Orbis OS - das Betriebssystem der PS4

[crysmopompas]

Bereits bei der PS3 hat sich Sony beim OpenSource-Betriebssystem (Free)BSD bedient, so wird z.B. auf der Festplatte das UFS2 Dateisystem genutzt.
Was sonst noch verwendet wurde läßt sich nicht so leicht nachprüfen, da anders als bei der bei der GPL Lizenz, die z.B. Linux nutzt, bei der BSD Lizenz Änderungen nicht veröffentlicht werden müssen. Man kann mit der Software quasi machen was man will.

Auf der PS4 setzt Sony bei der Basis des Betriebssystems auf FreeBSD 9. Ergänzt wird das ganze um proprietäre Komponenten von Sony (GUI, Grafikschnittstelle, PSN, ...).

Bilder eines 2nd-Gen-Devkit von vgleaks.:

Hier erwähnt Mark Cerny die BSD-Basis:
http://av.watch.impress.co.jp/docs/series/rt/20130325_593036.html bzw. http://www.neogaf.com/forum/showpost.php?p=52024563&postcount=461

Cerny: The OS is based on BSD. I believe this is the first game console using this architecture.
From the OS side, the PS4 will allow use of many multiple features simultaneously. Our goal is something like the following:

Send a video of the game you’re playing, and return to the game immediately to continue playing. Then, watch a game play video from your friend, then switch to video chat with that friend right away. If you see interesting DLC that your friend has, move to the store, then be able to ask your friend if it’s the right one.
In this manner, we envision it to be possible to come-and-go between and use many features. Even for multi-player games, you would be able to move the game to the background without quitting, and go through a similar routine.

The facilitation by the OS will allow for a rich set of actions.

Eine weitere Bestätigung von Sony bei Eurogamer:

Sony has issued a statement:
...
"Flexible Memory" is memory managed by the PS4 OS on the game's behalf, and allows games to use some very nice FreeBSD virtual memory functionality. However this memory is 100 per cent the game's memory, and is never used by the OS, and as it is the game's memory it should be easy for every developer to use it.

Auch auf der FreeBSD Mailingliste hat sich Sony eingebracht, hier 2011(!) mit einem AVX-Patch, ein Feature das neuere AMD-CPUs unterstützen. Ein Zusammenhang mit der PS4 ist nicht automatisch gegeben, liegt aber nahe.

 

[crysmopompas]

Lizenzliste der PS4:

Open Source Software used in PlayStation®4

PlayStation®4 uses the open source software listed below.

• base64
• BSD libc
• cairo
• CELT (Opus)
• cJSON
• cURL
• eglib
• Ethernet driver
• Expat XML Parser
• FreeBSD Kernel
• FreeBSD's fsck/newfs commands
• FreeType 2
• giflib-4.1.2
• ICU
• Jerasure version 1.2A
• jQuery
• kiconv for unicode
• libcompiler_rt
• libcxxrt
• libjpeg
• libjpeg-turbo
• libm
• libpng
• libpthread
• libunwind
• libusb FreeBSD
• libusrsctp 0.9.1
• libxml2
• Lua
• Mersenne Twister
• mmc driver & sdhci driver
• Mono class libraries
• Mono VM
• Network FreeBSD
• OpenSSL
• pixman
• Protocol Buffers
• SQLite-net
• squish
• udf2.x fs
• Webkit
• zlib

http://www.scei.co.jp/ps4-license/

 

[crysmopompas]

Update:

Open Source Software used in PlayStation®4

• base64
• BSD libc
• cairo
• CELT (Opus)
• cJSON
• cURL
• eglib
• Ethernet driver
• Expat XML Parser
• FreeBSD Kernel
• FreeBSD's fsck/newfs commands
• FreeType 2
• giflib-4.1.2
• growfs
• HarfBuzz
• ICU
• Intrusive MPSC node-based queue
• Jerasure version 1.2A
• jQuery
• kiconv for unicode
• libcompiler_rt
• libcxxrt
• libjpeg
• libjpeg-turbo
• libm
• libpng
• libpthread
• libunwind
• libusb FreeBSD
• libusrsctp 0.9.1
• libxml2
• Lua
• Mersenne Twister
• mmc driver & sdhci driver
• Mono class libraries
• Mono VM
• Network FreeBSD
• OpenSSL
• pixman
• Protocol Buffers
• SQLite-net
• squish
• udf2.x fs
• Webkit
• zlib

SHAREfactory™

• FFmpeg

 

[crysmopompas]

Vielleicht liegen die Gründe für das Fehlen der Standbyfunktion für Spiele tiefer:

One of the most often cited shortcomings for FreeBSD is for suspend and resume to actually work.

https://wiki.freebsd.org/SuspendResume

 

[-MORF-]

So damit auch mal jemand anderes in diesem Thread postet

Das Suspend Feature scheint ja rudimentär vorhanden zu sein, wenn man zB von einem Spiel heraus in die YouTube App geht, oder in irgendeine andere der Media Apps, wird das aktuelle Spiel ja suspended.
Nur wenn man ein anderes Spiel spielen will geht es nicht, oder die PS4 in den Standby schickt...
Aber wirklich brauchen tu ich das auch ehrlich gesagt gar nicht....Ich spiele Spiel X und wenn ich fertig bin, dann mach ich es aus, so läuft das seit Jahren...
Am PC minimier ich meine Spiele auch nicht, wenn ich sie nicht spiele.

 

[AngelvsMadman]

Mir würde diese minimale Funktion wie sie jetzt schon drinn ist VÖLLIG reichen.
Grund: wenn ich wirklich mal bei einem Spiel hänge -> youtube -> okay so wird das gemacht/da geht es lang -> Spiel

Klar ist sicher keine blöde Idee wenn ich schnell weg muss und einfach via Button die Konsole abschalten könnte und dann später an der selben Stelle im Spiel ohne lange vom letzten Checkpoint starten zu müssen weiter machen könnte.
Aber die aktuelle Funktion ist schon mal für meine Zwecke ausreichend, WENN sie sauber funktioniert (wäre mal interessant das zu testen mit zB infamous).

 

[Byakuya]

Seh ich ähnlich, so eine Funktion wie du sie beschreibst wuerde eher auf ein mobiles Gerät wie die Vita oder 3DS passen.
Die PSP Go hatte als einzig nützliches Feature ja genau das.

 

[crysmopompas]

@-MORF-
Es ist schon ein großer Unterschied ein Spiel anzuhalten, oder die ganze Hardware schlafen zu schicken und dann das Spiel fortzusetzen.

 

[Byakuya]

Bei der GO war es so Crysmo.
Zumindest ist es mir so in Erinnerung.

 

[crysmopompas]

Mir würde diese minimale Funktion wie sie jetzt schon drinn ist VÖLLIG reichen.
Grund: wenn ich wirklich mal bei einem Spiel hänge -> youtube -> okay so wird das gemacht/da geht es lang -> Spiel

Warum "würde"? Das geht ja mehr oder weniger.

---------- Beitrag um 10:49 Uhr hinzugefügt ---------- Vorheriger Beitrag um 10:42 Uhr ----------

Bei der Go kann man afaik den Spielstatus auf den Flashspeicher schreiben und später fortsetzen.

 

[AngelvsMadman]

Ich habs bis jetzt nicht testen können darum würde. Einmal (ist jetzt sicher 6-8 Monate her) ist mir Killzone SF abgekackt als ich vergessen habe die Maxdome-App zu schließen, ist halt die Frage ob das "Pausieren" einer App jetzt sauber funktioniert, dann nicht "würde reichen" sondern "reicht mir".

 

[Planet]

https://wiki.freebsd.org/SuspendResume

Da steht eigentlich nur, dass es auf frei verkäuflicher Hardware eine Vielzahl an Komponenten gibt die nicht unbedingt immer sauber programmierte Treiber besitzen. Das verhindert dann das Suspend (oder besser gesagt das Resume, denn Schlafen gehen sie alle ). Es werden dort aber auch etliche Geräte genannt, die einwandfrei poofen, also ist es kein grundlegendes Problem sondern der Vielfalt geschuldet.

