1 /***************************************************************************
3 * Open \______ \ ____ ____ | | _\_ |__ _______ ___
4 * Source | _// _ \_/ ___\| |/ /| __ \ / _ \ \/ /
5 * Jukebox | | ( <_> ) \___| < | \_\ ( <_> > < <
6 * Firmware |____|_ /\____/ \___ >__|_ \|___ /\____/__/\_ \
10 * Copyright (C) 2002 by Linus Nielsen Feltzing
12 * All files in this archive are subject to the GNU General Public License.
13 * See the file COPYING in the source tree root for full license agreement.
15 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
16 * KIND, either express or implied.
18 ****************************************************************************/
20 /* Arm bootloader and startup code based on startup.s from the iPodLinux loader
22 * Copyright (c) 2003, Daniel Palffy (dpalffy (at) rainstorm.org)
23 * Copyright (c) 2005, Bernard Leach <leachbj@bouncycastle.org>
30 .section .init.text,"ax",%progbits
34 /* Telechips firmware files start with a 32-byte header, as part of the code. */
38 /* Add -DTCCBOOT to EXTRA_DEFINES in the bootloader Makefile to
39 enable building the bootloader to be appended to the end of the
40 original firmware, dual-booting based on a key-press.
42 NB: On the D2 TCCBOOT currently only works in USB boot mode (via tcctool)
43 When flashed to the device, the OF will boot as normal - but holding a
44 key to boot Rockbox results in a blank screen and crashed player.
46 The following two values are filled in by mktccboot.
48 .word 0 /* Saved entrypoint of original firmware*/
49 .word 0 /* Location in RAM of the start of our bootloader */
51 ldr pc, =start_loc /* jump to the main entry point */
53 .word 0xffff0601 /* Unknown magic */
54 .word 0x3a726556 /* "Ver:" */
55 .word 0x31373030 /* "0071" */
56 .word 0 /* First CRC32 */
57 .word 0 /* Unknown - always 0 */
58 .word 0 /* Second CRC32 */
59 .word 0 /* length of firmware file */
62 /* Some original firmwares have 0x40 bytes of zeroes here - we
63 don't know why, but err on the side of caution and include it
75 ldr r0, [r0, #0x40] /* Read GPIO B */
77 ldreq pc, [pc, #-28] /* Jump to original firmware if keypad not pressed */
79 #error No bootup key detection implemented for this target
82 /* Copy bootloader to safe area - 0x21000000 (DRAM) */
83 /* TODO: Adjust this for other targets - DRAM + DRAMSIZE - 0x100000 */
94 ldr pc, =copied_start /* jump to the relocated start_loc: */
99 /* We don't use interrupts in the bootloader */
101 /* Set up stack for IRQ mode */
105 /* Set up stack for FIQ mode */
110 /* Let abort and undefined modes use IRQ stack */
119 /* Switch to supervisor mode */
124 /* Enable MMU & caches. At present this is just doing what the OF does.
125 Ensure TCMs are enabled before copying the exception vectors to 0x0. */
127 mov r1, #0xf7000000 /* Virtual MMU Table base */
129 ldr r0, =0x1fe0c /* Region 0: 0x00000000-0xffffffff (4Gb) */
130 str r0, [r1] /* AP: 3 EN: 1 DO: 0 CACHE_ALL */
132 ldr r0, =0x2801ae24 /* Region 1: 0x28000000-0x2fffffff (128Mb) */
133 str r0, [r1,#4] /* AP: 3 EN: 1 DO: 1 BUFFERED */
135 ldr r0, =0x13e44 /* Region 2: 0x00000000-0x000fffff (1Mb) */
136 str r0, [r1,#8] /* AP: 3 EN: 1 DO: 2 BUFFERED */
138 ldr r0, =0x4001ce60 /* Region 3: 0x40000000-0x5fffffff (512Mb) */
139 str r0, [r1,#0xc] /* AP: 3 EN: 1 DO: 3 CACHE_NONE */
141 ldr r0, =0x6001be80 /* Region 4: 0x60000000-0x6fffffff (256Mb) */
142 str r0, [r1,#0x10] /* AP: 3 EN: 1 DO: 4 CACHE_NONE */
144 ldr r0, =0x3801aea4 /* Region 5: 0x38000000-0x3fffffff (128Mb) */
145 str r0, [r1,#0x14] /* AP: 3 EN: 1 DO: 5 BUFFERED */
147 ldr r0, =0x8001eec0 /* Region 6: 0x80000000-0xffffffff (2Gb) */
148 str r0, [r1,#0x18] /* AP: 3 EN: 1 DO: 6 CACHE_NONE */
150 ldr r0, =0x1001aee0 /* Region 7: 0x10000000-0x17ffffff (128Mb) */
151 str r0, [r1,#0x1c] /* AP: 3 EN: 1 DO: 7 CACHE_NONE */
154 mcr p15, 0, r1, c2, c0, 0 /* Set TTBR = TABBASE (Virtual TLB) */
157 mcr p15, 0, r0, c3, c0, 0 /* Domain access d0-d15 = 'client' */
160 mcr p15, 0, r0, c9, c1, 0 /* Data TCM: 0xA0000000-0xA00001fff (8Kb) */
162 mcr p15, 0, r0, c9, c1, 1 /* Instr. TCM: 0x00000000-0x00000fff (4Kb) */
165 mcr p15, 0, r0, c7, c5, 0 /* Invalidate Icache */
167 mcr p15, 0, r2, c1, c0, 0 /* Enable MMU, I & D caches */
168 mcr p15, 0, r0, c7, c6, 0 /* Invalidate Dcache */
169 mcr p15, 0, r1, c8, c7, 0 /* Invalidate TLB */
171 #if !defined(BOOTLOADER) && !defined(STUB)
173 /* Copy exception handler code to address 0 */
174 ldr r2, =_vectorsstart
176 ldr r4, =_vectorscopy
183 /* Copy the IRAM (SRAM) */
221 #endif /* !BOOTLOADER,!STUB */
223 /* Initialise bss section to zero */
232 /* Set up some stack and munge it with 0xdeadbeef */
243 /* main() should never return */
247 /* Exception handlers. Will be copied to address 0 after memory remapping */
248 .section .vectors,"aw"
258 /* Exception vectors */
262 .word undef_instr_handler
263 .word software_int_handler
264 .word prefetch_abort_handler
265 .word data_abort_handler
266 .word reserved_handler
278 /* All illegal exceptions call into UIE with exception address as first
279 parameter. This is calculated differently depending on which exception
280 we're in. Second parameter is exception number, used for a string lookup
288 /* We run supervisor mode most of the time, and should never see a software
289 exception being thrown. Perhaps make it illegal and call UIE?
291 software_int_handler:
295 prefetch_abort_handler:
310 /* We don't use interrupts in the bootloader */
312 /* Align stacks to cache line boundary */
315 /* 256 words of IRQ stack */
319 /* 256 words of FIQ stack */