Skip to content

Instantly share code, notes, and snippets.

@ganboing
ganboing / README
Last active May 5, 2025 09:23
P550 Trace Sample
msg.txt -> Nexus Message dump
trace.txt -> Nexus Trace dump

EIC7700 firmware (bootchain)

First off, EIC7700 has several CPUs. MCPU (P550 cluster) + SCPU (E21) + LCPU (E21) + NPU and DSPs. The SCPU (Secure CPU) is used to run the Masked ROM after power on. The Masked ROM has the logic of loading different payloads from the selected boot source image and kickstarts other CPUs such as MCPU. Optionally it can also validate the cryptographic key/signature of the payload against OTP, thus implementing secure-boot. ESWIN calls the container of the payloads bootchain By default the boot source is QSPI boot flash. The bootchain is stored at the beginning of the flash (offset 0). The boot flash contains the following on my Hifive P550

  • DDR init: Vendor binary blob to initialize DDR (closed source)
  • "firmware": AFAIK, a very small piece of code that does little to nothing. Perhaps only to keep SCPU active.
  • bootloader: The usual opensbi+u-boot stuff that runs on MCPU. (open source, ESWIN maintains the patched opensbi/u-boot)

*As it's shown, the DDR init blob i

/data/home/zhuxianbin/workspace/esos/esos/bsp/spacemit/applications/main.c
/data/home/zhuxianbin/workspace/esos/esos/bsp/spacemit/drivers/adma/adma_service.c
/data/home/zhuxianbin/workspace/esos/esos/bsp/spacemit/drivers/board.c
/data/home/zhuxianbin/workspace/esos/esos/bsp/spacemit/drivers/can/can_service.c
/data/home/zhuxianbin/workspace/esos/esos/bsp/spacemit/drivers/i2c/i2c_service.c
/data/home/zhuxianbin/workspace/esos/esos/bsp/spacemit/drivers/ir/ir_service.c
/data/home/zhuxianbin/workspace/esos/esos/bsp/spacemit/drivers/pm/k1x_pm.c
/data/home/zhuxianbin/workspace/esos/esos/bsp/spacemit/drivers/uart/board_uart.c
/data/home/zhuxianbin/workspace/esos/esos/bsp/spacemit/drivers/uart/ck_usart.c
/data/home/zhuxianbin/workspace/esos/esos/bsp/spacemit/drivers/uart/drv_usart.h
@ganboing
ganboing / jh7110_otp.md
Last active February 12, 2024 03:48
jh7110/vf2 OTP Dump
function FindProxyForURL(url, host)
{
ipv4 = /^\d+\.\d+\.\d+\.\d+$/;
if (ipv4.test(host) && isInNet(host, "192.168.0.0", "255.255.0.0") )
return "DIRECT"
return "SOCKS 192.168.0.10:1080";
}
function FindProxyForURL(url, host)
{
return "SOCKS 192.168.1.100:1080";
}
function FindProxyForURL(url, host)
{
return "SOCKS 192.168.0.10:1082";
}
jA0EBwMCBwKc4DL9xflg0usBsTD5l0hn+NCYldXeJeuC6YYUSE/g1ZFkatdrp+bLkGY/ulniXTe8
XFpwstrXCxtvHHFP68JYnm3u6mMp2t3QqW3eegOfqy5pN+w2YYu/dLKtqJa0D1Ro5TOjkKqH/s2t
rVzCs1zE+f25qNxAYTSW6vxvKMp6TIwBQD3KFTGPL9q3VMFHy4yTB82A5hKF6C4Doa4KwJQfR5rr
Rq0b+eCvX4peqsR2H67lOjiyPdOV+ACH/Qheqb+RQ7c/+lEbSV/6GynkzIYctQ+3omFKmer3hc6e
qC0G6zl2g74VPPBRzwTdvQSNlDfQPysjhWIw8swQe2W0nVA6HRbLYwyyro5GBLploYIxjuQq3pd+
AVbImMKm/JXpN1epOZO6varWPD1Xc8dRfuIlwYxXxJIsd3LPf2d3cXmUMAL51jPjim+uPmkqFmMJ
1RyhUdnw0MU+b4K2NHvExkva2QbzS4264b1z0Gn8/lZctYYS3m8kqYRhT3wMYj5NZNEqxOblcVSn
9uqlir1qww5Gq+uaZVlT7d7Rmjy4dI3iuHKfRjsRwl9x7LdnHa2YIh7JWiJAWuOblrMc2T8bwfQL
x+dKp+mUBx//Mfawt6BlbzL0nZmE+xOsJtxb6g+8EH5NkS7IArpc887JdQxPGAqd34/MtI1iff2E
s9iqQW9Gdm/xpnHMl7yku9SzUr6nE2WVyjNTtEx+xhSbQvpe6xw6P9V5I3jAd0w6Pgh/Emomyv47