages

http://pastie.org/private/9qguibdzfcifmuzutlxg
(as you can see, all JTAG points are voltage active on a standby DECR. we need now to verify on a Test Proto if it's the same.)