- e3-hacking - earth.li

Success!
by David Given 17 Mar '05

17 Mar '05

My line level converter works! Woohoo! (It turns out that it helps if you look at the *right* diagram on the datasheet, make sure that you correctly work out which wire of the cable is connected to which pin, and generally don't do a bunch of really embarassing stuff. On the plus side, it turns out that MAX232 chips are much more robust than I thought.) What's more, pblq has now turned into a reasonably generalised mechanism for communicating with PBL, complete with the ability to suck down data using one-byte checksum packets. Currently it's running at 9600 baud, which means it maxes out at 16 bytes per second --- that's a bit over an hour to download PBL, and six *days* for the main flash --- so I've only downloaded fragments. Here's a log; do the checksums match your boards? $ ./pblq Attempting handshake... Connected. PBL V3.1 build 1277 Maximum packet length is 8208 Checksum of 00000000+10000: 00A828D0 Checksum of 80010000+550000: 349F8B09 Downloadng: ################ $ objdump -D -b binary -m arm7tdmi output.img output.img: file format binary Disassembly of section .data: 0000000000000000 <.data>: 0: ea000054 b 0x158 4: ea000055 b 0x160 8: ea00005e b 0x188 c: ea000054 b 0x164 10: ea000054 b 0x168 14: 00000000 andeq r0, r0, r0 18: ea001eb2 b 0x7ae8 1c: ea001e86 b 0x7a3c 20: 00000000 andeq r0, r0, r0 24: 00007740 andeq r7, r0, r0, asr #14 ...etc... I'll get it doing a bit more, polish the interface a bit --- in order to change options, you have to recompile it, which isn't good --- and post it somewhere in a couple of days, if people think it would be useful... -- +- David Given --McQ-+ | dg(a)cowlark.com | "Home is where, when you have to go there, they | (dg(a)tao-group.com) | have to take you in." --- Cordelia Naismith +- www.cowlark.com --+

2 6

Initial version of pblq
by David Given 17 Mar '05

17 Mar '05

Here it is --- it's only 6kB, so I've attached it, and I'm only doing that because this is a low subscription list. Features: * Lots of complex handshaking code; on startup, if PBL is running, it'll connect to that, otherwise it'll wait for you to power cycle the device. * After handshaking, it changes the baud rate for faster transfers. * Command-line interface, easily scriptable. * 100 Bps download speed at 115200 baud! It currently only supports three commands; ping, checksum and read. write (0500) is next on my list; do we know how to change the NAND flash yet? Is that 0E00? BTW, there's a typo in the PBL spec --- the documentation for 0900 is specifying that the baud rate should be passed in big-endian; it's actually little-endian. How to build: ./configure make How to use on the E2: ./pblq read outputfile.img 0x80000000 0x10000 ...and on the E3 (untested): ./pblq -s 115200 read outputfile.img 0x80000000 0x10000 Let me know if it works, is useful, or is broken. (Tip: -v is helpful.) ... Right. I now have a copy of the PBL flash image. Looking at it with a hex editor, I notice immediately that my serial number seems to be in it at 0xFF20. Can anyone confirm this? This would imply that each version of PBL is unique. My MD5 is: 08f841b5a4c14052bcd94b25e1363120 pbl-flash.img (That's the version read out of flash, as above, not the version in RAM.) I also notice that trying to read the contents of the NAND flash at 0x80010000, using the byte-at-a-time checksum technique, makes PBL very unhappy. At one point I ended up with a file full of Qs; mostly PBL acts oddly which makes pblq die with protocol errors. Any suggestions? -- +- David Given --McQ-+ | dg(a)cowlark.com | "Two of my imaginary friends reproduced once ... | (dg(a)tao-group.com) | with negative results." --- Ben, from a.s.r +- www.cowlark.com --+

