summaryrefslogtreecommitdiffstats
path: root/qemu/roms/u-boot/board/palmtreo680
diff options
context:
space:
mode:
authorYang Zhang <yang.z.zhang@intel.com>2015-08-28 09:58:54 +0800
committerYang Zhang <yang.z.zhang@intel.com>2015-09-01 12:44:00 +0800
commite44e3482bdb4d0ebde2d8b41830ac2cdb07948fb (patch)
tree66b09f592c55df2878107a468a91d21506104d3f /qemu/roms/u-boot/board/palmtreo680
parent9ca8dbcc65cfc63d6f5ef3312a33184e1d726e00 (diff)
Add qemu 2.4.0
Change-Id: Ic99cbad4b61f8b127b7dc74d04576c0bcbaaf4f5 Signed-off-by: Yang Zhang <yang.z.zhang@intel.com>
Diffstat (limited to 'qemu/roms/u-boot/board/palmtreo680')
-rw-r--r--qemu/roms/u-boot/board/palmtreo680/Makefile9
-rw-r--r--qemu/roms/u-boot/board/palmtreo680/README563
-rw-r--r--qemu/roms/u-boot/board/palmtreo680/palmtreo680.c148
3 files changed, 720 insertions, 0 deletions
diff --git a/qemu/roms/u-boot/board/palmtreo680/Makefile b/qemu/roms/u-boot/board/palmtreo680/Makefile
new file mode 100644
index 000000000..4f79e4bf1
--- /dev/null
+++ b/qemu/roms/u-boot/board/palmtreo680/Makefile
@@ -0,0 +1,9 @@
+#
+# Palm Treo680 Support
+#
+# Copyright (C) 2013 Mike Dunn <mikedunn@newsguy.com>
+#
+# This file is released under the terms of GPL v2 and any later version.
+# See the file COPYING in the root directory of the source tree for details.
+
+obj-y := palmtreo680.o
diff --git a/qemu/roms/u-boot/board/palmtreo680/README b/qemu/roms/u-boot/board/palmtreo680/README
new file mode 100644
index 000000000..c8799c6ab
--- /dev/null
+++ b/qemu/roms/u-boot/board/palmtreo680/README
@@ -0,0 +1,563 @@
+
+README for the Palm Treo 680.
+
+Copyright (C) 2013 Mike Dunn <mikedunn@newsguy.com>
+
+You may reproduce the contents of this file entirely or in part, but please
+credit me by name if you do. Thanks.
+
+
+Intro
+=====
+
+Yes, you can program u-boot onto the flash of your Palm Treo 680 so that u-boot
+(then Linux, Android, ...) runs at power-up. This document describes how, and
+gives some implementation details on this port of u-boot and describes how the
+Treo 680 boots from reset.
+
+But first, I probably don't need to tell you that after doing this, your phone
+will no longer run PalmOS. You *may* be able to later restore your phone to its
+original state by creating a backup image of the flash before writing u-boot
+(details below), but this is not heavily tested and should not be relied upon.
+There is also the possibility that something may go wrong during the process of
+programming u-boot, leaving you with a bricked phone. If you follow these
+instructions carefully this chance will be minimized, but I do not recommend
+that you program u-boot onto a phone that you can not afford to lose, and
+certainly not one that contains important data that is not backed up elsewhere.
+I AM NOT RESPONSIBLE FOR THE LOSS OF YOUR PHONE. DO THIS AT YOUR OWN RISK.
+Having said that, feel free to send me a note cursing me out if something does
+go wrong, but please tell me what happened exactly. For that matter, I'd love
+to hear from you if you succeed.
+
+
+Details on the SPL
+==================
+
+The docg4 features a 2k region at the start of its address space that interfaces
+to the system bus like a NOR flash. This allows the docg4 to function as a boot
+ROM. The Treo 680 uses this feature. The contents of this 2k region are
+write-protected and can not be reprogrammed. Fortunately, the code it contains
+does what we need to do, at least partially. After some essential hardware
+initialization (like the SDRAM controller), it runs an IPL (initial program
+loader) that copies 128K (no more, no less) from flash to a fixed address in
+SDRAM (0xa1700000) and jumps to it. 128K is too small for u-boot, so we use it
+to load a u-boot secondary program loader (SPL). But since our SPL only
+occupies a little over 1k, we can economize on flash usage by having the IPL
+load a portion of u-boot proper as well. We let the IPL load the first 128k of
+a concatenated spl + u-boot image, and because the SPL is placed before u-boot
+proper, the IPL jumps to the SPL, which copies the portion of u-boot that the
+IPL has already loaded to its correct SDRAM address, and then loads the
+remainder of u-boot and jumps to it.
