shofel

2026-03-15 20:32:39 +02:00
parent d1ad48155e
commit 2f07910512
32 changed files with 3565 additions and 0 deletions
--- a/Shofel/include/emmc.h
+++ b/Shofel/include/emmc.h
@@ -0,0 +1,102 @@
+#ifndef _EMMC_H_
+#define _EMMC_H_
+
+/* SDMMC4 base address (eMMC) on Tegra T124 - at 0x700B0600, NOT 0x78000600 */
+#define SDMMC4_BASE         0x700B0600
+#define SDMMC4_VENDOR_CLK   0x700B0700
+#define SDMMC4_VENDOR_MISC  0x700B07C0
+#define SDMMC4_REG_SIZE     0x200
+
+/* SDHCI register offsets (from SDMMC4_BASE) */
+#define SDHCI_BLOCK_SIZE        0x04
+#define SDHCI_ARGUMENT          0x08
+#define SDHCI_TRANSFER_MODE     0x0C
+#define SDHCI_RESPONSE          0x10
+#define SDHCI_BUFFER            0x20
+#define SDHCI_PRESENT_STATE     0x24
+#define SDHCI_HOST_CONTROL      0x28
+#define SDHCI_POWER_CONTROL     0x29
+#define SDHCI_CLOCK_CONTROL     0x2C
+#define SDHCI_SOFTWARE_RESET    0x2F
+#define SDHCI_INT_STATUS        0x30
+#define SDHCI_INT_ENABLE        0x34
+#define SDHCI_CAPABILITIES      0x40
+#define SDHCI_HOST_VERSION      0xFE
+
+/* Vendor register offsets (from SDMMC4_BASE) */
+#define SDMMC_VENDOR_CLK_CTRL   0x100   /* 0x700B0700 - Vendor Clock Control */
+#define SDMMC_VENDOR_MISC_CTRL  0x120   /* 0x700B0720 - Vendor Misc Control */
+
+/* VENDOR_CLK_CTRL bits */
+#define SDMMC_CLK_CTRL_PADPIPE      0x08    /* PADPIPE_CLKEN_OVERRIDE */
+#define SDMMC_CLK_CTRL_SPI_MODE     0x04    /* SPI_MODE_CLKEN_OVERRIDE */
+
+/* VENDOR_MISC_CTRL bits */
+#define SDMMC_MISC_CTRL_SPEC_300    0x20    /* Enable SDHCI Spec 3.0 mode */
+
+/* Auto-calibration registers (from SDMMC4_BASE) */
+#define SDMMC_SDMEMCOMP_PADCTRL 0x1E0   /* 0x700B07E0 - SDMEM comp pad control */
+#define SDMMC_AUTO_CAL_CONFIG   0x1E4   /* 0x700B07E4 - Auto-cal configuration */
+#define SDMMC_AUTO_CAL_STATUS   0x1EC   /* 0x700B07EC - Auto-cal status */
+
+/* SDMEM_COMP_PADCTRL bits */
+#define SDMMC_COMP_PADCTRL_E_INPUT  (1u << 31)  /* Force E_INPUT for calibration */
+
+/* AUTO_CAL_CONFIG bits */
+#define SDMMC_AUTO_CAL_START    (1u << 31)  /* Start auto-calibration */
+#define SDMMC_AUTO_CAL_ENABLE   (1u << 29)  /* Enable auto-calibration */
+
+/* AUTO_CAL_STATUS bits */
+#define SDMMC_AUTO_CAL_ACTIVE   (1u << 31)  /* Auto-calibration in progress */
+
+/* Software Reset bits */
+#define SDHCI_RESET_ALL         0x01
+#define SDHCI_RESET_CMD         0x02
+#define SDHCI_RESET_DAT         0x04
+
+/* PRESENT_STATE bits */
+#define SDHCI_CMD_INHIBIT       0x00000001
+#define SDHCI_DAT_INHIBIT       0x00000002
+#define SDHCI_CARD_INSERTED     0x00010000
+
+/* INT_STATUS bits */
+#define SDHCI_INT_CMD_COMPLETE  0x0001
+#define SDHCI_INT_XFER_COMPLETE 0x0002
+#define SDHCI_INT_BUF_WR_READY  0x0010
+#define SDHCI_INT_BUF_RD_READY  0x0020
+#define SDHCI_INT_ERROR         0x8000
+
+/*
+ * MMC Command register values (16-bit, placed in upper half of 0x0C write).
