Hacking A PS3, Linux styleKeith Wright

Why Linux on PS3?Additional computer

PPC Architecture

HDMI output

Full featured browser

Cell Broadband Engine

Bluetooth devices

Sixaxis Controllers

Blueray

Prepare Hard DriveBackup Data

Delete data you don't want

Insert USB drive

Settings -> System Settings -> Backup

Format Hard DriveSettings -> System Settings -> Format Hard Drive -> Custom -> Allocate 10G to Other -> Quick Format

Restore Data– Settings -> System Settings -> Restore

Installing a BootloaderChoose a Bootloader

Kboot

Petitboot

Copy to Media /PS3/otheros/otheros.bld

Settings -> System Settings ->Install Other OS

Settings -> System Settings ->Select Default OS -> Other OS

Returning to GameOSUse the ps3-utils: ps3-boot-gameos

Force shutdown by holding front power button, Force GameOS when powering on PS3 by holding the button until PS3 beeps twice

PetitbootFeatures a graphical interface and a text console

Works with keyboard, mouse, and game controller

Extends all the capabilities of kboot

Dynamically detects new boot devices

Allows setting of graphical modes

Allows rebooting to the Game Os

Petitboot

Discovered storage devices are mounted under /var/tmp/mnt, named by their device. For example, /dev/ps3da1 is mounted at /var/tmp/mnt/ps3da1.

To boot a kernel, use kexec: kexec -f --append="root=/dev/ps3da1" -l /tmp/tmp/mnt/ps3da1/boot/vmlinux –initrd=/tmp/tmp/mnt/ps3da1/boot/initrd.img

petitboot is a work-in-progress: if you have any problems, send email to jk@ozlabs.org.

Keyboard Controller Mouse Function

▲▼◄► D-pad Point Navigate

0 1 2 3 Video Mode

Alt+F1 Shell Console

Alt+F2 GUI Console

Del Bksp Square Boot GameOS

Using KbootNot just access to local files, but also NFS, HTTP, FTP, and TFTP.

Kboot is based on kexec

Using kexec-tools

Kexec calls allow a new kernel to be loaded without going through firmware or yaboot again

Can be used for speeding up kernel test builds

kexec -l <kernel> --append="<options>" --initrd=<initrd>

reboot

Installing package provides man page

Sources

http://www.kernel.org/pub/linux/kernel/people/geoff/cell/ps3-kboot/

http://kboot.sourceforge.net/

KexecUsing Fedora 10 kexec-tools

# kexec -l /boot/vmlinuz-$kver

--initrd=/boot/initrd-$kver.img \

--command-line="`cat /proc/cmdline`"

Tab key auto-completion

BusyBox• Kboot and Petitboot use Busybox

• Busybox is a project to go from booting a linux kernel to a shell

• Minimizes the size of the kernel

• Provides a minimal set of command such as fdisk, lvm, mount, umount, and vi

• Start the shell by typing ash at the kboot: prompt

yaboot.confboot=/dev/ps3da

init-message=Welcome to Fedora!\nHit <TAB> for boot options

partition=1

install=/usr/lib/yaboot/yaboot

delay=5

enablecdboot

enableofboot

enablenetboot

nonvram

mntpoint=/boot/yaboot

usemount root=LABEL=/"

image=/vmlinux-2.6.23-9.ydl6.1

label=ydl6_1080p

read-only

initrd=/initrd-2.6.23-9.ydl6.1.img

append="video=ps3fb:mode:133 rhgb quiet”

kboot.conf• /etc/kboot.confmessage=/etc/kboot.msg

default=linux

timeout=100

linux='/boot/vmlinux initrd=/boot/initrd.img root=UUID=2e7efb11-0646-42f5-8d6f-9e055473b1b8 quiet'

old='/boot/vmlinux.old initrd=/boot/initrd.img.old root=UUID=2e7efb11-0646-42f5-8d6f-9e055473b1b8 quiet'

kboot.msg is a simple text file that kboot displays

Choose Linux DistroNeeds to be PowerPC

YellowdogCellSDK part of install

Kernel modules are built for ps3

Fedora CellSDK Available

Free, easy and current

Optimal to build kernel

OtherRedhat, Ubuntu, OpenSuse, Gentoo

Installing Fedora

Successfully did GUI normal install of Fedora 10 PPC DVD (Versions as early as 5 reported)

Disable Unnecessary Services

Optimize /etc/fstab

Configure Wireless or Wired

Update Packages

Installing Yellowdog

Successfully installed YDL 6.1

RHEL/Centos Based

Not as updated as Fedora

Cell SDK pre-installed

PS3-utils pre-installed

Sold pre-installed!

