Southbridge

PS4 southbridge contains two processors named EMC and EAP on the same die that are mainly used on boot, during rest mode and for servicing.

Components

Southbridge processors

The two processors are on the same die. It is a SoC (System on Chip).

EMC

EMC could stand for External Micro Controller. EMC was named MediaCon by some people when its name was still unknown.

The role of EMC is to load EMC Initial Program Loader, to be an interface for icc for the main APU kernel and Syscon and to offer a debug interface via UART that does not rely on Syscon or main APU. EMC runs its own FreeBSD kernel. It is a Marvell Armada, an ARM-based SoC. Sony stuck a PCIe bridge on it. It exposes ARM peripherals to the x86 side. There is some extra stuff (e.g. HPET, ACPI stuff).

EMC cpuid = 412FC231 (ARM Cortex-M3 r2p1). CPU clock: maybe about 100MHz.

EMC Initial Program Loader

EMC Initial Program Loader is stored encrypted in a SLB2 container in PS4 Serial Flash.

EAP

EAP could stand for External Application Processor.

The role of EAP is to handle media (online Wireless/GbLAN, Bluray Drive and Harddrive) even when the PS4 is in standby mode. EAP runs its own FreeBSD kernel in standby mode, activated to handle tasks such as downloading games updates while the PS4 is in standby.

It handles several tasks to offload the APU:

• Network connections: Wireless and GbLAN, including background downloading and PlayGo
• File handling (Bluray Drive, Harddrive and USB 3.0), including background caching
• Main serial flash handling

EAP consists of Marvell PJ4C B0 rev 1 cores, ARMv7 CORTEX-A8 running FreeBSD 9 kernel. CPU clock: 500MHz. DDR clock: 800MHz.

As EAP Core software is unsigned, unencrypted and easily replaceable on PS4 HDD with a PS4 kernel exploit, it is possible to run homebrew code on EAP processor. See eapdev by Bigboss (psxdev).

EAP Kernel Boot Loader

EAP Kernel Boot Loader is stored encrypted in a SLB2 container in PS4 Serial Flash. The role of EAP Kernel Boot Loader is to decrypt then uncompress the EAP Kernel. The encrypted EAP Kernel is stored at virtual address 0xC1000000 and the decrypted and uncompressed EAP Kernel is located at virtual address 0xC3000000.

EAP Kernel

EAP Kernel is located at virtual address 0xC3000000. Encrypted EAP Kernel is mounted on device da0x2.

EAP Core

EAP Core is the usermode executable running on EAP. It is stored unencrypted in the EAP filesystem in SceEapCore.elf.

Southbridge RAM

Southbridge chip is connected to its own DDR3 SDRAM. It is named "sbram" as in SouthBridge RAM.

PS4 Fat and Slim

PS4 Fat and Slim Southbridge has one Samsung K4B2G1646E-BCK0, K4B2G1646F-BCMA or K4B2G1646Q-BCMA, giving a total of 256MB of memory.

PS4 Pro

PS4 Pro Southbridge has two Samsung K4B4G0846E-BYMA or H5TQ4G83CFR-RDC (K4B4G1646E-BYK0 on PS4 Pro DevKit), giving a total of 1GB of memory.

Serial Flash

Southbridge contains a 256MB Serial flash.

Aeolia has Macronix MX25L25635FMI-10G.

Auxiliary components

Southbridge is connected to the main APU by PCI-Express x4 and to Syscon by SPI.

Aeolia has SATA bridge MB86C311B, GbLAN controller 88EC060-NN82.

Southbridge revisions

There are three major hardware revisions, named Aeolia, Belize and Baikal.

See also Aeolia.

Southbridge revisions per chassis

Model (chassis)	Motherboards	Southbridge Codename	Southbridge Labeling
D1000	All CVN	Aeolia	CXD90025G
1000	All SAA	Aeolia	CXD90025G
1100	All SAB	Aeolia	CXD90025G
1200	All SAC	Belize	CXD90036G
2000	All SAD	Belize	CXD90036G
D7000	All HAC	Belize	CXD90036G
7000	All NVA	Belize / ?Belize 2?	CXD90036G / ?CXD90046GG?
2100	All SAE	Belize 2 / Baikal	CXD90046GG
2200	All SAF	Baikal	CXD90042GG
7100	All NVB	Baikal	CXD90042GG
7200	All NVG	Baikal	CXD90042GG

Motherboards per southbridge revisions

Southbridge Codename	Southbridge Labeling	Motherboards
Aeolia	CXD90025G	CVN-K12 SAA-001 SAB-001
Belize	CXD90036G	SAC-001 SAD-001 SAD-003 HAC-001 NVA-001
Belize 2	CXD90046GG	NVB-003 NVG-001 SAE-001
Baikal	CXD90042GG	NVB-004 SAD-002 SAE-002 SAE-003 SAE-004 SAF-003 SAF-004