Cell Configuration Ring: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
 
Line 370: Line 370:
Script to verify configuration ring at bootloader:
Script to verify configuration ring at bootloader:
* http://pastie.org/private/0jqux3usi8b6qup9vxi5vg
* http://pastie.org/private/0jqux3usi8b6qup9vxi5vg
* https://hastebin.com/oyinirefob.py


{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>

Latest revision as of 13:37, 23 September 2017

The Cell Configuration ring is sent to the Cell BE processor via an SPI bus from syscon. It is used to configure basic processor settings in preparation for booting.

Sample[edit | edit source]

This data was captured from the SPI bus connecting CELL to SYSCON and parsed as per the Cell BE 90nm HIG. See the full SPI dump for more boot-time communication over SPI.

Offset Length (bits) PS3 Value (bits) PS3 Value (hex) Description
Pervasive Logic (PRV) Bits
0000 002 0b00 0x0 reserved
SPE_1 Bits
0002 009 0b0 0000 0000 0x000 reserved
0011 015 0b000 0000 0000 0000 0x0000 SPE1 MC_BASE
0026 015 0b100 0000 0000 0000 0x4000 SPE1 MC_COMP_EN
0041 010 0b11 1000 0000 0x380 SPE1 IOIF1_COMP_EN
0051 032 0b1000 0000 0000 0000 0000 0000 0000 0000 0x80000000 reserved
0083 040 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 0x2401fc00000 SPE1 SReset???
0123 064 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 0x0000000000000802 reserved
0187 019 0b100 0000 0000 0000 0000 0x40000 SPE1 BE_MMIO_Base
0206 004 0b0000 0x0 SPE1 unit Cell BE node ID
0210 003 0b001 0x1 SPE1 SPE ID
0213 011 0b001 1011 0000 0x1B0 reserved
SPE_3 Bits
0224 009 0b0 0000 0000 0x000 reserved
0233 015 0b000 0000 0000 0000 0x0000 SPE3 MC_BASE
0248 015 0b100 0000 0000 0000 0x4000 SPE3 MC_COMP_EN
0263 010 0b11 1000 0000 0x380 SPE3 IOIF1_COMP_EN
0273 032 0b1000 0000 0000 0000 0000 0000 0000 0000 0x80000000 reserved
0305 040 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 0x2401fc00000 SPE3 SReset???
0345 064 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 0x0000000000000802 reserved
0409 019 0b100 0000 0000 0000 0000 0x40000 SPE3 BE_MMIO_Base
0428 004 0b0000 0x0 SPE3 unit Cell BE node ID
0432 003 0b011 0x3 SPE3 SPE ID
0435 011 0b001 1011 0000 0x1B0 reserved
SPE_5 Bits
0446 009 0b0 0000 0000 0x000 reserved
0455 015 0b000 0000 0000 0000 0x0000 SPE5 MC_BASE
0470 015 0b100 0000 0000 0000 0x4000 SPE5 MC_COMP_EN
0485 010 0b11 1000 0000 0x380 SPE5 IOIF1_COMP_EN
0495 032 0b1000 0000 0000 0000 0000 0000 0000 0000 0x80000000 reserved
0527 040 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 0x2401fc00000 SPE5 SReset???
0567 064 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 0x0000000000000802 reserved
0631 019 0b100 0000 0000 0000 0000 0x40000 SPE5 BE_MMIO_Base
0650 004 0b0000 0x0 SPE5 unit Cell BE node ID
0654 003 0b101 0x5 SPE5 SPE ID
0657 011 0b001 1011 0000 0x1B0 reserved
SPE_7 Bits
0668 009 0b0 0000 0000 0x000 reserved
0677 015 0b000 0000 0000 0000 0x0000 SPE7 MC_BASE
0692 015 0b100 0000 0000 0000 0x4000 SPE7 MC_COMP_EN
0707 010 0b11 1000 0000 0x380 SPE7 IOIF1_COMP_EN
0717 032 0b1000 0000 0000 0000 0000 0000 0000 0000 0x80000000 reserved
