http://wiki.henkaku.xyz/vita/index.php?title=Special:NewPages&feed=atom&hideredirs=1&limit=50&offset=&namespace=0&username=&tagfilter=&size-mode=max&size=0Vita Development Wiki - New pages [en]2024-03-29T07:54:19ZFrom Vita Development WikiMediaWiki 1.35.13http://wiki.henkaku.xyz/vita/SceSblPcffBinSceSblPcffBin2024-01-17T22:11:44Z<p>Princess of Sleeping: </p>
<hr />
<div>SceSblPcffBin is a kernel module containing the <b>P</b>SP <b>C</b>ompatibility <b>F</b>lash <b>F</b>iles i.e. PSPEmu Flash memory files.<br />
<br />
== Module ==<br />
<br />
{| class="wikitable"<br />
|-<br />
! Version !! World !! Privilege<br />
|-<br />
| 3.60 || Non-secure || Kernel<br />
|}<br />
<br />
== Libraries ==<br />
<br />
This module does not export any library except NONAME library.<br />
<br />
[[Category:ARM]]<br />
[[Category:Kernel]]<br />
[[Category:Modules]]</div>CelesteBluehttp://wiki.henkaku.xyz/vita/VisibleIdVisibleId2024-01-11T00:03:34Z<p>Princess of Sleeping: /* Usage */</p>
<hr />
<div>The PS Vita Visible ID is a unique per-console identifyer. It is an extension of the PSP Fuse ID.<br />
<br />
= Usage =<br />
<br />
The Visible ID has three main functions: identification, personalization, challenges.<br />
<br />
The first function is to uniquely identify a PS Vita console. However, the console mostly uses other identifyers like the Console ID and the Open PSID. The reason is that Visible ID is more predictable than OpenPSID and less descriptive than ConsoleID. However, an advantage of the Visible ID is that it contains the FuseId, which is used in PSPemu and in PSN challenges.<br />
<br />
The second function is to allow per-console encryption, aka personalization. From the Visible ID, some per-console keys are derived, like the one that signs IDPS Certificates, and probably also the one that signs SMI.<br />
<br />
The third function is to build per-console PSN challenges. A challenge is an encrypted set of data that is sent to PSN. Challenges are built for example in openpsid.prx on PSP and in [[SceSblGcAuthMgr]] on PS Vita. It is important to note that these challenges only use the 6 bytes FuseId from the 16 bytes Visible ID, which is probably in order to keep challenge format used for the PSP. See [[SceSblGcAuthMgr#Challenge]].<br />
<br />
Note that the Fuse ID is also contained in [[Cmep Key Ring Base|Cmep keyring 0x602]] because it is part of the SceIdStorageSeedValue.<br />
<br />
== Note ==<br />
<br />
The Visible ID is stored in a fuse (OTP Keyring 0x600), so it cannot be permanently changed like the Console ID or OpenPSID.<br />
<br />
= Structure =<br />
<br />
<source lang="C"><br />
typedef struct ScePsp2FuseId { // size is 8 bytes<br />
char dummy[2]; // constant (00 00) and replaced by constant 10 08<br />
char constant[2]; // constant (01 01)<br />
char serial_no[3]; // variable, incrementing serial number in little-endian<br />
char model_revision; // seems to always be 00 for PCH-1xxx and PDEL, 01 for PCH-2xxx and PS TV<br />
} ScePsp2FuseId;<br />
<br />
typedef struct ScePsp2VisibleId {<br />
ScePsp2FuseId fuse_id;<br />
char random[0x18];<br />
} ScePsp2VisibleId;<br />
</source><br />
<br />
Note that PSP Fuse ID is only 6 bytes not 8 (2 bytes are always zeroes). This is explained by the fact that the PSP's fuse containing Fuse ID is designed to store 6 bytes of Fuse ID (and probably 2 bytes of Fuse Configuration). And note that PS Vita's Fuse ID has hardcoded bytes, showing again that only 6 bytes are really per-console.<br />