+ * Format: (cmd_index << 8) | (type << 6) | (data_present << 5) |
+ *         (idx_check << 4) | (crc_check << 3) | response_type
+ * Response types: 0x00=none, 0x01=136-bit(R2), 0x02=48-bit(R1), 0x03=48-bit+busy(R1b)
+ */
+#define MMC_CMD17_READ      0x113A  /* READ_SINGLE_BLOCK: R1, data, CRC+index check */
+#define MMC_CMD24_WRITE     0x183A  /* WRITE_BLOCK: R1, data, CRC+index check */
+#define MMC_CMD13_STATUS    0x0D1A  /* SEND_STATUS: R1, no data, CRC+index check */
+
+/* Transfer Mode values (16-bit, lower half of 0x0C write) */
+#define XFER_MODE_READ      0x0010  /* Data direction = read, single block, PIO */
+#define XFER_MODE_WRITE     0x0000  /* Data direction = write, single block, PIO */
+
+/* Additional transfer mode bits */
+#define XFER_MODE_BLOCK_COUNT_ENABLE 0x0002  /* enable block count register */
+#define XFER_MODE_AUTO_CMD12         0x0004  /* autostop after multiblock transfer */
+#define XFER_MODE_MULTI_BLOCK        0x0020  /* the actuall multiblock transfer */
+
+#define XFER_MODE_READ_MULTI  (XFER_MODE_READ  | XFER_MODE_BLOCK_COUNT_ENABLE | XFER_MODE_AUTO_CMD12 | XFER_MODE_MULTI_BLOCK)
+#define XFER_MODE_WRITE_MULTI (XFER_MODE_WRITE | XFER_MODE_BLOCK_COUNT_ENABLE | XFER_MODE_AUTO_CMD12 | XFER_MODE_MULTI_BLOCK)
+
+/* CAR (Clock and Reset Controller) registers for SDMMC4 */
+#define CAR_BASE            0x60006000 
+#define CAR_CLK_ENB_L_SET   0x320
+#define CAR_RST_DEV_L_CLR   0x304
+#define CAR_RST_DEV_L_SET   0x300
+#define CAR_SDMMC4_BIT      (1 << 15)
+
+/* PMC I/O deep power down (PMC_BASE defined in t124.h) */
+#define PMC_IO_DPD2_REQ     0xC0
+#define PMC_IO_DPD2_STATUS  0xC4
+
+#endif
--- a/Shofel/include/emmc_server.h
+++ b/Shofel/include/emmc_server.h
@@ -0,0 +1,36 @@
+#ifndef _EMMC_SERVER_H_
+#define _EMMC_SERVER_H_
+
+#if __arm__
+    typedef u32 uint32_t;
+#else
+    #include <stdint.h>
+#endif
+
+/* eMMC server protocol commands */
+#define EMMC_CMD_READ           0x01
+#define EMMC_CMD_WRITE          0x02
+#define EMMC_CMD_STATUS         0x03
+#define EMMC_CMD_READ_EXT_CSD   0x04  /* Read 512-byte EXT_CSD register for chip health */
+#define EMMC_CMD_ERASE          0x05  /* Erase a range of sectors (forces reallocation) */
+#define EMMC_CMD_EXIT           0xFF
+
+/* Transfer chunk sizes basically the amount much data is sent/received per USB transfer was not multiple of 0x1000
