QSD8250 illegal instruction on WinCE devices

QSD8250 illegal instruction on WinCE devices

[Lukas-David Gorris]

Hi,

With the acer s200 we now have a second WinCE based device supported  
by our kernel for htc leo at  
git://git.linuxtogo.org/home/groups/mobile-linux/kernel.git  
htc-msm-2.6.32 . S200 has 256MB ram rather than 512 in leo. Only a  
small patch to rearrange memory mapping was needed.

The same cpu crashes as on leo were observed when booting an  
openembedded initrd on s200. So I think we can conclude that the  
illegal instruction problem is not specific to the very leo hardware.

Please look at the following prints on snapdragon SoC:

acer s200:
QUALCOMM(R)
QSD8250
BK153.R1
H192600C
AAB

htc leo:
QUALCOMM(R)
QSD8250
B0US19.0
H192500C
AAB

passion aka nexus one:
QUALCOMM(R)
QSD8250
B1F777.0
H194400C

This is taken from FCC testing photographs. More at  
http://htc-linux.org/wiki/index.php?title=Qsd8250 Not the acer s100  
(also wince device) with AAA suffix.

I think it is striking that the nexus one which comes with linux  
installed lacks the three letter suffix.

S200 and leo come with WinCE so it's obvious both have WinCE AMSS  
version. Both have the AAB appended on the SoC print. Both devices  
show the cpu crash (as indicated earlier the kernel used on both  
devices is almost same. so it's up to you how valid this is)

Nexus one aka passion comes with linux and has a linux specific AMSS  
version. All kinds of binaries with instruction sets spoken by  
cortex-a8 can be executed without any crashes.

It seems obvious that the problem is in some way related to the fact  
that our system is designed for use with WinCE.
(On a side note WinCE makes limited use of the optimizations of  
different ARM versions afaik. Yes, we did try running userspace  
without them. E.g. I tried to use a debian armel rootfilesystem with  
armv4t which works well on the nexus one / passion but it failed for me)

As it was mentioned it might be that the SoC in leo device is  
'programmed' in a different way because WinCE assumes different things  
than linux. I can confirm this to a certain extent. It is known that  
there are massive differences in the AMSS. E.g. we need to patch  
proc_comm, clock, ... for use with WinCE amss devices. But as I stated  
earlier we never had such a problem with crashes on the older WinCE  
devices with msm7x0x non-A and msm7xxxA. When linux boots you can  
execute everything. This is a phenomenon limited to WinCE qsd8.

A different thing to keep in mind is that we do not have a clean boot.  
Before WinCE is removed from memory and the linux kernel is loaded and  
started quite some stuff happens to the hardware. How far could this  
be related?

I am wondering about the qsd8 devices you QIC Inc. guys are working  
with. What about the snapdragon fish? Do they have the three letter  
suffix on qsd8250 ? Are there extra evaluation baords for WinCE ?

Once I received my 3,3V ttl level UART device I will try to boot  
git://codeaurora.org/quic/kernel/dwalker/linux-msm.git msm-core kernel  
on leo. As I'm not the best coder I'm wondering if it is good to help  
for ask here regarding leo specific patches in that branch.


Thanks

Lukas

Re: QSD8250 illegal instruction on WinCE devices

[Lukas-David Gorris]

[-- Attachment #1: Type: text/plain, Size: 1493 bytes --]

Hello,

The segmentation fault problem on htcleo and other WinCE based qs8250  
devices is solved. We need to set the cpu into some magic mode before  
boot and all cpu crashes are gone.
As suspected it is in fact in some way related to WinCE VS. linux  
device: A WinCE developer with low level knowledge by the name of K,  
'Cotulla' Ivan looked at the bootloader of qsd8250 based htc bravo,  
one of the _linux_ phones with the chip. This is where the necessary  
cpu init code was discovered. This init code is obviously not needed  
and used for WinCE which is why we were in 'crash mode' when booting  
linux. It is suppoed to be some workaround for a 'hardware bug'.

The HaRET Handheld Reverse Engineering Tool and bootloader was patched  
by Martijn Stolk with the qsd8250 cpu init code. Using this patched  
version we successfully tested htc leo / hd2 and acer s200 using our  
htc-msm-2.6.32 kernel. No segmentation faults or illegal instruction  
errors were observed on either device.

I am attaching the initial init file with the fix and the HaRET patch  
that was derived from it. The original mailing list thread is archived  
at

http://lists.linuxtogo.org/pipermail/mobile-linux-discuss/2010-June/000128.html

I am really wondering if qsd8* evaluation boards use something similar..

Regarding thoughts about different SoC revisions it seems like the B  
in qsd8250B devices is not relevant.


Thanks again for the help with this !

Lukas

[-- Attachment #2: init8250.S --]
[-- Type: application/octet-stream, Size: 13008 bytes --]

/*
 * Copyright (c) 2008, QUALCOMM Incorporated.
 * Copyright (c) 2009, Code Aurora Forum. All rights reserved.
 * Copyright (c) 2008-2009, Google Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *  * Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *  * Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the 
 *    distribution.
 *  * Neither the name of Google, Inc. nor the names of its contributors
 *    may be used to endorse or promote products derived from this
 *    software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 
 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */


    .section ".text.addinit", "ax"	


#define DSB .byte 0x4f, 0xf0, 0x7f, 0xf5
#define ISB .byte 0x6f, 0xf0, 0x7f, 0xf5


.globl _BOOTUP_init_CPU
_BOOTUP_init_CPU:
     	MOV	R0, #0
	MOV	R7, R1
	MOV	R8, R2

