test0r
816848a474
- Ghidra decompilation of v1.02-v1.19 blobs (118 functions) - 53 functions renamed, 79 MMIO registers mapped to TRM - 45 timeout-less poll loops identified and patched - Production patcher (patch_prod.py) and QEMU emulator - Comprehensive analysis, frequency tables, community research Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
85 lines
3.7 KiB
C
85 lines
3.7 KiB
C
/* RK3588 DDR Init Blob - Annotated MMIO Register Map
|
|
* Cross-referenced with TRM Part 2 and kernel sources
|
|
*/
|
|
|
|
/* === Blob-internal data tables (not MMIO) === */
|
|
/* 0x0001xxxx - timing params, DDR config tables within the binary */
|
|
/* 0x001Fxxxx - likely shared memory / mailbox area */
|
|
|
|
/* === PMU1 GRF (0xFD588000) === */
|
|
#define _DAT_fd588080 REG32(0xFD588080) /* PMU1_GRF: DDR status/config */
|
|
|
|
/* === DDR GRF CH2 (0xFD598000) === */
|
|
#define _DAT_fd59800c REG32(0xFD59800C) /* DDR_GRF_CH2: channel config */
|
|
|
|
/* === BUS GRF (0xFD5F4000 / 0xFD5F8000) === */
|
|
/* BUS_IOC or DDR-related bus fabric config - 27 registers */
|
|
#define _DAT_fd5f4000 REG32(0xFD5F4000) /* BUS_GRF: base config */
|
|
#define _DAT_fd5f400c REG32(0xFD5F400C) /* BUS_GRF: status */
|
|
/* 0xFD5F8000-0xFD5F809C: Dense register block - DDR bus interconnect */
|
|
/* These control AXI fabric, QoS, and DDR routing */
|
|
#define _DAT_fd5f800c REG32(0xFD5F800C) /* bus_grf: DDR route cfg */
|
|
#define _DAT_fd5f8018 REG32(0xFD5F8018)
|
|
#define _DAT_fd5f8020 REG32(0xFD5F8020)
|
|
#define _DAT_fd5f8028 REG32(0xFD5F8028)
|
|
#define _DAT_fd5f802c REG32(0xFD5F802C)
|
|
#define _DAT_fd5f8030 REG32(0xFD5F8030)
|
|
#define _DAT_fd5f8038 REG32(0xFD5F8038)
|
|
#define _DAT_fd5f8044 REG32(0xFD5F8044)
|
|
#define _DAT_fd5f804c REG32(0xFD5F804C)
|
|
#define _DAT_fd5f8050 REG32(0xFD5F8050)
|
|
#define _DAT_fd5f8054 REG32(0xFD5F8054)
|
|
#define _DAT_fd5f805c REG32(0xFD5F805C)
|
|
#define _DAT_fd5f8060 REG32(0xFD5F8060)
|
|
#define _DAT_fd5f8068 REG32(0xFD5F8068)
|
|
#define _DAT_fd5f806c REG32(0xFD5F806C)
|
|
#define _DAT_fd5f8070 REG32(0xFD5F8070)
|
|
#define _DAT_fd5f8074 REG32(0xFD5F8074)
|
|
#define _DAT_fd5f8078 REG32(0xFD5F8078)
|
|
#define _DAT_fd5f807c REG32(0xFD5F807C)
|
|
#define _DAT_fd5f8080 REG32(0xFD5F8080)
|
|
#define _DAT_fd5f8084 REG32(0xFD5F8084)
|
|
#define _DAT_fd5f8088 REG32(0xFD5F8088)
|
|
#define _DAT_fd5f808c REG32(0xFD5F808C)
|
|
#define _DAT_fd5f8098 REG32(0xFD5F8098)
|
|
#define _DAT_fd5f809c REG32(0xFD5F809C)
|
|
|
|
/* === PMU CRU / Secure CRU (0xFD8C8000) === */
|
|
/* Clock gate and reset controls for DDR subsystem */
|
|
#define _DAT_fd8c8004 REG32(0xFD8C8004) /* SCRU: DDR clock gate */
|
|
#define _DAT_fd8c8008 REG32(0xFD8C8008) /* SCRU: DDR reset */
|
|
#define _DAT_fd8c8014 REG32(0xFD8C8014) /* SCRU: DPLL config */
|
|
#define _DAT_fd8c8018 REG32(0xFD8C8018) /* SCRU: DPLL status */
|
|
|
|
/* === DDRC CH0 (0xFE010000) === */
|
|
/* Synopsys UMCTL2 registers - only 4 accessed directly */
|
|
#define _DAT_fe0100f0 REG32(0xFE0100F0) /* DDRC_CH0 + 0xF0: MSTR/timing? */
|
|
#define _DAT_fe0100f4 REG32(0xFE0100F4) /* DDRC_CH0 + 0xF4 */
|
|
#define _DAT_fe0100f8 REG32(0xFE0100F8) /* DDRC_CH0 + 0xF8 */
|
|
#define _DAT_fe0100fc REG32(0xFE0100FC) /* DDRC_CH0 + 0xFC */
|
|
|
|
/* === FIREWALL DDR (0xFE030000) === */
|
|
#define _DAT_fe030040 REG32(0xFE030040) /* FW_DDR: access control */
|
|
|
|
/* === SGRF (0xFE050000) - Security GRF === */
|
|
/* Controls which bus masters can access DDR regions */
|
|
#define _DAT_fe050000 REG32(0xFE050000) /* SGRF_DDR_CON0 */
|
|
#define _DAT_fe050004 REG32(0xFE050004) /* SGRF_DDR_CON1 */
|
|
#define _DAT_fe050008 REG32(0xFE050008) /* SGRF_DDR_CON2 */
|
|
#define _DAT_fe05000c REG32(0xFE05000C) /* SGRF_DDR_CON3 */
|
|
#define _DAT_fe05002c REG32(0xFE05002C) /* SGRF_DDR_CON11 */
|
|
#define _DAT_fe050054 REG32(0xFE050054) /* SGRF_DDR_CON21 */
|
|
#define _DAT_fe050058 REG32(0xFE050058) /* SGRF_DDR_CON22 */
|
|
#define _DAT_fe0500e0 REG32(0xFE0500E0) /* SGRF: status/busy poll */
|
|
#define _DAT_fe0500e4 REG32(0xFE0500E4) /* SGRF: enable/lock */
|
|
|
|
/* === Unknown 0xFECC0000 region === */
|
|
/* Possibly DDR Scramble / ECC or VO-related */
|
|
#define _DAT_fecc0004 REG32(0xFECC0004)
|
|
#define _DAT_fecc0008 REG32(0xFECC0008)
|
|
#define _DAT_fecc0020 REG32(0xFECC0020)
|
|
#define _DAT_fecc0084 REG32(0xFECC0084)
|
|
|
|
/* === SRAM (0xFF000000) === */
|
|
#define _DAT_ff000010 REG32(0xFF000010) /* SRAM: boot flag/mailbox */
|