Date: Sat, 07 Jun 2008 14:00:12 +0100 From: "Bruce M. Simpson" <bms@FreeBSD.org> To: freebsd-embedded@freebsd.org Subject: Re: Low cost ARM9 SoC board - NSD100/NCB3AST Message-ID: <484A865C.9010009@FreeBSD.org> In-Reply-To: <484A679E.7010106@incunabulum.net> References: <484A679E.7010106@incunabulum.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Bruce M Simpson wrote: > Hi, > > I have just made a speculative purchase of an ARM9 based device, the=20 > Emprex NSD-100 (pictures of inside case): > =20 > http://www.bit-tech.net/hardware/2008/04/29/emprex-nsd-100-p2p-download= -engine/1=20 > Finally, the uart pinouts. We don't know what 3+4 are but the traces definitely go to the SoC. As=20 with all of these things it's difficult to reverse engineer what BGA=20 stuff does without using hot air rework and manual re-balling of the=20 pads is risky. DCE view: from SoC TX 1 2 RX 3 4 +3.3 Vcc 5 6 GND # cat /proc/mtd dev: size erasesize name mtd0: 00020000 00010000 "Armboot" <----- boot loader mtd1: 007c0000 00010000 "Kernel & Ramdisk" mtd2: 00020000 00010000 "configure" Holding down the reset button (next to power connector) breaks into=20 ARMBoot on power-on. Flash is mapped at 0x10000000 physical on boot. STR9100>bdinfo enetaddr =3D 00:AA:BB:CC:XX:XX ip_addr =3D 192.168.10.2 baudrate =3D 38400 bps arch_number =3D 242 env_t =3D 0003A6B8 boot_params =3D 00000100 DRAM:00.start =3D 00000000 DRAM:00.size =3D 04000000 STR9100>version ARMboot 1.1.0 (Oct 11 2006 - 18:04:44) STR9100>printenv baudrate=3D38400 ethaddr=3D00:aa:bb:cc:xx:xx ipaddr=3D192.168.10.2 serverip=3D192.168.10.3 netmask=3D255.255.0.0 bootcmd=3Dgo 0x10020000 bootdelay=3D0 back to--- Creating 3 MTD partitions on "str9100_flash": 0x00000000-0x00020000 : "Armboot" 0x00020000-0x007e0000 : "Kernel & Ramdisk" 0x007e0000-0x00800000 : "configure" --- Looks like some kind of compressed kernel image with a loader in front;=20 it doesn't look like elf, based on monitor inspection. The FA526 core is configured little-endian. There is a bug with the ARMboot firmware's bootp command. the BOOTP/DHCP = next-server address needs to be in the target's native endian format=20 (you can see this in its ARP requests). e.g. 192.168.0.1 -> next-server 1.0.168.192; for isc-dhcpd You also need to set up a little-endian alias (a /32 will do) so it'll=20 get an ARP response! Then, and only then, will it try to tftp 0200A8C0.img at 0x01000000 by=20 default (again, this is hex in native endian). From the looks of it it tries to boot a full "kernel+rootfs" image with = a loader in front in all cases (boot and flash bootstrap), it doesn't=20 look like ARMboot has an ELF loader (see "Image Formats"): =20 http://armboot.cvs.sourceforge.net/armboot/armboot/README?revision=3D1.7&= view=3Dmarkup Haven't tried building a FreeBSD kernel for this sucker yet. Full linux dmesg: empiric:~ % cu -t -l /dev/cuaU0 -s 38400 can't open log file /var/log/aculog. Connected =FC=F0=F8=FF=FEUncompressing=20 Linux....................................................................= =2E...............=20 done, booting the kernel. request_standard_resources()....OK trap_init().....OK init_IRQ().....OK sched_init().....OK softirq_init().....OK time_init().....OK Linux version 2.4.27-star (root@ubuntu) (gcc version 3.3.6) #1759 Wed=20 Aug 15 03:31:19 PDT 2007 CPU: FA526id(wb) revision 1 ICache:16KB enabled, DCache:16KB enabled, BTB support Machine: STAR_STR9100 On node 0 totalpages: 16384 zone(0): 16384 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: console=3DttyS0,38400 root=3D/dev/ram0=20 initrd=3D0x00900000,10M mem=3D64M@0x00000000 IRQ Timer1 at interrupt number 0x0 and clock 100000000(Hz) console_init().....OK kmem_cache_init().....OK Calibrating delay loop... 153.60 BogoMIPS Memory: 64MB =3D 64MB total Memory: 51740KB available (1953K code, 574K data, 220K init) mem_init().....OK pgtable_cache_init().....OK max_threads is :1024 @@@@@@@@@@@@@@@@@ proc_caches_init().....OK Dentry cache hash table entries: 8192 (order: 4, 65536 bytes) Inode cache hash table entries: 4096 (order: 3, 32768 bytes) Mount cache hash table entries: 512 (order: 0, 4096 bytes) vfs_caches_init().....OK Buffer cache hash table entries: 4096 (order: 2, 16384 bytes) buffer_init().....OK Page-cache hash table entries: 16384 (order: 4, 65536 bytes) page_cache_init().....OK signals_init().....OK