+
+
+The docg4's "reliable mode"
+===========================
+
+This is a special mode of operation of the docg4's integrated controller whereby
+consecutive pairs of 2k regions are used in parallel (in some fashion) to store
+2k of data. In other words, the normal capacity is halved, but the data
+integrity is improved. In this mode, the data is read or written from pages in
+even-numbered 2k regions (regions starting at 0x000, 0x1000, 0x2000, ...). The
+odd-numbered 2k regions (regions starting at 0x800, 0x1800, 0x2800, ...) are
+transparently used in parallel. In reliable mode, the odd-numbered 2k regions
+are not meant to be read or written directly.
+
+Reliable mode is used by the IPL because there is not enough space in its 2k
+footprint to implement the BCH ecc algorithm. Data that is read while reliable
+mode is enabled must have been written in reliable mode, or the read fails.
+However, data written in reliable mode can also be read in normal mode (just not
+as reliably), but only from the even-numbered 2k regions; the odd-numbered 2k
+regions appear to contain junk, and will generate ecc errors. When the IPL and
+SPL read from flash, the odd-numbered 2k regions are explicitly skipped. The
+same is true for the flash_u-boot utility when it writes the u-boot image in
+reliable mode.
+
+The docg4 Linux driver supports writing in reliable mode (it is enabled by the
+module parameter), but not reading. However, the u-boot docg4_spl driver does
+read in reliable mode, in the same fashion as the IPL.
+
+
+Details on the IPL and its data format
+======================================
+
+Starting from block 5 and counting upward, the IPL will search for and load the
+first two blocks it finds that contain a magic number in the oob of the first
+page of the block. The contents are loaded to SDRAM starting at address
+0xa1700000. After two blocks have been loaded, it jumps to 0xa1700000. The
+number of blocks loaded and the load address in SDRAM are hard-coded; only the
+flash offset of the blocks can vary at run-time (based on the presence of the
+magic number).
+
+In addition to using the docg4's reliable mode, the IPL expects each 512 byte
+page to be written redundantly in the subsequent page. The hardware is capable
+of detecting bit errors (but not correcting them), and if a bit error is
+detected when a page is read, the page contents are discarded and the subsequent
+page is read.
+
+Reliable mode reduces the capacity of a block by half, and the redundant pages
+reduce it by half again. As a result, the normal 256k capacity of a block is
+reduced to 64k for the purposes of the IPL/SPL.
+
+For the sake of simplicity and uniformity, the u-boot SPL mimics the operation
+of the IPL, and expects the image to be stored in the same format.
+
+
+Instructions on Programming u-boot to flash
+===========================================
+
+To program u-boot to your flash, you will need to boot the Linux kernel on your
+phone using a PalmOS bootloader such as cocoboot. The details of building and
+running Linux on your Treo (cross-compiling, creating a root filesystem,
+configuring the kernel, etc) are beyond the scope of this document. The
+remainder of this document describes in detail how to program u-boot to the
+flash using Linux running on the Treo.
+
+
+Hardware Prerequisites
+======================
+
+A Palm Treo 680:
+ (dugh)
+
+A Palm usb cable:
+ You'll need this to establish a usbtty console connection to u-boot from a
+ desktop PC. Currently there is no support in u-boot for the pxa27x keypad
+ (coming soon), so a serial link must be used for the console.
+ These cables are still widely available if you don't already have one.
+
+A Linux desktop PC.
+ You may be able to use Windows for the u-boot console if you have a usb driver
+ that is compatible with the Linux usbserial driver, but for programming u-boot
+ to flash, you'll really want to use a Linux PC.
+
+
+Treo-side Software Prerequisites
+================================
+
+Linux bootloader for PalmOS:
+
+ Cocoboot is the only one I'm aware of. If you don't already have this, you
+ can download it from
+ https://download.enlightenment.org/misc/Illume/Treo-650/2008-11-13/sdcard-base.tar.gz
+ which is a compressed tar archive of the contents of an sd card containing
+ cocoboot. Use mkdosfs to create a fat16 filesystem on the first primary
+ partition of the card, mount the partition, and extract the tar file to it.
