# VisionFive 2 / JH7110 ideas

This is not StarFive official documentation.

All information here based on cited sources or reverse engineering and testing by contributors of this document. There is a lot of guesswork.

## Pseudocode conventions

(Who knows, might need them)

- Memory ranges: `start_addr + size`, e.g. `0x2a00_0000 + 32KiB`
- Bit ranges: `[end:start]`, both inclusive.
- Data addresses: `type[addr]`, e.g. `uint32_t[0x0200_0000]`

## Boot process

Two on-board switches control the boot mode:

- `0`: QSPI flash: The first stage is loaded from start of flash
- `1`: SD Card: The first stage is loaded from a GPT partition with partition type UUID `2E54B353-1271-4842-806F-E436D6AF6985` (known as `"HiFive BBL"` in fdisk)
- `2`: eMMC: ? (Probably same as SD card)
- `3`: UART XModem boot: On boot, starts receiving first stage by XModem

(Note that SD card and eMMC boot is [known to be unreliable according to StarFive][1]. And obviously UART is just for testing/debug/recovery. Prefer QSPI boot.)

[1]: https://doc-en.rvspace.org/JH7110/JH7110_Errata/JH7110_EVB/usb_boot.html

The boot mode switches controls where the first stage is found. The boot process is otherwise identical.

Secure boot mode is controlled by some OTP fuses inside the chip. All known public available hardware with JH7110 have secure boot off (i.e. no security).

### ROM stage

ROM is `0x2a00_0000 + 32KiB`

Hart 0:

- Load payload from the source depending on boot mode
- (If secure boot mode, check signature and decrypt)
- Check payload CRC
- Copy payload to `0x0800_0000`
- Send IPI to other harts
- Jump to `0x0800_0000`

Other harts:

- Wait for IPI
- Jump to `0x0800_0000`

### First stage

Non secure boot mode payload format, reverse engineered by `@orangecms`.

https://github.com/starfive-tech/Tools/issues/1

StarFive has adopted an reverse-engineered `spl_tool` (open source and GPL): https://github.com/starfive-tech/Tools/tree/master/spl_tool

Ordinarily corresponds to U-Boot SPL.

- Initializes DDR memory (almost the same code as for VF1)
- Loads and jumps to OpenSBI/U-Boot

Secure boot seems to be ECDSA-SHA256 with AES-256-CBC.

## References

- VisionFive 2 Single Board Computer Quick Start Guide: https://doc-en.rvspace.org/VisionFive2/PDF/VisionFive2_QSG.pdf