Skip to content

Instantly share code, notes, and snippets.

@orangecms

orangecms/k1-spl-dram.md

Last active August 19, 2024 09:57
Show Gist options
  • Save orangecms/8624aa82bab4931f787b5eee572f7668 to your computer and use it in GitHub Desktop.
Save orangecms/8624aa82bab4931f787b5eee572f7668 to your computer and use it in GitHub Desktop.
Download ZIP
SpacemiT K1 SPL/FSBL/DRAM init
Raw
k1-spl-dram.md

Vendor docs

https://docs.banana-pi.org/en/BPI-F3/BananaPi_BPI-F3

https://docs.banana-pi.org/en/BPI-F3/GettingStarted_BPI-F3

https://wiki.banana-pi.org/Banana_Pi_BPI-F3

Preparation

Attempts to get something to run via Ubuntu's/Debian's fastboot (version 28.0.2-debian) directly only results in hanging.
There is a script in the SpacemiT download archives though that invokes fastboot directly: https://archive.spacemit.com/image/k1/flash-all.zip

A newer version of fastboot will do; get it here if your distro doesn't have it: https://developer.android.com/tools/releases/platform-tools

People are puzzled.
https://forum.banana-pi.org/t/dfu-and-directly-flashing-the-emmc-using-simpler-tools/18049

I found notes on the usage of flashserver here:
https://forum.banana-pi.org/t/emmc-image-installation-fail-fastboot-charmap-exception/18276/3

Download and extract the latest titanflasher: https://archive.spacemit.com/tools/titanflasher/
From the titantools binary, extract the flashserver binary; it's essentially fastboot, but modified.

./titantools_for_linux-1.0.35-beta.AppImage --appimage-extract resources/app/flashserver

The file will then be at squashfs-root/resources/app/flashserver.
I recommend putting it elsewhere and have it in your $PATH.

NOTE: The path may change with a newer version of the AppImage.
You can mount it like this, which yields the mountpoint, so you can search for it:

./titantools_for_linux-1.0.35-beta.AppImage --appimage-mount

That will print a path like /tmp/.mount_titantFtuAIM. When done, press Ctrl+C to unmount.

TODO: reverse it.

Run SPL/FSBL

Here is my fork with a few extra changes to get the code to compile (mind the branch): https://github.com/orangecms/spacemit-u-boot/tree/v2022.10-k1

SpacemiT U-Boot creates a file named FSBL.bin in the root directory.
That is what we can run now using flasherver; after -cmd, provide the fastboot command to run:

flashserver -cmd "stage FSBL.bin"
flashserver -cmd "continue"

For each command, it will ask you to select the port. With just one device attached, that is just 1.
You can also do flasherver --list and from there take the portPath, which is something like [3, 2].
Join the two numbers with a -, and provide that as the -port:

flashserver -port 3-2 -cmd "getvar version-brom"

Alternatively, with a recent version of fastboot (this here is 35.0.1-11580240):

fastboot stage FSBL.bin
fastboot continue

Here is a log from U-Boot SPL with debug logging (loglevel > 0) enabled in drivers/ddr/spacemit/k1x/lpddr4_silicon_init.c:

fastboot_handle_command: 0002b0a0
Starting download of 176288 bytes
usb_tx_bytes : len= 65 pBuf= 0xc083fe88
usb_rx_bytes : len= 176288 pBuf= 0xc0800000
usb_tx_bytes : len= 65 pBuf= 0xc083fe88
usb_rx_bytes : len= 4096 pBuf= 0xc0838720
SETUP: 0x80 0x6 0x300
SETUP: 0x80 0x6 0x30a
SETUP: 0x80 0x6 0x300
SETUP: 0x80 0x6 0x30a
fastboot_handle_command: continue
usb_tx_bytes : len= 65 pBuf= 0xc083fe88
j...