0749 040 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 0x2401fc00000 SPE7 SReset???
0789 064 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 0x0000000000000802 reserved
0853 019 0b100 0000 0000 0000 0000 0x40000 SPE7 BE_MMIO_Base
0872 004 0b0000 0x0 SPE7 unit Cell BE node ID
0876 003 0b111 0x7 SPE7 SPE ID
0879 011 0b001 1011 0000 0x1B0 reserved
Cell Broadband Engine Interface (BEI) Unit Bits
0890 002 0b00 0x0 reserved
0892 004 0b0000 0x0 BIF unit Cell BE node ID
0896 022 0b10 0000 0000 0000 0000 0101 0x200005 BEI BE_MMIO_Base
0918 003 0b110 0x6 reserved
0921 003 0b011 0x3 reserved
0924 012 0b1111 1000 0000 0xf80 IOIF1 base address mask
0936 022 0b10 0100 0000 0000 0000 0000 0x240000 IOIF1 base address and replacement
0958 012 0b1111 1000 0000 0xf80 IOIF0 base address mask
0970 022 0b10 1000 0000 0000 0000 0000 0x280000 IOIF0 base address and replacement
0992 002 0b00 0x0 reserved
0994 002 0b10 0x2 AC0 configuration
0996 005 0b0 0100 0x04 BIF/IOIF0 receive (RX) configuration
1001 006 0b00 0100 0x04 BIF/IOIF0 transmit (TX) configuration
1007 006 0b00 0000 0x00 reserved
1013 001 0b1 0x1 BIF/IOIF0 coherency mode
1014 003 0b000 0x0 reserved
1017 003 0b100 0x4 BIF/IOIF0 I/O reorder mode for transmit
1020 016 0b0000 0000 0000 0000 0x0000 reserved
1036 003 0b100 0x4 IOIF1 I/O reorder mode for transmit
1039 001 0b1 0x1 reserved
1040 002 0b10 0x2 IOIF1 RX configuration
1042 002 0b10 0x2 IOIF1 TX configuration
1044 032 0b0000 0000 0000 0000 0000 0010 0000 0000 0x00000200 FlexIO PLL configuration
1076 002 0b00 0x0 reserved
EIB Unit Bits
1078 002 0b00 0x0 reserved
1080 001 0b0 0x0 AC0 livelock response control
1081 004 0b0000 0x0 EIB unit Cell BE node ID
1085 001 0b0 0x0 AC1 configuration
1086 001 0b1 0x1 AC0 configuration
1087 004 0b0010 0x2 AC0 command credits
1091 022 0b10 0000 0000 0000 0000 0000 0x200000 LBAR0_cfg
1113 022 0b11 1111 1111 1111 1111 1000 0x3FFFF8 LBAMR0_cfg
1135 003 0b011 0x3 reserved
1138 001 0b0 0x0 AC1 livelock response control
1139 002 0b00 0x0 reserved
SPE_6 Bits
1141 009 0b0 0000 0000 0x000 reserved
1150 015 0b000 0000 0000 0000 0x0000 SPE6 MC_BASE
1165 015 0b100 0000 0000 0000 0x4000 SPE6 MC_COMP_EN
1180 010 0b11 1000 0000 0x380 SPE6 IOIF1_COMP_EN
1190 032 0b1000 0000 0000 0000 0000 0000 0000 0000 0x80000000 reserved
1222 040 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 0x2401fc00000 SPE6 SReset???
1262 064 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 0x0000000000000802 reserved
1326 019 0b100 0000 0000 0000 0000 0x40000 SPE6 BE_MMIO_Base
1345 004 0b0000 0x0 SPE6 unit Cell BE node ID
1349 003 0b110 0x6 SPE6 SPE ID
1352 011 0b001 1011 0000 0x1B0 reserved
SPE_4 Bits
1363 009 0b0 0000 0000 0x000 reserved
1372 015 0b000 0000 0000 0000 0x0000 SPE4 MC_BASE
1387 015 0b100 0000 0000 0000 0x4000 SPE4 MC_COMP_EN
1402 010 0b11 1000 0000 0x380 SPE4 IOIF1_COMP_EN
1412 032 0b1000 0000 0000 0000 0000 0000 0000 0000 0x80000000 reserved
1444 040 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 0x2401fc00000 SPE4 SReset???
1484 064 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 0x0000000000000802 reserved
1548 019 0b100 0000 0000 0000 0000 0x40000 SPE4 BE_MMIO_Base
