(Who knows, might need them)
start_addr + size
, e.g. 0x2000_0000 + 256MiB
[end:start]
, both inclusive.type[addr]
, e.g. uint32_t[0x1185_81a0]
Generally in this order:
0x18400000
, no source code)0x00_0000
to intRAM0 0x1800_0000
)0x01_0000
to intRAM1 0x1808_0000
)0x04_0000
to DDR 0x8000_0000
)There are various 'secret' register definitions in the vendor source code. I've collected some of them in this gist.
You can just dump the code and put it into Ghidra or something.
Based on ddrinit, or at least very similar. Unused code in ddrinit can be found in the Boot ROM.
On the VisionFive board.
SCFG_boot_mode = 0
PAD_GPIO[61:60] = 0
(Set with resistors)PAD_GPIO[62] = 'BOOT MODE' button
(Held is 1
)PAD_GPIO[63] = 1
(Set with resistors)Boot always goes to ROM, which is 0x1184_0000 + 32KiB
wfi
(Expecting MSI from CLINT)uint32_t[0x1801_fffc]
gpio_init()
(Commented out code in ddrinit)uart_init(3)
(9600 baud at 'DEBUG' port)boot_from_uart()
boot_from_spi(1)
, loads secondBootio_padshare_sel = 6
The controller is an OpenEdges OMC (ORBIT Memory Controller). The following information is copied from the website.
Booting and create a combined FIT uImage:
https://www.thegoodpenguin.co.uk/blog/u-boot-fit-image-overview/
# load files from FAT fs from SD card to memory
fatload mmc 0 80200000 Image
fatload mmc 0 82200000 jh7100-starfive-visionfive-v1.dtb
# set a kernel cmdline, aka bootargs in U-Boot
setenv bootargs "console=ttyS0,115200 earlycon=sbi"
# boot a raw Image; note: the "-" means that we have no initrd
booti 80200000 - 82200000
fatload mmc 0 80200000 mImage
setenv bootargs "console=ttyS0,115200 earlycon=sbi"
bootm 80200000
We can use centre
from Harvey OS to serve TFTP and DHCP.
setenv serverip 192.168.22.1
setenv bootargs "console=ttyS0,115200 earlycon=sbi"
dhcp;tftpboot 80200000 mImage;bootm 80200000
A bunch of very interesting stuff in the device tree files:
qspi_refclk
, qspi_ahb
, qspi_apb
qspi_core
, qspi_ahb
, qspi_apb
cdns,qspi-nor
0x2000_0000 + 256MiB
(memory mapped area)0x1186_0000 + 64KiB
(control registers)The flash chip on-board supports QSPI but actually only single-wire SPI is ever used. Resets to reading with EBh
command so AHB doesn't work at power-on.
uint32_t[0x11800000] = 0x01000000
(secondBoot, early)
_SWITCH_CLOCK_clk_cpundbus_root_SOURCE_clk_pll0_out_
uint32_t[0x11800010] = 0x01000000
(secondBoot, early)
_SWITCH_CLOCK_clk_perh0_root_SOURCE_clk_pll0_out_
uint32_t[0x11860004] = 0x00000003
(secondBoot, when reading flash)The JH7100 has a kinda confusing GPIO multiplexer, though it's not that bad if you're just a user and never go that low level…
GPIO13
/GPIO14
on the 40-pin header and the 'DEBUG' header are both UART3 because of the GPIO mux thing.
The IO pad is used to configure on which GPIO pins the peripherals appear. secondBoot moves the UART to be seen on the 40 pin header instead of the extra debug header. The further vendor firmware components (DDR init, U-Boot, OpenSBI) assume that the UART is running on 115200 baud, whereas the initial mask ROM sets it to 9600 for xmodem transfer.
The UART movment happens here in secondBoot
, _SET_SYSCON_REG_register104_SCFG_io_padshare_sel(6);
:
We can retain this switch so that we can use the boot mode / xmodem transfer to start running from SRAM for development, but still use the full baud rate on the other header. I.e., we need to hook up two USB serial adapters.
https://github.com/starfive-tech/linux/blob/visionfive/drivers/clk/starfive/clk-starfive-jh7100.c
e24_apb
, e24rtc
e24
(mtime
ticks according to the e24rtc
)
uint32_t[0x1185_00bc]
(register47_e24_reset_vector
).0x8000_0000 + 2GiB
is the same as U74 0x1000_0000 + 2GiB
.
0x8000_0000 + 256MiB
)Info on the Core-Local Interrupt Controller:
The 'local interrupt' lines:
n
is U74 PLIC interrupt source n + 1
(CLIC has lint0
, but PLIC doesn't have source 0)Is this the first silicon available to the general public with a SiFive CLIC?
The transceiver is a Motorcomm YT8521SH.
msi_apb
msi_apb
Ever want to control 10 different interrupts from MMIO? I don't know why you'd want that, but…
0x1247_0000 + 32KiB
Every single 4-byte word is aliased to the same 32-bit register. It seems that this device doesn't do address decoding.
Format:
bits[31:10]
Hard-wired to zerobits[9:0]
Controls PLIC interrupts [42:33]
and CLIC interrupts [41:32]
gc300_2x
, gc300_ahb
, gc300_axi
, jpcgc300_axibus
, jpcgc300_mainclk
gc300_2x
, gc300_ahb
, gc300_axi
, jpcgc300_main
(What's 'JPC'?)
This isn't even mentioned in the vendor datasheet. Secret GPU? Completely broken? Needs more info.
GPU2D_CSR
0x1010_0000 + 256KiB
Mainline etnaviv
initializes fine, but DMA doesn't seem to work.
[ 28.069600] etnaviv etnaviv: bound 10100000.gpu (ops gpu_ops [etnaviv])
[ 28.073585] etnaviv-gpu 10100000.gpu: model: GC300, revision: 4635
[ 28.212694] [drm] Initialized etnaviv 1.3.0 20151214 for etnaviv on minor 0
If you mux out the JTAG ports, OpenOCD can recognize Xtensa from IDCODE
. Need a core configuration file to do anything meaningful, so probably never going to get it…