Syscon SPI

Overview

Syscon has multiple SPI busses for communicating with different hardware peripherals:

• CELL BE
• RSX
• South Bridge
• Syscon internal EEPROM (only in Mullion) data bus in between syscon EEPROM and a service connector

Cell BE SPI

The SPI bus used for the Cell is described in the "Cell Broadband Engine Hardware Initialization Guide" (HIG) and provides access to both SPI and MMIO registers within the Cell. Section 3 of the HIG describes the details of the SPI interface in detail. A summary relevant to the PS3 is available below.

SPI Communication

• Cell is the subordinate device, Syscon is the SPI master
• SPI_CLK runs at 2.5 MHz (as measured on a JSD-001)
• MSB first (except the configuration ring register)
• Serial data sent to the Cell is clocked on the SPI_CLK rising edge
• Serial data output from the Cell is clocked on the SPI_CLK falling edge

SPI Protocol

• Fixed size header

 * 8-bit Command ID
 * 16-bit SPI address

• Register-specific data length
• A quick and dirty DSView decoder is available here: ps3_sc_spi

SPI Command ID

Bits	Function	Bit Definition	Description
0:3	Cell BE Chip ID	0000	Serial SPI Memory
		0001	Cell BE Processor
		0010	IOIF0 Device
		0011	IOIF1 Device
		0100	System Controller
		0101	Reserved
		011x	Reserved
		1xxx	Example
4:5	Multichip ID	00	Cell BE Processor 0
		01	Cell BE Processor 1
		10	Cell BE Processor 2
		11	Cell BE Processor 3
6:7	Command	00	Read
		01	Write
		1x	Reserved
'x' indicates don't care

SPI MMIO Registers

SPI Address	Cell MMIO Address	Description	Size (bits)	Notes
0x9004	0x24000509004	Unknown	32	Read after SB_INT is asserted
0x9104	0x24000509104	Unknown	32	Written after every Syscon packet transfer
0xa000	0x2400008c000	SC -> BE packet buffer	32768 (0x1000 bytes)	Buffer where Cell reads packets from Syscon. Can write to this buffer over the SPI bus.
0xb000	0x2400008d000	BE -> SC packet buffer	32768 (0x1000 bytes)	Buffer where Syscon reads packets from Cell. Can NOT be written over the SPI bus. This is most likely held within SC.
N/A	0x2400008e100	Syscon packet doorbell	32	Will assert the SB_INT line when 0x1 is written to it from the Cell

RSX SPI

To be discovered...

Southbridge SPI

To be discovered...