+ You will probably need to edit the cocoboot.conf file to customize the
+ parameters passed to the kernel.
+
+
+Linux kernel:
+
+ The kernel on the Treo 680 is still a little rough around the edges, and the
+ official kernel frequently breaks on the Treo :( A development kernel
+ specifically for the Treo 680 can be found on github:
+ http://github.com/mike-dunn/linux-treo680
+ The master branch of this tree has been tested on the Treo, and I recommend
+ using this kernel for programming u-boot. As of this writing, there may be a
+ bug in the docg4 nand flash driver that sometimes causes block erasures to
+ fail. This has been fixed in the above tree.
+
+ If you choose to use the official kernel, it must contain the docg4 driver that
+ includes the reliable_mode module parameter. This was a later enhancement to
+ the driver, and was merged to the kernel as of v3.8. Do not try to use an
+ earlier kernel that contains the docg4 driver without support for writing in
+ reliable mode. If you try to program u-boot to flash with the docg4 driver
+ loaded without the reliable_mode parameter enabled, you *will* brick your
+ phone!
+
+ For the purpose of programming u-boot to flash, the following options must be
+ enabled in the Treo kernel's .config:
+
+ CONFIG_MTD=y
+ CONFIG_MTD_CMDLINE_PARTS=y
+ CONFIG_MTD_CHAR=y
+ CONFIG_MTD_NAND_DOCG4=m
+
+ Note that the docg4 nand driver is configured as a module, because we will
+ want to load and unload it with reliable_mode enabled or disabled as needed.
+
+ You will also need to specify mtd partitions on the kernel command line. In
+ the instructions that follow, we will assume that the flash blocks to which
+ u-boot will be programmed are defined by the second partition on the device.
+ The u-boot config file (include/configs/palmtreo680.h) places the u-boot image
+ at the start of block 6 (offset 0x180000), which is the first writable
+ (non-protected) block on the flash (this is also where the PalmOS SPL starts).
+ The u-boot image occupies four blocks, so to create the u-boot partition, pass
+ this command line to the kernel:
+ mtdparts=Msys_Diskonchip_G4:1536k(protected_part)ro,1024k(bootloader_part),-(filesys_part)
+ This will create three partitions:
+ protected_part: the first six blocks, which are read-only
+ bootloader_part: the next four blocks, for the u-boot image
+ filesys_part: the remainder of the device
+ The mtdchar kernel device driver will use device nodes /dev/mtd0, /dev/mtd1,
+ and /dev/mtd2 for these partitions, respectively. Ensure that your root file
+ system at least has /dev/mtd1 if you are not running udev or mdev.
+
+Userspace Utilities:
+
+ In addition to everything necessary to provide a useful userspace environment
+ (busybox is indispensable, of course), you will need the mtd-utils package on
+ your root filesystem. I use version 1.5.0 of mtd-utils, and I suggest you use
+ this version as well, or at leat a version very close to this one, as
+ mtd-utils has tended to be fluid.
+
+ Note that busybox includes a version of mtd-utils. These are deficient and
+ should not be used. When you run one of these utilities (nanddump, etc),
+ ensure you are invoking the separate executable from mtd-utils, and not the
+ one built into busybox. I recommend that you configure busybox with its
+ mtd-utils disabled to avoid any possibility of confusion.
+
+ You will also need to cross-compile the userspace Linux utility in
+ tools/palmtreo680/flash_u-boot.c, which we will run on the Treo to perform the
+ actual write of the u-boot image to flash. This utility links against libmtd
+ from the mtd-utils package.
+
+
+Desktop PC-side Software Prerequisites
+======================================
+
+Terminal emulator application:
+ minicom, kermit, etc.
+
+Linux kernel:
+ Compiled with CONFIG_USB_SERIAL enabled. Build this as a module.
