yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Development and Hacking General] flobb:
Re: Linux on Magician booting

Good job :) I have not enough skills to know what to modify in the kernel tree..... but it seems to be a lot of memory adresses.

If you need some testers, i may can help (if a find where i've install my chainloader)
[Windows Mobile Development and Hacking General] gyaur:
Linux on Magician booting

Could you make a release so we can help or test?
[Windows Mobile Development and Hacking General] awelux:
More Magician

Hi. The kernel is in hh cvs. Extract the universal tree which is universal for all htc devices :wink:

I will checkin my .config as defconf_magician soon.
[Windows Mobile Development and Hacking General] dwdrums:
hi! When is the first testing version available? :)

How long are u gonna take till the testing version is available?

Michael
[Windows Mobile Development and Hacking General] ParMaster:
Things are looking up for Xanadux / (Familiar port).

Hi All,

I've been running the most recent version of Xanadux / (ported "Familiar Linux" and the gpe environment) on my Harrier/(BlueAngel). Can someone tell me the best way to replace the internal rom / (flash) with xanadux on the sd card? I don't really want WinCE on the device any more at all. I'd rather just have linux running on it. I'm guessing the easiest way would be to use the romtools, i.e. psdwrite. Has anyone done this yet? If so, i'd really appreciate a quick rundown about how to do it.

I personally feel that things are really looking up for Familiar in general (including the Xanadux port). I spoke to some people who are coding for the OpenEZX (motorola project) this weekend. I expressed my sincerest hope for Familiar some day being able to support SDIO WiFi cards. In our discussion it came up that the "simplified spec" for SD had been made available to the public on April 8th, 2006. This is very good news indeed. Prior to this public release SD had seemed to be a very obscure standard to most programmers.

Cheers,

- ParMaster
[Windows Mobile Development and Hacking General] cr2:
Re: Things are looking up for Xanadux / (Familiar port).

The bootloader and wince are located in PXA flash,

and there is read/write support in the current Linux

kernel. You have a choice:

1. to boot using the HTC bootloader.

Then you must adapt the filesystem layout for the

pseudo-"wince" requirements.

2. Write your own bootloader. It needs more hardware

research, and in a case of failure you get a lot of big

problems (keyword - unknown JTAG)

You are very light on details. The SD card drivers are working since ages.

The SDIO support itself is the CMD5 (SDIO powerup) and CMD52/53 (afaik, SDIO read/write),

So it is like the PCMCIA support: you need to write

the individual driver for each device, SDIO is only

the bus protocol driver.

Do you know what chipset you wifi card is using ?
[Windows Mobile Development and Hacking General] ParMaster:
Thanks CR2

Hi CR2,

Thanks very much for finding time in your day to answer my questions about how to handle installation to internal flash and WLAN chipset through SDIO.

I guess i'll work on installing everything using the existing bootloader.

I've got an Ambicom SDIO 802.11b WLAN card. The reference design appears to be used by at least a few companies, including Socket i think.

It is either a prism3 or spectrum24, i'll have to recheck.

Again thank you for your time.

Cheers,

- ParMaster
[Windows Mobile Development and Hacking General] jshanab:
HTC Apache

I got to the point where OPIE comes up but the stylus doesn't work, actually nothing works. I wanted to ssh in but I can't ping the address. Kinda hard to tell if it is locked up or just never finished. I was wondering where the development is at on HTC Apache and how I can help.
[Windows Mobile Development and Hacking General] jshanab:
Stuck, no responses, is this project dead?

I can ssh in now, but I can't help if I can't get the thing built. Where are the files that were used to get the apache build. I have tried openembedded with familiar, lots and lots of errors. I built the toolchain and compiled a kernel, but didn't have enough info to configure the kernel correctly. Building myself from scratch seems like the only answer as even sourceforge CVS for the himilaya image times out. Like I asked in the title, Is this dead?

I have 3 monthes off of school to work on this, it would be a shame to waste it.
[Windows Mobile Development and Hacking General] cr2:
Re: Stuck, no responses, is this project dead?

himalaya ? Download the kernel for universal (-un0 branch) and choose HTC Apache in config.

