
README for the Palm Treo 680.

Copyright (C) 2013 Mike Dunn <mikedunn@newsguy.com>

You may reproduce the contents of this file entirely or in part, but please
credit me by name if you do.  Thanks.


Intro
=====

Yes, you can program u-boot onto the flash of your Palm Treo 680 so that u-boot
(then Linux, Android, ...) runs at power-up.  This document describes how, and
gives some implementation details on this port of u-boot and describes how the
Treo 680 boots from reset.

But first, I probably don't need to tell you that after doing this, your phone
will no longer run PalmOS.  You *may* be able to later restore your phone to its
original state by creating a backup image of the flash before writing u-boot
(details below), but this is not heavily tested and should not be relied upon.
There is also the possibility that something may go wrong during the process of
programming u-boot, leaving you with a bricked phone.  If you follow these
instructions carefully this chance will be minimized, but I do not recommend
that you program u-boot onto a phone that you can not afford to lose, and
certainly not one that contains important data that is not backed up elsewhere.
I AM NOT RESPONSIBLE FOR THE LOSS OF YOUR PHONE.  DO THIS AT YOUR OWN RISK.
Having said that, feel free to send me a note cursing me out if something does
go wrong, but please tell me what happened exactly.  For that matter, I'd love
to hear from you if you succeed.


Details on the SPL
==================

The docg4 features a 2k region at the start of its address space that interfaces
to the system bus like a NOR flash.  This allows the docg4 to function as a boot
ROM.  The Treo 680 uses this feature.  The contents of this 2k region are
write-protected and can not be reprogrammed.  Fortunately, the code it contains
does what we need to do, at least partially.  After some essential hardware
initialization (like the SDRAM controller), it runs an IPL (initial program
loader) that copies 128K (no more, no less) from flash to a fixed address in
SDRAM (0xa1700000) and jumps to it.  128K is too small for u-boot, so we use it
to load a u-boot secondary program loader (SPL).  But since our SPL only
occupies a little over 1k, we can economize on flash usage by having the IPL
load a portion of u-boot proper as well.  We let the IPL load the first 128k of
a concatenated spl + u-boot image, and because the SPL is placed before u-boot
proper, the IPL jumps to the SPL, which copies the portion of u-boot that the
IPL has already loaded to its correct SDRAM address, and then loads the
remainder of u-boot and jumps to it.


The docg4's "reliable mode"
===========================

This is a special mode of operation of the docg4's integrated controller whereby
consecutive pairs of 2k regions are used in parallel (in some fashion) to store
2k of data.  In other words, the normal capacity is halved, but the data
integrity is improved.  In this mode, the data is read or written from pages in
even-numbered 2k regions (regions starting at 0x000, 0x1000, 0x2000, ...).  The
odd-numbered 2k regions (regions starting at 0x800, 0x1800, 0x2800, ...) are
transparently used in parallel.  In reliable mode, the odd-numbered 2k regions
are not meant to be read or written directly.

Reliable mode is used by the IPL because there is not enough space in its 2k
footprint to implement the BCH ecc algorithm.  Data that is read while reliable
mode is enabled must have been written in reliable mode, or the read fails.
However, data written in reliable mode can also be read in normal mode (just not
as reliably), but only from the even-numbered 2k regions; the odd-numbered 2k
regions appear to contain junk, and will generate ecc errors.  When the IPL and
SPL read from flash, the odd-numbered 2k regions are explicitly skipped.  The
same is true for the flash_u-boot utility when it writes the u-boot image in
reliable mode.

The docg4 Linux driver supports writing in reliable mode (it is enabled by the
module parameter), but not reading.  However, the u-boot docg4_spl driver does
read in reliable mode, in the same fashion as the IPL.


Details on the IPL and its data format
======================================

Starting from block 5 and counting upward, the IPL will search for and load the
first two blocks it finds that contain a magic number in the oob of the first
page of the block.  The contents are loaded to SDRAM starting at address
0xa1700000.  After two blocks have been loaded, it jumps to 0xa1700000.  The
number of blocks loaded and the load address in SDRAM are hard-coded; only the
flash offset of the blocks can vary at run-time (based on the presence of the
magic number).

