The PSP Bible
Rev 1.1.2 5/20/09
Disclaimer
Only a small part of the information found in this document has been personally uncovered by myself; the majority of the information has been heavily plagiarized from a variety of online sources. It is not my intention that this information be regarded as my own original work, but rather as an original compilation of the information I have collected into a single, consolidated, organized and easily digested reference source for the homebrew and modding community.
I hope that you find it useful.
by
Senti4/30/2009
PSP Product Specifications
For simplicity’s sake, all of the hardware specs and schematics used in this document are (when known) based on the PSP 1001’s (Phat) TA-079 motherboard and related components.
Product Name: PlayStation Portable (PSP)
Color: Black
Dimensions: Approx. 170 mm (L) x 74 mm (W) x 23 mm (D)
Weight: Approx. 260 g (including battery)
Processors:
• Sony CXD1876 (Media Engine Chip) – MIPS R4000 Family CPU
o 333 MHz (Maximum). 222 MHz (Preset Default)
o 2MB embedded RAM
• Sony CXD2962GG (Graphics Processor Chip) – MIPS R4000 Family CPU
o 166 MHz (Maximum). 111 MHz (Preset Default)
• 2MB embedded RAM (Video Memory) Main Memory: 32MB
Main Memory:
• Samsung K5E5658HCM-D060
• 32MB 333MHz DDR SDRAM memory
Embedded DRAM: 4MB
Display: Sharp 4.3 inch, 16:9 widescreen TFT LCD, 480 x 272 pixel (16.77 million colors), Max. 200 cd/m2 (with brightness control)
Speakers: Built-in stereo speakers
Main Input/Output: IEEE 802.11b (Wi-Fi), USB 2.0 (Target), Memory Stick™ PRO Duo, IrDA, IR Remote (SIRCS)
UMD Disc Drive: (Playback only)
• Dimensions: Approx. 65 mm (W) x 64 mm (D) x 4.2 mm (H)
• Weight: Approx. 10g
• Disc Diameter: 60 mm
• Maximum Capacity: 1.8GB (Single-sided, dual layer)
• Laser wavelength: 660nm (Red laser)
• Encryption: AES 128bit
• Profile: PSP Game (full function), UMD Audio (codec ATRAC3plus™, PCM, (MPEG4 AVC)), UMD Video (codec MPEG4 AVC, ATRAC3plus™, Caption PNG)
Main Connectors: DC OUT 5V, Terminals for charging built-in battery, Headphone/Microphone/Control connector
Power: Built-in lithium-ion battery, AC adaptor
Motherboard Components – Side A
CN1001
USB 2.0 mini-B connector.
CN4201
Memory stick reader / WiFi Network/ Sound circuit board (MS-268) connector.
CN6001
3-pin battery connector.
CN9502
No component present – test points.
CRYSTAL CLOCK OSCILLATOR
27.000 (MHz) by NDK (Nihon Dempa Kogyo Co., LTD). 27 MHz crystal oscillator.
Probably NDK part# NX3225SA or similar.
IC1001
CXD2962GG by Sony. Graphics processor chip, codename TACHYON.
The main ‘System On a Chip’ (SoC) IC. A Sony custom-made LSI which holds the main CPU (ALLEGREX), the VFPU coprocessor, the Media Engine CPU & its embedded DRAM, the Graphics Engine & its embedded DRAM, the AVC decoder, the Virtual Mobile Engine DSP, the KIRK & SPOCK crypto engines, and the 4KB embedded mask ROM which holds the PreIPL and routines to boot into service mode.
IC1003
IRDA (infrared) sensor array.
IC1501
K5E5658HCM by Samsung. Flash/SDRAM.
MCP 3.0V/2.5V 32MB 8 bit Uniform Block NAND Flash + 32MB 32 bit 6ns CL3 DDR SDRAM in a 137 ball FBGA(LF) package. (Firmware storage)
IC1502
27043 by (unknown).
