Linux in ARM926EJ-S 248Mhz

CPU ARM926EJ-S ecosystem :

Texas Instruments OMAP1710, OMAP1610, OMAP1611, OMAP1612, OMAP-L137, OMAP-L138;
Qualcomm MSM6100, MSM6125, MSM6225, MSM6245, MSM6250, MSM6255A, MSM6260, MSM6275, MSM6280, MSM6300, MSM6500, MSM6800;
Freescale i.MX21, i.MX27, i.MX28,
Atmel AT91SAM9,
NXP Semiconductors,
Samsung S3C2412 LPC30xx (http://www.standardics.nxp.com/products/lpc3000/) ,
NEC C10046F5-211-PN2-A SoC – undocumented core in the ATi Hollywood graphics chip used in the Wii,
Telechips TCC7801, TCC7901,
ZiiLABS ZMS-05,
Rockchip RK2806 and RK2808,
NeoMagic MiMagic Family MM6, MM6+, MM8, MTV.

Devices of interest with these CPU, to follow as people install sometimes Linux on some :

Mobile phones: Sony Ericsson (K, W series);
Siemens and Benq (x65 series and newer);
LG Arena;
GPH Wiz;
Squeezebox Duet Controller (Samsung S3C2412). Squeezebox Radio;
Buffalo TeraStation Live (NAS);
Drobo FS (NAS);
Western Digital MyBook I World Edition; Western Digital MyBook II World Edition;
Seagate FreeAgent DockStar
(http://www.seagate.com/www/en-us/products/network_storage/freeagent_dockstar/) STDSD10G-RK;
Seagate FreeAgent GoFlex Home;
Chumby Classic


(Infos courtesy of Wikipedia)

Succeded to ping AK780x WinCE 5.0 to WM8505 WinCE 6.0 with vxUTIL from :

[You must be registered and logged in to see this link.]

They also sell a Telnet client for Windows CE 5.0 or 6.0 there (not tested) :

[You must be registered and logged in to see this link.]

If someone as a working ssh client for Anyka devices, please tell me.

ARM emulation under AK780x WinCE 5.0

If a Knight would be gentle to compile the Qemu sources there (if they compile..) :

[You must be registered and logged in to see this link.]

we could get interesting things to do. Here is the Qemu-arm running on a PC Windows Seven 64 bits :

[You must be registered and logged in to see this link.]

from the above ARMv5 emulated environment on a PC :

sh-3.00# dmesg | grep tty
Using fallback suid method
Using fallback suid method
kernel command line: mem=128M console=ttyAMA0 user_debug=31
ttyAMA0 at MMIO 0x16000000 (irq = 1) is a AMBA/PL011
ttyAMA1 at MMIO 0x17000000 (irq = 2) is a AMBA/PL011
sh-3.00#

Linux embarqué (Embedded linux) by Pierre Ficheux, Version 3, Eyrolles, ISBN : 978-2-212-12452-1
A free summary of v3 (Version 4 appeared in June 2012)
*****************************************************
Industrials and people pretending to be serious quiet when talking about Wind River Linux or Real Time OS.
Linux is inadapted for embedded devices in case of low memory fingerprint or no MMU in CPU (use uCLinux in this case)
A x86 PC is used for prototyping and cross compilation.
*******************************************************
For Linux structure please refer to UN*X System V and RTFM.
Modules for the kernel are located in /lib/modules
To settle your development environment, you need a cross toolchain for the target device (use binary or compile it from sources).
On your x86 PC you need to get access to a bit of GNU/Linux (in VirtualBox, with Cygwin, etc..)
Use ELDK, Crosstoll, Crosstool-NG or Scratchbox under Qemu, or your favorite Integrated Development Environment (IDE) :
Eclipse, Netbeans, or the Qemu devices emulator :
$ qemu-system-arm -M ? # gives you the list of ARM emulated devices..
Terminal emulation :
$ screen /dev/ttyxxx bdsrate #under GNU/Linux
or the software minicom to read serial port signals : a supported USB/RS232c wire is needed.
Beware that a number of devices have only a console based on an UART.
*********************************************************************
Building a minimal GNU/Linux distribution : compile the kernel with ELDK4.2 (cross compilation)
Create a root files system, simple or based on Busybox (take care to create /dev to get a call to the console)
You may also opte for user identification.
It is also possible to create an initramfs (kernel and rootfs in the same zImage file).
Starting from an existing distribution : it is not always a good idea. You will have to slim it.
Networking : the ethernet interface must be found and configured using ipconfig and route Networking Utilities commands from Busybox.
Network is tested with wget command.
It is possible to use a bridge under Qemu.
The network can be configured with shell scripts.
Note : PPP can also be installed.

