全志在线开发者论坛

司徒

中文名稱：小志掌機
英文名稱：Gaviar Handheld
開源方式：GPL License
開發人員：bankbank (銀行銀行)、steward (司徒)
開發目的：學習 RISC-V、體驗 KOF97 振動版
面向玩家：喜愛 DIY 樂趣、掌機的玩家
更新時間：由於我們的本業都跟這些無關, 只能利用閒餘時間研究, 因此, 每次更新的時間有可能長達一個月

功能簡介：
RISC-V 是一個趨勢, 只是目前比較少有掌機面市, 因此, bankbank 和司徒將會以軟件面向, 從頭做起, 並且將這些過程紀錄下來, 以供日後參考, 除了可以學習 RISC-V 的軟件開發之外, bankbank 也會進行 KOF97 遊戲逆向分析, 分析的目的並不是要修改 KOF97 ROM, 而是要讓模擬器知道哪些角色的招式可以去驅動振動馬達, 因為讓 KOF97 具備振動功能是 bankbank 跟司徒的夢想, KOF97 振動版相信可以再度勾起童年的快樂回憶, 由於逆向遊戲比較敏感, 因此, 盡量以點到為止

購買事項：
小志掌機是由暈哥製作並提供給 bankbank 和司徒，因此，如果想要購買的人可以去找暈哥，bankbank 和司徒並沒有參與任何販賣事項，司徒跟 bankbank 只是以開源的方向來研究這台掌機，當然所有的資源都是公開，因此，司徒比較建議玩家從 GitHub 下載並且自己動手列印製作，這樣會更有樂趣

資料倉庫：
https://github.com/Strugglemeat/gngeo
https://github.com/steward-fu/archives/releases/tag/f133

預計流程：

逆向 KOF97
硬件說明
硬件功能確認
- 點屏
- 按鍵
- 聲音
移植 Boot Loader
移植 Linux Kernel
- 屏幕驅動
- 按鍵驅動
- 聲音驅動
- 電池驅動
建置 Linux OS
移植 GNGEO 模擬器
- 支援振動功能

結帖時間：視情況而定
贊助連結：
https://store.steampowered.com/search/?developer=bankbank&ndl=1
https://play.google.com/store/apps/details?id=com.stylus.cavesweeper&gl=US&pli=1

注意事項：
由於此貼屬於開源專案, 因此, 司徒的仇家預計將前來尋仇, 這部分需要請管理員幫忙過濾惡意攻擊的言論, 如果無法有效制止, 此帖將提早結束, 我們將繼續漂流尋找下一個可以撰寫文章的地方

關於 bankbank (銀行銀行)：
romhacker and retro gamedev bankbank ( bankbank.net ), very focused on 68000, also interested in SH-2. my favorite game is Tetris the Grand Master 2 Plus. my dream is to make games and hacks that many people can enjoy. YouTube: https://www.youtube.com/bankbank

關於 steward (司徒)：
喜歡惡搞掌機, 賦予掌機另一種生命力, 藉由惡搞掌機來回味童年的美好, 誰叫掌機要惡搞當年的我

前言：
司徒相當高興可以遇到 Hack ROM 的高手 bankbank, bankbank 除了喜愛 Hack ROM 之外, 也熱愛 DIY 的樂趣, bankbank 本身可以閱讀簡單的中文, 因此, 如果需要詢問 bankbank 問題, 請盡量使用簡單的中文詞彙或者使用英文發問, 由於這個開源專案是從頭做起, 難免會遇到無法預期的開發問題, 加上 bankbank 和司徒的本業並非這個領域, 因此, 只能利用瑣碎時間研究, 基於熱愛掌機所發起的開源專案, 因此, 請不要催促開發進度

振動原理簡介：
左、右馬達用來代表左、右的方向, 此例使用大門武郎的岚之山, 大絕招一發動時, 同時振動馬達

右摔時，右邊振動馬達開始振動

左摔時，左邊振動馬達開始振動

司徒

Allwinner F133(D1s) 是 RISC-V 64位元架構, 就規格面來看, 應該是可以對應到 Ingenic JZ4760B 600MHz, 也就是 RS-97 掌機 (RetroGame), LDK GAME 掌機(小龍王)這一系列的等級, 當然 bankbank 和司徒是以 RISC-V 的軟件角度切入, 因此, 剛好可以趁機來看一下 RISC-V 跟 MIPS 的差距會有多大～

簡要規格

TRIMUI SMART

GAME GEAR Micro

Arduboy

FunKeyS (對不起只剩下屍體)

舊 3DS

正面

USB-TypeC、耳機孔

電源開關

R、MicroSD、L

音量開關

背面

拆掉類比搖桿帽子才可以提起A面

提起 A 面

A 面

屏

PCB

電源開關往下才可以取出 PCB

電池物品禁止發送到台灣，因此，司徒需要自行焊接電池，這個空間相當適合其它改造

正面

Allwinner F133 (D1s)

司徒

由於 KOF97 角色很多, 逆向需要花費相當多的時間去分析, 感謝 bankbank 的時間, , 於此同時, 司徒也會開始針對系統做移植, 而依照司徒的慣例, 都是先從硬件下手, 等待比較熟悉硬件後, 才會開始做移植的東西～感謝暈哥的開源文件, 將硬件原理圖開源出來, 原理圖設計得相當好, 如果有想要改版, 司徒這邊有一些想法, 或許可以參考一下

建議把CTRL拉到GPIO，方便用來控制雜音

MicroSD訊號沒有上拉電阻，因此，要注意PCB線長

GPIO都拉到獨立GPIO使用，避免鬼鍵問題，不過，可以使用晶片內部的提昇電阻，這樣可以減少電阻拉線

背光建議使用IC，避免壓降問題，屏使用RGB-565，建議找有TE(FRAME)的屏，這樣可以有效控制閃屏問題

司徒

司徒接著說明一下如何編譯 Tina-Linux 做聲音測試, 不過在編譯 Tina-Linux 之前, 我們先來看一下小志掌機的聲音電路

上圖是一般最常使用的聲音電路, 直接從晶片的聲音輸出(類比訊號)拉到功率放大器, 由於是類比訊號, 因此, 在走線的過程中, 很容易受到干擾, 這方面的佈線, 比較需要經驗的累積, 當然, 如果要有比較好的聲音效果, 一般建議使用專門的 Audio Codec 晶片, 而使用的介面可以使用 I2S or PCM, 訊號傳遞的部份使用數位訊號, 可以有效抑制雜訊, 如下圖所示, 不過缺點就是需要移植聲音驅動, 這部份也是比較費時～

司徒接著說明如何編譯 Tina-Linux for F133, 首先, 感謝 lovexulu 的協助，提供 Tina-Linux 的移植結果給司徒參考，由於 Tina-Linux 下載相當費時也比較麻煩，因此，司徒將其搬遷到 GitHub，編譯步驟如下：

$ cd
$ git clone https://github.com/steward-fu/tina-linux_sdk
$ cd tina-linux_sdk

$ wget https://github.com/steward-fu/archives/releases/download/f133/tina-linux_sdk_dl.7z.001
$ wget https://github.com/steward-fu/archives/releases/download/f133/tina-linux_sdk_dl.7z.002
$ wget https://github.com/steward-fu/archives/releases/download/f133/tina-linux_sdk_toolchain.tar.gz
$ tar xvf https://github.com/steward-fu/archives/releases/download/f133/tina-linux_sdk_toolchain.tar.gz
$ 7za x https://github.com/steward-fu/archives/releases/download/f133/tina-linux_sdk_dl.7z.001

$ source ./build/envsetup.sh
$ lunch
    You're building on Linux

    Lunch menu... pick a combo:
         1. d1-h_nezha_min-tina
         2. d1-h_nezha-tina
         3. d1s_nezha-tina

    Which would you like? [Default d1s_nezha]:3

$ make
$ pack
    /home/steward/Data/tina-linux_sdk/out/d1s-nezha/tina_d1s-nezha_uart4.img

    pack finish

燒錄步驟：

下載 https://github.com/steward-fu/archives/releases/download/f133/PhoenixCardv4.2.7.7z 並且解壓縮
執行 PhoenixCard.exe
選擇好 Image、Start up 後，按下 Burn 開始燒錄

燒錄完成

預設分區如下圖，如果想要使用自己編譯的 buildroot 系統，只要替換到 rootfs 分區就可以，不過預設只有 25MB

對 /dev/sdb8 進行擴充，這樣就可以放檔案進入測試

開機後，可以直接使用 adb shell 進入 console, 接著就可以手動測試聲音部份～

$ adb devices
    * daemon not running; starting now at tcp:5037
    * daemon started successfully
    List of devices attached
    20080411	device

$ adb shell
    BusyBox v1.27.2 () built-in shell (ash)

    ------run profile file-----
     _____  _              __     _
    |_   _||_| ___  _ _   |  |   |_| ___  _ _  _ _
      | |   _ |   ||   |  |  |__ | ||   || | ||_'_|
      | |  | || | || _ |  |_____||_||_|_||___||_,_|
      |_|  |_||_|_||_|_|  Tina is Based on OpenWrt!
     ----------------------------------------------
     Tina Linux (Neptune, 61CC0487)
     ----------------------------------------------
    nodev	debugfs
    root@TinaLinux:/#
    root@TinaLinux:/# mount /dev/mmcblk0p8 /mnt/UDISK/
    root@TinaLinux:/# amixer sset 'Headphone volume' 100%
        Simple mixer control 'Headphone volume',0
          Capabilities: volume volume-joined
          Playback channels: Mono
          Capture channels: Mono
          Limits: 0 - 7
          Mono: 7 [100%]
    root@TinaLinux:/# aplay /mnt/UDISK/ok.wav 
        Playing WAVE '/mnt/UDISK/ok.wav' : Signed 16 bit Little Endian, Rate 11025 Hz, Mono

如果不想手動編譯, 司徒這邊有做好的聲音測試檔案
https://github.com/steward-fu/archives/releases/download/f133/sound_test.img.7z
解開後, 使用 dd 命令燒錄到 MicroSD 卡後, 插入開機, 就會開始播放 Nokia 手機鈴聲～

司徒

@bankbank long time no see.
Please post the pinout information of the LCD panel and then we can decide how to connect it to F1C100S.