2 2

E2 PBL response
by Peter Washington 15 Mar '05

15 Mar '05

Hello folks, My name is Peter Washington, (alias Pugwash), and I've been helping Ralph Corderoy for some time now providing electronics expertise to back up his prowess on the software side. I started life as an electronic engineer speciallising in Micro's and then moved over the fence to software. I'm a bit of a newcomer, (complete virgin actually), to newsgroups and mailing list, so please bear with me. I've been following everything on this list avidly, and I'd like to congratulate Matt on the stirling work he's done in getting the E2 to talk to us and add my own congratulations to Ralph on his superb analysis of the E2 PBL. I actually own 2 E2's and an E3, one E2 is my main house phone and is registered with Amstrad, the other is in bits in my back bedroom on a "Breadboard", (a lump of wood big enough to hold the parts of the case that I need and the motherboard on some plastic pillars), hooked up to a PC running Linux. I should be receiving a batch of 5 MAX3232's today and I will be making up a voltage level shifter as soon as possible on some veroboard. I'm going to need to provide a second jack plug so that I can plug in to the E2 OR the E3 as I wish. If Ralph and Matt would like to supply me with a combined, modified exp.exe shortly, I will try the same tests on the E2 then the E3. I completely agree with Matt on 2 important matters :- 1. Trust the Maxim datasheets over any other source. (I think the Hardware Recyling circuit has used 0.1mF to 0.1 micro Farads, lack of the Greek mu) 2. Putting Vcc into the Gnd Pin of any chip will definitely damage it IF any other pin is connected to a voltage around about Vcc. The "Magic Blue Smoke" gets boiled off and it stops working ;-( I think that with the particular mix of people we now seem to have looking at this problem we should have it licked pretty quickly. On another subject entirely, (which should probably be handled further in some other forum), Ralph and I have been talking about home made Digital Storage Oscilloscopes recently, if either Matt or David would like to join forces with us maybe we could have a bash at actually making something. Cheers Peter

5 7

RE: [E3-hacking] E2 PBL response
by Peter Washington 15 Mar '05

15 Mar '05

hi Folks, Right, I've set my autowrap to 72. I hope it works. Matt, Ralph and I were talking about a Configurable Scope / DVM / Logic Analyser. Check out http://www.fpga4fun.com/, cool projects. The Wiki sounds like it might be the best approach to keeping Off Topic stuff to the right people, if I have the faintest understanding of what it is, Ralph perhaps we could have a chat about this. I would be more than happy to "scribble my thoughts" there, particularly since the project would involve lots of code running on a host computer to drive the beast. I have now received 5 MAX3232's so I will be building a Level Translator to put in my E2 serial lead, the E3 is already communicatiing nicely with the current lead, we just haven't been able to get it to talk to us properly, maybe I'll be able to as soon Ralph or Matt supply the latest version of exp.exe !!! Cheers Peter

1 0

PBL & running arbitrary code
by David Given 14 Mar '05

14 Mar '05

I recently found the Emailer Recycling page, and read the documentation there; it all looks highly intriguing, and I'm thinking of getting an E2 or E3, mainly as a toy. Amstrad have always been good at making hackable hardware --- I own a NC200, possibly the nicest Z80 laptop ever made, and have successfully run my own code on it. Still haven't managed to finish that CP/M port, though... Does anyone know if it's possible to use PBL to download and run arbitrary code on the device? Directive 05 would seem to allow data to be written to memory, but there doesn't seem to be any way of getting it to be executed. Does anyone know of such a thing? Would 05 allow you to overwrite PBL's stack (the dodgy way of doing this?) What about well-known PBL variables? And what does 07 do? (I suppose the easiest way of running your own code is to write it into the flash and then do a normal boot, but I'd rather not brick it immediately. Heaven forbid, the standard software might turn out to be useful.) -- David Given <dg(a)cowlark.com>

3 30

Line level conversion
by David Given 14 Mar '05

14 Mar '05

I'm now the proud owner of a MAX232CPE, and hopefully I should be able to breadboard up a line level converter tonight. Then we'll discover whether I've fried my UART by plugging it directly into an RS232 port. I can't seem to find, however, any consistency in the circuits I'm supposed to use. The datasheet's standard circuit uses 1µF capacitors; Maplin's circuit in the catalogue uses 22µF; the circuit here: http://www.seattlerobotics.org/encoder/aug97/cable.html ...uses 0.1µF. Hardware's not my strong point. Can anyone clarify? How critical are these sizes? -- +- David Given --McQ-+ | dg(a)cowlark.com | Quidquid latine dictum sit, altum viditur. | (dg(a)tao-group.com) | +- www.cowlark.com --+

