Syscon Cb100 Manual

Syscon 1st Generation (BGA Packaging)

Syscon mt8227aaku (bmsl), spi flash w25q32, led display cmi-v390hj1-p02. Login to the service-menu-2008. Supra stv-lc32k800wl (v1m02) main board t.ms18vg.72 t.vst59.a5, syscon tsumv59xe, spi flash w25q32, tuner cdt-3np5 / 1-10, led display lm315ta-t01. Login to the service menu-1147. Supra stv-lc2477fld (v5l09) section tv: main board-cv181l-y. Operator’s Manual This operator’s manual contains all the information you will need to safely and effi-ciently install, start-up, operate and maintain the AO2000 series gas analyzers. This operator’s manual contains information on all the functional units in the gas analyzers. The delivered gas analyzer may differ from the version described. Make sure that this Instruction Manual is always readily available to personnel who use the REX-C100 series. The contents of the Instruction Manual are subject to change without notice. If you have any questions regarding the manual, contact one of our sales people, our nearest sales office, or the place where you have purchased the controller. Panasonic 12 Megapixel Digital Camera DMC-FP1, FP2 Service Manual. Describes how to disassemble and service the camera. Has very much info on repair and set up after installing new main board. Very comprehensive. 4876 kB: 399: Panasonic: DMC-FP1, FP2: bk2syscon.pdf: 20/05/20.

Pyramid Syscon live probing

Syscon is the main power controller chip of the PS3. It is responsible for powering up the various power systems and for configuring and initialising the CELL BE, RSX and South Bridge. It communicates with these devices via separate SPI busses. There is external access by JTAG (disabled from factory on retail models), an EEPROM programming interface and Serial (UART). The Syscon is a SoC and consists of an ARM7TDMI (ARMv4) CPU, a 256KB EEPROM and 16KB RAM.

  • 1Serialnumbers per SKU
  • 2Syscon Externalised Ports
    • 2.1Syscon UART packets
    • 2.2Syscon UART
  • 3Syscon underlying ports

Retail[edit]

ModelProduct Sub CodeMotherboardSyscon
part no.
Syscon
Soft ID
Notes
CECHAxx
CECHBxx
0x01
0x02
COK-001CXR713120-201GB0B8E
CECHCxx
CECHExx
0x03
0x04
COK-002 or
COK-002W
CXR713120-201GB or
CXR713120-202GB
0C16
CECHGxx0x05SEM-001CXR713120-201GB or
CXR713120-202GB or
CXR713120-203GB
0D52
CECHHxx0x06DIA-001CXR714120-301GB0DBF
CECHJxx
CECHKxx
0x07DIA-002CXR714120-301GB or
CXR714120-302GB
0E69
CECHLxx
CECHMxx
CECHPxx
CECHQxx
0x08VER-001SW-301 or
SW-302
065D
CECH-20xx0x09DYN-001SW2-3010832
CECH-21xx0x0ASUR-001SW2-301 or
SW2-302
08A0
CECH-25xx0x0BJTP-001 or
JSD-001
SW2-301 or
SW2-302 or
SW2-303
08C2
CECH-30xx0x0CKTE-001SW2-301 or
SW2-302 or
SW2-303 or
SW3-301
0918
CECH-40xx0x0DMSX-001 or
MPX-001
SW3-302098F
CECH-42xxA?PQX-001SW3-304?

Non retail[edit]

ModelProduct Sub CodeMotherboardSyscon
part no.
Syscon
Soft ID
Active JTAGNotes
CEB-2040-MPU-501CXR713F120GB-000??No?Retail prototype
DECR1000(A/J)0x01TMU-520CXR713F120A03FBNoReference tool
DEH-H1001-D0x01COOKIE-13CXR713F120A0B67NoPreproduction
DEH-H1000A(S)(-E(S))0x01COK-001 (Prototype)CXR713F120A0B67NoPreproduction
DEH-FH1500J-A0x08VERTIGO-02D79F0073 (SW-301)0658?Yes?Preproduction
DEH-ML00AK-G0x0DMPX-001 (Prototype) D79F0123 (SW3-302)098F?No?Preproduction

Not mentioned:

Note: for more specific information per model, see the links to each subpage in the Serialnumbers per SKU table.

Syscon UART packets[edit]

Syscon

SCUART daemon (SCUARTD) packet structure[edit]

SCUARTD packets includes header of 0x3 bytes and optional payload (depending on the command).

