Talk:Syscon Hardware: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
m (→‎Packets, Lovely Packets: Next time, use tables :))
Line 192: Line 192:
==== Packets, Lovely Packets ====
==== Packets, Lovely Packets ====


<pre>
{| class="wikitable sortable"
Command             Address     Permission Sub-Commands/Params Function
|-
becount             0xCA7D       0xDD0C0000 - Display bringup/shutdown count + Power-on time
! Command !! Address !! Perms !! SubCommands !! Description
bepgoff             0xA4E7       0xD00C0000 - BE power grid off
|-
bepkt               0x2435D     0xDC0C0000 show Packet permissions
|becount || 0xCA7D || 0xDD0C0000|| - || Display bringup/shutdown count + Power-on time
set
|-
unset
|bepgoff || 0xA4E7 || 0xD00C0000|| - || BE power grid off
mode
|-
debug
|bepkt ||  0x2435D ||  0xDC0C0000 || show/set/unset/mode/debug/help || Packet permissions
help
|-
bestat               0xD413       0xFD0F0000 - Get status of BE
|bestat ||  0xD413 || 0xFD0F0000|| - || Get status of BE
boardconfig         0x99C7       0xDC0C0000 - Displays board configuration (NOT WORKING?)
|-
bootbeep             0x1EA67     0xF0000000 stat Boot beep
|boardconfig ||    0x99C7 || 0xDC0C0000|| - || Displays board configuration (NOT WORKING?)
on
|-
off
|bootbeep || 0x1EA67 ||  0xF0000000 || stat/on/off ||  Boot beep
bringup             0xD597       0xFD0F0000 - Turn PS3 on
|-
bsn                 0xD805       0xF00F0000 - Get board serial number
|bringup || 0xD597 || 0xFD0F0000|| - || Turn PS3 on
bstatus             0x24269     0xDD0C0000 - HDMI related status
|-
buzz                 0xA4FF       0xDC0C0000 [freq] Activate buzzer
|bsn || 0xD805 || 0xF00F0000|| - || Get board serial number
buzzpattern         0xA8B7       0xDC0C0000 [freq] [pattern] [count] Buzzer pattern
|-
clear_err           0x2595B     0xDD0C0000 last Clear errors
|bstatus || 0x24269 ||  0xDD0C0000|| - || HDMI related status
eeprom
|-
all
|buzz ||    0xA4FF || 0xDC0C0000 || [freq] || Activate buzzer
clearerrlog         0xB8CB       0xDD0C0000 - Clears error log
|-
comm                 0x9919       0xDC0C0000 - Communication mode
|buzzpattern ||    0xA8B7 || 0xDC0C0000 || [freq] [pattern] [count] || Buzzer pattern
commt               0x24907     0xDC0C0000 help Manual BE communication
|-
start
|clear_err || 0x2595B ||  0xDD0C0000 || last/eeprom/all ||  Clear errors
stop
|-
send
|clearerrlog ||    0xB8CB || 0xDD0C0000|| - || Clears error log
cp                   0x1E077     0xF0000000 ready CP control commands
|-
busy
|comm ||    0x9919 || 0xDC0C0000|| - || Communication mode
reset
|-
beepremote
|commt ||  0x24907 ||  0xDC0C0000 || help/start/stop/send ||  Manual BE communication
beep2kn1n3
|-
beep2kn2n3
|cp || 0x1E077 ||  0xF0000000 || ready/busy/reset/beepremote/beep2kn1n3/beep2kn2n3 || CP control commands
csum                 0xD687       0xFF0F0000 - Firmware checksum
|-
devpm               0xD053       0xDD0C0000 ata/pci/pciex/rsx Device power management
|csum ||    0xD687 || 0xFF0F0000|| - || Firmware checksum
diag                 0x9AAD       0xD00C0000 ... Diag (execute without param to show help) (NOT WORKING?)
|-
disp_err             0x25911     0xDD0C0000 - Displays errors
|devpm ||  0xD053 || 0xDD0C0000 || ata/pci/pciex/rsx || Device power management
duty                 0x9B23       0xDD0C0000 get/set Fan policy
|-
get/setmin
|diag ||    0x9AAD || 0xD00C0000 || ... || Diag (execute without param to show help) (NOT WORKING?)
get/setmax
|-
get/setinimin
|disp_err ||0x25911 ||  0xDD0C0000|| - || Displays errors
get/setinimax
|-
dve                 0x2995D     0xDC0C0000 help DVE chip parameters
|duty ||    0x9B23 || 0xDD0C0000 || get/set/getmin/setmin/getmax/setmax/getinmin/setinmin/getinmax/setinmax ||  Fan policy
set
|-
save