U-Boot SPL 2022.10spacemit-g0e3d5c910-dirty (Jul 11 2024 - 03:00:49 +0200)
ADDR[0xc0000304]=0x00800400 !!!!
PHY INIT done
wait DRAM INIT
DRAM INIT done
DRAM Mode register Init done.....
DEBUG-ADDR[0xc0000200]:0xf0001
DEBUG-ADDR[0xc0000204]:0x0
DEBUG-ADDR[0xc0000208]:0x800f0001
DEBUG-ADDR[0xc000020c]:0x0
DEBUG-ADDR[0xc0000220]:0x5030632
DEBUG-ADDR[0xc0000224]:0x5030632
ddr density: 4096 MB
enter self refresh start .....
enter self refresh start done .....
c0000000, 0, 2
Training start....
Training init....
dump margin and setting Before Training....
Write Leveling.....
Read Gate Training.....
Read_gate_training PASS!!
Read_gate_training PASS!!
read gate code[0xc0040070]=0x00012121
read gate code[0xc0040170]=0x00012222
read gate code[0xc0041070]=0x00011f1f
read gate code[0xc0041170]=0x00012020
Read Training.....
each RX Vref corresponding min margin = 22 22 22 23 23 24 24 24 23 23 23 22 21 18 17 17
 optimize Rx Vref adjust=5 ,corresponding best margin=24
Again!!! training optimize Fine Rx vref step = 5
Write Training.....
each TX Vref corresponding min margin = 19 19 19 20 20 20 20 20 20 20 21 21 21 21 21 21
 optimize Tx Vref adjust=31 ,corresponding best margin=21
Again!!! training optimize Fine Tx vref step = 31
Training status[0xC0058000]=0x00000000
change to 1600
frequency change done!!!!
enter self refresh start .....
enter self refresh start done .....
c0000000, 1, 2
Training start....
Training init....
dump margin and setting Before Training....
Write Leveling.....
Read Gate Training.....
Read_gate_training PASS!!
Read_gate_training PASS!!
read gate code[0xc0044070]=0x00012121
read gate code[0xc0044170]=0x00012222
read gate code[0xc0045070]=0x00011f1f
read gate code[0xc0045170]=0x00012020
Read Training.....
each RX Vref corresponding min margin = 14 15 15 16 17 17 17 17 16 16 15 15 14 12 10 9
 optimize Rx Vref adjust=4 ,corresponding best margin=17
Again!!! training optimize Fine Rx vref step = 4
Write Training.....
each TX Vref corresponding min margin = 12 12 12 12 12 12 12 12 13 13 13 13 14 14 14 14
 optimize Tx Vref adjust=33 ,corresponding best margin=14
Again!!! training optimize Fine Tx vref step = 33
Training status[0xC0058000]=0x00000000
change to 2400
frequency change done!!!!
enter self refresh start .....
enter self refresh start done .....
c0000000, 2, 2
Training start....
Training init....
dump margin and setting Before Training....
Write Leveling.....
Read Gate Training.....
Read_gate_training PASS!!
Read_gate_training PASS!!
read gate code[0xc0048070]=0x00012323
read gate code[0xc0048170]=0x00012323
read gate code[0xc0049070]=0x00012121
read gate code[0xc0049170]=0x00012121
Read Training.....
each RX Vref corresponding min margin = 8 8 9 9 10 11 11 11 10 10 9 8 8 4 0 0
 optimize Rx Vref adjust=5 ,corresponding best margin=11
Again!!! training optimize Fine Rx vref step = 5
Write Training.....
each TX Vref corresponding min margin = 9 9 9 9 10 10 10 10 9 9 9 9 9 9 9 9
 optimize Tx Vref adjust=25 ,corresponding best margin=10
Again!!! training optimize Fine Tx vref step = 25
Training status[0xC0058000]=0x00000000
change to 2400
frequency change done!!!!
lpddr4_silicon_init consume 263ms

Run U-Boot main

After SPL, you can load the U-Boot itb image:

fastboot stage u-boot.itb
fastboot continue

continued log:

.........Boot from fit configuration k1-x_deb1
## Checking hash(es) for config conf_2 ... OK
## Checking hash(es) for Image uboot ... crc32+ OK
## Checking hash(es) for Image fdt_2 ... crc32+ OK


U-Boot 2022.10spacemit-g0e3d5c910-dirty (Jul 15 2024 - 22:42:54 +0200)

