PS3 Frankenstein PHAT PS3: CECHA with 40nm RSX

What are the issues now that makes this impossible to do? would be really nice for people that need a gpu reball to get a 40nm
 
Wouldnt it be cool to have a phat ps3 with super slim CELL and RSX? Ofc we probably should first get some sort of a open source os that doesent get weirded out by the board and cpu, gpu differences.
 
DoublesAdvocate said:
To use a 40nm RSX you need the custom syscon that Sony put on these units, without access to them it's a brickwall as far as I can tell.
Click to expand...
Wouldn't there be references to the url these pkgs are stored? Inside dev_flash itself? If so these could still be active on the Sony CDN.
 
Just got a CECHA01 in, warranty sealed, syscon error 3034, and an ohm reading of 1.0 on the RSX. I am confident the GPU is dead, and I have a warranty sealed CECHK01 with a bad disc drive waiting on the shelf again. Round 2 will start shortly, all with perfect candidates!
 
MItch07 said:
cant we just dump the syscon? or is that too complicated
Click to expand...
JumpSuit said:
Wouldn't there be references to the url these pkgs are stored? Inside dev_flash itself? If so these could still be active on the Sony CDN.
Click to expand...
I think that part is already done? The issue now is flashing the dumped packages to the console and remarrying if I'm not mistaken?
@sandungas @M4j0r Would probably be the best people to ask about this stuff.
 
It could even be possible to upgrade this from a service mode? As I see all syscon firmwares are inside any PUP file. Could we just modify syscon firmware inside pup and reassemble pup for upgrade. Even remarry been done something similar, probably can be done something like remarry process?
As seen years ago 5 or 10 seconds power on motherboard if you swap cpu. Could be possible? Bd firmware is beside syscon inside pup.
 
DoublesAdvocate said:
I think that part is already done? The issue now is flashing the dumped packages to the console and remarrying if I'm not mistaken?
@sandungas @M4j0r Would probably be the best people to ask about this stuff.
Click to expand...
Yes, the firmware has been dumped so thats not the problem
The tricky thing is to find a syscon chip compatible with this hack, @M4j0r mentioned it in this post
https://www.psx-place.com/threads/f...cecha-with-40nm-rsx.28069/page-10#post-268507
M4j0r said:
About sourcing the exotic/rare syscon with the firmwares (303GB/304GB) which support the 40nm RSX:
- Sony only used it on phat units which were refurbished beginning in late 2009. So you can't really source it from these boards, since these probably always have a higher value than the target you're repairing
- You can get these chips from China, but be aware of fakes
- The easiest way to get a genuine "exotic" syscon from China is to buy the flash variant (CXR713F120A) and then just flash it with the newest firmware

Why the CXR713F120A?
- You can easily check if it has the flash bonding option by checking the bottom (FLASH: https://www.psdevwiki.com/ps3/images/b/bc/CXR713F120A-bottom-1F.JPG vs ROM: https://www.psdevwiki.com/ps3/images/7/7d/CXR713120-201GB-bottom.JPG)
- A ROM variant could just have a different marking on the top but still have the old firmware which you can't update
- The CXR713120, CXR713F120A and CXR714120 are interchangable (same pinout)

Maybe it's also cheaper to just get a "new" syscon for a 65nm RSX if there's no donor available.
Click to expand...
He is talking about the CXR71*120-*** syscon series btw, there are some variants of it, the rare ones with the "F" letter was used in the "communication processor" (a daughterboard) of the DECR-1000 and other non retail PS3 models
Basically, that PS3 models with 2 syscon chips allows to "unbrick" the syscon. The concept is a bit like the PC motherboards with 2 BIOS. It allows to hump into the primary BIOS and brick it, then use the secondary BIOS to restore the first BIOS
vyktormvmpay25 said:
It could even be possible to upgrade this from a service mode? As I see all syscon firmwares are inside any PUP file. Could we just modify syscon firmware inside pup and reassemble pup for upgrade. Even remarry been done something similar, probably can be done something like remarry process?
As seen years ago 5 or 10 seconds power on motherboard if you swap cpu. Could be possible? Bd firmware is beside syscon inside pup.
Click to expand...
Inside the PUP there are syscon "patches" (not the complete syscon firmware). That name could be a bit confusing but we are talking about official patches
The nice thing is we can modify the official patch, so it becomes a custom patch, and then we can install it by official means (just by installing the PUP)

For this hack the patch format is not enought though, because we need to change a byte that indicates the RSX revision, and that area is not affected by the patch
In other words... for this hack we need to modify the syscon base firmware

*Is tricky to talk about all this, incase i made some mistake feel free to correct me
 
sandungas said:
Yes, the firmware has been dumped so thats not the problem
The tricky thing is to find a syscon chip compatible with this hack
Click to expand...
For this hack the patch format is not enought though, because we need to change a byte that indicates the RSX revision, and that area is not affected by the patch
In other words... for this hack we need to modify the syscon base firmware
Click to expand...
You don't need to patch the fimware to overwrite the revision byte (as long as you don't want to do it from the CELL side). The problem is that the code which supports the newer RSX revisions is simply "too large" to fit into a patch, that's why you have to replace the syscon.
That's because FlexIO is a high speed interface and before CELL and RSX can talk with each other, the interface has to go trough a training phase to minimize the errors during operation (simply speaking) and that's coordinated by syscon.