Das sollte aber für Sony kein Problem darstellen, da sie alle Komponenten und Treiber in der Hand haben und auch keine große Varianz herrscht.

 

[crysmopompas]

Auf welche Treiber Sony zurückgreift weiß man nicht. Für einige Komponenten könnten schon die Standardtreiber zum Einsatz kommen.
Und wer weiß welche Treiber AMD im Stande ist zu liefern , Sony macht das sicher nicht alles selbst.

 

[AngelvsMadman]

Ähm okay und mit was funktioniert die Kiste dann jetzt wenn es keine Treiber gibt?

 

[crysmopompas]

Hat das jemand behauptet ???

 

[Planet]

OK, dann formuliere ich das mal anders: welche konkrete PC Konfiguration hat sich mehr als 10 Millionen mal verkauft? Sony hat es in der Hand in dem Sinne, dass sie die verwendeten Komponenten und die verwendete FreeBSD-Basisversion kontrollieren. Und da AMD den Chip als Custom Design geliefert hat, kann man wohl auch davon ausgehen, dass sie einen angepassten Treiber zur Verfügung stellen. Der Rest der Komponenten ist wohl eher relativ trivial.

Ich glaube nicht, dass dies die Bremse ist. Vermutlich liegt es eher daran, dass Spiele deutlich empfindlicher für so etwas sind als irgendwelche Desktop-Anwendungen. An einem Windows-PC der sonst den Schlafmodus einwandfrei beherrscht wacht trotzdem längst nicht jedes Spiel einwandfrei wieder mit auf.

 

[AngelvsMadman]

Sorry crysmopompas aber du formulierst das so, als gebe es für die halbe HW keine Treiber.
Was spricht dagegen die aktuellen Treiber zu verwenden? Die werden sich ja auch nicht so oft ändern.
Einige davon werden Std sein, einige nicht, aber eine fixe Basis hat man auf allen Fälle.

---------- Beitrag um 11:26 Uhr hinzugefügt ---------- Vorheriger Beitrag um 11:24 Uhr ----------

An einem Windows-PC der sonst den Schlafmodus einwandfrei beherrscht wacht trotzdem längst nicht jedes Spiel einwandfrei wieder mit auf.

Leider nicht nur Spiele.

 

[crysmopompas]

Bootlog von einem Devkit: http://www.psdevwiki.com/ps4/Bootprocess

This is a log from a cold boot from a DUH-T1000xA series PS4 Testkit. This log has been taken from the logconsole Neighborhood for PlayStation 4. The reference to CUSA00016 is the game WatchDogs in the Bluray Drive. I've let it log until the login screen for your PS4 Profile.

