brom-dump: spft-replay: add mt6580 SoC support

brom-dump/spft-replay/README.md

@@ -12,6 +12,7 @@ Usually old Mediatek devices from the mt65xx family do not enforce digital signa
 ### Supported platforms:
 * mt6573
 * mt6577 / mt8317
+* mt6580
 * mt6589 / mt8389
 
 ### License

brom-dump/spft-replay/src/device.py

@@ -234,7 +234,8 @@ def write(self, data, size=1):
 
             off_start += pkt_sz
 
-    def write_reg(self, reg_size, addr, words, check_status=True):
+    # Some SoCs reply with 0x0000 as OK (mt6589), some reply with 0x0001 (mt6580)
+    def write_reg(self, reg_size, addr, words, expected_response=0, check_status=True):
         # support scalar
         if not isinstance(words, list):
             words = [words]
@@ -245,22 +246,21 @@ def write_reg(self, reg_size, addr, words, check_status=True):
         self.echo(addr, 4)
         self.echo(len(words), 4)
 
-        expected = 0
-        self.check(self.read(2), to_bytes(expected, 2))  # arg check
+        self.check(self.read(2), to_bytes(expected_response, 2))  # arg check
 
         for word in words:
             self.echo(word, reg_size // 8)
 
         if check_status:
-            self.check(self.read(2), to_bytes(expected, 2))  # status
+            self.check(self.read(2), to_bytes(expected_response, 2))  # status
 
-    def write16(self, addr, words, check_status=True):
+    def write16(self, addr, words, expected_response=0, check_status=True):
         logging.brom(f"write16({as_hex(addr)}, [{as_hex(words, 2)}])")
-        self.write_reg(16, addr, words, check_status)
+        self.write_reg(16, addr, words, expected_response, check_status)
 
-    def write32(self, addr, words, check_status=True):
+    def write32(self, addr, words, expected_response=0, check_status=True):
         logging.brom(f"write32({as_hex(addr)}, [{as_hex(words)}])")
-        self.write_reg(32, addr, words, check_status)
+        self.write_reg(32, addr, words, expected_response, check_status)
 
     def get_target_config(self):
         logging.brom("Get target config")

brom-dump/spft-replay/src/manager.py

@@ -4,7 +4,7 @@
 import logging
 
 from src.common import as_hex, from_bytes, target_config_to_string
-from src.platform import MT6573, MT6577, MT6589
+from src.platform import MT6573, MT6577, MT6580, MT6589
 
 
 class DeviceManager:
@@ -59,6 +59,8 @@ def replay(self, payload, simple_mode, skip_remaining_data):
                 raise Exception(
                     "Unsupported hardware " f"{', '.join(as_hex(x, 2) for x in ver)}"
                 )
+        elif hw_code == 0x6580:
+            self.platform = MT6580(self.dev)
         elif hw_code == 0x6583:  # The code is 0x6583 but the SoC is 6589
             self.platform = MT6589(self.dev)
         else:

brom-dump/spft-replay/src/platform.py

@@ -234,6 +234,58 @@ def recv_remaining_data(self):
         logging.replay(f"<- DA: (unknown) {as_hex(self.dev.read(1))}")  # 83
 
 
+class MT6580(AbstractPlatform):
+    def __init__(self, dev):
+        self.dev = dev
+
+    def identify_chip(self):
+        hw_dict = self.dev.get_hw_sw_ver()
+        logging.replay(f"HW subcode: {as_hex(hw_dict[0], 2)}")
+        logging.replay(f"HW version: {as_hex(hw_dict[1], 2)}")
+        logging.replay(f"SW version: {as_hex(hw_dict[2], 2)}")
+        # The 0x10009000~0x1000A000 region is allocated to EFUSE controller.
+        # It is barely documented even in datasheets but the specified offset
+        # should contain some sort of additional SoC revision codes.
+        val = self.dev.read32(0x10009040)
+        logging.replay(f"0x10009040: {as_hex(val)}")
+
+    def init_pmic(self):
+        pass
+
+    def disable_watchdog(self):
+        self.dev.write32(
+            0x10007000, 0x22000064, expected_response=0x0001
+        )  # TOPRGU_WDT_MODE
+
+    def init_rtc(self):
+        pass
+
+    def identify_software(self):
+        val = self.dev.get_preloader_version()
+        val = self.dev.get_me_id()
+        val = self.dev.get_me_id()  # repeated twice
+        logging.replay(f"ME ID: {as_hex(val)}")
+        val = self.dev.get_target_config()
+        val = self.dev.get_target_config()  # repeated twice
+        logging.replay(f"Target config: {as_hex(val)}")
+        val = self.dev.get_brom_version()
+        logging.replay(f"BROM version: {as_hex(val, 1)}")
+        val = self.dev.get_preloader_version()
+
+    def init_emi(self):
+        pass
+
+    def send_payload(self, payload):
+        val = self.dev.send_da(0x200000, len(payload), 0, payload)
+        logging.replay(f"Received DA checksum: {as_hex(val, 2)}")
+
+    def jump_to_payload(self):
+        self.dev.jump_da(0x200000)
+
+    def recv_remaining_data(self):
+        pass
+
+
 class MT6589(AbstractPlatform):
     def __init__(self, dev):
         super().__init__(dev)