Possibly for clock signal conversions.
IC3002
BAR14 by Sony. SYSCON microcontroller, codename BARYON.
64 pin BGA chip. Handles everything from controlling power to all devices (including the LCD, UMD drive, memstick, WLAN, and main cpu), keeping the date/time, sleep mode control, controls all external switches including all buttons & the analog nub as well as the headphone remote buttons/switches, LED control, main power & battery control, and even access to the PSP’s Service Mode (SYSCON is the chip responsible for detecting the 0xFFFFFFFF serial of the battery to enable service mode).
IC6001
SN105257 by Texas Instruments. Possibly a type of voltage regulator or controller.
IC9001
CXD1876 by Sony. Media engine, codename LEPTON.
This Sony custom-made LSI holds the optical media DSP & CPU (Mechacon UMD Controller), the ATAPI interface, 480KB DRAM read buffer, and (at least) 384KB Flash ROM for firmware.
IC9502
SC901583EP by Freescale Semiconductors.
Unlabled IC
MB44C001 by Fujitsu. DC/DC power converter, codename POMMEL.
Power convertor IC controlled by the SYSCON (BARYON / BAR14) microcontroller.
S3001
WLAN switch.
S9001
UMD detect switch.
SYSCON CMOS Battery
By Matsushita Electric Industral Corp (Panasonic).
SYSCON 4 MHz Ceramic Resonator
[M] 4.00B by Matsushita Electric Industral Corp (Panasonic).
4 MHz ceramic resonator with built in capacitors (30 pF). Pin1=IN, Pin2=Gnd, Pin3=OUT.
Mfg part# EFO-SS4004E5 or similar.
Motherboard Components – Side B
CN2503
Left side speaker connector.
CN2504
Right side speaker connector.
CN4001
FH12A-40S-0.5SH(55) by Hirose Electric. Primary LCD ZIF connector.
The primary of two (also CN4502) connectors between the Sharp LCD’s flex circuit and the motherboard. Carries the display data, signal and test lines.
CN4502
Secondary LCD ZIF connector.
The secondary of two (also CN4502) connectors between the Sharp LCD’s flex circuit and the motherboard.
Backlight power connection.
CN4801
ABXY / power switch board (SW-445) ZIF connector.
CN4902
Direction control pad (d-pad) ZIF connector.
CN6002
CPL2102-0101F by SMK Corp. 2-Pin DC power jack connector.
Connects to SMK Corp part CPL2302-0101F (housing) with CTA5126-1101F (wire terminals).
CN9001
No component present – test point.
CN9501
UMD optical drive data flex cable connector.
CN9503
UMD optical drive motor control flex cable ZIF connector.
F1001 1.0A
NFCC06501ADTPF by (unknown). USB port 1.0A fuse.
F4501 0.5A
NFCC06102ADTPF by (unknown). LCD 0.5A fuse.
F6001 2.5A
NFCC06252ADTPF by (unknown). Main power 2.5A fuse.
F7001 nanoSMDC050F
nanoSMDC050F by Tyco Electronics. Polyswitch 2.5A resettable fuse.
IC2501
WM8973G by Wolfson Microelectronics. Audio Stereo CODEC.
Audio driver for speakers and headphones, digital audio equalizer.
The following is for the Wolfson WM8973L, which SHOULD be a close match, but not verified - use with caution.