司徒

逆向工程並非用於破壞攻擊的目的, 取而代之, 它是一個可以更了解細節的技術, 以這樣的角度, 則逆向變得更有趣, 就如同 bankbank 介紹的過程一樣, 透過查看變數而知道一些細節, 或許有些人不好意思詢問 bankbank 問題, 因此, 司徒帶大家走一下步驟：

準備好 kof97.zip, neogeo.zip 後, 開啟 debug 模式

$ mame kof97.zip -debug -resolution 320x240

可以設定WatchPoint的地方

按下F11並且輸入wp 0x10843B,1,w，接著再按下F5執行

P2被攻擊後就會觸發中斷, 是不是很簡單～

bankbank 透過尋找出一些位址, 讓大家知道模擬器是如何知道一些細節, 這也是振動需要判斷的數值, 這些看似很高深的技術, 其實透過說明, 大家都可以很容易上手, 因此, 如何讓懷舊遊戲變得更有趣, 有時候, 你也可以好好思考如何讓你喜愛的遊戲變得更好玩, 這才是樂趣所在, 當然, 大家更應該正向來看待逆向工程技術, 而基於一些原因, 我們盡量點到就好, 相信 bankbank 之後會為我們帶來更好玩的東西～

司徒

UART 是嵌入式開發最常用來除錯的一個介面, 因此, 在開始移植 Boot Loader 或者 Linux Kernel 之前, 必須先確保 UART 可以正常工作, 接下來, 司徒將說明如何驗證 UART 的輸出功能, 目前司徒是直接在 PCB 上面焊上排針

接線方式

UART 連接到 PB2, PB3

PB2, PB3

GPIO Multiplex Function

CCU 位址

APB1 (HOSC 24MHz)

Baudrate Table (24MHz)

UART4 位址

UART 暫存器

main.s

    .global _start
 
    .equ CCU_BASE,   0x02001000
    .equ GPIO_BASE,  0x02000000
    .equ UART4_BASE, 0x02501000
 
    .equ PB_CFG0,      0x0030
    .equ UART_BGR_REG, 0x090c
 
    .equ RBR,  0x0000
    .equ THR,  0x0000
    .equ DLL,  0x0000
    .equ DLH,  0x0004
    .equ IER,  0x0004
    .equ IIR,  0x0008
    .equ LCR,  0x000c
    .equ MCR,  0x0010
    .equ LSR,  0x0014
    .equ USR,  0x007c
     
    .text
    .long 0x4000006f
    .byte 'e','G','O','N','.','B','T','0'
    .long 0x5F0A6C39
    .long 0x8000
    .long 0, 0
    .long 0, 0, 0, 0, 0, 0, 0, 0
    .long 0, 0, 0, 0, 0, 0, 0, 0
   
    .org 0x0400
_start:
    li t0, 0x7700
    li a0, GPIO_BASE + PB_CFG0
    sw t0, 0(a0)
 
    li t0, (1 << 20) | (1 << 4)
    li a0, CCU_BASE + UART_BGR_REG
    sw t0, 0(a0)
 
    li t0, 0
    li a0, UART4_BASE + IER
    sw t0, 0(a0)
     
    li t0, 0
    li a0, UART4_BASE + MCR
    sw t0, 0(a0)
     
    li a0, UART4_BASE + LCR
    lw t0, 0(a0)
    li t1, (1 << 7)
    or t0, t0, t1
    sw t0, 0(a0)
 
    li t0, 13
    li a0, UART4_BASE + DLL
    sw t0, 0(a0)
     
    li t0, 0
    li a0, UART4_BASE + DLH
    sw t0, 0(a0)
     
    li a0, UART4_BASE + LCR
    lw t0, 0(a0)
    li t1, ~(1 << 7)
    and t0, t0, t1
    sw t0, 0(a0)
    lw t0, 0(a0)
    li t1, ~(0x1f)
    and t0, t0, t1
    li t1, 0x03
    or t0, t0, t1
    sw t0, 0(a0)
 
    la a1, hello
0:
    li a0, UART4_BASE + LSR
    lw t0, 0(a0)
    li t1, (1 << 5)
    and t0, t0, t1
    beqz t0, 0b
 
    li t0, 0
    lb t0, 0(a1)
    li a0, UART4_BASE + THR
    sb t0, 0(a0)
 
    add a1, a1, 1
    bgtz t0, 0b
 
1:
    j 1b
 
    .align
hello: .asciz "Hello, world!"
    .end

完成

不過, 目前小志掌機的外殼缺少 UART 洞口, 因此, 司徒基於暈哥的外殼, 使用 OpenSCAD 改造一下

difference(){
    import("V20-bottom.stl");
    translate([-23, 10, -5]){
        cube([10, 10, 10]);
    }
}
 
translate([42.1, -4.5, -3]){
    cube([1.5, 3, 3]);
}
translate([42.1, 8.1, -3]){
    cube([1.5, 3, 3]);
}

UART位置

因為司徒的3D印表機精度不夠，只好補強音量鍵

3D印表機列印

還不錯

下邊

側邊

上邊

側邊

背面

司徒

@lovehex99
一般建議先去搞系統再去做移植, 感觸會比較深, 提供一些想法給你：

將 FunKeys rootfs 替換到 i.MX6 上面 (解開覆蓋掉原本的)
應該可以從 UART (serial port) 看到一些東西
開始看看系統裡面有什麼東西, 破壞它
如果 i.MX6 有 Framebuffer Driver, 你應該就可以看到顯示的畫面

做完上面的, 你這時候再去做移植或者重新編譯 OS, 將會有很深的體驗～

司徒

司徒接著說明如何驗證按鍵功能，不過，在進行按鍵驗證之前，我們必須先了解一下按鍵的一些細節，這樣才會更了解按鍵特性，一般掌機使用的按鍵，大部分都是使用十字鍵、4 個功能鍵、SELECT、START、L、R 等按鍵，這也是早期 Nintendo 掌機的標準配備，而用來耦合按鍵和 PCB 的橋樑則是以導電膠、鍋仔片為大宗，這些看似簡單的東西，其實背後隱藏的許多設計的小細節，司徒嘗試來解說一下過程，下圖是 NDSL 掌機的 PCB 圖片

從上圖可以發現一個設計小細節，十字鍵的 PCB 缺口，它的長相跟 4 個功能鍵並不一致，這是因為十字鍵是連通按鍵(上下左右連在一起)，而 4 個功能鍵則是各自分開的按鍵，因此，當十字鍵的其中一個方向被按下時，其餘方向也會受影響，因此 PCB 設計必須做些保護措施，避免鬼鍵的問題發生

司徒使用如下圖片說明一下鬼鍵發生的過程，當十字鍵的下方向被按下時，左、右方向的按鍵也會稍微往下傾斜，所以最壞的情況下，系統將會收到下、左、右三個按鍵的訊息

十字鍵正常位置

下方鍵被按下時，左、右方向的按鍵也往下傾斜，說明導電膠會有誤觸到 PCB 的狀況發生

因此，為了避免十字鍵的鬼鍵問題，十字鍵的 PCB 缺口必須依照方向做適當排列，這樣就可以避免誤觸的問題，如下圖所示，十字鍵的左右按鍵會設計成上下導通，而十字鍵的上下按鍵則會設計成左右導通

至於鍋仔片，由於導通點是位於中央，因此，十字鍵的鬼鍵問題得以改善

下圖是小志掌機使用的按鍵，由於按壓力道需要比較用力，因此，這種按鍵比較少用於掌機，不過，如果使用此類的按鍵，則需要注意彈跳的問題

一般按鍵使用彈片做導通，如下所示

因此，按下或者放開時，會有一段不穩定的彈跳時間，如下圖所示，這就是一般按鍵的彈跳問題

針對軟體的解法，可以延遲一段時間後，一般是 10ms，接著再判斷按鍵是否確實被按下

針對硬體的解法，最常見到的作法就是 RC 濾波，在按鍵旁邊加上電容，基於 10ms 計算，最常使用的是：10K 電阻 + 1uF 電容、47K 電阻 + 220nF 電容，透過電容的充、放電效應，來修飾爬升曲線

市面上，有些晶片已經有內建 Debounce 功能，這樣就可以很方便解決按鍵彈跳問題

當然，有些掌機會使用類比搖桿當作十字鍵使用，如：Caanoo 掌機(類比電阻)、Neo Geo Pocket 掌機(4 顆按鍵)，如果是使用 4 顆按鍵則可以使用如上的彈跳解法，但是，如果是使用類比電阻，則需要加入 Dead Zone 判斷，避免漂移問題

Dead Zone 一般用於無效區域設定，當類比搖桿的移動是處於這些區域時，則不會發送任何移動訊號，而類比搖桿最常遇到就是靜止不動時，搖桿自動漂移(鬼鍵問題)，因此，如果使用類比搖桿當作十字鍵使用時，記得加入 Dead Zone 判斷，避免漂移問題發生

按鍵電路

ASCII 字型

對應按鍵

main.s

    .global _start
 
    .equ GPIO_BASE,  0x02000000
    .equ PD_CFG0,    0x0090
    .equ PD_CFG1,    0x0094
    .equ PD_CFG2,    0x0098
    .equ PD_DAT,     0x00a0
    .equ PE_CFG0,    0x00c0
    .equ PE_CFG1,    0x00c4
    .equ PE_DAT,     0x00d0
 
    .equ LCD_RST,    (1 << 0)
    .equ LCD_WR,     (1 << 18)
    .equ LCD_RS,     (1 << 19)
    .equ LCD_RD,     (1 << 20)
    .equ LCD_CS,     (1 << 21)
    .equ LCD_BL,     (1 << 22)
 
    .equ _250MS,     50000000
    .equ _500MS,     100000000
    .equ _1S,        200000000
    .equ BG,         0x0000
    .equ FG,         0xffff
 
    .text
    .long 0x4000006f
    .byte 'e','G','O','N','.','B','T','0'
    .long 0x5F0A6C39
    .long 0x8000
    .long 0, 0
    .long 0, 0, 0, 0, 0, 0, 0, 0
    .long 0, 0, 0, 0, 0, 0, 0, 0
   