Bootloader : x86 people are used to GRUB and Syslinux under GNU/Linux. U-boot is the reference for embedded devices, and must be compiled for the target device (with ELDK4.2 or others..)
$ qemu-sys-tem-arm -kernel u-boot.bin -nographic
You can create a file flash.img from u-boot.bin :
$ qemu-system-arm -pflash flash.img -nographic
Install : if not JTAG connector, bootloader must be installed via serial, using the specialised microcode (firmware) on the embedded device.
U-boot needs an uImage file (a zImage file with a U-boot header created with mkimage command).
Kernel can be loaded by TFTP and rootfs by NFS (NFS-Root) which doesn't modify the target device if delivered with a pre-installed reference distribution.

Mass memory and files system : an Embedded system usually contained flash memory (NAND or NOR) recognised by the LinuxMTD driver, at
[You must be registered and logged in to see this link.]
It is better to compile it in the kernel instead of having it as a dynamic module.
Bootloader, kernel and rootfs must be flashed in memory.
Starting of the kernel on a NOR flash must be donne by the command
bootm + memory adress of the partition containing the kernel.
The nand command under U-boot enables kernel configuration for NAND, who asks the copie of the kernel into RAM with nboot command, and then to use bootm command on the RAM copie adress.
The mtd-utils package (binaries under ELDK4.2) give tools to manipulate flash memory, where a lot of fs exist.
************************************************************************************
Third part ot the book : advanced corner.
Pierre Ficheux review the use of Buildroot (tool enabling embedded distribution creation), other development tools, Real Time systems and Man to Machine interface.
************************************************************************************

Some pages among others of interest about qemu :

[You must be registered and logged in to see this link.]

For french speaking people (to be moved into french speaking corner when created)
for aliens please refer to the previous article, or try Google Translate (no Warranty).