//	B	skip_label


        //; DCIALL to invalidate L2 cache bank (needs to be run 4 times, once per bank)
        //; This must be done early in code (prior to enabling the caches)
        MOV    r1, #0x2
        MCR    p15, 0, r1, c9, c0, 6   //; DCIALL bank D ([15:14] == 2'b00)
        ORR    r1, r1, #0x00004000
        MCR    p15, 0, r1, c9, c0, 6   //; DCIALL bank C ([15:14] == 2'b01)
        ADD    r1, r1, #0x00004000
        MCR    p15, 0, r1, c9, c0, 6   //; DCIALL bank B ([15:14] == 2'b10)
        ADD    r1, r1, #0x00004000
        MCR    p15, 0, r1, c9, c0, 6   //; DCIALL bank A ([15:14] == 2'b11)

        //; Initialize the BPCR - setup Global History Mask (GHRM) to all 1's
        //; and have all address bits (AM) participate.
        //; Different settings can be used to improve performance
        // MOVW   r1, #0x01FF
.word 0xe30011ff  // hardcoded MOVW instruction due to lack of compiler support
        // MOVT   r1, #0x01FF
.word 0xe34011ff  // hardcoded MOVT instruction due to lack of compiler support
        MCR    p15, 7, r1, c15, c0, 2   //; WCP15_BPCR


        //; Initialize all I$ Victim Registers to 0 for startup
        MCR    p15, 0, r0, c9, c1, 0    //; WCP15_ICVIC0    r0
        MCR    p15, 0, r0, c9, c1, 1    //; WCP15_ICVIC1    r0
        MCR    p15, 0, r0, c9, c1, 2    //; WCP15_ICVIC2    r0
        MCR    p15, 0, r0, c9, c1, 3    //; WCP15_ICVIC3    r0
        MCR    p15, 0, r0, c9, c1, 4    //; WCP15_ICVIC4    r0
        MCR    p15, 0, r0, c9, c1, 5    //; WCP15_ICVIC5    r0
        MCR    p15, 0, r0, c9, c1, 6    //; WCP15_ICVIC5    r0
        MCR    p15, 0, r0, c9, c1, 7    //; WCP15_ICVIC7    r0

        //; Initialize all I$ Locked Victim Registers (Unlocked Floors) to 0
        MCR    p15, 1, r0, c9, c1, 0    //; WCP15_ICFLOOR0  r0
        MCR    p15, 1, r0, c9, c1, 1    //; WCP15_ICFLOOR1  r0
        MCR    p15, 1, r0, c9, c1, 2    //; WCP15_ICFLOOR2  r0
        MCR    p15, 1, r0, c9, c1, 3    //; WCP15_ICFLOOR3  r0
        MCR    p15, 1, r0, c9, c1, 4    //; WCP15_ICFLOOR4  r0
        MCR    p15, 1, r0, c9, c1, 5    //; WCP15_ICFLOOR5  r0
        MCR    p15, 1, r0, c9, c1, 6    //; WCP15_ICFLOOR6  r0
        MCR    p15, 1, r0, c9, c1, 7    //; WCP15_ICFLOOR7  r0

        //; Initialize all D$ Victim Registers to 0
        MCR    p15, 2, r0, c9, c1, 0    //; WP15_DCVIC0    r0
        MCR    p15, 2, r0, c9, c1, 1    //; WP15_DCVIC1    r0
        MCR    p15, 2, r0, c9, c1, 2    //; WP15_DCVIC2    r0
        MCR    p15, 2, r0, c9, c1, 3    //; WP15_DCVIC3    r0
        MCR    p15, 2, r0, c9, c1, 4    //; WP15_DCVIC4    r0
        MCR    p15, 2, r0, c9, c1, 5    //; WP15_DCVIC5    r0
        MCR    p15, 2, r0, c9, c1, 6    //; WP15_DCVIC6    r0
        MCR    p15, 2, r0, c9, c1, 7    //; WP15_DCVIC7    r0

        //; Initialize all D$ Locked VDCtim Registers (Unlocked Floors) to 0
        MCR    p15, 3, r0, c9, c1, 0    //; WCP15_DCFLOOR0  r0
        MCR    p15, 3, r0, c9, c1, 1    //; WCP15_DCFLOOR1  r0
        MCR    p15, 3, r0, c9, c1, 2    //; WCP15_DCFLOOR2  r0
        MCR    p15, 3, r0, c9, c1, 3    //; WCP15_DCFLOOR3  r0
        MCR    p15, 3, r0, c9, c1, 4    //; WCP15_DCFLOOR4  r0
        MCR    p15, 3, r0, c9, c1, 5    //; WCP15_DCFLOOR5  r0
        MCR    p15, 3, r0, c9, c1, 6    //; WCP15_DCFLOOR6  r0
        MCR    p15, 3, r0, c9, c1, 7    //; WCP15_DCFLOOR7  r0

        //; Initialize ASID to zero
        MCR    p15, 0, r0, c13, c0, 1   //; WCP15_CONTEXTIDR r0

        //; ICIALL to invalidate entire I-Cache
        MCR    p15, 0, r0, c7, c5, 0    //; ICIALLU

        //; DCIALL to invalidate entire D-Cache
        MCR    p15, 0, r0, c9, c0, 6    //; DCIALL  r0


        //; The VBAR (Vector Base Address Register) should be initialized
        //; early in your code. We are setting it to zero
        MCR    p15, 0, r0, c12, c0, 0   //; WCP15_VBAR  r0

        //; Ensure the MCR's above have completed their operation before continuing
        DSB
        ISB

        //;-------------------------------------------------------------------
        //; There are a number of registers that must be set prior to enabling
        //; the MMU. The DCAR is one of these registers. We are setting
        //; it to zero (no access) to easily detect improper setup in subsequent
        //; code sequences
        //;-------------------------------------------------------------------
        //; Setup DACR (Domain Access Control Register) to zero
        MCR    p15, 0, r0, c3, c0, 0    //; WCP15_DACR  r0