    .org 0x0400
_start:
    li t0, 0x00000000
    li a0, GPIO_BASE + PE_CFG0
    sw t0, 0(a0)
    li a0, GPIO_BASE + PE_CFG1
    sw t0, 0(a0)
 
    li t0, 0x11111111
    li a0, GPIO_BASE + PD_CFG0
    sw t0, 0(a0)
    li a0, GPIO_BASE + PD_CFG1
    sw t0, 0(a0)
    li a0, GPIO_BASE + PD_CFG2
    sw t0, 0(a0)
 
    li t0, 0xffffffff
    li a0, GPIO_BASE + PD_DAT
    sw t0, 0(a0)
 
    jal lcd_rst
 
    li t0, 0xb2
    jal lcd_cmd
    li t0, 0x5c
    jal lcd_dat
    li t0, 0x5c
    jal lcd_dat
    li t0, 0x00
    jal lcd_dat
    li t0, 0x33
    jal lcd_dat
    li t0, 0x33
    jal lcd_dat
     
    li t0, 0xb7
    jal lcd_cmd
    li t0, 0x35
    jal lcd_dat
     
    li t0, 0x21
    jal lcd_cmd
     
    li t0, 0x11
    jal lcd_cmd
 
    li t0, _250MS
    jal delay
 
    li t0, 0xe0
    jal lcd_cmd
    li t0, 0xd0
    jal lcd_dat
    li t0, 0x06
    jal lcd_dat
    li t0, 0x0b
    jal lcd_dat
    li t0, 0x07
    jal lcd_dat
    li t0, 0x07
    jal lcd_dat
    li t0, 0x24
    jal lcd_dat
    li t0, 0x2e
    jal lcd_dat
    li t0, 0x32
    jal lcd_dat
    li t0, 0x46
    jal lcd_dat
    li t0, 0x37
    jal lcd_dat
    li t0, 0x13
    jal lcd_dat
    li t0, 0x13
    jal lcd_dat
    li t0, 0x2d
    jal lcd_dat
    li t0, 0x33
    jal lcd_dat
     
    li t0, 0xe1
    jal lcd_cmd
    li t0, 0xd0
    jal lcd_dat
    li t0, 0x02
    jal lcd_dat
    li t0, 0x06
    jal lcd_dat
    li t0, 0x09
    jal lcd_dat
    li t0, 0x08
    jal lcd_dat
    li t0, 0x05
    jal lcd_dat
    li t0, 0x29
    jal lcd_dat
    li t0, 0x44
    jal lcd_dat
    li t0, 0x42
    jal lcd_dat
    li t0, 0x38
    jal lcd_dat
    li t0, 0x14
    jal lcd_dat
    li t0, 0x14
    jal lcd_dat
    li t0, 0x2a
    jal lcd_dat
    li t0, 0x30
    jal lcd_dat
     
    li t0, 0x36
    jal lcd_cmd
    li t0, 0xb0
    jal lcd_dat
     
    li t0, 0x2a
    jal lcd_cmd
    li t0, 0x00
    jal lcd_dat
    li t0, 0x00
    jal lcd_dat
    li t0, 0x01
    jal lcd_dat
    li t0, 0x3f
    jal lcd_dat
     
    li t0, 0x2b
    jal lcd_cmd
    li t0, 0x00
    jal lcd_dat
    li t0, 0x00
    jal lcd_dat
    li t0, 0x00
    jal lcd_dat
    li t0, 0xef
    jal lcd_dat
     
    li t0, 0x3a
    jal lcd_cmd
    li t0, 0x55
    jal lcd_dat
 
    li t0, 0x29
    jal lcd_cmd
     
    li t0, 0x2c
    jal lcd_cmd
 
loop:
    li a0, GPIO_BASE + PE_DAT
    lw t0, 0(a0)
 
    li t1, (1 << 0)
    and t1, t1, t0
    bgtz t1, 0f
    li t0, 30
    j draw
0:
    li t1, (1 << 7)
    and t1, t1, t0
    bgtz t1, 1f
    li t0, 31
    j draw
1:
    li t1, (1 << 4)
    and t1, t1, t0
    bgtz t1, 2f
    li t0, 16
    j draw
2:
    li t1, (1 << 6)
    and t1, t1, t0
    bgtz t1, 3f
    li t0, 17
    j draw
3:
    li t1, (1 << 12)
    and t1, t1, t0
    bgtz t1, 4f
    li t0, 'B'
    j draw
4:
    li t1, (1 << 11)
    and t1, t1, t0
    bgtz t1, 5f
    li t0, 'X'
    j draw
5:
    li t1, (1 << 1)
    and t1, t1, t0
    bgtz t1, 6f
    li t0, 'L'
    j draw
6:
    li t1, (1 << 10)
    and t1, t1, t0
    bgtz t1, 7f
    li t0, 'R'
    j draw
7:
    li t1, (1 << 2)
    and t1, t1, t0
    bgtz t1, 8f
    li t0, 'Y'
    j draw
8:
    li t1, (1 << 9)
    and t1, t1, t0
    bgtz t1, 9f
    li t0, 'T'
    j draw
9:
    li t1, (1 << 8)
    and t1, t1, t0
    bgtz t1, 10f
    li t0, 'S'
    j draw
10:
    li t1, (1 << 3)
    and t1, t1, t0
    bgtz t1, 11f
    li t0, 'M'
    j draw
11:
    li t1, (1 << 13)
    and t1, t1, t0
    bgtz t1, 12f
    li t0, 'A'
    j draw
12:
    li x8, 0
    li x9, 0
    jal set_pos
 
    li t6, 320 * 240
bg:
    li t0, BG
    jal lcd_dat
    addi t6, t6, -1
    bgtz t6, bg
 
    li t0, _250MS
    jal delay
    j loop
 
draw:
    sll t0, t0, 3
    la a3, font
    add a3, a3, t0
    li t6, 8
    li x8, 135
    li x9, 100
nbyte:
    li t5, 8
    lb a4, 0(a3)
    jal set_pos
byte:
    li t1, 0x80
    and t0, a4, t1
    sll a4, a4, 1
    beqz t0, w0
w1:
    li t0, FG
    jal lcd_dat
    li t0, FG
    jal lcd_dat
    li t0, FG
    jal lcd_dat
    li t0, FG
    jal lcd_dat
    j next
w0:
    li t0, BG
    jal lcd_dat
    li t0, BG
    jal lcd_dat
    li t0, BG
    jal lcd_dat
    li t0, BG
    jal lcd_dat
next:
    addi t5, t5, -1
    bgtz t5, byte
 
    add a3, a3, 1
    add x9, x9, 2
    addi t6, t6, -1
    bgtz t6, nbyte
    j loop
 
set_pos:
    move a2, ra
    li t0, 0x2a
    jal lcd_cmd
    li t0, 0
    jal lcd_dat
    move t0, x8
    jal lcd_dat
 
    li t0, 0x2b
    jal lcd_cmd
    li t0, 0
    jal lcd_dat
    move t0, x9
    jal lcd_dat
 
    li t0, 0x2c
    jal lcd_cmd
    jr a2
 
lcd_wr:
    li a0, GPIO_BASE + PD_DAT
 
    li t4, 0x00ff
    and t2, t0, t4
    li t4, 0xff00
    and t3, t0, t4
    sll t2, t2, 1
    sll t3, t3, 2
 
    move t4, t1
    or t4, t4, t2
    or t4, t4, t3
    sw t4, 0(a0)
 
    li t0, LCD_WR
    or t4, t4, t0
    sw t4, 0(a0)
    jr ra
 
lcd_dat:
    move a1, ra
    li t1, LCD_RS | LCD_RD | LCD_BL | LCD_RST
    jal lcd_wr
    jr a1
 
lcd_cmd:
    move a1, ra
    li t1, LCD_RD | LCD_BL | LCD_RST
    jal lcd_wr
    jr a1
 
lcd_rst:
    move a1, ra
    li t0, 0x00000000
    li a0, GPIO_BASE + PD_DAT
    sw t0, 0(a0)
 
    li t0, _250MS
    jal delay
 
    li t0, 0xffffffff
    li a0, GPIO_BASE + PD_DAT
    sw t0, 0(a0)
 
