Syscon SPI: Difference between revisions
Jump to navigation
Jump to search
m (Let's add the internal SC EEPROM too) |
mNo edit summary |
||
| (One intermediate revision by one other user not shown) | |||
| Line 4: | Line 4: | ||
* [[RSX]] | * [[RSX]] | ||
* [[South Bridge]] | * [[South Bridge]] | ||
* Syscon internal [[SC EEPROM|EEPROM]] (only in [[ | * Syscon internal [[SC EEPROM|EEPROM]] (only in [[Mullion]]) data bus in between syscon EEPROM and a service connector | ||
= Cell BE SPI = | = Cell BE SPI = | ||
| Line 83: | Line 83: | ||
= Southbridge SPI = | = Southbridge SPI = | ||
To be discovered... | To be discovered... | ||
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude> | |||
Latest revision as of 13:07, 29 May 2023
Overview[edit | edit source]
Syscon has multiple SPI busses for communicating with different hardware peripherals:
- CELL BE
- RSX
- South Bridge
- Syscon internal EEPROM (only in Mullion) data bus in between syscon EEPROM and a service connector
Cell BE SPI[edit | edit source]
The SPI bus used for the Cell is described in the "Cell Broadband Engine Hardware Initialization Guide" (HIG) and provides access to both SPI and MMIO registers within the Cell. Section 3 of the HIG describes the details of the SPI interface in detail. A summary relevant to the PS3 is available below.
SPI Communication[edit | edit source]
- Cell is the subordinate device, Syscon is the SPI master
- SPI_CLK runs at 2.5 MHz (as measured on a JSD-001)
- MSB first (except the configuration ring register)
- Serial data sent to the Cell is clocked on the SPI_CLK rising edge
- Serial data output from the Cell is clocked on the SPI_CLK falling edge
SPI Protocol[edit | edit source]
- Fixed size header
* 8-bit Command ID * 16-bit SPI address
- Register-specific data length
- A quick and dirty DSView decoder is available here: ps3_sc_spi
SPI Command ID[edit | edit source]
| Bits | Function | Bit Definition | Description |
|---|---|---|---|
| 0:3 | Cell BE Chip ID | 0000 | Serial SPI Memory |
| 0001 | Cell BE Processor | ||
| 0010 | IOIF0 Device | ||
| 0011 | IOIF1 Device | ||
| 0100 | System Controller | ||
| 0101 | Reserved | ||
| 011x | Reserved | ||
| 1xxx | Example | ||
| 4:5 | Multichip ID | 00 | Cell BE Processor 0 |
| 01 | Cell BE Processor 1 | ||
| 10 | Cell BE Processor 2 | ||
| 11 | Cell BE Processor 3 | ||
| 6:7 | Command | 00 | Read |
| 01 | Write | ||
| 1x | Reserved | ||
| 'x' indicates don't care |
SPI MMIO Registers[edit | edit source]
| SPI Address | Cell MMIO Address | Description | Size (bits) | Notes |
|---|---|---|---|---|
| 0x9004 | 0x24000509004 | Unknown | 32 | Read after SB_INT is asserted |
| 0x9104 | 0x24000509104 | Unknown | 32 | Written after every Syscon packet transfer |
| 0xa000 | 0x2400008c000 | SC -> BE packet buffer | 32768 (0x1000 bytes) | Buffer where Cell reads packets from Syscon. Can write to this buffer over the SPI bus. |
| 0xb000 | 0x2400008d000 | BE -> SC packet buffer | 32768 (0x1000 bytes) | Buffer where Syscon reads packets from Cell. Can NOT be written over the SPI bus. This is most likely held within SC. |
| N/A | 0x2400008e100 | Syscon packet doorbell | 32 | Will assert the SB_INT line when 0x1 is written to it from the Cell |
RSX SPI[edit | edit source]
To be discovered...
Southbridge SPI[edit | edit source]
To be discovered...
