CFE patches

===========================================================================
     CFE Patches for AmigaOne X1000 (c) kas1e, 2026
===========================================================================


  BACKGROUND
  ----------

  As  we  are  all  aware  (or not), we do not have the CFE source code for
  the   X1000   that  includes  the  changes  from  PA-Semi  and  Hyperion.
  However,  we  do  have  the  full CFE source code prior to those specific
  changes.  Combined  with  Ghidra  for  PowerPC  decompilation and various
  disassembly  tools  --  plus  the  knowledge I gained working on the PA6T
  network  driver  regarding  CFE  binaries  and  its  API  --  it  is  now
  possible to create CFE patches even without the original source code.

  All   patches   are   made   for   the   "cfe_2012_june_08.lha"  version.
  On boot you should see:

    "Build Date: Fri Jun  8 16:04:49 CEST 2012 (hfrieden()jumpgate)"

  You can verify from the CFE prompt:

    CFE> d 0x7FDC4028


  WHAT ARE THESE PATCHES
  ----------------------

  These patches  fix bugs  and add  features  to CFE on the AmigaOne X1000.
  Each patch is  a  standalone  .elf file loaded  at the CFE> prompt.  They
  are  fully  resident  --  all  hook  code  and  data  live  in CFE's dead
  relocation  table  (.got  region between text and data segments), so they
  persist across boot commands and do not consume heap or stack memory.

  Each   patch   detects   if   it  has  already  been  loaded  and  prints
  "Already  installed,  skipping."  on  subsequent  runs,  so they are safe
  to re-run without side effects.

  All  patches  output  diagnostic  messages to both serial console and VGA
  simultaneously.  If  something  goes  wrong,  you will see the exact step
  that failed regardless of which console you are watching.


  CURRENT STATE
  -------------

  Currently  all  patches  are  "real-time,"  meaning  you  do  not need to
  re-flash  anything.  They  reside  only  in  the  current  CFE memory and
  will be gone after a reboot or power-off.

  Note  that  the  X1000's  CFE  firmware  is the property of A-EON/Trevor,
  so  I  cannot  distribute  a  ready-to-use patched CFE binary. What I can
  distribute  later  for  the  brave  is  a  tool  to  patch  your own CFE.
  Of   course,  I  will  test  everything  on  my  own  hardware  first;  I
  currently  have  a  hardware  programmer,  so  I can wipe and re-flash at
  any time without risk.

  That  is  for  later,  though.  For  now  the  goal  is  to  verify  that
  everything   works   correctly   without  introducing  new  issues.  Once
  stable enough, I will start experimenting with permanent flash.


  PRACTICAL USE
  -------------

  You  can  load  them  manually  at  the  CFE>  prompt, or set them to run 
  automatically  on  every  boot  via  the  STARTUP  environment  variable.
  The  real  goal  is  to  verify  that  they  fix  existing issues without
  introducing  new  ones.  Once  everything  is  stable, permanent flashing
  becomes an option.

  In  other  words:  any  X1000  user can play with these now without fear.
  However,  if  you  "burn  and  die," I take no responsibility. You should
  know what you are doing.


===========================================================================


  RUNNING THE PATCHES
  -------------------

  Patches are loaded  using the "boot -elf -noints" command. The -noints is 
  required,as without it,the system will simply reboot after a few seconds.

  You can run  patches in  any combination - just one per session, or all at
  once.The hooks are placed at different addresses and do not interfere with
  each other. Load order does not matter.


  Examples from a CF card:

    CFE> boot -elf -noints cf0:sata.elf
    CFE> boot -elf -noints cf0:usb.elf
    CFE> boot -elf -noints cf0:sfs.elf
    CFE> boot -elf -noints cf0:keycon.elf
    CFE> boot -elf -noints cf0:cmds.elf


  Examples from TFTP:

    CFE> ifconfig eth0 -auto; boot -elf -noints 192.168.0.144:sata.elf
    CFE> ifconfig eth0 -auto; boot -elf -noints 192.168.0.144:usb.elf
    CFE> ifconfig eth0 -auto; boot -elf -noints 192.168.0.144:sfs.elf
    CFE> ifconfig eth0 -auto; boot -elf -noints 192.168.0.144:keycon.elf
    CFE> ifconfig eth0 -auto; boot -elf -noints 192.168.0.144:cmds.elf


