Hey everyone,
I spent the past few weeks getting Linux running on a PS4 Pro CUH-7215B (Baikal southbridge). It is fully headless, no HDMI, no UART, no soldering. Just SSH over a USB ethernet adapter. Payload to SSH prompt in 32 seconds.
1. Why not?
2.The Gladius GPU in my CUH-7215B fails DP link training. HDMI just doesn't work under Linux. Every guide assumes you have a display. I didn't have one, so I had to figure out blind debugging from scratch.
3. It's always worth the effort to pop a shell.
A complete guide with everything I learned:
https://github.com/harreh3iesh/ps4-headless-linux
These were each discovered the hard way. I had to write debug logs to a USB FAT32 partition and rebooting over a dozen of times to see if any new progress was made on any config changes:
1.
2. busybox mount defaults to read-only — systemd 252 needs a read-write root immediately. The initramfs mounts ro by default. systemd can't write to
3. systemd 252 library path missing —
4.
5. Absolute symlinks break under
6. psxitarch missing
7. GCC 13 breaks MT7668 driver build — two tautological NULL checks that GCC 13 promotes to errors. Patches submitted upstream.
Anyone with a CUH-7215B (or any PS4 Pro with broken HDMI under Linux) who wants to use it as a headless Linux box. Also useful if you just want pre-switch_root SSH as a safety net during Linux bringup (even if your HDMI works), having SSH before systemd boots saves a lot of reboots.
The guide is CC0 (public domain). Hope it saves someone the 30+ hours of blind debugging it took to figure all this out.
Full guide: https://github.com/harreh3iesh/ps4-headless-linux
I spent the past few weeks getting Linux running on a PS4 Pro CUH-7215B (Baikal southbridge). It is fully headless, no HDMI, no UART, no soldering. Just SSH over a USB ethernet adapter. Payload to SSH prompt in 32 seconds.
Why headless?
1. Why not?
2.The Gladius GPU in my CUH-7215B fails DP link training. HDMI just doesn't work under Linux. Every guide assumes you have a display. I didn't have one, so I had to figure out blind debugging from scratch.
3. It's always worth the effort to pop a shell.
What I'm sharing
A complete guide with everything I learned:
https://github.com/harreh3iesh/ps4-headless-linux
It includes:
- Modified better-initramfs init script with USB debug logging, pre-switch_root SSH (dropbear on port 2222), and manual root mount
- PID 1 wrapper init that starts SSH + watchdog before handing off to systemd
- GCC 13 build fixes for the MT7668 driver (patches included, PR submitted to noob404's kernel)
- Reference
bootargs.txtfor headless kernel cmdline - All scripts are standalone files you can drop in, not just code blocks in a wall of text
The 7 bugs
These were each discovered the hard way. I had to write debug logs to a USB FAT32 partition and rebooting over a dozen of times to see if any new progress was made on any config changes:
1.
emount /newroot silent death — better-initramfs calls musthave root, but the PS4 kexec payload doesn't set root= on the cmdline. On headless hardware, this silently drops to a rescue shell nobody can see.2. busybox mount defaults to read-only — systemd 252 needs a read-write root immediately. The initramfs mounts ro by default. systemd can't write to
/run and dies.3. systemd 252 library path missing —
libsystemd-shared-252.so lives in /lib/systemd/ which isn't on psxitarch's ld.so.conf search path. systemd fails to load its own libraries.4.
bootargs.txt silently overrides hardcoded cmdline — the kexec payload reads this file from USB and replaces the entire kernel cmdline. Barely documented. If you're editing main-baikal.c and also have a bootargs.txt, your source changes are ignored.5. Absolute symlinks break under
switch_root — if /sbin/init is an absolute symlink, the initramfs resolves it against its own root, not /newroot. Has to be relative (../usr/local/bin/init-wrapper).6. psxitarch missing
/dev, /proc, /sys dirs — moveDev does mount --move /dev /newroot/dev which fails if the directory doesn't exist. Silent hang on headless.7. GCC 13 breaks MT7668 driver build — two tautological NULL checks that GCC 13 promotes to errors. Patches submitted upstream.
Hardware
- PS4 Pro CUH-7215B, firmware 9.60, GoldHEN
- Kernel: noob404 baikal-5.4.213-mt7668-dns-vpn (custom compiled with
CONFIG_USB_RTL8152=y) - USB ethernet: Amazon Basics RTL8153 gigabit adapter (~$13)
- Boot media: USB stick (FAT32 boot + ext4 psxitarch) 64GB
What works
- Full x86_64 Linux (all 8 Jaguar cores, ~5GB RAM)
- SSH in 32 seconds from payload
- systemd boots to multi-user target
- pacman package management
- Bluetooth (MT7668 HCI)
What doesn't work
- HDMI — Gladius GPU DP link training failure. Not fixable in software on CUH-7215B. This is why the whole headless approach exists.
- MT7668 WiFi — GPIO error (
invalid gpio mt76x8_pmu_en_gpio). Firmware loads but driver can't enable the radio. Needs kernel-level GPIO work.
Upstream contributions
I've submitted fixes back to the projects that needed them:- GCC 13 fix PR to noob404's kernel
- bootargs.txt documentation request to ps4-linux-payloads
- psxitarch headless bugs report
Who this is for
Anyone with a CUH-7215B (or any PS4 Pro with broken HDMI under Linux) who wants to use it as a headless Linux box. Also useful if you just want pre-switch_root SSH as a safety net during Linux bringup (even if your HDMI works), having SSH before systemd boots saves a lot of reboots.
The guide is CC0 (public domain). Hope it saves someone the 30+ hours of blind debugging it took to figure all this out.
Full guide: https://github.com/harreh3iesh/ps4-headless-linux
