|
| 1 | +# Notes about this branch and Banana Pi F3 (bpif3) board |
| 2 | + |
| 3 | +This board is quite different from unmatched and VisionFive 2 boards. Its SOC is a SpaceMit-k1 Octocore and has a |
| 4 | +completely different set of peripherals and memory map. |
| 5 | + |
| 6 | +The board does use a similar boot sequence to unmatched/vf2: |
| 7 | + |
| 8 | +- execution starts in the SOC proprietary ROM |
| 9 | +- Control is transferred to a SPL that sets up the hardware |
| 10 | +- Control is transferred to Uboot which contains a memory resident SBI |
| 11 | +- Control is transferred to Linux if Uboot is not interrupted by the user |
| 12 | + |
| 13 | +The executables for the non ROM components can reside on multiple non volatile memory devices (I've mainly used the provided |
| 14 | +SD card image so far). |
| 15 | + |
| 16 | +Although source code is available for all but the ROM part, I've so far been unable to replicate the distributed image. |
| 17 | + |
| 18 | +The best I've been able to do is replace Uboot+SBI. When I compile the SPL code, it fails to load due to some |
| 19 | +cryptographic failure. From this, I conclude that the SPL image is signed and therefore not really user replacable. Maybe |
| 20 | +this is buried somewhere in the vendor full SDK? |
| 21 | + |
| 22 | +Also the self compiled uboot seems to have a lot of debug material printed that I dont see in the vendor provided image. |
| 23 | + |
| 24 | +Most concerning to development is that although it has a Jtag interface, RISCV cores 1-7 are not visible prior to Linux booting. I |
| 25 | +think this SOC has some clever core power down registers that must be initialized to bring them online, but I have not yet decoded |
| 26 | +the magic sequence yet. |
| 27 | + |
| 28 | +In summary, the observed differences beween bpif3 and other boards: |
| 29 | + |
| 30 | +- The clock counter advances much faster than the other boards. |
| 31 | +- The UART is mapped at a different address (have not tried to interface to it directly yet) |
| 32 | +- DDR, Uboot and OpenSBI exist at different addresses. Linux appeared to be loading around 0x10000000, so xv6 is linked |
| 33 | +to locate starting at this address. |
| 34 | +- It has 8 cores, but I have been unable to bring them all online (only 4 appear to start when requesting them from SBI using the |
| 35 | +published API). |
| 36 | +- As mentioned, Jtag is not available for cores 1-7 until the SOC is executing somewhere in Linux. |
| 37 | +- The SPL boot section appears to be cryptographically signed. |
| 38 | +- The realtime core runs some ".elf" file when booting Linux. I can not find the source to this .elf file. |
| 39 | + |
| 40 | +By selecting bpif3 in the Makefile, an image is created that accounts for the differences. But the user must remember to load the kernel.bin file to 0x10000000 if not using the kernel elf file (with gdb). |
| 41 | + |
| 42 | +# Jtag connection |
| 43 | + |
| 44 | +I used an inexpensive FT2232H-56Q ftdi minimodule (Digikey 768-1278-ND) as a Jtag probe adapter. It lists for $29.95 in 2024. |
| 45 | + |
| 46 | +## FT2232H-56Q minimodule Jtag wiring details |
| 47 | + |
| 48 | +``` |
| 49 | +GPIO Pin, Signal, MiniModule pin |
| 50 | +
|
| 51 | + 1 VIO CN2-12 |
| 52 | + 7 TDI CN2-9 |
| 53 | + 11 TMS CN2-11 |
| 54 | + 13 TCK CN2-8 |
| 55 | + 15 TDO CN2-10 |
| 56 | + 25 gnd CN2-1 |
| 57 | + n/c nTRST CN2-14 |
| 58 | +``` |
| 59 | +Where: |
| 60 | + |
| 61 | +- TMS, TCK, TDI, TDO are normal Jtag signals |
| 62 | +- VIO is a voltage reference from bpif3 to the mini module (3.3v) |
| 63 | +- gnd is 0v |
| 64 | +- nTRST is a GPIO on the FT2232H but not connected to bpif3. That pin is hard wired on the board to the reset circuit and |
| 65 | +generally gets reset once. As a result, the config file setting for this pin doesnt matter. |
| 66 | + |
| 67 | +Please be sure to confirm the pinout of any adapter or cabling with the vendor documentation before making any connections since improper |
