Syscon Update

= Structure =

Ernie updates are stored in a packet format.

Packet Header
Any update packet has a common header structure.

Packet size varies depending on the hardware revision of Syscon: Renesas 78K0R/Kx3: 0x800 Renesas 78K0R/Kx3-L: 0x400 Renesas RL78/G13: 0x400

0x01
Version packet.

This packet is update header field.

Ernie Version and Hardware Info from a few PUPs:

0x02
Key revision packet.

This packet embeds the encryption key revision used to decrypt the Syscon update packets.


 * Key revision 0 is for Renesas 78K0R Proto. It is supported since at least FW 0.931 (FW 0.902 doesn't support this) until FW 1.692.
 * Key revision 1 is for Renesas 78K0R. It is supported since about FW 1.00. It is the key revision for most Fat PSVitas and for PSTV.
 * Key revision 2 is for Renesas RL78. It is supported since FW 2.50. It is the key revision for PSVita Slim Syscon.

0x03
Warning! This packet is not embedded in the Ernie Update SPKG. It is generated in ARM kernel and sent to Syscon with some Syscon command.

It is related to Syscon commands 0x1185 and 0x1183. See SceSyscon.

0x10
Encrypted data packet.

Each data packet is AES128CBC encrypted.

0x20
Digest packet.

Ernie Update steps

 * ARM PSVita updater arrives at last step: Ernie update.
 * ARM PSVita updater decrypts Ernie update SPKGs til it finds one whose Hardware Info matches.
 * ARM PSVita updater sends the encrypted data blocks directly to Ernie using some command.
 * Ernie decrypts concatenated received data blocks using AES128CBC.
 * Ernie installs the update using the decrypted data.