DEF CON 34 closed yesterday. If you were there, you came home with a badge built around Andrew "bunnie" Huang's Baochip-1x, and by now you have probably pressed the middle button, watched the lights, and traded a pattern with a stranger.
I have been working on this chip since the year started.
Not the badge, but the silicon, I wrote the bare metal C HAL for it, and then I wrote a book about it, and the process of doing both meant sitting with the part for months before most people knew it existed, some of the quirks are in the documentation and some you find by hunting in the silicon.
What the badge does not show you
The badge runs Xous, a microkernel OS written in Rust, with each process in its own isolated address space, it is a genuinely good piece of engineering and it is the right choice for a device that is meant to be a security token you can trust.It also means that what you have been interacting with for four days is several layers above the metal. You have seen a light show and a QR handshak, you have not seen the ReRAM and you have not touched the key store, the true random number generator, or the glitch sensors. Those are the parts that make this chip interesting, and they are sitting there in your pocket doing nothing.
Underneath Xous there is a 350 MHz VexRiscv core, 4 MB of ReRAM, 2 MB of SRAM, and a peripheral set on TSMC 22 nm. You can talk to all of it directly in C and that is what I spent the year doing.
Sixty errors and nine bugs
By the time the book was finished I had corrected around sixty documentation errors and found and fixed nine bugs in the SDK, despite wirting drivers to spec, sometimes the silicon didnt behave like I expected it to as per documentation. I must say that the This is a chip that was hitchhiked onto a tapeout by a small team, and the fact that the errata count is that low for a first silicon spin with an open RTL is remarkable. I am saying it because it is what actually happens when you take a new part and write a driver for every peripheral on it instead of blinking an LED and calling it characterized.
Every register write in my book ran on real hardware, and every one, if a number is in there, I put a scope on it or read it back off the part. That is the entire value proposition and it is why the book exists rather than a blog series.
The parts that are not open, and why it does not bother me
bunnie has been straightforward about this and I want to repeat it rather than let it get discovered as a gotcha. The AXI bus framework, the USB PHY, the PLLs, and the analog blocks are closed. There is no fully open process design kit at this node at commercial scale, so there was no version of this project where those pieces were open.
His framing is that they behave as wires, data goes in, the same data comes out, and you cannot verify the internals. That is a real limitation and you should hold it in mind.
What you get in exchange is the compute logic in open RTL, an open boot chain, a published reference image, and a package engineered so you can shine infrared through the silicon and check that what is on the die matches what was published. Nobody else has shipped that at thirty thousand units. Perfect was not on the menu, this is a long way past what was available last year.
What you can do with it now
The badge is a badge and the chip is a microcontroller (well more like an SoC), and you can write your own firmware for it in C today.
I released the HAL under Apache 2.0 with tested drivers, and 25 working examples: GPIO, UART, SPI, I2C, ADC, timers, watchdog, the crypto blocks, ReRAM, the lot. It is on GitHub. The book is for the layer past that, it walks all of the peripherals with the errata folded in, so you are not rediscovering the RTC problem on your own Tuesday night. And there is a companion coming, a lab book, with 30 hands on labs on a breadboard, running from an LED and Ohm's law through UART, SPI, I2C, an OLED, sensors, an IMU, SD cards, FIR and IIR filters, FFT, complementary and Kalman filters, AES, SHA, the TRNG, and finishing on a decision tree, a small neural network, and anomaly detection running on the chip. And for my supporters, if you bought the reference book already, the lab book is yours free. You do not need to do anything, it will land in your account.
Why I did this
I am an embedded engineer in Trinidad and Tobago. I have four books out with Apress and Springer and I run rvembedded.com, which is mostly about WCH RISC-V parts and has been for a while. When bunnie put out a call in March for someone to write the C HAL, I was not the obvious choice. I was just the guy who said yes and then actually finished it. I mention that only because if you are reading this on the way home from Vegas wondering whether you are qualified to do something with the chip in your bag, the answer is that the bar is lower than you think and the ceiling is higher than you think.
Pick up a copy of The Dabao Book:
and go make something with it.
Armstrong Subero is an embedded systems engineer and published author with Apress/Springer. He builds the Rovari RISC-V education platform from Trinidad and Tobago.