In addition to using the docg4's reliable mode, the IPL expects each 512 byte
page to be written redundantly in the subsequent page.  The hardware is capable
of detecting bit errors (but not correcting them), and if a bit error is
detected when a page is read, the page contents are discarded and the subsequent
page is read.

Reliable mode reduces the capacity of a block by half, and the redundant pages
reduce it by half again.  As a result, the normal 256k capacity of a block is
reduced to 64k for the purposes of the IPL/SPL.

For the sake of simplicity and uniformity, the u-boot SPL mimics the operation
of the IPL, and expects the image to be stored in the same format.


Instructions on Programming u-boot to flash
===========================================

To program u-boot to your flash, you will need to boot the Linux kernel on your
phone using a PalmOS bootloader such as cocoboot.  The details of building and
running Linux on your Treo (cross-compiling, creating a root filesystem,
configuring the kernel, etc) are beyond the scope of this document.  The
remainder of this document describes in detail how to program u-boot to the
flash using Linux running on the Treo.


Hardware Prerequisites
======================

A Palm Treo 680:
  (dugh)

A Palm usb cable:
  You'll need this to establish a usbtty console connection to u-boot from a
  desktop PC.  Currently there is no support in u-boot for the pxa27x keypad
  (coming soon), so a serial link must be used for the console.
  These cables are still widely available if you don't already have one.

A Linux desktop PC.
  You may be able to use Windows for the u-boot console if you have a usb driver
  that is compatible with the Linux usbserial driver, but for programming u-boot
  to flash, you'll really want to use a Linux PC.


Treo-side Software Prerequisites
================================

Linux bootloader for PalmOS:

  Cocoboot is the only one I'm aware of.  If you don't already have this, you
  can download it from
  https://download.enlightenment.org/misc/Illume/Treo-650/2008-11-13/sdcard-base.tar.gz
  which is a compressed tar archive of the contents of an sd card containing
  cocoboot.  Use mkdosfs to create a fat16 filesystem on the first primary
  partition of the card, mount the partition, and extract the tar file to it.
  You will probably need to edit the cocoboot.conf file to customize the
  parameters passed to the kernel.


Linux kernel:

  The kernel on the Treo 680 is still a little rough around the edges, and the
  official kernel frequently breaks on the Treo :(  A development kernel
  specifically for the Treo 680 can be found on github:
    http://github.com/mike-dunn/linux-treo680
  The master branch of this tree has been tested on the Treo, and I recommend
  using this kernel for programming u-boot.  As of this writing, there may be a
  bug in the docg4 nand flash driver that sometimes causes block erasures to
  fail.  This has been fixed in the above tree.

  If you choose to use the official kernel, it must contain the docg4 driver that
  includes the reliable_mode module parameter.  This was a later enhancement to
  the driver, and was merged to the kernel as of v3.8.  Do not try to use an
  earlier kernel that contains the docg4 driver without support for writing in
  reliable mode.  If you try to program u-boot to flash with the docg4 driver
  loaded without the reliable_mode parameter enabled, you *will* brick your
  phone!

  For the purpose of programming u-boot to flash, the following options must be
  enabled in the Treo kernel's .config:

     CONFIG_MTD=y
     CONFIG_MTD_CMDLINE_PARTS=y
     CONFIG_MTD_CHAR=y
     CONFIG_MTD_NAND_DOCG4=m

  Note that the docg4 nand driver is configured as a module, because we will
  want to load and unload it with reliable_mode enabled or disabled as needed.

  You will also need to specify mtd partitions on the kernel command line.  In
  the instructions that follow, we will assume that the flash blocks to which
  u-boot will be programmed are defined by the second partition on the device.
  The u-boot config file (include/configs/palmtreo680.h) places the u-boot image
  at the start of block 6 (offset 0x180000), which is the first writable
  (non-protected) block on the flash (this is also where the PalmOS SPL starts).
  The u-boot image occupies four blocks, so to create the u-boot partition, pass
  this command line to the kernel:
    mtdparts=Msys_Diskonchip_G4:1536k(protected_part)ro,1024k(bootloader_part),-(filesys_part)
  This will create three partitions:
    protected_part: the first six blocks, which are read-only
    bootloader_part: the next four blocks, for the u-boot image
    filesys_part: the remainder of the device
  The mtdchar kernel device driver will use device nodes /dev/mtd0, /dev/mtd1,
  and /dev/mtd2 for these partitions, respectively.  Ensure that your root file
  system at least has /dev/mtd1 if you are not running udev or mdev.


