[Arm-netbook] Disecting mmcblk0p1 and the boot process

[Frans Pop]

As some of you may know, Luke sponsored my netbook on the basis that I'd
try to get Debian Installer running on it. My confidence for being able to
do that was based on Martin Michlmayr's excellent work getting D-I to run
on various ARM-based NAS devices (one of which I own myself) and my own
fairly deep knowledge of D-I.

This netbook is quite challenging though. The main reasons being that:
- we don't have a kernel config yet (although creating one should not be
  all that hard; looking at available config options I'd be very surprised
  if 2.6.33 does not support it without any additional patches)
- we don't have console access to u-boot
- there is no separation between the u-boot program and u-boot config,
  which makes it very difficult to modify the boot process

I have been able to get some info though.


Contents of mmcblk0p1
=====================
The ct-pc89e-firmware.tgz tarball Luke has provided for download contains:
datang-epc.tar.gz  logo_bt.bin    logo_wn.bin         zImage_dt_update
logo_au.bin        logo_kl.bin    logo_write.bin
logo_batt.bin      logo_nond.bin  u-boot-dt-256m.bin
logo.bin           logo_nosd.bin  zImage_dt

The contents of datang-epc.tar.gz should match mmcblk0p2 (root fs).
And some of those files can be found identically (confirmed using cmp [1])
in mmcblk0p1:

File name		 Location in mmcblk0p1
			Hex offset	Decimal
logo_au.bin		0543:7000	88305664
logo_batt.bin		054b:4000	88817664
logo_nosd.bin		0553:1000	89329664
logo.bin		0562:b000	90353664
zImage_dt		056c:1c00	90971136
u-boot-dt-256m.bin	05cc:1c00	97262592

There's quite a lot of unused space on mmcblk1. On my system there is data
on mmcblk1 in other locations than for the mentioned files, but my impression
is that at least some of that may well be leftovers from earlier uses of the
device.

The 'logo.bin' file is probably the image that gets displayed when the system
is loading; the 'logo_nosd.bin' file is probably the image that's displayed
if you boot with the touchpad buttons pressed, but without an SD card present.
Anyone know what format those images are in?

[1] Example:
FILE=zImage_dt
SIZE=$(ls -l $FILE | awk '{print $5}')
OFFSET=90971136
cmp -s -n $SIZE mmcblk0p1.img $FILE $OFFSET && echo "match" || echo "nope"

I created mmcblk1.img using 'dd if=/dev/mmcblk0p1 of=mmcblk0p1.img'.


u-boot configuration
====================
Running 'strings' on u-boot-dt-256m.bin shows five potentially interesting
bits of configuration settings or command sequences.

1st fragment
------------
nand read c0008000 840000 40000
fat logo_wn.bin
fat logo_nond.bin
fat logo_noepc.bin
fat logo_kl.bin
fat logo_bt.bin
fat logo_write.bin
checkmemory

Lists all the image files included in the firmware tarball. Not much to tell
from it beyond that. And as not all logo files can be found on mmcblk0p1 it's
of doubtful value.

2nd fragment
------------
baudrate
===>wait update=======================>
Boot up for burning
ipaddr
ethaddr
loadaddr
bootfile
fat boot
=====>u-boot find
inand u-boot
=====>u-boot unfind
fat kernel
=====>kernel find
inand kernel
=====>kernel unfind
fat datang-epc.tar.gz
=====>datang-epc.tar.gz find
fat zImage_dt_update
bootm c0008000
=====>zImage_dt_update unfind
=====>datang-epc.tar.gz unfind
none

Command sequence for updating from a FAT files system? Of doubtful value as
the file names 'boot' and 'kernel' don't match the firmware tarball.

3rd fragment
------------
=====>SD init fault! NO SD?
rupdate
***************** update rootfs from sd card to inand sucess!!!!!!!!!!!!!!!!!**************
***************** update rootfs from sd card to inand failed!!!!!!!!!!!!!!!!!**************
zimage
inand update kernel c0008000
***************** update kernel from sd card to inand sucess!!!!!!!!!!!!!!!!!**************
***************** update kernel from sd card to inand failed!!!!!!!!!!!!!!!!!**************
u-boot.bin
inand update u-boot c0008000
***************** update u-boot from sd card to inand sucess!!!!!!!!!!!!!!!!!**************
***************** update u-boot from sd card to inand failed!!!!!!!!!!!!!!!!!**************
boot zImage from sd that fat32 part
boot zImage from sd that fat32 part
boot zImage from sd that fat32 part
updatebootfromsd
updatekernelfromsd
updaterootfsfromsd

Not sure what to make from this.

4th fragment
------------tftpkernel
tftp c0008000 zImage_dt
movi write kernel c0008000 0
tftp c0008000 u-boot-dt-256m.bin
movi write u-boot c0008000 0
uboot
fat u-boot-dt-256m.bin
u-boot
zImage
fat zImage_up_995
fat logo.bin
movi write 3999000 40000 c0008000 0
fat logo_nosd.bin
movi write 3997000 40000 c0008000 0
fat logo_batt.bin
movi write 3996000 40000 c0008000 0
fat logo_au.bin
movi write 3995000 40000 c0008000 0
update
fat u-boot-dt-update.bin
fat zImage_update
movi write 3500000 40000 c0008000 0
fat zImage_dt
movi write 3600000 600000 c0008000 0
movi write 3700000 40000 c0008000 0
movi write 3800000 40000 c0008000 0
movi write 3805000 40000 c0008000 0
movi write 3804000 40000 c0008000 0
movi write 3803000 40000 c0008000 0
movi write 3000000 600000 c0008000 0
fat zImage_cp
showlogo
inand

This is probably the most interesting one as it mentions exactly the four
logo files that can be found on mmcblk0p1.

The syntax for the 'movi write' command has two variants:
movi write {u-boot | kernel | rootfs} {addr} - Write data to moviNAND
movi write {sector#} {bytes(hex)} {addr} - Write data to moviNAND sector#

The second variant is used here and for the logo files the following formula
makes the commands match the offset in mmcblk0p1:
   (sector# * 512) - 74a7:8000
Could make sense if 74a7:8000 is the base address of the mmcblk0 device.
The second parameter also makes sense: 40000 hex is 262144, which is just
larger than the size of the logo files.

However, I've not been able to work out the other movi write's for the kernel
and u-boot (the same formula does not work).

Note also that the sequence starts with an attempt to tftp-boot. I'll see if I
can capture anything on the wired ethernet device after a boot with both mouse
buttons pressed.

Pity that movi and inand commands aren't documented in the u-boot manual.

5th fragment
------------
bootargs=root=/dev/mmcblk0p2 rootwait init=/init console=ttySAC0,115200
bootcmd=movi read kernel c0008000 0;bootm c0008000
bootdelay=3
baudrate=115200
ethaddr=00:40:5c:26:0a:5b
ipaddr=192.168.1.28
serverip=192.168.1.27
gatewayip=192.168.1.2
netmask=255.255.255.0

This looks to be the actual config used for a regular boot.

The 'init=/init' is incorrect and results in the following in dmesg:
    Failed to execute /init.  Attempting defaults...

Note that here the alternative 'movi read kernel' is used.
Apparently there's some hardcoded default for where the kernel and u-boot
should normally be found.


Any additions/corrections/comments welcome.

BTW, did you see the "reset" button on the bottom of the netbook?
Wonder if that maybe triggers a firmware reload...

Cheers,
FJP