Spoiler

SCE CONFIDENTIAL
Copyright (C) 2014 Sony Computer Entertainment Inc.
All Rights Reserved.
Copyright (c) 1992-2012 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
r43234/release_branches/release_01.760 Aug 20 2014 07:45:23 amd64
mDBG: Kernel Build ID = 3e1463e658d6a84a
CPU: DG1000FGF84HT (1594.00-MHz K8-class CPU)
Origin = "AuthenticAMD" Id = 0x710f13 Family = 16 Model = 11 Stepping = 3
Features=0x178bfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,MMX,FXSR,SSE,SSE2,HTT>
Features2=0x36d8220b<SSE3,PCLMULQDQ,MON,SSSE3,CX16,SSE4.1,SSE4.2,MOVBE,POPCNT,AESNI,XSAVE,AVX,F16C>
AMD Features=0x2e500800<SYSCALL,NX,MMX+,FFXSR,Page1GB,RDTSCP,LM>
AMD Features2=0x154837fb<LAHF,CMP,ExtAPIC,CR8,ABM,SSE4A,MAS,Prefetch,OSVW,IBS,SKINIT,WDT,NodeId,Topology,PerfCtrExtNB,<b26>,<b28>>
TSC: P-state invariant, performance statistics
Event timer "LAPIC" quality 400
ACPI APIC Table: <SCEI ORBIS >
FreeBSD/SMP: Multiprocessor System Detected: 8 CPUs
FreeBSD/SMP: 1 package(s) x 8 core(s)
cpu0 (BSP): APIC ID: 0
cpu1 (AP): APIC ID: 1
cpu2 (AP): APIC ID: 2
cpu3 (AP): APIC ID: 3
cpu4 (AP): APIC ID: 4
cpu5 (AP): APIC ID: 5
cpu6 (AP): APIC ID: 6
cpu7 (AP): APIC ID: 7
MADT: Could not find APIC for SCI IRQ 9
Aux direct memory bitmap: 0x0000000000000ce0 bytes @ [0xffffff8049018000 - 0xffffff8049018ce0)
[REGMGR] LOAD REGMGR...
GEOM_SCHED: Modevent 0.
GEOM_SCHED: Initializing global data.
GEOM_SCHED: Loaded module 'bds' error 0.
GEOM_SCHED: Modevent 0.
GEOM_SCHED: Loaded module 'is' error 0.
acpi0: <SCEI ORBIS> on motherboard
cpu0: <ACPI CPU> on acpi0
cpu1: <ACPI CPU> on acpi0
cpu2: <ACPI CPU> on acpi0
cpu3: <ACPI CPU> on acpi0
cpu4: <ACPI CPU> on acpi0
cpu5: <ACPI CPU> on acpi0
cpu6: <ACPI CPU> on acpi0
cpu7: <ACPI CPU> on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
pci0: found aeolia_pcie
iommu0: <AMD IOMMU> at device 0.2 on pci0
gc0: <Starsha> port 0x6000-0x60ff mem 0xe0000000-0xe3ffffff,0xe4000000-0xe47fffff,0xe4800000-0xe483ffff at device 1.0 on pci0
LVP BX
GC SE0 Redundant CU: 0x200
GC SE1 Redundant CU: 0x200
** HALT MEC 0x50000000 ***
** UNHALT MEC 0x0 ***
SClkVid:0x3c SClkDpmVid:3 Dpm:3
hdac0: <GPU/DEHT Audio Controller> mem 0xe4840000-0xe4843fff at device 1.1 on pci0
apcie0: <Aeolia PCI Express glue> mem 0xd0200000-0xd03fffff at device 20.4 on pci0
apcie0: Misc Peripherals base:0xfffffe00d0200000, start:0xd0200000 end:0xd03fffff size:0x200000
apcie0: Chip revision: 00000300
apcie0: Chip ID0: 41b30130
apcie0: Chip ID1: 52024d44
icc0: <Aeolia ICC> at device 20.4 on pci0
hpet_pci0: <Aeolia High Precision Event Timer> at device 20.4 on pci0
Timecounter "HPET" frequency 10000000 Hz quality 950
Event timer "HPET" frequency 10000000 Hz quality 450
Event timer "HPET1" frequency 10000000 Hz quality 450
Event timer "HPET2" frequency 10000000 Hz quality 450
Event timer "HPET3" frequency 10000000 Hz quality 450
sflash0: <Aeolia Serial Flash I/F> at device 20.4 on pci0
Sflash:Macronix(1920c2)
iommu_add_device_table_entry: device_id:00a4 dev:20 func:4 sflash
rtc0: <Aeolia RTC> at device 20.4 on pci0
uart0: <Non-standard ns8250 class UART with FIFOs> at device 20.4 on pci0
uart0: uart_bus_attach
uart0: console (115200,n,8,1)
twsi0: <Aeolia TWSI> at device 20.4 on pci0
xhci0: <XHCI (ORBIS) USB 3.0 controller> mem 0xdc000000-0xdc1fffff at device 20.7 on pci0
xhci1: <XHCI (ORBIS) USB 3.0 controller> mem 0xdc200000-0xdc3fffff at device 20.7 on pci0
iommu_add_device_table_entry: device_id:00a7 dev:20 func:7 xhci
usbus1 on xhci1
xhci2: <XHCI (ORBIS) USB 3.0 controller> mem 0xdc400000-0xdc5fffff at device 20.7 on pci0
aeolia_acpi0: <Aeolia acpi> port 0x1000-0x10ff at device 20.0 on pci0
mskc0: <Aeolia GBE controller> mem 0xc4000000-0xc4003fff at device 20.1 on pci0
iommu_add_device_table_entry: device_id:00a1 dev:20 func:1 mskc
msk0: <Aeolia GBE Id:0xbd Rev:0x01> on mskc0
eth0: Ethernet address: 00:0e:00:00:00:00
miibus0: <MII bus> on msk0
e1000phy0: <Marvell 88E1510 Gigabit PHY> PHY 1 on miibus0
e1000phy0: none, 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 1000baseT-master, 1000baseT-FDX, 1000baseT-FDX-master, auto, auto-flowe1000phy0:
ahci0: <Orbis Aeolia AHCI SATA controller> mem 0xc8000000-0xc8000fff,0xc8001000-0xc8001fff at device 20.2 on pci0
ahci0: r_mem start:0xc8001000 r_mem end:0xc8001fff r_mem size:0x1000
ahci0: Aeolia SATA PHY init
[SATA] Apply ATE SRAM RTC Setting Version: 0x1
ahci0: PHY calibration result[align90]: 0x5e
ahci0: Aeolia SATA PHY ID : 0x2100
ahci0: AHCI v1.30 with 1 3Gbps ports, Port Multiplier supported with FBS
ahcich0: <AHCI channel> at channel 0 on ahci0
iommu_add_device_table_entry: device_id:00a2 dev:0 func:0 ahcich
sdhci0: <Aeolia SDHCI> mem 0xcc000000-0xcc000fff at device 20.3 on pci0
iommu_add_device_table_entry: device_id:00a3 dev:20 func:3 sdhci
sdhci0: 1 slot(s) allocated
dmac0: <Aeolia DMA controller> mem 0xd4000000-0xd4000fff at device 20.5 on pci0
dmac0: base:0xfffffe00d4000000, start:0xd4000000 end:0xd4000fff size:0x1000
dmac0: sbram_size: 0x10000000
iommu_add_device_table_entry: device_id:00a5 dev:20 func:5 dmac
dmac1: <Aeolia DMA controller> mem 0xd4001000-0xd4001fff at device 20.5 on pci0
dmac1: base:0xfffffe00d4001000, start:0xd4001000 end:0xd4001fff size:0x1000
dmac1: sbram_size: 0x10000000
spm0: <Aeolia Scratch Pad Memory> mem 0xd9000000-0xd903ffff at device 20.6 on pci0
spm0: scratch pad memory window start:0xd9000000 end:0xd903ffff size:0x40000
MAC address [0]: 00:00:00:00:00:00
MAC address [1]: ffffff:ff
sbram0: <Aeolia DDR3 memory> mem 0x80000000-0xbfffffff at device 20.6 on pci0
hwpstate0: <Cool`n'Quiet 2.0> on cpu0
gbase_register_interrupt_handler(52)
gbase_register_interrupt_handler(53)
dce: 15
diag load
_kapi_kctx_init: context 0xffffffff835d86d0 attached to ops 0
_sdma_hw_init(0): microcode loaded
_kapi_kctx_init: context 0xffffffff835d88c8 attached to ops 1
_sdma_hw_init(1): microcode loaded
acpDecAc3: <Codec DecAc3 built on Aug 20 2014 07:41:30>
acpEncAc3: <Codec EncAc3 built on Aug 20 2014 07:41:34>
acpDecTrhd: <Codec DecTrhd built on Aug 20 2014 07:41:33>
acpDecM2bc: <Codec DecM2bc built on Aug 20 2014 07:41:31>
acpEncDts: <Codec EncDts built on Aug 20 2014 07:41:35>
acpDecM4aacfng: <Codec DecM4aacfng built on Aug 20 2014 07:41:32>
acpDecCelp: <Codec DecCelp built on Aug 20 2014 07:41:31>
acpEncCelp: <Codec EncCelp built on Aug 20 2014 07:41:35>
ajm: <Audio CoProcessor Job Manager built on Aug 20 2014 07:44:08>
acpDecMp3: <Codec DecMp3 built on Aug 20 2014 07:41:33>
acpDecAt9: <Codec DecAt9 built on Aug 20 2014 07:41:30>
acpDecM4aac: <Codec DecM4aac built on Aug 20 2014 07:41:32>
acpEncM4Aac: <Codec EncM4Aac built on Aug 20 2014 07:41:36>
acpDecCelp8: <Codec DecCelp8 built on Aug 20 2014 07:41:30>
acpEncCelp8: <Codec EncCelp8 built on Aug 20 2014 07:41:34>
**[scanin event_handler:1515]MOD_LOAD
scanin_initialize:1544
scanin_make_dev:1591
can't re-use a leaf (v_free_reserved)!
can't re-use a leaf (v_free_target)!
can't re-use a leaf (v_free_min)!
can't re-use a leaf (v_inactive_target)!
can't re-use a leaf (v_cache_min)!
can't re-use a leaf (v_cache_max)!
can't re-use a leaf (v_pageout_free_min)!
can't re-use a leaf (v_free_reserved)!
can't re-use a leaf (v_free_target)!
can't re-use a leaf (v_free_min)!
can't re-use a leaf (v_inactive_target)!
can't re-use a leaf (v_cache_min)!
can't re-use a leaf (v_cache_max)!
can't re-use a leaf (v_pageout_free_min)!
UVFAT_Initialize: exit
fuse-freebsd: version 0.4.4, FUSE ABI 7.8
Timecounters tick every 1.000 msec
Session ID: fe632ac3fc967332a63f52a29606725c
secure kernel build: Aug 20 201hdac0: #0: GPU
4 07:26:47 (r4464:release_branches/release_01.760)
xtsQ 4, inflateQ 4, hmacshaQ 4, commonQ 4
pcm0: <GPU PCM #0 HDMI> at cad 0 nid 1 on hdac0
pcm1: <GPU PCM #1 Analog> at cad 0 nid 1 on hdac0
pcm2: <GPU PCM #2 Digital> at cad 0 nid 1 on hdac0
usbus1: 5.0Gbps Super Speed USB v3.0
ahcich0: r_mem start:0xc8001000 r_mem end:0xc8001fff r_mem size:0x1000
ahcich0: Aeolia SATA PHY init
ugen1.1: <0x104d> at usbus1
uhub1: <0x104d XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus1
[SATA] Apply ATE SRAM RTC Setting Version: 0x1
ahcich0: PHY calibration result[align90]: 0x5b
ahcich0: Aeolia SATA PHY ID : 0x2100
GEOM_SCHED: Loading: mp = 0xffffffff832aa4b0, g_sched_class = 0xffffffff832aa4b0.
g_lvd_init 248 : Layered vnode device is initialized.
g_lvd_init 250 : lvd is built at 07:41:54 Aug 20 2014
icc_power_set_boot_request_notify_mode: set boot request notify=1