+ *
+ * Reads: 8 sectors (4KB) = 1.1 MB/s - OPTIMIZED
+ * Writes: 1 sector (512B) - ORIGINAL (safe)
+ */
+#define EMMC_CHUNK_SECTORS_READ    8
+#define EMMC_CHUNK_SECTORS_WRITE   1
+#define EMMC_CHUNK_SECTORS         1   /* Default - single sector for compatibility */
+#define EMMC_SECTOR_SIZE           512
+#define EMMC_CHUNK_BYTES           (EMMC_CHUNK_SECTORS * EMMC_SECTOR_SIZE)
+
+/* Command structure sent from PC to payload */
+struct emmc_cmd_s {
+    uint32_t op;
+    uint32_t start_sector;
+    uint32_t num_sectors;
+};
+
+#endif
--- a/Shofel/include/endianness.h
+++ b/Shofel/include/endianness.h
@@ -0,0 +1,17 @@
+#ifndef _ENDIANNESS_H_
+#define _ENDIANNESS_H_
+
+#ifdef __BYTE_ORDER
+    #if __BYTE_ORDER == __BIG_ENDIAN
+
+        #include <byteswap.h>
+        #define TO_LITTLE_ENDIAN(x) bswap_32(x)
+
+    #elif __BYTE_ORDER == __LITTLE_ENDIAN
+
+        #define TO_LITTLE_ENDIAN(x) x
+
+    #endif
+#endif
+
+#endif
--- a/Shofel/include/fuse.h
+++ b/Shofel/include/fuse.h
@@ -0,0 +1,127 @@
+#ifndef _FUSE_H_
+#define _FUSE_H_
+
+#include <stdio.h>
+#include <stdint.h>
+
+// Based on https://github.com/moriczgergo/moonflower/blob/933ab9ef66b76aa49ad2c29ca88d78173a81eff2/src/fuse.h
+
+typedef struct {
+    uint32_t FUSE_PRODUCTION_MODE; //0x000
+    uint32_t FUSE_JTAG_SECUREID_VALID; //0x004
+    uint32_t FUSE_ODM_LOCK; //0x008
+    uint32_t FUSE_OPT_OPENGL_EN; //0x00c
+    uint32_t FUSE_SKU_INFO; //0x010
+    uint32_t FUSE_CPU_SPEEDO_0_CALIB; //0x014
+    uint32_t FUSE_CPU_IDDQ_CALIB; //0x018
+    uint32_t RESERVED_0x01C;
+    uint32_t RESERVED_0x020;
+    uint32_t RESERVED_0x024;
+    uint32_t FUSE_OPT_FT_REV; //0x028
+    uint32_t FUSE_CPU_SPEEDO_1_CALIB; //0x02c
+    uint32_t FUSE_CPU_SPEEDO_2_CALIB; //0x030
+    uint32_t FUSE_SOC_SPEEDO_0_CALIB; //0x034
+    uint32_t FUSE_SOC_SPEEDO_1_CALIB; //0x038
+    uint32_t FUSE_SOC_SPEEDO_2_CALIB; //0x03c
+    uint32_t FUSE_SOC_IDDQ_CALIB; //0x040
+    uint32_t RESERVED_0x044;
+    uint32_t FUSE_FA; //0x048
+    uint32_t FUSE_RESERVED_PRODUCTION; //0x04c
+    uint32_t FUSE_HDMI_LANE0_CALIB; //0x050
+    uint32_t FUSE_HDMI_LANE1_CALIB; //0x054
+    uint32_t FUSE_HDMI_LANE2_CALIB; //0x058
+    uint32_t FUSE_HDMI_LANE3_CALIB; //0x05c
+    uint32_t FUSE_ENCRYPTION_RATE; //0x060