        //; Setup DCLKCR to allow normal D-Cache line fills
        MCR    p15, 1, r0, c9, c0, 7    //; WCP15_DCLKCR r0

        //; Initialize the ADFSR and EFSR registers.
        MCR    p15, 0, r0,  c5, c1, 0   //; ADFSR
        MCR    p15, 7, r0, c15, c0, 1   //; EFSR

        //; Setup the TLBLKCR
        //; Victim = 6'b000000; Floor = 6'b000000;
        //; IASIDCFG = 2'b00 (State-Machine); IALLCFG = 2'b01 (Flash); BNA = 1'b0;
        MOV    r1, #0x02
        MCR    p15, 0, r1, c10, c1, 3     //; WCP15_TLBLKCR  r1

        //;Make sure TLBLKCR is complete before continuing
        ISB

        //; Invalidate the UTLB
        MCR    p15, 0, r0, c8, c7, 0      //; UTLBIALL

        //; Make sure UTLB request has been presented to macro before continuing
        ISB

        //; setup L2CR1 to some default Instruction and data prefetching values
        //; Users may want specific settings for various performance enhancements
        //; In Halcyon we do not have broadcasting barriers. So we need to turn
        //  ; on bit 8 of L2CR1; which DBB:( Disable barrier broadcast )
        MOV r2, #0x100
        MCR    p15, 3, r2, c15, c0, 3     //; WCP15_L2CR1  r0


        //; Enable Z bit to enable branch prediction (default is off)
        MRC    p15, 0, r2, c1, c0, 0      //; RCP15_SCTLR  r2
        ORR    r2, r2, #0x00000800
        MCR    p15, 0, r2, c1, c0, 0      //; WCP15_SCTLR  r2

#ifdef CONFIG_ARCH_QSD8X50
        /* disable predecode repair cache for thumb2 (DPRC, set bit 4 in PVR0F2) */
        mrc p15, 0, r2, c15, c15, 2
        orr r2, r2, #0x10
        mcr p15, 0, r2, c15, c15, 2
#endif


        mov r1, lr
        //; Make sure Link stack is initialized with branch and links to sequential addresses
        //; This aids in creating a predictable startup environment
       BL      SEQ1
SEQ1:  BL      SEQ2
SEQ2:  BL      SEQ3
SEQ3:  BL      SEQ4
SEQ4:  BL      SEQ5
SEQ5:  BL      SEQ6
SEQ6:  BL      SEQ7
SEQ7:  BL      SEQ8
SEQ8:
        mov lr, r1


        //; REMOVE FOLLOWING THREE INSTRUCTIONS WHEN POWER COLLAPSE IS ENA
        //;Make sure the DBGOSLSR[LOCK] bit is cleared to allow access to the debug registers
        //; Writing anything but the "secret code" to the DBGOSLAR clears the DBGOSLSR[LOCK] bit
        MCR    p14, 0, r0, c1, c0, 4       //; WCP14_DBGOSLAR r0


        //; Read the DBGPRSR to clear the DBGPRSR[STICKYPD]
        //; Any read to DBGPRSR clear the STICKYPD bit
        //; ISB guarantees the read completes before attempting to
        //; execute a CP14 instruction.
        MRC    p14, 0, r3, c1, c5, 4       //; RCP14_DBGPRSR r3
        ISB

        //; setup L2CR0 with various L2/TCM control settings
        //; enable out of order bus attributes and error reporting
        //; this register comes up unpredictable after reset
        // MOVW   r1, #0x0F0F
.word 0xe3001f0f  // hardcoded MOVW instruction due to lack of compiler support
        // MOVT   r1, #0xC005
.word 0xe34c1005  // hardcoded MOVW instruction due to lack of compiler support
        MCR    p15, 3, r1, c15, c0, 1    //; WCP15_L2CR0  r1

        //; setup L2CPUCR
        //; MOV    r2, #0xFF
        //; Enable I and D cache parity
        //;L2CPUCR[7:5] = 3~Rh7 ~V enable parity error reporting for modified,
        //;tag, and data parity errors
        MOV    r2, #0xe0
        MCR    p15, 3, r2, c15, c0, 2    //; WCP15_L2CPUCR  r2

        //; setup SPCR
        //; enable all error reporting (reset value is unpredicatble for most bits)
        MOV    r3, #0x0F
        MCR    p15, 0, r3, c9, c7, 0     //; WCP15_SPCR  r3

        //; setup DMACHCRs (reset value unpredictable)
        //; control setting and enable all error reporting
        MOV   r1, #0x0F

        //; DMACHCR0 = 0000000F
        MOV   r2, #0x00                  //; channel 0
        MCR   p15, 0, r2, c11, c0, 0     //; WCP15_DMASELR  r2
        MCR   p15, 0, r1, c11, c0, 2     //; WCP15_DMACHCR  r1

        //; DMACHCR1 = 0000000F
        MOV   r2, #0x01                  //; channel 1
        MCR   p15, 0, r2, c11, c0, 0     //; WCP15_DMASELR  r2
        MCR   p15, 0, r1, c11, c0, 2     //; WCP15_DMACHCR  r1

        //; DMACHCR2 = 0000000F
        MOV   r2, #0x02                  //; channel 2
        MCR   p15, 0, r2, c11, c0, 0     //; WCP15_DMASELR  r2
        MCR   p15, 0, r1, c11, c0, 2     //; WCP15_DMACHCR  r1

        //; DMACHCR3 = 0000000F
        MOV   r2, #0x03                  //; channel 3
        MCR   p15, 0, r2, c11, c0, 0     //; WCP15_DMASELR  r2
        MCR   p15, 0, r1, c11, c0, 2     //; WCP15_DMACHCR  r1