icc_button_init: enabled power button notification
icc_button_init: enabled eject button notification
icc_button_init: enabled reset button notification
pass0 at ahcich0 bus 0 scbus1 target 0 lun 0
icc_thermal_set_notify: enabled thermal notification
icc nvs device registered
icc thermal info device registered
icc fan info device registered
icc configuration info device registered
icc indicator device registered
icc device_power info device registered
pass0: <SONY PS-SYSTEM 402R 0063> Removable CD-ROM SCSI-0 device
pass0: 150.000MB/s transfers (SATA 1.x, UDMA4, ATAPI 12bytes, PIO 8192bytes)
[REGMGR] READY NVS EVENT...
[REGMGR] NVS information [00175020(2)] ent: 22 (364) <0/0>.
[REGMGR] Product code [UC2 (0002)] [ASS (TestKit)] (0182).
[REGMGR] Registry initialize count = 342 (1024)
[REGMGR] Registry initialize binary = 85 (1280)
[REGMGR] Registry cache binary = 54420 (204800)
[REGMGR] Registry number of updated = 2
[REGMGR] Registry number of written = 4
[REGMGR] Registry EAP output count = 225 / bin = 6700
[REGMGR] Registry version (NVS) = 00175020 : 00175020
[REGMGR](0.044257 sec) Registry NVS Initialize...
[REGMGR](0.323018 sec) Registry NVS Initialize...
uhub1: 2 ports with 2 removable, self powered
DVI Mode
*** CEC FT [Normal:0x0] ***
Set CEC FeatureTable [Normal]
HDCP mode changed [HDCP Enable]
HDMI kernel module has been available
mmc0: <MMC/SD bus> on sdhci0
sbram0: base:0xfffffe0080000000, start:0x80000000 end:0xbfffffff size:0x40000000
sbram0: addr:0xfffffe0080000000
sbram0: size:0x10000000
trsw0 on sdio0
bt0 on sdio0
trs0 on sdio0
sdio0: <SDIO Device> at mmc0
g_crypt_deferred_init
g_crypt_deferred_init: calling CCP
g_crypt_deferred_init done
SMP: AP CPU #6 Launched!
SMP: AP CPU #2 Launched!
SMP: AP CPU #5 Launched!
SMP: AP CPU #3 Launched!
SMP: AP CPU #7 Launched!
SMP: AP CPU #1 Launched!
SMP: AP CPU #4 Launched!
init_safe_mode: 0
trsw0: FW version : 14.130.16.p37
wlan0: Ethernet address: 00:00:00:00:00:00
wlan1: Ethernet address: 00:00:00:00:00:00
ugen1.2: <SCEI> at usbus1
umass0: <SCEI USB-SATA Bridge, class 0/0, rev 3.00/0.01, addr 1> on usbus1
umass0: SCSI over Bulk-Only; quirks = 0x0000
umass0:0:0:-1: Attached to scbus0
Trying to mount root from msdosfs:md0 []...
init program: /mini-syscore.elf
<118>[SceSysCore mini] launched
<118>*** start manu_cert ***
<118>Special Wake is invalid
usbus0 on xhci0
usbus0: 5.0Gbps Super Speed USB v3.0
da0 at umass-sim0 bus 0 scbus0 target 0 lun 0
da0: <SCEI USB-SATA Bridge 0001> Fixed Direct Access SCSI-6 device
da0: 400.000MB/s transfers
da0: 476940MB (976773168 512 byte sectors: 255H 63S/T 60801C)
ugen0.1: <0x104d> at usbus0
<118>[SceSysAvControl] launched
uhub0: <0x104d XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus0
sysctl_kern_init_safe_mode: current_mode: 0
TSC freq = 1593844360
Timecounter "TSC-low" frequency 12451909 Hz quality 1000
sysctl_kern_init_safe_mode: current_mode: 0
<118>set CEC OFF
usbus2 on xhci2
usbus2: 5.0Gbps Super Speed USB v3.0
<118>* [AvSetting core:1525] hdmiConnected = 0
<118>* [AvSetting core:397] hdmi event: disconnected(0)
<118>** set_mode **
<118> video: port:0 1080P_5994 RGB444 full CERGB 24bpp 16:9 nodata
<118> audio: port:HDMI src:I2S 48k 2.0 24bit fmt:LPCM LPCM null
ugen2.1: <0x104d> at usbus2
uhub2: <0x104d XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus2
<118>*** Hdmi Init(kern) : 0 ***
uhub0: 2 ports with 2 removable, self powered
uhub2: 2 ports with 2 removable, self powered
<118>[SceSysCore mini] fstype=msdosfs
ugen0.2: <GenesysLogic> at usbus0
uhub3: <GenesysLogic USB2.0 Hub, class 9/0, rev 2.10/46.12, addr 1> on usbus0
<118>*** Hdmi Setup(kern) : 0 ***
<118>[SceSysCore mini] nmount /dev/da0x4.crypt to /system OK
<118>[SceSysCore mini] nmount /dev/da0x5.crypt to /system_ex OK
cd0 at ahcich0 bus 0 scbus1 target 0 lun 0
cd0: <SONY PS-SYSTEM 402R 0063> Removable CD-ROM SCSI-0 device
cd0: 150.000MB/s transfers (SATA 1.x, UDMA4, ATAPI 12bytes, uhub3: 4 ports with 4 removable, self powered
PIO 8192bytes)
cd0: cd present [12218912 x 2048 byte records]
GL3520-21: 4612
<118>[SceSysCore mini] nmount_ufs /dev/da0x9.crypt to /system_data OK
<118>[SceSysCore mini] nmount_ufs /dev/da0x13.crypt to /user OK
<118>[SceSysCore mini] nmount_ufs /dev/da0x14.crypt to /eap_user OK
<118>[SceSysCore mini] nmount /dev/da0x12.crypt to /update OK
ugen0.3: <GenesysLogic> at usbus0
uhub4: <GenesysLogic> on usbus0
[REGMGR] READY HDD EVENT...
[REGMGR] Registry version (HDD) = 00175020 : 00175020
[REGMGR] Registry number of updated = 2
[REGMGR] HDD information [00175020(2)] ent: 1750 (+ 9).
[REGMGR](0.029156 sec) Registry HDD Initialize...
[REGMGR](3.977080 sec) Registry HDD Initialize...
<118>[SceSysCore mini] nmount /dev/da0x0.crypt to /preinst OK
<118>[SceSysCore mini] nmount /dev/da0x1.crypt to /preinst2 OK
<118>[SceSysCore mini] Entering normal mode...
<118>[SceSysCore mini] HDD slow-mode is disabled
<118>verify_header: Header size 523776 wp 550
<118>[SceSysCore] launched
5.491534,[1] gsched_is(1897): g_is_init,! init, target=,'da0', preset=0
GEOM_SCHED: Device da0.sched. created.
<118>[SceSysCore] enabled GEOM I/O scheduler 'is' for da0
uhub4: 4 ports with 4 removable, self powered
HID : Safe Mode 0
HID : Controller USB Connection 0
ugen0.4: <Sony Computer Entertainment> at usbus0
usb_hid0: <Sony Computer Entertainment Wireless Controller, class 0/0, rev 2.00/1.00, addr 3> on usbus0
pfs_sbram_init(81) ***WRN*** pfs_sbram_init():Rel Mode.
<118>[SceSysCore] nmount /data to /user/data OK
<118>mDBG: Lastlog cleared.
<118>[MbusBaseEnv]alloc_count = 297
<118>[MbusBaseEnv]free_count = 0
<118>[MbusBaseEnv]alloc_size = 731672 bytes (715 KiB)
<118>[Syscore App] ExpandCpuSetMode : enable
<118>[Syscore App] srand seed: 0x5430d8af
<118>[SceSysCore] spawn /system/sys/orbis_audiod.elf OK
<118>[SceSysCore] spawn /system/sys/GnmCompositor.elf OK
+++ num clients 1
<118>[SceShellCore] Start
<118>[SceShellCore] Version Info
<118>[SceShellCore] release: 0x01760001
<118>[SceShellCore] build: testkit
<118>[SceShellCore] security-repository-path: release_branches/release_01.760
<118>[SceShellCore] security-revision: 4464
<118>[SceShellCore] sys-repository-path: release_branches/release_01.760
<118>[SceShellCore] sys-revision: 43234
<118>[SceShellCore] sdk-internal-build-number: 68351
<118>[SceShellCore] middleware-repository-path: release_branches/release_01.760
<118>[SceShellCore] middleware-revision: 8267
<118>[SceShellCore] middleware-build-number: 40682
<118>[SceShellCore] vsh-repository-path: release_branches/release_01.760
<118>[SceShellCore] vsh-revision: 67936
<118>[SceShellCore] vsh-build-number: 3849### AEC initializing
Shared System size : 0x400000
Shared System Addr : 0xff8000000
Shared Video size : 0x1200000
Shared Video Addr : 0xff0000000
25
<118>[SceShellCore] ModuleLoader 0 msec
<118>** set_mode_a **
<118> video: port:0 1080P_5994 RGB444 full CERGB 24bpp 16:9 nodata
<118> audio: port:HDMI src:I2S 48k 2.0 24bit fmt:LPCM LPCM null
<118>verify_header: Header size 523776 wp 586
<118>*** Hdmi Audio Setup(kern) : 0 ***
<118>[SceShellCore] ShellCoreMain 425 msec
<118>[SceShellCore] PafJob 0 msec
<118>[SceShellCore] ModuleLoaderSync 0 msec
<118>open: /system_data/priv/home/new_user_group.dat: 0x80af5022
<118>[SceShellCore] UserService 4 msec
<118>[SceShellCore] ContentManager 122 msec
<118>[SceShellCore] AppDB 7 msec
<118>[SceShellCore] ModuleLoaderSync 0 msec
<118>[Syscore App] Add event : pid=0x24
<118>[SceShellCore] AppMgr 3 msec
<118>[SceShellCore] LnC 2 msec
<118>[SceSystemStateMgr] Power-Up Cause Report from EMC
<118>[SceSystemStateMgr] powerup_cause POWER_BUTTON (00000100)
<118>[SceSystemStateMgr] first_boot 02
<118>[SceSystemStateMgr] last_shutdown_cause 00
<118>[SceSystemStateMgr] depth 02
<118>[SceSystemStateMgr] special_wake 00
<118>[SceSystemStateMgr] magic_code 00
<118>[SceSystemStateMgr] State Change: WORKING
icc_power_set_boot_request_notify_mode: set boot request notify=0
<118>[SceShellCore] SystemStateMgr 48 msec
<118>WARNING AutoMounter(int32_t AutoMount::EventManager::registerCallback(uint32_t, sceAutoMounter::CallbackFunc, ScePthreadAttr *, const char *, void *, size_t, bool) 193):
<118> threadName(SceProcessStarterDiscInsertionStart) is too long and will be truncated.
<118>WARNING AutoMounter(int32_t AutoMount::EventManager::registerCallback(uint32_t, sceAutoMounter::CallbackFunc, ScePthreadAttr *, const char *, void *, size_t, bool) 193):