Building Embedded Linux Systems (Mise au point de systèmes Linux embarqués), Karim
Yaghmour & Corp., Version 2, 2008, O'REILLY, 978-0-596-52968-0
Résumé libre de la v2
*********************
Première partie
. Il existe à ce jour (2008) sur le marché les distributions pour l'embarqué
suivantes : MontaVista, Timesys, Wind River, Denx. On peut classifier les
appareils par taille (vitesse du CPU, taille de la ROM et de la RAM, où par
exemple les netbooks apparaîssent comme de taille moyenne), par contrainte
temporelle d'exécution (Hard ou soft Real Time, ou mild), par facilité
d'appairage réseau, et par niveau d'interopérabilité.
On peut se référer aux sites LinuxDevices.com ou Linux Journal. Il faut déterminer
les composants du système cible, configurer et compiler le noyau, créer le rootfs,
créer le bootloader et le configurer, tout cela à partir d'un système hôte.
.Partant d'un système hôte éxécutant Linux (Station Linux, cygwin ou autres solutions), le système cible peut être développé par link (liason série ou éthernet), par carte amovible (généralement une carte SD pour les netbooks), ou configuré seul (cas de cartes x86). Le système cible inclut le bootloader, le noyau et le filesystem.
Pour déboguer, on peut utiliser la liason éthernet, la liaison série ou encore utiliser une interface BDM ou JTAG dont le software doit être compatible avec la
cross toolchain (Parfois l'on débogue par la liason ethernet alors que la liaison série conduit à un émulateur de terminal sur le système hôte). Un système embarqué a généralement pour espace de stockage de la mémoire flash montée en système de
fichiers journalisés (JFFS2, YAFFS2, LogFS). Le système peut démarrer d'une mémoire
flash, d'un support externe (carte SD pour la plupart des netbooks) ou du réseau
(dans ce cas le bootloader est lancé depuis l'appareil cible). Le développement de
drivers nécéssite des adresses physiques dans la mémoire, alors que le noyau utilise des adresses logiques.
. Le support hardware doit inclure le support du CPU, du Bus et des Interfaces, de
l'USB, du Port Série (où l'UART 16550(A) est très répandu), du clavier et de la souris, de l'écran, du son, de la mémoire flash (MTD), de la carte SD (non-MTD),
du réseau éthernet, du WiFi, etc.
Deuxième partie
. Les outils de developpement croisé peuvent être compilés à partir des sources, et l'on peut y ajouter les outils de developpement commerciaux. Il faut choisir des
versions compatibles entre elles de GCC, glibc et binutils, sans oublier les
Linux Headers et le compilateur du Bootstrap. Pour construire l'environnement de
developpement croisé on peut utiliser les scripts de Crosstool, Ptxdist, Buildroot,
Diet libc. Il est possible d'utiliser un IDE tel Eclipse, et les programmes d'émulation de terminal comme Minicom, UUCP cu ou C-Kermit.
Il faudra télécharger les sources du noyau et le configurer pour l'appareil cible, avec ses modules, et le rootfs doit être adapté à un usage embarqué. Les bibliothèques doivent aussi être installées, ainsi que les fichiers devices (/dev). On installera aussi Busybox ou embutils, ainsi que les fichiers d'initialisation.
. Les composants flash dans les appareils embarqués nécéssitent des outils appropriés (partitionnemnt, écriture ou effacement).
On distingue les composants MTD qui doivent être configurés dans le noyau, et les non-MTD. Les mémoires usuelles sont CFI (Common Flash Interface), on utilisera les outils flashcp pour les NORs et nandwrite pour les NANDs.
. Il existe différents systèmes de fichiers pour la cible (Cramfs, Squashfs, JFFS2,
YAFFS2, Tmpfs). Des outils permettent de placer des images en RAM.
. Le Bootloader se contente pas de charger le noyau, il programme les contrôleurs mémoire, initialise les caches du CPU, active divers composants, autorise le boot par le réseau et ainsi de suite. U-Boot est le plus utilisé, il doit être compilé
pour la machine cible et installé en définissant ses variables d'environnement.
Il faut aussi créer l'en tête du noyau avec l'utilitaire mkimage, de même pour l'image rootfs.
Troisième partie : configuration réseau, outils de déboguage
Quatrième partie : systèmes Temps Réel, Xenomia, patch Linux Real Time

TEC T-Book WM8505 7" WinCE6 : runs a bit of Slackware 11 through PocketDOS x86 emulation. There seems to be an USB hardware mismatch on the device (external USB mouse no recognised), so one has to use the nousb kernel option. It runs smoothly without blinking cursor like sometimes on the Videojet NetKids WM8505 7" WinCE6

Still unable to run PocketDOS on a FirstView AK780x 7" WinCE5

Here is a pix from the above, after executing dmesg and ls :

[You must be registered and logged in to see this image.]

A better Screenshot of Slackware 11 under PocketDOS on ARM netbook :

[You must be registered and logged in to see this image.]


Failed to import registry setting on a FirstView PC703 AK780x 7" WinCE 5

HaRET 0.5.2 bootloader on a FirstView PC703 AK780x @ 266MHz 7" WinCE5

HaRET waits for a configuration file, default.txt in DOS format, we use the following :

set RAMSIZE 0x08000000
#set MTYPE xxxx
#set KERNEL zImage
#set initrd initrd.gz
#set cmdline "parameters_to_be_passed_to-the_kernel"
boot

We use PuTTY as a Telnet client :
1-Start HaRET
2-Start PuTTY
3-In HaRET, click on "Listen for network connection"
5-In PuTTY, select Telnet/localhost/port 9999 and click "open"
6-Run HaRET default.txt
7-In PuTTY, we got the following :

[You must be registered and logged in to see this image.]

Now joining to search for a kernel, a rootfs and kernel parameters..

