Subject: [E3-hacking] ...and we're booting!

From: David Given <[email-masked]>
Date: Tue, 22 Mar 2005 20:27:13 +0000

Hurrah! My E2 emailer is now printing 'Hello, world!' at roughly 20
second intervals, as the watchdog timer reboots it!

I attach the gas source that produces the bootable image. It turns out
I'd misread the disassembly of the boot process, again... here, for
reference, is the updated and corrected document of the boot image's
magic:

+0000: magic1, 0x3B513B51
+0008: length of chunk
+0014: magic2, 0x00544F42 ("BOT")
+0064: address of boot vector after relocation
+0068: magic3, 0xB513B513
+006c: relocation destination
+0070: image type:
        0 == plain
        2 == compressed (won't go into the details of this now)

The boot vector is:

+0000: unknown, unused
+0004: start address after relocation

The maximum length of the boot chunk is 0x30000 bytes, 192kB. The
standard firmware gets relocated to 0x40000, so that's the address I've
used.

To produce a bootable image from the attached source, do this:

    arm-linux-as -o test-e2.o test-e2.s 
    arm-linux-ld --section-start .text=0x40000 -o test-e2.img test-e2.o
    arm-linux-objcopy -O binary test-e2.img test-e2.pbl
    pblq bless test-e2.pbl

Yeah, it's a bit convoluted --- blame GNU. The last stage uses pblq to
fix the checksum in the boot image, without which PBL will refuse to
touch it.

You can then upload it with:

    pblq writeflash test-e2.pbl 0

And then do:

    pblq term

, power cycle it, and watch the fun!

You can get pblq from my Amstrad Hacking page here:

http://www.cowlark.com/amstrad.html

Be gentle to my web server --- it's not very big.

-- 
+- David Given --McQ-+ "Opportunity is missed by most people because it's
|  [email-masked]    | dressed in overalls and looks like work." ---
| ([email-masked]) | Thomas Edison
+- www.cowlark.com --+

---

From: Jonathan McDowell <[email-masked]>
Date: Tue, 22 Mar 2005 21:10:27 +0000

> http://www.cowlark.com/amstrad.html

FWIW, I get the following results with an E3:

[noodles@pot ~/firm/E3/pblq-0.2]$ ./pblq -v ping
Waiting for device reset...
Handshaking...
Switching to 115200 baud...
pblq: Protocol error: incorrect packet prefix (got 64, should be 02)

[noodles@pot ~/firm/E3/pblq-0.2]$ ./pblq -v readflash test.flash 0 1024
Waiting for device reset...
Handshaking...
pblq: Device failed its handshake --- sent F8 when it should have sent 06!

So it does look like it's sufficiently different to not just work.

J.

-- 
 [       101 things you can't have too much of : 4 - Chocolate.       ]
 [ http://www.blackcatnetworks.co.uk/ - IPv6 enabled ADSL/dialup/colo ]

---

From: David Given <[email-masked]>
Date: Tue, 22 Mar 2005 21:44:02 +0000

On Tue, 2005-03-22 at 21:10 +0000, Jonathan McDowell wrote:
[...]
> FWIW, I get the following results with an E3:

Er, I forgot to mention that you need different options for the E3
because, IIRC, the E3 starts up at 115200 baud rather than the 9600 of
the E2.

Try:

	pblq -s 115200 ping

...and see what that does.

(-s specifies the baud rate to do the handshaking at, aka slow mode; -f
specifies the baud rate to switch to after handshaking, aka fast mode.)

-- 
+- David Given --McQ-+ 
|  [email-masked]    | ACRONYM: A Contrived Reduction of Nomenclature
| ([email-masked]) | Yielding Mnemonics
+- www.cowlark.com --+

---

From: Jonathan McDowell <[email-masked]>
Date: Tue, 22 Mar 2005 21:51:43 +0000

> ...and see what that does.

Should have said; I tried that, but it gets even less far:

[noodles@pot ~/firm/E3/pblq-0.2]$ ./pblq -v -s 115200 ping
Waiting for device reset...

And then nothing. It slows the E3 boot down, so it appears to do
something (I guess it could just be reading the chars), but it
eventually finishes booting fully.

J.

-- 
                                            jid: [email-masked]
Where the system is concerned, you're not
                                            allowed to ask "Why?".

---

From: David Given <[email-masked]>
Date: Tue, 22 Mar 2005 22:01:19 +0000

On Tue, 2005-03-22 at 21:51 +0000, Jonathan McDowell wrote:
[...]
> And then nothing.

Hmm.

Well, if it's managing to do the handshake at 9600 baud, try -f 9600
instead. You won't want to up/download much, but at least you might get
it working...

-- 
+- David Given --McQ-+ 
|  [email-masked]    | "The only thing to prevent what's past is to put a
| ([email-masked]) | stop to it before it happens." --- Sir Boyle Roche
+- www.cowlark.com --+

---

From: Jonathan McDowell <[email-masked]>
Date: Tue, 22 Mar 2005 22:22:28 +0000

> instead. You won't want to up/download much, but at least you might get

No joy; it doesn't seem to want to play with the PBL 3 packet types;
switching baud rate doesn't work and if I tell it not to do that then
fetching the version doesn't work.

J.

-- 
/-\                             |        noodles is back group
|@/  Debian GNU/Linux Developer |
\-                              |