/* Best-effort ground truth for FUN_0000d10c @ 0xd10c (196 bytes / 49 insts).
 * Contains poll site 11 (the sole site in this function).
 *
 * Harder to lift than FUN_0000d328 — uses two base pointers (channel-switched
 * via csel) and several save-and-modify loops on PHY registers indexed
 * through a secondary table pointer. Represents the "prepare-for-freq-change"
 * family of functions.
 *
 * Signature:  void prep_freq_change(struct ctx *ctx, uint32_t ch, void *save_area);
 *   X0 = ctx (opaque)
 *   W1 = channel index (0..3)
 *   X2 = save_area where original register values are cached for later restore
 *
 * Structure of ctx (guessed from offsets):
 *   ctx[0..7] : array of channel base pointers? (ctx[ch*32] = channel base)
 *   ctx[0xc8], ctx[0xd0] : two "secondary register table" base pointers
 *                         (one picked based on ch > 1)
 *
 * Behaviour:
 *   1. Look up the PHY base pointer for channel `ch` from ctx[ch*32].
 *   2. Select one of two secondary tables based on whether `ch > 1`.
 *   3. Read+save PHY @ +0x10180; clear bits 0xFFFBFD00, write back.
 *   4. Poll site 11: wait for PHY +0x10014 [2:0] == 1.
 *   5. For a fixed set of secondary-table offsets (depend on ch parity):
 *      save old value (masked), write a "disable" value.
 *   6. Return. The restore step happens in a sibling function.
 *
 * This is the PHY-side half of a frequency-scaling handshake: pause
 * training, record current state, clear active masks, wait for the
 * PHY firmware to reach "state 1" (idle?), then prime the hardware
 * for the new clock.
 *
 * NOTE: matching-decomp iteration on this function is deferred — it
 * will take several hours to reach ≥90% byte-match because GCC's
 * register allocation for the two-base-pointer csel pattern differs
 * substantially from the vendor's. The AI-Ghidra rename pass
 * (GhidrAssist + Hermes-2-Pro on dirac) may help identify the
 * semantic names for the offset constants (0x4c, 0x30, 0x1F0000,
 * 0x2FFF0FFF, etc.) before we continue here.
 */
#include <stdint.h>

struct ctx; /* opaque; array+pointer layout inferred from offsets */

#define PHY_OFF_BASE   0x10000
#define PHY_CTL_180    0x180   /* absolute: +0x10180 */
#define PHY_STATE_014  0x14    /* absolute: +0x10014 */

#define PHY_CTL_CLR_MASK  0xFFFBFD00U
#define PHY_STATE_IDLE    1U

static inline uint32_t rd(volatile uint8_t *b, unsigned o) {
    return *(volatile uint32_t *)(b + o);
}
static inline void wr(volatile uint8_t *b, unsigned o, uint32_t v) {
    *(volatile uint32_t *)(b + o) = v;
}

void prep_freq_change(struct ctx *ctx, uint32_t ch, uint8_t *save_area)
{
    uint64_t *ch_bases    = (uint64_t *)ctx;
    uint64_t *sec_table_a = *(uint64_t **)((uint8_t *)ctx + 0xC8);
    uint64_t *sec_table_b = *(uint64_t **)((uint8_t *)ctx + 0xD0);
    uint64_t *sec_table   = (ch > 1) ? sec_table_b : sec_table_a;

    volatile uint8_t *phy_ch = (volatile uint8_t *)(ch_bases[ch] + PHY_OFF_BASE);
    uint8_t *ch_save = save_area + ch * 32;

    /* Read + cache + mask-modify PHY CTL register */
    wr((uint8_t *)ch_save, 0x238, rd(phy_ch, PHY_CTL_180));
    uint32_t v = rd(phy_ch, PHY_CTL_180) & PHY_CTL_CLR_MASK;
    wr(phy_ch, PHY_CTL_180, v);

    /* Poll site 11 — wait for PHY state machine to report idle */
    while ((rd(phy_ch, PHY_STATE_014) & 7U) != PHY_STATE_IDLE)
        ;

    /* The rest: save + clear secondary-table entries indexed by a
     * parity-dependent pattern. Offsets 0x30, 0x4c, 0x18, 0x24 into
     * the secondary table; value masks 0xffff, 0x1f, 0x2fff, 0x4000;
     * replacement writes 0x1f0000, 0x2fff0fff, 0x40000000.
     *
     * This section is semi-decoded — names are the analyst's best guesses.
     * Further AI-Ghidra rename pass needed before attempting byte-match. */
    uint32_t parity = ch & 1;
    unsigned o0 = parity * 0x30;
    unsigned o1 = (parity + 0x4c) << 2;   /* ubfiz x1, x1, #2, #8 == (x1 & 0xff) << 2 */

    /* Block A: save low 16 bits at sec[o0+0x18], no write-back */
    wr(ch_save, 0x244, (uint32_t)(sec_table[(o0 + 0x18) / 8] & 0xFFFF));

    /* Block B: save low 5 bits at sec[o0+4], write 0x1f0000 */
    uint32_t *b_ptr = (uint32_t *)((uint8_t *)sec_table + o0 + 4);
    wr(ch_save, 0x240, *b_ptr & 0x1F);
    *b_ptr = 0x1F0000U;

    /* Block C: save low 12 bits at sec[o0+0x24], write 0x2fff0fff */
    uint32_t *c_ptr = (uint32_t *)((uint8_t *)sec_table + o0 + 0x24);
    wr(ch_save, 0x248, *c_ptr & 0x2FFFU);
    *c_ptr = 0x2FFF0FFFU;

    /* Block D: save bit 14 at sec[o1], write 0x40000000 */
    uint32_t *d_ptr = (uint32_t *)((uint8_t *)sec_table + o1);
    wr(ch_save, 0x24C, *d_ptr & 0x4000U);
    *d_ptr = 0x40000000U;
}