Skip to content
Tech News
← Back to articles

Fun with CSF firmware (RK3588 GPU firmware)

read original get RK3588 GPU Firmware Update → more articles
Why This Matters

This article highlights the importance of firmware in enabling GPU functionality on the RK3588 platform, specifically focusing on the role of Mali CSF firmware and its microcontroller. Understanding this firmware's operation is crucial for developers and security researchers, as it impacts GPU performance, stability, and potential attack vectors in embedded systems and consumer devices.

Key Takeaways

Published: Mon 12 September 2022 In RE.

Those of us who have been trying to make use of the "v10" Mali GPUs from Arm, such as the Mali-G610 in Rockchip's RK3588 will surely have noticed by now the requirement of firmware—kbase requires mali_csffw.bin to be present in one of the firmware directories (such as /lib/firmware ) for the GPU to be usable.

Part 1: What is this firmware and how does it work?

The firmware runs on a microcontroller inside the GPU and handles many tasks required to work the GPU that were previously handled inside the kernel. The MCU ("Microcontroller unit") is, as Alyssa Rosenzweig correctly guessed, a Cortex-M7 (r1p2, with no FPU, ECC cache, nor TCM), which I have found runs off the GPU clock, allowing for an impressive 990 MHz on RK3588. (That speed was measured on my board; maximum clock speeds on the RK3588 vary a bit from chip to chip.)

While the MCU is 32-bit, the GPU supports sixteen eight 48-bit virtual address spaces. So how can it access all of this memory? Arm decided on the obvious method here: simply let the MCU control its own page tables!

Calm down, it isn't quite that bad.

Memory mappings

To access memory, there are three layers that must be navigated:

The MCU's integrated MPU (memory protection unit)

The MCU memory mappings

... continue reading