There is no touchscreen driver right now, but it

is not difficult to adapt one.

There is also a svn with some more data here

svn://www.shadowmite.com/home/svn/ppc6700

Try to understand the phone (modem) operation.

Compile the RIL test programs from itsutils and

try to trace gpio & modem logs.
[Windows Mobile Development and Hacking General] jshanab:
I need a little help(partialy solved,got the source)

I am wasting huge amounts of time and getting nowhere. CVS times out. Perhaps I am doing something wrong?

cvs -z3 -d:pserver:anonymous@[b]cvs.sourceforge.net[/b]:/cvsroot/xanadux co -ko -r K2-6-12-hh2-xda0-un0 linux-2.6-xda

this neded to be ...xanadux.cvs.sourceforge.net....

I also don't quiet understand the initrd part. I am reading the how to compile himilaya and I don't quiet understand why my modules would be in the ramdisk.

I can cross-compile a kernel and all the other stuff but I am not seeing the steps to build a distribution and packaged it for the SD card. I can mount the sdcard and see a nice distribution structure, just like my local HD but how do I make a disk image from this directory to use qemu-arm on it?

Is there a howto? I feel like I am guessing here
[Windows Mobile Development and Hacking General] jshanab:
another dumb question..... :-(

Is that the kernel's config as in menuconfig?

or the distributions config like in ./configure

or make htcapache_defconfig ? <<<
[Windows Mobile Development and Hacking General] jshanab:
Is there documantation on the distribution layout?

I tried the def_config option and that creates the kernel config. But things like the touchscreen driver are still htcuniversal. I am guessing this is intentional, that the apache stuff is only additional differences.

How should I participate? Do I copy the htcuniversal_ts file into ./htcapache, modify it to pull in htcapache.gpio ? How do I tell the distribution to use this new file? modify the makefiles?

Or did I miss a configure step that would of SED the files?

Or did I miss a generic symlink style setup

Flying blind, I will attempt to do this and change the loaded module.

For example, although the booted machine shows the htcuniversal_ts module loaded, I can not find it or the reference to it that gets it loaded so I can change it
[Windows Mobile Development and Hacking General] cr2:
Re: Is there documantation on the distribution layout?

There is no touchscreen driver for apache yet, AFAIK.

And you can't use the driver from universal.
[Windows Mobile Development and Hacking General] Allan_ma70:
image for SD card

Has anyone got an image of the SDIO card and a way to write it without a linux box handy?
[Windows Mobile Development and Hacking General] luno:
hi!

what's about prophet?
[Windows Mobile Development and Hacking General] sint2006:
any news about linux for blueangle ,pda2k, supporting arabic language
[Windows Mobile Development and Hacking General] cr2:
I think that drawing the glyphs themselves is not a problem if

you use an appropriate truetype font, but IMHO

the right-to-left support is disabled in opie.
[Windows Mobile Development and Hacking General] sint2006:
could you explain more please

i installed the linux un my pda2k now , but it is not supporting arabic language ,am seraching for a solution , thanks in advance
[Windows Mobile Development and Hacking General] BORBOR:
sx66 dead

Hi ...

is anyone kind enough to help me ?

i got the ROM flashing process random generated password by monitoring the usb port while flashing new rom...

i opened MTTY and used this commands to erase ROM :

password ~~~~b~~~0SQ~e000

erase A0000000 1E00000

removed phone from cradle and soft reset , and my phone dead ! ...

no power up, no bootloader screen, nothing ! just a black screen while i'm doing anything ...

pc no longer recognize my device ... and flashing tools neither !

HELP PLZZZZZZZZZzz, i'm in a bad trouble
[Windows Mobile Development and Hacking General] mapcuk:
I install Linux (Openmoko image) on my Qtek S100 but it work slow ..

I've wanted to know how to increase and shut hightlight because battery had spent very fast.

Is documentation for Openmoko image? Where is it?
[Windows Mobile Development and Hacking General] sjs:
is atihwtbl0.txt the same as atireg.txt you posted?