Packet IDs are not important, they are used only by clients and processed by SCUART daemon. SCUART daemon opens terminal file /dev/ttyS0 and use it to send commands and receive responses.

OffsetSizeDescription
0x000x01Magic?
0x010x01Payload size
0x020x01Command
0x03Payload sizePayload data

Packets[edit]

Packet IDCommand/ActionDescriptionNotes
0x00versionFirmware versionGets installed syscon's firmware version (Note: backup bank contains version 0.4.5_b4 !! On CEB-2030 it is 0.3.0 )
0x01bringup
0x02shutdown
0x03firmudFirmware updateNotifies about firmware update operation
0x04bsnBoard Serial NumberRetrieves syscon's Board Serial Number
0x05haltUsed at start of firmware update operation
0x06cp ready
0x07cp busy
0x08cp reset
0x09bestatCell B.E. statusRetrieves Cell B.E. status
0x0Apowersw
0x0Bresetsw
0x0Cbootbeep stat
0x0Dbootbeep on
0x0Ebootbeep off
0x0FReset sysconResetResets syscon
0x10xdrdiag infoXDR diagnostics
0x11xdrdiag startXDR diagnosticsStarts XDR diagnostics
0x12xdrdiag resultXDR diagnosticsGets a result of XDR diagnostics
0x13xiodiagXIO diagnosticsStarts XIO diagnostics and gets a result of it
0x14fandiagFan diagnosticsRetrieves RPMs of fans
0x15errlogError logRetrieves a list of codes (with timestamps) of latest errors
0x16Read line
0x17tmpforcp <zone ID>Reference Tool's temperatureGets the temperature of reference tool
0x18Invalid CMDs
0x19
0x1A
0x1B
0x1C
0x1E
0x1F
0x20cp beepremote
0x21cp beep2kn1n3
0x22cp beep2kn2n3
??csumChecksum ??Calculates the Checksum of something (No packet ID listing on scuartd)
??osbo???No idea what this does, but returns when it's sent
??scopenreturns SC_READY or ERROR 1???
??scclose???
??ejectswtoggles eject switch button pressing (3 beeps)

Packets Logs[edit]

Syscon Cb100 Manual
Packet IDCommand/ActionLogsNotes
0x00version
0x01bringup
0x02shutdownReturns (END) if the system is on
0x03firmudThis will brick your SYSCON if you don't feed it any argument or feed to it the wrong argument!
0x04bsnN is digit and A is char (removed for privacy)
0x05halt
0x06cp ready
0x07cp busySTATUS light blinks forever
0x08cp resetNo responseShould reset CP to factory settings
0x09bestat
0x0Apowersw
0x0Bresetsw
0x0Cbootbeep statwhen it's off BOOT BEEP status changes to OFF
0x0Dbootbeep on
0x0Ebootbeep off
0x0FReset syscon
0x10xdrdiag info
0x11xdrdiag start
0x12xdrdiag resultwill return ERROR NOT STARTED if xdrdiag start wasn't run previously
0x13xiodiag
0x14fandiag
0x15errlogbunch of error logs. ends with (END) once they're over
0x16Read line
0x17tmpforcp <zone ID>
0x20cp beepremote
0x21cp beep2kn1n3sends a beep different than SYSCON beep :)
0x22cp beep2kn2n3sends two beeps different than SYSCON beeps :)
??csumdisplays 3 hexadecimal numbers inside rect parenthesis. the numbers are always the same, except when syscon version changes (v1.0.5_c1)
??csumAnother response (v1.0.4_c2)
??csumAnother response (v1.0.4_c1)
??csumAnother response (v1.0.3_c1)
??csumAnother response (v1.0.1_c1)
??csumAnother response (v0.9.14_c1)
??csumAnother response (v0.9.9_c1)
??csumAnother response (v0.8.4_c8)
??osbo
??scopen
??scclose

Notes[edit]

  • Some commands are unavailable on earlier firmwares, for example, tmpforcp is only supported on 1.3.3+.
  • Some commands are divided into several strings, the first part (if exists) describes a command group, the second part describes the actual command and other parts describes command arguments.
  • Real syscon commands have an ASCII form (a bold text in the 2nd column) instead of bytes above.
  • Packet with ID *0x03* notifies syscon and calls SX program (based on ZMODEM protocol) to send firmware, syscon have custom or original implementation of RX program to receive firmware. An implementation of ZMODEM protocol used by Sony: http://oss.sony.net/Products/Linux/Others/Download/DECR-1000/mips_fp_le-lrzsz-0.12.20-devtool.1.src.rpm

