August 20, 2020

Stealth Processor in the Allwinner H3 and H5 chips

I have been working on and off for about 3 years now on boards based on Allwinner H3 and H5 chips. In particular the Orange Pi PC (H3) and the PC2 (H5). I only recently discovered the information that follows.

A section of the chip has always caught my attention as being mysterious and poorly documented. This is shown in some diagrams as "CPUS" and the gang of R_xxx devices. There is even a special bit of RAM (SRAM A2) that seems dedicated to this part of the CPU. Devices in this section are grouped with an unique set of addresses, as follows (from the H5 datasheet). 

SRAM  A2		0x0004_4000 - 0x0005_3fff	64k

RTC			0x01f0_0000 - 0x01f003fff	1k
--gap			0x01f0_0400 - 0x01f007fff	1k
R_TIMER			0x01f0_0800 - 0x01f00bfff	1k
R_INTC			0x01f0_0C00 - 0x01f00ffff	1k	- NMI controller
R_WDOG			0x01f0_1000 - 0x01f0013ff	1k
R_PRCM			0x01f0_1400 - 0x01f0017ff	1k	- power and reset (CCU)
R_TWD			0x01f0_1800 - 0x01f001bff	1k
R_CPUCFG		0x01f0_1c00 - 0x01f001fff	1k	- controls ARM cores
R_CIR_RX		0x01f0_2000 - 0x01f0023ff	1k
R_TWI			0x01f0_2400 - 0x01f0027ff	1k
R_UART			0x01f0_2800 - 0x01f002bff	1k
R_PIO			0x01f0_2c00 - 0x01f002fff	1k
--gap			0x01f0_3000 - 0x01f0037ff	1k
R_PWM			0x01f0_3800 - 0x01f003bff	1k
So there you have it, a little world of its own. Several items of unique interest are marked in the above. There is also R_RSB, which does not appear in the above register map.

All of this is essentially undocumented in the datasheet. Searches online turn up interesting information. There is a unique CPU core with a non-ARM instruction set! This may be denote CPUS or CPU0. The ARM cores may be then numbered 1,2,3,4, but this is not consistently done.

This processor is a 32 bit OpenRisc 1000 architecture processor.

Allwinner has provided various binary "blobs" with code for the AR100, and efforts have been made to reverse engineer them, as noted in the above links.

How does firmware get loaded into SRAM A2, and how does the AR100 get started? At this point I have no idea. It does seem that firmware does get loaded. My guess is that this is done at boot time either by U-Boot (probably not) or by the ATF software (more likely). It does indeed seem that firmware does get loaded.

Why even have this processor? The fact that the power button and the IR sensor are routed to this thing makes a person think that it is part of a scheme for the board to go into a low power sleep mode. The AR100 would detect the power button and start things up. Bear in mind that this thing (the H5 chip) was designed to be part of a set-top box.

What clock rate does it run at? Apparently at 24 Mhz. At least my board now has it running at 24 Mhz, but it is certainly possible to divide to clock to lower rates.

Notes on the PRCM

The following link documents the otherwise undocumented registers in this thing. The linux sources support this via clk/sunxi-ng/ccu-sun8i-r.c which is a useful and instructive file.

Why not just ignore this whole thing?

None of the PIO pins on the 40 pin connector on my Orange Pi board are driven by the R_PIO. However there are several things that make us want to be able to use the "R" devices as follows: On top of that, if we want to start up other cores, we need to fiddle with registers in R_CPUCFG.

Documentation for these secret registers

Interestingly, Qemu (which can emulate ARM processors) actually emulates boards, and in particular the Orange Pi PC. So there are things that can be learned from the Qemu source code, perhaps. Another possible source of information is the Allwinner A23 SDK. This is mentioned in the Sunxi PRCM page as the only place some of these registers are documented. The SDK is big (a 4G tarball), but we have time and disk space.

The Allwinner A23 (sun8i) SoC features a Dual-Core Cortex-A7 ARM CPU. It is essentially an A20 cut down for lower power consumption.

The Allwinner A31 (sun6i) SoC features a Quad-Core Cortex-A7 ARM CPU.

Have any comments? Questions? Drop me a line!

Tom's electronics pages / [email protected]