Pin No. Name Type Description
1 MCLK Digital Input Master Clock
2 DCVDD Supply Digital Core Supply
3 DBVDD Supply Digital Buffer (I/O) Supply
4 DGND Supply Digital Ground (return path for both DCVDD and DBVDD)
5 BCLK Digital Input / Output Audio Interface Bit Clock
6 DACDAT Digital Input DAC Digital Audio Data
7 DACLRC Digital Input / Output Audio Interface Left / Right Clock/Clock Out
8 ADCDAT Digital Output ADC Digital Audio Data
9 ADCLRC Digital Input / Output Audio Interface Left / Right Clock
10 MONOOUT Analogue Output Mono Output
11 OUT3 Analogue Output Analogue Output 3 (can be used as headphone Pseudo Ground)
12 ROUT1 Analogue Output Right Output 1 (Line or Headphone)
13 LOUT1 Analogue Output Left Outpu 1 (line or headphone)
14 HPGND Supply Supply for Analogue Output Drivers (LOUT1/2, ROUT1/2)
15 ROUT2 Analogue Output Right Output 1 (Line or Headphone or Speaker)
16 LOUT2 Analogue Output Left Output 1 (Line or Headphone or Speaker)
17 HPVDD Supply Supply for Analogue Output Drivers (LOUT1/2, ROUT1/2, MONOUT)
18 AVDD Supply Analogue Supply
19 AGND Supply Analogue Ground (return path for both AVDD)
20 VREF Analogue Output Reference Voltage Decoupling Capacitor
21 VMID Analogue Output Midrail Voltage Decoupling Capacitor
22 MICBIAS Analogue Output Microphone Bias
23 RINPUT3 / HPDETECT Analogue Input Right Channel Input 3 or Headphone Plug-in Detection
24 LINPUT3 Analogue Input Left Channel Input 3
25 RINPUT2 Analogue Input Right Channel Input 2
26 LINPUT2 Analogue Input Left Channel Input 2
27 RINPUT1 Analogue Input Right Channel Input 1
28 LINPUT1 Analogue Input Left Channel Input 1
29 MODE Digital Input Control Interface Selection
30 CSB Digital Input Chip Selection / Device Address Selection
31 SDIN Digital Input / Output Control Interface Data Input / 2-wire Acknowledge Output
32 SCLK Digital Input Control Interface Clock Input
IC4503
L00053B by National Semiconductor. Dual-Display Constant Current LED Driver with Analog Brightness Control.
Manufacturer part# LM3503. A dual-display white LED driver used for display backlighting applications, the LM3503 has cycle-by-cycle current limit, output over-voltage protection, input under-voltage protection, and dynamic white LED current control capability.
Note : Pins are counted counter-clockwise from pin 1 mark.
Pin No. Name Description
DAP DAP Die Attach Pad (DAP), to be soldered to the printed circuit board’s ground plane for enhanced thermal dissipation.
1 NC No Connection
2 Sw Drain Connection of the Power NMOS Switch
3 Sw Drain Connection of the Power NMOS Switch
4 Vout1 Over-Voltage Protection (OVP) and Source Connection of the PMOS FET Switch
5 NC No Connection
6 Vout2 Drain Connections of the NMOS and PMOS Field Effect Transistor (FET) Switches. (Connect 100nF at VOUT2 node if VOUT2 is not used)
7 Fb Connect 100nF at VOUT2 node if VOUT2 is not used
8 NC No Connection
9 Cntrl White LED Current Control Connection
10 En1 PMOS FET Switch Control Connection
11 NC No Connection
12 En2 NMOS FET Switch Control Connection
13 Vin Input Voltage Connection
14 Agnd Analog Ground Connection
15 Pgnd Power Ground Connection
16 Pgnd Power Ground Connection
Cntrl : White LED current control pin. Use this pin to control the feedback voltage with an external DC voltage.
Fb : Output voltage feedback connection.
VOUT2 : Drain connections of the internal PMOS and NMOS FET switches (Figure 1: P1 and N2). It is recommended to connect 100nF at VOUT2 if VOUT2 is not used.
VOUT1 : Source connection of the internal PMOS FET switch and OVP sensing node. The output capacitor must be connected as close to the device as possible, between the VOUT1 pin and ground plane. Also connect the Schottky diode as close as possible to the VOUT1 pin to minimize trace resistance and EMI radiation.
Sw : Drain connection of the internal power NMOS FET switch. Minimize the metal trace length and maximize the metal trace width connected to this pin to reduce EMI radiation and trace resistance.
