Cybook gen3 hack

From MobileRead
Jump to: navigation, search

Contents

[edit] Introduction

On this page you will find the method used to fix a freezing problem with my Cybook Gen3.

In fact, the Cybook Gen3 works with a Linux kernel (It was one of the benefits that motivated my purchase).

The sources are available on the site cybook. So this method is:

  1. Connect the cybook to serial to a PC under linux
  2. fix the bug (infinite loop with rtc driver)
  3. compilation of a new kernel
  4. Replace the kernel

[edit] Connect to serial port

the cybook gen3 use a serial port at 115200 baud 8N1

The pinout can be found at [1] Here an exemple

you must use a MAX3232 to connect to serial PC port.

The Serial connection Schema with MAX3232
A photo of a cybook with serial port

















You can use minicom Official Site to connect to the cybook. Here the minicom serial configuration.

 
    +-----------------------------------------------------------------------+ 
    | A -                             Port série : /dev/ttyS0               | 
    | B - Emplacement du fichier de verrouillage : /var/lock                | 
    | C -            Programme d'appel intérieur :                          | 
    | D -            Programme d'appel extérieur :                          | 
    | E -                      Débit/Parité/Bits : 115200 8N1               | 
    | F -              Contrôle de flux matériel : Non                      | 
    | G -              Contrôle de flux logiciel : Non                      | 
    |                                                                       | 
    |    Changer quel réglage ?                                             | 
    +-----------------------------------------------------------------------+ 

first, when you have connect the serial port press a key when, just after pressing the power button, the prompt vivi appear

init built-in commands                                                          
Show Startup BMP                                                                
vivi layer :init_led3() .........                                               
vivi layer :init_power()..........                                              
date: 2006.11.10                                                                
vivi layer :init_pwr()..........                                                
vivi layer :init_usb()..........                                                
vivi layer :                                                                    
vivi layer :init_led3()..........                                               
vivi layer : bit led1 should be Lo                                              
DZ_after init_builtin_cmds                                                      
DZ Test vivi code                                                               
Press Return to start the LINUX now, any other key for vivi                     
type "help" for help.                                                           
vivi>

[edit] use the shell

ebrmain is the main program to read ebook.

to access to the shell, just open a ebook or turn a page to activate the cybook and next press <CTRL-C> before the cybook go in the suspend mode.

                                                                 
Waiting for enter to start '/bin/sh' (pid 52, terminal /dev/console)            
                                                                                
Please press Enter to aceivate this console. lease adc module                   
                                                                                
Starting pid 52, console /dev/console: '/bin/sh'                                                                                                            
                                                                                
BusyBox v0.60.3 (2002.05.13-08:36+0000) Built-in shell (ash)                    
Enter 'help' for a list of built-in commands. 

# ps                                                                            
  PID  Uid     VmSize Stat Command                                              
    1 root       1400 S    init                                                 
    2 root            S    [keventd]                                            
    3 root            S    [ksoftirqd_CPU0]                                     
    4 root            S    [kswapd]                                             
    5 root            S    [bdflush]                                            
    6 root            S    [kupdated]                                           
    7 root            S    [mtdblockd]                                          
   20 root            S    [khubd]                                              
   26 root            S    [usb-storage-0]                                      
   27 root            S    [scsi_eh_0]                                          
   51 root       1400 S    init                                                 
   52 root       1408 S    -sh                                                  
   66 root       1404 R    ps                                              

you cannot use ebrmain at the same time, to activate the reader just enter the command:

# /ebrmain/ebrmain     

[edit] Load a kernel in the ram

To load a kernel in memory, first change the xmodem_initial_timeout to 10000000

vivi> param set xmodem_initial_timeout 10000000  
Change 'xmodem_initial_timeout' value. 0x000493e0(300000) to 0x05f5e100(1000000)

To load a kernel in memory with minicom, in this exemple 10005056 is the size of kernel image. vivi can use only "Xmodem modem" The transfert is realize with 128k block size.

 
vivi> load ram 0x30008000 1005056 x                                             
Ready for downloading using xmodem...                                           
Waiting...                   

