Canon wordtank Z900

ハードウェア

SoC: MCIMX283DVM4B

DRAM: Micron MT47H64M16HR-25E (D9LHT)

DDR2-800

eMMC: Toshiba THGBM4G6D2HBAIR

8GB

LCD: SHARP LQ043T3LX02

480x272

eMMC の横にある TSOP48 のランド

TSOP48 pin 18 = CLK?

TSOP48 pin 12 = VCC?

ブートシーケンス

OCOTP で eMMC を選択

EBOOT を起動

"Press［ENTER］to launch image stored in SD/MMC or［SPACE］to cancel." のところでスペースを押すと止められる

RNDIS でデータを送り込める（後述）

USB Serial でも送り込めそうだがなんかよくわかんない

Windows を起動

Windows が起動しても UART は生きている

RNDIS によるイメージ転送

スペースキーを押したあとのメニューで DHCP の有無が選択できる

"［D］Download Image Now" を選択すると RNDIS を喋り始める

DHCP 有効かつ母艦側で internet sharing の設定をすると DHCP で IP を与えられるので便利

Link up したら tftp で転送できる

ファイル名: boot.bin

ポート: 980

転送完了したら Brain と同じ感じで jump してくれてそうだが、なんか応答が無い (2021/12/15 現在)

USB Recovery によるイメージ転送

TSOP の Pin 12 と Pin 18 を接続して CLK を High っぱなしにすると、Boot ROM が USB Recovery に fallback する

uuu で転送できる

HTLLC のあとリセットされて 0x8020a014 が出ている可能性？

参考

Bootlog

code: wordtank Z900 bootlog

HTLLCY

BATT:3.68V

B

b$LLLCBSP Clock Configuration:

PLL0 = 480000000 Hz

PLL1 = 480000000 Hz

PLL2 = 0 Hz

REF_CPU = 480000000 Hz

REF_EMI = 392727272 Hz

REF_IO0 = 480000000 Hz

REF_IO1 = 480000000 Hz

REF_PIX = 480000000 Hz

REF_HSADC = 480000000 Hz

REF_GPMI = 480000000 Hz

REF_PLL = 480000000 Hz

REF_XTAL = 24000000 Hz

REF_ENET_PLL= 0 Hz

P_CLK = 240000000 Hz

H_CLK = 80000000 Hz

X_CLk = 24000000 Hz

ETM = 24000000 Hz

EMI = 196363636 Hz

SSP0 = 24000000 Hz

SSP1 = 24000000 Hz

SSP2 = 24000000 Hz

SSP3 = 24000000 Hz

GPMI = 24000000 Hz

HSADC = 26666666 Hz

LCDIF = 24000000 Hz

SPDIF = 120000000 Hz

UTMI0 = 480000000 Hz

UTMI1 = 480000000 Hz

UART24MHZ = 24000000 Hz

PWM24MHZ = 24000000 Hz

TIMROT32K = 32000 Hz

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Feb 27 2012 19:08:33

Microsoft Windows CE Ethernet Bootloader 1.0 for MX28 (build 0639, Feb 28 2012 11:29:49 )

EBOOT:: Clean boot...

MMC High Density card

MMC: Switched to 4 bit mode

INFO: Initialized MMC Card

Card Capacity 7766016 (Kbytes)

OEMPlatformInit: SWITCH SDHC device to user partition.

OEMPlatformInit: OCRAM BOOT_MODE = 0x0000000A.

INFO: Booted from SD/MMC

INFO: Loading boot configuration from SDHC

INFO: Successfully loaded boot configuration from SDHC

System ready!

Preparing for download...

INFO: Initial Eboot Screen Display...

EBOOT: DisplayInit++ :LCD DISPLAY:LQ043T3LX02

Initiating image launch in 3 seconds. 2 seconds. 1 seconds. 0 seconds.

Launching flash image ...

INFO: Storing boot configuration to SDHC

INFO: Successfully stored boot configuration to SDHC

-BLMenu .

INFO: Using device name: 'MX2843204'

EBOOT: **** bCleanBootFlag = 1

INFO: Reading NK image to SDHC (please wait)...