+    uint32_t FUSE_PUBLIC_KEY[0x8]; //0x064 - 0x080
+    uint32_t FUSE_TSENSOR1_CALIB; //0x084
+    uint32_t FUSE_TSENSOR2_CALIB; //0x088
+    uint32_t RESERVED_0x08C;
+    uint32_t FUSE_OPT_CP_REV; //0x090
+    uint32_t FUSE_OPT_PFG; //0x094
+    uint32_t FUSE_TSENSOR0_CALIB; //0x098
+    uint32_t FUSE_BOOTROM_PATCH_SIZE; //0x09c
+    uint32_t FUSE_SECURITY_MODE; //0x0a0
+    uint32_t FUSE_PRIVATE_KEY[0x4]; //0x0a4 - 0x0b0
+    uint32_t FUSE_DEVICE_KEY; //0x0b4
+    uint32_t FUSE_ARM_DEBUG_DIS; //0x0b8
+    uint32_t FUSE_BOOT_DEVICE_INFO; //0x0bc
+    uint32_t FUSE_RESERVED_SW; //0x0c0
+    uint32_t FUSE_VP8_ENABLE; //0x0c4
+    uint32_t FUSE_RESERVED_ODM[0x8]; //0x0c8-0x0e4
+    uint32_t FUSE_OBS_DIS; //0x0e8
+    uint32_t RESERVED_0x0EC;
+    uint32_t FUSE_USB_CALIB; //0x0f0
+    uint32_t FUSE_SKU_DIRECT_CONFIG; //0x0f4
+    uint32_t FUSE_KFUSE_PRIVKEY_CTRL; //0x0f8
+    uint32_t FUSE_PACKAGE_INFO; //0x0fc
+    uint32_t FUSE_OPT_VENDOR_CODE; //0x100
+    uint32_t FUSE_OPT_FAB_CODE; //0x104
+    uint32_t FUSE_OPT_LOT_CODE_0; //0x108
+    uint32_t FUSE_OPT_LOT_CODE_1; //0x10c
+    uint32_t FUSE_OPT_WAFER_ID; //0x110
+    uint32_t FUSE_OPT_X_COORDINATE; //0x114
+    uint32_t FUSE_OPT_Y_COORDINATE; //0x118
+    uint32_t FUSE_OPT_SEC_DEBUG_EN; //0x11c
+    uint32_t FUSE_OPT_OPS_RESERVED; //0x120
+    uint32_t FUSE_SATA_CALIB; //0x124
+    uint32_t FUSE_GPU_IDDQ_CALIB; //0x128
+    uint32_t FUSE_TSENSOR3_CALIB; //0x12c
+    uint32_t FUSE_SKU_BOND_OUT_L; //0x130
+    uint32_t FUSE_SKU_BOND_OUT_H; //0x134
+    uint32_t FUSE_SKU_BOND_OUT_U; //0x138
+    uint32_t FUSE_SKU_BOND_OUT_V; //0x13c
+    uint32_t FUSE_SKU_BOND_OUT_W; //0x140
+    uint32_t RESERVED_0x144;
+    uint32_t FUSE_OPT_SUBREVISION; //0x148
+    uint32_t FUSE_OPT_SW_RESERVED_0; //0x14c
+    uint32_t FUSE_OPT_SW_RESERVED_1; //0x150
+    uint32_t FUSE_TSENSOR4_CALIB; //0x154
+    uint32_t FUSE_TSENSOR5_CALIB; //0x158
+    uint32_t FUSE_TSENSOR6_CALIB; //0x15c
+    uint32_t FUSE_TSENSOR7_CALIB; //0x160
+    uint32_t FUSE_OPT_PRIV_SEC_EN; //0x164
+    uint32_t FUSE_PKC_DISABLE; //0x168
+    uint32_t RESERVED_0x16C;
+    uint32_t RESERVED_0x170;
+    uint32_t RESERVED_0x174;
+    uint32_t RESERVED_0x178;
+    uint32_t FUSE_FUSE2TSEC_DEBUG_DISABLE; //0x17c
+    uint32_t FUSE_TSENSOR8_CALIB; //0x180 // <--WTF
+    uint32_t FUSE_OPT_CP_BIN; //0x184