A start of syscon's update procedure:

  • A CP development tool includes several scripts which are participated in syscon update procedure. It starts after a CP update via update_syscon.pl perl script.
  • This script checks the current syscon's firmware version. If it is in mask rom then it skips an update procedure, if not it checks major/minor/release parts of both versions and if a new version is applicable then it launches scfirmup utility and pass the firmware file path as an argument.
  • scfirmup is a stupid tool which prepares a connection to SCUARTD and sends an update packet with a file path inside it. There is no need to comment it, here is reimplementation: http://pastie.org/private/6h8mfeoics4mdxear7ayg

A syscon's update operation in SCUARTD consists of following steps:

  • 1. Check if SX program presents in /usr/bin/sx. It should be a regular file.
  • 2. Check if specified firmware file is a regular file.
  • 3. Halt syscon by sending command halt to UART, then wait some time until it prints HALT: OK.
  • 4. Reset syscon by sending byte 0x30 to GPIO register SC_PI0_DIPSW, byte 0x30 to GPIO register SC_RSTX, waiting 1 second and writing byte 0x31 to GPIO register SC_RSTX.
  • 5. Get current syscon's firmwave version by sending command version to UART. After receiving it, look for a character after the first _ (underscore) symbol from the left side of string and if it equals to the character b, then proceed to the next step, otherwise go to the (8) step. (It is possible to patch this step to allow upgrading or downgrading at will)
  • 6. Prepare syscon for an update by sending command firmud to UART, then fork the current process; the current process won't finish until a message Done from UART arrives (it is the end of update operation).
  • 7. In the forked process start SX program and pass firmware file path to it. SX program reads firmware file and transfer each chunk of it to syscon.
  • 8. After successful update operation reset syscon (a different way) by sending byte 0x31 to GPIO register SC_PI0_DIPSW, byte 0x30 to GPIO register SC_RSTX, waiting 1 second and writing byte 0x31 to GPIO register SC_RSTX.

Notes:

  • It seems all scuartds checks firmware revision and probably syscon is updated only once (after factory).
  • To be able to reflash it you need to patch SCUARTD or do a manual update without the use of SCUARTD.
  • You need to patch a single byte in SCUARTD to be able to flash any firmware (for example, to downgrade your syscon).
  • An actual firmware update process (without halting and resetting steps) takes about 1 minute.
  • You cannot install a corrupted firmware with scfirmup unless you corrupt the header! It seems there is a hash of sorts (possibly of the plaintext) in the header preventing scfirmup from installing something corrupt
  • Updating SYSCON requires the DECR to be in standby mode! You cannot update it while it is on.
  • Corrupting the header and the body will make firmup install the SYSCON update anyways! be careful not to do it!
  • Should you brick SYSCON, here's a patch to 'unbrick' it, do not use it unless you brick it though!
  • You can use this bruteforcer to try your luck when finding new packets: https://hastebin.com/vomogesaru.cpp

Syscon UART[edit]

BGANameDescription
P16UART0_TxDSerial Transmit
P15UART0_RxDSerial Receive
Cb100

You can attach a 3.3v TTL cable (LV-TTL) to the UART on syscon (UART0_TxD, UART0_RxD). (Convenient solder points are available on JSD-001 / JTP-001 by the NOR test points. They are marked as '?' in marcan' noraliser / judges' NORway install picture, closest to the ground at the bottom - RX is left, TX is right) Baud rate is 57600. There is a simple plaintext protocol involved. This varies on different syscon models. Example:

Syscon Cb100 Manual

<command>:<hash>

Manual

Where the hash is the sum of command bytes & 0xFF.

You should terminate commands with rn, the syscon messages are only terminated with n.

Syscon Cb100 Manual User

Samples[edit]

Here are some of the commands/messages encountered:

Messages:

Commands:

See also Syscon commands.