<118> threadName(SceProcessStarterDiscInsertionEnd) is too long and will be truncated.
<118>[SceShellCore] ProcessStarter 17 msec
<118>[SceShellCore] AppInstaller 0 msec
<118>[SceShellCore] ModuleLoaderSync 0 msec
<118>[SceShellCore] AppMessaging 0 msec
<118>[SceShellCore] ShellCoreUtil 0 msec
<118>[SceShellCore] SystemService 2 msec
<118>[SceShellCore] ModuleLoaderSync 0 msec
<118>[SceShellCore] Net 3 msec
<118>[ScePsnCore] _scePsnCoreInit() sceNpArchInit() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpManagerVshInit() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNetHttpXmlInit() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpPushCoreInit() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpPushServiceInit() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpIpcServerInit() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpServiceServerInit() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpTrophyServiceInit() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpServiceServerStart() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpManagerVshInitSyncUsers() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpMutexInit(SCE_NP_MANAGER_PRX_MUTEX_NAME)
<118>[ScePsnCore] _scePsnCoreInit() sceNpPresenceServiceInitialize() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpInGameMessageIntInitialize() finished
<118>[SystemLogger][01:35:44:635][Thread 0x00018799][TRACE][ERROR][ALWAYS]setting_value_manager.cpp(33) IsDebugOutput(): sceRegMgrGetInt failed[0x800d0203][-2146631165]
<118>[ScePsnCore] _scePsnCoreInit() sceNpSignalingIpcServerInit() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpManagerStartVsh() finished
<118>[ScePsnCore] _scePsnCoreInit() _setNpTitleId() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpTrophyVshInit() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpManagerVshPlusInit() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpPresenceInitialize() finished
<118>[ScePsnCore] _scePsnCoreInit() NpServiceBaseUrlVsh::Initialize() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpPushCoreStart() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpRifManagerServiceInit() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpSnsVshInit() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpSnsVshInitIpcServer() finished
<118>[ScePsnCore] _scePsnCoreInit() sceNpUtilityInit() finished
<118>[SceShellCore] PsnCore 107 msec
<118>[SceShellCore] NetService 0 msec
<118>[SceShellCore] Json 0 msec
<118>BD Copy : 0x0
<118>[BGFT] last checked (2014-10-05T01:35:44)
<118>[BGFT] interval (2014-10-05T04:57:47)
<118>[SceBgftServer] ServiceServer Start
<118>[SceShellCore] BGFT 77 msec
<118>[SceShellCore] Change run-level 0 -> 70
<118>[SceShellCore] Daemons 0 msec
<118>[SceShellCore] CompanionAppProxyUtil 0 msec
<118>[SceShellCore] UpdateService 0 msec
<118>[SceShellCore] SaveDataServer 29 msec
<118>[SceShellCore] Change run-level 70 -> 80
<118>[SceShellCore] START Shell UI
<118>[SceLncService] launchApp() titleId = {NPXS20001}
<118>[SceLncService] Launch NPXS20001, appType = {SCE_LNC_APP_TYPE_SHELL_UI} []
<118>[SceLncService] Num. of logged-in users is 0
<118>[SceSystemStateMgr] Power Mode Change: NAVIGATION
<118>[SceSystemStateMgr] HLT #CU ACLK DCLK ECLK LCLK SCLK SAMCLK VCLK DispCLK DPM VID
<118>[SceSystemStateMgr] 1 8 800 609 609 800 711 711 711 673 3 003c0040
<118>[SceSysCore] ip_conflict_cb: 2
<118>[SceSysCore] ip_conflict_cb: 0 0
[SceShellUI] Loading PSM
[SceShellUI] Loading libSceWeb
<118>[SceLncService] isBigAppOrMiniApp = {0}, app_param.{enableSuspendOnSpecialVideOutSettingInBgState, prohibitUsingSpecialVideOutSetting, enableS3d} = {0, 0, 0} (00)
<118>[Syscore App] createApp NPXS20001
<118>[Syscore App] processSpawn(pid, 0xb0c0101, 0x10101020, appParam, processParam, 1, 1, 1, param, debug, 0)
<118>[Syscore App] appParam: appType = 0x5, rootPath = /mnt/sandbox/NPXS20001_0000, titleId = NPXS20001
<118>[Syscore App] processParam: elfPath = /app0/eboot.bin, fullPath = /system_ex/app/NPXS20001/eboot.bin
<118>[Syscore App] attributeExe= 0
<118>[Syscore App] Add event : pid=0x2a
<118>[AppMgr Trace]: New Process, pid=0x2a, created.
<118>[AppMgr Trace]: New App, appId=0xb0c0101, created
<118>[SceShellCore] ShellUI 201 msec
<118>[SceShellCore] UserServiceServer 0 msec
<118>waiting for SceUserService..[SceShellCore] UserServiceClient 63 msec
<118>[SceShellCore] DeviceDiscovery 0 msec
<118>[SceShellCore] ScreenShotServer 0 msec
<118>MSG AutoMounter(int AutoMount::Init() 14:
<118> trc_notify=0.
<118>[SceShellCore] AutoMount 1 msec
<118>[SceShellCore] MediaEventListener 0 msec
<118>[SceShellCore] AppInstaller 0 msec
<118>[SceShellCore] AppContent 0 msec
<118>pass0: <SONY PS-SYSTEM 402R 0063> Removable CD-ROM SCSI-0 device
<118>[SceShellCore] GroupMessaging 10 msec
<118>[SystemLogger][01:35:45:072][Thread 0x0001872d][INFO][TRACE][ALWAYS][SYSTEM LOGGER INITIALIZE ASYNC BEGIN]
<118>[SystemLogger][01:35:45:073][Thread 0x000187d4][INFO][TRACE][ALWAYS][SystemLogger][01:35:45:073][Thread 0x0001872d][INFO][TRACE][ALWAYS][SYSTEM LOGGER INITIALIZE ASYNC END ]
<118>[SceShellCore] SystemLogger 1 msec
<118>[SYSTEM LOGGER INITIALIZE BEGIN][Heap]sanity OK, free 2546464 (61%), in-use 1647840 (39%), peak 1648192 (39%), when 9 [sec]
<118>[SystemLogger][01:35:45:073][Thread 0x000187d4][INFO][TRACE][ALWAYS]BUILD TYPE TestKit
<118>[SceShellCore] DbRecovery 0 msec
<118>[DecidServer] DECID_SERVER_ASSIST_MODE
<118>[DecidServer] DecidServerReleaseCheckMode=[2]
<118>[SceShellCore] DecidServer 0 msec
<118>[SceShellCore] AutoMounterIpcServer 0 msec
<118>[DecidServer] waiting for connecting client...
<118>media type:PS4 BD-ROM
<118>[SceAutoMount] libcam: MaximizeSpeed
<118>[SceAutoMount] libcam: set speed [speed:65535 kbyte/sec][rotation:0]
<118>[SceShellCore] ShareServerPost::Init 15 msec
<118>[SceShellCore] RTC 0 msec
<118>[SceShellCore] SystemStateMgr::PostInit 0 msec
<118>[SceShellCore] ShareServerPost::Start 0 msec
<118>[SceShellCore] CheckOsEventLog 0 msec
<118>[SceShellCore] Completed initialization
<118>[SceLncUtil] blockAppSuspend: name={SceVshLog}, appId={0x0b0c0000}, refCount={1}
<118>
<118>*** network ready. myaddr: 192.168.1.1 ***
<118>[SceShellCore] NpManager acquires /eap_user (refCount 1)
SERIAL_PRINT_TIME_TICK : 12063 msec -- main : start
<118>[SceShellUI] Start
<118>[SceShellUI] Run
<118>[SceShellUI] initializeSystem
SERIAL_PRINT_TIME_TICK : 12067 msec -- initializeSystem : start
SERIAL_PRINT_TIME_TICK : 12080 msec -- loadModules : start
SERIAL_PRINT_TIME_TICK : 12174 msec (total 94 msec) -- loadModules : end
<118>[SceLncUtil] unblockAppSuspend: name={SceVshLog}, appId={0x0b0c0000}, refCount={0}
<118>[SceShellCore] NpManager releases /eap_user (refCount 0)
<118>[SystemLogger][01:35:45:351][Thread 0x000187c7][TRACE][ERROR][ALWAYS]setting_value_manager.cpp(33) IsDebugOutput(): sceRegMgrGetInt failed[0x800d0203][-2146631165]
<118>[SystemLogger][01:35:45:425][Thread 0x000187d4][INFO][TRACE][ALWAYS][SYSTEM LOGGER INITIALIZE END ][Heap]sanity OK, free 2311904 (55%), in-use 1882400 (45%), peak 2035776 (49%), when 10 [sec]
<118>[REGIO] (202): HDD SAVE (5)...[0]
<118>[SceShellCore] NpManager acquires /eap_user (refCount 1)
<118>MSG: Setup AbstractStorage.
<118>[GetInstance]WARNING:Undefined Memory Allocator
<118>[SceShellCore] NpManager releases /eap_user (refCount 0)
<118>MSG NotificationDb(int sceNotificationDbInit::notificationDbInitialize() 1554):
<118> userId(0x10000000) is already registered. we will create tables for them.
SERIAL_PRINT_TIME_TICK : 12503 msec (total 436 msec) -- initializeSystem : end
<118>[SceShellUI] initializeFramework
SERIAL_PRINT_TIME_TICK : 12510 msec -- initializeFramework : start
<118>Loading PSM AOT PRX:/4VrE1TCMrg/common/lib/libScePsm_aot.sprx
<118>Loading UI2 AOT PRX:/4VrE1TCMrg/common/lib/libSceVshCommon_aot.sprx
<118>Loading VSH AOT PRX:/app0/libSceVsh_aot.sprx
<118>VM: sockets[VM_SOCKET] = 73
<118>VM: sockets[COMP_SOCKET] = 72
<118>VM: before starting compiler
<118>SystemService prx detected, using sceSystemServiceAddLocalProcess to spawn compiler
<118>[Syscore App] calling add process
<118>[Syscore App] processSpawn(pid, 0xb0c0101, 0x10101031, appParam, processParam, 0, 0, 0, param, debug, 0)
<118>[Syscore App] appParam: appType = 0x5, rootPath = /mnt/sandbox/NPXS20001_0000, titleId = NPXS20001