|dve || 0x2995D ||  0xDC0C0000 || help/set/save/show || DVE chip parameters
show
|-
eepcsum             0xAA65       0xDD0C0000 - Does nothing
|eepcsum || 0xAA65 || 0xDD0C0000|| - || Does nothing
eepromcheck         0x9A1D       0x000C0000 [id] Check eeprom
|-
eeprominit           0x9A65       0x000C0000 [id] Init eeprom
|eepromcheck ||    0x9A1D || 0x000C0000 || [id] || Check eeprom
ejectsw             0xD611       0xFD0F0000 - Eject switch
|-
errlog               0xB7ED       0xFF0C0000 - Gets the error log
|eeprominit || || 0x9A65 || 0x000C0000 || [id] || Init eeprom
fancon               0xD26D       0x0D000000 - Does nothing
|-
fanconautotype       0xC075       0xDD0C0000 - Does nothing
|ejectsw || 0xD611 || 0xFD0F0000|| - || Eject switch
fanconmode           0xBF35       0xDD0C0000 get Fan control mode
|-
fanconpolicy         0xBBC9       0xDD0C0000 get/set Fan control policy
|errlog ||  0xB7ED || 0xFF0C0000|| - || Gets the error log
getini/setini
|-
fandiag             0x1E91B     0xF0000000 - Fan test
|fancon ||  0xD26D || 0x0D000000|| - || Does nothing
faninictrl           0xD3D9       0x0D000000 - Does nothing
|-
fanpol               0xCA31       0xDD0C0000 - Does nothing
|fanconautotype || 0xC075 || 0xDD0C0000|| - || Does nothing
fanservo             0xBF29       0xDD0C0000 - Does nothing
|-
fantbl               0xC087       0xDD0C0000 get/set Fan table
|fanconmode || 0xBF35 || 0xDD0C0000 || get || Fan control mode
getini/setini
|-
getselect/setselect
|fanconpolicy ||  0xBBC9 || 0xDD0C0000 || get/set/getini/setini || Fan control policy
firmud               0xD61D       0xFDFF0000 - Firmware update
|-
geterrlog           0xB84F       0xDD0C0000 [id] Gets error log
|fandiag || 0x1E91B ||  0xF0000000|| - || Fan test ||
getrtc               0xA6F3       0xDD0C0000 - Gets rtc
|-
halt                 0x1E107     0xF0000000 - Halts syscon
|faninictrl || 0xD3D9 || 0x0D000000|| - || Does nothing
hdmi                 0x29F39     0xDD0C0000 ... HDMI (various commands, use help)
|-
hdmiid               0x29D1D     0xDC0F0000 - Get HDMI id's
|fanpol ||  0xCA31 || 0xDD0C0000|| - || Does nothing
hdmiid2             0x29D81     0xDC0F0000 - Get HDMI id's
|-
hversion             0x2422F     0xDD0C0000 - Platform ID
|fanservo || 0xBF29 || 0xDD0C0000|| - || Does nothing
hyst                 0xAEF5       0xDD0C0000 get/set Temperature zones
|-
getini/setini
|fantbl ||  0xC087 || 0xDD0C0000 || get/set/getini/setini/gettable/settable ||  Fan table
lasterrlog           0xB7FF       0xDD0C0000 - Last error from log
|-
ledmode             0xA80B       0xDC0C0000 [id] [id] Get led mode
|firmud ||  0xD61D || 0xFDFF0000|| - || Firmware update
LS                   0x2421B     0xDD0C0000 - LabStation Mode
|-
ltstest             0xCB97       0xDD0C0000 get/set be/rsx ?Temp related? values
|geterrlog || 0xB84F || 0xDD0C0000 || [id] || Gets error log
osbo                 0x1EA3F     0xF0000000 - Sets 0x2000F60
|-
patchcsum           0xD9F7       0xDD0C0000 - Patch checksum
|getrtc ||  0xA6F3 || 0xDD0C0000|| - || Gets rtc
patchvereep         0xD9B1       0xDD0C0000 - Patch version eeprom
|-
patchverram         0xD965       0xDD0C0000 - Patch version ram
|halt ||    0x1E107 ||  0xF0000000|| - || Halts syscon
poll                 0x240E3     0xDD0C0000 - Poll log
|-
portscan             0xDA0D       0xDD0C0000 [port] Scan port (NOT WORKING?)
|hdmi ||    0x29F39 ||  0xDD0C0000 || ... ||  HDMI (various commands, use help)
powbtnmode           0xB911       0xDC0C0000 [mode (0/1)] Power button mode
|-
powerstate           0xCE6F       0xDD0C0000 - Get power state
|hdmiid ||  0x29D1D ||  0xDC0F0000|| - || Get HDMI id's
powersw             0xD5F9       0xFD0F0000 - Power switch
|-
powupcause           0xB621       0xDD0C0000 - Power up cause
|hdmiid2 || 0x29D81 ||  0xDC0F0000|| - || Get HDMI id's