Userspace Utilities:

  In addition to everything necessary to provide a useful userspace environment
  (busybox is indispensable, of course), you will need the mtd-utils package on
  your root filesystem.  I use version 1.5.0 of mtd-utils, and I suggest you use
  this version as well, or at leat a version very close to this one, as
  mtd-utils has tended to be fluid.

  Note that busybox includes a version of mtd-utils.  These are deficient and
  should not be used.  When you run one of these utilities (nanddump, etc),
  ensure you are invoking the separate executable from mtd-utils, and not the
  one built into busybox.  I recommend that you configure busybox with its
  mtd-utils disabled to avoid any possibility of confusion.

  You will also need to cross-compile the userspace Linux utility in
  tools/palmtreo680/flash_u-boot.c, which we will run on the Treo to perform the
  actual write of the u-boot image to flash.  This utility links against libmtd
  from the mtd-utils package.


Desktop PC-side Software Prerequisites
======================================

Terminal emulator application:
  minicom, kermit, etc.


Linux kernel:
  Compiled with CONFIG_USB_SERIAL enabled.  Build this as a module.


Recommended (Not directly related to u-boot)
============================================

Working directly on the Treo's tiny screen and keypad is difficult and
error-prone.  I recommend that you log into the Linux kernel running on your
Treo from your desktop PC using ethernet over usb.  The desktop's kernel must be
configured with CONFIG_USB_USBNET, CONFIG_USB_NET_CDCETHER, and
CONFIG_USB_NET_CDC_SUBSET.  The Treo's kernel will need CONFIG_USB_ETH, and its
init script will need to start an ssh daemon like dropbear.  Note that the usb0
network interface will not appear on the desktop PC until the Treo kernel's usb
ethernet gadget driver has initialized.  You must wait for this to occur (watch
the PC's kernel log) before you can assign usb0 an ip address and log in to the
Treo.  If you also build the Treo's kernel with CONFIG_IP_PNP enabled, you can
pass its ip address on the kernel command line, and obviate the need to
initialize the network interface in your init script.

Having the Palm usb cable connected to the host has the added benefit of keeping
power supplied to your Treo, reducing the drain on the battery.  If something
goes wrong while you're programming u-boot to the flash, you will have lots of
time to correct it before the battery dies.

I have encountered a situation where the kernel is sometimes unable to mount a
root filesystem on the mmc card due to the mmc controller not initializing in
time, (and CONFIG_MMC_UNSAFE_RESUME doesn't seem to help) so I recommend that
you build a minimal root filesystem into the kernel using the kernel's initramfs
feature (CONFIG_BLK_DEV_INITRD).  If you want your root filesystem on the mmc
card, your init script can mount and switch_root to the mmc card after a short
sleep.  But keep in mind that in this case you won't be able to use an mmc card
to transfer files between your desktop and the Treo once Linux is running.
Another option for transfering files is to mount an nfs filesystem exported by
the desktop PC.  For greatest convenience, you can export the root filesystem
itself from your desktop PC and switch_root to it in your init script.  This
will work if your initramfs init script contains a loop that waits for you to
initialize the usb0 network interface on the desktop PC; e.g., loop while a ping
to the desktop PC returns an error.  After the loop exits, do the nfs mount and
call switch_root.  (You can not use the kernel nfsroot feature because the
network will not be up when the kernel expects it to be; i.e., not until you
configure the usb0 interface on the desktop.)  Use the nfs 'nolock' option when
mounting to avoid the need to run a portmapper like rpcbind.


Preliminaries
=============

Once Linux is running on your Treo, you may want to perform a few sanity checks
before programming u-boot.  These checks will verify my assumptions regarding
all the Treo 680s out there, and also ensure that the flash and mtd-utils are
working correctly.  If you are impatient and reckless, you may skip this
section, but see disclaimer at the top of this file!

