Editing Syscon SPI

= Overview =
Syscon has multiple SPI busses for communicating with different hardware peripherals:
* Cell BE
* RSX
* Southbridge

= Cell BE SPI =
The SPI bus used for the Cell is described in the "Cell Broadband Engine Hardware Initialization Guide" (HIG) and provides access to both SPI and MMIO registers within the Cell. Section 3 of the HIG describes the details of the SPI interface in detail. A summary relevant to the PS3 is available below.

== SPI Communication ==
* Cell is the subordinate device, Syscon is the SPI master
* SPI_CLK runs at 2.5 MHz (as measured on a JSD-001)
* MSB first (except the configuration ring register)
* Serial data sent to the Cell is clocked on the SPI_CLK rising edge
* Serial data output from the Cell is clocked on the SPI_CLK falling edge

== SPI Protocol ==
* Fixed size header
  * 8-bit [[Syscon SPI#SPI Command ID|Command ID]]
  * 16-bit SPI address
* Register-specific data length
* A quick and dirty DSView decoder is available here: [https://github.com/MikeM64/ps3_sc_spi ps3_sc_spi]

=== SPI Command ID ===
{| class="wikitable"
|-
! Bits !! Function !! Bit Definition !! Description
|-
| 0:3 || Cell BE Chip ID || 0000 || Serial SPI Memory
|-
| || || 0001 || Cell BE Processor
|-
| || || 0010 || IOIF0 Device
|-
| || || 0011 || IOIF1 Device
|-
| || || 0100 || System Controller
|-
| || || 0101 || Reserved
|-
| || || 011x || Reserved
|-
| || || 1xxx || Example
|-
| 4:5 || Multichip ID || 00 || Cell BE Processor 0
|-
| || || 01 || Cell BE Processor 1
|-
| || || 10 || Cell BE Processor 2
|-
| || || 11 || Cell BE Processor 3
|-
| 6:7 || Command || 00 || Read
|-
| || || 01 || Write
|-
| || || 1x || Reserved
|-
| 'x' indicates don't care
|}

=== SPI MMIO Registers ===

{| class="wikitable"
|-
! SPI Address !! Cell MMIO Address !! Description !! Size (bits) !! Notes
|-
| 0x9004 || 0x24000509004 || Unknown || 32 || Read after SB_INT is asserted
|-
| 0x9104 || 0x24000509104 || Unknown || 32 || Written after every Syscon packet transfer
|-
| 0xa000 || 0x2400008c000 || Syscon packet TX buffer || 32768 (0x1000 '''bytes''') || Buffer where Syscon writes packets for the Cell
|-
| 0xb000 || 0x2400008d000 || Syscon packet RX buffer || 32768 (0x1000 '''bytes''') || Buffer where Syscon reads packets from the Cell
|-
| N/A || 0x2400008e100 || Syscon packet doorbell || 32 || Will assert the SB_INT line when 0x1 is written to it from the Cell
|}

= RSX SPI =
To be discovered...

= Southbridge SPI =
To be discovered...

{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>