printmode           0x99D9       0xDC0C0000 [mode (0/1/2/3)] Set printmode
|-
printpatch           0xD94F       0xDD0C0000 - Prints patch
|hversion || 0x2422F ||  0xDD0C0000|| - || Platform ID
r                   0x8CA5       0xDD0C0000 [offset] [length] Read byte from SC
|-
r16                 0x8ED5       0xDD0C0000 [offset] [length] Read word from SC
|hyst ||    0xAEF5 || 0xDD0C0000 || get/set/getini/setini || Temperature zones
r32                 0x9191       0xDD0C0000 [offset] [length] Read dword from SC
|-
r64                 0x935D       0xDD0C0000 [offset] [length] Read qword from SC
|lasterrlog || 0xB7FF || 0xDD0C0000|| - || Last error from log
r64d                 0x948F       0xDD0C0000 [offset] [length] Read ?qword data? from SC
|-
rbe                 0x96F9       0xDD0C0000 [offset] Read from BE
|ledmode || 0xA80B || 0xDC0C0000 || [id] [id] ||  Get led mode
recv                 0x24135     0xDD0C0000 - Receive something
|-
resetsw             0xD605       0xFC0F0000 - Reset switch
|LS || 0x2421B ||  0xDD0C0000|| - || LabStation Mode
restartlogerrtoeep  0xB903       0xDD0C0000 - Reenable error logging to eeprom
|-
revision             0xD7E1       0xFFFF0000 - Get softid
|ltstest || 0xCB97 || 0xDD0C0000 || get/set be/rsx ||  ?Temp related? values
rrsxc               0xD313       0xDD0C0000 [offset] [length] Read from RSX
|-
rtcreset             0xA7BB       0x000C0000 - Reset RTC
|osbo ||    0x1EA3F ||  0xF0000000|| - || Sets 0x2000F60
scagv2               0xE24F       0xFF000000 - Auth related?
|-
scasv2               0xE207       0xDD000000 - Auth related?
|patchcsum ||  0xD9F7 || 0xDD0C0000|| - || Patch checksum
scclose             0xE1EF       0xFF000000 - Auth related?
|-
scopen               0xE121       0xFF000000 - Auth related?
|patchvereep ||    0xD9B1 || 0xDD0C0000|| - || Patch version eeprom
send                 0x2416F     0xDD0C0000 [variable] Send something
|-
shutdown             0xD5C5       0xFD0F0000 - PS3 shutdown
|patchverram ||    0xD965 || 0xDD0C0000|| - || Patch version ram
startlogerrtsk       0xB8E7       0xDD0C0000 - Start error log task
|-
stoplogerrtoeep     0xB8F5       0xDD0C0000 - Stop error logging to eeprom
|poll ||    0x240E3 ||  0xDD0C0000|| - || Poll log
stoplogerrtsk       0xB8D9       0xDD0C0000 - Stop error log task
|-
syspowdown           0xB6E9       0xDD0C0000 3 params System power down
|portscan || 0xDA0D || 0xDD0C0000 || [port] || Scan port (NOT WORKING?)
task                 0x15005     0xDD0C0000 - Print tasks
|-
thalttest           0xD813       0x000F0000 - Does nothing
|powbtnmode || 0xB911 || 0xDC0C0000 || [mode (0/1)] || Power button mode
thermfatalmode       0xCA3B       0xDD0C0000 canboot/cannotboot Set thermal boot mode
|-
therrclr             0xD3E5       0xDD0C0000 - Thermal register clear
|powerstate || 0xCE6F || 0xDD0C0000|| - || Get power state
thrm                 0xBF1D       0xDD0C0000 - Does nothing
|-
tmp                 0xAA69       0xDD0C0000 [zone] Get temperature
|powersw || 0xD5F9 || 0xFD0F0000|| - || Power switch
trace               0xB951       0xDD0C0000 ... Trace tasks (use help)
|-
trp                 0xAB2F       0xDD0C0000 get/set Temperature zones
|powupcause || 0xB621 || 0xDD0C0000|| - || Power up cause
getini/setini
|-
tsensor             0xA279       0xDD0C0000 [sensor] Get raw temperature
|printmode || 0x99D9 || 0xDC0C0000 || [mode (0/1/2/3)] || Set printmode
tshutdown           0xB2A1       0xDD0C0000 get/set Thermal shutdown
|-
getini/setini
|printpatch || || 0xD94F || 0xDD0C0000|| - || Prints patch
tshutdowntime       0xC95D       0xDD0C0000 [time] Thermal shutdown time
|-
tzone               0xB5E1       0xDD0C0000 - Show thermal zones
|r || 0x8CA5 || 0xDD0C0000 || [offset] [length] ||  Read byte from SC ||  ||
