Editing Cell Configuration Ring

The Cell Configuration ring is sent to the Cell BE processor via an SPI bus from syscon. It is used to configure basic processor settings in preparation for booting.

= Sample =
This [http://www.ps3devforum.com/viewtopic.php?p=31#p31 data was captured] from the SPI bus connecting CELL to SYSCON and parsed as per the [https://www-01.ibm.com/chips/techlib/techlib.nsf/techdocs/BD3F1F4C3DB32C7487257142006131BC/$file/CellBE_HIG_90nm_v1.5_30Nov2007_pub.pdf Cell BE 90nm HIG]. See the full SPI dump for more boot-time communication over SPI.

{| class="wikitable"
! Offset
! Length (bits)
! PS3 Value (bits)
! PS3 Value (hex)
! Description

|-
! colspan="5" style="center" | Pervasive Logic (PRV) Bits
|-
| 0000 || 002 || 0b00 || 0x0 || reserved
|-
! colspan="5" style="center" | SPE_1 Bits
|-
| 0002 || 009 || 0b0 0000 0000 || 0x000 || reserved
|-
| 0011 || 015 || 0b000 0000 0000 0000 || 0x0000 || SPE1 MC_BASE
|-
| 0026 || 015 || 0b100 0000 0000 0000 || 0x4000 || SPE1 MC_COMP_EN
|-
| 0041 || 010 || 0b11 1000 0000 || 0x380 || SPE1 IOIF1_COMP_EN
|-
| 0051 || 032 || 0b1000 0000 0000 0000 0000 0000 0000 0000 || 0x80000000 || reserved
|-
| 0083 || 040 || 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 || 0x2401fc00000 || SPE1 SReset???
|-
| 0123 || 064 || 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 || 0x0000000000000802 || reserved
|-
| 0187 || 019 || 0b100 0000 0000 0000 0000 || 0x40000 || SPE1 BE_MMIO_Base
|-
| 0206 || 004 || 0b0000 || 0x0 || SPE1 unit Cell BE node ID
|-
| 0210 || 003 || 0b001 || 0x1 || SPE1 SPE ID
|-
| 0213 || 011 || 0b001 1011 0000 || 0x1B0 || reserved
|-
! colspan="5" style="center" | SPE_3 Bits
|-
| 0224 || 009 || 0b0 0000 0000 || 0x000 || reserved
|-
| 0233 || 015 || 0b000 0000 0000 0000 || 0x0000 || SPE3 MC_BASE
|-
| 0248 || 015 || 0b100 0000 0000 0000 || 0x4000 || SPE3 MC_COMP_EN
|-
| 0263 || 010 || 0b11 1000 0000 || 0x380 || SPE3 IOIF1_COMP_EN
|-
| 0273 || 032 || 0b1000 0000 0000 0000 0000 0000 0000 0000 || 0x80000000 || reserved
|-
| 0305 || 040 || 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 || 0x2401fc00000 || SPE3 SReset???
|-
| 0345 || 064 || 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 || 0x0000000000000802 || reserved
|-
| 0409 || 019 || 0b100 0000 0000 0000 0000 || 0x40000 || SPE3 BE_MMIO_Base
|-
| 0428 || 004 || 0b0000 || 0x0 || SPE3 unit Cell BE node ID
|-
| 0432 || 003 || 0b011 || 0x3 || SPE3 SPE ID
|-
| 0435 || 011 || 0b001 1011 0000 || 0x1B0 || reserved
|-
! colspan="5" style="center" | SPE_5 Bits
|-
| 0446 || 009 || 0b0 0000 0000 || 0x000 || reserved
|-
| 0455 || 015 || 0b000 0000 0000 0000 || 0x0000 || SPE5 MC_BASE
|-
| 0470 || 015 || 0b100 0000 0000 0000 || 0x4000 || SPE5 MC_COMP_EN
|-
| 0485 || 010 || 0b11 1000 0000 || 0x380 || SPE5 IOIF1_COMP_EN
|-
| 0495 || 032 || 0b1000 0000 0000 0000 0000 0000 0000 0000 || 0x80000000 || reserved
|-
| 0527 || 040 || 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 || 0x2401fc00000 || SPE5 SReset???
|-
| 0567 || 064 || 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 || 0x0000000000000802 || reserved
|-
| 0631 || 019 || 0b100 0000 0000 0000 0000 || 0x40000 || SPE5 BE_MMIO_Base
|-