I've also got some OTG docs on my list to read now. i hope the pxa250 is similar to the 26x so the interfacing document (from TD) is be useful.

As eager as I am to jump in and code, I don't think I have enough knowledge yet. The extent of my knowledge in the embedded area is how to program for the old m68hc11. needless to say that knowledge is of very limited usefulness here. ... more reading, and lots of it. :)

i hope you don't me asking you questions, because i have 2 right now that are nagging me. they both relate to haret. the first is a question i got no solution from on haret ML:

the second question is if you could give me a hint about the file haret/src/wince/getsetcp.asm. i'm mostly confused about what the =mov_cp_reg and =mov_reg_cp things are (and then the |mov_cp_reg| and |mov_reg_cp| sections below that). i have never seen this before.
[Windows Mobile Development and Hacking General] buzz_lightyear:
well, i'm on Himalaya... :o)))

buzz
[Windows Mobile Development and Hacking General] cr2:
Yes.

We don't need to write anything in assembler, only to fix the boot logic

in haret.

You can remove this option, because it is

default on wince to load the text segment

at a 64K offset in the virtual memory space (and not only on wince).

|XXX| is simply a label and with 'export'

it is declared a global symbol, so

ldr r3, =XXX

simply loads the address of this

label/symbol/function

into the R3 register. It's a standard way of

doing

(*XXX)();

void XXX()

{...};

in C.
[Windows Mobile Development and Hacking General] sjs:
alright! i had tried that before but it only complained about the next numeric argument so i thought something was broken. i removed all the args it complained about, got rid of the const qualifier in Output, Log, Status and Complain (src/wince/output.cpp) and now it compiles and links. thank you! one step closer...

much clearer, thanks for taking the time to explain. :)

back to the reading... and hopefully now i can debug this boot process.
[Windows Mobile Development and Hacking General] sjs:
That is strange... i can get up to the point where haret goes into kernel mode. i changed 2 instances of 'memPhysAddr + 0x8000' to 'memPhysAddr + 0x1D0000' but that didn't seem to affect anything at all. i haven't done any thorough checking on that.

my debugging output:

Physical kernel address: a01d0000
Preloader physical/virtual address: a6cca000
Physical initrd address: a05d0000
Goodbye cruel world ...
Reset AC97
set thread priority to critical
disabled multitasking
this process can access all memory domains
we're in kernel mode baby!
*mmu = memPhysMap (cpuGetMMU()))

So for me the booting fails on calling (cpu->setup_load)(); from what i can see the function pxaSetupLoad() doesn't get called, but i'll have to look into this further... probably not tonight. i've got work in the morning. i'm too tired to hope that the function just doesn't get called.

thanks for the help to get this far. i really appreciate you taking the time to help a newbie.

edit: i couldn't sleep. :)

i've added 'extern cpu_fns *cpu;' to src/linboot.cpp so now pxaSetupLoad() is called. interrupts are cleared successfully and now for some reason pxaShutdownPeripherals() in src/wince/cpu-pxa.cpp is hanging on one of the instructions old_icmr = *icmr; or *icmr = 0;. i do not see any reason why this should fail, unless memPhysMap(ICMR) (in pxaSetupLoad()) returned something incorrect. seriously this time, i'm going to sleep now.
[Windows Mobile Development and Hacking General] cr2:
Ok. IMHO you should upload your haret

binary to wiki or here.

The kernel is relocated over the

wince page table ? cool :)

I have read the whole himalaya wiki, it

has a lot of useful information that can

be reused. The comparison of the MMU dumps shows that HTC kept the static wince virtual addresses and reshuffled

the physical.

> The ASIC is for GPIO and SDIO and is

> located at physical 0x0D800000.

> At 0x0D801000 an ASCII part number

> can be found: HTC-SDIO

> P/N:30H80028-0

> Well it seems this ASIC is not used for

> the SD interface, but one at 0x0C800000

> (maybe ASIC5?)

Blueangel addresses are a little bit different, but close.

