Subject: [E3-hacking] Trying to load u-boot from NAND.

From: Jonathan McDowell <[email-masked]>
Date: Mon, 24 Apr 2006 17:51:43 +0100

As I've discussed on IRC I've been trying to write a simple 2nd stage
bootloader that PBL will load from NAND that will then load u-boot. An
uncompressed PBL block seems to have a limit of 16k, which is far too
small for u-boot and I don't want to get into replacing PBL with u-boot
entirely without JTAG.

Anyway. While I can init serial and flash the LEDs, I don't seem to be
able to manage to even ident the NAND. My code isn't a lot different
from the NAND code I wrote for u-boot and the kernel, so I'm not quite
sure what I'm doing wrong. I've tried a dumb loop as a delay, as well as
the cleverer timer based delay routines that u-boot uses. But I don't
think this should be the problem, as as long as the delay is the minimal
length it shouldn't matter if it's more?

The code is at:

http://the.earth.li/~noodles/ldr-new.tar.gz

It's rough and ready, but please, someone tell me what blindingly
obvious thing I'm missing that means it doesn't work!

J.

-- 
Web [          I don't steal taglines, I replicate them.           ]
site: http:// [                                          ]       Made by
www.earth.li/~noodles/  [                      ]         HuggieTag 0.0.23

---

From: Matt Callow <[email-masked]>
Date: Tue, 25 Apr 2006 13:36:52 +0100

>obvious thing I'm missing that means it doesn't work!
Think I've fixed it. I now get:
!LDR started.
Looking for NAND.
latch2 = 00
Enabling CE.
latch2 = 00
Resetting chip.
latch2 = 80
Writing: FF
latch2 = 88
latch2 = A8
latch2 = 28
latch2 = A8
Writing: 70
latch2 = 88
latch2 = A8
latch2 = 28
latch2 = 20
latch2 = 28
Read: 40
Reading chip ID (send ReadID).
latch2 = A8
Writing: 90
latch2 = 88
latch2 = A8
latch2 = 28
Reading chip ID (send addr 0).
latch2 = 68
Writing: 00
latch2 = 48
latch2 = 68
latch2 = 28
Reading chip ID (manufacturer).
latch2 = 20
latch2 = 28
Read: 98
Reading chip ID (id).
latch2 = 20
latch2 = 28
Read: 75
Disabling CE.
latch2 = 2C
Found Tosh NAND.
nand_boot(): Write me.
Failed to find/boot from NAND. Twiddling my thumbs.
   
Seems to be a problem with data alignment?
                                               
Diff attached

Matt

diff -u ldr-new/nand.c ldr-new-matt/nand.c
--- ldr-new/nand.c	2006-04-24 17:42:26.000000000 +0100
+++ ldr-new-matt/nand.c	2006-04-25 13:30:32.000000000 +0100
@@ -29,7 +29,7 @@
 #define NAND_CMD_READID			0x90
 #define NAND_CMD_RESET			0xff
 
-u16 ams_delta_latch2_val;
+static u16 ams_delta_latch2_val = 0;
 
 void ams_delta_latch2_write(u16 mask, u16 value)
 {
@@ -40,7 +40,7 @@
 	uart_putbyte(ams_delta_latch2_val);
 	uart_puts("\r\n");
 
-	*(volatile u16 *) 0x08000000 = ams_delta_latch2_val;
+	*(volatile u8 *) 0x08000000 = ams_delta_latch2_val;
 }
 
 u8 ams_delta_nand_read(void)
@@ -50,7 +50,7 @@
 	ams_delta_latch2_write(AMS_DELTA_LATCH2_NAND_NRE |
 			AMS_DELTA_LATCH2_NAND_NWE,
 			AMS_DELTA_LATCH2_NAND_NWE);
-	*(volatile u16 *) MPUIO_DIR_CONTROL_REG = ~0;
+	*(volatile u8 *) MPUIO_DIR_CONTROL_REG = ~0;
 	udelay(10);
 	val = *(volatile u8 *) MPUIO_DATA_INPUT_REG;
 	ams_delta_latch2_write(AMS_DELTA_LATCH2_NAND_NRE,
@@ -70,8 +70,8 @@
 	uart_puts("\r\n");
 
 	udelay(1);
-	*(volatile u16 *) MPUIO_DIR_CONTROL_REG = 0;
-	*(volatile u16 *) MPUIO_DATA_OUTPUT_REG = val;
+	*(volatile u8 *) MPUIO_DIR_CONTROL_REG = 0;
+	*(volatile u8 *) MPUIO_DATA_OUTPUT_REG = val;
 	ams_delta_latch2_write(AMS_DELTA_LATCH2_NAND_NWE |
 				AMS_DELTA_LATCH2_NAND_NRE,
 				AMS_DELTA_LATCH2_NAND_NRE);

---

From: Jonathan McDowell <[email-masked]>
Date: Tue, 25 Apr 2006 13:49:31 +0100

> Think I've fixed it. I now get:
...    
  