Pgnd : Power ground pin. Connect directly to the ground plane.
Agnd : Analog ground pin. Connect the analog ground pin directly to the Pgnd pin.
VIN : Input voltage connection pin. The CIN capacitor should be as close to the device as possible, between the VIN pin and ground plane.
En2 : Enable pin for the internal NMOS FET switch during device operation. When VEn2 is ≥ 1.4V, the internal NMOS FET switch turns off and the SUB display is turned on. The En2 pin has an internal pull down circuit, thus the internal NMOS FET switch is normally in the on state of operation with the SUB display turned off. When VEn2 is ≤ 0.3V, the internal NMOS FET switch turns on and the SUB display is turned off. If both VEn1 and VEn2 are ≤ to 0.3V the LM3503 will shutdown. If VOUT2 is not used, En2 must be floating or grounded and En1 used to enable the device.
En1 : Enable pin for the internal PMOS FET switch during device operation. When VEn1 is ≤ 0.3V, the internal PMOS FET switch turns on and the MAIN display is turned off. When VEn1 is ≥ 1.4V, the internal PMOS FET switch turns off and the MAIN display is turned on. If both VEn1 and VEn2 are ≤ 0.3V the LM3503 will shutdown. The En1 pin has an internal pull down circuit, thus the internal PMOS FET switch is normally in the on state of operation with the MAIN display turned off. If VOUT2 is not used, En2 must be grounded and En1 use to enable the device.
IC6003
No component present.
It is unknown if this location is used as a set of test points or if it is an unused IC location held over from a prior motherboard design. The layout for an 8 pin SMD IC suggests the latter possibility.
IC9501
A2707G by Sony.
Sub Assemblies / Daughter Boards / Misc
Analog Nub Controller
DC Power Jack
LCD
Sharp 4.3 inch, 16:9 widescreen TFT LCD, 480 x 272 pixel (16.77 million colors), Max. 200 cd/m2 (with brightness control).
TFT LCD Panel
Connects via CN4001.
Term No. Name Function Notes
1 GND GND (0V)
2 GND GND (0V)
3 VCC +2.5V power source
4 VCC +2.5V power source
5 R0 RED data signal (LSB)
6 R1 RED data signal
7 R2 RED data signal
8 R3 RED data signal
9 R4 RED data signal
10 R5 RED data signal
11 R6 RED data signal
12 R7 RED data signal (MSB)
13 G0 GREEN data signal (LSB)
14 G1 GREEN data signal
15 G2 GREEN data signal
16 G3 GREEN data signal
17 G4 GREEN data signal
18 G5 GREEN data signal
19 G6 GREEN data signal
20 G7 GREEN data signal (MSB)
21 B0 BLUE data signal (LSB)
22 B1 BLUE data signal
23 B2 BLUE data signal
24 B3 BLUE data signal
25 B4 BLUE data signal
26 B5 BLUE data signal
27 B6 BLUE data signal
28 B7 BLUE data signal (MSB)
29 GND GND (0V)
30 CK Clock signal to sample each data
31 DISP Display ON / OFF signal
32 Hsync Horizontal synchronizing signal
33 Vsync Vertical synchronizing signal
34 NC NC Note 1
35 AVDD +5V Analog power source
36 AVDD +5V Analog power source
37 NC NC Note 1
38 TEST1 TEST1 Note 2
39 TEST2 TEST2 Note 3
40 TEST3 TEST3 Note 3
Note 1 - They have been open within FPC.
Note 2 - Please be sure to set 38 pins (TEST1) to open.
Note 3 - Please be sure to connect 39 pin (TEST2) ,40 pin (TEST3) with GND.
LCD Backlight
Connects via CN4502.
Term No. Signal Function
1 Vled- LED Power Source Input terminal (Cathode side)
2 NC NC
3 NC NC
4 Vled+ LED Power Source Input terminal (Anode side)
Left Speaker
Connects to motherboard, side B, via CN2503 connector.