<118>[Syscore App] processParam: elfPath = /4VrE1TCMrg/common/lib/MonoCompiler.elf, fullPath = /system/common/lib/MonoCompiler.elf
<118>[Syscore App] attributeExe= 0
<118>[Syscore App] Add event : pid=0x2b
<118>[AppMgr Trace]: New Process, pid=0x2b, created.
<118> + compiler_local_pid = 10101031
<118>[PSM] PsmFramework::Initialize
<118>PSM:24487
<118>MonoVM:f19b9d6104343a6ee9f3ae718ccda33692e511a1
<118>PSS Platform:a730c133a7d00bca756c3b48aaff86556c41b006
<118>Piglet:3555fd9238638fe168f3ddca765bfe5aa5e119f7
<118>BootParam :1
<118>[PSM] Loading Json
<118>[PSM] LoadModulesInBG 0 msec
<118>[PSM] Loading SysCore
Accept InitRequest from PID 42
Type : 0
Size : 0x1600000
Addr : 0x1000000000
Type : 3
Size : 0x8400000
Addr : 0x1080000000
<118>[PSM] Loading libSceDipsw
<118>[PSM] Loading Piglet
<118>[PSM] Loading AudioOut
<118>[PSM] Loading Audiodec
<118>[Sce GnmCompositor] Last modified: Thu Apr 10 22:43:02 2014
<118>[PSM] Loading WebKit
<118>Size : 0x1600000
<118>Addr : 0x1000000000
<118>Size : 0x8400000
<118>Addr : 0x1080000000
<118>PigletAllocatorInitialize system(addr=1000000000, size=23068672) video=(addr=1080000000, size=138412032)
<118>PigletAllocatorTerminate
<118>[PSM] scePssGraphicsInitialize() 132 msec. elapsed
<118>mount ---
<118>MONO_LOG_LEVEL=error
<118>vm: jit_area 900000000, fd 83
<118>vm: outgoing_area 909000000, fd 84
<118>vm: incoming_area 908000000, fd 85
<118>compiler was started with SystemService.prx, closing socket 72
<118>Failed to create filesystem from /hostapp/dll
<118>Load DLL /4VrE1TCMrg/common/lib/mscorlib.dll
<118>[SceShellCore] Libc Heap Status: free 2295808 (55%), in-use 1898496, trend +10112.7 KB/min, peak 2035776, when 11 [sec]
<118>[PSM] Allocated 268435456 bytes for Resource Heap
<118>[SceLncService] No heart beat of Shell UI has been observed for 1012 msec.
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.PlayStation.Core.dll
<118>Load DLL /4VrE1TCMrg/common/lib/System.dll
<118>[PSM] PsmFramework::Initailize() 452 msec. elapsed
<118>W:\Build\J00739822\vsh\cdlg\np_commerce_dialog\server\np_commerce_server_wrapper.cpp(309) initializeCSharp:
<118>MSG AbstractStorageWrapper(int sce::vsh:rbis::abstract_storage::InitializeCSharp() 223):
<118> Register Table for ContentManager's PInvokes
<118>MSG ContentManagerWrapper(int sce::vsh:rbis::content_manager::InitializeCSharp() 427):
<118> Register Table for ContentManager's PInvokes
SERIAL_PRINT_TIME_TICK : 13418 msec (total 908 msec) -- initializeFramework : end
<118>[SceShellUI] initializeSystemAfterPsm
SERIAL_PRINT_TIME_TICK : 13459 msec -- initializeSystemAfterPsm : start
<118>#LOGIN MGR# sceMbusEventCreate() success (handle = 2).
<118>@ deviceMonitor2StartPolling:L2652
<118>@ connectDeviceByFunction:L1258
* [mbus:378] owner-changed from unknown device
<118>@ connectDeviceByFunction:L1258
* [mbus:378] owner-changed from unknown device
<118>@ connectDeviceByFunction:L1258
* [mbus:378] owner-changed from unknown device
<118>[AppDb][Server] Rcv Event 6
<118>[SceShellUI] initializeFrameworkDependentModules
SERIAL_PRINT_TIME_TICK : 13494 msec -- initializeFrameworkDependentModules : start
<118>@ connectDeviceByFunction:L1258
* [mbus:378] owner-changed from unknown device
SERIAL_PRINT_TIME_TICK : 13520 msec (total 26 msec) -- initializeFrameworkDependentModules : end
<118>ScePsP: Open Pad [0x000000000001030f, 16, 12]: ret=0x03010300
<118>ScePsP: ConnectedDeviceStatus: count=1
<118> [c][DeviceId ][UserId ][Model ]
<118> [ ][0xffffffffffffffff][0xffffffff][none ]
<118> [ ][0xffffffffffffffff][0xffffffff][none ]
<118> [ ][0xffffffffffffffff][0xffffffff][none ]
<118> [ ][0xffffffffffffffff][0xffffffff][none ]
<118>[SceShellUI] runFramework
<118>Load DLL /app0/psm/Application/app.exe
<118>Load DLL /4VrE1TCMrg/common/lib/System.Json.dll
<118>Load DLL /4VrE1TCMrg/common/lib/System.Runtime.Serialization.dll
<118>Load DLL /4VrE1TCMrg/common/lib/System.Xml.dll
<118>Load DLL /4VrE1TCMrg/common/lib/System.Core.dll
<118>Load DLL /4VrE1TCMrg/common/lib/System.ServiceModel.Web.dll
<118>Load DLL /4VrE1TCMrg/common/lib/System.ServiceModel.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Lx.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.PlayStation.HighLevel.UI2.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.PlayStation.Orbis.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Accessor.Db.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.SQLite.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.DbRecoveryUtilityWrapper.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Accessor.Db.Notify.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.AppDbWrapper.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Orbis.AbstractStorage.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.UserServiceWrapper.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.MimeType.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Accessor.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.KernelSysWrapper.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.SystemLoggerWrapper.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Registry.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Gls.NativeCall.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.UpdateServiceWrapper.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Orbis.Bgft.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.JsExtension.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.VideoServiceWrapper.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.MusicCoreServerJsExWrapper.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Np.Manager.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.AppInstUtilWrapper.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Np.RifManager.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.SysUtilWrapper.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.ShellCoreUtilWrapper.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.MarlinDownloaderWrapper.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.FileSelector.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Orbis.ContentManager.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.ProfileCache.dll
<118>Load DLL /4VrE1TCMrg/common/lib/System.Xml.Linq.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Friend.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Np.Webapi.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Np.Trophy.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.PartyCommon.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Np.Common.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.WebViewDialog.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.VideoRecordingWrapper.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Np.Sns.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Orbis.BgftAccessor.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Webbrowser.XdbWrapper.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Messages.StorageAccessLib.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Messages.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Messages.BgAccessLib.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.VoiceMsg.VoiceMsgWrapper.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.GriefReportStorage.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Orbis.CdlgServerNpCommerce.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.PsnUtil.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Np.Asm.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.SessionInvitation.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.GameCustomData.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.GriefReport.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Np.Tmdb.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.ErrorDialogUtilWrapper.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.SysfileUtilWrapper.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.SyscallWrapper.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.ShareServerPostWrapper.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Np.AppLaunchLink.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.Passcode.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Webbrowser.XutilWrapper.dll
<118>Load DLL /4VrE1TCMrg/common/lib/Sce.Vsh.Np.ServiceChecker.dll
<118>Load DLL /app0/psm/Application/Sce.Vsh.DbRecoveryWrapper.dll
<118>[REGIO] (202): HDD SAVE (5)...[0]