1567 004 0b0000 0x0 SPE4 unit Cell BE node ID
1571 003 0b100 0x4 SPE4 SPE ID
1574 011 0b001 1011 0000 0x1B0 reserved
SPE_2 Bits
1585 009 0b0 0000 0000 0x000 reserved
1594 015 0b000 0000 0000 0000 0x0000 SPE2 MC_BASE
1609 015 0b100 0000 0000 0000 0x4000 SPE2 MC_COMP_EN
1624 010 0b11 1000 0000 0x380 SPE2 IOIF1_COMP_EN
1634 032 0b1000 0000 0000 0000 0000 0000 0000 0000 0x80000000 reserved
1666 040 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 0x2401fc00000 SPE2 SReset???
1706 064 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 0x0000000000000802 reserved
1770 019 0b100 0000 0000 0000 0000 0x40000 SPE2 BE_MMIO_Base
1789 004 0b0000 0x0 SPE2 unit Cell BE node ID
1793 003 0b010 0x2 SPE2 SPE ID
1796 011 0b001 1011 0000 0x1B0 reserved
SPE_0 Bits
1807 009 0b0 0000 0000 0x000 reserved
1816 015 0b000 0000 0000 0000 0x0000 SPE0 MC_BASE
1831 015 0b100 0000 0000 0000 0x4000 SPE0 MC_COMP_EN
1846 010 0b11 1000 0000 0x380 SPE0 IOIF1_COMP_EN
1856 032 0b1000 0000 0000 0000 0000 0000 0000 0000 0x80000000 reserved
1888 040 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 0x2401fc00000 SPE0 SReset???
1928 064 0b0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 1000 0000 0010 0x0000000000000802 reserved
1992 019 0b100 0000 0000 0000 0000 0x40000 SPE0 BE_MMIO_Base
2011 004 0b0000 0x0 SPE0 unit Cell BE node ID
2015 003 0b000 0x0 SPE0 SPE ID
2018 011 0b001 1011 0000 0x1B0 reserved
MIC Bus Logic Bits
2029 004 0b1000 0x8 reserved
2033 016 0b0000 0000 0000 0000 0x0000 MIC address space start
2049 016 0b1111 1111 1111 1100 0xfffc MIC address space end
2065 030 0b10 0000 0000 0000 0000 0101 0000 1001 0x20000509 PRV BE_MMIO_Base
2095 030 0b10 0000 0000 0000 0000 0101 0000 1010 0x2000050A MIC BE_MMIO_Base
2125 004 0b0011 0x3 reserved
2129 004 0b0000 0x0 MIC unit Cell BE node ID
2133 002 0b00 0x0 reserved
PowerPC Processor Unit Bits
2135 009 0b0 0000 0000 0x000 reserved
2144 008 0b0000 0000 0x00 PIR_defn
2152 013 0b0 0000 0000 0000 0x0000 reserved
2165 040 0b10 0100 0000 0001 1111 1100 0000 0000 0000 0000 0000 0x2401fc00000 PPE SReset Vector
2205 224 0b0000 ... 1000 ... 0011 1100 0000 0x000000000000000000000000008000000000000000000000000003c0 reserved
PowerPC Processor Storage Subsystem (PPSS) Bits
2429 061 0b 0x008000000000400, 0b0 reserved
2490 001 0b1 0x1 L2 livelock
2491 044 0b0000 0000 0000 0000 0000 0000 1111 1000 0000 0000 0000 0x000000f8000 reserved
2535 004 0b0000 0x0 PPE unit Cell BE node ID
2539 009 0b0 1101 1000 0x0D8 reserved
2548 030 0b10 0000 0000 0000 0000 0101 0000 0000 0x20000500 PPE BE_MMIO_Base
2578 007 0b100 0111 0x47 reserved
2585 001 0b1 0x1 NCU 2 token decode
2586 016 0b0000 0000 0000 0000 0x0000 reserved
2602 001 0b1 0x1 NCU livelock
2603 001 0b1 0x1 PPE livelock
2604 002 0b00 0x0 reserved
MIC Bits
2606 016 0b0000 0000 0000 0000 0x0000 XIO PLL LO
2622 016 0b1001 1100 1111 1100 0x9cfc XIO PLL HI
2638 004 0b0000 0x0 reserved
PRV Bits
2642 006 0b01 1111 0x1F Thermal overload temperature
2648 027 0b000 0010 1000 1000 0000 0001 1000 0x288018 reserved
2675 001 0b1 0x1 Pervasive logic livelock
2676 010 0b00 0000 0000 0x0 reserved
2686 008 0b0000 0000 0x08 SPE disable
2694 003 0b011 0x3 reserved

