PS3 NOR Manager [PNM Project V1.0] Document V1.

1 Author: No_One 1/19

Dedicated to graf_chokolo, dantehades, israyel & PS3 sceners Logo by moneef

PS3 NOR Manager [PNM Project V1.0] Document V1.1 Author: No_One 2/19

DOCUMENT HISTORY
V1.0 Initial version V1.1 07/19/11 - SPANSION NOR reference added: S29GL128P90TFIR2, - GPIO assignment update to use the LTC4411 STAT signal (GPIO#4 & GPIO#5 are now unusable), - Official PNM logo inserted in the document.

PS3 NOR Manager [PNM Project V1.0] Document V1.1 Author: No_One 3/19

INTRODUCTION

SLIM PS3 consoles use an 8Mx16bits NOR FLASH (128Mbits of non-volatile memory). The memory could be one of the following references: - K8Q2815UQB-PI4B (Manufacturer: SAMSUNG), - S29GL128P90TFIR2 (Manufacturer: SPANSION). Please refer to the datasheet for further information. The FLASH is packaged in a TSOP56 (Thin Small-Outline Package). This memory embeds a part of the firmware used by the CELL BE itself (asecure_loader, eEID, ). The other part of the firmware is stored on the internal HDD. The following diagram illustrates the architecture used between the CELL BE and the NOR FLASH:
Control Bus Address Bus CELL BE Chip Select Data Bus 128Mbit NOR FLASH Firmware

Encrypted

Please note that the FLASH content is ENCRYPTED.

PS3 NOR Manager [PNM Project V1.0] Document V1.1 Author: No_One 4/19

PNM is a project using a FPGA and 2 NOR FLASH sockets. It requires a direct access to the PS3 CELL EBU (signals are located on the motherboard). This may be the riskier step due to the number of signals involved. The embedded NOR must have been removed or disabled to avoid electrical conflicts. PNM is designed with several hardware/software features in mind: DUMP This command dumps (reads) the content of a NOR FLASH. UPDATE This command updates (writes) the content of a NOR FLASH. COPY This command copies the content of a NOR FLASH to another NOR FLASH. STATIC SWITCH This command defines the NOR FLASH to be used (before starting the PS3 console). DYNAMIC SWITCH This command defines the NOR FLASH used with programmable conditions (from host). CAPTURE This command captures the NOR bus activities. Programmable conditions could be used (number of samples to be defined).

PS3 NOR Manager [PNM Project V1.0] Document V1.1 Author: No_One 5/19

The following diagram illustrates the architecture used:

NC7SB3157P6X FAIRCHILD

EP3C25E144C8N ALTERA

EPCS16SI8N ALTERA

10-Pin Male Header

CTRL#1

/CE

2:1 MUX

/CE#1

FLASH NOR #1

Serial EEPROM JTAG Connector

PS3 NOR Bus

FPGA

PS3 Custom Connector

/CE

2:1 MUX

/CE#2

FLASH NOR #2

Serial To USB Module

+5V USB CTRL#2 GPIO Bus +5V PS3 +3.3V +2.5V +1.2V 3x LDO Regulators +5V Power Switch

64-Pin Male Header

NC7SB3157P6X FAIRCHILD

K8Q2815UQB-PI4B SAMSUNG OR 648-0562211-A01 WELLS-CTI

1N5404 FAIRCHILD AND LT1963ES8 LINEAR

DLP-USB232M FTDI

LTC4411ES5 LINEAR

USB Connector

PS3 NOR Manager - V1.0 - No_One

PS3 NOR Manager [PNM Project V1.0] Document V1.1 Author: No_One 6/19

QUICK DESCRIPTION OF THE HARDWARE

POWER MANAGEMENT In a standalone use, PNM is powered by the USB port (+5V). Once connected to the PS3, PNM is powered by the console itself even if USB port is used. Here is the power management rules:
P5VUSB NO NO YES YES P5VPS3 NO YES NO YES PNM Powered by P5VPS3 Powered by P5VUSB Powered by P5VPS3 Comments PNM is OFF The USB port is used for communication

PNM must be powered before starting the console otherwise the CELL cannot boot properly. Please notice that NOR maintenance features (DUMP, UPDATE) are disabled when PNM is powered by the PS3. This prevents from electrical conflicts. Multiplexing features are still active (SWITCH functions). PNM power consumption is about 0.4W when sockets are empty. USB PORT The USB port is mainly used in the standalone mode. PNM uses a module (DLP-USB232M) manufactured by FTDI. Please refer to the following website for more details (http://www.ftdichip.com). Drivers are provided to handle the USB communication (Virtual COM Port). The transfer bandwidth is limited to 3Mbauds. A LED indicates whenever communication is active between PNM and host. The host system (PC) must be capable to deliver up to 1W on the power line.

PS3 NOR Manager [PNM Project V1.0] Document V1.1 Author: No_One 7/19

JTAG CONNECTOR (10-PIN MALE HEADER) The JTAG connector is used to debug/program the embedded FPGA. The pinout has been chosen to fit the JTAG USB-Blaster product specifications (ALTERA):
Pin # 1 2 3 4 5 6 7 8 9 10 Name TCK GND TDO +3.3V TMS TDI GND

Please refer to the following website for more details (http://www.altera.com). Please notice that this connector is only used for FPGA debug purposes. A LED indicates the correct FPGA configuration (each time PNM is switched ON). If this LED remains ON, the FPGA configuration failed. Another LED indicates that the software is running. Different blinking rates will be defined according to the function which is executed. JUMPER A Jumper selects the NOR socket used for booting the PS3 (STATIC SWITCH).

Jumper 1-2 2-3

Comments SOCKET #2 SOCKET #1

The FLASH socket #1 is active by default (when no jumper used).

PS3 NOR Manager [PNM Project V1.0] Document V1.1 Author: No_One 8/19

PS3 CONNECTOR (64-PIN MALE HEADER) The PS3 connector (a DIN 41612 connector) is used to connect PNM to the console. The pinout is totally customized:
Pin # 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 Name A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 A10 A11 A12 A13 A14 A15 A16 A17 A18 A19 A20 A21 A22 GND DQ0 DQ1 DQ2 DQ3 DQ4 DQ5 DQ6 DQ7 Comments ADDRESS BIT #0 - LSB ADDRESS BIT #22 - MSB GROUND DATA BIT #0 - LSB Pin # 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 Name DQ8 DQ9 DQ10 DQ11 DQ12 DQ13 DQ14 DQ15 GND NCE NOE NWE NWPACC RYNBY NRESET GND NC NC GPIO5 GPIO4 GPIO3 GPIO2 GPIO1 GPIO0 GND GND NC NC GND GND P5VPS3 P5VPS3 Comments DATA BIT #15 - MSB GROUND /CHIP_SELECT /OUTPUT_ENABLE /WRITE_ENABLE /WRITE_PROTECT /READY_BUSY /RESET GROUND NOT CONNECTED NOT CONNECTED GLOBAL PURPOSE I/O #5 GLOBAL PURPOSE I/O #0 GROUND GROUND NOT CONNECTED NOT CONNECTED GROUND GROUND +5.0V +5.0V

PS3 NOR Manager [PNM Project V1.0] Document V1.1 Author: No_One 9/19

The P5VPS3 is a power line coming from the console (+5V). When not in standalone mode, the P5VPS3 MUST be active before switching on the PS3. It is important to wire this line to a permanently active power (on the motherboard). 6 global purpose I/O are provided (GPIO0 to GPIO5). Each generic I/O can be programmed and meets the following specifications: Direction It can be INPUT (default) or OUTPUT. Data It can be 0 (default) or 1. Digital signals on this connector have LVCMOS/LVTTL +3.3V logic levels. An 4.7Ohm resistor has been inserted on each line to prevent from temporary short-circuits. Current GPIO assignment:
GPIO #5 #4 #3 to #0 OUTPUT INPUT BIDIR Comments This GPIO drives the UI LED Cannot be used anymore This GPIO reads the power STAT (LTC4411) Cannot be used anymore General Purpose Input/Output

FLASH SOCKETS PNM has 2 NOR FLASH sockets (push-pull).

Both are connected to the PS3 CELL EBU. The FLASH socket #2 is active only when requested by the host (PC) or the jumper. The FPGA ensures that only one FLASH can be active to prevent from short-circuits.

PS3 NOR Manager [PNM Project V1.0] Document V1.1 Author: No_One 10/19

The following top view shows the different user interfaces (LEDS, SOCKETS, JUMPER and CONNECTORS):

SCHEMATICS

BILL OF MATERIALS

TOP VIEW