version             0xD65F       0xFFFF0000 - SC firmware version
|-
w                   0x8BF9       0xDD0C0000 [offset] [value] Write byte to SC
|r16 || 0x8ED5 || 0xDD0C0000 || [offset] [length] ||  Read word from SC ||
w16                 0x8E2D       0xDD0C0000 [offset] [value] Write word to SC
|-
w32                 0x8FED       0xDD0C0000 [offset] [value] Write dword to SC
|r32 || 0x9191 || 0xDD0C0000 || [offset] [length] ||  Read dword from SC ||
w64                 0x92A9       0xDD0C0000 [offset] [value] Write qword to SC
|-
wbe                 0x9665       0xDD0C0000 [offset] [value] Write to BE
|r64 || 0x935D || 0xDD0C0000 || [offset] [length] || Read qword from SC  
wmmto               0xCB3B       0xDC0C0000 get Get watch dog timeout
|-
wrsxc               0xD279       0xDD0C0000 [offset] [value] Write to RSX
|r64d ||    0x948F || 0xDD0C0000 || [offset] [length] ||  Read ?qword data? from SC
xdrdiag             0x1E711     0xF0000000 start XDR diag
|-
info
|rbe || 0x96F9 || 0xDD0C0000 || [offset] ||  Read from BE
result
|-
xiodiag             0x1E875     0xF0000000 - XIO diag
|recv ||    0x24135 ||  0xDD0C0000|| - || Receive something
xrcv                 0x25313     0xDC0C0000 - Xmodem receive
|-
</pre>
|resetsw || 0xD605 || 0xFC0F0000|| - || Reset switch
|-
|restartlogerrtoeep  0xB903 || 0xDD0C0000|| - || Reenable error logging to eeprom
|-
|revision || ||  0xD7E1 || 0xFFFF0000|| - || Get softid
|-
|rrsxc ||  0xD313 || 0xDD0C0000 || [offset] [length] || Read from RSX ||
|-
|rtcreset || ||  0xA7BB || 0x000C0000|| - || Reset RTC
|-
|scagv2 ||  0xE24F || 0xFF000000|| - || Auth related?
|-
|scasv2 ||  0xE207 || 0xDD000000|| - || Auth related?
|-
|scclose || 0xE1EF || 0xFF000000|| - || Auth related?
|-
|scopen ||  0xE121 || 0xFF000000|| - || Auth related?
|-
|send ||    0x2416F ||  0xDD0C0000 || [variable] || Send something
|-
|shutdown ||0xD5C5 || 0xFD0F0000|| - || PS3 shutdown
|-
|startlogerrtsk || 0xB8E7 || 0xDD0C0000|| - || Start error log task
|-
|stoplogerrtoeep ||  0xB8F5 || 0xDD0C0000|| - || Stop error logging to eeprom
|-
|stoplogerrtsk ||  0xB8D9 || 0xDD0C0000|| - || Stop error log task
|-
|syspowdown ||0xB6E9 || 0xDD0C0000 || 3 params || System power down
|-
|task ||    0x15005 ||  0xDD0C0000|| - || Print tasks
|-
|thalttest || 0xD813 || 0x000F0000|| - || Does nothing
|-
|thermfatalmode || 0xCA3B || 0xDD0C0000 || canboot/cannotboot || Set thermal boot mode
|-
|therrclr || 0xD3E5 || 0xDD0C0000|| - || Thermal register clear
|-
|thrm ||    0xBF1D || 0xDD0C0000|| - || Does nothing
|-
|tmp ||0xAA69 || 0xDD0C0000 || [zone] ||  Get temperature
|-
|trace ||  0xB951 || 0xDD0C0000 || ... ||  Trace tasks (use help)
|-
|trp ||0xAB2F || 0xDD0C0000 || get/set/getini/setini ||  Temperature zones
|-
|tsensor || 0xA279 || 0xDD0C0000 || [sensor] ||  Get raw temperature
|-
|tshutdown || 0xB2A1 || 0xDD0C0000 || get/set/getini/setini ||  Thermal shutdown
|-
|tshutdowntime ||  0xC95D || 0xDD0C0000 || [time] ||  Thermal shutdown time
|-
|tzone ||  0xB5E1 || 0xDD0C0000|| - || Show thermal zones
|-
|version || 0xD65F || 0xFFFF0000|| - || SC firmware version
|-
|w ||0x8BF9 || 0xDD0C0000 || [offset] [value] ||  Write byte to SC
|-
|w16 ||0x8E2D || 0xDD0C0000 || [offset] [value] ||  Write word to SC
|-
|w32 ||0x8FED || 0xDD0C0000 || [offset] [value] ||  Write dword to SC
|-
|w64 ||0x92A9 || 0xDD0C0000 || [offset] [value] ||  Write qword to SC
|-
|wbe ||0x9665 || 0xDD0C0000 || [offset] [value] ||  Write to BE
|-
|wmmto ||  0xCB3B || 0xDC0C0000 || get ||  Get watch dog timeout
|-
|wrsxc ||  0xD279 || 0xDD0C0000 || [offset] [value] ||  Write to RSX
|-
|xdrdiag || 0x1E711 ||  0xF0000000 || start/info/result ||  XDR diag
|-
|xiodiag || 0x1E875 ||  0xF0000000|| - || XIO diag
|-
|xrcv ||    0x25313 ||  0xDC0C0000|| - || Xmodem receive
|-
|}