  Examples from your Amiga FFS boot partition (alongside amigaboot.of):

    If  you  have  no  CF  card,  you  can  put the patches on your AmigaOS
    boot  partition.  These  patches  are  built  in  a  way  that will not
    crash   even  if  run  from  CFE's  AmigaFS,  which  lacks  (or  has  a
    broken/unimplemented) seek(), so this will work too:

    CFE> boot -elf -noints -fs=amigafs ide0.0:sata.elf
    CFE> boot -elf -noints -fs=amigafs ide0.0:usb.elf
    CFE> boot -elf -noints -fs=amigafs ide0.0:sfs.elf
    CFE> boot -elf -noints -fs=amigafs ide0.0:keycon.elf
    CFE> boot -elf -noints -fs=amigafs ide0.0:cmds.elf


  Or just as much as you want at once using semicolons:

    CFE> boot -elf -noints cf0:sata.elf; boot -elf -noints cf0:usb.elf;


  AUTOMATIC ON EVERY BOOT
  -----------------------

  To   make  patches  run  automatically,  change  your  STARTUP  variable.
  For example, if your current STARTUP is:

    set pmu -astate=a4; menu

  Change it to include the patches before "menu":

    CFE> setenv -p STARTUP "set pmu -astate=a4; boot -elf -fs=amigafs
ide0.0:keycon.elf; menu"

  Or add all of them via semicolon. Now it will run on every boot. 


  THE PATCHES
  -----------


----  SATA Patch  (sata.elf)  ---------------------------------------------

  -- Fixes  CFE's  broken  IDE/SATA  driver  to  enable all 4 SATA ports on
     the  SB600  controller.   Stock  CFE  uses  the  SB600 in  legacy  IDE
     emulation  mode  and  only  probes  Channel 0.  In  IDE emulation each
     channel  has  a  "master"  and  a "slave",  but unlike  real IDE,  the
     SB600  maps  individual  SATA  ports  to  these  roles.  Stock CFE can
     only  see  port 0  (Channel 0  master),  and  port 2 (Channel 0 slave)
     only  if  port 0   already  has  a  drive - because  the  probe  code
     hardcodes  master-only  device  select. Channel  1  (ports  1  and  3)
     is  completely  invisible  since  CFE  never reads  its  BAR at  all.

     This  patch  enables  all  4  SATA  ports  independently  -- any  port
     works  alone  without  requiring  another  port  to  have a drive  in,
     just like casual SATA:

         SATA port 0 -> Channel 0 master -> ide0.0
         SATA port 2 -> Channel 0 slave  -> ide0.1
         SATA port 1 -> Channel 1 master -> ide1.0
         SATA port 3 -> Channel 1 slave  -> ide1.1

  -- Adds  UDMA  (DMA)  read  support via SB600 Bus  Master DMA. Disk reads
     are    now   hardware-accelerated   instead   of   byte-by-byte   PIO.
     Kickstart module loading drops from ~8 seconds to ~0.3 seconds.

  -- Reads all PCI BARs dynamically  from  ECAM  config space. No hardcoded
     I/O addresses  --  works  correctly  with  any  PCI card configuration
     (multiple GPUs, add-in cards, etc.).

  -- Fixes  "show  devices"  displaying  "I/O 0000" instead of the real I/O
     base address (stock  bug: reads  wrong half of 64-bit field on PPC64).

  -- ATAPI(CD-ROM) devices detected correctly.DMA is automatically bypassed
     for  ATAPI,  falling  back  to PIO.

  -- All  added  devices  appear  in  the device  tree, so amigaboot.of can
     find and boot from them.

  -- Tested  with single HDD in any port, 2 HDDs across channels, single CD,
     2 CD-ROMs,  mixed  HDD+CD  configurations,  with and without additional
     PCI cards, dual GPU setups, etc.


