Linux on the ST-Ericsson Ux500 platforms
(Last test 2020-04-17 using kernel v5.7-rc1)

The ST-Ericsson Ux500 was primarily incorporated in two chipsets found in the wild: U8500 and A9500. The latter lacks a modem but is otherwise the same chip. The Ux500 is also known as NovaThor which has its own Wikipedia article even.

The U8500 was used in numerous mobile phones from Samsung and Sony Ericsson, the U9500 was used in a few tablet products and the single board computer Snowball.

Documentation

Look into the wayback machine for ST-Ericsson and you find the chip docs!

Old Snowball Files

The introduction video from Movial is still available at YouTube!

The support for Snowball U9500 has been discontinued, but there is a backup of all related files here on GitHub if you e.g. need to recover the board or so. This repository includes some documentation.

Target platforms

Device tree for the Ux500 SoC
Ux500 products

Device tree for the Samsung GT-I8190 "golden" mobile phone
Device tree for the Samsung GT-S7710 "skomer" mobile phone

ST-Ericsson reference designs

Device tree for the Snowball board
Device tree for the HREF v60 and later reference design base board
Device tree for the TVK1281618 User Interface Boards (common part)
Device tree for the TVK1281618 R2 UIB for the Ux500 reference designs
Device tree for the TVK1281618 R3 UIB for the Ux500 reference designs
Device tree for the "ST_UIB" (the board is marked with this) for the Ux500 reference designs

Toolchain

The latest ARM-provided GCC toolchain is what I usually use to compile recent kernels. You want the arm-none-linux-gnueabihf compiler.

Download the toolchain and install it such that it is always in your path, example:

CS_BASE=/var/gcc-arm-9.2-2019.12-x86_64-arm-none-linux-gnueabihf/arm-none-linux-gnueabihf
export PATH=$PATH:${CS_BASE}/bin
export MANPATH=$MANPATH:${CS_BASE}/share/doc/gcc-linaro-arm-linux-gnueabihf/man/

Here are some .mak Makefiles that I use to configure and build a U300, Nomadik or Ux500 series kernel out-of-the box:

ux500.mak can be used for any Ux500 platform actually, it configures and builds a combined binary for these platforms. If you don't specify a UX500_BOARD to the script, it will built it with a Snowball device tree.

Using these also optionally use a minimal initramfs root filesystem placed in your home directory. (This is to get you to a prompt without a root filesystem installed in the flash, such as the ArchLinux method described below.) These root filesystems are created using this script. Prebuilt version can be obtained here:

rootfs-ux500.cpio (Ux500, U8500, Snowball)

Copy the rootfs to you home directory and the ux500.mak file to your linux/ git tree or base dir and simply:

> make -f ux500.mak config
> make -f ux500.mak build

Upload a zImage on Ux500 using fastboot

The fastboot i.e. LittleKernel boot loader in the later ux500 platforms does not support not passing an initrd image when booting over USB. The proper way to kick a boot with just initramfs is like this:

> echo "foo" > null-initrd
> fastboot --base 0x0 boot zImage null-initrd

Elder versions of fastboot do not recognize the --base argument so if you have one of those instead just specify -b 0x0.

Upload a zImage on Ux500 using U-Boot

The Snowball board usually comes with U-Boot pre-installed so you can use this to boot the board using TFTP over the on-board ethernet connector.

My notes on installing a TFTP server might be helpful to set up the server.

To boot from U-Boot you need a uImage, then:

setenv ethaddr 6e:e6:84:36:8e:9e ; setenv serverip 169.254.1.1 ; setenv ipaddr 169.254.1.2 ; tftpboot 0x01000000 169.254.1.1:uImage ; bootm

Booting a kernel on Samsung Galaxy Xcover 2 (GT-S7710)

The Samsung Xcover 2 was released in 2013 and uses the U8500 SoC. According to the source code release for GT-S7710 the Samsung code name for this product is Skomer.

Prerequisites: dnf -y install abootimg heimdall

The abootimg creates a boot image on the Android-specific format (containing a kernel, a ramdisk and some parameters) and heimdall is a flashing tool to install new firmware into Samsung phones.