    li t0, _250MS
    jal delay
    jr a1
 
delay:
    addi t0, t0, -1
    bgtz t0, delay
    jr ra
 
font:
    .byte 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
    .byte 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
    .byte 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
    .byte 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
    .byte 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
    .byte 0x3C,0x42,0x99,0xBD,0xBD,0x99,0x42,0x3C,0x3C,0x42,0x81,0x81,0x81,0x81,0x42,0x3C
    .byte 0xFE,0x82,0x8A,0xD2,0xA2,0x82,0xFE,0x00,0xFE,0x82,0x82,0x82,0x82,0x82,0xFE,0x00
    .byte 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x38,0x64,0x74,0x7C,0x38,0x00,0x00
    .byte 0x80,0xC0,0xF0,0xFC,0xF0,0xC0,0x80,0x00,0x01,0x03,0x0F,0x3F,0x0F,0x03,0x01,0x00
    .byte 0x18,0x3C,0x7E,0x18,0x7E,0x3C,0x18,0x00,0xEE,0xEE,0xEE,0xCC,0x00,0xCC,0xCC,0x00
    .byte 0x00,0x00,0x30,0x68,0x78,0x30,0x00,0x00,0x00,0x38,0x64,0x74,0x7C,0x38,0x00,0x00
    .byte 0x3C,0x66,0x7A,0x7A,0x7E,0x7E,0x3C,0x00,0x0E,0x3E,0x3A,0x22,0x26,0x6E,0xE4,0x40
    .byte 0x18,0x3C,0x7E,0x3C,0x3C,0x3C,0x3C,0x00,0x3C,0x3C,0x3C,0x3C,0x7E,0x3C,0x18,0x00
    .byte 0x08,0x7C,0x7E,0x7E,0x7C,0x08,0x00,0x00,0x10,0x3E,0x7E,0x7E,0x3E,0x10,0x00,0x00
    .byte 0x58,0x2A,0xDC,0xC8,0xDC,0x2A,0x58,0x00,0x24,0x66,0xFF,0xFF,0x66,0x24,0x00,0x00
    .byte 0x00,0x10,0x10,0x38,0x38,0x7C,0xFE,0x00,0xFE,0x7C,0x38,0x38,0x10,0x10,0x00,0x00
    .byte 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x1C,0x1C,0x1C,0x18,0x00,0x18,0x18,0x00
    .byte 0x6C,0x6C,0x24,0x00,0x00,0x00,0x00,0x00,0x00,0x28,0x7C,0x28,0x7C,0x28,0x00,0x00
    .byte 0x10,0x38,0x60,0x38,0x0C,0x78,0x10,0x00,0x40,0xA4,0x48,0x10,0x24,0x4A,0x04,0x00
    .byte 0x18,0x34,0x18,0x3A,0x6C,0x66,0x3A,0x00,0x18,0x18,0x20,0x00,0x00,0x00,0x00,0x00
    .byte 0x30,0x60,0x60,0x60,0x60,0x60,0x30,0x00,0x0C,0x06,0x06,0x06,0x06,0x06,0x0C,0x00
    .byte 0x10,0x54,0x38,0x7C,0x38,0x54,0x10,0x00,0x00,0x18,0x18,0x7E,0x18,0x18,0x00,0x00
    .byte 0x00,0x00,0x00,0x00,0x18,0x18,0x30,0x00,0x00,0x00,0x00,0x00,0x3E,0x00,0x00,0x00
    .byte 0x00,0x00,0x00,0x00,0x18,0x18,0x00,0x00,0x00,0x04,0x08,0x10,0x20,0x40,0x00,0x00
    .byte 0x38,0x4C,0xC6,0xC6,0xC6,0x64,0x38,0x00,0x18,0x38,0x18,0x18,0x18,0x18,0x7E,0x00
    .byte 0x7C,0xC6,0x0E,0x3C,0x78,0xE0,0xFE,0x00,0x7E,0x0C,0x18,0x3C,0x06,0xC6,0x7C,0x00
    .byte 0x1C,0x3C,0x6C,0xCC,0xFE,0x0C,0x0C,0x00,0xFC,0xC0,0xFC,0x06,0x06,0xC6,0x7C,0x00
    .byte 0x3C,0x60,0xC0,0xFC,0xC6,0xC6,0x7C,0x00,0xFE,0xC6,0x0C,0x18,0x30,0x30,0x30,0x00
    .byte 0x78,0xC4,0xE4,0x78,0x86,0x86,0x7C,0x00,0x7C,0xC6,0xC6,0x7E,0x06,0x0C,0x78,0x00
    .byte 0x00,0x00,0x18,0x00,0x00,0x18,0x00,0x00,0x00,0x00,0x18,0x00,0x00,0x18,0x18,0x30
    .byte 0x1C,0x38,0x70,0xE0,0x70,0x38,0x1C,0x00,0x00,0x7C,0x00,0x00,0x7C,0x00,0x00,0x00
    .byte 0x70,0x38,0x1C,0x0E,0x1C,0x38,0x70,0x00,0x7C,0xC6,0xC6,0x1C,0x18,0x00,0x18,0x00
    .byte 0x3C,0x42,0x99,0xA1,0xA5,0x99,0x42,0x3C,0x38,0x6C,0xC6,0xC6,0xFE,0xC6,0xC6,0x00
    .byte 0xFC,0xC6,0xC6,0xFC,0xC6,0xC6,0xFC,0x00,0x3C,0x66,0xC0,0xC0,0xC0,0x66,0x3C,0x00
    .byte 0xF8,0xCC,0xC6,0xC6,0xC6,0xCC,0xF8,0x00,0xFE,0xC0,0xC0,0xFC,0xC0,0xC0,0xFE,0x00
    .byte 0xFE,0xC0,0xC0,0xFC,0xC0,0xC0,0xC0,0x00,0x3E,0x60,0xC0,0xCE,0xC6,0x66,0x3E,0x00
    .byte 0xC6,0xC6,0xC6,0xFE,0xC6,0xC6,0xC6,0x00,0x7E,0x18,0x18,0x18,0x18,0x18,0x7E,0x00
    .byte 0x06,0x06,0x06,0x06,0xC6,0xC6,0x7C,0x00,0xC6,0xCC,0xD8,0xF0,0xF8,0xDC,0xCE,0x00
    .byte 0x60,0x60,0x60,0x60,0x60,0x60,0x7E,0x00,0xC6,0xEE,0xFE,0xFE,0xD6,0xC6,0xC6,0x00
    .byte 0xC6,0xE6,0xF6,0xFE,0xDE,0xCE,0xC6,0x00,0x7C,0xC6,0xC6,0xC6,0xC6,0xC6,0x7C,0x00
    .byte 0xFC,0xC6,0xC6,0xC6,0xFC,0xC0,0xC0,0x00,0x7C,0xC6,0xC6,0xC6,0xDE,0xCC,0x7A,0x00
    .byte 0xFC,0xC6,0xC6,0xCE,0xF8,0xDC,0xCE,0x00,0x78,0xCC,0xC0,0x7C,0x06,0xC6,0x7C,0x00
    .byte 0x7E,0x18,0x18,0x18,0x18,0x18,0x18,0x00,0xC6,0xC6,0xC6,0xC6,0xC6,0xC6,0x7C,0x00
    .byte 0xC6,0xC6,0xC6,0xEE,0x7C,0x38,0x10,0x00,0xC6,0xC6,0xD6,0xFE,0xFE,0xEE,0xC6,0x00
    .byte 0xC6,0xEE,0x3C,0x38,0x7C,0xEE,0xC6,0x00,0x66,0x66,0x66,0x3C,0x18,0x18,0x18,0x00
    .byte 0xFE,0x0E,0x1C,0x38,0x70,0xE0,0xFE,0x00,0x3C,0x30,0x30,0x30,0x30,0x30,0x3C,0x00
    .byte 0x60,0x60,0x30,0x18,0x0C,0x06,0x06,0x00,0x3C,0x0C,0x0C,0x0C,0x0C,0x0C,0x3C,0x00
    .byte 0x18,0x3C,0x66,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xFF
    .byte 0x30,0x30,0x18,0x00,0x00,0x00,0x00,0x00,0x00,0x3C,0x06,0x3E,0x66,0x66,0x3C,0x00
    .byte 0x60,0x7C,0x66,0x66,0x66,0x66,0x7C,0x00,0x00,0x3C,0x66,0x60,0x60,0x66,0x3C,0x00
    .byte 0x06,0x3E,0x66,0x66,0x66,0x66,0x3E,0x00,0x00,0x3C,0x66,0x66,0x7E,0x60,0x3C,0x00
    .byte 0x1C,0x30,0x78,0x30,0x30,0x30,0x30,0x00,0x00,0x3E,0x66,0x66,0x66,0x3E,0x06,0x3C
    .byte 0x60,0x7C,0x76,0x66,0x66,0x66,0x66,0x00,0x18,0x00,0x38,0x18,0x18,0x18,0x18,0x00
    .byte 0x0C,0x00,0x1C,0x0C,0x0C,0x0C,0x0C,0x38,0x60,0x60,0x66,0x6C,0x78,0x6C,0x66,0x00
    .byte 0x38,0x18,0x18,0x18,0x18,0x18,0x18,0x00,0x00,0xEC,0xFE,0xFE,0xFE,0xD6,0xC6,0x00
    .byte 0x00,0x7C,0x76,0x66,0x66,0x66,0x66,0x00,0x00,0x3C,0x66,0x66,0x66,0x66,0x3C,0x00
    .byte 0x00,0x7C,0x66,0x66,0x66,0x7C,0x60,0x60,0x00,0x3E,0x66,0x66,0x66,0x3E,0x06,0x06
    .byte 0x00,0x7E,0x70,0x60,0x60,0x60,0x60,0x00,0x00,0x3C,0x60,0x3C,0x06,0x66,0x3C,0x00
    .byte 0x30,0x78,0x30,0x30,0x30,0x30,0x1C,0x00,0x00,0x66,0x66,0x66,0x66,0x6E,0x3E,0x00
    .byte 0x00,0x66,0x66,0x66,0x66,0x3C,0x18,0x00,0x00,0xC6,0xD6,0xFE,0xFE,0x7C,0x6C,0x00
    .byte 0x00,0x66,0x3C,0x18,0x3C,0x66,0x66,0x00,0x00,0x66,0x66,0x66,0x66,0x3E,0x06,0x3C
    .byte 0x00,0x7E,0x0C,0x18,0x30,0x60,0x7E,0x00,0x0E,0x18,0x0C,0x38,0x0C,0x18,0x0E,0x00
    .byte 0x18,0x18,0x18,0x00,0x18,0x18,0x18,0x00,0x70,0x18,0x30,0x1C,0x30,0x18,0x70,0x00
    .byte 0x00,0x00,0x76,0xDC,0x00,0x00,0x00,0x00,0x10,0x28,0x10,0x54,0xAA,0x44,0x00,0x00
    .end

完成

司徒

@newcastle 是地～正是小弟本人～

雖然之前說不玩寨機, 不過我還是偷偷玩, 哈哈～只是以後我不再釋出任何研究成果, 就我自己玩而已, 哈～

目前是玩 TRIMUI SMART寨機 (Allwinner S3 + RAM 128MB + eMMC 8GB + RTL8723DS), 目前還在逆向研究中, 預期要讓它跑 Linux Kernel + 精簡客製化的 Debian 桌面, 主要是想跑 WINE(arm32) 的逆向遊戲, 網址：https://steward-fu.github.io/website/handheld.htm#trimui-smart

然後, 之前有一個特別的想法, 想做一台特別的掌機, 用來懷念小時候的樂趣, 目前可能鎖定 RISC-V 晶片, 只是用哪家, 目前還在觀望, 所以我才發貼問一下是否可以寫其它家晶片的問題～哈

司徒

司徒畫了一張Framebuffer的流程圖，這樣可以更知道整個Framebuffer Driver的運作，至於司徒為何還是使用Framebuffer Driver而不是其它更新的Video Driver Model呢？因為太難的司徒也不會...

司徒

司徒看了一下目前Tina-Linux裡面的Video Framebuffer Driver，發現這個Video Driver是為了可以透過初始化參數的設定就可以點屏，架構相對來說比較複雜一點，對於初期可以很快拿來使用，但是後期我們要做最佳化時，會變成是一個瓶頸，司徒覺得不適合我們短小精幹的小志掌機，為此，司徒將小志掌機的顯示驅動拆成如下三個階段製作：

階段一：使用I/O Toggle方式顯示
階段二：使用DMA方式顯示
階段三：加上INT中斷掃屏

framebuffer位於drivers/video/fbdev資料夾，因此，我們創建一個新檔案st7789.c

/*
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option)any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */

#include <linux/cdev.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/fb.h>
#include <linux/dma-mapping.h>
#include <linux/device.h>
#include <linux/backlight.h>
#include <linux/platform_device.h>
#include <linux/uaccess.h>
#include <linux/pm_runtime.h>
#include <linux/interrupt.h>
#include <linux/wait.h>
#include <linux/clk.h>
#include <linux/cpufreq.h>
#include <linux/console.h>
#include <linux/spinlock.h>
#include <linux/slab.h>
#include <linux/delay.h>
#include <linux/lcm.h>
#include <linux/clk-provider.h>
#include <video/of_display_timing.h>
#include <linux/gpio.h>
#include <linux/omapfb.h>
#include <linux/compiler.h>
#include <linux/workqueue.h>
#include <linux/sched.h>
#include <asm/io.h>
#include <asm/irq.h>