CPU:   rv64imafdcvsu_zicsr_zifencei_zicbom_zihintpause_zba_zbb_zbc_zbs_svpbmt_sstc_sscofpmf
Model: spacemit k1-x deb1 board
DRAM:  DDR size = 4096 MB
DDR size = 4096 MB
DDR size = 4096 MB
4 GiB
[RESET]probe start
[RESET]probe finish
DCDC_REG1@dcdc1: ; enabling
DCDC_REG2@dcdc2: ; enabling
DCDC_REG3@dcdc3: ; enabling
DCDC_REG4@dcdc4: ; enabling
DCDC_REG5@dcdc5: ; enabling
DCDC_REG6@dcdc6: ; enabling
LDO_REG1@ldo1: ; enabling
LDO_REG2@ldo2: ; enabling
LDO_REG3@ldo3: ; enabling
LDO_REG4@ldo4: ; enabling
LDO_REG5@ldo5: ; enabling
LDO_REG6@ldo6: ; enabling
LDO_REG7@ldo7: ; enabling
LDO_REG8@ldo8: ; enabling
LDO_REG9@ldo9: ; enabling
LDO_REG10@ldo10: ; enabling
LDO_REG11@ldo11: ; enabling
SWITCH_REG1@switch1: ; enabling
Core:  395 devices, 22 uclasses, devicetree: board
MMC:   [RESET]spacemit_reset_set assert=0, id=71
[RESET]spacemit_reset_set assert=0, id=72
sdh@d4280000: probe done.
[RESET]spacemit_reset_set assert=0, id=71
[RESET]spacemit_reset_set assert=0, id=83
sdh@d4281000: probe done.
sdh@d4280000: 0, sdh@d4281000: 2
Loading Environment from nowhere... OK
pcie_dw_k1x_probe, 662
[RESET]spacemit_reset_set assert=0, id=90
Now init Rterm...
pcie prot id = 1, porta_init_done = 0
Now waiting portA resister tuning done...
porta redonly_reg2: 00005d47
pcie_rcal = 0x00005d47
pcie port id = 1, lane num = 2
Now int init_puphy...
waiting pll lock...
Now finish init_puphy....
pcie_dw_k1x pcie@ca400000: Unable to get phy0pcie_dw_k1x pcie@ca400000: Unable to get phy1PCIEn
In:    serial
Out:   serial
Err:   serial
ddr_freq_change: ddr frequency change from level 0 to 6
Change DDR data rate to 2400MT/s
[RESET]spacemit_reset_set assert=0, id=38
Default to 100kHz
EEPROM: TlvInfo v1 len=32
valid ethaddr: fe:fe:fe:e4:09:17
Serial number is valid.
Cannot find TLV data: product_name
Cannot find TLV data: manufacture_date
Cannot find TLV data: manufacturer
Cannot find TLV data: device_version
Cannot find TLV data: sdk_version
k1xci_udc: phy_init
k1xci_udc probe
k1xci_udc: pullup 1
-- suspend --
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x0 value 0x100 length 0x40
handle setup SET_ADDRESS, 0x0, 0x5 index 0x0 value 0xe length 0x0
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x0 value 0x100 length 0x12
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x0 value 0x200 length 0x9
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x0 value 0x200 length 0x20
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x0 value 0x300 length 0xff
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x409 value 0x302 length 0xff
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x409 value 0x301 length 0xff
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x409 value 0x303 length 0xff
handle setup SET_CONFIGURATION, 0x0, 0x9 index 0x0 value 0x1 length 0x0
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x409 value 0x302 length 0xff
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x409 value 0x304 length 0xff
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x0 value 0x300 length 0x4
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x409 value 0x301 length 0xff
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x0 value 0x300 length 0x4
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x409 value 0x302 length 0xff
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x0 value 0x300 length 0x4
handle setup GET_DESCRIPTOR, 0x80, 0x6 index 0x409 value 0x303 length 0xff

Now press Ctrl + C to drop into the U-Boot shell. Enjoy! :-)

@orangecms
Copy link
Author

DRAM training

I took the SpacemiT U-Boot fork, which is not open source - it has a binary blob in a header in the DRAM / DDR controller driver. Dumped that, and since U-Boot loads it and has the load address, I could open it up in Ghidra with that base address.

I then went ahead and adjusted some things Ghidra couldn't fully figure out, mainly function args. You will see in U-Boot that a 10-entry u64 array is passed, with actually 5 values only, including the DDR controller base, something they call boot_pp, the CS number, and, by default silenced to void, a printf implementation, plus a blob which is actually part of the payload header that the mask ROM reads above your payload to it. Turns out that's non-sense anyway and, AFAICT, unused.

So back to Ghidra.
Since I knew the args, I could now trace them through the function calls within that binary, seeing that a lot of stack allocation and unnecessary copying is going on, which is why it gets confusing. Probably that is just what the compiler does without too much optimization. Anyway, I could still figure out a lot.
As I currently happen to understand it, the SRAM is heavily used for a bunch of stuff, but... I may be mistaken. There is a >4k chunk of memory allocated on the stack that is being written to in nested loops across multiple functions, especially in read and write training.