Put the device into developer mode.
Create a serial cable, use a resistor of 619kOhm between ID and GND to bring out the normal console (also known as ttyAMA2 on ux500). In the FSA880 port connector this is known as factory UART mode You can test the console with the burnt-in bootloader, just hammer ENTER to get into the boot console, it should come up something like this, the prompt SBL> presumably means "Secondary Boot Loader". You can type help to play around with the different commands. This bootloader is named aboot and is in turn based on Little Kernel (LK).
Check the environment: printenv
Set up the environment to provide console (notice we only change the value of the console argument):
setenv CMDLINE cachepolicy=writealloc mpcore_wdt.mpcore_margin=359 root=/dev/ram0 rw rootwait crash_reboot=yes crash_dump=no init=init console=ttyAMA2,115200,n8 (default value cachepolicy=writealloc mpcore_wdt.mpcore_margin=359 root=/dev/ram0 rw rootwait crash_reboot=yes crash_dump=no init=init console='null'
saveenv
Compile the new zImage
echo "blah" > null-initrd
abootimg --create boot.img -k zImage -r null-initrd -c "bootsize=0x6b1000" -c "pagesize=0x800" \ -c "kerneladdr=0x8000" -c "ramdiskaddr=0x2000000" -c "secondaddr=0xf00000" -c "tagsaddr=0x100"
Shut down device (hold power key, select shut down)
Hold down HOME (middle button under screen with a house on), VOLUME - (on the side) and press and release POWER
The phone will bzzz and show a special screen with warnings about custom OS (also known as Odin Mode). Press VOLUME UP to continue.
The Android robot comes up with the text Downloading... Do not turn off target!
Execute Heimdall to download and flash a new kernel like this:
heimdall flash --Kernel boot.img --verbose
notice: capital K in Kernel!

Links

Serial debugging at PostmarketOS tells you how to build a suitable serial cable
Rick va der Zwet's XCover 2 modification guide

Root Xcover 2
Sebastians firmware images

Prebuilt images ux500

uImage-5.0-snowball-initramfs a fully working v5.0 kernel with initramfs for the Snowball, as a uImage.
uImage-5.0-snowball a fully working v5.0 kernel without initramfs for the Snowball, as a uImage.
uImage-4.20-rc3-snowball a fully working v4.20-rc3 kernel with initramfs for the Snowball, as a uImage.
uImage-4.15-rc1-snowball a fully working v4.15-rc1 kernel without initramfs for the Snowball, as a uImage. Intended to be used when you want to install ArchLinux on the snowball.
uImage-4.11-snowball a fully working v4.11 kernel without initramfs for the Snowball, as a uImage. Intended to be used when you want to install ArchLinux on the snowball.
uImage-4.10-rc8-snowball a fully working v4.10-rc8 kernel without initramfs for the Snowball, as a uImage. Intended to be used when you want to install ArchLinux on the snowball. (This time I think I fixed up all systemd dependencies.)
uImage-4.7-rc1-snowball a fully working v4.7-rc1 kernel without initramfs for the Snowball, as a uImage. Intended to be used when you want to install ArchLinux on the snowball.
uImage-4.4-snowball a fully working v4.4 kernel without initramfs for the Snowball, as a uImage. Intended to be used when you want to install ArchLinux on the snowball.
uImage-4.4-rc2-snowball a fully working v4.4-rc2 kernel without initramfs for the Snowball, as a uImage. Intended to be used when you want to install ArchLinux on the snowball.
uImage-4.2-rc1-snowball a fully working v4.2-rc1 kernel with initramfs for the Snowball, as a uImage.
uImage-4.1-rc3-snowball a fully working v4.1-rc3 kernel with initramfs for the Snowball, as a uImage.
uImage-4.0-snowball a fully working v4.0 kernel with initramfs for the Snowball, as a uImage.
uImage-3.18-rc4-snowball an in-flight development version of the v3.18 kernel release candidate 4. As a uImage.
uImage-3.12-snowball an in-flight development version of the v3.13 kernel actually. As a uImage.