INFO: Copying NK image to RAM address 0xa0200000

INFO: Read is 1% completeINFO: Read is 2% completeINFO: Read is 3% completeINFO: Read is 4% completeINFO: Read is 5% completeINFO: Read is 6% completeINFO: Read is 7% completeINFO: Read is 8% completeINFO: Read is 9% completeINFO: Read is 10% completeINFO: Read is 11% completeINFO: Read is 12% completeINFO: Read is 13% completeINFO: Read is 14% completeINFO: Read is 15% completeINFO: Read is 16% completeINFO: Read is 17% completeINFO: Read is 18% completeINFO: Read is 19% completeINFO: Read is 20% completeINFO: Read is 21% completeINFO: Read is 22% completeINFO: Read is 23% completeINFO: Read is 24% completeINFO: Read is 25% completeINFO: Read is 26% completeINFO: Read is 27% completeINFO: Read is 28% completeINFO: Read is 29% completeINFO: Read is 30% completeINFO: Read is 31% completeINFO: Read is 32% completeINFO: Read is 33% completeINFO: Read is 34% completeINFO: Read is 35% completeINFO: Read is 36% completeINFO: Read is 37% completeINFO: Read is 38% completeINFO: Read is 39% completeINFO: Read is 40% completeINFO: Read is 41% completeINFO: Read is 42% completeINFO: Read is 43% completeINFO: Read is 44% completeINFO: Read is 45% completeINFO: Read is 46% completeINFO: Read is 47% completeINFO: Read is 48% completeINFO: Read is 49% completeINFO: Read is 50% completeINFO: Read is 51% completeINFO: Read is 52% completeINFO: Read is 53% completeINFO: Read is 54% completeINFO: Read is 55% completeINFO: Read is 56% completeINFO: Read is 57% completeINFO: Read is 58% completeINFO: Read is 59% completeINFO: Read is 60% completeINFO: Read is 61% completeINFO: Read is 62% completeINFO: Read is 63% completeINFO: Read is 64% completeINFO: Read is 65% completeINFO: Read is 66% completeINFO: Read is 67% completeINFO: Read is 68% completeINFO: Read is 69% completeINFO: Read is 70% completeINFO: Read is 71% completeINFO: Read is 72% completeINFO: Read is 73% completeINFO: Read is 74% completeINFO: Read is 75% completeINFO: Read is 76% completeINFO: Read is 77% completeINFO: Read is 78% completeINFO: Read is 79% completeINFO: Read is 80% completeINFO: Read is 81% completeINFO: Read is 82% completeINFO: Read is 83% completeINFO: Read is 84% completeINFO: Read is 85% completeINFO: Read is 86% completeINFO: Read is 87% completeINFO: Read is 88% completeINFO: Read is 89% completeINFO: Read is 90% completeINFO: Read is 91% completeINFO: Read is 92% completeINFO: Read is 93% completeINFO: Read is 94% completeINFO: Read is 95% completeINFO: Read is 96% completeINFO: Read is 97% completeINFO: Read is 98% completeINFO: Read is 99% completeINFO: Read is 100% complete

INFO: Copy of NK completed successfully

OEMLaunch called PhysAddress 0x40200000.

Download successful! Jumping to image at 0x0 (physical 0x40200000)...

BSP Clock Configuration:

