BFE EngineeringandClaude Fable 5
5155224594
Preparing the repo to go public (ADR-0007): - CI: kernel-build moves from the self-hosted runner to ubuntu-latest (installs its own cross toolchain + qemu, caches the pristine tarball). On a public repo a registered self-hosted runner is reachable from approved fork-PR workflows — i.e. arbitrary code on private infrastructure — and the build never actually needed the SDK host. ADR-0004 marked superseded-in-part; docs/ci-cd.md rewritten (site specifics now live only in the private deployment log). - Licensing: LICENSE gains the GPL-2.0 carve-out for patches/ and the kernel source excerpts (Linux derivatives; per-driver provenance was already tracked in PROVENANCE.md); patches/README.md states it too. - Scrubbed from the tip: bench-unit dev credentials and its gadget IP (m2-boot notes), the site AP SSID+BSSID and a neighboring AP's BSSID and the device WLAN MAC (wifi bring-up evidence — BSSIDs are geolocatable), the runner mesh IP. NOTE: these remain in git history; decision on a pre-publication history rewrite is separate. - Emoji cleanup across 21 tracked files (kernel port docs, review report, enforce-mcdc.sh) per repo text conventions: status marks became [x]/[wip]/[ ]/OK plain text. - "[maintainer]-gated" process phrasing normalized to "maintainer-gated" (attributions in dated evidence docs kept). Verified: zero emojis tracked; scrub grep clean; patches carry no internal references; ci.yml parses; shellcheck unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K
54 lines
3.1 KiB
Markdown
54 lines
3.1 KiB
Markdown
# HPMCU mailbox — [x] 100% VERIFIED on warden-c8a3 (2026-08-25)
|
|
|
|
A fully-open A7 ↔ HPMCU (RISC-V SCR1) hardware-mailbox round-trip on our self-built
|
|
Linux 6.18.46. Open kernel driver + open SCR1 firmware, **zero blobs**.
|
|
|
|
## Evidence (serial, _b slot = our 6.18)
|
|
SCR1 echo firmware running: `DBG_STATE = 0x584F424D` ("MBOX"). Five round-trips,
|
|
Linux → mailbox → SCR1 → mailbox → Linux, **all exact**:
|
|
```
|
|
sent 0x0000beef/0x600df00d -> B2A 0x0000BEEF/0x600DF00D e=4 OK
|
|
sent 0x0000c0de/0x12345678 -> B2A 0x0000C0DE/0x12345678 e=5 OK
|
|
sent 0x0000face/0xdeadbeef -> B2A 0x0000FACE/0xDEADBEEF e=6 OK
|
|
sent 0x00001234/0xcafef00d -> B2A 0x00001234/0xCAFEF00D e=7 OK
|
|
sent 0x0000aa55/0x55aa55aa -> B2A 0x0000AA55/0x55AA55AA e=8 OK
|
|
```
|
|
Echo counter increments 1:1 with sends; both CMD and DAT echo back verbatim.
|
|
|
|
## The three fixes it took (none in the research plan — found on hardware)
|
|
1. **Controller IRQ count** (`rockchip-mailbox.c`): the rv1106 mailbox has ONE
|
|
shared IRQ (GIC_SPI 1), but the rk3368 driver-data assumes one IRQ per channel
|
|
(num_chans=4) and probe failed `IRQ index 1 not found`. Added an
|
|
`rv1106_drv_data { .num_chans = 1 }` + a `rockchip,rv1106-mailbox` match entry
|
|
(ahead of the rk3368 fallback). Channel 0 is all the doorbell needs. Controller
|
|
then probes clean and clocks the mailbox (pclk_mailbox on).
|
|
2. **SCR1 core clock** (`clk-rv1106.c`): `clk_core_mcu` (the coprocessor's 297 MHz
|
|
core clock) had flags 0, so 6.18's `clk_disable_unused()` switched it off and the
|
|
released core never executed (DBG_STATE stayed 0). Marked it `CLK_IGNORE_UNUSED`.
|
|
(5.10 happened to leave it on.)
|
|
3. **A2B doorbell semantics** (SCR1 firmware + send order): the MCU-side receiver
|
|
must set `A2B_INTEN` or an A7 write to A2B_CMD never raises A2B_STATUS — the echo
|
|
firmware now sets `A2B_INTEN` at init. And the A2B_DAT write is the doorbell, so
|
|
the sender writes CMD first, then DAT (the mainline order), so both are current
|
|
when the SCR1 reads them.
|
|
|
|
## Loading the firmware (no reflash, no brick)
|
|
The SCR1 echo firmware (`scr1-echo/`, 154 B) is loaded at runtime into hpmcu_sram
|
|
(0xFF6FE000) via the proven `flared/hpmcu.rs` sequence (`load-echo-fw.sh`): GRF
|
|
uncached peripheral window (0xff040024/28) → CORECRU hold → firmware to SRAM →
|
|
SGRF boot addr → CORECRU release. **Do NOT kill warden-flared** (it one-shot-loads
|
|
at boot then just beats + pets the dw-wdt; killing it resets the board). We reset
|
|
+ reload the SCR1; flared does not re-load. The SRAM-load path avoids the 0x40000
|
|
boot-load brick hazard entirely.
|
|
|
|
## Config / DT
|
|
`CONFIG_ROCKCHIP_MBOX=y`; board DTS `&mailbox { status = "okay"; }` (the @ff5c0000
|
|
HPMCU-connected instance). The existing /dev/mem SRAM watchdog is untouched (a
|
|
separate dead-man's-switch); the mailbox is the general open IPC channel.
|
|
|
|
## Files
|
|
- `scr1-echo/main.c` + `start.S` + `link.lds` + `Makefile` — the open SCR1 echo fw.
|
|
- `scr1-echo/load-echo-fw.sh`, `mbox-roundtrip.sh`, `echo-fw-words.txt` — load + test.
|
|
- Kernel deltas: `rockchip-mailbox.c` (rv1106 num_chans=1), `clk-rv1106.c`
|
|
(CLK_CORE_MCU IGNORE_UNUSED), `rv1106-warden.dts` (&mailbox okay).
|