3 3

E3 Software Unready When E3 Launched.
by Ralph Corderoy 22 Feb '05

22 Feb '05

Hi, People are probably getting fed up with me posting on this list but I thought some of Sir Alan Sugar comments in Amstrad's interim trading statement were worthy of another post. http://inputplus.co.uk/ralph/emailer/extnews.html Amstrad or Emailers in the news Links to selected items of news regarding Amstrad or Emailers that may be of interest. Oldest first. [snip] * 2005-02-17 Amstrad [9]press release announces an interim statement for the six months ending 2004-12-31. Initial E3 sales have been low, but it was launched lacking full functionality because the software wasn't ready. Once new software is available various initiatives are planned to stimulate sales. In the short term, the software will allow pictures to be retrieved and displayed from digital cameras, and sent by email. Also planned, is the ability to run the unit on an ADSL line. A PDF of the full preliminary announcement is available from the press release. 9. http://www.amstrad.com/news_latest.html Cheers, Ralph.

1 0

Re: E2 PBL bios dump.
by en4rab 21 Feb '05

21 Feb '05

I have sent otaku a copy of the bios dump i made from my E2 emailer. I also had an idea for recovery of the bios of the E3, has anyone yet worked out if the Jtag port of the CPU in the E3 is taken to a usable header on the e3's board. According to the datasheet for the e3's cpu the jtag pins are at locations U15, U16, U17, T14 and R13 (the jtag signals are called (nTrst, TDO, TDI, TMS and TCK off hand i cant rember which pin is which) If these pins are routed to a suitable set of test points it should be relatively easy (if time consuming) to dump the bios of the E3 using an inexpensive (�10ish) wiggler type jtag interface. This site has details of how to build a cheap wiggler compatible buffered jtag lead, http://jtag-arm9.sourceforge.net/ , however there are several places selling these interface for around a tenner (although these dont include the transistor for control of the nTrst line) since jtag leads have just become a popular way to read data off some other UK equipment. Dumping of the bootloader could then be done using either macraigors , http://www.macraigor.com/ , flashprog (the demo will read but not write the flash) or the long winded method using ocd commander and a macro to read each byte then converting the log of this macro to a binary file (which was how I dumped the E2 bios as i hadnt sussed flashprog :) If the E3 behaves like the E2 did it will have its WDT enabled and locked so about 4 or 5 seconds after you halt the CPU the WDT will time out and reset the box, this resulted in the memory controller being in its boot up state with the bios (on chip select 0) being mapped throught the whole of memory, reading past the end of the bios chip just looped back to the beginning of the chip. Because the WDT was enabled I was unable to get a dump of the ram from a running box so i couldnt recover the uncompressed firmware image from ram. I am interested in getting an E3 to play with but unfortunately time and money are not on my side at the moment, but if i do i will look at dumping the E3 bios too (and ram if WDT is not enabled) Just a word of warning, dont use a jtag interface that doesnt have a 74hc244 or ac244 chip as i dont think arm cores are 5v tolerant so the simple resistor based jtag leads may well kill the CPU. I think the jtag interface from tailor-madecircuits, http://www.tailor-madecircuits.com/jtag_interface.htm , should work for dumping the bios but it doesnt have the nTrst circuitry, but I think it will work, but be warned TMC have had a run on these so there is a bit of a delay on them. Obviously all of this will only be of use if the jtag signals have been routed to somewhere usefull on the E3's board. en4rab ===== -- | .-. en4rab(a)yahoo.com | / \ .-. | / \ / \ .-. .-. _ _ +--/-------\-----/-----\-----/---\---/---\---/-\-/-\/\/--- | / \ / \ / '-' '-' |/ '-' '-' -END OF TRANSMISSION- __________________________________ Do you Yahoo!? Take Yahoo! Mail with you! Get it on your mobile phone. http://mobile.yahoo.com/maildemo

2 2

Re: E2 Watchdog timer
by en4rab 21 Feb '05

21 Feb '05

Yes possibly a macro could be writen for macraigors ocd debug to periodically write 0xa5a5 to the watchdog counter reset register inbetween commands to read other bits of memory but it would be a tedious way to do things.

2 1

E2 PBL Dump, anyone ?
by Otaku 10 Feb '05

10 Feb '05

Anyone ( *ahem* Ralph ) happen to have a dump of the E2 Atmel flash ? I'm hoping there are similarities in the way the main image is treated , and this could help me with the E3 I'm working on.. Cheers

2 1