+
+
+Recommended (Not directly related to u-boot)
+============================================
+
+Working directly on the Treo's tiny screen and keypad is difficult and
+error-prone. I recommend that you log into the Linux kernel running on your
+Treo from your desktop PC using ethernet over usb. The desktop's kernel must be
+configured with CONFIG_USB_USBNET, CONFIG_USB_NET_CDCETHER, and
+CONFIG_USB_NET_CDC_SUBSET. The Treo's kernel will need CONFIG_USB_ETH, and its
+init script will need to start an ssh daemon like dropbear. Note that the usb0
+network interface will not appear on the desktop PC until the Treo kernel's usb
+ethernet gadget driver has initialized. You must wait for this to occur (watch
+the PC's kernel log) before you can assign usb0 an ip address and log in to the
+Treo. If you also build the Treo's kernel with CONFIG_IP_PNP enabled, you can
+pass its ip address on the kernel command line, and obviate the need to
+initialize the network interface in your init script.
+
+Having the Palm usb cable connected to the host has the added benefit of keeping
+power supplied to your Treo, reducing the drain on the battery. If something
+goes wrong while you're programming u-boot to the flash, you will have lots of
+time to correct it before the battery dies.
+
+I have encountered a situation where the kernel is sometimes unable to mount a
+root filesystem on the mmc card due to the mmc controller not initializing in
+time, (and CONFIG_MMC_UNSAFE_RESUME doesn't seem to help) so I recommend that
+you build a minimal root filesystem into the kernel using the kernel's initramfs
+feature (CONFIG_BLK_DEV_INITRD). If you want your root filesystem on the mmc
+card, your init script can mount and switch_root to the mmc card after a short
+sleep. But keep in mind that in this case you won't be able to use an mmc card
+to transfer files between your desktop and the Treo once Linux is running.
+Another option for transfering files is to mount an nfs filesystem exported by
+the desktop PC. For greatest convenience, you can export the root filesystem
+itself from your desktop PC and switch_root to it in your init script. This
+will work if your initramfs init script contains a loop that waits for you to
+initialize the usb0 network interface on the desktop PC; e.g., loop while a ping
+to the desktop PC returns an error. After the loop exits, do the nfs mount and
+call switch_root. (You can not use the kernel nfsroot feature because the
+network will not be up when the kernel expects it to be; i.e., not until you
+configure the usb0 interface on the desktop.) Use the nfs 'nolock' option when
+mounting to avoid the need to run a portmapper like rpcbind.
+
+
+Preliminaries
+=============
+
+Once Linux is running on your Treo, you may want to perform a few sanity checks
+before programming u-boot. These checks will verify my assumptions regarding
+all the Treo 680s out there, and also ensure that the flash and mtd-utils are
+working correctly. If you are impatient and reckless, you may skip this
+section, but see disclaimer at the top of this file!
+
+Load the docg4 driver:
+
+ $ modprobe docg4 ignore_badblocks=1 reliable_mode=1
+
+We tell the driver to use the docg4's "reliable mode" when writing because this
+is the format required by the IPL, which runs from power-up and loads the first
+portion of u-boot. We must ignore bad blocks because linux mtd uses out-of-band
+(oob) bytes to mark bad blocks, which will cause the blocks written by PalmOS to
+be misidentified as "bad" by libmtd.
+
+Check the kernel log to ensure that all's well:
+
+ $ dmesg | tail
+ <... snip ...>
+ docg4 docg4: NAND device: 128MiB Diskonchip G4 detected
+ 3 cmdlinepart partitions found on MTD device Msys_Diskonchip_G4
+ Creating 3 MTD partitions on "Msys_Diskonchip_G4":
+ 0x000000000000-0x000000180000 : "protected_part"
+ 0x000000180000-0x000000280000 : "bootloader_part"
+ 0x000000280000-0x000008000000 : "filesys_part"
+
+Ensure that the partition boundaries are as shown. (If no partitions are shown,
+did you remember to pass them to the kernel on the command line?) We will write
+u-boot to bootloader_part, which starts at offset 0x180000 (block 6) and spans 4
+256k blocks. This partition is accessed through the device node /dev/mtd1.
+
+The docg4 contains a read-only table that identifies blocks that were marked as
+bad at the factory. This table is in the page at offset 0x2000, which is within
+the partition protected_part (/dev/mtd0). There is a slight chance that one or
+more of the four blocks that we will use for u-boot is listed in the table, so
+use nanddump to inspect the table to see if this is the case:
+
+ $ nanddump -p -l 512 -s 0x2000 -o /dev/mtd0
+ ECC failed: 0
+ ECC corrected: 0
+ Number of bad blocks: 0
+ Number of bbt blocks: 0
+ Block size 262144, page size 512, OOB size 16
+ Dumping data starting at 0x00002000 and ending at 0x00002200...
