Research: GCC/TLMM Clock Enable on SDM636 from UEFI ABL
Date: 2026-03-28 · Status: Research complete; device verification still needed.
Context: ABL v2.1 hung when trying to read TLMM GPIO 105 (hall sensor) at flat address 0x03069004. This research determined why and confirmed the working address.
Executive Summary
There is no dedicated GCC_TLMM_AHB_CLK on SDM660/SDM636. The TLMM block sits on the CNOC (Config NOC) bus. However, the ABL hang was NOT a clock issue — it was an XPU (eXtended Protection Unit) access control block. The flat TLMM address range (0x03000000) is XPU-protected from ABL. The south tile address (0x03100000) is accessible.
Key Hardware Addresses
| Component | Physical Base | Notes |
|---|---|---|
| GCC (CLK_CTL_BASE) | 0x00100000 | 768 KB, clock controller |
| TLMM (flat — XPU-blocked) | 0x03000000 | 12 MB, blocked from ABL |
| TLMM south tile (works) | 0x03100000 | mainline kernel mapping for GPIO 105 |
| Hall sensor GPIO_IN_OUT | 0x03169004 | South tile base + 105×0x1000 + 0x04 |
Bus Topology
CPU → SNOC (System NOC) → CNOC (Config NOC) → TLMM north/south/center
→ BLSP, SDCC, USB, etc.TLMM is a slave on CNOC. GPIO 105 is in the south tile. No clock gating needed — CNOC clocks are active at ABL time. The XPU block at the flat address is a TrustZone policy decision, not a clock issue.
XBL Clock Init (for reference)
XBL’s Clock_DebugInit() enables: GCC_SNOC_CNOC_AHB_CBCR, GCC_CNOC_PERIPH_NORTH_AHB_CBCR, GCC_CNOC_PERIPH_SOUTH_AHB_CBCR. These remain active into ABL. No additional clock enables are needed for TLMM access — only the correct address range matters.
Conclusion
- Do NOT use raw address 0x03069004 — XPU-blocked → indefinite bus stall
- Use 0x03169004 (south tile) with GCD memory mapping before MmioRead32
- No clock enable needed — CNOC is already running at ABL time
- This is confirmed working in ABL v2.2+ (hall sensor reads GPIO 105 correctly)