Editing Baryon

Baryon is the codename for the PSP Syscon (System Controller) chip. Communication with this chip is done through SPI.

= Versions =

{| class="wikitable" style="text-align: center"
! Version
! Notes
|-
| 0x00020601
| First known version. Found on TMU-001 motherboard.
|-
| 0x00030600
| 
|-
| 0x00040600
| 
|-
| 0x00114000
| 
|-
| 0x00121000
| 
|-
| 0x0022B200
| 
|-
| 0x00234000
| Removed ability to write to battery EEPROM.
|-
| 0x00243000
| 
|-
| 0x00263100
| 
|-
| 0x00285000
| 
|-
| ?0x002A0000?
| From hypothetical TA-094 motherboard.
|-
| 0x002C4000
| 
|-
| 0x002E4000
| 
|-
| 0x00304000
| 
|-
| 0x00403000
| 
|}

= Hardware =

== Hardware versions ==

* Note: You can usually deduce the serial number of the system controller chip on the motherboard when knowing Baryon version. For example, 0x00030600 has the BAR14 labelled chip, while 0x00040600 has the BAR15 labelled chip.

== Talking to Baryon ==

<pre>
TA-086:
- Power from programmer (3.3V)
- X1 OSC 4Mhz
- Cut FLMD0 grounding
========== (Connect) ==========
------ Start(Signature Read) ------
Device name: UPD78F0531
Device data:  10 7F 04 7C
Device end addr: 00003FFF
Security Flag: 00FF (Vulnerable)
Boot Block Number: 003
Firmware Version: 2.00
Signature Read PASS
------ End(Signature Read) ------
========== (Disconnect) ==========


TA-085:
- Power from programmer (3.3V)
- X1 OSC 4Mhz
========== (Connect) ==========
------ Start(Signature Read) ------
Device name: UPD78F0544
Device data:  10 7F 04 7C
Device end addr: 0000BFFF
Security Flag: 00F9
Boot Block Number: 003
Firmware Version: 2.00
Signature Read PASS
------ End(Signature Read) ------
========== (Disconnect) ==========


TA-093:
- Power from programmer (3.3V)
- EXCLK (OCD0B) 4Mhz from Programmer
========== (Connect) ==========
------ Start(Signature Read) ------
Device name: UPD78F0534
Device data:  10 7F 04 7C
Device end addr: 0000BFFF
Security Flag: 00E8
Boot Block Number: 003
Firmware Version: 2.00
Signature Read PASS
------ End(Signature Read) ------
========== (Disconnect) ==========

TA-091:
- Power from programmer (3.3V)
- EXCLK (OCD0B) 4Mhz from Programmer
- Remove RxD/TxD resistors
========== (Connect) ==========
------ Start(Signature Read) ------
Device name: UPD78F0544
Device data:  10 7F 04 7C
Device end addr: 0000BFFF
Security Flag: 00F9
Boot Block Number: 003
Firmware Version: 2.00
Signature Read PASS
------ End(Signature Read) ------
========== (Disconnect) ==========


TA-090:
========== (Connect) ==========
------ Start(Signature Read) ------
Device name: UPD78F0534
Device data:  10 7F 04 7C
Device end addr: 0000BFFF
Security Flag: 00F9
Boot Block Number: 003
Firmware Version: 2.00
Signature Read PASS
------ End(Signature Read) ------
========== (Disconnect) ==========

</pre>

== Hardware Signature (3AXX) ==

<pre>
02 13 10 7f 04 7c 7f 7f 02 c4 37 38 46 b0 b5 b3 34 20 20 79 03 5d 03
</pre>

== Meaning ==

<pre>
10 Vendor (Renessas)
7F Extension code (fixed in 78K0/Kx2)
04 Function information (fixed in 78K0/Kx2)
7C Device Extension code (fixed in 78K0/Kx2)
7F 7F 02 Internal flash memory last address (extracted from the lower bytes)  (0xBFFF) (48KB) (Note 2)
C4 37 38 46 B0 B5 B3 34 20 20 Device name (D78F0534  )
79 Security flag information (odd parity bit so 0xF9) (Note 3)
03 Boot block number (fixed)
</pre>

=== Notes ===

<pre>
Note 2.
The parity calculation for the END field is performed as follows (when the last address is 005FFFH) 
 
<1> The END field is divided in 7-bit units from the lower digit (the higher 3 bits are discarded). 
 
    0  0     5 F     F F 00000000 01011111 11111111  ↓  000  0000001  0111111  1111111 
 
<2> The odd parity bit is appended to the highest bit. 
 
    p0000001  p01111111  p1111111 (p = odd parity bit)  = 0000001  10111111  01111111  = 01 BF 7F 
 
<3> The order of the higher, middle, and lower bytes is reversed, as follows.    7F BF 01 
 
CHAPTER  5   DESCRIPTION  OF  COMMAND  PROCESSING 
Application Note  U17739EJ2V0AN 50 
  The following shows the procedure to translate the values in the END field that has been sent from the microcontroller to the actual address. 
 
<1> The order of the higher, middle, and lower bytes is reversed, as follows. 
 
 7F BF 01       ↓  01 BF 7F 
 
<2> Checks that the number of “1” is odd in each byte (this can be performed at another timing). 
 
<3> The parity bit is removed and a 3-bit 0 is added to the highest bit. 
 
 01 BF 7F       ↓  00000001  10111111  01111111       ↓  0000001    0111111  1111111       ↓  000  0000001  0111111  1111111 
 
<4> The values are translated into groups in 8-bit units. 
 
 00000000101111111111111       ↓  00000000  01011111  11111111       ↓  =     0     0       5     F       F     F 
 
  If “7F BF 01” is given to the END field, the actual last address is consequently 005FFFH. 
</pre>

<pre>
Note 3. When security flag information is set using the Security Set command, the highest bit is fixed to “1”.  If the security flag information is read using the Silicon Signature command, however, the highest bit is the odd parity. 
</pre>

== Hardware Revision (3AXX) ==

<pre>
D78F0534
</pre>

* custom BGA 78K0/KE2
* 48 KB FLASH
* 1KB RAM
* 4 MHz
* Multiplier x1
* UART-X1-OSC
* If 64 Pin, REGC Connected to VDD (for some odd reason)

= Pictures =

<imgur w="500">32tdUCq.png</imgur>
<imgur w="500">YphArDh.png</imgur>
<imgur w="500">Bu2tbIC.png</imgur>

= Notes on TA-086 psp syscon firmware =

* Sbox at 0x3E00 (size 0x100)

* Keys at 0x3F00 (size 0xC0)

* Syscon Version at 0x3FC0 size 4 endian swapped (Baryon:0×00121000)

* Syscon Build Date at 0x3FC4 size 0x1C ($Date: 2005/12/20 05:58:05 $)