| 0650 || 004 || 0b0000 || 0x0 || SPE5 unit Cell BE node ID
|-
| 0654 || 003 || 0b101 || 0x5 ||  SPE5 SPE ID
|-
| 0657 || 011 || 0b001 1011 0000 || 0x1B0 || reserved
|-
! colspan="5" style="center" | SPE_7 Bits
|-
| 0668 || 009 || 0b0 0000 0000 || 0x000 || reserved
|-
| 0677 || 015 || 0b000 0000 0000 0000 || 0x0000 || SPE7 MC_BASE
|-
| 0692 || 015 || 0b100 0000 0000 0000 || 0x4000 || SPE7 MC_COMP_EN
|-
| 0707 || 010 || 0b11 1000 0000 || 0x380 || SPE7 IOIF1_COMP_EN
|-
| 0717 || 032 || 0b1000 0000 0000 0000 0000 0000 0000 0000 || 0x80000000 || reserved
|-
| 0749 || 040 || 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 || 0x2401fc00000 || SPE7 SReset???
|-
| 0789 || 064 || 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 || 0x0000000000000802 || reserved
|-
| 0853 || 019 || 0b100 0000 0000 0000 0000 || 0x40000 || SPE7 BE_MMIO_Base
|-
| 0872 || 004 || 0b0000 || 0x0 || SPE7 unit Cell BE node ID
|-
| 0876 || 003 || 0b111 || 0x7 ||  SPE7 SPE ID
|-
| 0879 || 011 || 0b001 1011 0000 || 0x1B0 || reserved
|-
! colspan="5" style="center" | Cell Broadband Engine Interface (BEI) Unit Bits
|-
| 0890 || 002 || 0b00 || 0x0 || reserved
|-
| 0892 || 004 || 0b0000 || 0x0 || BIF unit Cell BE node ID
|-
| 0896 || 022 || 0b10 0000 0000 0000 0000 0101 || 0x200005 || BEI BE_MMIO_Base
|-
| 0918 || 003 || 0b110 || 0x6 || reserved
|-
| 0921 || 003 || 0b011 || 0x3 || reserved
|-
| 0924 || 012 || 0b1111 1000 0000 || 0xf80 || IOIF1 base address mask
|-
| 0936 || 022 || 0b10 0100 0000 0000 0000 0000 || 0x240000 || IOIF1 base address and replacement
|-
| 0958 || 012 || 0b1111 1000 0000 || 0xf80 || IOIF0 base address mask
|-
| 0970 || 022 || 0b10 1000 0000 0000 0000 0000 || 0x280000 ||  IOIF0 base address and replacement
|-
| 0992 || 002 || 0b00 || 0x0 || reserved
|-
| 0994 || 002 || 0b10 || 0x2 || AC0 configuration
|-
| 0996 || 005 || 0b0 0100 || 0x04 || BIF/IOIF0 receive (RX) configuration
|-
| 1001 || 006 || 0b00 0100 || 0x04 || BIF/IOIF0 transmit (TX) configuration
|-
| 1007 || 006 || 0b00 0000 || 0x00 || reserved
|-
| 1013 || 001 || 0b1 || 0x1 || BIF/IOIF0 coherency mode
|-
| 1014 || 003 || 0b000 || 0x0 || reserved
|-
| 1017 || 003 || 0b100 || 0x4 || BIF/IOIF0 I/O reorder mode for transmit
|-
| 1020 || 016 || 0b0000 0000 0000 0000 || 0x0000 || reserved
|-
| 1036 || 003 || 0b100 || 0x4 || IOIF1 I/O reorder mode for transmit
|-
| 1039 || 001 || 0b1 || 0x1 || reserved
|-
| 1040 || 002 || 0b10 || 0x2 || IOIF1 RX configuration
|-
| 1042 || 002 || 0b10 || 0x2 || IOIF1 TX configuration
|-
| 1044 || 032 || 0b0000 0000 0000 0000 0000 0010 0000 0000 || 0x00000200 || FlexIO PLL configuration
|-
| 1076 || 002 || 0b00 || 0x0 ||  reserved
|-
! colspan="5" style="center" | EIB Unit Bits
|-
| 1078 || 002 || 0b00 || 0x0 || reserved
|-
| 1080 || 001 || 0b0 || 0x0 || AC0 livelock response control
|-
| 1081 || 004 || 0b0000 || 0x0 || EIB unit Cell BE node ID
|-
| 1085 || 001 || 0b0 || 0x0 || AC1 configuration
|-
| 1086 || 001 || 0b1 || 0x1 || AC0 configuration
|-
| 1087 || 004 || 0b0010 || 0x2 || AC0 command credits
|-
| 1091 || 022 || 0b10 0000 0000 0000 0000 0000 || 0x200000 || LBAR0_cfg
|-
| 1113 || 022 || 0b11 1111 1111 1111 1111 1000 || 0x3FFFF8 || LBAMR0_cfg
|-
| 1135 || 003 || 0b011 || 0x3 || reserved