#define PALETTE_SIZE    256
#define DRIVER_NAME     "gaviar-fb"
#define GPIO_BASE       0x02000000
#define PD_CFG0         0x0090
#define PD_CFG1         0x0094
#define PD_CFG2         0x0098
#define PD_DAT          0x00a0
#define LCD_RST         (1 << 0)
#define LCD_WR          (1 << 18)
#define LCD_RS          (1 << 19)
#define LCD_RD          (1 << 20)
#define LCD_CS          (1 << 21)
#define LCD_BL          (1 << 22)

struct myfb_par {
    struct device *dev;
    struct platform_device *pdev;
    void *vram_virt;
    uint32_t vram_size;
    dma_addr_t vram_phys;
    u32 pseudo_palette[16];
    struct fb_videomode mode;
};

struct iomm {
    uint8_t *gpio;
};

static struct iomm myio = { 0 };
static struct fb_var_screeninfo myfb_var = { 0 };
static struct fb_fix_screeninfo myfb_fix = {
    .id = DRIVER_NAME,
    .type = FB_TYPE_PACKED_PIXELS,
    .type_aux = 0,
    .visual = FB_VISUAL_TRUECOLOR,
    .xpanstep = 0,
    .ypanstep = 1,
    .ywrapstep = 0,
    .accel = FB_ACCEL_NONE
};

static void lcd_write(uint32_t ctl, uint32_t dat)
{
    uint32_t r = ctl | ((dat & 0xff) << 1) | ((dat & 0xff00) << 2);

    writel(r, myio.gpio + PD_DAT);
    r |= LCD_WR;
    writel(r, myio.gpio + PD_DAT);
}

static void lcd_write_cmd(uint32_t cmd)
{
    lcd_write(LCD_RD | LCD_BL | LCD_RST, cmd);
}

static void lcd_write_dat(uint32_t dat)
{
    lcd_write(LCD_RS | LCD_RD | LCD_BL | LCD_RST, dat);
}

static void lcd_reset(void)
{
    uint32_t r = 0;

    r = readl(myio.gpio + PD_DAT);
    r &= ~LCD_RST;
    writel(r, myio.gpio + PD_DAT);
    mdelay(150);

    r |= LCD_RST;
    writel(r, myio.gpio + PD_DAT);
    mdelay(150);
}

static int lcd_init(struct myfb_par *mypar)
{
    writel(0x11111111, myio.gpio + PD_CFG0);
    writel(0x11111111, myio.gpio + PD_CFG1);
    writel(0x11111111, myio.gpio + PD_CFG2);
    writel(0xffffffff, myio.gpio + PD_DAT);

    lcd_reset();
    lcd_write_cmd(0xb2);
    lcd_write_dat(0x5c);
    lcd_write_dat(0x5c);
    lcd_write_dat(0x00);
    lcd_write_dat(0x33);
    lcd_write_dat(0x33);

    lcd_write_cmd(0xb7);
    lcd_write_dat(0x35);

    lcd_write_cmd(0x21);

    lcd_write_cmd(0x11);

    mdelay(150);

    lcd_write_cmd(0xe0);
    lcd_write_dat(0xd0);
    lcd_write_dat(0x06);
    lcd_write_dat(0x0b);
    lcd_write_dat(0x07);
    lcd_write_dat(0x07);
    lcd_write_dat(0x24);
    lcd_write_dat(0x2e);
    lcd_write_dat(0x32);
    lcd_write_dat(0x46);
    lcd_write_dat(0x37);
    lcd_write_dat(0x13);
    lcd_write_dat(0x13);
    lcd_write_dat(0x2d);
    lcd_write_dat(0x33);

    lcd_write_cmd(0xe1);
    lcd_write_dat(0xd0);
    lcd_write_dat(0x02);
    lcd_write_dat(0x06);
    lcd_write_dat(0x09);
    lcd_write_dat(0x08);
    lcd_write_dat(0x05);
    lcd_write_dat(0x29);
    lcd_write_dat(0x44);
    lcd_write_dat(0x42);
    lcd_write_dat(0x38);
    lcd_write_dat(0x14);
    lcd_write_dat(0x14);
    lcd_write_dat(0x2a);
    lcd_write_dat(0x30);

    lcd_write_cmd(0x36);
    lcd_write_dat(0xb0);

    lcd_write_cmd(0x2a);
    lcd_write_dat(0x00);
    lcd_write_dat(0x00);
    lcd_write_dat(0x01);
    lcd_write_dat(0x3f);

    lcd_write_cmd(0x2b);
    lcd_write_dat(0x00);
    lcd_write_dat(0x00);
    lcd_write_dat(0x00);
    lcd_write_dat(0xef);

    lcd_write_cmd(0x3a);
    lcd_write_dat(0x55);

    lcd_write_cmd(0x29);
    lcd_write_cmd(0x2c);

    {
        int i = 0;
        uint16_t *p = mypar->vram_virt;

        for (i = 0; i < 320 * 240; i++) {
            lcd_write_dat(*p++);
        }
    }

    return 0;
}

static int myfb_setcolreg(unsigned n, unsigned r, unsigned g, unsigned b, unsigned t, struct fb_info *info)
{
    #define CNVT_TOHW(val, width) ((((val) << (width)) + 0x7FFF - (val)) >> 16)
    r = CNVT_TOHW(r, info->var.red.length);
    b = CNVT_TOHW(b, info->var.blue.length);
    g = CNVT_TOHW(g, info->var.green.length);

    ((u32 *)(info->pseudo_palette))[n] =
        (r << info->var.red.offset) |
        (g << info->var.green.offset) |
        (b << info->var.blue.offset);

    return 0;
}

static int myfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
{
    int bpp = var->bits_per_pixel >> 3;
    struct myfb_par *par = info->par;
    unsigned long line_size = var->xres_virtual * bpp;

    if ((var->xres != 320) || (var->yres != 240) || (var->bits_per_pixel != 16)) {
        return -EINVAL;
    }

    var->transp.offset = 0;
    var->transp.length = 0;
    var->red.offset = 11;
    var->red.length = 5;
    var->green.offset = 5;
    var->green.length = 6;
    var->blue.offset = 0;
    var->blue.length = 5;
    var->red.msb_right = 0;
    var->green.msb_right = 0;
    var->blue.msb_right = 0;
    var->transp.msb_right = 0;

    if (line_size * var->yres_virtual > par->vram_size) {
        var->yres_virtual = par->vram_size / line_size;
    }
    if (var->yres > var->yres_virtual) {
        var->yres = var->yres_virtual;
    }
    if (var->xres > var->xres_virtual) {
        var->xres = var->xres_virtual;
    }
    if (var->xres + var->xoffset > var->xres_virtual) {
        var->xoffset = var->xres_virtual - var->xres;
    }
    if (var->yres + var->yoffset > var->yres_virtual) {
        var->yoffset = var->yres_virtual - var->yres;
    }
    return 0;
}

static int myfb_set_par(struct fb_info *info)
{
    struct myfb_par *par = info->par;

    fb_var_to_videomode(&par->mode, &info->var);
    info->fix.visual = FB_VISUAL_TRUECOLOR;
    info->fix.line_length = 320 * 2;

    return 0;
}

static int myfb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info)
{
    info->var.xoffset = var->xoffset;
    info->var.yoffset = var->yoffset;

    return 0;
}

static struct fb_ops myfb_ops = {
    .owner          = THIS_MODULE,
    .fb_check_var   = myfb_check_var,
    .fb_set_par     = myfb_set_par,
    .fb_setcolreg   = myfb_setcolreg,
    .fb_pan_display = myfb_pan_display,

    .fb_fillrect  = sys_fillrect,
    .fb_copyarea  = sys_copyarea,
    .fb_imageblit = sys_imageblit,
};

static int myfb_probe(struct platform_device *device)
{
    int ret = 0;
    struct fb_info *info = NULL;
    struct myfb_par *par = NULL;
    struct fb_videomode *mode = NULL;

    mode = devm_kzalloc(&device->dev, sizeof(struct fb_videomode), GFP_KERNEL);
    if (mode == NULL) {
        return -ENOMEM;
    }
    mode->name = "320x240";
    mode->xres = 320;
    mode->yres = 240;
    mode->vmode = FB_VMODE_NONINTERLACED;
    pm_runtime_enable(&device->dev);
    pm_runtime_get_sync(&device->dev);

    info = framebuffer_alloc(sizeof(struct myfb_par), &device->dev);
    if (!info) {
        return -ENOMEM;
    }

    par = info->par;
    par->pdev = device;
    par->dev = &device->dev;
    fb_videomode_to_var(&myfb_var, mode);

    par->vram_size = (320 * 240 * 2 * 4) + 4096;
    par->vram_virt = dma_alloc_coherent(&device->dev, par->vram_size, (resource_size_t *)&par->vram_phys, GFP_KERNEL | GFP_DMA);
    if (!par->vram_virt) {
        return -EINVAL;
    }
    info->screen_base = (char __iomem *)par->vram_virt;
    myfb_fix.smem_start = par->vram_phys;
    myfb_fix.smem_len = par->vram_size;
    myfb_fix.line_length = 320 * 2;
    myfb_var.grayscale = 0;
    myfb_var.bits_per_pixel = 16;

    info->flags = FBINFO_FLAG_DEFAULT;
    info->fix = myfb_fix;
    info->var = myfb_var;
    info->fbops = &myfb_ops;
    info->pseudo_palette = par->pseudo_palette;
    info->fix.visual = (info->var.bits_per_pixel <= 8) ? FB_VISUAL_PSEUDOCOLOR : FB_VISUAL_TRUECOLOR;
    ret = fb_alloc_cmap(&info->cmap, PALETTE_SIZE, 0);
    if (ret) {
        return -EINVAL;
    }
    info->cmap.len = 32;

    myfb_var.activate = FB_ACTIVATE_FORCE;
    fb_set_var(info, &myfb_var);
    dev_set_drvdata(&device->dev, info);
    if (register_framebuffer(info) < 0) {
        return -EINVAL;
    }
    lcd_init(par);

    return 0;
}

static int myfb_remove(struct platform_device *dev)
{
    struct fb_info *info = dev_get_drvdata(&dev->dev);
    struct myfb_par *par = info->par;

    if (info) {
        flush_scheduled_work();
        unregister_framebuffer(info);
        fb_dealloc_cmap(&info->cmap);
        dma_free_coherent(NULL, par->vram_size, par->vram_virt, par->vram_phys);
        framebuffer_release(info);
    }
    iounmap(myio.gpio);

    return 0;
}

static int myfb_suspend(struct platform_device *dev, pm_message_t state)
{
    struct fb_info *info = platform_get_drvdata(dev);

    console_lock();
    fb_set_suspend(info, 1);
    pm_runtime_put_sync(&dev->dev);
    console_unlock();

    return 0;
}

static int myfb_resume(struct platform_device *dev)
{
    struct fb_info *info = platform_get_drvdata(dev);

    console_lock();
    pm_runtime_get_sync(&dev->dev);
    fb_set_suspend(info, 0);
    console_unlock();

    return 0;
}

static const struct of_device_id fb_of_match[] = { { .compatible = "allwinner,sunxi-disp" }, {} };
MODULE_DEVICE_TABLE(of, fb_of_match);

static struct platform_driver fb_driver = {
    .probe    = myfb_probe,
    .remove   = myfb_remove,
    .suspend  = myfb_suspend,
    .resume   = myfb_resume,
    .driver = {
        .name   = DRIVER_NAME,
        .owner  = THIS_MODULE,
        .of_match_table = of_match_ptr(fb_of_match),
    },
};

static void sunxi_ioremap(void)
{    
    myio.gpio = (uint8_t *)ioremap(GPIO_BASE, 1024);
}

static void sunxi_iounmap(void)
{
    iounmap(myio.gpio);
}

static int __init myfb_init(void)
{
    sunxi_ioremap();
    return platform_driver_register(&fb_driver);
}

static void __exit myfb_cleanup(void)
{
    platform_driver_unregister(&fb_driver);
    sunxi_iounmap();
}

module_init(myfb_init);
module_exit(myfb_cleanup);

