Add FEL support for Allwinner SoC A733

[dlan17]

the PR tries to add FEL support for A733, tested on Radxa Cubie A7A board it's capable of booting uboot spl image..

still need some help to check if the commit message is accurate..

the spl_address is coded to 0x52000, as in my case I've tried, the <0x51000 isn't working..

[Icenowy]

Is the WIP U-Boot port available anywhere?

[Icenowy]

And is there any BROM dump of this SoC?

[dlan17]

Is the WIP U-Boot port available anywhere?

have a local repo, but not sorted out yet, the main challenge is to bring up DDR..

[dlan17]

And is there any BROM dump of this SoC?

no idea of what's the aim to do the dump, not really needed of this from my side..

[apritzel]

A BootROM dump would indeed be very helpful to confirm the various addresses used, for instance the SD card load address, the stack locations, and where any BROM buffers are. You can try to submit them to https://github.com/smaeul/sunxi-blobs, so that we have them on record for the future

[dlan17]

A BootROM dump would indeed be very helpful to confirm the various addresses used, for instance the SD card load address, the stack locations, and where any BROM buffers are. You can try to submit them to https://github.com/smaeul/sunxi-blobs, so that we have them on record for the future

I'm not familiar with this, I'd appreciate if someone else would do this..

[Icenowy]

At least N-BROM should be easy to dump -- just use sunxi-fel read functionality to dump the memory zone of BROM according to the manual.

[Icenowy]

Looks like the branch is still quite broken -- sunxi-fel read on BROM does not work at all (while sunxi-fel readl can read individual words from BROM)

[dlan17]

Looks like the branch is still quite broken -- sunxi-fel read on BROM does not work at all (while sunxi-fel readl can read individual words from BROM)

$ ./sunxi-fel read 0x17000 0x200 dump.bin usb_bulk_recv() ERROR -7: Operation timed out

it seems these address space aren't readable? I have no idea why..

[Icenowy]

https://github.com/smaeul/sunxi-blobs/pull/5

BROM dumps here (HS-BROM seems to be not available now).

Maybe I should try to do some trick like what @apritzel does on A523, on my Teclast tablet, to retrieve the secure part.

[apritzel]

Thanks @Icenowy for the BROM dump! That looks like the usual BootROM setup procedure, with all the hotplug checks, and including setting the ACTLR.SMP bit that isn't there anymore on the A55. Oh well .... Normal stack is at 0xf3400 (towards the end of the NPU SRAM aka "SHARED_SRAM), IRQ stack is at 0x48c00.

0x46E00 - 0x48C00 is the space that we can't write

Are you sure it's that large? Typically the IRQ stack usage is pretty small, like at most 1KB (0x400), which would mean we just need to save/restore from 0x48800-0x48c00. I wonder if we can use the area before the SPL load address for thunk and scratch? So 0x44000 and 0x45000 or so? I will continue wading through the BROM disassembly, to see if I can find some buffer addresses somewhere, or if it touches more in the lower SRAM area.

[dlan17]

Are you sure it's that large? Typically the IRQ stack usage is pretty small, like at most 1KB (0x400), which would mean we just need to save/restore from 0x48800-0x48c00.

Yes, it's my actual test result, just boot straight into FEL mode (without SD or eMMC), then I did something like this a) "fel write 512bytes" b) "fel read back 512bytes" c) do m5sum to compare

for 0x46e00, it's fail at stage a - fel write

for the large buffer, is the space used by anything else than IRQ stack, like FEL/usb buffer? or maybe simply access forbidden?

I wonder if we can use the area before the SPL load address for thunk and scratch? So 0x44000 and 0x45000 or so?

I think it's possible, but haven't tested, I will try it some day and will let you know..