It seems that this magic ASIC5 can be ATI SDIO ??
[Windows Mobile Development and Hacking General] sjs:
Done.

http://wiki.xda-developers.com/index.php?pagename=BlueangelResearch

I have no time to post a patch right now but I will quite soon.

You will get a lot of info about where you are in the boot process.

This is how far I get:

HaRET(1)# Physical kernel address: a0008000
Preloader physical/virtual address: a6cd4000
Physical initrd address: a0408000
Goodbye cruel world ...
Reset AC97
set thread priority to critical
disabled multitasking
this process can access all memory domains
we're in kernel mode baby!
*mmu = memPhysMap (cpuGetMMU())
cpu->setup_load
interrupts cleared
in pxaShutdownPeripherals()
icmr = 00820004
old_icmr = *icmr = c6500d80

this means that it is freezing on the instruction *icmr = 0; in src/wince/cpu-pxa.cpp:108 (line # will be different since I have modified this file, but it's in pxaShutDownPeripherals()).

I took a quick look at the function memPhysMap() but only really read the first part until it starts manipulating that internal cache. I'm not sure on this one, but is it possible to just write to the ICMR directly using something like:

*(0x40d00004) = 0;

or i guess we can do

*(ICMR) = 0;

... i'll have to try it tonight.
[Windows Mobile Development and Hacking General] cr2:
Only if you have the 1:1 MMU page table.

I have identified the Philips UDA1380HN sound chip on the Blueangel picture.

The IRDA address 0xa8030000 is not

mapped anywhere...

There is no ASIC5 like on Himalaya, but

some other small HTC ASIC.

The (Himalaya modified) Blueangel memory map is

Physical Virtual Size ? Description

0x00000000 0xa0000000 0x200000 StrataFlash ROM 32Mbyte

0x44000000 0xa8000000 0x010000 LCD controller (not used)

0x48000000 0xa8100000 0x100000 Memory Controller

0x16000000 0xa9000000 0x100000 Debug port ?

0x04000000 0xa9100000 0x100000 Disk on chip ?

0x0e000000 0xa9200000 0x010000 ASICX ?

0x0c000000 0xa9300000 0x010000 ASIC3 top half ?

0x11000000 0xa9400000 0x010000 ASIC3 lower half ?

0x10000000 0xaa000000 0x000000 USB +256b, BTUR -> 0xaa050000

0x10800000 0xaa100000 0x000000 ??? maybe UDA1380HN

0x08000000 0xab000000 0x400000 ATI Imageon 3200

0x20000000 0xac000000 0x010000 pcmcia0

0x28000000 0xac100000 0x010000 pcmcia0

0x2c000000 0xac200000 0x0E0000 pcmcia0

0x30000000 0xad000000 0x010000 pcmcia1

0x38000000 0xad100000 0x010000 pcmcia1

0x3c000000 0xad200000 0x0E0000 pcmcia1

0x40000000 0xae000000 0x200000 XScale Peripherals (ser0,ser1)

0xa0000000 0xb0000000 0x400000 SDRAM 64MB

0xa4000000 0xb4000000 0x400000 SDRAM 64MB
[Windows Mobile Development and Hacking General] cr2:
Corrected memory map:

Physical Virtual Size ? Description

0x00000000 0xa0000000 0x200000 PXA263 StrataFlash ROM 32Mbyte

0x44000000 0xa8000000 0x010000 PXA263 LCD controller (not used)

0x48000000 0xa8100000 0x100000 PXA263 Memory Controller

0x16000000 0xa9000000 0x010000 Debug port ?

0x04000000 0xa9100000 0x100000 Disk on chip ?