        //; Set ACTLR (reset unpredictable)
        //; Set AVIVT control, error reporting, etc.
        //; MOV   r3, #0x07
        //; Enable I and D cache parity
        //;ACTLR[2:0] = 3'h7 - enable parity error reporting from L2/I$/D$)
        //;ACTLR[5:4] = 2'h3 - enable parity
        //;ACTLR[19:18] =2'h3 - always generate and check parity(when MMU disabled).
        //;Value to be written #0xC0037
        // MOVW   r3, #0x0037
.word 0xe3003037  // hardcoded MOVW instruction due to lack of compiler support
        // MOVT   r3, #0x000C
.word 0xe340300c  // hardcoded MOVW instruction due to lack of compiler support
            //; read the version_id to determine if d-cache should be disabled
        LDR r2, = 0xa8e00270  //;Read HW_REVISION_NUMBER, HWIO_HW_REVISION_NUMBER_ADDR
        LDR r2,[r2]
        AND r2,r2,#0xf0000000 //;hw_revision mask off bits 28-31
         //;if HW_revision is 1.0 or older, (revision==0)
        CMP r2,#0
        //; Disable d-cache on older QSD8650 (Rev 1.0) silicon
        orreq   r3, r3, #0x4000          //;disable dcache
        MCR   p15, 0, r3, c1, c0, 1      //; WCP15_ACTLR  r3

//;End of error and control setting

        //;----------------------------------------------------------------------
        //; Unlock ETM and read StickyPD to halt the ETM clocks from running.
        //; This is required for power saving whether the ETM is used or not.
        //;----------------------------------------------------------------------

        //;Clear ETMOSLSR[LOCK] bit
        MOV   r1, #0x00000000
        MCR   p14, 1, r1, c1, c0, 4        //; WCP14_ETMOSLAR      r1

        //;Clear ETMPDSR[STICKYPD] bit
        MRC   p14, 1, r2, c1, c5, 4        //; RCP14_ETMPDSR       r2

/*
//	LEO vibro test 

        LDR     R1, =0xA900080C
        LDR     R0, [R1]
        ORR     R0, R0, #0x20
        STR     R0, [R1] 
*/
skip_label:
      
	MOV	R0, #0
	MOV	R1, R7
	MOV	R2, R8

// jump to kernel entry point 
	b	stext

	.ltorg

[-- Attachment #3: 20100625_qsd8xxx_dirty_segfault_patch.diff --]
[-- Type: text/x-patch, Size: 15975 bytes --]

diff --git a/Makefile b/Makefile
index ada58f1..402be9c 100644
--- a/Makefile
+++ b/Makefile
@@ -34,7 +34,7 @@ endif
 .PHONY : all FORCE
 
 vpath %.cpp src src/wince src/mach
-vpath %.S src src/wince
+vpath %.S src src/wince src/mach
 vpath %.rc src/wince
 
 ################ cegcc settings
@@ -108,7 +108,7 @@ $(OUT)mach-autogen.o: src/mach/machlist.txt
 COREOBJS := $(MACHOBJS) haret-res.o libcfunc.o \
   script.o memory.o video.o asmstuff.o lateload.o output.o cpu.o \
   linboot.o fbwrite.o font_mini_4x6.o winvectors.o exceptions.o \
-  asmstuff-armv5.o
+  asmstuff-armv5.o bootQSD8xxx.o
 