Revision as of 10:26, 5 October 2019

Problem with syscon pinout numeration in wiki in the SWX-xxx series (128 pins package)

In all the SWX-xxx series pages the pinout is numered starting with the pin1 at bottom-left corner (when viewing the syscon in the same orientation than the printed texts) this way:

  • """pin 1 left bottom at mark, counter clockwise from south (pins 1-38) to east (pins 39-64), north (pins 65-102), west (103-128))"""

In the first SW series is barelly visible (in the photos it looks is not marked) but in newer series is more visible, and is located at bottom-rigth corner, see this photos i marked: http://666kb.com/i/cnj3qic8k412x3p8r.jpg

  • All photos are taken from wiki visibles in his respective pages... look for the original photo to see it in better resolution (when posible because there are not much photos of syscons in wiki or internet)

If this is correct, is needed to change the info about the pinout in all the affected pinout tables (in all SWX-xxx pages)

PowerON/off HDMI/CEC, WiFi, Bluetooth, GbLAN, buttons etc

There is no seperate communication processor on the PS3. Powering is handled by syscon.

  • Power and eject buttons/switchs are connected with syscon (indirectly), there is no protocol involved, the syscon pins related with this buttons has 2 posible states: 3.3v (when button is not pressed)... or 0v (when button is pressed)

Multipage Correction

<TizzyT> eussnl my syscon is CXR714120-301GB its different form what the wiki says
CECHH / DIA-001

Package

http://pastie.org/private/tkcfjwit37huzyzoie7z5g BGA

ball count: 4x16 + 8x14 + 2x12 = 64+112+24 = 200 pads

new QF package is 26 * 38 = 128 pins

Clocks

SysCon clocks: 

T4 XTAL / T5 EXTAL goes to [X4001] of 16.9344 MHz
C16 OSCIN / B16 OSCOUT goes to [X4002] of 32.768 kHz

http://oi52.tinypic.com/2s9ziw0.jpg

Backup Mode / Diag

BACKUP_MODE / DIAG_MODE pins on Gen 2 might be pins 110 and 111. They are pulled low. Not completely sure, but looking at those pins in relation to what's around them seems like it could be those two.

SEM-001 CECHG 

Pink is N15 BACKUP_MODE
Blue is N16 DIAG_MODE

picture: http://psx-scene.com/forums/attachments/f149/26456d1300550098-brick-recovery-research-untitled-1.jpg source: http://psx-scene.com/forums/780185-post344.html !unverified!

According to schematics, DIAG and BACKUP_MODE are are shown in the following picture for COK-001 and COK-002 Motherboards - http://goput.it/69k.jpg These pins are tied to 3.3v so grounding them should enable each mode respectively. !unverified!