+    uint32_t FUSE_OPT_GPU_FS; //0x188
+    uint32_t FUSE_OPT_FT_BIN; //0x18c
+    uint32_t RESERVED_0x190;
+    uint32_t FUSE_SKU_BOND_OUT_X; //0x194
+    uint32_t FUSE_APB2JTAG_DISABLE; //0x198
+    uint32_t RESERVED_0x19C;
+    uint32_t FUSE_PHY_FLOORSWEEP; //0x1a0
+    uint32_t FUSE_PHY_FLOOR_ENABLE; //0x1a4
+    uint32_t FUSE_ARM_CRYPT_DE_FEATURE; //0x1a8
+    uint32_t FUSE_DENVER_MTS_DE_FEATURE; //0x1ac
+    uint32_t FUSE_DIE_VERSION_OVERRIDE; //0x1b0
+    uint32_t FUSE_TRIMMERS; //0x1b4
+    uint32_t FUSE_DENVER_BOOT_SEC; //0x1b8
+    uint32_t FUSE_DENVER_DFD_ACCESS; //0x1bc
+    uint32_t FUSE_WOA_SKU_FLAG; //0x1c0
+    uint32_t FUSE_ECO_RESERVE_1; //0x1c4
+    uint32_t FUSE_GCPLEX_CONFIG_FUSE; //0x1c8
+    uint32_t RESERVED_0x1CC;
+    uint32_t RESERVED_0x1D0;
+    uint32_t RESERVED_0x1D4;
+    uint32_t RESERVED_0x1D8;
+    uint32_t RESERVED_0x1DC;
+    uint32_t RESERVED_0x1E0;
+    uint32_t RESERVED_0x1E4;
+    uint32_t RESERVED_0x1E8;
+    uint32_t RESERVED_0x1EC;
+    uint32_t RESERVED_0x1F0;
+    uint32_t RESERVED_0x1F4;
+    uint32_t RESERVED_0x1F8;
+    uint32_t FUSE_SPARE_REALIGNMENT_REG; //0x1fc
+    uint32_t FUSE_SPARE_BITS[0X40]; //0x200 - 0X2fc
+} fuse_chip_registers_t;
+
+void print_fuses( fuse_chip_registers_t *fuse_chip_registers );
+
+#endif
+
--- a/Shofel/include/mem_dumper_usb_server.h
+++ b/Shofel/include/mem_dumper_usb_server.h
@@ -0,0 +1,16 @@
+#ifndef _MEM_DUMP_USB_SERVER_H_
+#define _MEM_DUMP_USB_SERVER_H_
+
+#if __arm__    
+    typedef u32 uint32_t;
+#else
+    #include <stdint.h>
+#endif
+
+    struct mem_dumper_args_s {
+        uint32_t start;
+        uint32_t len;
+    };
+
+#endif
+
--- a/Shofel/include/mini_libusb.h
+++ b/Shofel/include/mini_libusb.h
@@ -0,0 +1,37 @@
+#ifndef _MINI_LIBUSB_H_
+#define _MINI_LIBUSB_H_
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <fcntl.h>
+#include <unistd.h>
+#include <dirent.h>
+
+#include <errno.h>
+#include <ctype.h>
+
+#include <sys/ioctl.h>
+#include <linux/usbdevice_fs.h>
+
+#define USB_CTRL_DEVICE_ENDPOINT_TO_HOST 0x82
+#define USB_CTRL_GET_STATUS 0x00
+
+#define USB_BULK_TIMEOUT 500
+
+#if DEBUG
+    #define DEBUG_MSG(fmt, ...) do { fprintf( stderr, "%s:%d:%s(): " fmt, \
+                                __FILE__, __LINE__, __func__, ##__VA_ARGS__ ); } while(0)
+#else
+    #define DEBUG_MSG(fmt, ...) 
