Communication Processor Update Package
Updates to the communication processor are stored within a special CPUP package contained within Development kit (DEM or PDEL) PUP files.
In firmware .940 and .945 (and their subsets) exclusively, the CPUP are embedded within encrypted Update Packages.
CPUP Structure
Each CPUP shares a common header.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | MAGIC (CpUp in Little Endian) |
| 0x4 | 0x4 | Version (in Little Endian) |
| 0x13 | 0x1 | Unknown, always 0x01 |
| 0x14 | 0x4 | Full CPUP Size (in Little Endian) |
| 0x18 | 0x1 | Unknown, always 0x20 |
| 0x1C | 0x4 | Extracted/Decrypted CPUP size (in Little Endian) |
Every CP updates below version 1000 (found in firmware 1.00) are divided in 2 parts (2 separate CPUP files set to the same version value).
Every version after version 1000 is only comprised of a single part.
CP board id
- DEM-300xH has the CP board id 3
- PDEL-100x has the CP board id 4
CP version
Here are the different CP versions identified as of today:
| CPUP Header | CP Version | System Software Version |
|---|---|---|
| 00060004 | 0604 | 0.902 |
| 00080508 | 0858 | 0.931 |
| 00090100 | 0910 | 0.940 |
| 00090203 | 0923 | 0.945 |
| 00090501 | 0951 | 0.990 |
| 00090600 | 0960 | 0.995.000 |
| 00090700 | 0970 | 0.995.070 |
| 00090708 | 0978 | 0.996 |
| 01000000 | 1000 | 1.000 |
| 01000001 | 1001 | 1.030 |
| 01000002 | 1002 | 1.040 |
| 01000106 | 1016 | 1.500 |
| 01000300 | 1030 | 1.600 |
| 01000800 | 1080 | 1.800 |
| 01010000 | 1100 | 2.000 |
| 01010702 | 1172 | 2.120 |
| 01010904 | 1194 | 2.500 |
| 01020001 | 1201 | 3.000 |
| 01030001 | 1301 | 3.100 |
Kernel Boot Loader logs
The Kernel Boot Loader and Non-secure Kernel Boot Loader respectively reference the current CP version in their bootlog (the version issued by KBL appears in the console output), this follows the below standard:
KBL:
Starting PSP2 Kernel Boot Loader [0x%08x]: %d...revision : %d.build date : %s.....cp info. : bid.%x ver.%04x
NSKBL:
Starting PSP2 Kernel Boot Loader (Non-secure) [0x%08x]: %d...BOOTSW.......%d: 0x%08x....: CP time...: CP bid & version
Where bid. is the Board id and ver. is the CP firmware version For example "bid.4 ver.1301" stands for board id 4, CP version 1301
in NSKBL format the information is logged in the following format: "0x00041301 [0x00041301]: CP bid & version" Where 0x0004 is the mask for bid (Board id 4) and 0x1301 is the mask for version (Version 1301).
These version information appear to most likely be read from sysroot at offset 0x44 (0x4 bytes in little endian, 0x01130400 for bid.4 ver.1301, or 0x00041301 with the proper endianness)
Update
The Communication Processor is updated through the use of the SceDeci4pCpup module.
Downgrade
Note: The Communication Processor on PS Vita Development units is not downgradable within normal operations (even when downgrading the unit itself using a PUP).