MODULE_DESCRIPTION("framebuffer driver for Gaviar handheld");
MODULE_AUTHOR("Steward Fu <steward.fu@gmail.com>");
MODULE_LICENSE("GPL");

drivers/video/fbdev/Kconfig

config FB_ST7789
    tristate "ST7789 framebuffer support"
    depends on FB
    select FB_SYS_FOPS
    select FB_SYS_FILLRECT
    select FB_SYS_COPYAREA
    select FB_SYS_IMAGEBLIT
    ---help---
      Frame buffer driver for the Gaviar handheld

drivers/video/fbdev/Makefile

obj-$(CONFIG_FB_ST7789) += st7789.o

選擇ST7789

編譯下載後就可以看到Linux Boot Logo

如果不想手動編譯，可以使用司徒做好的測試Image，如果要自己手動編譯，Commit使用44f254c025465ea58a2f024482f572f59567cb2b

$ cd
$ wget https://github.com/steward-fu/website/releases/download/gaviar/kernel_test_20260912.img
$ sudo dd if=kernel_test_20260912.img of=/dev/sdX bs=1M

司徒

Kernel Crash 問題已經解決，但是從 Log 的結果來看，Kernel 並沒有進入到最後的階段，因為我們尚未描述 rootfs 位置，理應有 VFS Crash 的 Log 才對，所以我們還要繼續追問題

ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
sunxi-ehci: EHCI SUNXI driver
get ehci0-controller wakeup-source is fail.
sunxi ehci0-controller don't init wakeup source
[sunxi-ehci0]: probe, pdev->name: 4101000.ehci0-controller, sunxi_ehci: 0xffffffe00051a130, 0x:ffffffd004078000, irq_no:2e
[sunxi-ehci0]: Not init ehci0
get ehci1-controller wakeup-source is fail.
sunxi ehci1-controller don't init wakeup source
[sunxi-ehci1]: probe, pdev->name: 4200000.ehci1-controller, sunxi_ehci: 0xffffffe00051a8c0, 0x:ffffffd00407c000, irq_no:31
sunxi-ehci 4200000.ehci1-controller: 4200000.ehci1-controller supply drvvbus not found, using dummy regulator
sunxi-ehci 4200000.ehci1-controller: 4200000.ehci1-controller supply hci not found, using dummy regulator
sunxi-ehci 4200000.ehci1-controller: EHCI Host Controller
sunxi-ehci 4200000.ehci1-controller: new USB bus registered, assigned bus number 1
sunxi-ehci 4200000.ehci1-controller: irq 49, io mem 0x04200000

先把 USB 的 DTS 描述進行關閉來定位問題

&ehci0 {
    status = "disabled";
};

&ohci0 {
    status = "disabled";
};

關閉後的 Kernel Log

ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
sunxi-ehci: EHCI SUNXI driver
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
sunxi-ohci: OHCI SUNXI driver
usbcore: registered new interface driver uas
usbcore: registered new interface driver usb-storage
sunxi-rtc 7090000.rtc: errata__fix_alarm_day_reg_default_value(): ALARM0_DAY_REG=0, set it to 1
sunxi-rtc 7090000.rtc: Warning: Using internal RC 16M clock source. Time may be inaccurate!
sunxi-rtc 7090000.rtc: Warning: Using internal RC 16M clock source. Time may be inaccurate!
sunxi-rtc 7090000.rtc: Warning: Using internal RC 16M clock source. Time may be inaccurate!
sunxi-rtc 7090000.rtc: registered as rtc0
sunxi-rtc 7090000.rtc: Warning: Using internal RC 16M clock source. Time may be inaccurate!
sunxi-rtc 7090000.rtc: setting system clock to 1970-01-01T00:00:11 UTC (11)
sunxi-rtc 7090000.rtc: sunxi rtc probed
i2c /dev entries driver
sunxi-mmc 4020000.sdmmc: SD/MMC/SDIO Host Controller Driver(v4.25 2022-6-21 13:40)
sunxi-mmc 4020000.sdmmc: ***ctl-spec-caps*** 8
sunxi-mmc 4020000.sdmmc: No vmmc regulator found
sunxi-mmc 4020000.sdmmc: No vqmmc regulator found
sunxi-mmc 4020000.sdmmc: No vdmmc regulator found
sunxi-mmc 4020000.sdmmc: No vd33sw regulator found
sunxi-mmc 4020000.sdmmc: No vd18sw regulator found
sunxi-mmc 4020000.sdmmc: No vq33sw regulator found
sunxi-mmc 4020000.sdmmc: No vq18sw regulator found
sunxi-mmc 4020000.sdmmc: Got CD GPIO
sunxi-mmc 4020000.sdmmc: set cd-gpios as 24M fail
sunxi-mmc 4020000.sdmmc: sdc set ios:clk 0Hz bm PP pm UP vdd 21 width 1 timing LEGACY(SDR12) dt B
sunxi-mmc 4020000.sdmmc: no vqmmc,Check if there is regulator

接著在 Kernel menuconfig 也將 MMC 關閉，DTS 裡面除了 UART4 的 SDC 也關閉

misc dump reg init
brd: module loaded
loop: module loaded
i2c /dev entries driver
ashmem: initialized

但是 Kernel 還是沒有進入載入 init 的階段，因此，從 initcall 印出 Log

$ vim init/main.c
    1012 static void __init do_initcall_level(int level)
    1013 {
    1014     int ret = 0;
    1015     initcall_entry_t *fn;
    1016 
    1017     strcpy(initcall_command_line, saved_command_line);
    1018     parse_args(initcall_level_names[level],
    1019            initcall_command_line, __start___param,
    1020            __stop___param - __start___param,
    1021            level, level,
    1022            NULL, &repair_env_string);
    1023 
    1024     trace_initcall_level(initcall_level_names[level]);
    1025     for (fn = initcall_levels[level]; fn < initcall_levels[level+1]; fn++) {
    1026         printk("### INITCALL BEGIN: level=%d fn=%ps ###\n", level, initcall_from_entry(fn));
    1027         do_one_initcall(initcall_from_entry(fn));
    1028         printk("### INITCALL END: level=%d fn=%ps ret=%d ###\n", level, initcall_from_entry(fn), ret);
    1029     }
    1030 }

最後出問題的地方在 clk_disable_unused

### INITCALL END: level=6 fn=i2c_dev_init ret=0 ###
### INITCALL BEGIN: level=6 fn=sunxi_led_driver_init ###
### INITCALL END: level=6 fn=sunxi_led_driver_init ret=0 ###
### INITCALL BEGIN: level=6 fn=timer_led_trigger_init ###
### INITCALL END: level=6 fn=timer_led_trigger_init ret=0 ###
### INITCALL BEGIN: level=6 fn=defon_led_trigger_init ###
### INITCALL END: level=6 fn=defon_led_trigger_init ret=0 ###
### INITCALL BEGIN: level=6 fn=ashmem_init ###
### INITCALL END: level=6 fn=ashmem_init ret=0 ###
### INITCALL BEGIN: level=6 fn=sunxi_sid_driver_init ###
### INITCALL END: level=6 fn=sunxi_sid_driver_init ret=0 ###
### INITCALL BEGIN: level=7 fn=init_oops_id ###
### INITCALL END: level=7 fn=init_oops_id ret=0 ###
### INITCALL BEGIN: level=7 fn=pm_qos_power_init ###
### INITCALL END: level=7 fn=pm_qos_power_init ret=0 ###
### INITCALL BEGIN: level=7 fn=pm_debugfs_init ###
### INITCALL END: level=7 fn=pm_debugfs_init ret=0 ###
### INITCALL BEGIN: level=7 fn=wakeup_reason_init ###
### INITCALL END: level=7 fn=wakeup_reason_init ret=0 ###
### INITCALL BEGIN: level=7 fn=printk_late_init ###
### INITCALL END: level=7 fn=printk_late_init ret=0 ###
### INITCALL BEGIN: level=7 fn=init_srcu_module_notifier ###
### INITCALL END: level=7 fn=init_srcu_module_notifier ret=0 ###
### INITCALL BEGIN: level=7 fn=tk_debug_sleep_time_init ###
### INITCALL END: level=7 fn=tk_debug_sleep_time_init ret=0 ###
### INITCALL BEGIN: level=7 fn=fault_around_debugfs ###
### INITCALL END: level=7 fn=fault_around_debugfs ret=0 ###
### INITCALL BEGIN: level=7 fn=max_swapfiles_check ###
### INITCALL END: level=7 fn=max_swapfiles_check ret=0 ###
### INITCALL BEGIN: level=7 fn=prandom_reseed ###
### INITCALL END: level=7 fn=prandom_reseed ret=0 ###
### INITCALL BEGIN: level=7 fn=clk_debug_init ###
### INITCALL END: level=7 fn=clk_debug_init ret=0 ###
### INITCALL BEGIN: level=7 fn=sync_state_resume_initcall ###
### INITCALL END: level=7 fn=sync_state_resume_initcall ret=0 ###
### INITCALL BEGIN: level=7 fn=deferred_probe_initcall ###
### INITCALL END: level=7 fn=deferred_probe_initcall ret=0 ###
### INITCALL BEGIN: level=7 fn=ubi_init ###
### INITCALL END: level=7 fn=ubi_init ret=0 ###
### INITCALL BEGIN: level=7 fn=of_fdt_raw_init ###
### INITCALL END: level=7 fn=of_fdt_raw_init ret=0 ###
### INITCALL BEGIN: level=7 fn=clk_disable_unused ###

忽略 CLK 錯誤檢查

chosen {
    bootargs = "console=ttyS4,115200n8 earlycon=sbi ignore_loglevel loglevel=8 init=/init clk_ignore_unused";
};

終於進入載入 init 的階段，這才是 Kernel 完成開機的階段，當然中間忽略的問題還要一一找出來

Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
CPU: 0 PID: 1 Comm: swapper Not tainted 5.4.61 #5
Call Trace:
[<ffffffe0000211c4>] walk_stackframe+0x0/0x98
[<ffffffe00002137c>] show_stack+0x2a/0x34
[<ffffffe000287892>] dump_stack+0x20/0x28
[<ffffffe000025882>] panic+0xec/0x27a
[<ffffffe000000f22>] mount_block_root+0x214/0x27a
[<ffffffe00000110a>] mount_root+0x86/0x90
[<ffffffe000001288>] prepare_namespace+0x174/0x17e
[<ffffffe000000b62>] kernel_init_freeable+0x174/0x1c8
[<ffffffe000297ff8>] kernel_init+0x12/0xee
[<ffffffe00001ff30>] ret_from_exception+0x0/0xc
---[ end Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0) ]---