+ 0x00002000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+ <... snip ...>
+
+The format of the table is simple: one bit per block, with block numbers
+increasing from left to right, starting with block 0 as the most significant bit
+of the first byte. A bit will be clear if the corresponding block is bad. We
+want to use blocks 6 throgh 9, so both of the two least significant bits of the
+first byte must be set, as must the two most significant bits of the second
+byte. If this is not true in your case (you are very unlucky), you should use
+the first contiguous set of four good blocks after block 6, and adjust the
+partition boundaries accordingly. You will also have to change the value of
+CONFIG_SYS_NAND_U_BOOT_OFFS in include/configs/palmtreo680.h and recompile
+u-boot. Because the two blocks loaded by the IPL do not have to be contiguous,
+but our SPL expects them to be, you will need to erase any good blocks that are
+at an offset prior to CONFIG_SYS_NAND_U_BOOT_OFFS, so that the IPL does not find
+the magic number in oob and load it. Once you have done all this, the
+instructions in this file still apply, except that the instructions below for
+restoring the original PalmOS block contents may need to be modified.
+
+Next, use nanddump to verify that the PalmOS SPL is where we expect it to be.
+The SPL can be identified by a magic number in the oob bytes of the first page
+of each of the two blocks containing the SPL image. Pages are 512 bytes in
+size, so to dump the first page, plus the oob:
+
+ $ nanddump -p -l 512 -s 0 -o /dev/mtd1
+ ECC failed: 0
+ ECC corrected: 0
+ Number of bad blocks: 0
+ Number of bbt blocks: 0
+ Block size 262144, page size 512, OOB size 16
+ Dumping data starting at 0x00000000 and ending at 0x00000200...
+ 0x00000000: 0a 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00
+ <... snip ...>
+ 0x000001f0: 13 4c 21 60 13 4d 2a 69 13 4b 29 69 89 1a 99 42
+ OOB Data: 42 49 50 4f 30 30 30 10 3a e2 00 92 be a0 11 ff
+
+Verify that the first seven bytes of oob data match those in the above line.
+(This is ASCII "BIPO000".)
+
+Do the same for the next block:
+ $ nanddump -p -l 512 -s 0x40000 -o /dev/mtd1
+
+The first seven oob bytes in last line should read:
+
+ OOB Data: 42 49 50 4f 30 30 31 81 db 8e 8f 46 07 9b 59 ff
+
+(This is ASCII "BIPO001".)
+
+For additional assurance, verify that the next block does *not* contain SPL
+data.
+
+ $ nanddump -p -l 512 -s 0x80000 -o /dev/mtd1
+
+It doesn't matter what the oob contains, as long as the first four bytes are
+*not* ASCII "BIPO". PalmOS should only be using two blocks for the SPL
+(although we will need four for u-boot).
+
+If you want, you can back up the contents of bootloader_part to a file. You may
+be able to restore it later, if desired (see "Restoring PalmOS" below).
+
+ $ nanddump -l 0x100000 -s 0 -o -f bootloader_part.orig /dev/mtd1
+
+nanddump will spew voluminous warnings about uncorrectable ecc errors. This is
+a consequence of reading pages that were written in reliable mode, and is
+expected (these should all occur on pages in odd-numbered 2k regions; i.e.,
+0x800, 0xa00, 0xc00, 0xe00, 0x1800, 0x1a00, ...). The size of the file
+bootloader_part.orig should be 1081344, which is 2048 pages, each of size 512
+plus 16 oob bytes. If you are using initramfs for the root filesystem, don't
+forget to copy the file to permanent storage, such as an mmc card.
+
+If all of the above went well, you can now program u-boot.
+
+
+Programming u-boot
+==================
+
+Our u-boot includes a small SPL that must be prepended to u-boot proper. From
+the base u-boot source directory on your desktop PC:
+
+ $ cat spl/u-boot-spl.bin u-boot.bin > u-boot-concat.bin
+
+cd to the tools/palmtreo680/ directory, and cross-compile flash_u-boot.c for the
+Treo:
+
+ $(CC) -o flash_u-boot $(CFLAGS) $(INCLUDEPATH) $(LIBPATH) flash_u-boot.c -lmtd
+
+Substitute variable values from your cross-compilation environment as
+appropriate. Note that it links to libmtd from mtd-utils, and this must be
+included in $(LIBPATH) and $(INCLUDEPATH).