PLL0 = 480000000 Hz

PLL1 = 480000000 Hz

PLL2 = 0 Hz

REF_CPU = 480000000 Hz

REF_EMI = 392727272 Hz

REF_IO0 = 480000000 Hz

REF_IO1 = 480000000 Hz

REF_PIX = 480000000 Hz

REF_HSADC = 480000000 Hz

REF_GPMI = 480000000 Hz

REF_PLL = 480000000 Hz

REF_XTAL = 24000000 Hz

REF_ENET_PLL= 0 Hz

P_CLK = 240000000 Hz

H_CLK = 80000000 Hz

X_CLk = 24000000 Hz

ETM = 24000000 Hz

EMI = 196363636 Hz

SSP0 = 24000000 Hz

SSP1 = 24000000 Hz

SSP2 = 24000000 Hz

SSP3 = 24000000 Hz

GPMI = 96000000 Hz

HSADC = 26666666 Hz

LCDIF = 8000000 Hz

SPDIF = 120000000 Hz

UTMI0 = 480000000 Hz

UTMI1 = 480000000 Hz

UART24MHZ = 24000000 Hz

PWM24MHZ = 24000000 Hz

TIMROT32K = 32000 Hz

Windows CE Kernel for ARM (Thumb Enabled) Built on Apr 5 2011 at 17:47:22

INFO:OALLogSetZones: dpCurSettings.ulZoneMask: 0xb

Windows CE R3 OS Build 0636, Feb 23 2012 17:26:16

OALInitCpuHclkClock: HW_POWER_5VCTRL=0x20300415

OALInitCpuHclkClock:Update CPU clock to 454MHz!

OAL:: NKForceCleanBoot!

OALArgsQuery: OAL_ARGS_QUERY_UUID

UfnClientLib!UfnCheckPID: WARNING -- using MS reference platform VID/PID 0x045e/0x00ce (not allowed in shipping platforms)

BATT: MainVoltageHigh = 3850

BATT: MainVoltageCritical = 3500

Deteced gBatteryVoltage = 3632

BATT: battery cover interrupt IRQ_GPIO3_PIN4=228

BATT: BatteryCoverInterruptThread Entered!

WAV: BSPSetSpeakerEnable 1

Tempreture abnormal, Charger stop !!!

BKL: Prio=100

SDHC: + DllEntry, Enter

PXP_DllEntry: DLL_PROCESS_ATTACH lpvReserved(0x8022d57c)

PxpClass::PxpInit: Enabling pixel pipeline

PXP_Init - hDev=0xd040d7e0

WEMMCF:Start

WEMMCF: Reset Status = 0x00000000

MMC_EXT_CSD_BOOTCONF=0x0

ddr mode enable

MMC card set bus width to ddr mode

MMC Single/Multiple Command.

WEMMCF:End

GetOverlayAlign: succeeds, size is 8!

GetDisplayGuid: {F444B1EF-52E2-4cf2-875F-DA6033418809}

Initializing LQ043T3 controller

DisplayControllerLQ043T3: VCOM=0x11F

LoadPixelDepthFromRegistry: succeeds!

LQ043T3 InitDisplay: LCD Power Off & Reset before BSPInitLCDIF(TRUE).

Display controller init using PLL - rootfreq=432000000 PixFreq=9009 u32Div=48!

GetVMemSizeFromRegistry: succeeds, size is 8388608!

LayMgr.cpp: Layout Manager successfully initialized to 1

Maximum Allowed Error 7:

OomUI_Initialize: SUCCESS!

LaunchManager:Enter.

LaunchManager:Execute successfull.

RbyIdleTask:Enter

BSPClockSetpointRelease req=0 count=0

RbyIdleTask:ACLineStatus 0

RbyIdleTask:ActiveSync disabled.

RbyIdleTask: Reset Status = 0x00000000

RbyIdleTask: ShowWarnings = 1, CountDown = 30

LowBatteryWatchThread Start

MSIM: IM_ReadRegistry read KB 5

LowBatteryWndProc: WM_CREATE

Tempreture abnormal, Charger stop !!!

Before HeepCompact

Before Main Loop

RbyIdleTask: ShowOOMUIWarnings = 1, Priority256 = 249, OOM CountDown = 30

OutOfMemoryWatchThread Start

OOMUIWndProc: WM_CREATE

RbyIdleTask: OOM Event Handle = 0x00b20803

RbyIdleTask: OutOfMemoryWatchThread (pri = 249) started.

+OEMSetAlarmTime(12/31/2135 23:59:59.000)

Alarm to be set is OK: 2135/12/31, 23:59:59 Day of week:6

RbyIdleTask:Enter PowerNotificationEventsThread! Prio.Level=97

Before HeepCompact

Before Main Loop

RbyIdleTask: Message pump started!.

Tempreture abnormal, Charger stop !!!