Load the docg4 driver:

  $ modprobe docg4 ignore_badblocks=1 reliable_mode=1

We tell the driver to use the docg4's "reliable mode" when writing because this
is the format required by the IPL, which runs from power-up and loads the first
portion of u-boot.  We must ignore bad blocks because linux mtd uses out-of-band
(oob) bytes to mark bad blocks, which will cause the blocks written by PalmOS to
be misidentified as "bad" by libmtd.

Check the kernel log to ensure that all's well:

  $ dmesg | tail
   	      <... snip ...>
  docg4 docg4: NAND device: 128MiB Diskonchip G4 detected
  3 cmdlinepart partitions found on MTD device Msys_Diskonchip_G4
  Creating 3 MTD partitions on "Msys_Diskonchip_G4":
  0x000000000000-0x000000180000 : "protected_part"
  0x000000180000-0x000000280000 : "bootloader_part"
  0x000000280000-0x000008000000 : "filesys_part"

Ensure that the partition boundaries are as shown.  (If no partitions are shown,
did you remember to pass them to the kernel on the command line?)  We will write
u-boot to bootloader_part, which starts at offset 0x180000 (block 6) and spans 4
256k blocks.  This partition is accessed through the device node /dev/mtd1.

The docg4 contains a read-only table that identifies blocks that were marked as
bad at the factory.  This table is in the page at offset 0x2000, which is within
the partition protected_part (/dev/mtd0).  There is a slight chance that one or
more of the four blocks that we will use for u-boot is listed in the table, so
use nanddump to inspect the table to see if this is the case:

  $ nanddump -p -l 512 -s 0x2000 -o /dev/mtd0
  ECC failed: 0
  ECC corrected: 0
  Number of bad blocks: 0
  Number of bbt blocks: 0
  Block size 262144, page size 512, OOB size 16
  Dumping data starting at 0x00002000 and ending at 0x00002200...
  0x00002000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
   	      <... snip ...>

The format of the table is simple: one bit per block, with block numbers
increasing from left to right, starting with block 0 as the most significant bit
of the first byte.  A bit will be clear if the corresponding block is bad.  We
want to use blocks 6 throgh 9, so both of the two least significant bits of the
first byte must be set, as must the two most significant bits of the second
byte.  If this is not true in your case (you are very unlucky), you should use
the first contiguous set of four good blocks after block 6, and adjust the
partition boundaries accordingly.  You will also have to change the value of
CONFIG_SYS_NAND_U_BOOT_OFFS in include/configs/palmtreo680.h and recompile
u-boot.  Because the two blocks loaded by the IPL do not have to be contiguous,
but our SPL expects them to be, you will need to erase any good blocks that are
at an offset prior to CONFIG_SYS_NAND_U_BOOT_OFFS, so that the IPL does not find
the magic number in oob and load it.  Once you have done all this, the
instructions in this file still apply, except that the instructions below for
restoring the original PalmOS block contents may need to be modified.

Next, use nanddump to verify that the PalmOS SPL is where we expect it to be.
The SPL can be identified by a magic number in the oob bytes of the first page
of each of the two blocks containing the SPL image.  Pages are 512 bytes in
size, so to dump the first page, plus the oob:

  $ nanddump -p -l 512 -s 0 -o /dev/mtd1
  ECC failed: 0
  ECC corrected: 0
  Number of bad blocks: 0
  Number of bbt blocks: 0
  Block size 262144, page size 512, OOB size 16
  Dumping data starting at 0x00000000 and ending at 0x00000200...
  0x00000000: 0a 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00
   	      <... snip ...>
  0x000001f0: 13 4c 21 60 13 4d 2a 69 13 4b 29 69 89 1a 99 42
    OOB Data: 42 49 50 4f 30 30 30 10 3a e2 00 92 be a0 11 ff

Verify that the first seven bytes of oob data match those in the above line.
(This is ASCII "BIPO000".)

Do the same for the next block:
  $ nanddump -p -l 512 -s 0x40000 -o /dev/mtd1

The first seven oob bytes in last line should read:

    OOB Data: 42 49 50 4f 30 30 31 81 db 8e 8f 46 07 9b 59 ff

(This is ASCII "BIPO001".)

For additional assurance, verify that the next block does *not* contain SPL
data.

  $ nanddump -p -l 512 -s 0x80000 -o /dev/mtd1

It doesn't matter what the oob contains, as long as the first four bytes are
*not* ASCII "BIPO".  PalmOS should only be using two blocks for the SPL
(although we will need four for u-boot).

If you want, you can back up the contents of bootloader_part to a file.  You may
be able to restore it later, if desired (see "Restoring PalmOS" below).

  $ nanddump -l 0x100000 -s 0 -o -f bootloader_part.orig /dev/mtd1

nanddump will spew voluminous warnings about uncorrectable ecc errors.  This is
a consequence of reading pages that were written in reliable mode, and is
expected (these should all occur on pages in odd-numbered 2k regions; i.e.,
0x800, 0xa00, 0xc00, 0xe00, 0x1800, 0x1a00, ...).  The size of the file
bootloader_part.orig should be 1081344, which is 2048 pages, each of size 512
plus 16 oob bytes.  If you are using initramfs for the root filesystem, don't
forget to copy the file to permanent storage, such as an mmc card.

If all of the above went well, you can now program u-boot.


Programming u-boot
==================

Our u-boot includes a small SPL that must be prepended to u-boot proper.  From
the base u-boot source directory on your desktop PC:

  $ cat spl/u-boot-spl.bin u-boot.bin > u-boot-concat.bin

cd to the tools/palmtreo680/ directory, and cross-compile flash_u-boot.c for the
Treo:

  $(CC) -o flash_u-boot $(CFLAGS) $(INCLUDEPATH) $(LIBPATH) flash_u-boot.c -lmtd

Substitute variable values from your cross-compilation environment as
appropriate.  Note that it links to libmtd from mtd-utils, and this must be
included in $(LIBPATH) and $(INCLUDEPATH).

Transfer u-boot-concat.bin and the compiled flash_u-boot utility to the Treo's
root filesystem.  On the Treo, cd to the directory where these files were
placed.

Load the docg4 driver if you have not already done so.

  $ modprobe docg4 ignore_badblocks=1 reliable_mode=1

Erase the blocks to which we will write u-boot:

  $ flash_erase /dev/mtd1 0x00 4

If no errors are reported, write u-boot to the flash:

  $ ./flash_u-boot u-boot-concat.bin /dev/mtd1

You can use nanddump (see above) to verify that the data was written.  This
time, "BIPO" should be seen in the first four oob bytes of the first page of all
four blocks in /dev/mtd1; i.e., at offsets 0x00000, 0x40000, 0x80000, 0xc0000.

Shutdown linux, remove and re-insert the battery, hold your breath...


Enjoying u-boot
===============

After you insert the battery, the u-boot splash screen should appear on the lcd
after a few seconds.  With the usb cable connecting the Treo to your PC, in the
kernel log of your PC you should see

  <6>usb 3-1: New USB device found, idVendor=0525, idProduct=a4a6
  <6>usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
  <6>usb 3-1: Product: U-Boot 2013.01-00167-gd62ef56-dirty
  <6>usb 3-1: Manufacturer: Das U-Boot

Load the usbserial module on your desktop PC:

  $ modprobe usbserial vendor=0x0525 product=0xa4a6

and run your favorite terminal emulation utility (minicom, kermit, etc) with the
serial device set to /dev/ttyUSB0 (assuming this is your only usb serial
device).  You should be at the u-boot console (type 'help').

There is not much that is unique about using u-boot on the palm treo 680.
Kernels can be loaded from mmc, flash, and from the desktop PC via kermit.  You
can expand the size of the second partition on the flash to contain a kernel, or
else put the kernel(s) in their own partition.

Nand commands work as expected, with the excepton that blocks not written by the
linux mtd subsystem may be misidentified by the u-boot docg4 driver as "bad" if
they contain data in the oob bytes.  This will be the case for the blocks
containing the u-boot image, for example.  To work around this, use 'nand scrub'
instead of 'nand erase' to erase these blocks, and 'nand read.raw' to read them
to memory.  (It would be useful if u-boot's nand commands provided a way to
explicitly ignore "bad" blocks, because read.raw does not perform ecc.)  The
'nand dump' command will read these "bad" blocks, however.

Currently u-boot itself can only be programmed to flash from Linux; there is no
support for reliable mode in u-boot's docg4 flash driver.  This should be
corrected soon.


Customizing
===========

If you change u-boot's configuration significantly (adding or removing
features), you may have to adjust the value of CONFIG_SYS_NAND_U_BOOT_SIZE.
This is the size of the concatenated spl + u-boot image, and tells the SPL how
many flash blocks it needs to load.  It will be rounded up to the next 64k
boundary (the spl flash block capacity), so it does not have to be exact, but
you must ensure that it is not less than the actual image size.  If it is larger
than the image, blocks may be needlessly loaded, but if too small, u-boot may
only be partially loaded, resulting in a boot failure (bricked phone), so better
to be too large.  The flash_u-boot utility will work with any size image and
write the required number of blocks, provided that the partition is large
enough.

As the first writable block on the device, block 6 seems to make the most sense
as the flash offset for writing u-boot (and this is where PalmOS places its
SPL).  But you can place it elsewhere if you like.  If you do, you need to
adjust CONFIG_SYS_NAND_U_BOOT_OFFS accordingly, and you must ensure that blocks
preceeding the ones containing u-boot do *not* have the magic number in oob (the
IPL looks for this).  In other words, make sure that any blocks that previously
contained the u-boot image or PalmOS SPL are erased (and optionally written with
something else) so that the IPL does not load it.  Also make sure that the new
u-boot starting offset is at the start of a flash partition (check the kernel
log after loading the docg4 driver), and pass the corresponding mtd device file
to the flash_u-boot utility.

The u-boot built-in default environment is used because a writable environment
in flash did not seem worth the cost of a 256k flash block.  But adding this
should be straightforward.


Restoring PalmOS
================

If you backed up the contents of bootloader_part flash partition earlier, you
should be able to restore it with the shell script shown below.  The first two
blocks of data contain the PalmOS SPL and were written in reliable mode, whereas
the next two blocks were written in normal mode, so the script has to load and
unload the docg4 driver.  Make sure that the mtd-utils nandwrite and flash_erase
are in your path (and are not those from busybox).  Also double-check that the
backup image file bootloader_part.orig is exactly 1081344 bytes in length.  If
not, it was not backed up correctly.  Run the script as:

  ./restore_bootpart bootloader_part.orig /dev/mtd1

The script will take a minute or so to run.  When it finishes, you may want to
verify with nanddump that the data looks correct before you cycle power, because
if the backup or restore failed, your phone will be bricked.  Note that as a
consequence of reliable mode, the odd-numbered 2k regions in the first two
blocks will not exactly match the contents of the backup file, (so unfortunately
we can't simply dump the flash contents to a file and do a binary diff with the
original back-up image to verify that it was restored correctly).  Also,
nanddump will report uncorrectable ecc errors when it reads those regions.

#!/bin/sh

if [ $# -ne 2 ]; then
    echo "usage: $0: <image file> <mtd device node>"
    exit 1
fi

# reliable mode used for the first two blocks
modprobe -r docg4
modprobe docg4 ignore_badblocks=1 reliable_mode=1 || exit 1

# erase all four blocks
flash_erase $2 0 4

# Program the first two blocks in reliable mode.
# 2k (4 pages) is written at a time, skipping alternate 2k regions
# Note that "2k" is 2112 bytes, including 64 oob bytes
file_ofs=0
flash_ofs=0
page=0
while [ $page -ne 1024 ]; do
    dd if=$1 bs=2112 skip=$file_ofs count=1 | nandwrite -o -n -s $flash_ofs $2 - || exit 1
    file_ofs=$((file_ofs+2))
    flash_ofs=$((flash_ofs+0x1000))
    page=$((page+8))
done;

# normal mode used for the next two blocks
modprobe -r docg4
modprobe docg4 ignore_badblocks=1 || exit 1
dd if=$1 bs=1 skip=$file_ofs count=540672 | nandwrite -o -n -s 0x80000 $2 - || exit 1
modprobe -r docg4


TODO
====

  - Keypad support.
  - Interactive boot menu using keypad and lcd.
  - Add reliable mode support to the u-boot docg4 driver.
  - U-boot command that will write a new image to the bootloader partition in
    flash.
  - Linux FTD support.