Communication Processor Update Package

From Vita Development Wiki
Revision as of 07:42, 25 October 2018 by Mathieulh (talk | contribs)
Jump to navigation Jump to search

Updates to the communication processor are stored within a special CPUP package contained within Development kit (DEM or PDEL) PUP files.

In firmware .940 and .945 (and their subsets) exclusively, the CPUP are embedded within encrypted Update Packages.

CPUP Structure

Each CPUP shares a common header.

Offset Size Description
0x0 0x4 MAGIC (CpUp in Little Endian)
0x4 0x4 Version (in Little Endian)
0x13 0x1 Unknown, always 0x01
0x14 0x4 Full CPUP Size (in Little Endian)
0x18 0x1 Unknown, always 0x20
0x1C 0x4 Extracted/Decrypted CPUP size (in Little Endian)

Every CP updates below version 1000 (found in firmware 1.00) are divided in 2 parts (2 distinct CPUP files sharing the same version value).

Every version after version 1000 is only comprised of a single part.

CP board id

  • DEM-300xH has the CP board id 3
  • PDEL-100x has the CP board id 4

CP version

Here are the different CP versions identified as of today:

CPUP Header CP Version System Software Version
00060004 0604 0.902
00080508 0858 0.931
00090100 0910 0.940
00090203 0923 0.945
00090501 0951 0.990
00090600 0960 0.995.000
00090700 0970 0.995.070
00090708 0978 0.996
01000000 1000 1.000
01000001 1001 1.030
01000002 1002 1.040
01000106 1016 1.500
01000300 1030 1.600
01000800 1080 1.800
01010000 1100 2.000
01010702 1172 2.120
01010904 1194 2.500
01020001 1201 3.000
01030001 1301 3.100

Kernel Boot Loader logs

The Kernel Boot Loader and Non-secure Kernel Boot Loader respectively reference the current CP version in their bootlog (the version issued by KBL appears in the console output), this follows the below standard:

KBL:

Starting PSP2 Kernel Boot Loader [0x%08x]: %d...revision   : %d.build date : %s.....cp info.   : bid.%x ver.%04x

NSKBL:

Starting PSP2 Kernel Boot Loader (Non-secure) [0x%08x]: %d...BOOTSW.......%d: 0x%08x....: CP time...: CP bid & version

Where bid. is the Board id and ver. is the CP firmware version For example "bid.4 ver.1301" stands for board id 4, CP version 1301

in NSKBL format the information is logged in the following format: "0x00041301 [0x00041301]: CP bid & version" Where 0x0004 is the mask for bid (Board id 4) and 0x1301 is the mask for version (Version 1301).


These version information appear to most likely be read from sysroot at offset 0x44 (0x4 bytes in little endian, 0x01130400 for bid.4 ver.1301, or 0x00041301 with the proper endianness)

Update

The Communication Processor is updated through the use of the SceDeci4pCpup module.

Downgrade

Note: The Communication Processor on PS Vita Development units is not downgradable within normal operations (even when downgrading the unit itself using a PUP).