ArchLinux on the ux500 (especially Snowball)

It's fairly simple to install a generic ArchLinux distribution on the ux500 variants to get some proper root filesystem with some more action. This is based on the Versatile Express installation procedure.

We start by putting it on an SD card and from there to the internal eMMC.

You need to first build a kernel, you can use the prebuilt v4.4 kernel found further down this page.

U-Boot procedure

The following was done on the Snowball which has an on-board 7GiB eMMC which appears as /dev/mmcblk0 and is pre-partitioned with three partitions:

mmcblk0p1 (3968 KiB): contains the first boot stages: ISSW (initial secure software), MEM-INIT settings (that set up the external memory), X-Loader (that loads TEE and U-Boot) TEE (Trusted Execution Environment) and U-Boot or other boot loader. U-Boot appears at offset 0x00100000 into this partition.
- here is a copy of my boot partition. CAUTION! I think those are signed to be individually unique for each device. It is NOT possible at all to overwrite your boot partition with this. The file is here for purely academic purpose and my own backup. It may be possible to just overwrite the U-Boot at offset 0x00100000.
- A copy of U-Boot 2009.11 from offset 0x00100000. Done like this:
```
	  dd if=/dev/mmcblk0p1 of=u-boot-2009-11.bin skip=2048
	
```
  MAYBE it is possible to replace your U-Boot with mine like this:
```
	  dd if=/dev/mmcblk0p1 of=/dev/mmcblk0p1 seek=2048
	
```
mmcblk0p2 (53248 KiB): Kernel, FAT filesystem containing the uImage and some other stuff
mmcblk0p3 (3088384 KiB): Userspace root filesystem, can be Android or whatever, but ArchLinux works fine too

We will proceed to overwrite the uImage in mmcblk0p2 with the latest we have and then overwrite the root filesysystem in mmcblk0p3 with ArchLinux.

Get hold of a uImage that boots your Snowball. See below for a pre-built binary if need be.

Prepare an SD card on your computer, when I tried I had to use a 2GiB SD card because the Snowball would not support SDHC cards, so there may be tight on space. This computer has a proper SD card reader that appears as /dev/mmcblk0 but yours may be /dev/sdb or whatever. We're anyways just going to use this to prepare the eMMC so:

      umount /run/media/[username]/[path to sd card mount]
      dd if=/dev/zero of=/dev/mmcblk0 bs=1M count=8
      parted /dev/mmcblk0
      (parted) mklabel gpt
      (parted) mkpart ESP fat32 1MiB 513MiB
      (parted) set 1 boot on
      (parted) mkpart primary ext4 513MiB 100%
      (parted) quit
      mkfs.vfat /dev/mmcblk0p1
      mkdir /mnt/boot
      mount /dev/mmcblk0p1 /mnt/boot
      cp uImage /mnt/boot
      umount /mnt/boot
      mkfs.ext4 /dev/mmcblk0p2
      mkdir /mnt/rootfs
      mount /dev/mmcblk0p2 /mnt/rootfs
      cd /tmp
      wget http://archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz
      cd /mnt/rootfs
      tar xvfz /tmp/ArchLinuxARM-armv7-latest.tar.gz
      cd
      umount /mnt/rootfs

It may take time for the rootfs to unmount because all changes are written to the SD card.

Go to U-Boot console (hammer enter)

      printenv
      setenv bootargs console=ttyAMA2,115200n8 root=/dev/mmcblk0p2 rw rootwait rootfstype=ext4 init=/sbin/init
      printenv
      mmc rescan 1
      fat load mmc 1:1 0x00100000 /uImage
      bootm

This should bring up ArchLinux from the card. It may behave badly but nevermind. Log in with root/root

Prepare the new root filesystem on the eMMC and shut down but NOTE: the blkid call below will output the UUID of the new ext4 partition, so take care to save this so you can use it for mounting the filesystem later!

    mkfs.ext4 /dev/mmcblk1p3
    mkdir /mnt/rootfs
    mount /dev/mmcblk1p3 /mnt/rootfs
    dhcpd
    pacman -S wget
    cd /mnt/rootfs
    wget http://archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz
    tar xvfz ArchLinuxARM-armv7-latest.tar.gz
    rm ArchLinuxARM-armv7-latest.tar.gz
    blkid
    cd
    umount /mnt/rootfs
    shutdown -h now

The output from blkid may look something like this:

      /dev/mmcblk0: PTTYPE="dos"
      /dev/mmcblk0p2: LABEL="boot" UUID="5C9F-14B3" TYPE="vfat"
      /dev/mmcblk0p3: UUID="05675adc-df07-4320-b606-8eeee4936aee" TYPE="ext4"

Note the UUID for the ext4 partition. These will be used to mount the rootfs.