MS-268
Memory Stick reader, WiFi submodule, and headphone/remote control port.
Connects to motherboard, side A, via CN4201 connector.
WiFi submodule
SWU-BXJ154N
Mounted on the underside of the SIRCS / memory stick submodule.
Marvell Libertas 88W8010 (RF transceiver)
Marvell Libertas 88W8380 (ARM9 processor)
Memory Stick
Pin No. Name Function
1 VSS
2 BS (IN) serial protocol bus state signal
3 VCC (IN)
4 DIO (IN/OUT) serial protocol data signal
5 not used
6 INS stick insertion/extraction detect
7 not used
8 SCLK (IN) serial protocol clock signal
9 VCC
10 VSS
Headphone / Remote Control Port
Standard 3.5mm 3-conductor stereo headphone jack and 6-pin female control port.
Phone jack:
Tip (pink wire) : left audio (plus 600mv DC bias)
Ring (red wire) : right audio
Sleeve (black wire) : audio ground (GND)
6-pin female control port
(pin numbered clockwise from top left pin)
Pin 1 : (brown wire) ? Possibly ground (GND)
Pin 2 : (blue wire) digital ground (GND)
Pin 3 : (orange wire) TXD
Pin 4 : (green wire) ? Possibly trigger @2.5V (seems to be control from PSP itself)
Pin 5 : (yellow wire) +2.5V (0V when plug isn’t inserted into headphone jack)
Pin 6 : (grey wire) RXD
Right Speaker
Connects to motherboard, side B, via CN2504 connector.
Unlabeled Connection
Analog Nub controller contact/connection point to motherboard, side B.
UMD drive
Glossary
ALLEGREX (part of TACHYON)
The codename for the main cpu of the PSP. Codename origin unknown.
BARYON (another Star Trek term)
The codename for the SYSCON microcontroller IC (refer to SYSCON for more information). (IC marked with “BAR xx”).
HIBARI
The codename for the PSP Slim LCD Controller IC. Means “Skylark” in Japanese.
IdStorage
A low-level storage area that holds specific configuration data and id’s for each individual PSP. A basic mapping format is used where a single NAND page is used to store a “leaf”. Each leaf is assigned a 16-bit leaf id and mapped to an index. Located in the first MB non-mapped area of the NAND Flash. 256KB is reserved on the flash to hold the IdStorage area.
IPL (Initial Program Load)
The bootstrap program that loads the firmware. Located in the first MB non-mapped area of the NAND Flash. 512KB is reserved on the flash to hold the IPL.
KIRK (part of TACHYON) (another Star Trek term)
The hardware crypto engine responsible for almost all aspects of the PSP’s security, including decryption of eboots & prx’s, savefile and adhoc encryption, and idstorage verification. Named after Captain Kirk of Star Trek.
LEPTON (another Star Trek term) *chip CXD1876*
The codename for the Mechacon UMD Controller IC. A Sony custom-made LSI which holds the optical media DSP & CPU, the ATAPI interface, 480KB DRAM read buffer, and (at least) 384KB Flash ROM for firmware.
Magpie
The codename for the PSP Fat’s WLAN firmware (bird name also used for the codename of the PSP Slim’s LCD Controller IC: “Hibari” – means Skylark).
NAND
Refers to NAND Flash. A type of non-volatile memory similar to an EEPROM which uses NAND Gate cells (as opposed to NOR Flash which uses NOR Gates). On the PSP, a single MCP IC holds both the NAND Flash and DDR SDRAM both of which are 32MB in size (on the slim PSP both are doubled to 64MB and embedded into the TACHYON main CPU IC). The NAND Flash holds the entire PSP Firmware as well as the IPL and IdStorage.
POMMEL (another Star Trek term) *chip MB44C001*
The codename for the Power Control IC. A DC-DC converter controlled by SYSCON.
