ps5-uart

emc header
 1  5v
 2  5v
 3  gnd
 4  gnd
 5  emc gpio a1. pulling low at emc boot causes emc rom to enter uart shell @ 460800
 6  uart rx emc 115200
 7  uart tx emc 115200
 8  3v3, goes low when emc resets
 9  0v?
10  gnd
11  titania uart0 tx (efc fw: 460800, eap fw: 691200)
12  titania uart0 rx (efc fw: 460800, eap fw: 691200)
13  titania uart1 rx (bootrom: 460800, apu: 230400)
14  titania uart1 tx (bootrom: 460800, apu: 230400)
15  gnd
16  emc gpio c5 ("GPI SW" (only used if devif_det# active))
17  0v?
18  5v?
19  emc gpio a49 (devif_det#)
20  emc gpio a27. main power switch
21  i2c data (i2c_bus_4)
22  i2c clock (i2c_bus_4)
23  gnd
24  emc reset#

i2c_bus_4 contains mainly power management stuff:
(7bit addrs, 400khz)
1f      pca9557_gpioexpander    CP/dev only
2c      ad5272_nand             titania nand
2e      ad5272_g6_2             gddr6
2f      ad5272_g6_1             gddr6
51      rt5127_pmic             titania pmic
58      ds80pci102_redriver
64      rt5069_pmic             salina pmic. actually rt5126 (EDM-010) or da9081 (EDM-020) on ps5

emc gpio a 4,5,6,7(cs0:efc),8(cs1:floyd) - emc-efc spi bus (shared with floyd)

emc gpio a16 goes to rt5126 pin 13/rt5127 pin 44. set hi with pg2

emc gpio a29 - efc reset#
emc gpio a30 - titania bootmode (0: nand, 1: uart)
    to patch out emc's efc irq handler: emc.fcddr_write(0xa0113200, bytes.fromhex('7047'))
        prevents eventflg 8 being sent to task
    uart boot is on uart1 @ 460800.
    known cmds:
        info: prints "t2.0.100.041\nEC5E98BF84CC.C.1" from efc, "t2.0.100.043\nEC5E98BF84CC.C.1" from eap
        down: enters xmodem1k/crc
            0x03060000 when hdr.cpu is 0x99
        run: (sigchecks/decrypts?) downloaded data and execs
            0x030B0000 if called without doing down first
            0x06020000 if passed completely invalid data
            0x06020001 if hdr.cpu is 4. weird!!
            0x010100xx if hdr.cpu is not in (1,2,4). xx is hdr.cpu value (probably generic "invalid value" errorcode)
    unknown cmds return 0x030D0000
    errors get logged into "fw0" region of titania spi
        note: reading spi seems to kill rom
emc gpio a31 - titania cpu select (0: efc, 1: eap)
emc gpio a38 - efc to emc cmd irq (emc waits for it to be triggered after efc released from reset)

rt5126 - rt5127 connections
13      44  (emc gpio a16)
14      45
15      46

bits
31-28       cpu-origin
27-16       error major
15-0        error minor

0x001   invalid rom checksum hi (cmd 1)
0x002   invalid rom checksum lo (cmd 1)
0x004   invalid ipcfifo src/dst cpu (read)
0x006   invalid ipcfifo src/dst cpu (write)
0x007   invalid ipcfifo register bank index
0x008   ipcfifo msg len too large (read)
0x009   ipcfifo msg len too large (write)
0x011   DFSR
0x012   IFSR
0x013   ADFSR hi
0x014   ADFSR lo
0x015   AIFSR hi
0x016   AIFSR lo
0x017   DFAR hi
0x018   DFAR lo
0x019   IFAR hi
0x01a   IFAR lo
0x201   expected ipcfifo 0x55
0x202   unknown ipcfifo cmd
0x203   failed to reply to cmd 1 (checksum). can only really happen if src/dst cpu are invalid.
0x204   minor 0: failed to read jump address. minor 1: failed to ack jump address.
0x205   failed to ack cmd 4, or wfi woke up.
0x206   (minor 0) __stack_chk_fail
0x207   (minor 3) __stack_chk_fail
0x30E   minor 1: timed out waiting to write byte to uart1

0x101   invalid hdr.cpu field value. minor is offending value.
0x306   trying to "down" image with hdr.cpu=0x99 and invalid other fields
0x30B   "run" without valid "down" state
0x30D   unknown uart command
0x602   image verification failure. minor 0: efc/eap, minor 1: bcm

src dst bank
    1   1
    2   3
    3   5
1       0
2       2
3       4

bank
0       1 -> 0
1       0 -> 1
2       2 -> 0
3       0 -> 2
4       3 -> 0
5       0 -> 3

1   checksum-verify own rom
2   set SCTLR.V=0 and jump to address
4   wfi (ipcfifo cmd dispatch keeps running if woken)

pico        emc header
1           6
2           7
3           4
4           5
5           24
11          12
12          11