----  USB Patch  (usb.elf)  -----------------------------------------------

  -- Hooks  CFE's USB  mass-storage  attach / detach to dynamically  manage
     device tree nodes, enabling USB boot through amigaboot.of. On plug-in,
     a "usbdiskN" node is created; on unplug,it is removed. 

  -- Supports up to 4 simultaneous USB devices (usbdisk0 - usbdisk3).

  -- Detects USB sticks already plugged in before the patch was loaded:
     scans  CFE's  heap  for  existing USB device structs and creates nodes
     for them immediately.

  --  USB  CD/DVD  support  (SubClass  2): stock CFE only accepted SubClass
     5-6  (flash  drives)  and  rejected  everything  else.  CD-ROM and DVD
     drives  are  now  recognized and special EHCI hook added: stock  CFE's
     EHCI  driver cannot handle transfers  larger  than  ~20KB, but  tested 
     CDs reads request ~90KB  at once.  The hook transparently splits large
     reads into 16KB chunks, making USB CD-ROM boot possible.

  --  All  USB  device  nodes are registered in the device tree with proper
     methods, so "show devices", "dir", and "boot" commands work.


----  SFS Patch  (sfs.elf)  -----------------------------------------------

  -- Adds a read-only SFS2 filesystem driver to CFE, registered as "sfs2".
     So you can do dir, load and boot from "sfs2" partitions: 

       CFE> dir -fs=sfs2 ide0.0:             (list root directory)
       CFE> dir -fs=sfs2 ide0.0:sys          (list subdirectory)
       CFE> boot -fs=sfs2 ide0.0:file.elf    (boot a file)
       CFE> boot -fs=sfs2 usbdisk0:boot.elf  (boot from USB)

  -- Proper output for "dir": shows file names, sizes, and types (file/dir).

  -- Full  B-tree  traversal  for  fragmented  file support -- files do not
     need to be contiguous on disk.


----  KeyCon Patch  (keycon.elf)  ------------------------------------------

  -- Fixes keyboard and console issues in CFE's line editor by adding:
  
   - Key repeat: holding any key now auto-repeats. 
   - Home key: jumps cursor to beginning of line.
   - End key: jumps cursor to end of line.
   - Delete key: forward-delete with auto-repeat support.

  --  VGA  backspace  cross-line  fix:  pressing  backspace at column 0 now
     wraps  the  cursor  to  the  end  of  the  previous  line.  Stock  CFE
     moved the cursor to pixel x=-8 (off-screen), corrupting display.

  --  VGA  left-arrow  cross-line  fix:  left  arrow at column 0 also wraps
     to the previous line, matching backspace behavior.

  --  VGA  ghost  character  fix:  using  Up/Down  arrow  to browse command
     history  no  longer  leaves  remnants  of  longer previous commands on
     screen. 


----  CMDS Patch  (cmds.elf)  ---------------------------------------------


  "cls":
         clears the screen.Works on both VGA(fills framebuffer with spaces)
         and serial (sends ESC sequences).

  "version":
         displays  CFE version information read from the binary at runtime:
         version number, board name,  architecture, build date, build user,
         and copyright strings.

  "editenv  <variable>":
 
       opens the variable's current value in  an editable  line. Pre-fills
       the prompt with:

       setenv VARIABLE "current value"

         To  make  the  change permanent, move to the beginning and insert
         "-p" after setenv.  Press Enter to execute, or Ctrl-C to cancel.

  "pager <on/off>":
  
        toggles output paging for long command output.

        When enabled, output that  exceeds  the  screen  height pauses with
        a "--more--" prompt.  Controls at the prompt:
          q       -- abort output (stop and return to CFE>)
          Enter   -- advance one line
          any key -- advance one page

        Useful for  "help", "show  devices",  "show  devtree"  and  similar
        commands that produce more output than fits on screen.

  "help":
        extension of original "help": after  CFE's  standard  help  output,
	    appends  a list of the custom commands with brief descriptions.


===========================================================================

  Thanks  to  all developers  and  testers from  amigans.net for their help
  and testing: Balaton, Joerg, Hypex, TearsOfMe, Sailor, Tuvok, K-L and all
  others which I may forget -- keep the spirit alive!

===========================================================================