+
+Transfer u-boot-concat.bin and the compiled flash_u-boot utility to the Treo's
+root filesystem. On the Treo, cd to the directory where these files were
+placed.
+
+Load the docg4 driver if you have not already done so.
+
+ $ modprobe docg4 ignore_badblocks=1 reliable_mode=1
+
+Erase the blocks to which we will write u-boot:
+
+ $ flash_erase /dev/mtd1 0x00 4
+
+If no errors are reported, write u-boot to the flash:
+
+ $ ./flash_u-boot u-boot-concat.bin /dev/mtd1
+
+You can use nanddump (see above) to verify that the data was written. This
+time, "BIPO" should be seen in the first four oob bytes of the first page of all
+four blocks in /dev/mtd1; i.e., at offsets 0x00000, 0x40000, 0x80000, 0xc0000.
+
+Shutdown linux, remove and re-insert the battery, hold your breath...
+
+
+Enjoying u-boot
+===============
+
+After you insert the battery, the u-boot splash screen should appear on the lcd
+after a few seconds. With the usb cable connecting the Treo to your PC, in the
+kernel log of your PC you should see
+
+ <6>usb 3-1: New USB device found, idVendor=0525, idProduct=a4a6
+ <6>usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+ <6>usb 3-1: Product: U-Boot 2013.01-00167-gd62ef56-dirty
+ <6>usb 3-1: Manufacturer: Das U-Boot
+
+Load the usbserial module on your desktop PC:
+
+ $ modprobe usbserial vendor=0x0525 product=0xa4a6
+
+and run your favorite terminal emulation utility (minicom, kermit, etc) with the
+serial device set to /dev/ttyUSB0 (assuming this is your only usb serial
+device). You should be at the u-boot console (type 'help').
+
+There is not much that is unique about using u-boot on the palm treo 680.
+Kernels can be loaded from mmc, flash, and from the desktop PC via kermit. You
+can expand the size of the second partition on the flash to contain a kernel, or
+else put the kernel(s) in their own partition.
+
+Nand commands work as expected, with the excepton that blocks not written by the
+linux mtd subsystem may be misidentified by the u-boot docg4 driver as "bad" if
+they contain data in the oob bytes. This will be the case for the blocks
+containing the u-boot image, for example. To work around this, use 'nand scrub'
+instead of 'nand erase' to erase these blocks, and 'nand read.raw' to read them
+to memory. (It would be useful if u-boot's nand commands provided a way to
+explicitly ignore "bad" blocks, because read.raw does not perform ecc.) The
+'nand dump' command will read these "bad" blocks, however.
+
+Currently u-boot itself can only be programmed to flash from Linux; there is no
+support for reliable mode in u-boot's docg4 flash driver. This should be
+corrected soon.
+
+
+Customizing
+===========
+
+If you change u-boot's configuration significantly (adding or removing
+features), you may have to adjust the value of CONFIG_SYS_NAND_U_BOOT_SIZE.
+This is the size of the concatenated spl + u-boot image, and tells the SPL how
+many flash blocks it needs to load. It will be rounded up to the next 64k
+boundary (the spl flash block capacity), so it does not have to be exact, but
+you must ensure that it is not less than the actual image size. If it is larger
+than the image, blocks may be needlessly loaded, but if too small, u-boot may
+only be partially loaded, resulting in a boot failure (bricked phone), so better
+to be too large. The flash_u-boot utility will work with any size image and
+write the required number of blocks, provided that the partition is large
+enough.
+
+As the first writable block on the device, block 6 seems to make the most sense
+as the flash offset for writing u-boot (and this is where PalmOS places its
+SPL). But you can place it elsewhere if you like. If you do, you need to
+adjust CONFIG_SYS_NAND_U_BOOT_OFFS accordingly, and you must ensure that blocks
+preceeding the ones containing u-boot do *not* have the magic number in oob (the
+IPL looks for this). In other words, make sure that any blocks that previously
+contained the u-boot image or PalmOS SPL are erased (and optionally written with
+something else) so that the IPL does not load it. Also make sure that the new
+u-boot starting offset is at the start of a flash partition (check the kernel
+log after loading the docg4 driver), and pass the corresponding mtd device file
+to the flash_u-boot utility.
+
+The u-boot built-in default environment is used because a writable environment
+in flash did not seem worth the cost of a 256k flash block. But adding this
+should be straightforward.