No go to the U-Boot console (hammer enter) again, but boot from the eMMC:

      printenv
      setenv bootargs console=ttyAMA2,115200n8 root=/dev/mmcblk1p3 rw rootwait rootfstype=ext4 init=/sbin/init
      printenv
      mmc rescan 1
      fat load mmc 1:1 0x00100000 /uImage
      bootm

Whoa! ArchLinux comes up. Login as root/root and update the system:
```
      dhcpd
      pacman -Syu
    
```

Install the uImage to the boot partition then:

      mkdir /mnt/boot
      mount /dev/mmcblk1p2 /mnt/boot
      cd /mnt/boot
      wget http://dflund.se/~triad/krad/ux00/uImage-4.4-snowball
      mv uImage uImage-old
      mv uImage-4.4-snowball uImage
      cd
      umount /mnt/boot

When we got this far we should consider making the U-Boot command line change permanent. First all the previous steps must have worked out and the U-Boot environment should look sane. Then edit the bootargs from the U-Boot propts and save (NOTE the backslash in front of $ in \${bootargs} is NOT OPTIONAL, and as you can see, the SD card comes up as the first device when it is inserted, otherwise as the second):
```
      printenv
      setenv emmcargs setenv bootargs \${bootargs} root=/dev/mmcblk0p3 rw rootwait rootfstype=ext4 init=/sbin/init
      setenv mmcargs setenv bootargs \${bootargs} root=/dev/mmcblk1p3 rw rootwait rootfstype=ext4 init=/sbin/init
      printenv
      saveenv
      reset
    
```
Remove the SD card and reboot. The kernel should now boot from the eMMC.

Fastboot procedure

If the board has Fastboot installed, we do not need to screw around with FAT partitions etc.

Prepare an SD card on your computer:

      umount /run/media/[username]/[path to sd card mount]
      dd if=/dev/zero of=/dev/mmcblk0 bs=1M count=8
      fdisk /dev/mmcblk0
      [n p 1 ENTER ENTER w]
      mkfs.ext4 /dev/mmcblk0p1
      mkdir /mnt/rootfs
      mount /dev/mmcblk0p1 /mnt/rootfs
      cd /tmp
      wget http://archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz
      cd /mnt/rootfs
      tar xvfz /tmp/ArchLinuxARM-armv7-latest.tar.gz
      cd
      umount /mnt/rootfs

If you can boot using fastboot this is all you need. You can boot into ArchLinux like this:

      fastboot -b 0x0 -c "console=ttyAMA2,115200,n8 root=/dev/mmcblk0p1 rw rootwait rootfstype=ext4 init=/sbin/init" boot zImage null-initrd

This board doesn't have networking. Unless you plug in a USB wireless adapter. So I see no point in preparing a root filesystem in the eMMC. Anyways if you want it (but make sure you know what you're doing) download the ArchLinux tar to the root filesystem on your SD card and:
```
      mkfs.ext4 /dev/mmcblk2p1
      mount /dev/mmcblk2p1 /mnt
      cd /mnt
      tar xvfz /ArchLinuxARM-armv7-latest.tar.gz
      cd
      umount /mnt
    
```

After this you can boot from the embedded eMMC using:

      fastboot -b 0x0 -c "console=ttyAMA2,115200,n8 root=/dev/mmcblk2p1 rw rootwait rootfstype=ext4 init=/sbin/init" boot zImage null-initrd

I guess you could also install packages with pacman by using the SD card as source, as there is no network. I haven't tried.

Linux on the ST-Ericsson Ux500 platforms (Last test 2020-04-17 using kernel v5.7-rc1)