Subject: [E3-hacking] Knowledge of bootloader

From: Mark Underwood <[email-masked]>
Date: Thu, 19 Jan 2006 19:01:40 +0000 (GMT)

Hi Guys,

Could someone let me know if there are any docs describing how I can use the boot-loader to upload
my own kernel into RAM and ideally also re-flash it?

Thanks,

Mark

___________________________________________________________ 
Yahoo! Messenger - NEW crystal clear PC to PC calling worldwide with voicemail http://uk.messenger.yahoo.com

---

From: David Given <[email-masked]>
Date: Thu, 19 Jan 2006 23:38:01 +0000

On Thursday 19 January 2006 19:01, Mark Underwood wrote:
[...]
> Could someone let me know if there are any docs describing how I can use
> the boot-loader to upload my own kernel into RAM and ideally also re-flash
> it?

Yes, this has been fairly well reverse engineered. I wrote a tool called pblq 
that would do this sort of thing; see http://www.cowlark.com/amstrad.html. 
Someone else on the list has a very similar tool called pbltool which is 
apparently more complete --- sorry, I've forgotten who and where!

Is there a decent set of resources for this kind of software, yet? The one 
page I know about (Ralph's page on inputplus) has lots of information on the 
hardware, but not much about software.

-- 
+- David Given --McQ-+ 
|  [email-masked]    | C:\DOS, C:\DOS\RUN, RUN\DOS\RUN
| ([email-masked]) | 
+- www.cowlark.com --+

---

From: Andy <[email-masked]>
Date: Fri, 20 Jan 2006 08:05:44 +0000

Hi,

>apparently more complete --- sorry, I've forgotten who and where!

It was written by Jonathan McDowell, I can't remember where I found it! I've put a link to my local copy here:

http://www.cambridgewargames.org.uk/members/andy/emailer/

Hope that helps, 

	Andy M

---

From: Jonathan McDowell <[email-masked]>
Date: Fri, 20 Jan 2006 08:34:09 +0000

> http://www.cambridgewargames.org.uk/members/andy/emailer/

http://www.earth.li/~noodles/files/pbltool.c

is where it came from originally. I haven't looked at it in ages, but
I've finally got my E3 out of the drawer again and hooked it up, so will
try and do some cleanups and another release. ISTR someone had a few
patches for it; I'm happy to receive comments/patches if you have them.

I don't think it does anything that pblq doesn't, except for the fact I
couldn't get pblq to work on the E3 and as I started writing test code
to figure out why it just became easier to extend it.

J.

-- 
The cost of feathers has risen.  Now even down is up.

---

From: Mark Underwood <[email-masked]>
Date: Tue, 24 Jan 2006 22:01:31 +0000 (GMT)

> hardware, but not much about software.

Right, I now have my E3 talking to my PC :-) (hence the new boot logs) and have tried to run both
pbltool and pblq.

When I run pbltool it doesn't seem to pickup the right character at the beginning and just prints
lots of "Flushing: 0x**" messages while the E3 boots up and then "Prodding..."

With pblq it seems to get further. If I run "pblq -p /dev/ttyS0 -v ping" I get the following
response:

(voice and e-mail LEDS flashing)
Waiting for device to reset...
Handshaking...
Switching to 115200 baud...
(voice and e-mail LEDS stop flashing)
(10 sec pause)
(voice and e-mail LEDS start flashing again)
pblq: Protocol error: incorrect packet prefix (got C9, should be 02)
(Continues to boot)

If I set the fast baud rate to 9600 then it doesn't print the "Switching to 115200 baud..."
message. If my understanding is correct then this means the program has stopped the E3 from going
into it's normal boot mode and the PBL software should now be in a state to receive commands, but
it seems that any command that is sent to it is ignored (well at least PACKET_SETBAUD and
PACKET_GETVERSION). It couldn't be that my slow P120 Laptop is being outrun by a E3 could it (if
the response got sent from the E3 before the UART was read from would the buffer be flushed when
the read() call was made? I don't think this is the case)?!

Any idea's, please :-)

Mark

> > _______________________________________________
> e3-hacking mailing list
> [email-masked]
> http://www.earth.li/cgi-bin/mailman/listinfo/e3-hacking
> 

___________________________________________________________ 
Yahoo! Photos – NEW, now offering a quality print service from just 8p a photo http://uk.photos.yahoo.com

---

From: mark <[email-masked]>
Date: Tue, 24 Jan 2006 22:16:22 +0000

Hi,

I find that the E3 boots a bit too quick for me to run pbltool and
connect the power.

What I do is run pbltool and then connect the power. This gives an error
message unexpected packet 0x02 or something like that, and then I get
what you are getting 0x?? (which is the text of the booting kernel
image). At the point pbltool goes into prodding/probing mode I power
cycle the phone and it then normally goes into PBL mode. Give the phone
enough time to power down before you reconnect the power though.

I put it down to noise on the serial line, maybe its because I'm not
using the line converter, who knows.

You'll know when its in PBL mode, the phone appears completely dead (the
LEDS are just visible as they flash about every five seconds).

Mark.

---

From: David Given <[email-masked]>
Date: Tue, 24 Jan 2006 22:21:27 +0000

On Tuesday 24 January 2006 22:01, Mark Underwood wrote:
[...]
> If I set the fast baud rate to 9600 then it doesn't print the "Switching to
> 115200 baud..." message. If my understanding is correct then this means the
> program has stopped the E3 from going into it's normal boot mode and the
> PBL software should now be in a state to receive commands, but it seems
> that any command that is sent to it is ignored (well at least
> PACKET_SETBAUD and PACKET_GETVERSION). It couldn't be that my slow P120
> Laptop is being outrun by a E3 could it (if the response got sent from the
> E3 before the UART was read from would the buffer be flushed when the
> read() call was made? I don't think this is the case)?!

Doubtful --- a P120 should have no trouble whatsoever from coping with 115200 
baud.

I'm afraid I only tested pblq on an E2 (but I am planning on getting an E3 
since they're so cheap). I had gathered that the E3 had a different default 
slow baud rate from the fast one. You might try tinkering with the slow rate 
settings --- but I would have expected the handshaking to fail if that were 
the case.

BTW, if you use a slow rate of 115200, start the terminal and then boot the 
E3, you should get the Linux startup messages.

-- 
+- David Given --McQ-+ "It's the dawn of the day before the time of the
|  [email-masked]    | land that the lost dinosaurs forgot to remember!"
| ([email-masked]) | --- Ookla the Mok
+- www.cowlark.com --+