 HARETOBJS := $(COREOBJS) haret.o gpio.o uart.o wincmds.o \
   watch.o irqchain.o irq.o pxatrace.o mmumerge.o l1trace.o arminsns.o \
diff --git a/src/bootQSD8xxx.S b/src/bootQSD8xxx.S
new file mode 100644
index 0000000..0bd07e3
--- /dev/null
+++ b/src/bootQSD8xxx.S
@@ -0,0 +1,311 @@
+/*
+ * Copyright (c) 2008, QUALCOMM Incorporated.
+ * Copyright (c) 2009, Code Aurora Forum. All rights reserved.
+ * Copyright (c) 2008-2009, Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the 
+ *    distribution.
+ *  * Neither the name of Google, Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#define DSB .byte 0x4f, 0xf0, 0x7f, 0xf5
+#define ISB .byte 0x6f, 0xf0, 0x7f, 0xf5
+
+.section .text.preload
+	.global bootQSD8xxx
+bootQSD8xxx:
+
+
+     	//MOV	R0, #0
+	//MOV	R7, R1
+	//MOV	R8, R2
+	//MOV R9, LR
+	    MOV R7, R0 // Kernel location
+	    MOV R8, R1 // Machtype
+	    MOV R9, R2 // Tags location
+	    MOV R0, #0
+
+//	B	skip_label
+
+
+        //; DCIALL to invalidate L2 cache bank (needs to be run 4 times, once per bank)
+        //; This must be done early in code (prior to enabling the caches)
+        MOV    r1, #0x2
+        MCR    p15, 0, r1, c9, c0, 6   //; DCIALL bank D ([15:14] == 2'b00)
+        ORR    r1, r1, #0x00004000
+        MCR    p15, 0, r1, c9, c0, 6   //; DCIALL bank C ([15:14] == 2'b01)
+        ADD    r1, r1, #0x00004000
+        MCR    p15, 0, r1, c9, c0, 6   //; DCIALL bank B ([15:14] == 2'b10)
+        ADD    r1, r1, #0x00004000
+        MCR    p15, 0, r1, c9, c0, 6   //; DCIALL bank A ([15:14] == 2'b11)
+
+        //; Initialize the BPCR - setup Global History Mask (GHRM) to all 1's
+        //; and have all address bits (AM) participate.
+        //; Different settings can be used to improve performance
+        // MOVW   r1, #0x01FF
+.word 0xe30011ff  // hardcoded MOVW instruction due to lack of compiler support
+        // MOVT   r1, #0x01FF
+.word 0xe34011ff  // hardcoded MOVT instruction due to lack of compiler support
+        MCR    p15, 7, r1, c15, c0, 2   //; WCP15_BPCR
+
+
+        //; Initialize all I$ Victim Registers to 0 for startup
+        MCR    p15, 0, r0, c9, c1, 0    //; WCP15_ICVIC0    r0
+        MCR    p15, 0, r0, c9, c1, 1    //; WCP15_ICVIC1    r0
+        MCR    p15, 0, r0, c9, c1, 2    //; WCP15_ICVIC2    r0
+        MCR    p15, 0, r0, c9, c1, 3    //; WCP15_ICVIC3    r0
+        MCR    p15, 0, r0, c9, c1, 4    //; WCP15_ICVIC4    r0
+        MCR    p15, 0, r0, c9, c1, 5    //; WCP15_ICVIC5    r0
+        MCR    p15, 0, r0, c9, c1, 6    //; WCP15_ICVIC5    r0
+        MCR    p15, 0, r0, c9, c1, 7    //; WCP15_ICVIC7    r0
+
+        //; Initialize all I$ Locked Victim Registers (Unlocked Floors) to 0
+        MCR    p15, 1, r0, c9, c1, 0    //; WCP15_ICFLOOR0  r0
+        MCR    p15, 1, r0, c9, c1, 1    //; WCP15_ICFLOOR1  r0
+        MCR    p15, 1, r0, c9, c1, 2    //; WCP15_ICFLOOR2  r0
+        MCR    p15, 1, r0, c9, c1, 3    //; WCP15_ICFLOOR3  r0
+        MCR    p15, 1, r0, c9, c1, 4    //; WCP15_ICFLOOR4  r0
+        MCR    p15, 1, r0, c9, c1, 5    //; WCP15_ICFLOOR5  r0
+        MCR    p15, 1, r0, c9, c1, 6    //; WCP15_ICFLOOR6  r0
+        MCR    p15, 1, r0, c9, c1, 7    //; WCP15_ICFLOOR7  r0
+
+        //; Initialize all D$ Victim Registers to 0
+        MCR    p15, 2, r0, c9, c1, 0    //; WP15_DCVIC0    r0
+        MCR    p15, 2, r0, c9, c1, 1    //; WP15_DCVIC1    r0
+        MCR    p15, 2, r0, c9, c1, 2    //; WP15_DCVIC2    r0
+        MCR    p15, 2, r0, c9, c1, 3    //; WP15_DCVIC3    r0
+        MCR    p15, 2, r0, c9, c1, 4    //; WP15_DCVIC4    r0
+        MCR    p15, 2, r0, c9, c1, 5    //; WP15_DCVIC5    r0
+        MCR    p15, 2, r0, c9, c1, 6    //; WP15_DCVIC6    r0
+        MCR    p15, 2, r0, c9, c1, 7    //; WP15_DCVIC7    r0
+
+        //; Initialize all D$ Locked VDCtim Registers (Unlocked Floors) to 0
+        MCR    p15, 3, r0, c9, c1, 0    //; WCP15_DCFLOOR0  r0
+        MCR    p15, 3, r0, c9, c1, 1    //; WCP15_DCFLOOR1  r0
+        MCR    p15, 3, r0, c9, c1, 2    //; WCP15_DCFLOOR2  r0
+        MCR    p15, 3, r0, c9, c1, 3    //; WCP15_DCFLOOR3  r0
+        MCR    p15, 3, r0, c9, c1, 4    //; WCP15_DCFLOOR4  r0
+        MCR    p15, 3, r0, c9, c1, 5    //; WCP15_DCFLOOR5  r0
+        MCR    p15, 3, r0, c9, c1, 6    //; WCP15_DCFLOOR6  r0
+        MCR    p15, 3, r0, c9, c1, 7    //; WCP15_DCFLOOR7  r0
+
+        //; Initialize ASID to zero
+        MCR    p15, 0, r0, c13, c0, 1   //; WCP15_CONTEXTIDR r0
+
+        //; ICIALL to invalidate entire I-Cache
+        MCR    p15, 0, r0, c7, c5, 0    //; ICIALLU
+
+        //; DCIALL to invalidate entire D-Cache
+        MCR    p15, 0, r0, c9, c0, 6    //; DCIALL  r0
+
+
+        //; The VBAR (Vector Base Address Register) should be initialized
+        //; early in your code. We are setting it to zero
+        MCR    p15, 0, r0, c12, c0, 0   //; WCP15_VBAR  r0
+
+        //; Ensure the MCR's above have completed their operation before continuing
+        DSB
+        ISB
+
+        //;-------------------------------------------------------------------
+        //; There are a number of registers that must be set prior to enabling
+        //; the MMU. The DCAR is one of these registers. We are setting
+        //; it to zero (no access) to easily detect improper setup in subsequent
+        //; code sequences
+        //;-------------------------------------------------------------------
+        //; Setup DACR (Domain Access Control Register) to zero
+        MCR    p15, 0, r0, c3, c0, 0    //; WCP15_DACR  r0
+
+        //; Setup DCLKCR to allow normal D-Cache line fills
+        MCR    p15, 1, r0, c9, c0, 7    //; WCP15_DCLKCR r0
+
+        //; Initialize the ADFSR and EFSR registers.
+        MCR    p15, 0, r0,  c5, c1, 0   //; ADFSR
+        MCR    p15, 7, r0, c15, c0, 1   //; EFSR
+
+        //; Setup the TLBLKCR
+        //; Victim = 6'b000000; Floor = 6'b000000;
+        //; IASIDCFG = 2'b00 (State-Machine); IALLCFG = 2'b01 (Flash); BNA = 1'b0;
+        MOV    r1, #0x02
+        MCR    p15, 0, r1, c10, c1, 3     //; WCP15_TLBLKCR  r1
+
+        //;Make sure TLBLKCR is complete before continuing
+        ISB
+
+        //; Invalidate the UTLB
+        MCR    p15, 0, r0, c8, c7, 0      //; UTLBIALL
+
+        //; Make sure UTLB request has been presented to macro before continuing
+        ISB
+