Device : PC703 AK780x @ 266MHz WinCE5
HaRET : 0.5.3 "haret-for-kernel-2-6-32"
default.txt : a test configuration file with dummies mtype, ramaddr, etc..

#HaRET 0.5.3 for ARM kernel 2.6.32 configuration file
# Samsung SC32442 : 1772; Foundation ARM926 : 2048; CelestialSemiARM926EJ : 1662;
set mtype 2048
set ramaddr 0x00a00000
set ramsize 0x10000000
#set kernel_offset
#set initrd_offset
set kernel vmlinuz-2.6.32-5-versatile-squeeze
set initrd initrd-squeeze.gz
set kernelcrc 1
set fbduringboot 1
#set forcefbduringboot 1
set cmdline "root=/dev/ram0 mem=128M lpj=0"
log "earlylog.txt"
boot

kernel 2.6.32 and initrd from debian "Squeeze"

earlylog file :

HaRET(19)# boot
boot KERNEL=vmlinuz-2.6.32-5-versatile-squeeze INITRD=initrd-squeeze.gz
Opening file vmlinuz-2.6.32-5-versatile-squeeze
Opening file initrd-squeeze.gz
boot params: RAMADDR=00a00000 RAMSIZE=10000000 MTYPE=2048 CMDLINE='root=/dev/ram0 mem=128M lpj=0'
Boot FB feedback: 1
Built virtual to physical page mapping
Allocated 993 pages (tags=48000000/3242c000 kernel=48001000/3242b000 initrd=48132000/322fa000 index=483DD000/3204f000)
Built kernel tags area
Built page index
Video buffer at 00196420 sx=800 sy=480 mx=200 my=80
Video Phys FB=32450420 Fonts=3204d068
preload=2292@483E0000/3204c000 sj=483E0000 stack=483DE000/3204e000 data=483DF000/3204d000 exec=3204c128
Reading 1246756 bytes...
Read complete
Reading 2796200 bytes...
Read complete
CRC test complete. tags=1807856376 kernel=1200029155 initrd=1669353105
Launching to physical address 3204c010
Trampoline setup (tram=136@0002616C/0e02616c/3200116c)
MMU setup: mmu=A0380000/30380000
Go Go Go...

It crashes in fancy coloured effects..

mtype : 2729
Machine name : CnM Book silver
Machine type : cnmbook7se
Contact : Liviu Dudau
------------------------------------------------------------------------------------
From 48edcfcfbfcb3ffa76539f237b5527b62d72133a Mon Sep 17 00:00:00 2001
From: Russell King <rmk+kernel@arm.linux.org.uk>
Date: Sat, 20 Mar 2010 15:37:39 +0000
Subject: [PATCH] ARM: Update mach-types

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
---
arch/arm/tools/mach-types | 75 +++++++++++++++++++++++++++++++++++++++++++-
1 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 31c2f4c..1536f17 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -12,7 +12,7 @@
#
# [You must be registered and logged in to see this link.]
#
-# Last update: Sat Feb 20 14:16:15 2010
+# Last update: Sat Mar 20 15:35:41 2010


# machine_is_xxx CONFIG_xxxx MACH_TYPE_xxx number
cnmbook7se MACH_CNMBOOK7SE CNMBOOK7SE 2729

/!\ Not to be mixed-grilled with cnmnb7be Linux, XBurst 400 MHz 32-bit CPU (Mips)

From HaRET/Documentation : "In order for [HaRET] to work, one must have a Linux kernel customized for the device"

[You must be registered and logged in to see this link.]
(http://handhelds.org/cgi-bin/cvsweb.cgi/~checkout~/haret/docs/haret.html)
(http://handhelds.org/moin/moin.cgi/HaRET_20Documentation)

Handhelds.org is undergoing renovations - The site should be active on the week of Oct 1st, 2012!

Image of HaRET 0.5.2 bootloader trying to boot Linux on PC703 AK780x 7" WinCE5

Screenshot with Capt XP Pro : [You must be registered and logged in to see this link.]
(Timed 5s, JPEG output)

[You must be registered and logged in to see this image.]

It seems me that HaRET should be compiled for the device as it is very instable :
sometimes the widget GO GO GO appears, sometimes not..

