test0r
816848a474
- Ghidra decompilation of v1.02-v1.19 blobs (118 functions) - 53 functions renamed, 79 MMIO registers mapped to TRM - 45 timeout-less poll loops identified and patched - Production patcher (patch_prod.py) and QEMU emulator - Comprehensive analysis, frequency tables, community research Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
90 lines
2.7 KiB
C
90 lines
2.7 KiB
C
#ifndef RK3588_DDR_H
|
|
#define RK3588_DDR_H
|
|
|
|
#include <stdint.h>
|
|
|
|
/* Ghidra type mappings */
|
|
typedef uint64_t undefined8;
|
|
typedef uint32_t undefined4;
|
|
typedef uint16_t undefined2;
|
|
typedef uint8_t undefined1;
|
|
typedef uint8_t undefined;
|
|
typedef uint8_t byte;
|
|
typedef unsigned int uint;
|
|
typedef unsigned long ulong;
|
|
typedef unsigned short ushort;
|
|
|
|
/* MMIO access */
|
|
#define REG32(addr) (*(volatile uint32_t *)(uintptr_t)(addr))
|
|
|
|
/* === RK3588 DDR Memory Map (from TRM Part 2) === */
|
|
|
|
/* DDR Controller (DDRC / Synopsys UMCTL2) - 4 channels */
|
|
#define DDRC_CH0_BASE 0xFE010000 /* stride 0x8000 */
|
|
#define DDRC_CH1_BASE 0xFE018000
|
|
#define DDRC_CH2_BASE 0xFE020000
|
|
#define DDRC_CH3_BASE 0xFE028000
|
|
|
|
/* DDR Firewall */
|
|
#define FIREWALL_DDR_BASE 0xFE030000
|
|
#define FW_DDR_MST5_REG 0x54
|
|
#define FW_DDR_MST13_REG 0x74
|
|
#define FW_DDR_MST21_REG 0x94
|
|
#define FW_DDR_MST26_REG 0xA8
|
|
#define FW_DDR_MST27_REG 0xAC
|
|
|
|
/* MSCH (Memory Scheduler / DDR QoS) - 4 channels */
|
|
#define MSCH0_BASE 0xFE040000 /* stride 0x4000 */
|
|
#define MSCH1_BASE 0xFE044000
|
|
#define MSCH2_BASE 0xFE048000
|
|
#define MSCH3_BASE 0xFE04C000
|
|
|
|
/* SGRF (Security GRF) */
|
|
#define SGRF_BASE 0xFE050000
|
|
|
|
/* DFI Monitor (DDRMON) */
|
|
#define DFI_BASE 0xFE060000 /* per-channel stride 0x4000 */
|
|
|
|
/* DDR PHY (Synopsys DWC LPDDR5/4X multiPHY) - 4 channels */
|
|
#define DDRPHY_CH0_BASE 0xFE0C0000 /* 256KB each */
|
|
#define DDRPHY_CH1_BASE 0xFE0D0000
|
|
#define DDRPHY_CH2_BASE 0xFE0E0000
|
|
#define DDRPHY_CH3_BASE 0xFE0F0000
|
|
|
|
/* GRF (General Register Files) */
|
|
#define PMU1_GRF_BASE 0xFD58A000
|
|
#define SYS_GRF_BASE 0xFD58C000
|
|
#define PMU2_GRF_BASE 0xFD58E000
|
|
#define DDR_GRF_BASE 0xFD590000
|
|
|
|
/* Bus GRF - heavy usage in DDR init (27 registers) */
|
|
#define BUS_GRF_BASE 0xFD5F0000
|
|
|
|
/* CRU (Clock and Reset Unit) */
|
|
#define CRU_BASE 0xFD7C0000
|
|
#define SCRU_BASE 0xFD7D0000 /* Secure CRU, DDR PLL domain */
|
|
#define SBUSCRU_BASE 0xFD7D8000
|
|
|
|
/* PMU */
|
|
#define PMU_BASE 0xFD8C0000
|
|
|
|
/* PMUGRF OS registers (DDR blob writes, Linux reads) */
|
|
#define PMUGRF_OS_REG2 0x208 /* encodes bus width, channel info */
|
|
|
|
/* === Register region mapping for decompiled code === */
|
|
/*
|
|
* 0xFD58xxxx = GRF region
|
|
* 0xFD59xxxx = DDR GRF
|
|
* 0xFD5Fxxxx = Bus GRF (27 regs - main DDR config)
|
|
* 0xFD8Cxxxx = PMU/CRU
|
|
* 0xFE01xxxx = DDRC (channels 0-3)
|
|
* 0xFE03xxxx = Firewall DDR
|
|
* 0xFE04xxxx = MSCH (QoS)
|
|
* 0xFE05xxxx = SGRF (9 regs - security/access)
|
|
* 0xFE0Cxxxx = DDRPHY
|
|
* 0xFECCxxxx = unknown (possibly VO/display related?)
|
|
* 0xFF00xxxx = SRAM / Boot ROM
|
|
*/
|
|
|
|
#endif /* RK3588_DDR_H */
|