+        //; setup L2CR1 to some default Instruction and data prefetching values
+        //; Users may want specific settings for various performance enhancements
+        //; In Halcyon we do not have broadcasting barriers. So we need to turn
+        //  ; on bit 8 of L2CR1; which DBB:( Disable barrier broadcast )
+        MOV r2, #0x100
+        MCR    p15, 3, r2, c15, c0, 3     //; WCP15_L2CR1  r0
+
+
+        //; Enable Z bit to enable branch prediction (default is off)
+        MRC    p15, 0, r2, c1, c0, 0      //; RCP15_SCTLR  r2
+        ORR    r2, r2, #0x00000800
+        MCR    p15, 0, r2, c1, c0, 0      //; WCP15_SCTLR  r2
+
+#ifdef CONFIG_ARCH_QSD8X50
+        /* disable predecode repair cache for thumb2 (DPRC, set bit 4 in PVR0F2) */
+        mrc p15, 0, r2, c15, c15, 2
+        orr r2, r2, #0x10
+        mcr p15, 0, r2, c15, c15, 2
+#endif
+
+
+        mov r1, lr
+        //; Make sure Link stack is initialized with branch and links to sequential addresses
+        //; This aids in creating a predictable startup environment
+       BL      SEQ1
+SEQ1:  BL      SEQ2
+SEQ2:  BL      SEQ3
+SEQ3:  BL      SEQ4
+SEQ4:  BL      SEQ5
+SEQ5:  BL      SEQ6
+SEQ6:  BL      SEQ7
+SEQ7:  BL      SEQ8
+SEQ8:
+        mov lr, r1
+
+
+        //; REMOVE FOLLOWING THREE INSTRUCTIONS WHEN POWER COLLAPSE IS ENA
+        //;Make sure the DBGOSLSR[LOCK] bit is cleared to allow access to the debug registers
+        //; Writing anything but the "secret code" to the DBGOSLAR clears the DBGOSLSR[LOCK] bit
+        MCR    p14, 0, r0, c1, c0, 4       //; WCP14_DBGOSLAR r0
+
+
+        //; Read the DBGPRSR to clear the DBGPRSR[STICKYPD]
+        //; Any read to DBGPRSR clear the STICKYPD bit
+        //; ISB guarantees the read completes before attempting to
+        //; execute a CP14 instruction.
+        MRC    p14, 0, r3, c1, c5, 4       //; RCP14_DBGPRSR r3
+        ISB
+
+        //; setup L2CR0 with various L2/TCM control settings
+        //; enable out of order bus attributes and error reporting
+        //; this register comes up unpredictable after reset
+        // MOVW   r1, #0x0F0F
+.word 0xe3001f0f  // hardcoded MOVW instruction due to lack of compiler support
+        // MOVT   r1, #0xC005
+.word 0xe34c1005  // hardcoded MOVW instruction due to lack of compiler support
+        MCR    p15, 3, r1, c15, c0, 1    //; WCP15_L2CR0  r1
+
+        //; setup L2CPUCR
+        //; MOV    r2, #0xFF
+        //; Enable I and D cache parity
+        //;L2CPUCR[7:5] = 3~Rh7 ~V enable parity error reporting for modified,
+        //;tag, and data parity errors
+        MOV    r2, #0xe0
+        MCR    p15, 3, r2, c15, c0, 2    //; WCP15_L2CPUCR  r2
+
+        //; setup SPCR
+        //; enable all error reporting (reset value is unpredicatble for most bits)
+        MOV    r3, #0x0F
+        MCR    p15, 0, r3, c9, c7, 0     //; WCP15_SPCR  r3
+
+        //; setup DMACHCRs (reset value unpredictable)
+        //; control setting and enable all error reporting
+        MOV   r1, #0x0F
+
+        //; DMACHCR0 = 0000000F
+        MOV   r2, #0x00                  //; channel 0
+        MCR   p15, 0, r2, c11, c0, 0     //; WCP15_DMASELR  r2
+        MCR   p15, 0, r1, c11, c0, 2     //; WCP15_DMACHCR  r1
+
+        //; DMACHCR1 = 0000000F
+        MOV   r2, #0x01                  //; channel 1
+        MCR   p15, 0, r2, c11, c0, 0     //; WCP15_DMASELR  r2
+        MCR   p15, 0, r1, c11, c0, 2     //; WCP15_DMACHCR  r1
+
+        //; DMACHCR2 = 0000000F
+        MOV   r2, #0x02                  //; channel 2
+        MCR   p15, 0, r2, c11, c0, 0     //; WCP15_DMASELR  r2
+        MCR   p15, 0, r1, c11, c0, 2     //; WCP15_DMACHCR  r1
+
+        //; DMACHCR3 = 0000000F
+        MOV   r2, #0x03                  //; channel 3
+        MCR   p15, 0, r2, c11, c0, 0     //; WCP15_DMASELR  r2
+        MCR   p15, 0, r1, c11, c0, 2     //; WCP15_DMACHCR  r1
+
+        //; Set ACTLR (reset unpredictable)
+        //; Set AVIVT control, error reporting, etc.
+        //; MOV   r3, #0x07
+        //; Enable I and D cache parity
+        //;ACTLR[2:0] = 3'h7 - enable parity error reporting from L2/I$/D$)
+        //;ACTLR[5:4] = 2'h3 - enable parity
+        //;ACTLR[19:18] =2'h3 - always generate and check parity(when MMU disabled).
+        //;Value to be written #0xC0037
+        // MOVW   r3, #0x0037
+.word 0xe3003037  // hardcoded MOVW instruction due to lack of compiler support
+        // MOVT   r3, #0x000C
+.word 0xe340300c  // hardcoded MOVW instruction due to lack of compiler support
+            //; read the version_id to determine if d-cache should be disabled
+        LDR r2, = 0xa8e00270  //;Read HW_REVISION_NUMBER, HWIO_HW_REVISION_NUMBER_ADDR
+        LDR r2,[r2]
+        AND r2,r2,#0xf0000000 //;hw_revision mask off bits 28-31
+         //;if HW_revision is 1.0 or older, (revision==0)
+        CMP r2,#0
+        //; Disable d-cache on older QSD8650 (Rev 1.0) silicon
+        orreq   r3, r3, #0x4000          //;disable dcache
+        MCR   p15, 0, r3, c1, c0, 1      //; WCP15_ACTLR  r3
+
+//;End of error and control setting
+
+        //;----------------------------------------------------------------------
+        //; Unlock ETM and read StickyPD to halt the ETM clocks from running.
+        //; This is required for power saving whether the ETM is used or not.
+        //;----------------------------------------------------------------------
+
+        //;Clear ETMOSLSR[LOCK] bit
+        MOV   r1, #0x00000000
+        MCR   p14, 1, r1, c1, c0, 4        //; WCP14_ETMOSLAR      r1
+
+        //;Clear ETMPDSR[STICKYPD] bit
+        MRC   p14, 1, r2, c1, c5, 4        //; RCP14_ETMPDSR       r2
+
+/*
+//	LEO vibro test 
+
+        LDR     R1, =0xA900080C
+        LDR     R0, [R1]
+        ORR     R0, R0, #0x20
+        STR     R0, [R1] 
+*/
+skip_label:
+      
+        MOV R0, #0 // r0 must contain zero
+        MOV R1, R8 // r1 must contain machtype
+        MOV R2, R9 // r2 must contain location to tags
+        MOV PC, R7 // jump to kernel code
+        
+	.end
+
diff --git a/src/linboot.cpp b/src/linboot.cpp
index f671b50..1a12941 100644
--- a/src/linboot.cpp
+++ b/src/linboot.cpp
@@ -147,7 +147,7 @@ setup_linux_params(char *tagaddr, uint32 phys_initrd_addr, uint32 initrd_size)
  ****************************************************************/
 