0x0e000000 0xa9200000 0x010000 unknown

0x0c000000 0xa9300000 0x010000 ASIC3

0x11000000 0xa9400000 0x010000 unknown

0x10000000 0xaa000000 0x000000 USB +256b, BTUR +36b -> 0xaa050000

0x10800000 0xaa100000 0x000000 HTC DPRAM ASIC P/N: 30H80037-00-L

0x08000000 0xab000000 0x400000 ATI Imageon 3200

0x20000000 0xac000000 0x010000 pcmcia0

0x28000000 0xac100000 0x010000 pcmcia0

0x2c000000 0xac200000 0x0E0000 pcmcia0

0x30000000 0xad000000 0x010000 pcmcia1

0x38000000 0xad100000 0x010000 pcmcia1

0x3c000000 0xad200000 0x0E0000 pcmcia1

0x40000000 0xae000000 0x200000 PXA263 Peripherals (ser0,ser1)

0xa0000000 0xb0000000 0x400000 SDRAM 64MB

0xa4000000 0xb4000000 0x400000 SDRAM 64MB
[Windows Mobile Development and Hacking General] sjs:
saved, thank you.

so is there anything known about this HTC dpram asic? I would imagine not too much.

so after some experimenting with this haret code (linboot.cpp, cpu-pxa.cpp mostly) and trying the other implementation of memPhysMap() but getting the same result (frozen blueangel in proc src/wince/asmstuff.asm:linux_start) i agree we have to rewrite. it's no wonder it did not boot since i heavily commented out most of the code after entering kernel mode just to see how far i could get. (you don't have a perfect system when there's nothing to add, but nothing more to remove :p)

The code for booting this device must be rewritten... but not all of it. it will take some time for me to gain enough knowledge to write it.

for now i'm comparing haret code to intel 26x specs to see where pxa25x and 26x differ. i only started last night so there is only one small change i've made in include/pxa2xx.h. i'm sure there are more differences; intel themselves said that pxa26x is definitely NOT just 25x with on-chip flash.

include/pxa2xx.h:63 has

// GPIO[80:2] Edge Detect Interrupt Pending
#define IRQ_GPIO80_2 (1 << 10)

so for 26x I added lines:

// GPIO[89:2] Edge Detect Interrupt Pending (26x)
#define IRQ_GPIO89_2 (1 << 10)

that value is never used in haret, but i just wanted to make clear that there are differences.

i think there also may be some discrepancy with the DMA code but I've only just d/l'd the pxa255 docs to check this out. in the same file as above around line 270 struct pxaDMA is defined. if my counting is correct then the first Reserved1[44] block ends at 0x4000003c which is consistent with 26x dev manual. however, then they define DINT which should be at 0x400000F0 according to intel... also the manual says DINT is read only but in src/wince/cpu-pxa.cpp:pxaResetDMA() 0x0 is written to dma->DINT....

i believe that we can use most of the code for booting linux. the parts i think we need to change (which may actually be changing the functions/headers for code we are calling, not changing the actual linboot.cpp:bootLinux() function. although since the point where haret freezes is not consistent maybe this is due to erroneous code in memory handling... but that's just speculation on my part.

oh, one more question if you don't mind! :) does the himalaya actually have a pxa263 as well? if so i wonder why haret boots linux on one device and not the other. obviously there can be major differences even with the same core but for some reason i got to thinking that the himalaya actually has a pxa255... i don't know why.

back to the reading! too bad... coding is more fun.
[Windows Mobile Development and Hacking General] sjs:
also, just in case anyone is interested, there is a compiled version of haret-0.3.6 from CVS at http://anymore.nl/ipaq/ as well. that one has the source untouched from the CVS version. only the makefiles were patched.
[Windows Mobile Development and Hacking General] cr2:
It is the debug port. The wifi is

TNETW1100 (acx100) combined with Maxim MAX2820 (the driver needs tweaking).

Bluetooth is probably BRF61xx like on hx4700. Audio is UDA1380 (driver exists).

It is interesting that wifi and bluetooth are

implemented as pcmcia drivers and are multiplexed in some strange way. I'm curious if we can get some "absolute" virtual addresses from m$ pcmcia API.

If they are pcmcia-like, they can be attached directly to the CPU, or through

ASIC3. That needs to be researched.

We should also convert the Himalaya IDA scripts into the HaRET printf() statements

and dump the PXA263 registers. It will

help to understand which PXA subsystems are enabled/disabled and which parameters do they have.

