Project

General

Profile

MT6235 DSP » History » Version 1

Anonymous, 02/19/2016 10:48 PM

1 1
== Introduction ==
2
MT6235 SoC features two DSP processors (master and slave).[[BR]]
3
Most probably these processors are ADSP-2181.[[BR]]
4
Below is outcome from analyzing of original Sciphone G2 firmware which uses DSP processor.
5
6
== Base addresses of DSP related peripherals. ==
7
Connected via APB:
8
 * '''0x820A0000''' - MCU - DSP1 (master) Shared Registers
9
 * '''0x820C0000''' - MCU - DSP2 (slave) Shared Registers
10
Conected via AHB:
11
 * '''0xA0000000''' - CPU - DSP1 (master) Share RAM
12
 * '''0xA1000000''' - CPU - DSP2 (slave) Share RAM
13
 * '''0xA2000000''' - CPU - DSP1 (master) IDMA port base address
14
  * '''0xA2000000''' - DSP1 Code Memory
15
   * 0xA2000000 - DSP1 Code Memory Page 0
16
   * 0xA2010000 - DSP1 Code Memory Page 1
17
   * ...
18
   * 0xA20F0000 - DSP1 Code Memory Page 15
19
  * '''0xA2100000''' - DSP1 Program Memory
20
   * 0xA2100000 - DSP1 Program Memory Page 0
21
   * 0xA2110000 - DSP1 Program Memory Page 1
22
   * ...
23
   * 0xA21F0000 - DSP1 Program Memory Page 15
24
  * '''0xA2200000''' - DSP1 Data Memory
25
   * 0xA2100000 - DSP1 Data Memory Page 0
26
   * 0xA2110000 - DSP1 Data Memory Page 1
27
   * ...
28
   * 0xA21F0000 - DSP1 Data Memory Page 15
29
  * '''0xA2310000''' - DSP1 DDMA Short Read/Write Register
30
31
== DSP Patch Unit registers (not documented in datasheet) ==
32
33
 DPUB - DSP Patch Unit Base address (0x820E0000)[[BR]]
34
 n - instruction number
35
36
 * DPUB + n*16 + 0x0 - page number
37
 * DPUB + n*16 + 0x4 - address
38
 * DPUB + n*16 + 0x8 - low 16 bits of instruction
39
 * DPUB + n*16 - 0xC - high 8 bits of instruction
40
 * DPUB + 0x100 - patch enable register
41
42
 It seems that DSP Patch Unit is able to patch only 4 instructions of DSP code memory.[[BR]]
43
 After writing 0xFF to DSP Patch Enable Register, value 0x33 appears (mask 0x3 enables master DSP, second mask 0x30 enables slave?).[[BR]]
44
 Below analysis shows that MTK firmware loads only 4 instructions over DSP Patch Unit and the rest of patch is loaded via MCU-DSP shared memory, which also proves above assumption.[[BR]]
45
 Hard to say if DSP Patch Unit is able to load patches to slave DSP, but probably not as there are MTK processors which have 2 DSP Patch Units. 
46
 
47
== Functions which work with DSP processors ==
48
49
 * '''idma_load()''' - called by Reload_DSP_Patch(), Application_Initialize()
50
51
This function uses following structure describing DSP patch:
52
{{{
53
  struct dsp_ptch {
54
    char     patch_version[20];
55
    uint16_t patch_enable[48];  /* offset 0x14 */
56
    uint16_t page_number[48];   /* offset 0x74 */
57
    uint16_t address[48];       /* offset 0xD4 */
58
    uint32_t code[48];          /* code loaded using DSP Patch Unit, offset 0x134 */
59
    uint32_t idma_code1[1024];  /* code loaded using IDMA to DSP1 Code Memory, offset 0x1F4 */
60
    uint32_t idma_code2[1024];  /* code loaded using IDMA to DSP2 Code Memory, offset 0x11F4 */
61
  }
62
}}}
63
64
  * reset DSP1
65
  * reset DSP2
66
  * write 0 to DSP Patch Unit Enable register (disable patches?)
67
  * write 16 values from DSP patch table to DSP Patch Unit (using page number and address fields)
68
  * calculate value (mask) using patch_enable field as follows:
69
70
{{{
71
mask = 0
72
for (i = 0; i < 32; ++i)
73
    mask |= dsp_ptch->patch_enable[i] << i;
74
}}}
75
76
  * nothing is written to DSP Patch Unit Enable register, only mask is calculated and then compared to some other value which triggers if code should be uploaded over IDMA or not
77
  * write 1024 instructions from idma_code[] table over IDMA under address 0xA200F000 (DSP1 Code Memory) - idma_load_cm()
78
  * write 1024 instructions form_idma_code2[] table over IDMA under address 0xA300F000 (DSP2 Code Memory) - idma_load_cm_d2()
Add picture from clipboard (Maximum size: 48.8 MB)