 // Maximum number of index pages.
-#define MAX_INDEX 6
+#define MAX_INDEX 10
 #define PAGES_PER_INDEX (PAGE_SIZE / sizeof(uint32))
 
 // Data Shared between normal haret code and C preload code.
@@ -251,6 +251,10 @@ fbOverlaps(struct preloadData *pd)
                     , pd->initrdOffset + pd->initrdSize);
 }
 
+extern "C" {
+    void bootQSD8xxx(char* kernel, uint32 mach, char *tags);
+}
+
 // Code to launch kernel.
 static void __preload
 preloader(struct preloadData *data)
@@ -324,6 +328,10 @@ preloader(struct preloadData *data)
 
     FB_PRINTF(&data->fbi, "Jumping to Kernel...\\n");
 
+    // QSD8xxx hack to boot kernel without segfaults
+    bootQSD8xxx(destKernel, data->machtype, destTags);
+    FB_PRINTF(&data->fbi, "Shouldn't get here\\n");
+
     // Boot
     typedef void (*lin_t)(uint32 zero, uint32 mach, char *tags);
     lin_t startfunc = (lin_t)destKernel;

Re: QSD8250 illegal instruction on WinCE devices

[Daniel Walker]

On Sun, 2010-06-27 at 22:50 +0100, Lukas-David Gorris wrote:
> Hello,
> 
> The segmentation fault problem on htcleo and other WinCE based qs8250  
> devices is solved. We need to set the cpu into some magic mode before  
> boot and all cpu crashes are gone.

Great! I'm glad that someone figure it out.

> As suspected it is in fact in some way related to WinCE VS. linux  
> device: A WinCE developer with low level knowledge by the name of K,  
> 'Cotulla' Ivan looked at the bootloader of qsd8250 based htc bravo,  
> one of the _linux_ phones with the chip. This is where the necessary  
> cpu init code was discovered. This init code is obviously not needed  
> and used for WinCE which is why we were in 'crash mode' when booting  
> linux. It is suppoed to be some workaround for a 'hardware bug'.

Was a specific instruction discovered that fix it? The files and patches
that you provided include a fair amount of code.

Daniel

Re: QSD8250 illegal instruction on WinCE devices

[Martijn Stolk]

On 28-6-2010 19:34, Daniel Walker wrote:
> Was a specific instruction discovered that fix it? The files and patches
> that you provided include a fair amount of code.
>
> Daniel
>
>    
We still have to isolate which part of that asm specifically solves the 
problem, as it includes quite a lot of initialization code indeed. For 
now we're just glad we can continue our quest of getting Linux to run on 
our phones. :-)

I'll try and isolate the problem area soonish and post it here.

Regards,
Martijn

Re: QSD8250 illegal instruction on WinCE devices

[Daniel Walker]

On Tue, 2010-06-29 at 00:24 +0200, Martijn Stolk wrote:
> On 28-6-2010 19:34, Daniel Walker wrote:
> > Was a specific instruction discovered that fix it? The files and patches
> > that you provided include a fair amount of code.
> >
> > Daniel
> >
> >    
> We still have to isolate which part of that asm specifically solves the 
> problem, as it includes quite a lot of initialization code indeed. For 
> now we're just glad we can continue our quest of getting Linux to run on 
> our phones. :-)
> 
> I'll try and isolate the problem area soonish and post it here.

