Editing Syscon SPI

= Overview =
[[Syscon Hardware|Syscon]] has multiple SPI busses for communicating with different hardware peripherals:
* [[CELL BE]]
* [[RSX]]
* [[South Bridge]]
* Syscon internal [[SC EEPROM|EEPROM]] (only in [[Mullion]]) data bus in between syscon EEPROM and a service connector

= Cell BE SPI =
The SPI bus used for the Cell is described in the "Cell Broadband Engine Hardware Initialization Guide" (HIG) and provides access to both SPI and MMIO registers within the Cell. Section 3 of the HIG describes the details of the SPI interface in detail. A summary relevant to the PS3 is available below.

== SPI Communication ==
* Cell is the subordinate device, Syscon is the SPI master
* SPI_CLK runs at 2.5 MHz (as measured on a JSD-001)
* MSB first (except the configuration ring register)
* Serial data sent to the Cell is clocked on the SPI_CLK rising edge
* Serial data output from the Cell is clocked on the SPI_CLK falling edge

== SPI Protocol ==
* Fixed size header
  * 8-bit Command ID
  * 16-bit SPI address
* Register-specific data length

=== SPI Command ID ===
{| class="wikitable"
|-
! Bits !! Function !! Bit Definition !! Description
|-
| 0:3 || Cell BE Chip ID || 0000 || Serial SPI Memory
|-
| || || 0001 || Cell BE Processor
|-
| || || 0010 || IOIF0 Device
|-
| || || 0011 || IOIF1 Device
|-
| || || 0100 || System Controller
|-
| || || 0101 || Reserved
|-
| || || 011x || Reserved
|-
| || || 1xxx || Example
|-
| 4:5 || Multichip ID || 00 || Cell BE Processor 0
|-
| || || 01 || Cell BE Processor 1
|-
| || || 10 || Cell BE Processor 2
|-
| || || 11 || Cell BE Processor 3
|-
| 6:7 || Command || 00 || Read
|-
| || || 01 || Write
|-
| || || 1x || Reserved
|-
| 'x' indicates don't care
|}

=== SPI MMIO Registers ===

{| class="wikitable"
|-
! SPI Address !! Cell MMIO Address !! Description !! Size (bits) !! Notes
|-
| 0x9004 || 0x24000509004 || Unknown || 32 || Read after SB_INT is asserted
|-
| 0x9104 || 0x24000509104 || Unknown || 32 || Written after every Syscon packet transfer
|-
| 0xa000 || 0x2400008c000 || SC -> BE packet buffer || 32768 (0x1000 '''bytes''') || Buffer where Cell reads packets from Syscon. Can write to this buffer over the SPI bus.
|-
| 0xb000 || 0x2400008d000 || BE -> SC packet buffer || 32768 (0x1000 '''bytes''') || Buffer where Syscon reads packets from Cell. Can NOT be written over the SPI bus. This is most likely held within SC.
|-
| N/A || 0x2400008e100 || Syscon packet doorbell || 32 || Will assert the SB_INT line when 0x1 is written to it from the Cell
|}

= RSX SPI =
To be discovered...

= Southbridge SPI =
To be discovered...

{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>