> +	*(volatile u8 *) 0x08000000 = ams_delta_latch2_val;

Given that this appears to be what fixes it, yes, that seems likely.
However it now works for me too, so thanks for that. Now all I need to
do is finish the routine to read u-boot from NAND.

J.

-- 
Programmer, | Suburbia: where they tear out the  | Tel/SMS (Vodafone):
sysadmin &  |  trees & then name streets after   |   +44-7974-678646
BHMF.       |               them.                |  Made by HuggieTag

---

From: Jonathan McDowell <[email-masked]>
Date: Tue, 25 Apr 2006 22:37:32 +0100

> do is finish the routine to read u-boot from NAND.

Leading to the following output from a freshly powered on E3:

Amstrad Delta - PBL V4.9 Build:1311 Assert Debug ICE
PBL 32MB NAND
0MB.-->MEMv01.00.002,CopyLim=00220000h,CodeEnd=01400000h-->PBL......1MB.......2MB*

!LDR started.
Looking for NAND.
Enabling CE.
Resetting chip.
Reading chip ID (send ReadID).
Reading chip ID (send addr 0).
Reading chip ID (manufacturer).
Reading chip ID (id).
Disabling CE.
Found Tosh NAND.
Loading u-boot................................................................................................................................................................................................................................................................
Starting u-boot.

U-Boot 1.1.4 (Mar 22 2006 - 02:13:39)

U-Boot code: 11F00000 -> 11F148D0  BSS: -> 11F15D60
RAM Configuration:
Bank #0: 10000000 32 MB
Flash:  0 kB
NAND:32 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
E3 # 

J.

-- 
 [           I'm from the government. I'm here to help you.           ]

---

From: David Given <[email-masked]>
Date: Tue, 25 Apr 2006 22:53:19 +0100

Jonathan McDowell wrote:
[...]
> Leading to the following output from a freshly powered on E3:

Hurrah! This is great news; it means that sometime soon I should finally be
able to get rid of the serial cable...

Just out of interest, what did you use to bless the PBL image you uploaded?
The code I've currently got in pblq uses a brute-force method to calculate the
checksum of simply trying every possible value in turn until the checksum
succeeds, which is highly unsatisfactory. I'm looking for a better algorithm.

(I've got pblq now talking to both the E2 *and* the E3, and would like to do
some final cleaning up before releasing it.)

- --
+- David Given --McQ-+ "If you're up against someone more intelligent
|  [email-masked]    | than you are, do something insane and let him think
| ([email-masked]) | himself to death." --- Pyanfar Chanur
+- www.cowlark.com --+

---

From: Jonathan McDowell <[email-masked]>
Date: Wed, 26 Apr 2006 16:19:14 +0100

On Tue, Apr 25, 2006 at 10:53:19PM +0100, David Given wrote:
> Hurrah! This is great news; it means that sometime soon I should
> finally be able to get rid of the serial cable...

Unfortunately I'm now stuck at the point where I can turn on the E3,
have PBL load !LDR from NAND, !LDR load u-boot from NAND, u-boot load
the kernel from NAND, the kernel does its uncompression, then hangs.
Whereas if I load the same !LDR image to PBL over the serial port
loading everything else from NAND works fine. So I need to track down
what PBL twiddles when loading something from NAND that's breaking it
all.

> Just out of interest, what did you use to bless the PBL image you
> uploaded?  The code I've currently got in pblq uses a brute-force
> method to calculate the checksum of simply trying every possible value
> in turn until the checksum succeeds, which is highly unsatisfactory.
> I'm looking for a better algorithm.

My code is roughly:

u8 i, j;
int curchar;
int len;

curchar = fgetc(stdin);
len = 0;
while (curchar != EOF) {
	i += curchar;
	i = i & 0xFF;
	j += i;
	j = j & 0xFF;
}
printf("Fixup bytes for offset 6 = 0x%02X, 7 = 0x%02X\n,
		(-j + (len - 7) * i) & 0xFF,
		(j - (len - 6) * i) & 0xFF);

J.