Scripts[edit | edit source]

Scripts to parse configuration ring from SPI dump:

Script to verify configuration ring at bootloader:

General
Hypervisor
Services
Plugin
Interfaces
ap_plugin · audioplayer_plugin · audiop_plugin_dummy · audiop_plugin_mini · auth_plugin · autodownload_plugin · autoupdateconf_plugin · avc_plugin · avc_util · avc2_game_plugin · avc2_game_video_plugin · avc2_text_plugin · bdp_disccheck_plugin · bdp_plugin · bdp_storage_plugin · campaign_plugin · category_setting_plugin · comboplay_plugin · custom_render_plugin · data_copy_plugin · deviceconf_plugin · dlna_plugin · download_plugin · dtcpip_util · edy_plugin · esehttp · eseibrd · eseidle · eselock · eula_cddb_plugin · eula_hcopy_plugin · eula_net_plugin · explore_plugin · explore_plugin_ft · explore_plugin_game · explore_plugin_np · filecopy_plugin · friendim_plugin · friendml_plugin · friendtrophy_plugin · game_ext_plugin · game_indicator_plugin · game_plugin · gamedata_plugin · gamelib_plugin · gameupdate_plugin · hknw_plugin · idle_plugin · impose_plugin · kensaku_plugin · msgdialog_plugin · mtpinitiator_plugin · musicbrowser_plugin · nas_plugin · netconf_plugin · newstore_plugin · np_eula_plugin · np_matching_plugin · np_multisignin_plugin · np_sns_plugin · npsignin_plugin · np_trophy_ingame · np_trophy_plugin · osk · oskfullkeypanel · oskpanel · pesm_plugin · photo_network_sharing_plugin · photolist_plugin · photoviewer_plugin · playlist_plugin · poweroff_plugin · premo_plugin · premo_game_plugin · print_plugin · profile_plugin · ps3_savedata_plugin · ps3_savedata_plugin_game · ps3_savedata_plugin_psp · rec_plugin · regcam_plugin · remotedownload_plugin · sacd_plugin · scenefolder_plugin · screenshot_plugin · software_update_plugin · soundvisualizer_plugin · strviewer_plugin · sysconf_plugin · system_plugin · thumthum_plugin · upload_util · user_info_plugin · user_plugin · videodownloader_plugin · videoeditor_plugin · videoplayer_util · videoplayer_plugin · vmc_savedata_plugin · wboard_plugin · webbrowser_plugin · webbrowser_service · webrender_plugin · xai_plugin · xmb_ingame · xmb_plugin
Emulation
Extended
features
Online
Hardware
SC
CELL
RAM
SB
HDD
BD
Tools
Strings
files
dumps
Reference
Keys & Seeds
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Cell_Configuration_Ring&oldid=46421"