class R_FCFG(Register32): UNK_MODE = 9, 8 MATCH_WRITE = 5 MATCH_READ = 4 USE_DART = 1 ENABLE = 0 class DAPFRegs(RegMap): FCFG = irange(0x00, 16, 0x40), R_FCFG STREAMS = irange(0x04, 16, 0x40), Register32 ADDR_BOT_LO = irange(0x08, 16, 0x40), Register32 ADDR_BOT_HI = irange(0x0c, 16, 0x40), Register32 ADDR_TOP_LO = irange(0x10, 16, 0x40), Register32 ADDR_TOP_HI = irange(0x14, 16, 0x40), Register32 Address ranges have 32-bit granularity. TOP is inclusive. All entries are searched in order until one matches range and flags. UNK_MODE needs to be 1..3 for AES to match (some kind of access type mask?) If DAPF does not hit and address is < 4 GiB, it goes to DART by default. Otherwise it faults. (Is this threshold configurable?) DAPF can optionally forward other ranges into DART (only the low 32 bits go through). DARTRegs.ENABLED_STREAMS only affects the DART (ranges enabled in DAPF will still work, unless they forward into DART). The DCP DAPF has: 0000000231310000 00000011 00000001 001e4000 00000008 007e4ffc 00000008 00000000 00000000 Stream 0: RO: Maps DCP firmware 1:1 with UNK_MODE=0 (?) (Note: DCP data is mapped via the DART) 0000000231310040 00000233 00000001 00000000 0000000f fffffffc 0000000f 00000000 00000000 Stream 0: RW: 0xf00000000 -> RW DART with UNK_MODE=2 (this is the normal RTKit DVA range) 0000000231310080 00000031 00000001 3b700000 00000002 3b7ffffc 00000002 00000000 00000000 00000002313100c0 00000031 00000001 3c100000 00000002 3c100c4c 00000002 00000000 00000000 0000000231310100 00000031 00000001 3fe00000 00000002 3feffffc 00000002 00000000 00000000 0000000231310140 00000031 00000001 3e40c000 00000002 3e40fffc 00000002 00000000 00000000 0000000231310180 00000031 00000001 3e430000 00000002 3e433ffc 00000002 00000000 00000000 00000002313101c0 00000031 00000001 3b008000 00000002 3b00bffc 00000002 00000000 00000000 0000000231310200 00000031 00000001 3b040000 00000002 3b0407fc 00000002 00000000 00000000 0000000231310240 00000031 00000001 3b040800 00000002 3b043ffc 00000002 00000000 00000000 Stream 0: RW: A bunch of MMIO stuff (UNK_MODE=0) 0000000231310280 00000231 00001000 00000000 00000000 fffffffc 000000ff 00000000 00000000 Backdoor! Stream 12: RW full access. What is this about? 00000002313102c0 00000031 00000001 3d0d8000 00000002 3d0db0b8 00000002 00000000 00000000 0000000231310300 00000031 00000001 3d1f0000 00000002 3d1f0c48 00000002 00000000 00000000 Stream 0: RW: More MMIO (UNK_MODE=0)