Project

General

Profile

MT6235 DSP » History » Version 4

Anonymous, 02/19/2016 10:49 PM

1 4
2
h2. Introduction
3
4
MT6235 SoC features two DSP processors (master and slave).
5
6
Most probably these processors are ADSP-2181.
7
8 1
DSP code is executed from ROM but seems that there is possiblity to upload code over IDMA.
9
So far we're not able to read Code Memory using IDMA interface. Only uploading is possible.
10
Below is outcome from analyzing of original Sciphone G2 firmware which uses DSP processor.
11
12 4
13
h2. Base addresses of DSP related peripherals.
14
15 1
Connected via APB:
16 4
* *0x820A0000* - MCU - DSP1 (master) Shared Registers
17
* *0x820C0000* - MCU - DSP2 (slave) Shared Registers
18 1
Conected via AHB:
19 4
* *0xA0000000* - CPU - DSP1 (master) Share RAM
20
* *0xA1000000* - CPU - DSP2 (slave) Share RAM
21
* *0xA2000000* - CPU - DSP1 (master) IDMA port base address
22
** *0xA2000000* - DSP1 Code Memory
23
*** 0xA2000000 - DSP1 Code Memory Page 0
24
*** 0xA2010000 - DSP1 Code Memory Page 1
25
*** ...
26
*** 0xA20F0000 - DSP1 Code Memory Page 15
27
** *0xA2100000* - DSP1 Program Memory
28
*** 0xA2100000 - DSP1 Program Memory Page 0
29
*** 0xA2110000 - DSP1 Program Memory Page 1
30
*** ...
31
*** 0xA21F0000 - DSP1 Program Memory Page 15
32
** *0xA2200000* - DSP1 Data Memory
33
*** 0xA2100000 - DSP1 Data Memory Page 0
34
*** 0xA2110000 - DSP1 Data Memory Page 1
35
*** ...
36
*** 0xA21F0000 - DSP1 Data Memory Page 15
37
** *0xA2310000* - DSP1 DDMA Short Read/Write Register
38 1
39
40 4
h2. DSP Patch Unit registers (not documented in datasheet)
41
42
43
 DPUB - DSP Patch Unit Base address (0x820E0000)
44
45 1
 n - instruction number
46
47 4
* DPUB + n*16 + 0x0 - page number
48
* DPUB + n*16 + 0x4 - address
49
* DPUB + n*16 + 0x8 - low 16 bits of instruction
50
* DPUB + n*16 - 0xC - high 8 bits of instruction
51
* DPUB + 0x100 - patch enable register
52 1
53 4
 It seems that DSP Patch Unit is able to patch only 4 instructions of DSP code memory.
54
55
 After writing 0xFF to DSP Patch Enable Register, value 0x303 appears (mask 0x300 enables master DSP, second mask 0x3 enables slave?).
56
57
 Below analysis shows that MTK firmware loads only 4 instructions over DSP Patch Unit and the rest of patch is loaded via MCU-DSP shared memory, which also proves above assumption.
58
59 1
 Hard to say if DSP Patch Unit is able to load patches to slave DSP, but probably not as there are MTK processors which have 2 DSP Patch Units. 
60
 
61
62 4
h2. Functions which work with DSP processors
63 1
64 4
65
*idma_load()* - called by Reload_DSP_Patch(), Application_Initialize()
66
67 2
This function is called at very early startup of platform (from init() function).
68
69 1
This function uses following structure describing DSP patch:
70 4
<pre>
71 3
  struct dsp_ptch {
72 4
    char     patch_versionr20;
73
    uint16_t patch_enabler48;  /* offset 0x14 */
74
    uint16_t page_numberr48;   /* offset 0x74 */
75
    uint16_t addressr48;       /* offset 0xD4 */
76
    uint32_t coder48;          /* code loaded using DSP Patch Unit, offset 0x134 */
77
    uint32_t idma_code1r1024;  /* code loaded using IDMA to DSP1 Code Memory, offset 0x1F4 */
78
    uint32_t idma_code2r1024;  /* code loaded using IDMA to DSP2 Code Memory, offset 0x11F4 */
79 2
  }
80 4
</pre>
81 2
82 4
** reset DSP1
83
** reset DSP2
84
** write 0 to DSP Patch Unit Enable register (disable patches?)
85
** write 16 values from DSP patch table to DSP Patch Unit (using page number and address fields)
86
** calculate value (mask) using patch_enable field as follows (why 32 times if only 16 patches were loaded?):
87 1
88 4
<pre>
89 1
mask = 0
90
for (i = 0; i < 32; ++i)
91
    mask |= dsp_ptch->patch_enable[i] << i;
92 4
</pre>
93 1
94 4
** nothing is written to DSP Patch Unit Enable register, only mask is calculated and then compared to some other value which triggers if code should be uploaded over IDMA or not
95
** write 1024 instructions from idma_code[] table over IDMA under address 0xA200F000 (DSP1 Code Memory) - idma_load_cm()
96
** write 1024 instructions form_idma_code2[] table over IDMA under address 0xA300F000 (DSP2 Code Memory) - idma_load_cm_d2()
97 1
98 4
*L1D_DSP_Wakeup()* - called by L1D_Init(), L1D_Meta_Init()
99 1
100 4
** set DSP clock to 104MHz
101
** call L1D_DSP_WritePatchConfig(1)
102
*** write 4 first entries from dsp_ptch[] table to DSP Patch Unit
103
*** write 0x303 to DSP Patch Unit Enable register (enable these patches?). This value is calculated as follows:
104 1
105 4
<pre>
106
enable = dsp_ptch->patch_enabler0 << 8;
107
enable |= dsp_ptch->patch_enabler1 << 9;
108
enable |= dsp_ptch->patch_enabler2;
109
enable |= dsp_ptch->patch_enabler3 << 1;
110
</pre>
111 1
112 4
** set reset for DSP1
113
** power up IR (?)
114
** turn on DSP clock
115
** wait 64 Qbits
116
** write 0 to DSP1 shared RAM (0xA0000000)
117
** release reset for DSP1
Add picture from clipboard (Maximum size: 48.8 MB)