...alles hatte hier nicht Platz, mehr siehe Link.

---------- Beitrag 14.05.2015 um 00:06 Uhr hinzugefügt ---------- Vorheriger Beitrag 13.05.2015 um 23:55 Uhr ----------

1,6GHz der CPU sind da auch zu sehen.
3x USB3 Controller

 

[crysmopompas]

Über das PS4 OS, Sonys Änderungen an FreeBSD und mögliche Lücken:

Since there haven't been any major public announcements regarding PS4 hacking for a long time now, I wanted to explain a bit about how far PS4 hacking has come, and what is preventing further progression.

I will explain some security concepts that generally apply to all modern systems, and the discoveries that I have made from running ROP tests on my PS4.

If you are not particularly familiar with exploitation, you should read my article about exploiting DS games through stack smash vulnerabilities in save files first.

You may download my complete setup here to run these tests yourself; it is currently for firmware 1.76 only.

As well as having a well documented CPU architecture, much of the software used in the PS4 is open source.

Most notably, the PS4's Orbis OS is based on FreeBSD, just like the PS3's OS was (with parts of NetBSD as well); but as well as FreeBSD 9.0, other noticable software used includes Mono VM, and WebKit.

WebKit entry point

WebKit is the open source layout engine which renders web pages in the browsers for iOS, Wii U, 3DS, PS Vita, and the PS4.

Although so widely used and mature, WebKit does have its share of vulnerabilities; you can learn about most of them by reading Pwn2Own write-ups.

In particular, the browser in PS4 firmware 1.76 uses a version of WebKit which is vulnerable to CVE-2012-3748, a heap-based buffer overflow in the JSArray::sort(...) method.

In 2014, nas and Proxima announced that they had successfully been able to port this exploit to the PS4's browser, and released the PoC code publicly as the first entry point into hacking the PS4.

This gives us arbitrary read and write access to everything the WebKit process can read and write to, which can be used to dump modules, and overwrite return addresses on the stack, letting us control the Program Counter (for ROP).

Since then, many other vulnerabilities have been found in WebKit, which could probably allow for module dumping and ROP on later firmwares of the PS4, but as of writing, no one has ported any of these exploits to the PS4 publicly.

ASLR

Address Space Layout Randomization (ASLR) is a security technique which causes the base addresses of modules to be different every time you start the PS4.

It has been reported to me that very old firmwares (1.05) don't have ASLR enabled, but it was introduced sometime before firmware 1.70. Note that kernel ASLR is not enabled (for firmwares 1.76 and lower at least), which will be proved later in the article.

For most exploits ASLR would be a problem because if you don't know the addresses of the gadgets in memory, you would have no idea what to write to the stack.

Luckily for us, we aren't limited to just writing static ROP chains. We can use JavaScript to read the modules table, which will tell us the base addresses of all loaded modules. Using these bases, we can then calculate the addresses of all our gadgets before we trigger ROP execution, bypassing ASLR.

