SpacemiT K1: FOSS, blob-free oreboot + EDK2 bootloader for the Orange Pi RV2 + R2S (no vendor U-Boot) + Tuned and Driver-Complete Freebsd 16-CURRENT
I've been doing mainline work on the Orange Pi R2S and RV2, and I got tired of the vendor U-Boot SPL/U-Boot stack, so I replaced all of it. These boards now boot like this:
BootROM
→ oreboot bt0 DRAM init + training in Rust, no DDR blob
→ OpenSBI 1.9 fw_dynamic, M-mode
→ EDK2 real UEFI, S-mode
→ your OS's EFI loader (FreeBSD loader.efi from the ESP in my case)
bt0 loads a FIT containing OpenSBI and EDK2 itself. It can read it from eMMC boot1, a microSD GPT partition or memory-mapped SPI NOR. Everything is built from source, and no binary blob is linked or loaded anywhere in the chain. The DDR training was reverse-engineered from SpacemiT's training blob into Rust (thanks, oreboot folks), and EDK2 builds on SpacemiT's open-source K1 platform code.
Repo: https://github.com/DaveWK/ore-edk-boot-opi
What works today (tested on my boards, Oct 2026):
- R2S: boots FreeBSD from eMMC. bt0 goes in boot0 and the OpenSBI+EDK2 FIT in boot1. A warm reboot takes about 85 s to login with a DEBUG EDK2 build.
- RV2: boots FreeBSD from NVMe on a cold power-on. bt0 turns on the M.2 slot's power, and EDK2 brings up PCIe Gen2 x2 and boots the NVMe ESP.
- RV2 SPI-NOR-only image (rv2-nor): boots with no microSD card at all. UEFI variables are stored in the NOR and persist across boots. I won't publish prebuilt binaries for this one. Writing the SPI NOR replaces the board's own firmware, and getting that wrong is much harder to recover from than a bad SD card. If you want it, build it yourself and know your way back.
- bt0 is also a fastboot flasher. Put the board in BootROM USB download mode and fastboot stage bt0. It trains DRAM (no vendor training blob!) and comes back as a normal fastboot device, so you can fastboot flash emmc|boot0|boot1|sd|disk. It accepts raw or sparse images, and zero-filled chunks are TRIMmed instead of written. On the R2S it writes eMMC with SDMA on the 8-bit bus at about 30 MB/s, so you don't need a vendor flashing tool.
K1 notes for anyone hacking on other boards:
- bt0 detects USB download mode from the BootROM storage API pointer (0xc08381a0) and starts fastboot instead of booting. The BootROM shows up as 361c:1001, and bt0 re-enumerates as 18d1:4ee0.
- On the R2S, PIO writes to eMMC on the 4-bit and 8-bit buses fail with data CRC errors at both 51.2 and 20.48 MHz. SDMA writes from the download buffer work fine at 8-bit/51.2 MHz HS. If your K1 eMMC writes are flaky, try DMA before you blame the pads.
- The RV2's M.2 slot supply is on GPIO 116. bt0 switches it on before the handoff so EDK2 can bring PCIe up.
- The EDK2 platforms are derived from SpacemiT's MUSE-Pi-Pro platform on bianbu-maker's k1 edk2/edk2-platforms trees. Adding another K1 board should mostly mean a per-board rank count, a DT and a board.conf. I've only tested the R2S and RV2, so BPI-F3, Jupiter or MUSE Pi owners are very welcome to try it.
Building it:
git clone --recurse-submodules=dts --recurse-submodules=opensbi https://github.com/DaveWK/ore-edk-boot-opi.git
cd ore-edk-boot-opi
make submodules
make r2s # or rv2; rv2-nor is build-it-yourself only
You get bt0.bin, next.itb/next.img and a SHA256SUMS file. The README has install steps for both boards and covers the R2S download-mode procedure (hold the button, USB-A to USB-A cable).
Known gaps:
- R2S cold boot hasn't been tested yet; only warm reboot is verified.
- UEFI variables live in RAM on the R2S (it has no NOR) and, by default, on the RV2 SD build.
- No bootinfo header is generated yet. Installs keep the one already on the boot device.
- The BootROM image is signed with oreboot's packer keys. That's fine on boards without secure-boot fuses.
- The RV2 download-mode button and port aren't documented yet.
- No prebuilt release yet for the R2S and RV2 SD images, so build them yourself for now. The SPI NOR image will stay source-only.
Credits: the bt0 work builds on orangecms' oreboot k1x branch. EDK2 comes from SpacemiT/bianbu-maker's K1 trees. Licenses: GPL-2.0 (oreboot), BSD-2-Clause-Patent (EDK2), BSD-2-Clause (OpenSBI).
FreeBSD images for both boards come from https://github.com/DaveWK/freebsd-img-maker. Next up is the same oreboot + EDK2 chain for the Radxa Cubie A7A and the ASUS Tinker Board 2S.
Bug reports, UART logs and "it bricked my board" stories are welcome. Download mode is the recovery path, so back up boot0/boot1 (or the start of your SD card) before flashing. 🦀