+#endif
+
+int usb_open_by_vid_pid( uint16_t vid, uint16_t pid, uint8_t wait );
+int usb_close( int usb );
+int usb_send_bulk_txn( int usb, uint32_t ep, uint32_t len, void *data );
+int usb_send_control_txn( int usb, uint8_t bRequestType, uint8_t bRequest, uint16_t wValue, uint16_t wIndex, uint16_t len, uint8_t *data, int32_t timeout );
+
+#endif
+
--- a/Shofel/include/rcm.h
+++ b/Shofel/include/rcm.h
@@ -0,0 +1,17 @@
+#ifndef _RCM_H_
+#define _RCM_H_
+
+#include <sys/stat.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <fcntl.h>
+#include <unistd.h>
+
+#include "t124.h"
+#include "mini_libusb.h"
+#include "endianness.h"
+
+int send_rcm_cmd( int rcm_usb, char* payload_filename, uint32_t payload_thumb_mode );
+
+#endif
--- a/Shofel/include/t124.h
+++ b/Shofel/include/t124.h
@@ -0,0 +1,102 @@
+#ifndef _T124_RCM_H_
+#define _T124_RCM_H_
+
+#define JETSON_TK1_VID 0x0955
+#define JETSON_TK1_PID 0x7140
+
+#define SHIELD_TK1_VID 0x0955
+#define SHIELD_TK1_PID 0x7f40
+
+#define JIBO_TK1_VID 0x0955
+#define JIBO_TK1_PID 0x7740
+
+#define IROM_BEGIN              0x00100000
+#define IROM_END                0x0010FFFF
+#define IROM_LEN                0x00010000
+
+#define IRAM_BEGIN              0x40000000
+#define IRAM_END                0x4003FFFF
+#define IRAM_LEN                0x00040000
+
+#define BOOTROM_DO_BCT_BOOT         0x00100624
+#define BOOTROM_EP1_IN_WRITE_IMM    0x001065C0
+#define BOOTROM_EP1_OUT_READ_IMM    0x00106612
+#define BOOTROM_USB_BUF_1           0x40004000
+#define BOOTROM_USB_BUF_2           0x40008000
+#define BOOTROM_PAYLOAD_ENTRY       0x4000E000
+#define BOOTROM_SMASH_TARGET        0x4000DCD8
+#define BOOTROM_STACK_GAP_LEN           0x30C
+#define BOOTROM_SMASH_LEN           (BOOTROM_SMASH_TARGET - BOOTROM_USB_BUF_2) // 0x5CD8
+
+#define VARS_LEN 0x10
+
+#define INTERMEZZO_LEN 0x100
+#define INTERMEZZO_REL_ADD ( BOOTROM_PAYLOAD_ENTRY - INTERMEZZO_LEN ) // 0x4000DF00
+
+#define OFFSET_INTERMEZZO_START     0x0
+#define OFFSET_PAYLOAD_START        ( INTERMEZZO_LEN )
+#define OFFSET_MEMCPY_RET_ADD       ( BOOTROM_SMASH_LEN - BOOTROM_STACK_GAP_LEN - 0x4 ) // 0x59C8 ( 0x30C Bytes copied from the stack before entry )
+#define OFFSET_PAYLOAD_BEF_LENVAR   ( OFFSET_MEMCPY_RET_ADD - 0x4 )
+#define OFFSET_PAYLOAD_AFT_LENVAR   ( OFFSET_MEMCPY_RET_ADD - 0x8 )
+#define OFFSET_PAYLOAD_THUMB_MODE   ( OFFSET_MEMCPY_RET_ADD - 0xC )
+#define OFFSET_PAYLOAD_CONT         ( OFFSET_MEMCPY_RET_ADD + 0x4 )
+
+
+#define IRAM_ADD_INTERMEZZO_START    ( BOOTROM_PAYLOAD_ENTRY + OFFSET_INTERMEZZO_START )
+#define IRAM_ADD_PAYLOAD_START       ( BOOTROM_PAYLOAD_ENTRY + OFFSET_PAYLOAD_START )
+#define IRAM_ADD_PAYLOAD_BEF_LENVAR  ( BOOTROM_PAYLOAD_ENTRY + OFFSET_PAYLOAD_BEF_LENVAR )
+#define IRAM_ADD_PAYLOAD_AFT_LENVAR  ( BOOTROM_PAYLOAD_ENTRY + OFFSET_PAYLOAD_AFT_LENVAR )
+#define IRAM_ADD_PAYLOAD_THUMB_MODE  ( BOOTROM_PAYLOAD_ENTRY + OFFSET_PAYLOAD_THUMB_MODE )
+#define IRAM_ADD_PAYLOAD_CONT        ( BOOTROM_PAYLOAD_ENTRY + OFFSET_PAYLOAD_CONT )
+
+
+#define RCM_EP1_IN      0x81
+#define RCM_EP1_OUT     0x01
+#define RCM_CHIP_ID_LEN 0x10
+
+#define RCM_CMD_LEN 0x32274
+#define RCM_CMD_MAX_USEFUL_LEN 0x31000 // Ensures Header + Payload + Padding doesn't complete RCM CMD and buffer 2 is used for getstatus.