The controller base address is 0xc000_0000.
PHY0 is at 0xc004_0000, and they use PHY0 base + boot_pp * 0x4000 a bunch of times (boot_pp is set to 0, 1, 2, the blob called 3 times).

And there are other blocks involved, e.g. at 0xc005_8000.

SRAM seems to start at 0xc080_0000, which is where your payload with its header is loaded, but since the header is included, you really start at 0xc080_1000 (i.e. at 4k offset). That is also the address where U-Boot links the SPL binary.

@orangecms
Copy link
Author

orangecms commented Aug 9, 2024 •
edited
Loading

oreboot DRAM init

NOTE: I reverse engineered the DRAM training blob and translated the other DRAM init code from U-Boot, staged at https://github.com/orangecms/oreboot/tree/all-the-things-wip/src/mainboard/spacemit/k1x/bt0

NOTE: In order to get the binary with the necessary header, I hacked a bit into the vendor tool, created a custom JSON config for it (see below), and fixed some bits in U-Boot. See https://github.com/orangecms/spacemit-u-boot/tree/v2022.10-k1 - it's a bit messy. I could flash the eMMC with that U-Boot, but then got authentication (header verfiication) errors when booting. No clue why. So just use the tool to create the binary; ./tools/build_binary_file.py -c oreboot.json -o oreboot.bin.
Will see if we can port the tool to create the header to make it easier to use.

{
  "_comment": {
    "info": "bootinfo build configuration script",
    "key word": {
      "image": "image definition",
      "module": "image module definition",
      "data": "image item data config"
    }
  },
  "info": {
    "arch": "RISCV64",
    "description": "spacemit k1x fsbl image"
  },
  "image": [
    {
      "module": "ROTPK",
      "data": [
        {
          "pubkey": {
            "name": "rsakeypair0",
            "algorithm": "RSA2048",
            "source": "board/spacemit/k1-x/configs/key/rsakeypair0_prv.key",
            "align": 256
          }
        }
      ]
    },
    {
      "module": "image_header",
      "data": [
        {
          "structure": [
            "name, header0, 0",
            "magic, AIHD, 4",
            "version, 1, 1",
            "secure, 0, 1",
            "reserved, 0, 2",
            "imgsize, 0x0200, 8",
            "load_addr, 0x100, 8",
            "pad, 0xA5, 8"
          ]
        }
      ]
    },
    {
      "module": "image_config",
      "data": [
        {
          "structure": [
            "name, keydata, 0",
            "key_default, 0, 4",
            "table_num, 2, 4",
            {
              "structure": [
                "name, keytable0, 0",
                "key_name, spl, 16",
                "key_id, 0, 4"
              ]
            },
            "pad, 0, 452"
          ]
        }
      ]
    },
    {
      "module": "oem_pubkey",
      "data": [
        {
          "structure": [
            "name, oem_key, 0",
            {
              "pubkey": {
                "name": "spl_pubkey",
                "algorithm": "RSA2048",
                "source": "board/spacemit/k1-x/configs/key/spl_pubkey_prv.key",
                "align": 256
              }
            },
            "reserved, 0, 1792"
          ]
        }
      ]
    },
    {
      "module": "cert0",
      "data": [
        {
          "signature": {
            "name": "signature0",
            "algorithm": "SHA256+RSA2048",
            "key": "rsakeypair0",
            "source": "header0 + keydata + oem_key",
            "align": 256
          }
        }
      ]
    },
    {
      "module": "padding",
      "data": [
        {
          "structure": [
            "pad, 0, 992"
          ]
        }
      ]
    },
    {
      "module": "spl",
      "data": [
        {
          "structure": [
            "name, header1, 0",
            "magic, AIHD, 4",
            "version, 1, 1",
            "secure, 0, 1",
            "reserved, 0, 2",
            "imgsize, sizeof(fsbl), 8",
            "load_addr, 0x512, 8",
            "pad, 0xA5, 8"
          ]
        },
        {
          "file": {
            "name": "fsbl",
            "source": "spacemit-k1x-bt0.bin",
            "align": 32
          }
        },
        {
          "signature": {
            "name": "signature1",
            "algorithm": "SHA256+RSA2048",
            "key": "spl_pubkey",
            "source": "header1 + fsbl",
            "align": 256
          }
        }
      ]
    }
  ]
}

Here is a log.