Don't do it on my account, I was just wondering if that was discovered..

Daniel

-- 
Sent by a consultant of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

Re: QSD8250 illegal instruction on WinCE devices

[Martijn Stolk]

No worries. I wanted to isolate what specifically fixes the problem 
myself in order to make a minimal patch. I'm also hoping for some help 
regarding information, as I don't have access to official QSD8250 
documentation.

I've found the key register that differs between between how it is 
initialized for Windows CE and for Linux, and solves the problem for us. 
It is the Auxilliary Control Register (cp15, 0, c1, c0, 1).

For Windows CE it is initialized to 0x002C0077 
(=0b00000000001011000000000001110111)
For Linux it is initialized to 0x000C0037      
(=0b00000000000011000000000000110111)

The following page explains this register for the Cortex-A8, the ARM 
core on which the QSD8250 is based:
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0344k/Bgbffjhh.html

The 7th bit (bit 6 on that page) controls the behaviour of the 
Invalidate All & by MVA instructions. It needs to be disabled for Linux.

The 22nd bit, however, is in an area marked as "reserved" on that page. 
I am very curious what this bit does. Maybe this reserved area is 
documented in QSD8250 documentation? Could anyone provide clearity about 
this bit?

In conclusion, we are able to continue our work using the following asm, 
but do not know what the second flag means:
   MRC p15, 0, r0, c1, c0, 1
   BIC r0, #0x40
   BIC r0, #0x200000
   MCR p15, 0, r0, c1, c0, 1

Thanks in advance for any information.

Regards,
Martijn


On 06/29/2010 06:49 PM, Daniel Walker wrote:
>
> Don't do it on my account, I was just wondering if that was discovered..
>
> Daniel
>

Re: QSD8250 illegal instruction on WinCE devices

[Daniel Walker]

On Tue, 2010-06-29 at 21:03 +0200, Martijn Stolk wrote:
> No worries. I wanted to isolate what specifically fixes the problem 
> myself in order to make a minimal patch. I'm also hoping for some help 
> regarding information, as I don't have access to official QSD8250 
> documentation.
> 
> I've found the key register that differs between between how it is 
> initialized for Windows CE and for Linux, and solves the problem for us. 
> It is the Auxilliary Control Register (cp15, 0, c1, c0, 1).
> 
> For Windows CE it is initialized to 0x002C0077 
> (=0b00000000001011000000000001110111)
> For Linux it is initialized to 0x000C0037      
> (=0b00000000000011000000000000110111)
> 
> The following page explains this register for the Cortex-A8, the ARM 
> core on which the QSD8250 is based:
> http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0344k/Bgbffjhh.html
> 
> The 7th bit (bit 6 on that page) controls the behaviour of the 
> Invalidate All & by MVA instructions. It needs to be disabled for Linux.
> 
> The 22nd bit, however, is in an area marked as "reserved" on that page. 
> I am very curious what this bit does. Maybe this reserved area is 
> documented in QSD8250 documentation? Could anyone provide clearity about 
> this bit?

You found that you needed both of these set? One or the other wasn't
enough.

I'm not sure that we can open talk about what this 22nd bit does, so I'd
just set it like you have it and not worry about it.

Daniel

-- 
Sent by a consultant of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.

Re: QSD8250 illegal instruction on WinCE devices

[Martijn Stolk]

On 06/29/2010 10:38 PM, Daniel Walker wrote:
> On Tue, 2010-06-29 at 21:03 +0200, Martijn Stolk wrote:
>> No worries. I wanted to isolate what specifically fixes the problem
>> myself in order to make a minimal patch. I'm also hoping for some help
>> regarding information, as I don't have access to official QSD8250
>> documentation.
>>
>> I've found the key register that differs between between how it is
>> initialized for Windows CE and for Linux, and solves the problem for us.
>> It is the Auxilliary Control Register (cp15, 0, c1, c0, 1).
>>
>> For Windows CE it is initialized to 0x002C0077
>> (=0b00000000001011000000000001110111)
>> For Linux it is initialized to 0x000C0037
>> (=0b00000000000011000000000000110111)
>>
>> The following page explains this register for the Cortex-A8, the ARM
>> core on which the QSD8250 is based:
>> http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0344k/Bgbffjhh.html
>>
>> The 7th bit (bit 6 on that page) controls the behaviour of the
>> Invalidate All&  by MVA instructions. It needs to be disabled for Linux.
>>
>> The 22nd bit, however, is in an area marked as "reserved" on that page.
>> I am very curious what this bit does. Maybe this reserved area is
>> documented in QSD8250 documentation? Could anyone provide clearity about
>> this bit?
>
> You found that you needed both of these set? One or the other wasn't
> enough.
>
> I'm not sure that we can open talk about what this 22nd bit does, so I'd
> just set it like you have it and not worry about it.
>
> Daniel
>
Here's a table on what I noticed during my tests:

bit: 7 | 22 | remark
      1 |  1 | Linux crashes due to segmentation faults
      0 |  1 | Linux works fine, no crashes, no segfaults
      0 |  0 | Same as above
      1 |  0 | Linux doesn't segfault immediately, but seems to only 
cause problems
               when the device is idling for a second or less (maybe 
power management
               or something).

Disabling bit 7 solves the segfault issues already. Bit 22 just causes 
some mysterious behaviour which I am curious about. We're able to 
continue without knowing this of course, but I was hoping you were 
allowed to answer a specific question like this. Don't worry if you can't.

Thanks either way for your help.

Regards,
Martijn