Installing UbuntuUbuntu 6.1 last version commercially supported

Luckily, the Intrepid Ibex has a PS3 install iso: http://cdimage.ubuntu.com/ports/releases/8.10/release/

Select and install software is longest part

Be patient... it stayed at 6% for a long time!

sudo apt-get install ubuntu-restricted-extras

Optimizing fstab/dev/ps3da1 / ext3 defaults,noatime,nodiratime 1 1

spufs /spu spufs defaults 0 0

tmpfs /dev/shm tmpfs defaults 0 0

devpts /dev/pts devpts gid=5,mode=620 0 0

sysfs /sys sysfs defaults 0 0

proc /proc proc defaults 0 0

/dev/ps3da2 swap swap defaults 0 0

# nodiratime and noatime save writing to disk access times

# Memory from ps3vram module managed in rc.local

Configuring SoundDownload Configuration File

http://kernel.org/pub/linux/kernel/people/geoff/cell/PS3.conf.alsa

Install it as PS3.conf/etc/alsa/cards/PS3.conf

/usr/share/alsa/cards/PS3.conf

– Using a custom kernel build, I had to chmod o+rw /dev/snd/* for it to work

PS3-utils for Linux• If not pre-installed, then build them from:• http://kernel.org/pub/linux/kernel/people/geoff/cell/ps3-utils/

• ps3-boot-game-os

• ps3-dump-bootloader

• ps3-flash-util

• ps3-video-mode?

Preparing the Kernel Source

git clone git://git.kernel.org/pub/scm/linux/kernel/git/geoff/ps3-linux.git ps3-linux

Create/Backup .config file in ps3-linux directorymake help

make ps3_defconfig

make menuconfig

USB HID Boot Protocol drivers

Configure KernelGeneral Setup

Auto append version

Advanced Platform Ps3

Cell (SPU)

Device DriversUSB Support

EHCIUHCISpecial HID drivers

LogitechSony

Using ps3vram

If you use ps3vram, then you can add over 240Mb of GPU RAM to use as swap

Need kernel supportYellowdog has it pre-built

Fedora/Ubuntu don't have the module

Configure a custom kernel from git

Device Drivers -> MTD Block SupportMemory Technology Device (MTD) support

Self-contained MTD device drivers

PS3 video ram

Building the KernelEdit Makefile version

make help

make && make modules_install && make install

Update the /etc/yaboot.conf with the new kernel information

Reboot

Test

Booting the Kernel• Kboot

• Use the TAB key to cycle through what is available

• Type the label that was configured in the /etc/yaboot.conf file

• http://kernel.org/pub/linux/kernel/people/geoff/cell/ps3-howto/ps3-boot-recovery-howto.txt

• Petitboot• Selecting the kernel with mouse and keyboard• Use Alt+F1 to access text console of system• Use Alt+F2 to return to the GUI• ?Use ssh, http, and other features

Pulseaudio Distribution kernels work fine Custom rolled kernel

• Have /etc/rc.local chmod o+rw /dev/snd/*

Flash Adobe flash-plugin? Nope, not for PPC! Gnash? gnash-plugin. Audio only.... Xine? xine-plugin. Not at all... Mplayer? gecko-mediaplayer(Fedora) or

mplayer-plugin(Ubuntu)– Yes! With a Greasemonkey script!– Install Greasemonkey Addon for Firefox

http://userscripts.org/scripts/show/24999

Bluetooth PS3 Linux

Cell phone? Sixaxis

PC Linux Sixaxis

Media Devices

Blueray DVD?At least some data appears visible

Mediaserver http://code.google.com/p/ps3mediaserver/ Allows any Java-enabled system to server

media to PS3

Cell Broadband Engine IBM CellSDK MIT GeorgiaTech

Python game

Mpeg decoder

Acknowledgements The author acknowledges Georgia Institute of Technology, its Sony

Toshiba-IBM Center of Competence, and the National Science Foundation, for the use of Cell Broadband Engine resources that have contributed to this research.

The author acknowledges Geoff Levand for his help in getting started with Linux on the Sony Playstation 3 and for maintaining http://kernel.org/pub/linux/kernel/people/geoff/cell/