+
+
+Restoring PalmOS
+================
+
+If you backed up the contents of bootloader_part flash partition earlier, you
+should be able to restore it with the shell script shown below. The first two
+blocks of data contain the PalmOS SPL and were written in reliable mode, whereas
+the next two blocks were written in normal mode, so the script has to load and
+unload the docg4 driver. Make sure that the mtd-utils nandwrite and flash_erase
+are in your path (and are not those from busybox). Also double-check that the
+backup image file bootloader_part.orig is exactly 1081344 bytes in length. If
+not, it was not backed up correctly. Run the script as:
+
+ ./restore_bootpart bootloader_part.orig /dev/mtd1
+
+The script will take a minute or so to run. When it finishes, you may want to
+verify with nanddump that the data looks correct before you cycle power, because
+if the backup or restore failed, your phone will be bricked. Note that as a
+consequence of reliable mode, the odd-numbered 2k regions in the first two
+blocks will not exactly match the contents of the backup file, (so unfortunately
+we can't simply dump the flash contents to a file and do a binary diff with the
+original back-up image to verify that it was restored correctly). Also,
+nanddump will report uncorrectable ecc errors when it reads those regions.
+
+#!/bin/sh
+
+if [ $# -ne 2 ]; then
+ echo "usage: $0: <image file> <mtd device node>"
+ exit 1
+fi
+
+# reliable mode used for the first two blocks
+modprobe -r docg4
+modprobe docg4 ignore_badblocks=1 reliable_mode=1 || exit 1
+
+# erase all four blocks
+flash_erase $2 0 4
+
+# Program the first two blocks in reliable mode.
+# 2k (4 pages) is written at a time, skipping alternate 2k regions
+# Note that "2k" is 2112 bytes, including 64 oob bytes
+file_ofs=0
+flash_ofs=0
+page=0
+while [ $page -ne 1024 ]; do
+ dd if=$1 bs=2112 skip=$file_ofs count=1 | nandwrite -o -n -s $flash_ofs $2 - || exit 1
+ file_ofs=$((file_ofs+2))
+ flash_ofs=$((flash_ofs+0x1000))
+ page=$((page+8))
+done;
+
+# normal mode used for the next two blocks
+modprobe -r docg4
+modprobe docg4 ignore_badblocks=1 || exit 1
+dd if=$1 bs=1 skip=$file_ofs count=540672 | nandwrite -o -n -s 0x80000 $2 - || exit 1
+modprobe -r docg4
+
+TODO
+====
+
+ - Keypad support.
+ - Interactive boot menu using keypad and lcd.
+ - Add reliable mode support to the u-boot docg4 driver.
+ - U-boot command that will write a new image to the bootloader partition in
+ flash.
+ - Linux FTD support.
diff --git a/qemu/roms/u-boot/board/palmtreo680/palmtreo680.c b/qemu/roms/u-boot/board/palmtreo680/palmtreo680.c
new file mode 100644
index 000000000..f4f6e1f5b
--- /dev/null
+++ b/qemu/roms/u-boot/board/palmtreo680/palmtreo680.c
@@ -0,0 +1,148 @@
+/*
+ * Palm Treo 680 Support
+ *
+ * Copyright (C) 2013 Mike Dunn <mikedunn@newsguy.com>
+ *
+ * This file is released under the terms of GPL v2 and any later version.
+ * See the file COPYING in the root directory of the source tree for details.
+ *
+ */
+
+#include <common.h>
+#include <command.h>
+#include <serial.h>
+#include <nand.h>
+#include <malloc.h>
+#include <asm/arch/pxa-regs.h>
+#include <asm/arch-pxa/pxa.h>
+#include <asm/arch-pxa/regs-mmc.h>
+#include <asm/io.h>
+#include <asm/global_data.h>
+#include <u-boot/crc.h>
+#include <linux/mtd/docg4.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+static struct nand_chip docg4_nand_chip;
+
+int board_init(void)
+{
+ /* We have RAM, disable cache */
+ dcache_disable();
+ icache_disable();
+
+ gd->bd->bi_arch_number = CONFIG_MACH_TYPE;
+ gd->bd->bi_boot_params = CONFIG_SYS_DRAM_BASE + 0x100;
+
+ return 0;
+}
+
+int dram_init(void)
+{
+ /* IPL initializes SDRAM (we're already running from it) */
+ gd->ram_size = PHYS_SDRAM_1_SIZE;
+ return 0;
+}
+
+#ifdef CONFIG_LCD
+void lcd_enable(void)
+{
+ /*
+ * Undo the L_BIAS / gpio77 pin configuration performed by the pxa lcd
+ * driver code. We need it as an output gpio.