select<CTRL-A> and "s"

choose "transfert Xmodem"

choose the file to transfert

 +-----[xmodem envoyer - Appuyez sur CTRL-C pour quitter]------+   
 |Sending kernel-128.bin, 7852 blocks: Give your local XMODEM r|(300000) 
 |eceive command now.                                          |        
 |Bytes Sent:1005056   BPS:4629                                |        
 |                                                             |        
 |Transfer complete                                            |        
 |                                                             |        
 | PRÊT : appuyez sur une touche pour continuer...             |        
 +-------------------------------------------------------------+        

booting the kernel from ram

vivi> boot ram
Copy linux kernel from 0x00030000 to 0x30008000, size = 0x00100000 ... done
zImage magic = 0x016f2818
Setup linux parameters at 0x30000100
linux command line is: "noinitrd root=/dev/mtdblock/2 init=/linuxrc console=ttyS0"
MACH_TYPE = 193
NOW, Booting Linux......
Uncompressing Linux............................................ done, booting the kernel.
Linux version 2.4.18-rmk7-pxa1 (phil@phil) (gcc version 2.95.3 20010315 (release
...

[edit] The mtd partitions

The cybook comes with a Nor Flash with 5 partitions. From vivi, you can see the partitions

vivi> part show                                                                 
mtdpart info. (6 partitions)                                                    
name              offset        size        flag                                
------------------------------------------------                                
vivi            : 0x00000000    0x00020000     0  128k                          
param           : 0x00020000    0x00010000     0   64k                          
kernel          : 0x00030000    0x00100000     0    1M                          
root            : 0x00130000    0x00170000     4    1M+448k                     
ebr             : 0x002a0000    0x00540000     4    5M+256k                     
BMP             : 0x007e0000    0x00020000     0  128k              

From linux

# cat /proc/mtd                                                                 
dev:    size   erasesize  name                                                  
mtd0: 00800000 00020000 "Physically mapped flash"                               
mtd1: 00100000 00010000 "Kernel (896k)"                                         
mtd2: 00170000 00010000 "root"                                                  
mtd3: 00020000 00010000 "BMP"                                                   
mtd4: 00020000 00010000 "vivi"                                                  
mtd5: 00540000 00010000 "ebr" 

[edit] mtd partition identification

You must use the mtd-utils ftp site to obtain mtd-utils to manipulate the mtd partition

here File:Mtd-utils-1.0.1.arm-bin.tar.zip, you can find a precompiled version with gcc 2.95.3. Copy the file in a bin directory of the Memory of the cybook. So you can have access in /mnt/ext1/bin via minicom

 # /mnt/ext1/bin/mtd_debug info /dev/mtd/1                                                   
mtd.type = MTD_NORFLASH                                                         
mtd.flags =                                                                     
mtd.size = 1048576 (1M)                                                         
mtd.erasesize = 65536 (64K)                                                     
mtd.writesize = 0                                                               
mtd.oobsize = 0                                                                 
mtd.ecctype = MTD_ECC_NONE                                                      
regions = 0                      

[edit] Save the mtd partition

two method to save the mtd partition, go to a safe place in the /mnt/ext2 which is the SD storage and create a directory

# mkdir /mnt/ext2/savmtd
# cd /mnt/ext2/savmtd

the first one with mtd_debug

# /mnt/ext1/bin/mtd_debug read /dev/mtd/1 0 1048576 mtd1.dump                   
Copied 1048576 bytes from address 0x00000000 in flash to mtd1.dump   

the second one with dd

# dd if=/dev/mtd/1 of="mtd1_00100000_00010000_Kernel_896k.img"                  
2048+0 records in                                                               
2048+0 records out  

[edit] Flash the kernel

Be sure to have test the kernel you want to flash with a boot ram first. Be sure saving the kernel mtd partition before proceed

Copy the zImage file on the SD card, you can find it from cybook in /mnt/ext2

# /mnt/ext1/bin/flashcp zImage /dev/mtd/1


[edit] kernel compilation

You must download the sources "Code source GPL 1.0" and "Code source GPL 2.0".
My cybook use vivi to boot, so the code source to use is "Code source GPL 1.0".
The "Code source GPL 2.0" has the crosstool 2.95.3. So i use it to compil the kernel 1.0.