| 68 | +interconnection can damage the board, interface or (unlikely) the host PC. |
| 69 | + |
| 70 | +# Errata |
| 71 | + |
| 72 | +## usertests |
| 73 | + |
| 74 | +Fascinatingly, this board fails the usertests program frequently, but sometimes at a new place - rmdot. |
| 75 | + |
| 76 | +It may also fail at sbrkmuch (!) just like unmatched. Curious. And sometimes it passes all tests. |
| 77 | + |
| 78 | +I did not do as much detailed debugging with this board as was done on unmatched to look beyond the failure string. |
| 79 | + |
| 80 | +## cores 1-7 |
| 81 | + |
| 82 | +Its possible to run xv6 with a single core. In main.c, comment out this: |
| 83 | + |
| 84 | +``` |
| 85 | + // cant start hart 1 for now since 0 was mapped to 1 |
| 86 | + //for (int i = 2; i < NCPU; i++) |
| 87 | + //{ |
| 88 | + // if (i != boothartid) |
| 89 | + // { |
| 90 | + // sbi_hart_start(i, harts_entry[i]); |
| 91 | + // |
| 92 | + // } |
| 93 | + //} |
| 94 | +``` |
| 95 | +That single core will boot xv6 with a single core and jtag works with core 0 and all is good. |
| 96 | + |
| 97 | +The problem is with cores 1-7, which appear inaccessible pre-Linux. Attempts to start them with the above code is partially successful. |
| 98 | + |
| 99 | +I end up with exactly 4 cores running, and those are visible to Jtag once they are running. The others silently fail for some unknown reason. |
| 100 | + |
| 101 | +Note: I presently have a wart in the code having to do with core 1 that is the reason for starting i at 2. This should get resolved in a next revision. |
| 102 | + |
| 103 | +# Jtag Workaround Attempt |
| 104 | + |
| 105 | +Given that all 8 cores are visible once we are in Linux, I used the telnet openocd session to try and take control of them and run xv6. |
| 106 | + |
| 107 | +This is the approach: |
| 108 | + |
| 109 | +For all cores, |
| 110 | +``` |
| 111 | +reg satp 0x0 |
| 112 | +reg sie 0x0 |
| 113 | +reg tp = N (where N ranges from 2..7) |
| 114 | +reg pc = (address of) spin |
| 115 | +``` |
| 116 | + |
| 117 | +After loading the code with core 0 (thread 1 in gdb), xv6 runs with core 0 and all the rest are waiting at wfi at spin (label in entry_sbi.S). |
| 118 | + |
| 119 | +Next, halt the code and one by one set a core pc to ```_entry_hartN``` (where N ranges from 2..7). |
| 120 | + |
| 121 | +All revectored cores are now running XV6. |
| 122 | + |
| 123 | +But attempts to get this to occur correctly (via SBI and also from uboot) have failed. I even tried to tuck all of the Linux cores back to SBI by first setting their PC to the new function 'park' which calles SBI to "stop" them and then try to run unmodified xv6 that asks cores 2..7 to start at the appropriate time. |
| 124 | + |
| 125 | +That plan failed, although park seems to power down the core (and Jtag cant talk to it once that happens). |
| 126 | + |
| 127 | +The real solution to this is to get Jtag to work while the code is running Uboot to try and figure out why they cant emerge when requested. Unresponsive cores appear to be "powered off" and the code to turn them on (so maybe they could wait at a wfi like the U74 cores do) is not |
| 128 | +documented (I specifically saw some undocumented register addresses getting written to in the SBI source code that power them up). |
| 129 | + |
| 130 | +This code snapshot calls SBI for cores 2-7 and ends up with 4 running cores with no error returned for the cores that dont start (yes, the return value was checked offline). |
| 131 | + |
| 132 | +# Closing Thought |
| 133 | + |
| 134 | +This board has great potential for custom development but I think that is hindered by the lack of clear published information about what is needed to make it work properly. I'm hopeful that more information will be made available or others contribute to the project their solutions (via pull request). |
| 135 | + |
0 commit comments