Syscon SPI

From PS3 Developer wiki
Revision as of 03:33, 16 December 2021 by MikeM6464 (talk | contribs) (Fixed Mullion link)
Jump to navigation Jump to search


Syscon has multiple SPI busses for communicating with different hardware peripherals:


The SPI bus used for the Cell is described in the "Cell Broadband Engine Hardware Initialization Guide" (HIG) and provides access to both SPI and MMIO registers within the Cell. Section 3 of the HIG describes the details of the SPI interface in detail. A summary relevant to the PS3 is available below.

SPI Communication

  • Cell is the subordinate device, Syscon is the SPI master
  • SPI_CLK runs at 2.5 MHz (as measured on a JSD-001)
  • MSB first (except the configuration ring register)
  • Serial data sent to the Cell is clocked on the SPI_CLK rising edge
  • Serial data output from the Cell is clocked on the SPI_CLK falling edge

SPI Protocol

  • Fixed size header
 * 8-bit Command ID
 * 16-bit SPI address
  • Register-specific data length
  • A quick and dirty DSView decoder is available here: ps3_sc_spi

SPI Command ID

Bits Function Bit Definition Description
0:3 Cell BE Chip ID 0000 Serial SPI Memory
0001 Cell BE Processor
0010 IOIF0 Device
0011 IOIF1 Device
0100 System Controller
0101 Reserved
011x Reserved
1xxx Example
4:5 Multichip ID 00 Cell BE Processor 0
01 Cell BE Processor 1
10 Cell BE Processor 2
11 Cell BE Processor 3
6:7 Command 00 Read
01 Write
1x Reserved
'x' indicates don't care

SPI MMIO Registers

SPI Address Cell MMIO Address Description Size (bits) Notes
0x9004 0x24000509004 Unknown 32 Read after SB_INT is asserted
0x9104 0x24000509104 Unknown 32 Written after every Syscon packet transfer
0xa000 0x2400008c000 SC -> BE packet buffer 32768 (0x1000 bytes) Buffer where Cell reads packets from Syscon. Can write to this buffer over the SPI bus.
0xb000 0x2400008d000 BE -> SC packet buffer 32768 (0x1000 bytes) Buffer where Syscon reads packets from Cell. Can NOT be written over the SPI bus. This is most likely held within SC.
N/A 0x2400008e100 Syscon packet doorbell 32 Will assert the SB_INT line when 0x1 is written to it from the Cell


To be discovered...

Southbridge SPI

To be discovered...