After a deep series of crash tests, it seems that Wing Linux is the closest for AK Chips, especially the port for HTC Elf ARM926EJ-S rev 3 (v5l) TI OMAP850

To get Wing-linux-0.42.zip containing in a cab a zImage and an initrd cpio gzipped
Wing Linux project page :

[You must be registered and logged in to see this link.]

Please find under a pix from Tux in HaRET for incentive and motivation..

[You must be registered and logged in to see this image.]

HaretScripting.exe with configuration file HaretScripting.ini
Download link :

[You must be registered and logged in to see this link.]
or
[You must be registered and logged in to see this link.]

A scripting tool which helps dump whatever you want from HaRET. In other words :
you will be able to dump your device, without needs of PC or USB or knowledge about this process

Requirements

HaRET.exe
Windows Mobile 5 (NDLR : works also with WinCE5.0)
NetCF 2.0 or greater

Quick How To

Copy into a folder of your SD card: HaRET.exe, HaretScripting.exe and HaretScripting.ini
Run HaRET with your favorite default.txt parameters to try to boot Linux
It crashes, reset and do the following
Run HaretScripting.exe and choose your script set
Use [HaRET] button, which will run HaRET.exe into Listen mode (port 9999).
Use [Execute] button, which will execute scripts shown below device selection listbox (disabled for now)

Example of a dummy HaretScripting.ini :

[PC703 AK780x]
pwf ramconsolelog.txt 0xe00000000 0x1000

It creates a dump of the Ram at the specified adresses

Screenshot :
[You must be registered and logged in to see this image.]
Now in search of a Boot log somewhere in the Ram if any..

HaRET 0.5.1
default.txt for 64MB device, mtype set to HTC Herald for test
Wing Linux kernel and initrd

#HaRET default.txt configuration file
#device : FirstView PC703 AK780x 7" WinCE5.0
#CnM Book Silver mtype : 2729
#Wing Linux 0.4.2 for TI OMAP850 based devices as HTC Elf mtype : 2372
#Wizard : 1219; Startreck : 2487; Prophet : 2185; Pharos : 1874; Opal : 2392;
#Herald : 1461; Gene : 2095; Excalibur : 2391; Artemis : 1462;
set mtype 1461
#vram
#alloctest 0x2000
set ramaddr 0x30000000
set ramsize 0x04000000
#set kernel_offset 0x00008000
#set initrd_offset
#set bootspd 0
#set kernel zImage-wizard
#set initrd initrd-wizard
set kernel "zImage-wing"
set initrd "initramfs.cpio-wing.gz"
#set kernelcrc 1
#set fbduringboot 1
#set forcefbduringboot 1
set cmdline "ppp.nostart=1 debug root=/dev/loop0 mem=128M mddi.width=800 mddi.height=480 lcd.density=128 lpj=0 vga=ask highres=off"
log "earlylog.txt"
boot

earlylog results :
HaRET(24)# boot
boot KERNEL=zImage-wing INITRD=initramfs.cpio-wing.gz
Opening file zImage-wing
Opening file initramfs.cpio-wing.gz
boot params: RAMADDR=30000000 RAMSIZE=04000000 MTYPE=1461 CMDLINE='ppp.nostart=1 debug root=/dev/loop0 mem=128M mddi.width=800 mddi.height=480 lcd.density=128 lpj=0 vga=ask highres=off'
Boot FB feedback: 1
Built virtual to physical page mapping
Allocated 1426 pages (tags=48000000/324b9000 kernel=48001000/324b8000 initrd=48186000/32333000 index=4858D000/31f2c000)
Built kernel tags area
Built page index
Video buffer at 00186420 sx=800 sy=480 mx=200 my=80
Video Phys FB=324e3420 Fonts=31f29064
preload=2264@48591000/31f28000 sj=48591000 stack=4858F000/31f2a000 data=48590000/31f29000 exec=31f28128
Reading 1591508 bytes...
Read complete
Reading 4219411 bytes...
Read complete
Launching to physical address 31f28010
Trampoline setup (tram=136@000241C0/0e0241c0/31edc1c0)
MMU setup: mmu=A0380000/30380000
Go Go Go...

It hangs at this point (screenshot) :

[You must be registered and logged in to see this image.]

We notice one ghost out of three widgets..

One step beyond from the above.

Tweaking the ramaddr with the following default.txt in HaRET 0.5.0 :

#HaRET default.txt configuration file
#device : FirstView PC703 AK780x 7" WinCE5.0
#CnM Book Silver mtype : 2729
#Wing Linux 0.4.2 for TI OMAP850 based devices as HTC Elf mtype : 2372
#Wizard : 1219; Startreck : 2487; Prophet : 2185; Pharos : 1874; Opal : 2392;
#Herald : 1461; Gene : 2095; Excalibur : 2391; Artemis : 1462;
set mtype 1461
set ramaddr 0x3fe7335c
set ramsize 0x04000000
set kernel "zImage-wing"
set initrd "initramfs.cpio-wing.gz"
#set cmdline "ppp.nostart=1 debug root=/dev/loop0 mem=128M "
log "earlylog.txt"
boot

Most people got black screen or vertical bars, I got a grey screen. Sorry for the inconvenience

[You must be registered and logged in to see this image.]

But at ramaddr 0x3fe7335d, it crashes.

"The screen was..", William Gibson, Neuromancer, 1984

Can it dump ROM also?

According to :

[You must be registered and logged in to see this link.]

one can use

[V|P]WF <filename> <addr> <size>
Write a portion of [V]irtual or [P]hysical memory to given file. This is useful, for example, to dump the boot ROM into a file (usually the first 256K of ROM at physical address 0) "and then disassemble it".

But I think the ROM as all intellectual properties must be protected. Thereby it could be nice to have a localised copy in case things going wrong to be able to reflash as support is not really accurate for discontinued products.

Others ramaddr of interest for FV PC703 AK780x in HaRET :

0x21111820
0x21118820

Screen switches from red to white to grey

The problem is that in AK7802 ROM is somewhat protected as regularutilities can't dump it. There is need of dump utility because the answer from manufacturers are - these are discountinued products and ROM is not available. Simple as that. Netbook/Pad is bricked and no ROM What intellectual properties must be protected? The chinese didn't mind to use WinCE illegally on these netbooks at first place so it is not important after all, we bought the product and we have all rights to do all we want with this crap.

When manufacturers agree to answer somehow, it is still a point.
They are more like to promote a new product supposed to better feed the need of the market, and it is not only chinese, it seems to be a global trade law..

A few things about HaRET..
- run HaRET
- run PuTTY
- listen for connection in HaRET
- in PuTTY, Telnet port 9999 to localhost
we got :

Welcome, this is HaRET 0.5.2 running on WindowsCE v5.0
Minimal virtual address: 00010000, maximal virtual address: 7FFFFFFF
Detected machine Generic ARM 926/generic (Plat='Windows CE 5.0' OEM='Anyka AK780x')
CPU is ARM ARM arch 5TEJ stepping 5 running in system mode
Enter 'HELP' for a short command summary.

use the fonction runscript <script_name> in HaRET with the following script :

# Display some greeting message
print "Welcome to Handheld Reverse Engineering Tool!"
print "Some basic info about your device :"
print "MMU L1 descriptor table address is %08x" MMU
print "Video RAM address is %08x" VRAM
print "Current Process ID is %d" PID
print "CPU identification register (p15 r0) is %08x" CP (15, 0)
# Fill top ten scan lines (the run bar) with some color
#vfh VRAM 800*10 0x0099

we got :

HaRET(1)# runscript script.txt
Welcome to Handheld Reverse Engineering Tool!
Some basic info about your device :
MMU L1 descriptor table address is 30380000
Video RAM address is 32505420
Current Process ID is 7
line 7: Unexpected ')'
line 7: not enough arguments to function CP
line 7: Unknown variable 'CP' in expression
CPU identification register (p15 r0) is 00000075
HaRET(2)#

Note that
ramaddr : physical RAM start address (default = 0xa0000000).
ramaddr setting can make HaRET crash, hang, get grey SOD or switch from red to white to grey..
V2P(adress) : return physical address for given virtual address is no more implemented

BTW the third ghost widget in HaRET is identified : it is "RUN"