NOTE: The panic is intentional.

oreboot 🦀 bt0
RISC-V arch 8000000058000001
RISC-V core vendor: SpacemiT (0x0710)
RISC-V implementation: X60 (0x1000000049772200)
RISC-V hart ID 0
HeaderInfo {
    magic: 0x6ded1e0,
    crc32: 0xc23e034a,
    chipid: 0x9bb6cc1b8baeb641,
    mac_addr: 0xaeba42965924c6c9,
    version: 0x3691b684,
    cs_num: 0xb56abde1,
}
dump 1024 bytes @c0800040
a4f0e0ba5793715641938afc43a1adc23d3e945629b111c817037cec782476ec
d4a3be098fb5cb75d4191c2d6b87fe2e10593975ba5739c37345d04d47b98ff2
14cdbdc2fff228183c0c9a9b2099766740719c70cd018b7b30503e01fdd6dd40
db66d04e65f9f9a9e1f08edead41df8d84556dc989ec7f4e82b9198cf5eec9ef
7913086b2bfff2855a6525fac8cfed30a89b6a69c951276fc2c7a412118fac42
8c7bd55f0dbed9230717a3538a920ee32fa189a6ea79956a702e391916745007
414948440100000000020000000000000001000000000000a5a5a5a5a5a5a5a5
000000000200000073706c000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
d263462f1b7be1bbc2a160f5ece41575781d7120b3c95101927eca04e9d5c47e
c8639b0d530a14ceada30910d9add7b04739c7d7dcba696ae1efff835e53ec40
fd50f916c7d2d6c9c004388fb574e38eef23ae58eb591fad0aff47a4c82720b5
eb0649b58b5a664db8a088ad6a9a3f88951618380e9b2a9368f9449a0c3b9227
3cb179c42baaa309375797cd2894a341b557b7fcdef90ede70a7b5b7abac917f
1dec10dfe100426ebc1571062c154934856acc84f38f6dae0d66a436e25be1db
f819a9193c07a8a594a4d667a16d8397a4203705502929fadd603f9f63f864da
8d2dedf8fee3cb4c330137fcca99e6cbf8e6eebced7fe3dcf42e5fd99dbaab3d
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
ADDR[0xc0000304]=0x00800400
PHY INIT done
wait DRAM INIT
DRAM INIT done
DRAM Mode register Init done.
DDR size (density): 4096MB
MR 8: 18
DEBUG-ADDR[0xc0000200]:0x000f0001
DEBUG-ADDR[0xc0000204]:0x00000000
DEBUG-ADDR[0xc0000208]:0x800f0001
DEBUG-ADDR[0xc000020c]:0x00000000
DEBUG-ADDR[0xc0000220]:0x05030632
DEBUG-ADDR[0xc0000224]:0x05030632
self refresh start
self refresh done
Training start...
Training init...
Dump margin and setting before training...
write leveling
read gate train
read gate training pass
read gate training pass
0xc0040070 = 0x00012121
0xc0040170 = 0x00012222
0xc0041070 = 0x00011f1f
0xc0041170 = 0x00012020
read training
each RX Vref corresponding min margin
 00: 22, 01: 22, 02: 22, 03: 23,
 04: 23, 05: 24, 06: 24, 07: 24,
 08: 24, 09: 23, 10: 23, 11: 22,
 12: 21, 13: 18, 14: 17, 15: 16,
optimize RX Vref adjust = 5, corresponding best margin = 24
Optimize fine RX vref step: 5
write training
each TX Vref corresponding min margin
 00: 20, 01: 20, 02: 20, 03: 20,
 04: 20, 05: 20, 06: 20, 07: 20,
 08: 20, 09: 20, 10: 20, 11: 20,
 12: 20, 13: 20, 14: 20, 15: 20,
optimize TX Vref adjust = 21, corresponding best margin = 29
Optimize fine TX vref step: 21
Training status [0xc0058000]=0x00000000
change to 1600
frequency change done!
self refresh start
self refresh done
Training start...
Training init...
Dump margin and setting before training...
write leveling
read gate train
read gate training pass
read gate training pass
0xc0044070 = 0x00012222
0xc0044170 = 0x00012222
0xc0045070 = 0x00012020
0xc0045170 = 0x00012020
read training
each RX Vref corresponding min margin
 00: 14, 01: 15, 02: 15, 03: 16,
 04: 16, 05: 17, 06: 17, 07: 17,
 08: 17, 09: 16, 10: 16, 11: 15,
 12: 14, 13: 11, 14: 10, 15: 9,
optimize RX Vref adjust = 5, corresponding best margin = 17
Optimize fine RX vref step: 5
write training
each TX Vref corresponding min margin
 00: 12, 01: 12, 02: 12, 03: 12,
 04: 12, 05: 12, 06: 12, 07: 12,
 08: 12, 09: 12, 10: 12, 11: 12,
 12: 12, 13: 12, 14: 12, 15: 12,
optimize TX Vref adjust = 21, corresponding best margin = 30
Optimize fine TX vref step: 21
Training status [0xc0058000]=0x00000000
change to 2400
frequency change done!
self refresh start
self refresh done
Training start...
Training init...
Dump margin and setting before training...
write leveling
read gate train
read gate training pass
read gate training pass
0xc0048070 = 0x00012323
0xc0048170 = 0x00012323
0xc0049070 = 0x00012121
0xc0049170 = 0x00012121
read training
each RX Vref corresponding min margin
 00: 8, 01: 8, 02: 9, 03: 9,
 04: 10, 05: 10, 06: 11, 07: 10,
 08: 10, 09: 10, 10: 9, 11: 8,
 12: 8, 13: 4, 14: 0, 15: 0,
optimize RX Vref adjust = 6, corresponding best margin = 11
Optimize fine RX vref step: 6
write training
each TX Vref corresponding min margin
 00: 10, 01: 10, 02: 10, 03: 10,
 04: 10, 05: 10, 06: 10, 07: 10,
 08: 10, 09: 10, 10: 10, 11: 10,
 12: 10, 13: 10, 14: 10, 15: 10,
optimize TX Vref adjust = 21, corresponding best margin = 31
Optimize fine TX vref step: 21
Training status [0xc0058000]=0x00000000
change to 2400
frequency change done!
[bt0] panic in 'src/mainboard/spacemit/k1x/bt0/src/dram.rs' line 1589
[bt0]   TODO