SoftID

Note: moved from seperate page, as there are already over 8 different syscon pages and the very same info is mention in depth on the SC firmware and SC hardware page (and in 150 wiki edits on the sysinfo page :/) we dont have a sperate page for every SELF flag either ;) (although there are >4 pages describing SELF :/)

a SoftID is just a 0x4 code that tells you the hardware revision of the syscon.
This info can be get through the More System Information method.
You can find them also inside the SYS_CON_FIRMWARE_*********.pkg (Syscon_Firmware) at the offset 0x28E (In this link you can found the list of the Syscon update packages)
every SoftID is associated with the ps3 mainboard. this means that you can know if a SC is compatible with your board without opening a PS3 ( Syscon Hardware)

SoftID SC Generation notes
Phats
0B8E 1 -
0C16 2 -
0D52 3 -
0DBF 4 -
0E69 5 -
0F29 6 -
0F38 7 -
065D 8 -
Slims
0832 9 -
08C2 10 -
0918 11 -

Datasheet of SoC similar to syscon

COK-002 with 0DBF syscon

Information: https://lh5.googleusercontent.com/-UiaHRjhdt50/UesKSGuxdFI/AAAAAAAAGOU/0FV8Fazyl60/s800/TV2013072019053700.jpg

Min ver: https://lh5.googleusercontent.com/-iUOuidm6v3g/UexEQily6TI/AAAAAAAAGOk/zSfBMpYDRAM/s800/TV2013072117272000.jpg

Board type: https://lh6.googleusercontent.com/-K1sc66WzJxo/Ue1Mdr5mHeI/AAAAAAAAGO8/rnqlidQAVfY/s800/DSC01591.JPG

Syscon: https://lh6.googleusercontent.com/-OTxjx3qJV0M/Ue1L2itOfRI/AAAAAAAAGO0/Bv6zli_xQQg/s800/DSC01590.JPG


Talk

-This breaks lot of standards/pages/tables in wiki, can you add some notes please ?. E.g: the board came from official repair service, bought in a normal shop, or is a frankenstein made at home ?, it boots correctly and allows firmware updates ?. If it works normally i think this proves CXR713120-20xGB and CXR714120-30xGB shares the same pinout, but the fact that is using 0DBF SoftID is a bit shocking (maybe because is the minimal SoftID allowed by CXR714120-30xGB ?... check SoftID examples in this table) --Sandungas 22:07, 24 July 2013 (MSK)

-The console is a CECHE01 MG (Metal Gear Solid 4 edition) and came with a 3rd generation BD drive (the first type with 2 lens). It had never been to SONY for service. It works normally, correctly and as you could see, has a minimum version which is compatible with the motherboard type. --l_oliveira


SHA1 hashes stored at eeprom

from http://www.edepot.com/playstation3.html

"Files finally stored into the FLASH regions have their associated SHA-1 hash value stored in the SYSCON EEPROM for authentication and verification purposes. "

What happens if we change those hashes to something a 3.55 ofw would have? (assuming we were doing this experiment on a hackable console?)

PS2 Mechacon vs PSP Syscon vs PS3 Syscon vs Vita Syscon vs PS4 Syscon

Production Start Date (<=) PS2 Mechacon PSP Syscon PS3 Syscon Vita Syscon PS4 Syscon Used IC/CPU Core
10/1999 CXP101064 - - - - Sony SPC970 (100 pin)
01/2000 CXP102064 - - - -
09/2000 CXP103049 - - - - Sony SPC??? (136 pin)
08/2004 - BARxx - - - NEC D790019 / D780032AY (78K0/78003xA, 64 pin)
07/2005 - B30x - - - NEC D79F0036 / D78F????? (78K0/KE2, 64 pin)
07/2007 - B40x - - - NEC D79F???? / D78F????? (78K0/???, 84 pin)
07/2008 - 3Axx - - - NEC D79F???? / D78F????? (78K0/???, ?? pin)
03/2009 - 3Bxx - - - NEC D79F???? / D78F????? (78K0/???, ?? pin)
05/2009 - 40xx - - - NEC D79F???? / D78F????? (78K0/???, ?? pin)
03/2003 CXR706080 - - - - Sony SR11
PS2 (Dragon): 164 pin
PS3 (Donkey): 200 pin
09/2004 CXR716080 - CXR713120 - -
07/2007 CXR726080 - CXR714120 - -
03/2008 - - SW - - NEC D79F0073 / D78F11AA (78K0R/KH3, 128 pin)
05/2009 - - SW2 - - NEC D79F0086 / D78F11BB (78K0R/KH3, 128 pin)
07/2010 - - - "SC" - NEC D79F0109 / D78F???? (78K0R/???, 121 pin)
06/2011 - - SW3 - - NEC D79F0123 / D78F11CC (78K0R/KG3, 100 pin)
07/2013 - - - - C0L Renesas R5F100PL (RL78/G13, 100 pin)
08/2013 - - - A0xxx - Renesas ?R5F120PL? (RL78/???, ?100? pin)
04/2015 - - - - C0L2 Renesas R5F101LL (RL78/G13, 64 pin)
  • The SPC900 core was designed by Texas Instruments [[1]]
  • CXP101064, CXP102064 are similar to CXP97 (CXP971000, CXP972032, CXP973064, CXP973F064)
    • In-Circuit-Emulator: Mitek NICE-SPC970 [[2]]; Debug software: SVD970; Flash programmer: SFP-2
  • A F inside the model name specifies if the IC contains flash memory.
    • Mass-produced units don't have/use program flash memory, instead a encrypted firmware patch is stored on the data-"EEPROM"
  • CXR7 series uses Sony SR11 CPU (ARM7TDMI)
    • Models with public datasheet: CXR702080, CXR702F080, CXR704060
    • Maybe based on the Texas Instruments TMS470R1 series (derived from TMS470R1B512 ?)
  • Prototype PS3 Syscon's:

Packets, Lovely Packets

Command Address Perms SubCommands Description
becount 0xCA7D 0xDD0C0000 - Display bringup/shutdown count + Power-on time
bepgoff 0xA4E7 0xD00C0000 - BE power grid off
bepkt 0x2435D 0xDC0C0000 show/set/unset/mode/debug/help Packet permissions
bestat 0xD413 0xFD0F0000 - Get status of BE
boardconfig 0x99C7 0xDC0C0000 - Displays board configuration (NOT WORKING?)
bootbeep 0x1EA67 0xF0000000 stat/on/off Boot beep
bringup 0xD597 0xFD0F0000 - Turn PS3 on
bsn 0xD805 0xF00F0000 - Get board serial number
bstatus 0x24269 0xDD0C0000 - HDMI related status
buzz 0xA4FF 0xDC0C0000 [freq] Activate buzzer
buzzpattern 0xA8B7 0xDC0C0000 [freq] [pattern] [count] Buzzer pattern
clear_err 0x2595B 0xDD0C0000 last/eeprom/all Clear errors
clearerrlog 0xB8CB 0xDD0C0000 - Clears error log
comm 0x9919 0xDC0C0000 - Communication mode
commt 0x24907 0xDC0C0000 help/start/stop/send Manual BE communication
cp 0x1E077 0xF0000000 ready/busy/reset/beepremote/beep2kn1n3/beep2kn2n3 CP control commands
csum 0xD687 0xFF0F0000 - Firmware checksum
devpm 0xD053 0xDD0C0000 ata/pci/pciex/rsx Device power management
diag 0x9AAD 0xD00C0000 ... Diag (execute without param to show help) (NOT WORKING?)
disp_err 0x25911 0xDD0C0000 - Displays errors
duty 0x9B23 0xDD0C0000 get/set/getmin/setmin/getmax/setmax/getinmin/setinmin/getinmax/setinmax Fan policy
dve 0x2995D 0xDC0C0000 help/set/save/show DVE chip parameters
eepcsum 0xAA65 0xDD0C0000 - Does nothing
eepromcheck 0x9A1D 0x000C0000 [id] Check eeprom
eeprominit 0x9A65 0x000C0000 [id] Init eeprom
ejectsw 0xD611 0xFD0F0000 - Eject switch
errlog 0xB7ED 0xFF0C0000 - Gets the error log
fancon 0xD26D 0x0D000000 - Does nothing
fanconautotype 0xC075 0xDD0C0000 - Does nothing
fanconmode 0xBF35 0xDD0C0000 get Fan control mode
fanconpolicy 0xBBC9 0xDD0C0000 get/set/getini/setini Fan control policy
fandiag 0x1E91B 0xF0000000 - Fan test
faninictrl 0xD3D9 0x0D000000 - Does nothing
fanpol 0xCA31 0xDD0C0000 - Does nothing
fanservo 0xBF29 0xDD0C0000 - Does nothing
fantbl 0xC087 0xDD0C0000 get/set/getini/setini/gettable/settable Fan table
firmud 0xD61D 0xFDFF0000 - Firmware update
geterrlog 0xB84F 0xDD0C0000 [id] Gets error log
getrtc 0xA6F3 0xDD0C0000 - Gets rtc
halt 0x1E107 0xF0000000 - Halts syscon
hdmi 0x29F39 0xDD0C0000 ... HDMI (various commands, use help)
hdmiid 0x29D1D 0xDC0F0000 - Get HDMI id's
hdmiid2 0x29D81 0xDC0F0000 - Get HDMI id's
hversion 0x2422F 0xDD0C0000 - Platform ID
hyst 0xAEF5 0xDD0C0000 get/set/getini/setini Temperature zones
lasterrlog 0xB7FF 0xDD0C0000 - Last error from log
ledmode 0xA80B 0xDC0C0000 [id] [id] Get led mode
LS 0x2421B 0xDD0C0000 - LabStation Mode
ltstest 0xCB97 0xDD0C0000 get/set be/rsx ?Temp related? values
osbo 0x1EA3F 0xF0000000 - Sets 0x2000F60
patchcsum 0xD9F7 0xDD0C0000 - Patch checksum
patchvereep 0xD9B1 0xDD0C0000 - Patch version eeprom