+ */
+ writel((readl(GAFR2_L) & ~(0xc << 24)), GAFR2_L);
+
+ /* power-up and enable the lcd */
+ writel(0x00400000, GPSR(86)); /* enable; drive high */
+ writel(0x00002000, GPSR(77)); /* power; drive high */
+ writel(0x02000000, GPCR(25)); /* enable_n; drive low */
+
+ /* turn on LCD backlight and configure PWM for reasonable brightness */
+ writel(0x00, PWM_CTRL0);
+ writel(0x1b1, PWM_PERVAL0);
+ writel(0xfd, PWM_PWDUTY0);
+ writel(0x00000040, GPSR(38)); /* backlight power on */
+}
+#endif
+
+#ifdef CONFIG_MMC
+int board_mmc_init(bd_t *bis)
+{
+ writel(1 << 10, GPSR(42)); /* power on */
+ return pxa_mmc_register(0);
+}
+#endif
+
+void board_nand_init(void)
+{
+ /* we have one 128M diskonchip G4 */
+
+ struct mtd_info *mtd = &nand_info[0];
+ struct nand_chip *nand = &docg4_nand_chip;
+ if (docg4_nand_init(mtd, nand, 0))
+ hang();
+}
+
+#ifdef CONFIG_SPL_BUILD
+void nand_boot(void)
+{
+ __attribute__((noreturn)) void (*uboot)(void);
+
+ extern const void *_start, *_end; /* boundaries of spl in memory */
+
+ /* size of spl; ipl loads this, and then a portion of u-boot */
+ const size_t spl_image_size = ((size_t)&_end - (size_t)&_start);
+
+ /* the flash offset of the blocks that are loaded by the spl */
+ const uint32_t spl_load_offset = CONFIG_SYS_NAND_U_BOOT_OFFS +
+ DOCG4_IPL_LOAD_BLOCK_COUNT * DOCG4_BLOCK_SIZE;
+
+ /* total number of bytes loaded by IPL */
+ const size_t ipl_load_size =
+ DOCG4_IPL_LOAD_BLOCK_COUNT * DOCG4_BLOCK_CAPACITY_SPL;
+
+ /* number of bytes of u-boot proper that was loaded by the IPL */
+ const size_t ipl_uboot_load_size = ipl_load_size - spl_image_size;
+
+ /* number of remaining bytes of u-boot that the SPL must load */
+ const size_t spl_load_size =
+ CONFIG_SYS_NAND_U_BOOT_SIZE - ipl_load_size;
+
+ /* memory address where we resume loading u-boot */
+ void *const load_addr =
+ (void *)(CONFIG_SYS_NAND_U_BOOT_DST + ipl_uboot_load_size);
+
+ /*
+ * Copy the portion of u-boot already read from flash by the IPL to its
+ * correct load address.
+ */
+ memcpy((void *)CONFIG_SYS_NAND_U_BOOT_DST, &_end, ipl_uboot_load_size);
+
+ /*
+ * Resume loading u-boot where the IPL left off.
+ */
+ nand_spl_load_image(spl_load_offset, spl_load_size, load_addr);
+
+#ifdef CONFIG_NAND_ENV_DST
+ nand_spl_load_image(CONFIG_ENV_OFFSET, CONFIG_ENV_SIZE,
+ (void *)CONFIG_NAND_ENV_DST);
+
+#ifdef CONFIG_ENV_OFFSET_REDUND
+ nand_spl_load_image(CONFIG_ENV_OFFSET_REDUND, CONFIG_ENV_SIZE,
+ (void *)CONFIG_NAND_ENV_DST + CONFIG_ENV_SIZE);
+#endif
+#endif
+ /*
+ * Jump to U-Boot image
+ */
+ uboot = (void *)CONFIG_SYS_NAND_U_BOOT_START;
+ (*uboot)();
+}
+
+void board_init_f(ulong bootflag)
+{
+ nand_boot();
+}
+
+#endif /* CONFIG_SPL_BUILD */