koendv/hi3861_notes

Huawei Hi3861 RISC-V processor notes

hi3861_notes's Issues

More information

Hi @koendv, thank you for your notes. This repository help me a lot.

I'm porting Zephyr RTOS to Hi3861. I would like to share some more information I got.

Boot

The boot process of Hi3861 consists with three parts: romboot, flashboot and kernel (user code, or the OS itself).

1. The fixed romcode verifies the flashboot at FLASH_BASE, copies it to 0x10A000 (which is actually CPU_RAM_BASE + 200KB) and executes. Since the first 64 bytes in the bootable image is the signature header, the actal entry is 0x10A040
2. The flashboot then verifies and boot the kernel at FLASH_BASE + 0xD3C0

Build

A total build on LiteOS generates several images. Finaly a Hi3861_demo_allinone.bin can be import to the HiBurn tool to flash. Here is a flow chart of the build progress:

Though not documented, the signature header is simple. I've implemented one in Python: sign_bin.py

Flash

The tool OpenHisiIpCam/hiburn mentioned in your notes is not the same thing with that HiBurn.exe we used for flashing Hi3861. Though they're sharing the same name.

In fact, the protocol to flash Hi3861 is a combination of a private command procotol and Ymodem. Though the client side (HiBurn) is not open source, we can make a glance on it from the server side: loaderboot from the LiteOS/OpenHarmony SDK.

I've implemented an open source alternative too. Currently it's part of the Zephyr project. I'll rewrite a standalone script in the future.

Just like the flashboot, the entry of the loaderboot is at 0x10A040.

Toolchain

The riscv32-unknown-elf works good. The riscv64-zephyr-elf from Zephyr SDK works good too (I prefer it since it runs on my MacBook Pro :p ).

The Hi3861's CPU is actually a RISC-V Privilege CPU with instruction set extension-M plus extension-C and Zicsr. While compiling with the Zephyr GCC, -march=rv32imc should be changed to -march=rv32imc_zicsr.

---

Hope these informations could help.

Serial port Flash and AT options

Planning to use the HI-07S module from AI-Thinker, Read that UART0 can be used to flash (instead of JTAG) and UART1 for AT commands. I wish to flash it via UART0 and use AT commands, but the host processor only has one serial-port available. A solution would be an dual analog switch (or MOSFETS) between the serial ports (via a GPIO the host controls) or can the HI-07S be programmed that AT commands flow through UART0 ? I will add a JTAG header just in case. P.S The AI-Thinker module seems to use GPIO7 to select the BOOT mode but could not find further documentation about this. The goal is hands-free programming.

Secure Boot for Hi3861

Has anyone configured Hi3861 for secure boot? I configured secure boot from many Chinese documents, but a board has been turned into a brick. Does anyone have detailed steps?

open source linux version of [hiburn for Hi3881]

Hi!

Found following link:

There is also an open source linux version of [hiburn for Hi3881](https://github.com/OpenHisiIpCam/hiburn).

I do not think this util can be used for hi3861, as the tool under the link if for uboot cmd automation.
Means tool suppose that target device has working uboot and it handle it's cmd for spi flash manipulation.
It was originally created for hisilicon based ip cameras that have uboot+gnu/linux software stack.