<br />
= Location =<br />
<br />
Visible ID is physically contained in some "fuses".<br />
<br />
Visible ID is stored in [[Cmep Key Ring Base|Cmep keyring 0x600]].<br />
<br />
Visible ID can be obtained directly either by reading [[Cmep Key Ring Base|Cmep keyring 0x600]] with [[Cmep]] code execution, or by calling [[Syscon UART RPC]] command 0x120.<br />
<br />
Visible ID can be obtained less directly with kernel privilege by calling [[Secure_Modules_Functions#0x3_-_GetVisibleId]] or [[SceSblSsMgr#sceSblAimgrGetVisibleIdForDriver]].<br />
<br />
Visible ID can be obtained less directly with usermode system privileg by calling [[SceVshBridge#vshSblAimgrGetVisibleId]].<br />
<br />
= Proof that Visible ID contains Fuse ID =<br />
<br />
Code from openpsid.prx PSP kernel module that generates a challenge:<br />
<source lang="C"><br />
u32 fuseid0 = *(u32 *)0xBC100090;<br />
u32 fuseid1 = *(u32 *)0xBC100094;<br />
challenge_work[88] = fuseid1 >> 24;<br />
challenge_work[89] = fuseid1 >> 16;<br />
challenge_work[90] = fuseid1 >> 8;<br />
challenge_work[91] = fuseid1;<br />
challenge_work[92] = fuseid0 >> 24;<br />
challenge_work[93] = fuseid0 >> 16;<br />
challenge_work[94] = fuseid0 >> 8;<br />
challenge_work[95] = fuseid0;<br />
memcpy(work+0x14, challenge_work, 0x60);<br />
</source><br />
<br />
Code from [[SceSblGcAuthMgr]] PS Vita kernel module that generates a challenge:<br />
<source lang="C"><br />
ret = sceSblAimgrGetVisibleIdForDriver(g_visible_id);<br />
if ((int)ret < 0) goto fail;<br />
challenge_0x60_tmp[88] = 0x10;<br />
challenge_0x60_tmp[89] = 8;<br />
challenge_0x60_tmp[90] = g_visible_id[2];<br />
challenge_0x60_tmp[91] = g_visible_id[3];<br />
challenge_0x60_tmp[92] = g_visible_id[4];<br />
challenge_0x60_tmp[93] = g_visible_id[5];<br />
challenge_0x60_tmp[94] = g_visible_id[6];<br />
challenge_0x60_tmp[95] = g_visible_id[7];<br />
</source><br />
<br />
= Samples =<br />
<br />
Visible ID of Test Subject 9 PS Vita:<br />
<pre><br />
00 00 01 01 AC 72 45 00 F5 68 96 03 80 57 C8 1A<br />
25 99 21 A1 73 A4 89 F2 E9 96 23 E9 86 0F 74 2D<br />
</pre><br />
<br />
Visible ID of some PDEL-100x:<br />
<pre><br />
00 00 01 01 3A 60 45 00 C0 26 0E C9 99 12 F1 CB<br />
26 C1 3C BB 8E CE 9C C2 3C A1 11 84 6F 7A 86 F6<br />
</pre><br />
<br />
Visible ID of some PS Vita Slim or PS TV:<br />
<pre><br />
00 00 01 01 78 E8 86 01 61 2E 3A 4A DD E0 41 44<br />
62 D5 2C 05 18 51 9F 00 60 0D 57 36 53 BC 77 C4<br />
</pre><br />
<br />
Samples of PSP Fuse ID:<br />
* 0x0000590C 26A1828E<br />
<br />
Samples of PSP Fuse Configuration (endianness maybe wrong):<br />
* 0x2D00 (TA-085 slim 02g)<br />
* 0x3300 (TA-095v2 09g)</div>CelesteBluehttp://wiki.henkaku.xyz/vita/SDIF_RegistersSDIF Registers2024-01-09T18:19:56Z<p>Xerpi: /* Registers */</p>
<hr />
<div><span id="mmio-interfaces"></span><br />
== MMIO Interfaces ==<br />
<br />
{| class="wikitable"<br />
|-<br />
! Name<br />
! Physical Address<br />
|-<br />
| SceSdif0 (MMC)<br />
| 0xE0B00000<br />
|-<br />
| SceSdif1 (SD/GC)<br />
| 0xE0C00000<br />
|-<br />
| SceSdif2 (Wlan/Bt)<br />
| 0xE0C10000<br />
|-<br />
| SceSdif3 (UNK)<br />
| 0xE0C20000<br />
|}<br />
<br />
<span id="registers"></span><br />
== Registers ==<br />
<br />
{| class="wikitable"<br />
|-<br />
! Offset<br />
! Size<br />
! Name<br />
! Comment<br />
|-<br />
| 0x00<br />
| 0x4<br />
| SDMA System Address / Argument 2<br />
|<br />
|-<br />
| 0x04<br />
| 0x2<br />
| Block Size<br />
|<br />
|-<br />
| 0x06<br />
| 0x2<br />
| Block Count<br />
|<br />
|-<br />
| 0x08<br />
| 0x4<br />
| Argument 1<br />
|<br />
|-<br />
| 0x0C<br />
| 0x2<br />
| Transfer Mode<br />
| Bootrom is seen to use Reserved bits<br />
|-<br />
| 0x0E<br />
| 0x2<br />
| Command<br />
|<br />
|-<br />
| 0x10<br />
| 0x2<br />
| Response0<br />
|<br />
|-<br />
| 0x12<br />
| 0x2<br />
| Response1<br />
|<br />
|-<br />
| 0x14<br />
| 0x2<br />
| Response2<br />
|<br />
|-<br />
| 0x16<br />
| 0x2<br />
| Response3<br />
|<br />
|-<br />
| 0x18<br />
| 0x2<br />
| Response4<br />
|<br />
|-<br />
| 0x1A<br />
| 0x2<br />
| Response5<br />
|<br />
|-<br />
| 0x1C<br />
| 0x2<br />
| Response6<br />
|<br />
|-<br />
| 0x1E<br />
| 0x2<br />
| Response7<br />
|<br />
|-<br />
| 0x20<br />
| 0x4<br />
| Buffer Data Port<br />
|<br />
|-<br />
| 0x24<br />
| 0x4<br />
| Present State<br />
|<br />
|-<br />
| 0x28<br />
| 0x1<br />
| Host Control 1<br />
|<br />
|-<br />
| 0x29<br />
| 0x1<br />
| Power Control<br />
|<br />
|-<br />
| 0x2A<br />
| 0x1<br />
| Block Gap Control<br />
|<br />
|-<br />
| 0x2B<br />
| 0x1<br />
| Wakeup Control<br />
|<br />
|-<br />
| 0x2C<br />
| 0x2<br />
| Clock Control<br />
|<br />
|-<br />
| 0x2E<br />
| 0x1<br />
| Timeout Control<br />
|<br />
|-<br />
| 0x2F<br />
| 0x1<br />
| Software Reset<br />
|<br />
|-<br />
| 0x30<br />
| 0x2<br />
| Normal Interrupt Status<br />
|<br />
|-<br />
| 0x32<br />
| 0x2<br />
| Error Interrupt Status<br />
|<br />
|-<br />
| 0x34<br />
| 0x2<br />
| Normal Interrupt Status Enable<br />
|<br />
|-<br />
| 0x36<br />
| 0x2<br />
| Error Interrupt Status Enable<br />
|<br />
|-<br />
| 0x38<br />
| 0x2<br />
| Normal Interrupt Signal Enable<br />
|<br />
|-<br />
| 0x3A<br />
| 0x2<br />
| Error Interrupt Signal Enable<br />
|<br />
|-<br />
| 0x3C<br />
| 0x2<br />
| Auto CMD Error Status<br />
|<br />
|-<br />
| 0x3E<br />
| 0x2<br />
| Host Control 2<br />
|<br />
|-<br />
| 0x40<br />
| 0x8<br />
| Capabilities<br />
|<br />
|-<br />
| 0x48<br />
| 0x8<br />
| Maximum Current Capabilities<br />
|<br />
|-<br />
| 0x50<br />
| 0x2<br />
| Force Event for Auto CMD Error Status<br />
|<br />
|-<br />
| 0x52<br />
| 0x2<br />
| Force Event for Error Interrupt Status<br />
|<br />
|-<br />
| 0x54<br />
| 0x1<br />
| ADMA Error Status<br />
|<br />
|-<br />
| 0x55<br />
| 0x3<br />
| UNUSED<br />
|<br />
|-<br />
| 0x58<br />
| 0x8<br />
| ADMA System Address<br />
|<br />
|-<br />
| 0x60<br />
| 0x2<br />
| Preset Value for Initialization<br />
|<br />
|-<br />
| 0x62<br />
| 0x2<br />
| Preset Value for Default Speed<br />
|<br />
|-<br />
| 0x64<br />
| 0x2<br />
| Preset Value for High Speed<br />
|<br />
|-<br />
| 0x66<br />
| 0x2<br />
| Preset Value for SDR12<br />
|<br />
|-<br />
| 0x68<br />
| 0x2<br />
| Preset Value for SDR25<br />
|<br />
|-<br />
| 0x6A<br />
| 0x2<br />
| Preset Value for SDR50<br />
|<br />
|-<br />
| 0x6C<br />
| 0x2<br />
| Preset Value for SDR104<br />
|<br />
|-<br />
| 0x6E<br />
| 0x2<br />
| Preset Value for DDR50<br />
|<br />
|-<br />
| 0x70<br />
| 0x70<br />
| UNUSED<br />
|<br />
|-<br />
| 0xE0<br />
| 0x4<br />
| Shared Bus Control<br />
|<br />
|-<br />
| 0xE4<br />
| 0x18<br />
| UNUSED<br />
|<br />
|-<br />
| 0xFC<br />
| 0x2<br />
| Slot Interrupt Status<br />
|<br />
|-<br />
| 0xFE<br />
| 0x2<br />
| Host Controller Version<br />
| Reads as <code>0x8901</code> (SDHCI Spec 2.0, vendor <code>0x89</code>) on a PSTV.<br />
|}<br />
<br />
<span id="notes"></span><br />
=== Notes ===<br />
<br />
All registers are the same as defined in the SD Specifications Part A2: https://www.ercankoclar.com/wp-content/uploads/2017/11/SD-Specifications-Part-A2-SD-Host-Controller-Simplified-Specification.pdf</div>SonicMastrhttp://wiki.henkaku.xyz/vita/BarkleyBarkley2024-01-08T18:34:44Z<p>CelesteBlue: </p>
<hr />
<div>Barkley is the PS Vita Motion Sensor. It is also referred as "Motion" in the System Software SDK. It is still unknown if Barkley is only the gyroscope or the full set of components related to motion sensing.<br />
<br />
On DEM-3000H:<br />
* Value line microcontroller: [https://www.st.com/en/microcontrollers-microprocessors/stm32f100-value-line.html STMicroelectronics STM32F100].<br />
STMicroelectronics’s STM32F100 Value line microcontrollers deliver high processing performance coupled with up to eleven 16‑bit timers,<br />
including a motor control timer and a fast 1.2 μs conversion time 12‑bit ADC for efficient appliance and industrial-control applications.<br />
Based on the Arm® Cortex®-M3 core running at up to 24 MHz, the STM32 Value line offers an excellent cost-performance-peripherals trade-off.<br />
It provides all the essential features to make it the perfect choice to develop cost-effective applications traditionally addressed by 16-bit microcontrollers.<br />
* Accelerometer: Kionix KXTC9 (three-axis MEMS accelerometer IC). It is a chip connected to [[Kermit]] via SPI.<br />
* Gyroscope: STMicroelectronics 3GA51H<br />
* ?Magnetic compass?: STMicroelectronics ST32P10SoE / GK09093<br />
<br />
On PCH-1xxx:<br />
* ?Magnetic compass?: STMicroelectronics ST32P10S0E (undocumented)<br />
<br />
[[Category:Devices]]</div>CelesteBluehttp://wiki.henkaku.xyz/vita/BatteryBattery2024-01-08T18:03:22Z<p>CelesteBlue: </p>
<hr />
<div>Most PS Vita models contain a battery.<br />
<br />
= Battery models =<br />
<br />
* No battery: [[IRT-001]], [[IRT-002]]<br />
* [[SP65M]] with black connector: [[IRS-002]]<br />
* [[SP65X]] with grey connector: [[IRS-1001]]<br />
* [[SP86R]]: [[USS-1001]], [[USS-1002]]<br />
<br />
[[Category:Devices]]</div>CelesteBluehttp://wiki.henkaku.xyz/vita/External_Boot_ModeExternal Boot Mode2024-01-06T21:13:06Z<p>CelesteBlue: Created page with "Similarly to the Jigkick battery on PSP, the PS Vita also has a hidden manufacturing/recovery mode in the boot ROM. By convention, we call this "external boot mode". Once a ha..."</p>
<hr />
<div>Similarly to the Jigkick battery on PSP, the PS Vita also has a hidden manufacturing/recovery mode in the boot ROM. By convention, we call this "external boot mode". Once a handshake with Kermit boot ROM passes, the PS Vita will boot from an SD card in the gamecard slot instead of from internal eMMC. The payload must be signed by Sony specifically for this mode. However the signature check can be bypassed by glitching. See [[Vulnerabilities]].<br />
<br />
To trigger Kermit Bootrom Jig mode, first enable [[Syscon UART RPC]] then do a handshake with [[Kermit]].<br />
<br />
See also: [[SLSK#Secret_debug_mode]].<br />
<br />
= Entering Handshake =<br />
<br />
Now that [[#Jig_Handler]] is set up, you can use Syscon UART RPC interface to trigger the Kermit handshake.<br />
<br />
# Send a Jig packet with RPC command 0x110. This is a packet whose payload is encrypted.<br />
# In the decrypted packet, the data triggers some command handler which sets flag <code>0x18</code>.<br />
# Only state 1 handles flag <code>0x18</code>.<br />
# Main Function in state 1 is called with target state 9. It does some unknown tasks (maybe power on device?) and sets flag <code>0x15</code>. State is set to 9.<br />
# Main Function in state 9 is called with target state 3 (due to flag <code>0x15</code>).<br />
# Ernie is ready to perform the handshake.<br />
<br />
= Handshake =<br />
<br />
The pin references for [[Kermit]] are from [[GPIO Registers]]. The pin references for Ernie are from the reference manual. TODO: figure out the physical mapping of the pins.<br />
<br />
# Ernie sets P15.<br />
# Ernie sets P97.<br />
# Kermit polls for GPIO Port 4 high.<br />
# Kermit does some magic register writes (possibly switching SPI pins to Jig handshake interface).<br />
# Kermit writes 8 bytes challenge to a [[Cmep]] only register.<br />
# Kermit sets GPIO Port 3 high.<br />
# Ernie polls for P16 high.<br />
# Ernie clears P90<br />
# (Step 1 Kermit -> Ernie) Ernie receives a packet <code>84 00 88 XX XX XX XX</code> where XX is 4 bytes of the challenge.<br />
# Ernie sets P90.<br />
# Ernie clears P90.<br />
# (Step 2 Kermit -> Ernie) Ernie receives a packet <code>84 00 8C XX XX XX XX</code> where XX is 4 bytes of the challenge.<br />
# Ernie sets P90.<br />
# Ernie does some endian swapping with the data.<br />
# Ernie AES encrypts the challenge with the shared key with Kermit boot ROM.<br />
# Ernie does some endian swapping with the data.<br />
# Kermit polls for GPIO Port 4 high.<br />
# Ernie clears P90.<br />
# (Step 1 Ernie -> Kermit) Ernie sends a packet <code>85 00 80 XX XX XX XX</code> where XX is 4 bytes of the response.<br />
# Ernie sets P90.<br />
# Ernie clears P90.<br />
# (Step 2 Ernie -> Kermit) Ernie sends a packet <code>85 00 84 XX XX XX XX</code> where XX is 4 bytes of the response.<br />
# Ernie sets P90.<br />
# Kermit magically gets 8 bytes in a [[Cmep]] only register.<br />
# Kermit sets GPIO Port 3 low.<br />
# Kermit AES encrypts the challenge with its own shared key and does a timing-safe memcmp with the response.<br />
# Kermit makes sure to wipe the key and all relevant registers.</div>CelesteBluehttp://wiki.henkaku.xyz/vita/ElmoElmo2024-01-06T16:05:50Z<p>CreepNT: Fix formatting and add to Devices category</p>
<hr />
<div><br />
Elmo is the codename of the Power Management IC (PMIC) of the PS Vita. The PMIC is responsible for generating the various voltages required by [[Kermit]] and probably other devices on the board.<br />
<br />
= Hardware =<br />
<br />
The Elmo PMIC is manufactured by Fujitsu. All models are part of the custom "MB44" series but the exact model used depends on the unit.<br />
<br />
[[Ernie]] can communicate with Elmo via I²C.<br />
<br />
[[File:FCC PCH-1001 PMIC.png|thumb|<code>MB44C026A</code> on the PCH-1001 FCC application unit]]<br />
[[File:FCC PCH-2001 board.png|thumb|<code>MB44C032</code> on the PCH-2001 FCC application unit]]<br />
<br />
== <code>MB44C026</code> ==<br />
<br />
Seen in: DEM-3000G, PDEL-1000 (IRT-002)<br />
<br />
Date codes: 1021, 1139<br />
<br />
== <code>MB44026A</code> ==<br />
<br />
Seen in: PCH-1001 FCC application unit, PCH-1xxx (IRS-002), VTE-1xxx (DOL-1001)<br />
<br />
Date codes: 1125, 1149, 1221<br />
<br />
== <code>MB44C029</code> ==<br />
<br />
Seen in: PCH-1000 (IRS-1001)<br />
<br />
Date codes: 1240<br />
<br />
== <code>MB44C032</code> ==<br />
<br />
Uses a black package instead of white/metallic.<br />
<br />
Seen in: PCH-2001 FCC application unit, PCH-2000 (USS-1001)<br />
<br />
Date codes: 1448, 1330<br />
<br />
[[Category:Devices]]</div>CreepNThttp://wiki.henkaku.xyz/vita/AbbyAbby2024-01-05T00:07:41Z<p>CreepNT: Add to Devices category</p>
<hr />
<div>Abby is the codename of the Fuel Gauge (battery management) IC of the PS Vita. This IC works in conjunction with [[Cookie]] to charge the battery of the unit, and also monitors the battery's charge level, health, etc.<br />
<br />
= Hardware =<br />
<br />
== SN27520 ==<br />
<br />
Customized(?) version of the Texas Instruments bq27520.<br />
<br />
Used in Fat units.<br />
<br />
[[Category:Devices]]</div>CelesteBluehttp://wiki.henkaku.xyz/vita/TouchpanelTouchpanel2024-01-04T23:50:03Z<p>CelesteBlue: Created page with "The PS Vita has two touchpanels. The front one is a screen whilst the rear one is part of the shell. The PS Vita touchpanels are controlled by the Atmel MaXTouch 224 controlle..."</p>
<hr />
<div>The PS Vita has two touchpanels. The front one is a screen whilst the rear one is part of the shell. The PS Vita touchpanels are controlled by the Atmel MaXTouch 224 controller. A maximum of 224 nodes can be allocated to the touchscreen.<br />
<br />
* [https://ww1.microchip.com/downloads/en/DeviceDoc/mXT224T_1v0_Datasheet_GX.pdf Atmel MXT224T Datasheet]</div>CelesteBluehttp://wiki.henkaku.xyz/vita/CodenamesCodenames2024-01-04T23:34:35Z<p>CelesteBlue: </p>
<hr />
<div>The PS Vita software and hardware is often given by SCE codenames. This page lists them grouped by theme.<br />
<br />
= Models =<br />
<br />
* Iris: PS Vita 1000 series<br />
* Ushiwaka: PS Vita 2000 series<br />
* Dolce: PS TV<br />
<br />
= Sesame Street =<br />
<br />
Whilst PSP codenames were inspired by the Star Trek universe, most PS Vita codenames make reference to Sesame Street characters. Kermit the Frog, arguably Jim Henson's most famous Muppet creation, was the star and host of The Muppet Show, and played a significant role on Sesame Street.<br />
<br />
* [[Kermit]]: SoC. SCE's temporary codename for Kermit was SoC. Toshiba chip.<br />
* [[Ernie]]: Syscon. SCE's temporary codename for Ernie was Syscon. On PSP it was codenamed Baryon as a reference to Star Trek. Renesas chip.<br />
* [[Grover]]: Communication Processor<br />
* [[Elmo]]: Power Management IC<br />
* [[Abby]]: Battery Fuel Gauge (System-Side Impedance Track™ Fuel Gauge With Integrated LDO). SCE's temporary codename for Abby was Battery.<br />
* [[Cookie]]: USB Charge Management IC<br />
* [[Barkley]]: Motion sensor accelerometer IC (maybe only gyroscope part)<br />
* [[Robin]]: Wireless LAN and Bluetooth card<br />
* [[Zoe]]: 3G communication modem<br />
<br />
= Toshiba =<br />
<br />
* [[Venezia]]: Toshiba's codename for car camera's smart recognition chip. SCE's temporary codename for Venezia was CodecEngine.<br />
* VIP: Toshiba Venezia Image Processing<br />
* [[Cmep|Cry/Cmep]]: Toshiba MeP crypto processor</div>CelesteBlue