|-
| 1138 || 001 || 0b0 || 0x0 || AC1 livelock response control
|-
| 1139 || 002 || 0b00 || 0x0 || reserved
|-
! colspan="5" style="center" | SPE_6 Bits
|-
| 1141 || 009 || 0b0 0000 0000 || 0x000 || reserved
|-
| 1150 || 015 || 0b000 0000 0000 0000 || 0x0000 || SPE6 MC_BASE
|-
| 1165 || 015 || 0b100 0000 0000 0000 || 0x4000 || SPE6 MC_COMP_EN
|-
| 1180 || 010 || 0b11 1000 0000 || 0x380 || SPE6 IOIF1_COMP_EN
|-
| 1190 || 032 || 0b1000 0000 0000 0000 0000 0000 0000 0000 || 0x80000000 || reserved
|-
| 1222 || 040 || 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 || 0x2401fc00000 || SPE6 SReset???
|-
| 1262 || 064 || 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 || 0x0000000000000802 || reserved
|-
| 1326 || 019 || 0b100 0000 0000 0000 0000 || 0x40000 || SPE6 BE_MMIO_Base
|-
| 1345 || 004 || 0b0000 || 0x0 || SPE6 unit Cell BE node ID
|-
| 1349 || 003 || 0b110 || 0x6 || SPE6 SPE ID
|-
| 1352 || 011 || 0b001 1011 0000 || 0x1B0 || reserved
|-
! colspan="5" style="center" | SPE_4 Bits
|-
| 1363 || 009 || 0b0 0000 0000 || 0x000 || reserved
|-
| 1372 || 015 || 0b000 0000 0000 0000 || 0x0000 || SPE4 MC_BASE
|-
| 1387 || 015 || 0b100 0000 0000 0000 || 0x4000 || SPE4 MC_COMP_EN
|-
| 1402 || 010 || 0b11 1000 0000 || 0x380 || SPE4 IOIF1_COMP_EN
|-
| 1412 || 032 || 0b1000 0000 0000 0000 0000 0000 0000 0000 || 0x80000000 || reserved
|-
| 1444 || 040 || 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 || 0x2401fc00000 || SPE4 SReset???
|-
| 1484 || 064 || 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 || 0x0000000000000802 || reserved
|-
| 1548 || 019 || 0b100 0000 0000 0000 0000 || 0x40000 || SPE4 BE_MMIO_Base
|-
| 1567 || 004 || 0b0000 || 0x0 || SPE4 unit Cell BE node ID
|-
| 1571 || 003 || 0b100 || 0x4 || SPE4 SPE ID
|-
| 1574 || 011 || 0b001 1011 0000 || 0x1B0 || reserved
|-
! colspan="5" style="center" | SPE_2 Bits
|-
| 1585 || 009 || 0b0 0000 0000 || 0x000 || reserved
|-
| 1594 || 015 || 0b000 0000 0000 0000 || 0x0000 || SPE2 MC_BASE
|-
| 1609 || 015 || 0b100 0000 0000 0000 || 0x4000 || SPE2 MC_COMP_EN
|-
| 1624 || 010 || 0b11 1000 0000 || 0x380 || SPE2 IOIF1_COMP_EN
|-
| 1634 || 032 || 0b1000 0000 0000 0000 0000 0000 0000 0000 || 0x80000000 || reserved
|-
| 1666 || 040 || 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 || 0x2401fc00000 || SPE2 SReset???
|-
| 1706 || 064 || 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 || 0x0000000000000802 || reserved
|-
| 1770 || 019 || 0b100 0000 0000 0000 0000 || 0x40000 || SPE2 BE_MMIO_Base
|-
| 1789 || 004 || 0b0000 || 0x0 || SPE2 unit Cell BE node ID
|-
| 1793 || 003 || 0b010 || 0x2 || SPE2 SPE ID
|-
| 1796 || 011 || 0b001 1011 0000 || 0x1B0 || reserved
|-
! colspan="5" style="center" | SPE_0 Bits
|-
| 1807 || 009 || 0b0 0000 0000 || 0x000 || reserved
|-
| 1816 || 015 || 0b000 0000 0000 0000 || 0x0000 || SPE0 MC_BASE
|-
| 1831 || 015 || 0b100 0000 0000 0000 || 0x4000 || SPE0 MC_COMP_EN
|-
| 1846 || 010 || 0b11 1000 0000 || 0x380 || SPE0 IOIF1_COMP_EN
|-
| 1856 || 032 || 0b1000 0000 0000 0000 0000 0000 0000 0000 || 0x80000000 || reserved
|-
| 1888 || 040 || 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 || 0x2401fc00000 || SPE0 SReset???
|-