PBP (PSP Boot Package)
The file extension for eboots used to launch programs under the VSH. Holds the ELF executable file as well as optional icon/background/sound files to visually display under the VSH.
PRX (PSP Relocatable Executable)
A custom relocatable ELF file used as the executable file format for PSP programs. Typically used as library modules in the PSP firmware. Similar to the IRX (IOP Relocatable Executable) or ERX (EE Relocatable Executable) of the PS2 executable formats.
PSAR (Playstation Archive)
An archiving file format used to store an image of the PSP’s firmware. Used by firmware updaters to update the PSP’s firmware.
Psjs (Playstation Javascript)
A javascript-like scripting language used to drive the XMB and its resources.
SPOCK (part of TACHYON) (another Star Trek term)
The hardware crypto engine responsible for the raw sector level decryption of UMD’s. Named after Captain Spock of Star Trek.
SYSCON (codename BARYON)
The System Control microcontroller which handles everything from, controlling power to all devices (including the LCD, UMD drive, memstick, wlan, even the main cpu), keeping the date/time, sleep mode control, controls all external switches including all buttons & the analog nub as well as the headphone remote buttons/switches, LED control, main power & battery control, and even access to the PSP’s Service Mode (SYSCON is the chip responsible for detecting the 0xFFFFFFFF serial of the battery to enable service mode).
TACHYON (another Star Trek term) *chip CXD2962GG*
The codename for the main CPU SoC IC. A Sony custom-made LSI which holds the main CPU (Allegrex), the VFPU coprocessor, the Media Engine CPU & its embedded DRAM, the Graphics Engine & its embedded DRAM, the AVC decoder, the Virtual Mobile Engine DSP, the KIRK & SPOCK crypto engines, and the 4KB embedded mask ROM which holds the PreIPL and routines to boot into service mode.
Voyager (another Star Trek term)
The codename for the PSP Slim’s WLAN firmware. Named after the Starfleet vessel of Star Trek.
VSH (Visual Shell)
The main interface of the PSP, a user interface shell which provides the access to the kernel. Uses Sony’s XMB (Cross Media Bar) for its GUI.
XMB (Cross Media Bar)
The graphical component of the VSH. A script driven GUI first developed for the Sony Japanese PSX DVR (Digital Video Recorder) and also used on Sony WEGA & Bravia TV’s as well as the Sony PS3.
Circuit Schematics
The PSP TA-079 motherboard (not including sub-boards) contains 4 proprietary IC’s made by Sony itself and 7 other IC’s produced for Sony by other companies. None of the Sony produced chips have publically available datasheets and only 2-3 of the non-Sony produced chips have so far been identified as being based on known production chips with publically available datasheets. Because so much of the critical chip circuitry of the PSP is unknown (and will probably stay that way for the foreseeable future), any schematic produced by the user community is doomed to contain a great deal of omissions and errors, so use them with caution.
These schematics will be updated as new information is obtained:
Power Circuits – updated 5/12/09
Useful Links and Credits
In writing this document, I have found useful information in more places than I can realistically recall, but a couple places really stand out.
Acidmods.com
http://acidmods.com/Probably THE best mod site on the internet (and since I’m the one writing this document, my opinion’s the one that counts), if you have a hardware question about the PSP, this site is your best bet on finding help.
Dark-Alex
http://www.dark-alex.org/One of the finest custom firmware (CFW) site on the internet.
Hitman Group
http://hitmen.c02.at/Home of a great PSP guide called ‘yet another PlayStationPortable Documentation’. It hasn’t been updated in a while but it’s full of useful information and can be found at
http://hitmen.c02.at/files/yapspd/psp_doc/index.html#idx3.5/The Llamma’s adventures in Sony PSP
http://www.llamma.com/PSP/index.htmlA good site for repair parts and guides (with lots of pictures).
SBORPS (SilverSpring’s Bunch Of Random PSP Stuff)
http://my.malloc.us/silverspring/The name says it all, but you can find a lot of great PSP developer-type information on this site.