+#define RCM_CMD_HEADER_LEN 0x284
+
+#define RCM_CMD_BUF_INTERMEZZO_START     ( RCM_CMD_HEADER_LEN + OFFSET_INTERMEZZO_START )
+#define RCM_CMD_BUF_PAYLOAD_START        ( RCM_CMD_HEADER_LEN + OFFSET_PAYLOAD_START )
+#define RCM_CMD_BUF_MEMCPY_RET_ADD       ( RCM_CMD_HEADER_LEN + OFFSET_MEMCPY_RET_ADD )
+#define RCM_CMD_BUF_PAYLOAD_BEF_LENVAR   ( RCM_CMD_HEADER_LEN + OFFSET_PAYLOAD_BEF_LENVAR )
+#define RCM_CMD_BUF_PAYLOAD_AFT_LENVAR   ( RCM_CMD_HEADER_LEN + OFFSET_PAYLOAD_AFT_LENVAR )
+#define RCM_CMD_BUF_PAYLOAD_THUMB_MODE   ( RCM_CMD_HEADER_LEN + OFFSET_PAYLOAD_THUMB_MODE )
+#define RCM_CMD_BUF_PAYLOAD_CONT         ( RCM_CMD_HEADER_LEN + OFFSET_PAYLOAD_CONT )
+
+
+#define MAX_PAYLOAD_BEF_SIZE        ( OFFSET_PAYLOAD_THUMB_MODE - OFFSET_PAYLOAD_START ) // 22716 Bytes
+#define MAX_PAYLOAD_AFT_SIZE        ( RCM_CMD_MAX_USEFUL_LEN - RCM_CMD_BUF_PAYLOAD_CONT ) // 177072 Bytes
+#define MAX_PAYLOAD_FILE_SIZE       ( MAX_PAYLOAD_BEF_SIZE + MAX_PAYLOAD_AFT_SIZE ) // 199788 Bytes
+
+
+#define SECURE_BOOT_BASE	0x6000C200
+#define SB_CSR_0            0x0
+#define SB_PIROM_START_0    0x4
+#define SB_PFCFG_0		    0x8
+#define JTAG_ON		        0x00000080
+
+#define APB_BASE	0x70000000
+#define APB_MISC_PP_CONFIG_CTL_0	0x24
+#define APB_MISC_PP_CONFIG_CTL_0_JTAG				0x40
+#define APB_MISC_PP_CONFIG_CTL_0_TBE 				0x80
+
+#define FLOW_CTLR_BASE  0x60007000
+#define FLOW_CTLR_HALT_COP_EVENTS_0  0x4
+#define FLOW_CTLR_HALT_COP_FLOW_MODE_WAITEVENT (1 << 30)
+#define FLOW_CTLR_HALT_COP_JTAG           (1 << 28)
+
+#define PMC_BASE               0x7000e400
+#define PMC_CNTRL              0x000
+#define PMC_CNTRL_MAIN_RST    (1 << 4)
+#define PMC_SCRATCH0           0x050
+#define PMC_SCRATCH0_MODE_RCM (1 << 1)
+
+#define FUSE_BASE   0x7000F900
+#define FUSE_LEN   0x300
+
+
+#endif
+
--- a/Shofel/include/types.h
+++ b/Shofel/include/types.h
@@ -0,0 +1,19 @@
+#ifndef _TYPES_H_
+#define _TYPES_H_
+
+typedef signed char s8;
+typedef signed short s16;
+typedef signed int s32;
+typedef signed long long s64;
+typedef unsigned char u8;
+typedef unsigned short u16;
+typedef unsigned int u32;
+typedef unsigned long long u64;
+typedef volatile u8 vu8;
+typedef volatile u16 vu16;
+typedef volatile u32 vu32;
+typedef volatile u64 vu64;
+typedef u32 size_t;
+typedef u32 uintptr_t;
+
+#endif