| 1928 || 064 || 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 || 0x0000000000000802 || reserved
|-
| 1992 || 019 || 0b100 0000 0000 0000 0000 || 0x40000 || SPE0 BE_MMIO_Base
|-
| 2011 || 004 || 0b0000 || 0x0 || SPE0 unit Cell BE node ID
|-
| 2015 || 003 || 0b000 || 0x0 || SPE0 SPE ID
|-
| 2018 || 011 || 0b001 1011 0000 || 0x1B0 || reserved
|-
! colspan="5" style="center" | MIC Bus Logic Bits
|-
| 2029 || 004 || 0b1000 || 0x8 || reserved
|-
| 2033 || 016 || 0b0000 0000 0000 0000 || 0x0000 || MIC address space start
|-
| 2049 || 016 || 0b1111 1111 1111 1100 || 0xfffc || MIC address space end
|-
| 2065 || 030 || 0b10 0000 0000 0000 0000 0101 0000 1001 || 0x20000509 || PRV BE_MMIO_Base
|-
| 2095 || 030 || 0b10 0000 0000 0000 0000 0101 0000 1010 || 0x2000050A || MIC BE_MMIO_Base
|-
| 2125 || 004 || 0b0011 || 0x3 || reserved
|-
| 2129 || 004 || 0b0000 || 0x0 || MIC unit Cell BE node ID
|-
| 2133 || 002 || 0b00 || 0x0 || reserved
|-
! colspan="5" style="center" | PowerPC Processor Unit Bits
|-
| 2135 || 009 || 0b0 0000 0000 || 0x000 || reserved
|-
| 2144 || 008 || 0b0000 0000 || 0x00 || PIR_defn
|-
| 2152 || 013 || 0b0 0000 0000 0000 || 0x0000 || reserved
|-
| 2165 || 040 || 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 || 0x2401fc00000 || PPE SReset Vector
|-
| 2205 || 224 || 0b0000 ... 1000 ... 0011 1100 0000 || 0x000000000000000000000000008000000000000000000000000003c0 || reserved
|-
! colspan="5" style="center" | PowerPC Processor Storage Subsystem (PPSS) Bits
|-
| 2429 || 061 || 0b || 0x008000000000400, 0b0 || reserved
|-
| 2490 || 001 || 0b1 || 0x1 || L2 livelock
|-
| 2491 || 044 || 0b0000 0000 0000 0000 0000 0000 1111 1000 0000 0000 0000 || 0x000000f8000 || reserved
|-
| 2535 || 004 || 0b0000 || 0x0 || PPE unit Cell BE node ID
|-
| 2539 || 009 || 0b0 1101 1000 || 0x0D8 || reserved
|-
| 2548 || 030 || 0b10 0000 0000 0000 0000 0101 0000 0000 || 0x20000500 || PPE BE_MMIO_Base
|-
| 2578 || 007 || 0b100 0111 || 0x47 || reserved
|-
| 2585 || 001 || 0b1 || 0x1 || NCU 2 token decode
|-
| 2586 || 016 || 0b0000 0000 0000 0000 || 0x0000 || reserved
|-
| 2602 || 001 || 0b1 || 0x1 || NCU livelock
|-
| 2603 || 001 || 0b1 || 0x1 || PPE livelock
|-
| 2604 || 002 || 0b00 || 0x0 || reserved
|-
! colspan="5" style="center" | MIC Bits
|-
| 2606 || 016 || 0b0000 0000 0000 0000 || 0x0000 || XIO PLL LO
|-
| 2622 || 016 || 0b1001 1100 1111 1100 || 0x9cfc || XIO PLL HI
|-
| 2638 || 004 || 0b0000 || 0x0 || reserved
|-
! colspan="5" style="center" | PRV Bits
|-
| 2642 || 006 || 0b01 1111 || 0x1F || Thermal overload temperature
|-
| 2648 || 027 || 0b000 0010 1000 1000 0000 0001 1000 || 0x288018 || reserved
|-
| 2675 || 001 || 0b1 || 0x1 || Pervasive logic livelock
|-
| 2676 || 010 || 0b00 0000 0000 || 0x0 || reserved
|-
| 2686 || 008 || 0b0000 0000 || 0x08 || SPE disable
|-
| 2694 || 003 || 0b011 || 0x3 || reserved
|}

== Scripts ==

Scripts to parse configuration ring from SPI dump:
* http://pastie.org/private/gbhlx25kvhfvciob2fqwrq
* https://hastebin.com/voqekajoyu.py
* http://pastie.org/private/v8d150oqofmnhtvaruraig

Script to verify configuration ring at bootloader:
* http://pastie.org/private/0jqux3usi8b6qup9vxi5vg

{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>