PS3 Frankenstein PHAT PS3: CECHA with 40nm RSX

M4j0r said:
I know how it works but we simply can't patch it into the retail syscons using the available space we have.
It has three steps:
1) Setup (to select the right table, algorithm and misc. stuff)
2) Table Data Patching (apply patches to the training data) - RSX specific
3) Execute the training algorithm - RSX specific

Problems: Not enough patch space to just overwrite everything or just too many offsets to patch.
The Problem is really that we don't have enough offsets to patch, the difference between the algorithms isn't that big but we simply lack the ability to patch more than like 2 things because we also need to overwrite the table data (which also needs to fit into the patch) and need about 2 patches for the setup.
Sony also produced two variants of the 40nm chip which get automatically detected by Syscon and use different tables/algorithms. So instead of adding support for one chip we need to add two :/ (https://www.psdevwiki.com/ps3/Talk:Rambus_Registers).
Click to expand...
Ok, thats the official way to do it, but i was wondering if there are alternative ways to do it
Lets say... by hardcoding the data inside the algorithm (this way there is no need to patch the data table because syscon is not going to read it)
Or... bypass the algorithm completly patching functions to output always the correct values... this way the syscon is not doing an "smart" identification of the RSX model, instead of that "smart" identification we are "locking" syscon to a specific RSX model
 
sandungas said:
Ok, thats the official way to do it, but i was wondering if there are alternative ways to do it
Lets say... by hardcoding the data inside the algorithm (this way there is no need to patch the data table because syscon is not going to read it)
Or... bypass the algorithm completly patching functions to output always the correct values... this way the syscon is not doing an "smart" identification of the RSX model, instead of that "smart" identification we are "locking" syscon to a specific RSX model
Click to expand...
Yes, I had that idea too and did some research on that. The non 65nm RSX compatible Syscons (201/202/203) require too many patches for 40nm support, even "dirty" patches. It might work with the 301 (partial 65nm support) and 302 (full 65nm support) but doing that doesn't really make sense (preliminary tests failed).
A 90nm -> 65nm swap isn't really ideal (and not recommendable) which leaves only 40nm. Let's say the 40nm RSX works with a patched Syscon. Then you have to swap the RSX and Syscon. These have to come from different consoles. The modchip offers the same functionality and is easier to install.
If you swap the RSX to 40nm you should swap the Syscon to 304. That's because Sony didn't only patch the FlexIO training but also the config server inside Syscon which communicates with CELL. The modchip or "dirty" Syscon patches can lead to a softlock since they don't patch that part.
The only boards which could make use of the "dirty" Syscon patches without a Syscon swap could be the DIA-001, DIA-002 and DEB-001. I don't know why someone would put money into that.
 
M4j0r said:
Yes, I had that idea too and did some research on that. The non 65nm RSX compatible Syscons (201/202/203) require too many patches for 40nm support, even "dirty" patches. It might work with the 301 (partial 65nm support) and 302 (full 65nm support) but doing that doesn't really make sense (preliminary tests failed).
A 90nm -> 65nm swap isn't really ideal (and not recommendable) which leaves only 40nm. Let's say the 40nm RSX works with a patched Syscon. Then you have to swap the RSX and Syscon. These have to come from different consoles. The modchip offers the same functionality and is easier to install.
If you swap the RSX to 40nm you should swap the Syscon to 304. That's because Sony didn't only patch the FlexIO training but also the config server inside Syscon which communicates with CELL. The modchip or "dirty" Syscon patches can lead to a softlock since they don't patch that part.
The only boards which could make use of the "dirty" Syscon patches without a Syscon swap could be the DIA-001, DIA-002 and DEB-001. I don't know why someone would put money into that.
Click to expand...

I think that if it were possible to make it work swaping RSX+Syscon from a 40nm console to a 90nm and doing the voltage modification... that would be perfect for me. I'm more than ready to sacrifice a couple of slim consoles for my phattys
 
quark said:
I don't know much about ps3 development (and gaming consoles in general) but I do have a logic analyzer and I'd love to check what's going on with that chip.

Anyway... want to buy a couple of them but seems impossible since the only web selling them is https://www.bukalapak.com/p/elektronik/elektronik-lainnya/jpcrkc-jual-ps3-rsx-mod and there is not any option that lets you select shiping to eu...

Can anyone help me buying a couple of them?
Click to expand...

I thought about hooking up my oscilloscope to capture the SPI communication coming off the modchip to see exactly when and what signals it sends. Might be able to see how many bytes of data it sends/receives. A logic analyzer might be more useful.

To get the modchip I used "lusianaliu" on Fiverr who bought the modchip from this listing and shipped them to me. It's a bit inconvenient, but works. Took about 2 weeks total, not bad. You have to buy 5 chips and all said and done it was ~$100. Or $20/chip, not bad really.
 
If I do had one of those, I could check with my logic analyzer, but I dunno if @lusianaliu would buy a couple of them for me...
 
She's a pro! I recommend. @DeadEnd went through her a few times and I think a few others on the forum too. So she'll get you sorted. It's easier than you think. Just start a fiver account and search for her "buy stuff from Indonesia" service. Message her and she'll walk you through the process.

I was apprehensive at first, but it wasn't that bad.
 
RIP-Felix said:
She's a pro! I recommend. @DeadEnd went through her a few times and I think a few others on the forum too. So she'll get you sorted. It's easier than you think. Just start a fiver account and search for her "buy stuff from Indonesia" service. Message her and she'll walk you through the process.

I was apprehensive at first, but it wasn't that bad.
Click to expand...

Cool, I'll try fiver, thanks!

Why did you buy those? aren't https://www.bukalapak.com/p/elektronik/elektronik-lainnya/jpcrkc-jual-ps3-rsx-mod these cheaper?
 
Last edited:
I sent her both links but she was only able to purchase from the other one. I think they were out of stock or something, not sure.
 
I've tried different ways of doing with patches in mullion syscon with DeadEnd and help of M4j0r, sandungas. We need more space inside syscon for each rsx or at least for the one is charged. Orbis modchip will do it on fly over spi as auticonfig righ after boot. It is more complex, not a simple line code execution as simple microcontroller.
Mullion syscon can be copy one to one and reuse from another unit, like any eprom. On Renesas ic I don't have any method to dump full (is not public)
 
vyktormvmpay25 said:
I've tried different ways of doing with patches in mullion syscon with DeadEnd and help of M4j0r, sandungas. We need more space inside syscon for each rsx or at least for the one is charged. Orbis modchip will do it on fly over spi as auticonfig righ after boot. It is more complex, not a simple line code execution as simple microcontroller.
Mullion syscon can be copy one to one and reuse from another unit, like any eprom. On Renesas ic I don't have any method to dump full (is not public)
Click to expand...

I should check more info about this syscon stuff to know how it works... because, besides giving to cell the initial instructions/configuration (thing I guess it does) does it anything else? (power management?) and, if between syscon versions the pinout is different, wouldn't be a solution to make an adapter board to just solder the 40nm version?

Sorry for my ignorance, but never been interested in the scene before
 
Last edited:
Even if someone is going to be able to reroute vias with adaptor, it will need another custom case, radiator or so on. Reason doing this? Only difference I see to have ps2 emulator ic added? Or EE ic in case of cok001 boards. To complex for me, I'm quite limited and probably I don't understand your point of view.
 
ummm the cell or the rsx are taller (or thick) than what I'm sugesting...

Just because the cecha-b are two (or more) consoles in one, is what I think that made them a lot more interesting than the rest of the models.
 
mod chip is the best way. its only 4 wires, complete syscon swap meens more bga work. also after syscon swap you need to mary cell to new syscon chip. a lot of work and for what to avoid the chip? the only flaw to this modchip is that for now on some bc consoles (the reasson is not completly specified propably the syscon version) ps2 games goes black screen and stay there untill you exit from from game via ps button.
 
At least cok002 boards won't have any issues, from what I understand only cok001 with different ram colour, black or green? Can't remember, was posted earlier in thread for sure.
 
vyktormvmpay25 said:
At least cok002 boards won't have any issues, from what I understand only cok001 with different ram colour, black or green? Can't remember, was posted earlier in thread for sure.
Click to expand...

good call yes cok-002 dont have any issue. nah i dont think ps2 rampus ram is the issue. @DeadEnd mention he has success on cok-001 with syscon 202 while those that have syscon 201 dont work so propably syscon version is the issue. until modcips are fixed for all cok-001
 
Ok I've misunderstanding something, botakompong has shown me some tests on those different cok001 but I did not pay attention as not much help I can give or test to make at that time. So hope he will sort this out.
Edit
Don't have /see those boards around here, bearly can find cok002 here and most quite damaged that even cell won't work.
 
You must log in or register to reply here.

Similar threads

Back
Top