Verify the configuration of the compiler

$HOME/cybook-src-2.0-20090730/crosstool/2.95.3/bin/arm-linux-gcc -print-search-dirs 
install: /usr/local/arm/2.95.3/lib/gcc-lib/arm-linux/2.95.3/ 
programs: /usr/local/arm/2.95.3/lib/gcc-lib/arm-linux/2.95.3/:/usr/local/arm/2.95.3/lib/gcc-lib/arm-linux/:/usr/lib/gcc/arm-linux/2.95.3/
          :/usr/lib/gcc/arm-linux/:/usr/local/arm/2.95.3/arm-linux/bin/arm-linux/2.95.3/:/usr/local/arm/2.95.3/arm-linux/bin/ 
libraries: /usr/local/arm/2.95.3/lib/gcc-lib/arm-linux/2.95.3/:/usr/lib/gcc/arm-linux/2.95.3/:/usr/local/arm/2.95.3/arm-linux/lib/arm-linux/2.95.3/
          :/usr/local/arm/2.95.3/arm-linux/lib/


Create the link

# ln -s $HOME/cybook-src-2.0-20090730/crosstool/2.95.3 /usr/local/arm/2.95.3

Correct the error script in $HOME/cybook-src-2.0-20090730/busybox/scripts/trylink

replace 
function try {
by
try() {

Source the file $HOME/cybook-src-2.0-20090730/bin/cybserc

$ source $HOME/cybook-src-2.0-20090730/bin/cybserc

go to the "Code source GPL 1.0"

# cd $HOME/gpl_gen3/kernel_16M
# make dep
# make zImage

After the compilation, you can found the kernel zImage in $HOME/gpl_gen3/kernel_16M/arch/arm/boot
you can transfer this file as we showed in the previous chapter.

[edit] Correct the bug

in the file ./gpl_gen3/kernel_16M/drivers/char/s3c2410-rtc.c and ./kernel_16M/include/asm-arm/arch-s3c2410/time.h ,
there is a infinite loop if the rtc doesn't work.

read_rtc_bcd_time:
	rtc_tm->tm_year = (unsigned char)BCDYEAR & Msk_RTCYEAR;
		rtc_tm->tm_mon = (unsigned char)BCDMON & Msk_RTCMON;
//		rtc_tm->tm_mday = (unsigned char)BCDDAY & Msk_RTCDAY;
 		rtc_tm->tm_mday = (unsigned char)BCDDATE & Msk_RTCDAY; 
		rtc_tm->tm_hour = (unsigned char)BCDHOUR & Msk_RTCHOUR;
		rtc_tm->tm_min = (unsigned char)BCDMIN & Msk_RTCMIN;
		rtc_tm->tm_sec = (unsigned char)BCDSEC & Msk_RTCSEC;

		if (rtc_tm->tm_sec == 0) {
			/* Re-read all BCD registers in case of BCDSEC is 0.
			   See RTC section at the manual for more info. */
			goto read_rtc_bcd_time;
		}

one of the correction

read_rtc_bcd_time:
		rtc_tm->tm_year = (unsigned char)BCDYEAR & Msk_RTCYEAR;
		rtc_tm->tm_mon = (unsigned char)BCDMON & Msk_RTCMON;
//		rtc_tm->tm_mday = (unsigned char)BCDDAY & Msk_RTCDAY;
		rtc_tm->tm_mday = (unsigned char)BCDDATE & Msk_RTCDAY;
		rtc_tm->tm_hour = (unsigned char)BCDHOUR & Msk_RTCHOUR;
		rtc_tm->tm_min = (unsigned char)BCDMIN & Msk_RTCMIN;
		rtc_tm->tm_sec = (unsigned char)BCDSEC & Msk_RTCSEC;

  if (rtc_tm->tm_sec == 0 &&  count == 0 ) {
			/* Re-read all BCD registers in case of BCDSEC is 0.
			   See RTC section at the manual for more info. */
     printk("WARNING: BCDSEC = %d ", rtc_tm->tm_sec );
     printk("=> Re-read all BCD registers\n" );
     count++;
		goto read_rtc_bcd_time; 
   }
   if (rtc_tm->tm_sec == 0 &&  count > 0 ) {
     printk("WARNING: The rtc doesn't work !");
     printk("Nevermind, doesn't need for cybook gen3 !\n");
   }
   printk("DEBUG: BCDSEC = %d\n", rtc_tm->tm_sec );

[edit] Credits

ijovy

Personal tools
Namespaces

Variants
Actions
Navigation
MobileRead Networks
Toolbox