POSIX conformance testing by UNIFIX Data In reg is:1bfc0c!!!!!!!!!!!!! USB to PC now PCI: bus0: Fast back to back transfers disabled pci bridge found Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket do initcalls start Starting kswapd NTFS driver v1.1.22 [Flags: R/W] SGI XFS with no debug enabled i2c-core.o: i2c core module version 2.6.1 (20010830) i2c-algo-bit.o: i2c bit algorithm module pty: 256 Unix98 ptys configured Str9100 Serial Driver version 5.05c (2001-07-08) with no serial options=20 enabled ttyS00 at 0xf7800000 (irq =3D 10) is a Star_UART !!!!!!!!!!!!!mac is: 0:d0:35:0:XX:XX phy0 id:0243, phy1 id:ffff !!!!!!!!!!! function:configure_lan_port Line:1811 function:configure_lan_port Line:1855 function:configure_lan_port Line:1881 function:configure_lan_port Line:1961 RAMDISK driver initialized: 16 RAM disks of 20480K size 1024 blocksize loop: loaded (max 8 devices) PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered SCSI subsystem driver Revision: 1.00 kmod: failed to exec /sbin/modprobe -s -k scsi_hostadapter, errno =3D 2 kmod: failed to exec /sbin/modprobe -s -k scsi_hostadapter, errno =3D 2 Amd/Fujitsu Extended Query Table v1.1 at 0x0040 str9100_flash: Swapping erase regions for broken CFI table. number of CFI chips: 1 cfi_cmdset_0002: Disabling fast programming due to code brokenness. Creating 3 MTD partitions on "str9100_flash": 0x00000000-0x00020000 : "Armboot" 0x00020000-0x007e0000 : "Kernel & Ramdisk" 0x007e0000-0x00800000 : "configure" ftl_cs: FTL header not found. ftl_cs: FTL header not found. ftl_cs: FTL header not found. usb.c: registered new driver hub hcd.c: ehci_hcd @ EHCI, EHCI_HCdriver hcd.c: irq 24, pci mem fcc00000 usb.c: new USB bus registered, assigned bus number 1 hub.c: USB hub found hub.c: 2 ports detected host/usb-ohci.c: USB OHCI at membase 0xc5819000, IRQ 23 host/usb-ohci.c: usb-OHCI, OHCI_HCdriver usb.c: new USB bus registered, assigned bus number 2 hub.c: USB hub found hub.c: 2 ports detected usb.c: registered new driver usblp printer.c: v0.13: USB Printer Device Class driver Initializing USB Mass Storage driver... usb.c: registered new driver usb-storage USB Mass Storage support registered. NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 4096 bind 8192) NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: AppleTalk 0.18a for Linux NET4.0 NetWinder Floating Point Emulator V0.97 (double precision) do initcalls end RAMDISK: Compressed image found at block 0 Freeing initrd memory: 10240K VFS: Mounted root (ext2 filesystem) readonly. Freeing init memory: 220K UART IRQ_ports =3D c02a6018 UART IRQ at interrupt number 0xa Mon Jan 1 00:00:00 UTC 2007 Mounting root fs rw ... Load x1205 rtc driver ... Using /lib/modules/2.4.27-star/x1205-rtc.o X1205: I2C based RTC driver. X1205: found X1205 on STR9100 I2C Adapter ccr_write_enable: verify SR failed X1205: i2c_add_driver RTC driver. X1205: misc_register RTC driver. atr is 0 Synchronize system date & time ... Mounting other filesystems ... System initialization begin! Load configuration file OK! Time zone setting OK! Load nt_sev OK! info, udhcpc (v0.9.9-pre) started Network setting OK! System time setting OK! sh: =A8t@=FE=FF=BF,=FE=FF=BF=C0=B5: not found Http & Ftp OK! Load automount OK! USB connect to pc; clear all interrupt ! Load button driver OK! Load bittorrent job control deamon OK! Load upnp av finished! Load check disk full finished! System initialization end! Load printerd ... printerd wakened Sysinit done BusyBox v1.00-rc2 (2006.09.14-03:08+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. # MTD block devices are present out of the box. It should be possible to=20 depenguinate this from within Linux; there is no mtd tool, but it could=20 be built and uploaded. There is a python 2.4 interpreter. # cat /proc/iomem 00000000-03ffffff : System RAM 0003f000-00227677 : Kernel code 00227678-002b70ab : Kernel data 10000000-107fffff : flash b0000000-b03fffff : PCI non-prefetchable b0400000-b07fffff : PCI prefetchable It looks like the on-chip USB controller is memory mapped, but does NOT=20 use PCI configuration space -- from dmesg I imagine the Linux USB driver = has been hacked to attach directly to the memory mapped space, a bit=20 like the SiBA core enumeration on the Sentry5 MIPS SoC.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?484A865C.9010009>