@orangecms
Copy link
Author

orangecms commented Aug 9, 2024 •
edited
Loading

flash to eMMC

Get binaries from https://drive.google.com/drive/folders/1UQHHIu6MnOFvrqAhE5PR-fHMnH8RyAf6 / openwrt-spacemit-k1-nas-MUSE-N1-ext4-pack.zip (for other vendor binaries, see also https://docs.banana-pi.org/en/BPI-F3/BananaPi_BPI-F3 )

unzip openwrt-spacemit-k1-nas-MUSE-N1-ext4-pack.zip factory/FSBL.bin u-boot.itb factory/bootinfo_sd.bin

and use the following partition_oreboot.json:

{
    "version": "1.0",
    "format": "gpt",
    "partitions": [
        {
            "name": "bootinfo",
            "hidden": true,
            "offset": "0K",
            "size": "512",
            "image": "factory/bootinfo_sd.bin",
            "holes": "{\"(80;512)\"}"
        },
        {
            "name": "fsbl",
            "hidden": false,
            "offset": "128K",
            "size": "256K",
            "image": "../u-boot/oreboot.bin"
        }
    ]
}

then flash the whole thing (yes, bootinfo_sd.bin is fine even though we flash to eMMC; it's weird):

fastboot stage factory/FSBL.bin
fastboot continue
sleep 2
fastboot stage u-boot.itb
fastboot continue
sleep 5

fastboot flash gpt partition_oreboot.json
fastboot flash bootinfo factory/bootinfo_sd.bin
fastboot flash fsbl ../u-boot/oreboot.bin

NOTE: The above may not work with a fresh board. I initially used spacemit-flashserver --debug -part partition_oreboot.json with a modified fastboot.yaml:

version: 1.0 # 配置文件版本
support: # 支持的项目代号
  - 'k1x'
  - 'k1pro'
actions: # 刷机操作的定义

  - getvar:
      args: 'version-brom'
      set: 'version'
      skip_fail: true
      timeout:
        seconds: 1

  - stage:
      file: 'factory/FSBL.bin'
      skip_when: "not temp.version"
      timeout:
        minutes: 2

  - continue:
      skip_when: "not temp.version"
      timeout:
        seconds: 1

  - stage:
      file: 'u-boot.itb'
      skip_when: "not temp.version"
      timeout:
        minutes: 2
      retry: 3

  - continue:
      skip_when: "not temp.version"
      timeout:
        seconds: 1

  - multi_flash:
      timeout:
        minutes: 10
      relate_partition: ['partition_oreboot.json']

@orangecms
Copy link
Author

Thanks to a volunteer who ran the reversed DRAM init code on their MuseBook, the SpacemiT M1 based laptop - it works fine!

https://pastebin.com/C9y3Kh2b

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment