Continuing on from my last post.<\/p>\n
The board I have contains the following hardware (other than the CPU)<\/p>\n
RAM – k4s561632d-tl75 = 16M X 8BITS x 2 banks (64m ram?)
\nROM – H27UBG8T2A TR = 4G Nand Flash (4G MLC? some ref as 2G, need to double check..)<\/p>\n
NAND Config:
\n1024 blocks. Each block has 256 programmable pages. Each Page is 8640 bytes (8192+448spare)<\/p>\n
Ingenic has a USBBoot.exe tool which can be used to view the NAND.
\nTesting was done with these nand settings in usbboot.cfg:<\/p>\n
[SDRAM] [NAND] NAND Config notes –<\/p>\n HYNIX_H27UBG8T2AR 3.3V 32Gbit NAND ID of No.0 device No.0 flash: \/\/ ad d7 94 9a 74 42 3.3V Bus Width x8<\/p>\n 3rd Byte Dev ID<\/p>\n 0x94=0b10010100 <\/p>\n 00 – Internal Chip Number 1 0x9a=0b10011010<\/p>\n 10 – 8kb page size 0x74=0b 0 111 01 00<\/p>\n 01 – 2 Planes 0x42=0b01 000 010 —-<\/p>\n I also see this though in one of the nand.cfg files<\/p>\n NandID,NandExtID=PlaneNum, Tals, Talh, \tTrp, Twp,Trhw, Twhr, dwPageSize, dwBlockSize, dwOOBSize, dwPageAddressCycle,dwMinValidBlocks,dwMaxValidBlocks, NandName<\/p>\n 0xADD7,0x00749A94=1,\t 15, \t5, \t15, 15, 100, 80, 8192, \t2048*1024, 448, 3,\t 1998,\t2048,\t“HYNIX_HY27UBG8T2ATR”}\t<\/p>\n Its referred to there as a 2G sized chip. So.. are Hynix Docs right or the above?<\/p>\n —<\/p>\n A look at the NAND shows:<\/p>\n USBBoot :> nreadraw 0 1024 0 0<\/p>\n 00000000 ff 55 55 55 55 55 55 55 ff ff ff ff 01 00 11 04 |.UUUUUUU……..| IPL? <\/p>\n IPL = Initial Program Loader. Boot_Sel I hear you ask?<\/p>\n The JZ4755 has an integrated ROM with 8KB this memory is connected to the External Memory Controller (EMC). boot_sel[1:0] Our CPU then reads the first byte from NAND to determine whether the bus is 8- or 16-bit. Our NAND has 8-bit data, 3 cyles, and 8192 bytes per page, so the first byte should be 0xFF<\/p>\n On our board, the boot_sel is configured by the cunningly labelled boot button. So, we now know how the board boots up, and why our USB works.<\/p>\n So lets look at the actual boot code we decompiled above. Luckily I know a man with tar.gz roaming around the back streets, and persuaded him to give me some goodies. (Ok, fine, its all at the Ingenic.cn ftp site).<\/p>\n I’ll be even lazier though, and paste in the bits off of the Qi wiki here – http:\/\/en.qi-hardware.com\/wiki\/Boot_Process as its pretty much identical.<\/p>\n start.S<\/p>\n The first subroutine ran is the _start, which is defined in \/cpu\/mips\/start.S, this subroutine makes a call to the reset function, defined on the same file, which code is shown next:<\/p>\n \t.globl _start \t\/* Init Timer *\/ \t\/* Initialize GOT pointer. \tla\tsp, 0x80004000 Hmm, looks familiar doesn’t it.<\/p>\n If we look at hex dumps for most nand uboots for this device, you’ll find fairly similar code structures in all right at the start, albeit with slightly different header prefixes.<\/p>\n Next in series – dumping the NAND and converting the dumps back to binary for some reverse engineering the file system formats in use (assuming our NAND dumps are indeed correct!).<\/p>\n","protected":false},"excerpt":{"rendered":" Continuing on from my last post. The board I have contains the following hardware (other than the CPU) RAM – k4s561632d-tl75 = 16M X 8BITS x 2 banks (64m ram?) ROM – H27UBG8T2A TR = 4G Nand Flash (4G MLC? some ref as 2G, need to double check..) NAND Config: 1024 blocks. Each block has […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[390,282,25],"tags":[251,414,391,413,393],"class_list":["post-850","post","type-post","status-publish","format-standard","hentry","category-arcade-machines","category-firmware-2","category-technical-mumbo-jumbo","tag-embedded","tag-ingenic","tag-jamma","tag-mips","tag-reverse-engineering"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/850","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/comments?post=850"}],"version-history":[{"count":10,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/850\/revisions"}],"predecessor-version":[{"id":860,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/posts\/850\/revisions\/860"}],"wp:attachment":[{"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/media?parent=850"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/categories?post=850"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.computersolutions.cn\/blog\/wp-json\/wp\/v2\/tags?post=850"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n[PLL]
\nEXTCLK\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a024\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Define\u00a0the\u00a0external\u00a0crystal\u00a0in\u00a0MHz
\nCPUSPEED\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0336\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Define\u00a0the\u00a0PLL\u00a0output\u00a0frequency
\nPHMDIV\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a03\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Define\u00a0the\u00a0frequency\u00a0divider\u00a0ratio\u00a0of\u00a0PLL=CCLK:PCLK=HCLK=MCLK
\nBOUDRATE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a057600\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Define\u00a0the\u00a0uart\u00a0baudrate. Yes they misspelt it.
\nUSEUART\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a01\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Use\u00a0which\u00a0uart,\u00a00\/1\u00a0for\u00a0jz4740,0\/1\/2\/3\u00a0for\u00a0jz4750 <\/p>\n
\n\t\t\t\t;k4s561632d \/ : RA0 ~ RA12, Column address : CA 0 ~ CA 8
\n\t\t\t\t;32M x 2 chips = 64M total Ram.
\nBUSWIDTH\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a016\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;The\u00a0bus\u00a0width\u00a0of\u00a0the\u00a0SDRAM\u00a0in\u00a0bits\u00a0(16|32)
\nBANKS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a04\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;The\u00a0bank\u00a0number\u00a0(2|4)
\nROWADDR\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a013\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Row\u00a0address\u00a0width\u00a0in\u00a0bits\u00a0(11-13)
\nCOLADDR\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a09\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Column\u00a0address\u00a0width\u00a0in\u00a0bits\u00a0(8-12)
\nISMOBILE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Define\u00a0whether\u00a0SDRAM\u00a0is\u00a0mobile\u00a0SDRAM,\u00a0this\u00a0only\u00a0valid\u00a0for\u00a0Jz4750\u00a0,1:yes\u00a00:no
\nISBUSSHARE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a01\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Define\u00a0whether\u00a0SDRAM\u00a0bus\u00a0share\u00a0with\u00a0NAND\u00a01:shared\u00a00:unshared <\/p>\n
\nBUSWIDTH\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 8\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;The\u00a0width\u00a0of\u00a0the\u00a0NAND\u00a0flash\u00a0chip\u00a0in\u00a0bits\u00a0(8|16|32)
\nROWCYCLES\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;The\u00a0row\u00a0address\u00a0cycles\u00a0(2|3)
\nPAGESIZE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 8192\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;The\u00a0page\u00a0size\u00a0of\u00a0the\u00a0NAND\u00a0chip\u00a0in\u00a0bytes(512|2048|4096)
\nPAGEPERBLOCK\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0256\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;The\u00a0page\u00a0number\u00a0per\u00a0block
\nFORCEERASE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;The\u00a0force\u00a0to\u00a0erase\u00a0flag\u00a0(0|1)
\nOOBSIZE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0448\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;oob\u00a0size\u00a0in\u00a0byte
\nECCPOS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Specify\u00a0the\u00a0ECC\u00a0offset\u00a0inside\u00a0the\u00a0oob\u00a0data\u00a0(0-[oobsize-1])
\nBADBLACKPOS\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Specify\u00a0the\u00a0badblock\u00a0flag\u00a0offset\u00a0inside\u00a0the\u00a0oob\u00a0(0-[oobsize-1])
\nBADBLACKPAGE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Specify\u00a0the\u00a0page\u00a0number\u00a0of\u00a0badblock\u00a0flag\u00a0inside\u00a0a\u00a0block(0-[PAGEPERBLOCK-1])
\nPLANENUM\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0 2\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;The\u00a0planes\u00a0number\u00a0of\u00a0target\u00a0nand\u00a0flash
\nBCHBIT\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Specify\u00a0the\u00a0hardware\u00a0BCH\u00a0algorithm\u00a0for\u00a04750\u00a0(4|8)
\nWPPIN\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a019\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Specify\u00a0the\u00a0write\u00a0protect\u00a0pin\u00a0number\u00a0
\nBLOCKPERCHIP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0;Specify\u00a0the\u00a0block\u00a0number\u00a0per\u00a0chip,0\u00a0means\u00a0ignore
\n<\/code><\/p>\n
\n4096M x 8bit<\/p>\n
\n Vendor ID :0xad (Hynix) \/\/Manufacturer Code
\n Product ID :0xd7 (Device ID) \/\/ Device Identifier
\n Chip ID :0x94 \/\/Internal Chip Number
\n Page ID :0x9a \/\/Page Size\/BlockSize\/Redundant Area
\n Plane ID :0x74 \/\/Plane Number , ECC
\n Tech ID :0x42 \/\/Tech \/ EDO \/Interface<\/p>\n
\n01 – 4 Level Cell (cell type)
\n01 – 2 pages programmed at once
\n10 – Interleave supported, Write Cache Supported<\/p>\n
\n0 10 – 448 Bytes (redundant area size)
\n1 01 – 2M Block Size (without spare area)<\/p>\n
\nECC level – reserved.<\/p>\n
\n010 32nm Nand
\n0 EDO Supported
\n0 SDR NAND Interface<\/p>\n
\n00000010 00 00 00 00 21 e0 e0 03 00 00 e9 8f 21 e0 20 01 |….!…….!. .|
\n00000020 00 80 1d 3c 00 40 bd 37 00 80 19 3c 90 06 39 27 |…<.@.7...<..9'|\n00000030 08 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 |.. .............|\n00000040 1b 43 02 3c 83 de 42 34 19 00 82 00 0f 00 02 3c |.C.<..B4.......<|\n00000050 10 20 00 00 40 42 42 34 82 24 04 00 1b 00 44 00 |. ..@BB4.$....D.|\n00000060 f4 01 80 00 50 c3 03 34 21 60 a0 00 12 48 00 00 |....P..4!`...H..|\n00000070 1b 00 69 00 f4 01 20 01 12 28 00 00 02 10 25 71 |..i... ..(....%q|\n00000080 01 00 a4 24 50 c3 42 38 0b 28 82 00 04 00 a3 2c |...$P.B8.(.....,|\n00000090 33 00 60 10 0c 00 a2 2c 04 00 05 24 fc ff a2 24 |3.`....,...$...$|\n000000a0 40 23 02 00 20 4e 02 24 1b 00 49 00 f4 01 20 01 |@#.. N.$..I... .|\n000000b0 12 28 00 00 04 00 a3 2c 27 00 60 14 c0 12 05 00 |.(.....,'.`.....|\n000000c0 08 00 a2 2c 2a 00 40 10 00 18 8a 34 00 5a 05 00 |...,*.@....4.Z..|\n\u2026.\n\nOur JZ4755 is a MIPS XSCALE CPU.\n\nThe above dump is off of a NAND, so we have a 12byte prefix (need to look at the JZ dev nand.c for a proper reason why).\nAllegedly in the spanish forums, its due to NAND write testing for signedness etc.\n\nIf I run it through a decompiler eg mips-linux-objdump -bbinary -mmips -D ..., I do see valid code, so our initial dump looks correct for MIPS.\nMIPS == Backasswardness vs our dump, cough.\n\n0: 555555ff 0x555555ff\n4: 55555555 0x55555555\n8: ffffffff 0xffffffff\n\nc: 04110001 bal 14 \n10: 00000000 nop\n14: 03e0e021 move gp,ra\n18: 8fe90000 lw t1,0(ra)\n1c: 0120e021 move gp,t1\n20: 3c1d8000 lui sp,0x8000\n24: 37bd4000 ori sp,sp,0x4000\n28: 3c198000 lui t9,0x8000\n2c: 273906b8 addiu t9,t9,1720\n30: 03200008 jr t9\n34: 00000000 nop\n38: 00000000 nop\n...\n\nThis should match up to our IPL -> SPL stuff uboot loader. Lets see, first though, an explanation.<\/p>\n
\nThis is in CPU, and 8K in size (need to double check that in the Ingenic CPU docs), basically it boots to NAND, runs the code in NAND, unless otherwise directed via boot_sel.<\/p>\n
\nAfter a processor reset, the processor runs the program contained in the ROM memory, and depending on the values of the boot_sel[1:0] flags carries out the following operations:<\/p>\n
\n00\tUnused
\n01\tInitialization via USB port: Receives a block of data through the USB (device) port,
\n and stores it in internal SRAM.
\n10\tInitialization via NAND memory with 512-byte pages at Chip Select 1 (CS1):
\n11\tInitialization via NAND memory with 2048-byte pages at Chip Select 1 (CS1): <\/p>\n
\n(if bit[7:4] = 0, it is 16-bit), and the number of cycles per page is 2 or 3 (if bit[3:0] = 0, it is 2 cycles).
\nIt then adjusts the EMC using this information and copies the first 8kB from NAND to the internal SRAM.<\/p>\n
\nIf its pressed and we then connect a usb cable, our CPU then sits there waiting for an init via USB port.<\/p>\n
\n \t.text
\n .word JZ4740_NANDBOOT_CFG \/*(0xffffffff) NAND 8 Bits 3 cycles *\/
\n b reset; nop \/* U-boot entry point *\/
\n b reset; nop \/* software reboot *\/
\nreset:
\n \t\/*
\n \t * CU0=UM=EXL=IE=0, BEV=ERL=1, IP2~7=1 \t *\/
\n \tli\tt0, 0x0040FC04 \/*t0 = 0x0040FC04 *\/
\n \tmtc0\tt0, CP0_STATUS \/*CP0_STAT = 0x0040FC04 Normal mode processor,
\n disable interrupts, Exception level normal,
\n kernel mode*\/
\n \t\/* IV=1, use the specical interrupt vector (0x200) *\/
\n \tli\tt1, 0x00800000
\n \tmtc0\tt1, CP0_CAUSE \/*CP0_CAUSE = 0x00800000 Cause of last exception*\/<\/p>\n
\n \tmtc0\tzero, CP0_COUNT \/*Address at which processing resumes after an exception*\/
\n \tmtc0\tzero, CP0_COMPARE \/**\/<\/p>\n
\n\t*\/
\n \tbal 1f
\n \tnop
\n \t.word _GLOBAL_OFFSET_TABLE_
\n \t1:
\n \tmove gp, ra
\n \tlw t1, 0(ra)
\n \tmove\tgp, t1<\/p>\n
\n \tla\tt9, nand_boot
\n \tj\tt9
\n \tnop<\/p>\n