The modules table also includes the filenames of the modules:

WebProcess.self
libkernel.sprx
libSceLibcInternal.sprx
libSceSysmodule.sprx
libSceNet.sprx
libSceNetCtl.sprx
libSceIpmi.sprx
libSceMbus.sprx
libSceRegMgr.sprx
libSceRtc.sprx
libScePad.sprx
libSceVideoOut.sprx
libScePigletv2VSH.sprx
libSceOrbisCompat.sprx
libSceWebKit2.sprx
libSceSysCore.sprx
libSceSsl.sprx
libSceVideoCoreServerInterface.sprx
libSceSystemService.sprx
libSceCompositeExt.sprx
Although the PS4 predominantly uses the [Signed] PPU Relocatable Executable (PRX) format for modules, some string references to [Signed] Executable and Linking Format (ELF) object files can also be found in the libSceSysmodule.sprx dump, such as bdj.elf, web_core.elf and orbis-jsc-compiler.self. This combination of modules and objects is similar to what is used in the PSP and PS3.

You can view a complete list of all modules available (not just those loaded by the browser) in libSceSysmodule.sprx. We can load and dump some of these through several of Sony's custom system calls, which will be explained later in this article.

System calls

Interestingly, the PS4 uses the same calling convention as Linux and MS-DOS for system calls, with arguments stored in registers, rather than the traditional UNIX way (which FreeBSD uses by default), with arguments stored in the stack:

rax - System call number
rdi - Argument 1
rsi - Argument 2
rdx - Argument 3
r10 - Argument 4
r8 - Argument 5
r9 - Argument 6
We can try to perform any system call with the following JuSt-ROP method:

this.syscall = function(name, systemCallNumber, arg1, arg2, arg3, arg4, arg5, arg6) {
console.log("syscall " + name);

this.add("pop rax", systemCallNumber);
if(typeof(arg1) !== "undefined") this.add("pop rdi", arg1);
if(typeof(arg2) !== "undefined") this.add("pop rsi", arg2);
if(typeof(arg3) !== "undefined") this.add("pop rdx", arg3);
if(typeof(arg4) !== "undefined") this.add("pop rcx", arg4);
if(typeof(arg5) !== "undefined") this.add("pop r8", arg5);
if(typeof(arg6) !== "undefined") this.add("pop r9", arg6);
this.add("pop rbp", stackBase + returnAddress - (chainLength + + 0x1480);
this.add("mov r10, rcx; syscall");
}
Using system calls can tell us a huge amount about the PS4 kernel. Not only that, but using system calls is most likely the only way that we can interact with the kernel, and thus potentially trigger a kernel exploit.

If you are reverse engineering modules to identify some of Sony's custom system calls, you may come across an alternative calling convention:

Sometimes Sony performs system calls through regular system call 0 (which usually does nothing in FreeBSD), with the first argument (rdi) controlling which system call should be executed:

rax - 0
rdi - System call number
rsi - Argument 1
rdx - Argument 2
r10 - Argument 3
r8 - Argument 4
r9 - Argument 5
It is likely that Sony did this to have easy compatibility with the function calling convention, for example:

unsigned long syscall(unsigned long n, ...) {
register unsigned long rax asm("rax");

asm("mov r10, rcx");
rax = 0;
asm("syscall");
return rax;
}
Using this, they can perform any system call from C.

When writing ROP chains, we can use either convention:

// Both will get the current process ID:
chain.syscall("getpid", 20);
chain.syscall("getpid", 0, 20);
It's good to be aware of this, because we can use whichever one is more convenient for the gadgets that are available.

The last standard FreeBSD 9 system call is wait6, number 532; anything higher than this must be a custom Sony system call.

Invoking most of Sony's custom system calls without the correct arguments will return error 0x16, "Invalid argument"; however, any compatibility or unimplemented system calls will report the "There is not enough free system memory" error.

Through trial and error, I have found that system call number 617 is the last Sony system call, anything higher is unimplemented.

From this, we can conclude that there are 85 custom Sony system calls in the PS4's kernel (617 - 532).

This is significantly less than the PS3, which had almost 1000 system calls in total. This indicates that we have fewer possible attack vectors, but that it may be easier to document all of the system calls.

Furthermore, 9 of these 85 system calls always return 0x4e, ENOSYS, which suggests that they may only be callable from development units, leaving us with just 76 which are usable.

Of these 76, only 45 are referenced by libkernel.sprx (which all non-core applications use to perform system calls), so developers only have 45 custom system calls which they can use.

Interestingly, although only 45 are intended to be called (because libkernel.sprx has wrappers for them), some of the other 31 are still callable from the Internet Browser process. It is more likely for these unintended system calls to have vulnerabilities in them, since they have probably had the least amount of testing.

The PS4 uses the standard FreeBSD 9.0 system calls for reading files and directories.

However, whilst using read for some directories such as /dev/ will work, others, such as / will fail.

I'm not sure why this is, but if we use gendents instead of read for directories, it will work much more reliably:
...
Unfortunately, due to sandboxing we don't have complete access to the file system. Trying to read files and directories that do exist but are restricted will give you error 2, ENOENT, "No such file or directory".

We do have access to a lot of interesting stuff though including encrypted save data, trophies, and account information. I will go over more of the filesystem in my next article.

The list of open source software used in the PS4 doesn't list any kind of sandboxing software like Capsicum, so the PS4 must use either pure FreeBSD jails, or some kind of custom, proprietary, sandboxing system (unlikely).
...
We can prove the existence of FreeBSD jails being actively used in the PS4's kernel through the auditon system call being impossible to execute within a jailed environment:
...
This tells us that whatever sandbox system the PS4 uses is at least based on jails because the jailed check passes.

Summary

From the information currently available, the PS4's kernel seems to be very similar to the stock FreeBSD 9.0 kernel.

Importantly, the differences that are present appear to be from standard kernel configuration changes (such as disabling SCTP sockets), rather than from modified code. Sony have also added several of their own custom system calls to the kernel, but apart from this, the rest of the kernel seems fairly untouched.

In this respect, I'm inclined to believe that the PS4 shares most of the same juicy vulnerabilities as FreeBSD 9.0's kernel!

Unfortunately, most kernel exploits cannot be triggered from the WebKit entry point that we currently have due to sandboxing constraints (likely to be just stock FreeBSD jails).

And with FreeBSD 10 being out, it's unlikely that anyone is stashing away any private exploits for FreeBSD 9, so unless a new one is suddenly released, we're stuck with what is currently available.

It may not be impossible to exploit the PS4 kernel by leveraging some of the existing kernel memory corruption vulnerabilities, but it certainly would't be easy.

The best approach from here seems to be reverse engineering all of the modules which can be dumped, in order to document as many of Sony's custom system calls as possible; I have a hunch that we will have more luck targeting these, than the standard FreeBSD system calls.

Recently Jaicrab has discovered two UART ports on the PS4 which shows us that there are hardware hackers interested in the PS4. Although the role of hardware hackers has traditionally been to dump the RAM of a system, like with the DSi, which we can already do thanks to the WebKit exploit, there's also the possibility of a hardware triggered kernel vulnerability being found, like geohot's original PS3 hypervisor hack. It remains most likely that a kernel exploit will be found on the PS4 through system call vulnerabilities though.

http://cturt.github.io/ps4.html
https://github.com/CTurt/PS4-playground
https://twitter.com/CTurtE/status/633607314818379776

 

[crysmopompas]

CTurt ist noch weitergekommen:

Just broke WebKit process out of a FreeBSD jail (cred->cr_prison = &prison0). Guess you could say the PS4 is now officially "jailbroken" :P

Can successfully dump RAM from other processes (like SceShellUI) using ptrace! Next step: patching RAM...

[ame]https://twitter.com/CTurtE/status/673581693207502849[/ame]
[ame]https://twitter.com/CTurtE/status/675683629977178112[/ame]
[ame]https://twitter.com/CTurtE/status/675762173583454209[/ame]