Project

General

Profile

Actions

MT6235 DSP » History » Revision 1

Revision 1/4 | Next »
Anonymous, 02/19/2016 10:48 PM


Introduction
MT6235 SoC features two DSP processors (master and slave).BR
Most probably these processors are ADSP-2181.BR
Below is outcome from analyzing of original Sciphone G2 firmware which uses DSP processor. Base addresses of DSP related peripherals.
Connected via APB: * '''0x820A0000''' - MCU - DSP1 (master) Shared Registers * '''0x820C0000''' - MCU - DSP2 (slave) Shared Registers
Conected via AHB: * '''0xA0000000''' - CPU - DSP1 (master) Share RAM * '''0xA1000000''' - CPU - DSP2 (slave) Share RAM * '''0xA2000000''' - CPU - DSP1 (master) IDMA port base address * '''0xA2000000''' - DSP1 Code Memory * 0xA2000000 - DSP1 Code Memory Page 0 * 0xA2010000 - DSP1 Code Memory Page 1 * ... * 0xA20F0000 - DSP1 Code Memory Page 15 * '''0xA2100000''' - DSP1 Program Memory * 0xA2100000 - DSP1 Program Memory Page 0 * 0xA2110000 - DSP1 Program Memory Page 1 * ... * 0xA21F0000 - DSP1 Program Memory Page 15 * '''0xA2200000''' - DSP1 Data Memory * 0xA2100000 - DSP1 Data Memory Page 0 * 0xA2110000 - DSP1 Data Memory Page 1 * ... * 0xA21F0000 - DSP1 Data Memory Page 15 * '''0xA2310000''' - DSP1 DDMA Short Read/Write Register DSP Patch Unit registers (not documented in datasheet) DPUB - DSP Patch Unit Base address (0x820E0000)BR
n - instruction number * DPUB + n*16 + 0x0 - page number * DPUB + n*16 + 0x4 - address * DPUB + n*16 + 0x8 - low 16 bits of instruction * DPUB + n*16 - 0xC - high 8 bits of instruction * DPUB + 0x100 - patch enable register It seems that DSP Patch Unit is able to patch only 4 instructions of DSP code memory.BR
After writing 0xFF to DSP Patch Enable Register, value 0x33 appears (mask 0x3 enables master DSP, second mask 0x30 enables slave?).BR
Below analysis shows that MTK firmware loads only 4 instructions over DSP Patch Unit and the rest of patch is loaded via MCU-DSP shared memory, which also proves above assumption.BR
Hard to say if DSP Patch Unit is able to load patches to slave DSP, but probably not as there are MTK processors which have 2 DSP Patch Units. Functions which work with DSP processors * '''idma_load()''' - called by Reload_DSP_Patch(), Application_Initialize()

This function uses following structure describing DSP patch: {{{
struct dsp_ptch {
char patch_version20;
uint16_t patch_enable48; /* offset 0x14 /
uint16_t page_number48; /
offset 0x74 /
uint16_t address48; /
offset 0xD4 /
uint32_t code48; /
code loaded using DSP Patch Unit, offset 0x134 /
uint32_t idma_code11024; /
code loaded using IDMA to DSP1 Code Memory, offset 0x1F4 /
uint32_t idma_code21024; /
code loaded using IDMA to DSP2 Code Memory, offset 0x11F4 */
}
}}}

  • reset DSP1
  • reset DSP2
  • write 0 to DSP Patch Unit Enable register (disable patches?)
  • write 16 values from DSP patch table to DSP Patch Unit (using page number and address fields)
  • calculate value (mask) using patch_enable field as follows:

{{{
mask = 0
for (i = 0; i < 32; ++i)
mask |= dsp_ptch->patch_enable[i] << i;
}}}

  • nothing is written to DSP Patch Unit Enable register, only mask is calculated and then compared to some other value which triggers if code should be uploaded over IDMA or not
  • write 1024 instructions from idma_code[] table over IDMA under address 0xA200F000 (DSP1 Code Memory) - idma_load_cm()
  • write 1024 instructions form_idma_code2[] table over IDMA under address 0xA300F000 (DSP2 Code Memory) - idma_load_cm_d2()
Files (1)
dsp_patch.bin dsp_patch.bin 8.49 KB Dump of DSP patch table , 05/17/2011 01:00 PM

Updated by about 8 years ago · 1 revisions

Add picture from clipboard (Maximum size: 48.8 MB)