-- 
 "Tax free porn, man. Think about  |  .''`.  Debian GNU/Linux Developer
   it." -- Jasper Janssen, asr.    | : :' :  Happy to accept PGP signed
                                   | `. `'   or encrypted mail - RSA +
                                   |   `-    DSA keys on the keyservers.

---

From: Jonathan McDowell <[email-masked]>
Date: Sun, 14 May 2006 20:43:49 +0100

> what PBL twiddles when loading something from NAND that's breaking it

Er, and now bizarrely I find that disabling CONFIG_DEBUG_MUTEXES means
it boots, which just seems wrong.

This means I now have an E3 that will boot (albeit slowly) without
having to be fed anything over the serial port. I'll try and get a
tarball of bits and instructions together this week so some other brave
soul can try and let us know if it works for them too. :)

What's everyone else working on at present and how's it going?

J.

-- 
      101 things you can't have too much of : 46 - Clinton jokes.

---

From: Jasmine Strong <[email-masked]>
Date: Sun, 14 May 2006 22:48:43 +0200

On 14 May 2006, at 21:43, Jonathan McDowell wrote:
> having to be fed anything over the serial port.

Breakthrough!  I've been playing with the JTAG probe but haven't
managed anything yet.

> I'll try and get a

I certainly will.

> What's everyone else working on at present and how's it going?

I have an E3 on my desk in bits right now.  I had to do a release at  
work last
week so I haven't really been able to do much.  The good news was that
loads of people at work have been asking me what it is-  everyone's
fascinated by the funny little computer with a phone built in.

Thanks for sending it :-)

-J.

---

From: Matt Callow <[email-masked]>
Date: Mon, 15 May 2006 10:59:13 +0100

> soul can try and let us know if it works for them too. :)
Excellent
> What's everyone else working on at present and how's it going?
Haven't had much time recently, but still working on the camera. No luck 
in getting any info from Omnivision though :(

Matt

---

From: Mark Underwood <[email-masked]>
Date: Wed, 17 May 2006 21:13:19 +0100 (BST)

> it boots, which just seems wrong.

Very strange, how on earth did you find out that disabling CONFIG_DEBUG_MUTEXES made it work? Well
done on getting it to boot.

> soul can try and let us know if it works for them too. :)

Once I have rebuilt my E3 I'll do that!

> What's everyone else working on at present and how's it going?

Not much. Last thing I was working was the sound. I would really like to get the mixer working
properly (well at all!). I tried building the sound driver as a module and running the commands
that put the modem into speaker phone mode and then install the sound driver, but it still comes
out the handset and I can't find a data sheet for the Voice Codec :-/. If anyone else has time
could they try the same trick (build sound driver a module, put modem into speaker phone mode,
install sound driver) and let me know if it works for them, or any other idea's for getting this
to work (Cliff :-))

> J.

Mark

> > _______________________________________________
> e3-hacking mailing list
> [email-masked]
> http://www.earth.li/cgi-bin/mailman/listinfo/e3-hacking
> 

Send instant messages to your online friends http://uk.messenger.yahoo.com

---

From: Jonathan McDowell <[email-masked]>
Date: Thu, 18 May 2006 21:57:57 +0100

On Wed, May 17, 2006 at 09:13:19PM +0100, Mark Underwood wrote:
> > Er, and now bizarrely I find that disabling CONFIG_DEBUG_MUTEXES
> > means it boots, which just seems wrong.
> 
> Very strange, how on earth did you find out that disabling
> CONFIG_DEBUG_MUTEXES made it work? Well done on getting it to boot.

Copious debug output lead me to discover it was hanging in mutex_lock
and I went to turn on DEBUG_MUTEXES only to discover it was already
enabled, so I disabled it.

> Not much. Last thing I was working was the sound. I would really like
> to get the mixer working properly (well at all!). I tried building the
> sound driver as a module and running the commands that put the modem
> into speaker phone mode and then install the sound driver, but it
> still comes out the handset and I can't find a data sheet for the
> Voice Codec :-/. 

I failed to find any datasheet for it either. Mixer support would be
great; it's a bit too loud to use the handset at present.

J.

-- 
 Have you been having any immoral thoughts lately? I know I sure have.