Syscon Cb100 Manual Pdf

Bruteforcing commands: http://pastebin.com/CNei0xbC

VERY IMPORTANT:

  • Max size of a command is 11 characters, 16 if you count with C:<hash>:
  • Sending a command with 11 chars results in NO OUTPUT
  • Sending a command with more than 11 chars results in NG F0000002
  • Max size of a command on DECR is 135, 140 if you count with C:<hash>:

Syscon EEPROM (SPI)[edit]

BGANameDescription
F16CSBChip Select (needs to be low)
H16DOSerial Data Output
G16DISerial Data Input
E16SKBSerial Data Clock
J15WCBWrite Protect
J16RBBReady/Busy
G11VDDep+ 3.3V
C15VSSepGND

Syscon Cb100 Manual Transmission

Syscon JTAG[edit]

It is disabled in factory after production on retail models.

BGANameDescription
L8JRTCKReturn Test Clock
K8JTCKTest Clock
K9JTDOTest Data Out
L9JTMSTest Mode State / Test Mode Select
K7JTDITest Data In
L7JNTRSTTest Reset

Syscon Cell SPI Bus[edit]

BGANameDescription
M2/BE_SPI_CSChip Select
N2BE_SPI_DOSerial Data Output
M1BE_SPI_DISerial Data Input
N1BE_SPI_CLKSerial Data Clock
P2/BE_RESETCellBE Reset
P1BE_POWGOODCellBE PowerGood
T2/BE_INTCellBE Interrupt

Syscon Southbridge SPI Bus[edit]

BGANameDescription
B9/SB_SPI_CSChip Select
B8SB_SPI_DOSerial Data Output
A9SB_SPI_DISerial Data Input
A8SB_SPI_CLKSerial Data Clock


Syscon
CXR713120-201GB·CXR713120-202GB·CXR713120-203GB
CXR714120-301GB·CXR714120-302GB
SW-301·SW-302
SW2-301·SW2-302·SW2-303
SW3-301·SW3-302·SW3-304
CELL
90 nm
65 nm
CXD2981AGB·CXD2981GB·CXD2989·CXD2989AGB·CXD2989GB·CXD2990ABG·CXD2990GB·CXD2990AGB
CXD2992AGB·CXD2992GB·CXD2996GB·CXD2999AGG
RSX
CXD2971AGB·CXD2971DGB·CXD2971GB·CXD2971-1GB·CXD2971BGB·CXD297BGB
CXD2982·CXD2982GB·CXD2991GB·CXD2991BGB·CXD2991GGB·CXD2991CGB·CXD2991EGB
CXD5300AGB·CXD5300A1GB·CXD5300DGB·CXD5301A1GB·CXD5301DGB·CXD5302A1GB·CXD5302DGB
CELL RAM
(XDR)
X5116AC-3C-E·X5116ADSE-3C-E·X1032BASE-3C-F·X1032BASE-3CA2-F·X1032BBBG-3C-F
K4Y50164UC-JCB3·K4Y50164UE-JCB3
RSX RAM
(GDDR3)
K4J52324QC-SC14·K4J52324KJ-JC14·K4J52324KI-JC14
PS2
Compatibility
CXD2953AGB·CXD2972GB·CXD9833GB
K4R271669F·K4R271669H
South Bridge
CXD2973AGB-4‎·CXD2973GB·CXD2979GB·CXD2984GB·CXD2984AGB·CXD9963GB
Starship2
Flash
K9F1G08U0A-PIB0·K9F1G08U0B-PIB0·K9F2G08U0M
NOR
Macronix
Samsung
Spansion
Others
Panasonic
BD SATA/PATA
BD Controllers
On BD board
Sony
CXD5063AGG-1·CXD5065GB-1·CXD5130R-1·CXD5131R-1
R8J32800FPV·R8J32810FPV1·R8J32820FPV1
Integrated
Sony
Renesas SCEI
IDT SCEI
Wireless
Bluetooth·Wifi·88W8580·88W8780·88W8781
Connectors
88E6108-LAR1·88E6106-LKJ1·88E1118R-NNC2·88E1310-NNB2·88EC060-NNB2
Sil9132CBU·Sil9132CBU-HD·MN864709·MN8647091
CXM4024R·CXM4027R
TC7WP3125FK·ISL4353C
PCI·PCIe·Service Connectors
Diverse Comp.
Protection·Regulators·Thermal·Timebases
Codenames

Syscon Cb100 Manual Diagram

Retrieved from ‘http://www.psdevwiki.com/ps3/index.php?title=Syscon_Hardware&oldid=55831’