移除 CLK 錯誤檢查

chosen {
    bootargs = "console=ttyS4,115200n8 earlycon=sbi ignore_loglevel loglevel=8 init=/init";
};

在 CLK 裡面添加 Debug Log

1230 static void clk_disable_unused_subtree(struct clk_core *core)
1231 {
1232     struct clk_core *child;
1233     unsigned long flags;
1234 
1235     printk(
1236         "CLK %s: prepare=%d enable=%d protect=%d parent=%s\n",
1237         core->name,
1238         core->prepare_count,
1239         core->enable_count,
1240         core->protect_count,
1241         core->parent ? core->parent->name : "NULL");

定位到 PLL-CPU 問題

### CLK UNUSED END: pll-ddr0 ###
CLK pll-cpux: prepare=0 enable=0 protect=0 parent=dcxo24M
CLK riscv: prepare=0 enable=0 protect=0 parent=pll-cpux
CLK riscv-axi: prepare=0 enable=0 protect=0 parent=riscv
### CLK UNUSED END: riscv-axi ###
### CLK UNUSED END: riscv ###
CLK pll-cpux-div: prepare=0 enable=0 protect=0 parent=pll-cpux
### CLK UNUSED END: pll-cpux-div ###

將 SUN8IW20_PLL_CPUX_REG 設定成 CLK_IS_CRITICAL

$ vim drivers/clk/sunxi-ng/ccu-sun8iw20.c
    37 #define SUN8IW20_PLL_CPUX_REG       0x000
    38 static struct ccu_mult pll_cpux_clk = {
    39     .enable     = BIT(27),
    40     .lock       = BIT(28),
    41     .mult       = _SUNXI_CCU_MULT_MIN(8, 8, 12),
    42     .common     = {       
    43         .reg        = 0x000,
    44         .hw.init    = CLK_HW_INIT("pll-cpux", "dcxo24M",
    45                           &ccu_mult_ops,
    46                           CLK_SET_RATE_UNGATE | CLK_IS_CRITICAL),
    47     },
    48 };

添加 BOOT 開機選項，然後使用 rootwait 故意讓 Kernel 停在等待 rootfs Ready 的狀態

chosen {
    bootargs = "console=ttyS4,115200n8 earlycon=sbi ignore_loglevel loglevel=8 root=/dev/mmcblk0p1 rootwait rw rootfstype=fat init=/init";
};

Kernel 已經可以正常開機

printk: console [ttyS4] enabled
printk: bootconsole [sbi0] disabled
printk: bootconsole [sbi0] disabled
misc dump reg init
brd: module loaded
loop: module loaded
i2c /dev entries driver
ashmem: initialized
Waiting for root device /dev/mmcblk0p1...

司徒當初考慮使用 Tina-Linux 的原因是 Allwinner F133 相關的移植都已經完成, 我們應該可以很快就將 Kernel 移植使用, 但是目前看來, Tina-Linux 太高度客製化, 導致在還沒有很熟悉配置設定前, 可能需要花一些時間來除錯問題, 不過這個投資可能還是比從頭移植 Allwinner F133 到 main stream 上來得快一點～划算划算～哈

司徒

司徒幫小志掌機規劃的Memory Layout

Device Tree保留這些區域避免被覆蓋

memory@40000000 {
    device_type = "memory";
    reg = <0x0 0x40000000 0x0 0x04000000>; /* 64 MB */
};

reserved-memory {
    #address-cells = <2>;
    #size-cells = <2>;
    ranges;

    opensbi_reserved: opensbi@43e00000 {
        reg = <0x0 0x43e00000 0x0 0x00080000>; /* 512 KiB */
        no-map;
    };

    dtb_reserved: dtb@43d00000 {
        reg = <0x0 0x43d00000 0x0 0x00010000>; /* 64 KiB */
        no-map;
    };
};

開機後的Log

[    0.000000] Linux version 5.4.61 (steward@debian) (riscv64-unknown-linux-gnu-gcc (C-SKY RISCV Tools V1.8.4 B20200702) 8.1.0, GNU ld (GNU Binutils) 2.32) #1 PREEMPT Fri Sep 11 07:05:18 CST 2026
[    0.000000] earlycon: sbi0 at I/O port 0x0 (options '')
[    0.000000] printk: bootconsole [sbi0] enabled
[    0.000000] cma: Reserved 16 MiB at 0x0000000042c00000
[    0.000000] Zone ranges:
[    0.000000]   DMA32    [mem 0x0000000040000000-0x0000000043ffffff]
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000043cfffff]
[    0.000000]   node   0: [mem 0x0000000043d10000-0x0000000043dfffff]
[    0.000000]   node   0: [mem 0x0000000043e80000-0x0000000043ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x0000000043ffffff]

司徒

司徒最終使出吃奶的力氣跟 AI 努力奮鬥後, 終於把這個 Crash 問題找出來, 首先看到 Crash PC位址是位於 0x205a12

[    0.000000] sepc: ffffffe000205a12 ra : ffffffe00000b832 sp : ffffffe0006d7e10
[    0.000000] sstatus: 0000000200000100 sbadaddr: 0000000010002080 scause: 0000000000000005

定位副程式

$ riscv64-unknown-linux-gnu-addr2line -e vmlinux -f -C 0xffffffe000205a12
    plic_toggle.isra.2
    irq-sifive-plic.c:?

查看 Device Tree

$ vim arch/riscv/boot/dts/sunxi/sun20iw1p1.dtsi
    plic0: interrupt-controller@10000000 {

從 OpenSBI 列印 0x10002080 內容，發現內容都是 0

M-mode read 0x10002080 => 0
S-mode read 0x10002080 => 0

開始定位權限問題，發現 PLIC_CTRL_REG 需要設定才可以存取 PLIC 內容

於是在 OpenSBI 跳轉到 Kernel 前，先設定 PLIC 存取權限，就可以解掉 Crash 問題

*(volatile uint32_t *)0x101ffffc = 1;

Baudrate 115200bps

[    0.000000] Linux version 5.4.61 (steward@debian) (riscv64-unknown-linux-gnu-gcc (C-SKY RISCV Tools V1.8.4 B20200702) 8.1.0, GNU ld (GNU Binutils) 2.32) #1 PREEMPT Thu Sep 10 22:35:38 CST 2026
[    0.000000] earlycon: sbi0 at I/O port 0x0 (options '')
[    0.000000] printk: bootconsole [sbi0] enabled
[    0.000000] cma: Reserved 16 MiB at 0x0000000047000000
[    0.000000] Zone ranges:
[    0.000000]   DMA32    [mem 0x0000000040000000-0x0000000047ffffff]
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000047ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x0000000047ffffff]
[    0.000000] elf_hwcap is 0x20112d
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32320
[    0.000000] Kernel command line: console=ttyS4,115200n8 debug loglevel=7,initcall_debug=1 init=/init earlycon=sbi
[    0.000000] Dentry cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.000000] Sorting __ex_table...
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 104568K/131072K available (4909K kernel code, 449K rwdata, 1909K rodata, 160K init, 234K bss, 10120K reserved, 16384K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] rcu: Preemptible hierarchical RCU implementation.
[    0.000000]  Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 0, nr_irqs: 0, preallocated irqs: 0
[    0.000000] plic: mapped 200 interrupts with 1 handlers for 2 contexts.
[    0.000000] riscv_timer_init_dt: Registering clocksource cpuid [0] hartid [0]
[    0.000000] clocksource: riscv_clocksource: mask: 0xffffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[    0.000125] sched_clock: 64 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[    0.008238] riscv_timer_clockevent depends on broadcast, but no broadcast function available
[    0.021298] clocksource: timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 79635851949 ns
[    0.043416] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[    0.053948] pid_max: default: 32768 minimum: 301
[    0.060648] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.068014] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.089491] ASID allocator initialised with 65536 entries
[    0.095919] rcu: Hierarchical SRCU implementation.
[    0.105840] devtmpfs: initialized
[    0.342131] random: get_random_u32 called from bucket_table_alloc.isra.27+0x10a/0x12c with crng_init=0
[    0.349219] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.368572] futex hash table entries: 256 (order: 0, 6144 bytes, linear)
[    0.384847] pinctrl core: initialized pinctrl subsystem
[    0.401201] NET: Registered protocol family 16
[    0.425372] DMA: preallocated 256 KiB pool for atomic allocations
[    0.435759] cpuidle: using governor menu
[    0.864565] rtc_ccu: sunxi ccu init OK
[    0.943050] clock: sunxi ccu init OK
[    0.955128] clock: sunxi ccu init OK
[    1.281595] sun6i-dma 3002000.dma-controller: sunxi dma probed
[    1.316158] iommu: Default domain type: Translated 
[    1.322135] sunxi iommu: irq = 4
[    1.336606] SCSI subsystem initialized
[    1.343999] usbcore: registered new interface driver usbfs
[    1.350350] usbcore: registered new interface driver hub
[    1.356590] usbcore: registered new device driver usb
[    1.362847] videodev: Linux video capture interface: v2.00
[    1.376396] Advanced Linux Sound Architecture Driver Initialized.
[    1.389471] Bluetooth: Core ver 2.22
[    1.393475] NET: Registered protocol family 31
[    1.397995] Bluetooth: HCI device and connection manager initialized
[    1.404467] Bluetooth: HCI socket layer initialized
[    1.409454] Bluetooth: L2CAP socket layer initialized
[    1.414767] Bluetooth: SCO socket layer initialized
[    1.421697] pwm module init!
[    1.438662] g2d 5410000.g2d: Adding to iommu group 0
[    1.447448] G2D: rcq version initialized.major:252
[    1.459566] clocksource: Switched to clocksource riscv_clocksource
[    1.644760] sun8iw20-pinctrl 2000000.pinctrl: initialized sunXi PIO driver
[    1.679602] NET: Registered protocol family 2
[    1.693720] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    1.702402] TCP established hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    1.710560] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    1.718069] TCP: Hash tables configured (established 1024 bind 1024)
[    1.725104] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    1.732064] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    1.740853] NET: Registered protocol family 1
[    1.771587] workingset: timestamp_bits=62 max_order=15 bucket_order=0
[    1.892320] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.901056] ntfs: driver 2.1.32 [Flags: R/W].
[    2.831877] io scheduler mq-deadline registered
[    2.836472] io scheduler kyber registered
[    2.848914] [DISP]disp_module_init
[    2.858080] disp 5000000.disp: Adding to iommu group 0
[    3.319244] display_fb_request,fb_id:0
[    3.325176] [DISP] Fb_copy_boot_fb,line:1449:
[    3.325230] no boot_fb0
[    3.335539] disp_al_manager_apply ouput_type:0
[    3.341621] [DISP] lcd_clk_config,line:774:
[    3.341861] disp 0, clk: pll(72000000),clk(72000000),dclk(6000000) dsi_rate(72000000)
[    3.341861]      clk real:pll(288000000),clk(288000000),dclk(6000000) dsi_rate(0)
[    3.366295] [DISP]disp_module_init finish
[    3.376543] sunxi_sid_init()783 - insmod ok
[    3.397789] uart uart0: uart0 supply uart not found, using dummy regulator
[    3.407627] sw_uart_request_gpio()1273 - UART0 devm_pinctrl_get() failed! return -19
[    3.415548] uart0: ttyS0 at MMIO 0x2500000 (irq = 18, base_baud = 1500000) is a SUNXI
[    3.429644] sun8iw20-pinctrl 2000000.pinctrl: 2000000.pinctrl supply vcc-pb not found, using dummy regulator
[    3.444651] uart uart4: uart4 supply uart not found, using dummy regulator
[    3.454608] uart4: ttyS4 at MMIO 0x2501000 (irq = 22, base_baud = 1500000) is a SUNXI
[    3.471324] printk: console [ttyS4] enabled setup baud 115200 parity n bits 8, flow n
[    3.471324] printk: console [ttyS4] enabled
[    3.480395] printk: bootconsole [sbi0] disabled
[    3.480395] printk: bootconsole [sbi0] disabled
[    3.499934] misc dump reg init
[    3.523752] libphy: Fixed MDIO Bus: probed
[    3.536492] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    3.544162] sunxi-ehci: EHCI SUNXI driver
[    3.554895] get ehci0-controller wakeup-source is fail.
[    3.562094] sunxi ehci0-controller don't init wakeup source
[    3.568767] [sunxi-ehci0]: probe, pdev->name: 4101000.ehci0-controller, sunxi_ehci: 0xffffffe00076b730, 0x:ffffffd004067000, irq_no:2e
[    3.582892] [sunxi-ehci0]: Not init ehci0
[    3.590936] get ehci1-controller wakeup-source is fail.
[    3.598042] sunxi ehci1-controller don't init wakeup source
[    3.604712] [sunxi-ehci1]: probe, pdev->name: 4200000.ehci1-controller, sunxi_ehci: 0xffffffe00076bec0, 0x:ffffffd00406b000, irq_no:31
[    3.619088] sunxi-ehci 4200000.ehci1-controller: 4200000.ehci1-controller supply drvvbus not found, using dummy regulator
[    3.634144] sunxi-ehci 4200000.ehci1-controller: 4200000.ehci1-controller supply hci not found, using dummy regulator
[    3.649553] sunxi-ehci 4200000.ehci1-controller: EHCI Host Controller
[    3.657523] sunxi-ehci 4200000.ehci1-controller: new USB bus registered, assigned bus number 1
[    3.668805] sunxi-ehci 4200000.ehci1-controller: irq 49, io mem 0x04200000