Then comes GPIO/ASIC3 EGPIOs ... :)
[Windows Mobile Development and Hacking General] cr2:
There is one more sign that putting the

kernel at the RAM bottom is bad, if

the hardware is setup by wince.

tiacxwln.dll uses at least these

hardcoded addresses

0xb0001344

0xb0001345

0xb0001350

which are mapped to the beginning of

the memory. So the wireless can

(potentially) overwrite parts of the

kernel with DMA...
[Windows Mobile Development and Hacking General] sjs:
yikes! is this possible with wlan turned off? that would certainly mess things up for us.
[Windows Mobile Development and Hacking General] cr2:
It depends on what "turned off" really means. Linux kernel on the HP jornada 820

was failing because the USB OHCI controller was writing its timestamp into

the memory with busmaster DMA.

The problem was first solved by loading

the kernel at 0xc0200000 address (+2Mb)

because nobody knew what device is

responsible (HP don't tell anything about the machine).

HaRET should either reset all external devices

(not possible right now), or load the kernel above 2Mb too.
[Windows Mobile Development and Hacking General] cr2:
I suspect that MPEG support in ATI Imageon is limited to IDCT.

FYI, these files in windows directory are not XIP:

ace_ddi.dll

ACX100_dl.bin

atihwtbl0.txt

BTAudioGW.dll

BtCeIf.dll

BTConfigCE.cpl

BtCoreIf.dll

btrez.dll

Camera_Detect.exe

Camera.exe

CameraPictureDLL.dll

CameraVideoDLL.dll

GSMAMRDLL.dll

gsmamrenc.dll

H263VIDEOENC.dll

HSDCard.dll

htc_cmd.dll

HTC_Misc.dll

MP4_READER.dll

mp4spvd.dll

MP4Writer.dll

MPEG4SPVIDEOENC.dll

OEMExtDLL.dll

OEMExtDLL.lib

oeminfo.xml

pcmcia.dll

PhoneExt.dll

PhonePH.dll

RadioPresentService.dll

rilgsm.dll

SdkCE.dll

SDMemory.dll

Serial_BTUR.dll

serial_cmd.dll

spi.dll

tiacxwln.dll

TIBinaryParser.dll

usb.dll

USSD_Dll.dll
[Windows Mobile Development and Hacking General] sjs:
well i guess we could move/delete tiacxwln.dll to be sure it doesn't write to any memory... unless windoze chokes in that event. but in any case if we get haret to disable dma (which it already tries to do, but freezes) then we shouldn't have to worry about this, right?

i hadn't heard of IDCT before and didn't like what i saw on the pages google returned... it scared me a little. for now i'm sticking to learning about other parts of the device.

we just had a long weekend in canada (victoria day) and work was horrible. i haven't made any progress (not even reading) recently. :( i should quit my job. ;)
[Windows Mobile Development and Hacking General] cr2:
DPRAM is used to communicate with the

gsm unit. There is a

AT%DPRAMTEST=1

RIL command.
[Windows Mobile Development and Hacking General] sjs:
wow, you're good. this is all very new to me. i found a website of itsme, who has a bunch of code in viewcvs on this site. (s)he has what seems to be MS's ril.h header file on their website, http://www.xs4all.nl/~itsme/ ... lots of info there. mostly for the xda but some of it should be useful. i'm sure not all was transferred to the wiki here either.

i also found a website with a sample ril application, http://www.itsx.com/index.html?pocketpc-ril.html~mainFrame which also links to relevant MS patents that may be of use. i don't know if this is useful to you, but i'm going to have to add it to my list of reading... wheeee! :)
[Windows Mobile Development and Hacking General] cr2:
Don't be too politically correct :)

We will eventually support RIL, camera & so on too.

What we need right now is the decoded

dump of the PXA263 and ASIC3 configuration registers from HaRET.

GPIO/EGPIO list for the devices.

More tricky is the

memory mapping/IRQ for wifi, bluetooth and SDIO, i'm trying to do something here.

FYI, IRDA is using the onboard PXA263 controller.