====== Porting Linux to the Toshiba e800 ====== I'm trying, with the help from [[http://www.mnementh.co.uk/|Ian Molton]], to install Linux on my Toshiba e800 PDA. ====== State of my PDA ====== This is where CE 2k3 stops, the calibration step: {{ressources:e800-calibration-locked.jpg?240x320|CE blocked at calibartion step}} Useless to say that my device is unusable in the state. I had to do something about it. There was one and only one option in my opinion: run Linux, of course! ====== JTAG ====== Lots of information was gathered from: [[http://www.mnementh.co.uk/eseries/|Linux on the Toshiba e-series PDAs]] and sub-pages, most notably the "debricking" page. ===== JTAG connectivity ===== * First, unplug the battery. * Next, remove all screws you can come to sight. * Then, open up the case: * The silver-looking sides are //clips//ed to both the front and back of the case. * Gently lift the back of the case from the bottom. Don't go brute force! * You can gain access to the JTAG pads by removing the black, thick plastic band on the left side of the PDA (when you looking from the rear), next to the WiFi (or BT) module. I've had a 9-pin ribon cable soldered on the PCB (by a colleague of mine, I tend to be clumsy with small things): {{ressources:e800-pcb.jpg?320x240|JTAG cable}} Left of the picture is the top of the PDA. The JTAG connector is on the PCB, right in front of you, covered by a solid thick plastic band. Here's the pinout for the JTAG pads, when looking at the PDA as in the picture above: ^ Position | Left\\ most | ||||||| Right\\ most | ^ Pin # | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | ^ Signal | ''Vcc'' | ''TCK'' | ''TDI'' | ''TDO'' | ''TMS'' | ''N/A'' ||| ''Gnd'' | * Now, you can close the case. This is what I get: {{ressources:e800-side-jtag.jpg?320x240|JTAG out, side view}} {{ressources:e800-front-jtag_ribon.jpg?320x240|JTAG out, front view}} * Build your parallel port adapter as per Ian's [[http://www.mnementh.co.uk/eseries/jtag_schem.png|instructions]] (it is a simplified and fully working version of a [[http://toolbox.xilinx.com/docsan/3_1i/pdf/docs/jtg/jtg.pdf|Xilinx DLC5 JTAG Parallel Cable III]]). Here's the one I build: {{ressources:e800-jtag-adapter.jpg?320x240|JTAG Adapter}} ===== JTAG software ===== Again, Ian has done most of the needed job to drive this adpater from software. See [[http://www.mnementh.co.uk/eseries/debricking.html|there]] for how to get the software. Here is a typical ''bsrflash'' session that dumps the first Mebibyte from the flash: # bsrflash r dump.bin 1048576 Probing available busses... Intel PXA255 A0 c8026496 Probing for devices... Found Intel K3 strataflash in 2x16 bit mode. Reading data: 000eb154 / 000ffffc On my computer (x86_64 at 2.2GHz), reading 1MiB takes 30min. Yes, you read correctly: thirty minutes! This is roughly 583 byte per second. So, 32Mib take 16 hours! If you get something like the following: # ./bsrflash r dump.bin 1048576 Probing available busses... Intel PXA255 A0 c8026496 Probing for devices... No devices found. then you are not fast enough. After the PDA has been powered on (using the hard reset slidder, at the bottom), you have a window of about 1 second to run ''bsrflash'', or the WinCE loader will kind of rellocate the flash so that it is no longer available at ''0x0'' (we still have to figure how it does that, and how to work around this //feature//). When dumping the flash, Ian suggests that you dump it a second time and ''cmp(1)'' the two files to check for transfers glitches (JTAG has no CRC or whatsoever). If they differ, then: - check cabling: * a parallel cable (from adapter to PC) longer than 1m could be problematic (mine is 80cm), * a long JTAG lead (from PDA to adapter) could also cause grief (mine is 30cm), * all in all, try keeping the total length below 1.5m; - dump a third time: * if two of the three files match, then those two are most probably OK (the odds that two consecutive reads give the same error at the same address is low enough), * if the three files differ, then you really have a cabling problem; - Ian and I came up with a set of patches to make ''bsrflash'' more robust; apply them all in order: - {{ressources:100-debrick-bsrflash_null_pointer_dereference.patch.txt}} - {{ressources:200-debrick-bsrflash_prepare_multiple_reads.patch.txt}} - {{ressources:300-debrick-bsrflash_multiple_reads.patch.txt}} - {{ressources:400-debrick-bsrflash_truncate_existing_dump_file.patch.txt}} If you applied the patch set above, then usage of ''bsrflash'' changes when reading the flash: bsrflash r [samples] where //''samples''// is the number of __identical__ and __consecutive__ samples of a __single__ address that are required to validate that the data at this address was read successfully. 2 is most probably enough, 3 is my choice, while 4 and above may be overkill (but acceptable if you dump a small size). Setting this to 2 will double the download time; setting to 3 will triple it; and so on... Defaults to 1. Here is an example of the new usage: # bsrflash r dump.bin 1048576 3 Probing available busses... Intel PXA255 A0 c8026496 Probing for devices... Found Intel K3 strataflash in 2x16 bit mode. Reading data: 00000fb8 / 000ffffc : read error, retrying Reading data: 0001d870 / 000ffffc : read error, retrying Reading data: 000eb154 / 000ffffc **UPDATE 20080131** Ian has commited the 4 changes above into his [[http://git.mnementh.co.uk/cgi-bin/gitweb.cgi?p=bsrflash.git;a=summary|GIT tree]]. ====== Bootloader ====== Do __**NOT**__ try to use the bootloader without prior confirmed JTAG access!\\ If you use it on your device and it breaks, don't come moaning and whining, neither Ian nor I will be held responsible for the breakage.\\ Once you decide to replace the original bootloader by APEX, you're on your own.\\ \\ **You've been warned.** We are using [[http://wiki.buici.com/wiki/Apex_Bootloader|APEX]] as bootloader as an initial attempt at having a fully open source bootloader. We may end up porting a more common bootloader (namely, U-Boot) once we master the boot sequence and hardware initialisation. For now the APEX port to the e800 is very alpha. Here is a table of the status of some important items, somewhat in order of importance: ^ Item ^ Status ^ | Serial PUTC | OK | | JTAG PUTC | Missing, code is known | | SDRAM | Timings are known, register values are there, but init sequence is missing | | C environment | Missing | | Full serial console | Missing | | Flash driver | Missing, should be pretty obvious: CFI is already suported in APEX | | Environment | Missing, nothing machine-specific though | | Zmodem download | Missing, nothing machine-specific though | ^ Wanabe Items ^ Status ^ | Button access | Missing, should be quite easy | | Boot menu | Select between different kernels. Missing, highly wanted, needs button access. There is code to draw characters (thx Ian!) | | Splash Logo | Nice APEX logo in background, progress bar, and all the fuzz. Missing, highly wanted, most important! | | SD and CF | Boot from off-board SD and CF. Missing, complex, but would be nice | | IrDA console | Console on the left-hand side IrDA port. Missing | | WinCE support | Boot WinCE from APEX. Missing, will most probably never ever happen | For the adventurous, the port is on-going in the ''ymorin_e800'' branch in Ian's [[http://git.mnementh.co.uk/cgi-bin/gitweb.cgi?p=apex.git;a=summary|GIT cloned tree]]. I'm pushing there whenever I have some interesting stuff done. We'll eventually push back to the original APEX GIT tree once we are stable enough.