He is talking about the CXR71*120-*** syscon series btw, there are some variants of it, the rare ones with the "F" letter was used in the "communication processor" (a daughterboard) of the DECR-1000 and other non retail PS3 models
Basically, that PS3 models with 2 syscon chips allows to "unbrick" the syscon. The concept is a bit like the PC motherboards with 2 BIOS. It allows to hump into the primary BIOS and brick it, then use the secondary BIOS to restore the first BIOS
Click to expand...
The DECR-1000 only has one syscon like any other PS3, the "F" models just allow you to rewrite the firmware through a recovery mode.
 
M4j0r said:
You don't need to patch the fimware to overwrite the revision byte (as long as you don't want to do it from the CELL side). The problem is that the code which supports the newer RSX revisions is simply "too large" to fit into a patch, that's why you have to replace the syscon.
That's because FlexIO is a high speed interface and before CELL and RSX can talk with each other, the interface has to go trough a training phase to minimize the errors during operation (simply speaking) and that's coordinated by syscon.
Click to expand...
There is no way to overwrite the base firmware completly ?
M4j0r said:
The DECR-1000 only has one syscon like any other PS3, the "F" models just allow you to rewrite the firmware through a recovery mode.
Click to expand...
Ok, i made an small mess, i mentioned it because the DECR-1000 have a syscon of the "F" variant and the communication processor (daughterboard) is able to "flash" the syscon
Maybe someone have a broken DECR-1000, this syscon would be fine for this mod ?
 
M4j0r said:
before CELL and RSX can talk with each other, the interface has to go trough a training phase
Click to expand...
Is there more documentation on that training phase somewhere? I've seen it referenced here and there, but that's about it, and I'd love to read more/understand it better.
 
sandungas said:
There is no way to overwrite the base firmware completly ?
Click to expand...
The firmware is only one time programmable and that happens when the chip is manufactured.

Ok, i made an small mess, i mentioned it because the DECR-1000 have a syscon of the "F" variant and the communication processor (daughterboard) is able to "flash" the syscon
Maybe someone have a broken DECR-1000, this syscon would be fine for this mod ?
Click to expand...
Yes, although I wouldn't sacrifice a DECR for that, the CP just talks via UART to the syscon.

marciolsf said:
Is there more documentation on that training phase somewhere? I've seen it referenced here and there, but that's about it, and I'd love to read more/understand it better.
Click to expand...
Yes, you can find the example code in the CELL hardware initialization guide. (FlexIO = Rambus Redwood = RRAC). The example is only for CELL to CELL. Although this won't tell you anything about how it actually works, since it's in hardware.
 
Okay, hardware swaps all went without incident. The CECHK01 was known working with no issues or errors. No delamination after all the rework cycles on the COK-001 board. Moved the resistor diagonal. I am now getting a nearly instant YLOD with syscon errors A0902120, A0403034, and A0404001 all at once.

Here is the original syscon dump: http://squeept.com/junk/second_try_dump.bin
Here is the fixed syscon that I wrote to the 302 syscon chip: http://squeept.com/junk/second_try_modified.bin

The checksums were fixed using the syscon script on board after the write, so ignore any wrong checksums.

Any ideas? Did I miss any more minor hardware changes somewhere in this thread? I'm HIGHLY confident that all of the hardware is good.
 
Excluding 3034 that always will come every time even is only rsx problem, why 2120 appear to need any more mod inside dump for hdmi?
I am still working to decap ram for 40nm just to get easy pinout for further tests measurements as we can reball but without complete information on pins we are blind looking at rsx. Ram can be tricky and I don't like idea reball on board back if not possible to check all communication lines.
Edit
Is this right?
8fa72c53dc40069ae49ec5ad21831386.jpg

Edit
Now found it on devwiki and it is right
 
Last edited:
squeept said:
Okay, hardware swaps all went without incident. The CECHK01 was known working with no issues or errors. No delamination after all the rework cycles on the COK-001 board. Moved the resistor diagonal. I am now getting a nearly instant YLOD with syscon errors A0902120, A0403034, and A0404001 all at once.
Click to expand...

A0902120 means that there's something wrong with the HDMI encoder initialization
A0403034 means that the BE <-> RSX FlexIO bit training failed, A0404001 is also related to that
 
M4j0r said:
A0902120 means that there's something wrong with the HDMI encoder initialization
A0403034 means that the BE <-> RSX FlexIO bit training failed, A0404001 is also related to that
Click to expand...

At this point, if I didn't miss any hardware changes and my EEPROM dump looks correctly fixed, this has gone above my pay grade. I also have no use for this board now. It's gone through 4 rework cycles now, so I'm not gonna put it through 2 more to try to swap a working GPU and syscon back on it.

So, do you (or anyone here that's capable) have any interest in getting your hands on this board and continuing to work on the problem? I'll even cover the shipping cost.
 
You must log in or register to reply here.

Similar threads

Back
Top