司徒

司徒目前已經將 Kernel 程式碼打包放到 https://github.com/steward-fu/gaviar, 這份 Kernel 是從 Tina-Linux 抽取出來的源代碼, 尚未做修改, 因此, 目前還無法正常開機進入系統, 司徒心想剛好紀錄整個除錯過程, 將來可以當作參考, 編譯步驟如下：

$ cd
$ wget https://github.com/steward-fu/website/releases/download/gaviar/thead_toolchain.tar.gz
$ tar xvf thead_toolchain.tar.gz
$ sudo mv thead /opt
$ export PATH=/opt/thead/bin:$PATH

$ git clone https://github.com/steward-fu/gaviar
$ cd gaviar/kernel

$ ARCH=riscv CROSS_COMPILE=riscv64-unknown-linux-gnu- make distclean
$ ARCH=riscv CROSS_COMPILE=riscv64-unknown-linux-gnu- make gaviar_defconfig
$ ARCH=riscv CROSS_COMPILE=riscv64-unknown-linux-gnu- make menuconfig
$ ARCH=riscv CROSS_COMPILE=riscv64-unknown-linux-gnu- make Image dtbs -j4

$ sudo dd if=arch/riscv/boot/Image of=/dev/sdX   bs=1024 seek=400
$ sudo dd if=arch/riscv/boot/dts/sunxi/board.dtb of=/dev/sdX bs=1024 seek=300

開機問題如下：

[    0.000000] Linux version 5.4.61 (steward@debian) (riscv64-unknown-linux-gnu-gcc (C-SKY RISCV Tools V1.8.4 B20200702) 8.1.0, GNU ld (GNU Binutils) 2.32) #3 PREEMPT Tue Sep 8 21:27:48 CST 2026
[    0.000000] earlycon: sbi0 at I/O port 0x0 (options '')
[    0.000000] printk: bootconsole [sbi0] enabled
[    0.000000] cma: Reserved 16 MiB at 0x0000000047000000
[    0.000000] Zone ranges:
[    0.000000]   DMA32    [mem 0x0000000040000000-0x0000000047ffffff]
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000047ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x0000000047ffffff]
[    0.000000] elf_hwcap is 0x20112d
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32320
[    0.000000] Kernel command line: console=ttyS4,115200n8 debug loglevel=7,initcall_debug=1 init=/init earlycon=sbi
[    0.000000] Dentry cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.000000] Sorting __ex_table...
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 104568K/131072K available (4909K kernel code, 448K rwdata, 1909K rodata, 160K init, 234K bss, 10120K reserved, 16384K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] rcu: Preemptible hierarchical RCU implementation.
[    0.000000]  Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 0, nr_irqs: 0, preallocated irqs: 0
[    0.000000] Oops - load access fault [#1]
[    0.000000] Modules linked in:
[    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.4.61 #3
[    0.000000] sepc: ffffffe000205a12 ra : ffffffe00000b832 sp : ffffffe0006d7e10
[    0.000000]  gp : ffffffe000741948 tp : ffffffe0006dc670 t0 : ffffffe0006d7d70
[    0.000000]  t1 : 0000000000000005 t2 : 000000000000043f s0 : ffffffe0006d7ef0
[    0.000000]  s1 : 0000000000000001 a0 : ffffffd000002080 a1 : 0000000000000002
[    0.000000]  a2 : 0000000000000000 a3 : ffffffd000000000 a4 : 0000000000000020
[    0.000000]  a5 : ffffffffffffffff a6 : ffffffe000577be0 a7 : 0000000000000000
[    0.000000]  s2 : ffffffe0006f4bd8 s3 : ffffffe006e0b318 s4 : ffffffe00075d150
[    0.000000]  s5 : 0000000000000000 s6 : 0000000000000002 s7 : ffffffe0005f3c78
[    0.000000]  s8 : ffffffe000621920 s9 : ffffffe0007488a8 s10: 0000000000000001
[    0.000000]  s11: 0000000000200000 t3 : ffffffd004000000 t4 : 9000000004fffcc7
[    0.000000]  t5 : 0000000000000003 t6 : ffffffe0006d7d3c
[    0.000000] sstatus: 0000000200000100 sbadaddr: 0000000010002080 scause: 0000000000000005
[    0.000000] random: get_random_bytes called from init_oops_id+0x26/0x38 with crng_init=0
[    0.000000] ---[ end trace 0000000000000000 ]---
[    0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
[    0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---

司徒

呼叫的流程如下：

司徒

Legacy SBI Interface有如下幾個Function，上面的那個main.s範例就是使用EID 0x01的sbi_console_putchar()印出字串，藉由上面的main.s範例，讓我們可以更了解SBI Interface的運作原理

司徒

由於目前司徒目前使用LED閃爍程式替代Kernel，那是否代表可以修改這個LED閃爍程式來呼叫SBI Interface呢？答案肯定是可以的，程式碼如下：

    .global _start
    
    .text
    .long 0x05c0006f
    .byte 'e','G','O','N','.','B','T','0'
    .long 0x5f0a6c39
    .long 0x8000
    .long 0, 0
    .long 0, 0, 0, 0, 0, 0, 0, 0
    .long 0, 0, 0, 0, 0, 0, 0, 0
   
_start:
    la a0, msg
    call sbi_puts
1:
    j 1b
 
sbi_puts:
    mv t0, a0
1:
    lbu a0, 0(t0)
    beqz a0, 2f
    li a7, 1
    ecall
    addi t0, t0, 1
    j 1b
2:
    ret
 
msg: .asciz "\n\nHello, world!\n"
    .end

編譯、燒錄

$ riscv64-unknown-linux-gnu-as -o main.o main.s
$ riscv64-unknown-linux-gnu-ld -T main.ld -o main.elf main.o
$ riscv64-unknown-linux-gnu-objcopy -O binary main.elf tmp.bin
$ python3 gen_checksum.py tmp.bin main.bin
$ sudo dd if=main.bin of=/dev/sdb bs=1024 seek=400

開機後就可以從UART看到Hello, world!字串，如果想從屏幕上印出字串，只要修改lib/sbi/sbi_ecall_legacy.c，將#if 0改成#if 1後，重新編譯燒錄即可

static int sbi_ecall_legacy_handler(unsigned long extid, unsigned long funcid,
                    const struct sbi_trap_regs *regs,
                    unsigned long *out_val,
                    struct sbi_trap_info *out_trap)
{
    int ret = 0;
    struct sbi_tlb_info tlb_info;
    u32 source_hart = current_hartid();
    ulong hmask = 0;
 
    switch (extid) {
    case SBI_EXT_0_1_SET_TIMER:
#if __riscv_xlen == 32
        sbi_timer_event_start((((u64)regs->a1 << 32) | (u64)regs->a0));
#else
        sbi_timer_event_start((u64)regs->a0);
#endif
        break;
    case SBI_EXT_0_1_CONSOLE_PUTCHAR:
        sbi_putc(regs->a0);
 
#if 0
        /* Added by Steward for Gaviar handheld */
        void f133_slcd_putc(char ch);
        f133_slcd_putc(regs->a0);
#endif
        break;

司徒

司徒目前幫小志掌機規劃的 MicroSD Layout 如下

檔案更新的方式如下

$ sudo dd if=fw_jump.bin of=/dev/sdX bs=1024 seek=8
$ sudo dd if=fw_jump.bin of=/dev/sdX bs=1024 seek=40
$ sudo dd if=dtb         of=/dev/sdX bs=1024 seek=300
$ sudo dd if=Image       of=/dev/sdX bs=1024 seek=400

司徒LV 6

@steward

steward 发布的最佳帖子

steward 发布的最新帖子