Worklog PS3 R&D Thread

[YveltalGriffin]

The Wii U, Xbox, and Xbox 360 have been trimmed. Will the PlayStation 3 be the next power hungry console on the chopping block?

The PS3 motherboard is wickedly complex. It makes the Wii U and Xbox 360 look downright basic, and trimming it will be no easy feat. Thankfully, the PS3 has a relatively robust homebrew scene, and there's already quite a bit of hardware documentation on psdevwiki.

Old revisions like the COK-001 and COK-002 are simply not gonna work for portablizing. Giant BGAs are spread out all over the board, including a partial PS2 chipset, and the ICs are on old process nodes that are super power hungry. There are also 4 RDRAM ICs and the motherboard is 6 (or 8?) layers.

The general consensus on the BB Discord is that only the final PS3 Super Slim revisions will achieve decent thermals and battery life in a compact form factor. These diagrams give a general overview of the Super Slim motherboard's anatomy.

It's highly optimized compared to the older models, but multiple daughterboards and insane trace rewiring will still be necessary.

Here's a short info dump of what I've learned so far:

• Finding the lowest-power Super Slim motherboards
  • Some CECH-40xx and CECH-42xx motherboards have 28nm RSX.
  • All CECH-43xx motherboards have 28nm RSX.
  • CECH-43xx motherboards (RTX-001 and REX-001) purportedly have fewer PCB layers (presumably 4L, down from 6L on previous revs)
  • For this reason, I have been seeking out CECH-43xx motherboards (RTX-001 and REX-001) since they're guaranteed to be the lowest power
• Boot requirements, CFW, and disc drive patches
  • Certain hardware boot requirements are already well-understood, thanks to the homebrew community
  • The disc drive controller IC and Wi-Fi/BT module are required to load software and play games. The system blackscreens when loading games without them present
  • Earlier revision PS3 consoles (CECH-25xx and earlier) can run "noBD" and "noBT" CFW, which patches out these requirements
  • As of 2024, Super Slim consoles cannot run CFW. Therefore the disc drive IC and BT module cannot be patched out.
  • This is the Super Slim tradeoff: more relocations in exchange for lower chipset power. How much lower? Idk yet.
  • CECH-25xx has a 40nm RSX and a larger-package CELL, but thanks to CFW could be trimmed without relocating disc drive controller or BT.
  • 
  • The CECH-25xx could be an alternate trim route if Super Slim relocations prove too onerous. Tradeoff = more power.
• Southbridge & Relocations
  • This site gives a good overview of the console architecture.
  • All game-loading interfaces (SATA, USB) run through the Southbridge
  • The Southbridge then connects to the CELL over "FlexIO" (high speed differential interface)
  • A Southbridge+NOR daughterboard will have to be cut out and reconnected to the mobo
  • Daughterboards for the disc drive controller, Syscon, and Wi-Fi/BT will also be mandatory
• HDMI, HDCP, and analog video
  • The PS3 HDMI output uses HDCP at all times.
  • We have to test whether Wisecoco/Eyoyo type driver boards care about this.
  • If they can't display the video, we might be forced to use analog video.
  • If analog video is required, hopefully we can use RGB and grab H-Sync / V-Sync from the video encoder for VGA.
• Softmod setup on Super Slims
  • As of 2024, Super Slims can only use PS3HEN to run homebrew and load backups from HDD or USB.
  • PS3HEN is not persistent across reboots, but all you have to do is re-run the enabler after a reboot, which just takes clicking an icon in XMB.
  • Running the enabler doesn't require internet! Should work perfectly in a portable.

With custom regs, daughterboards for the Southbridge, Syscon, disc drive controller, Wi-Fi/BT, and video encoder, the max possible trim would look something like this. I am very optimistic about this being possible.

I did some experiments and confirmed that the disc drive mechacon (SOIC) is not required for boot. The disc drive controller (QFP) is required for games to load. Next, I'll try removing the Ethernet controller.

The dream would be a new exploit for Super Slim systems that allows for full CFW, and patching out the disc drive and Wi-Fi/BT just like on older systems. That would eliminate a ton of wiring, but is probably not going to happen anytime soon.

If anybody has additional insights, or wants to share their ideas or research, please post in this thread! Let's do this thing!

 

[loopj]

Bro save some projects for the rest of us!

 

[Customledmods]

I’m really glad to see someone working on the ps3. Good luck and thanks for sharing this info with us.

 

[Crazzyleprechaun]

That trim is going to be insane if it is feasible wow

 

[Bill_The_Fish]

I was actually thinking about this a few days ago. I hope you are successful with this, because that will be really cool.

 

[Jonny]

Do we have board scans for the super slim? I'd love to try my hand and make some if they would help

 

[KTW02]

Does the slim 25xx have the final die shrink 45 nm Cell BE like the super slim does? If so, it might make sense to develop an interposer board to adapt the 28 nm RSX to the 25xx. AFAIK it's technically possible, but it hasn't been done before due to a lack of use case. Adapting a 40nm RSX has been enough for Frankenstein PS3s so far.

 

[YveltalGriffin]

Do we have board scans for the super slim? I'd love to try my hand and make some if they would help

We do not, but it's still early enough that scans aren't necessary IMO. Unlike the Wii U, where there was one obviously superior mobo rev, there are SEVEN Super Slim revs and over a dozen revs total. Personally, I'm gonna hold off on sanding til I have a trim strategy locked in.

Does the slim 25xx have the final die shrink 45 nm Cell BE like the super slim does? If so, it might make sense to develop an interposer board to adapt the 28 nm RSX to the 25xx. AFAIK it's technically possible, but it hasn't been done before due to a lack of use case. Adapting a 40nm RSX has been enough for Frankenstein PS3s so far.

Super glad you brought this up! I was thinking the same thing, but forgot to mention it in the first post.

So, according to community wisdom, the large CELL found on CECH-25XX & MPX/MSX Super Slims (CXD2992GB) is the same process node as the small CELL (CXD2999AGG) found on late model Super Slims. Both are supposedly 45nm, but the 2999 has a smaller substrate and overall package.

Caveat: I'm not totally convinced that the smaller package variant CELL, CXD2999, is NOT a dieshrink. Comparing die area alone doesn't tell the whole story. For instance, the Wii U's B1X SOC die is about the same size as the A5X, but it consumes 30% less power. Even a 20% delta is massive when the overall chip TDP is 15-20W (my random guess for the 45nm CELL).

But, let's assume the community wisdom is correct, and CXD2992 = CXD2999 in terms of power. As you suggested, then we just need to transplant a 28nm RSX onto a CECH-25XX, and boom, we have a CFW-able system (i.e. noBD/noBT-able) with the lowest possible chipset power!

The interposer strat has been pulled off already on the OG Xbox (see here and here) so it's totally feasible. A VIPPO pcb would make designing an interposer relatively simple.

Besides the soldering, the hardest part of the transplant would be pinoutting the 40nm RSX and the 28nm RSX. But there's a potential saving grace: MSX/MPX Super Slims have the larger 40nm RSX (recognizable by the 4 GDDR3 chips), just without the IHS, and a 45nm CELL. Basically, MSX Super Slims have the exact same chipset as a CECH-25XX.

So, by cross referencing an MSX/MPX against the other Super Slim revs, it should be possible to figure out the pinout and make the adapter. Assuming there aren't any drastic differences like firmware / bootrom / syscon stuff...

This isn't a new idea-- a couple people have wanted to make a 28nm Frankenstein before, like Calyps0man. The difference is that he wanted to put the 28nm RSX into a COK board, while we would be interested in putting it on a CECH-25XX. But it's effectively the same workflow.


~

All of this makes me wonder...

• Say the transplant was successful, and you had a CECH-25XX with a 45nm CELL and a 28nm RSX
• You've essentially recreated a Super Slim in terms of chipset!
• It can run CFW...
• ...but the PCB layout is less compact than a Super Slim, and you've got more than 4 PCB layers to deal with.

Surely there is a way to frankenstein together a CFW-able system ON a Super Slim mobo.

What would that require? My gut says, you'd need to install the CELL (and Syscon/Southbridge/NOR?) from a CECH-25XX onto a donor Super Slim board. The obvious choice for such a transplant would be the NPX-001:

It has the large package CELL, which you would replace with the CECH-25XX CELL. It already has a 28nm RSX! You wouldn't have to touch the RSX at all! And you'd have to replace other stuff that's paired with the CELL, like the Southbridge, Syscon, and NOR Flash. But that's easy enough, those all have to be rewired anyway!

I will do some more research, but this seems promising and slightly more feasible than interposer strats.

 

[Viilmo]

As you suggested, then we just need to transplant a 28nm RSX onto a CECH-25XX, and boom, we have a CFW-able system (i.e. noBD/noBT-able) with the lowest possible chipset power!

wtf

 

[cfc_12]

I'm glad of this news

There's even a PS4 Laptop & Portable already out there

 

[YveltalGriffin]

Got some CFW-able CECH-2501s! The JTP motherboard is huge but it will be a good testbed for CFW and syscon shenanigans.

After installing Evilnat 4.89.3 Cobra 8.4 [PEX] [CEX] [noBD+noBT] I removed the disc drive controller and the Wi-Fi/BT module. It still loads games! Great to confirm that the noBD+noBT CFW does what it's supposed to.

What I'll do next is lift the Syscon pins one by one to determine the bare minimum needed for the system to run. Some of the pins, like the one for the power button, are obviously mandatory. So I'll reference the psdevwiki pinout tables to save time. This will help inform a manual Syscon relocation!

 

[Stitches]

Man.... I really should not put my finger in that

............ however..............