patchverram 0xD965 0xDD0C0000 - Patch version ram
poll 0x240E3 0xDD0C0000 - Poll log
portscan 0xDA0D 0xDD0C0000 [port] Scan port (NOT WORKING?)
powbtnmode 0xB911 0xDC0C0000 [mode (0/1)] Power button mode
powerstate 0xCE6F 0xDD0C0000 - Get power state
powersw 0xD5F9 0xFD0F0000 - Power switch
powupcause 0xB621 0xDD0C0000 - Power up cause
printmode 0x99D9 0xDC0C0000 [mode (0/1/2/3)] Set printmode
printpatch 0xD94F 0xDD0C0000 - Prints patch
r 0x8CA5 0xDD0C0000 [offset] [length] Read byte from SC
r16 0x8ED5 0xDD0C0000 [offset] [length] Read word from SC
r32 0x9191 0xDD0C0000 [offset] [length] Read dword from SC
r64 0x935D 0xDD0C0000 [offset] [length] Read qword from SC
r64d 0x948F 0xDD0C0000 [offset] [length] Read ?qword data? from SC
rbe 0x96F9 0xDD0C0000 [offset] Read from BE
recv 0x24135 0xDD0C0000 - Receive something
resetsw 0xD605 0xFC0F0000 - Reset switch
restartlogerrtoeep 0xB903 0xDD0C0000 - Reenable error logging to eeprom
revision 0xD7E1 0xFFFF0000 - Get softid
rrsxc 0xD313 0xDD0C0000 [offset] [length] Read from RSX
rtcreset 0xA7BB 0x000C0000 - Reset RTC
scagv2 0xE24F 0xFF000000 - Auth related?
scasv2 0xE207 0xDD000000 - Auth related?
scclose 0xE1EF 0xFF000000 - Auth related?
scopen 0xE121 0xFF000000 - Auth related?
send 0x2416F 0xDD0C0000 [variable] Send something
shutdown 0xD5C5 0xFD0F0000 - PS3 shutdown
startlogerrtsk 0xB8E7 0xDD0C0000 - Start error log task
stoplogerrtoeep 0xB8F5 0xDD0C0000 - Stop error logging to eeprom
stoplogerrtsk 0xB8D9 0xDD0C0000 - Stop error log task
syspowdown 0xB6E9 0xDD0C0000 3 params System power down
task 0x15005 0xDD0C0000 - Print tasks
thalttest 0xD813 0x000F0000 - Does nothing
thermfatalmode 0xCA3B 0xDD0C0000 canboot/cannotboot Set thermal boot mode
therrclr 0xD3E5 0xDD0C0000 - Thermal register clear
thrm 0xBF1D 0xDD0C0000 - Does nothing
tmp 0xAA69 0xDD0C0000 [zone] Get temperature
trace 0xB951 0xDD0C0000 ... Trace tasks (use help)
trp 0xAB2F 0xDD0C0000 get/set/getini/setini Temperature zones
tsensor 0xA279 0xDD0C0000 [sensor] Get raw temperature
tshutdown 0xB2A1 0xDD0C0000 get/set/getini/setini Thermal shutdown
tshutdowntime 0xC95D 0xDD0C0000 [time] Thermal shutdown time
tzone 0xB5E1 0xDD0C0000 - Show thermal zones
version 0xD65F 0xFFFF0000 - SC firmware version
w 0x8BF9 0xDD0C0000 [offset] [value] Write byte to SC
w16 0x8E2D 0xDD0C0000 [offset] [value] Write word to SC
w32 0x8FED 0xDD0C0000 [offset] [value] Write dword to SC
w64 0x92A9 0xDD0C0000 [offset] [value] Write qword to SC
wbe 0x9665 0xDD0C0000 [offset] [value] Write to BE
wmmto 0xCB3B 0xDC0C0000 get Get watch dog timeout
wrsxc 0xD279 0xDD0C0000 [offset] [value] Write to RSX
xdrdiag 0x1E711 0xF0000000 start/info/result XDR diag
xiodiag 0x1E875 0xF0000000 - XIO diag
xrcv 0x25313 0xDC0C0000 - Xmodem receive
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Talk:Syscon_Hardware&oldid=54677"