As I am not really fond of GUI stuff especially that has to be run with Mono I'd like to make a console utility that would work with the new bootloader. I can't offer a Python script as this is not my primary programming language but plain C or php script no problem.
My goal is to support only the BP so I am not sure if going through ds30 loader sources is the good choice. Maybe there's some short protocol description or a dump I could start with? I can also run a serial sniffer on vmware and dump the transaction myself, but if it's ready please post it here.
Here's a dump. My understanding is this:
Send hello: 0xc1
Get 3 bytes: device ID, BL version MAJ, BL ver minor + revision
Get OK: 0x4b
In a loop:
erase 1 page (8 rows, must be page aligned):
00 00 00 01 01 FE
00 04 00 01 01 FA
00 08 00 01 01 F6
address | command | # of data bytes (includes checksum) | checksum
address = three bytes = table page (always 0) | high byte | low byte
command = erase = 0x01
crc = sum of bytes and checksum equals 0
ds30 Loader responds OK = 0x4b
Write 1 rows of program data 8 times:
00 00 00 02 C1 ... (row 0 )
00 00 80 02 C1 ... (row 1)
address | command | number of data bytes (includes CRC)| ...n data bytes... | checksum
address = 3 bytes = same as erase
command = 1 bytes = program (0x02)
number of data bytes including CRC = 0xc1 = 192 data + 1 CRC per row
192 data bytes
CRC
ds30 Loader responds OK = 0x4b to each row.
There is also a ds30 Loader console, but it hasn't been updated with the new features that were added for us.
Thanks Ian, I will play with it in a few minutes, just gotta do some grocery shopping. I believe it's safe to experiment it will not overwrite itself, right :) ?
The bootloader won't let you overwrite it, and it will also force the correct jump instruction at location 0x0000 so it doesn't forget where to start after a bad burn.
Here's the main bootloader source if it's helpful:
http://code.google.com/p/the-bus-pirate ... 30loader.s (http://code.google.com/p/the-bus-pirate/source/browse/trunk/bootloader-v4/src/ds30loader.s)
It also returns these values (if not OK):
.equ VERMAJ, 1 /*firmware version major*/
.equ VERMIN, 0 /*fimrware version minor*/
.equ VERREV, 2 /*firmware version revision*/
.equ HELLO, 0xC1
.equ OK, 'K' /*erase/write ok*/
.equ CHECKSUMERR,'N' /*checksum error*/
.equ VERFAIL, 'V' /*verification failed*/
.equ BLPROT, 'P' /*bootloader overwrite error*/
Thanks, I am almost done with basic BL communication. I believe a testing version will be ready within the next 2 hours.
Yes it has, in the new package on the homepage. But it also requires mono.
[quote author="ian"]
There is also a ds30 Loader console, but it hasn't been updated with the new features that were added for us.
[/quote]
The flowchart in firmware manual might be interesting for you.
Here's the manual:
http://mrmackey.no-ip.org/elektronik/ds ... manual.pdf (http://mrmackey.no-ip.org/elektronik/ds30loader/files/documents/ds30%20loader%20-%20firmware%20manual.pdf)
I thought I also saw a description of the protocol somewhere, but I couldn't find it. It might have been in the code.
Reading the asm :P hehe
I think the asm is good readable (i took me an hour to understand the main flow) AFAIK the opcodes of an pic resembles much C (or was it some other processor?) the bad/nasty thing is a separate data and programm memory.
I'm still working on it as I can't figure why the data sent by the uploader is not exactly the same as in the HEX file.
I know word size is 24bit/3bytes so every 4th byte from the HEX is ignored 0x00, but still something seems to be wrong or sth I am not aware of.
Edit:
After going through the C# code I think I know where I was wrong.
The console client for the v4 bootloader is ready or at least fully usable. It needs some better error handling but at this point it will do everything it should. That includes HEX parsing with CRC and address checking, etc.
I have tested it only with the latest firmware and BPv3 under MacOSX, FreeBSD 6.3 and Linux.
It is written in pure C and should compile on any POSIX compatible system. I guess it would work under Windows too, but some includes should be replaced.
I have attached it together with sources and pre-built binaries for MacOSX and Linux.
Usage is pretty simple:
./ds30client --dev=/path/to/device --hello
./ds30client --dev=/path/to/device --hex=/path/to/hexfile.hex [ --verbose
Thank pppd, I'll post this for testers today.
I'm glad you figured it out. From the email notice it looked like you were having some issues, but when I read the post all looks ok.
The bootloader should be really safe, it won't allow itself to be overwritten, and it forces the correct jump instruction, so it should be impervious to most common modes of failure (there's always corner cases and unknown bugs though).
[quote author="ian"]I'm glad you figured it out. From the email notice it looked like you were having some issues, but when I read the post all looks ok.[/quote] That's true, I lost a few hours because of a incomplete dump file made with portmon. It turns out it did not catch everything from the transaction and some things got mixed up. Maybe it's because I run it with vmware?
Anyway, I am waiting for any report that it works somewhere else too ;)
Thanks for your fantastic work on this. I posted it to the front page, I'll also update the main how-to to include it. Hopefully we get some testers soon.
I have just added Windows support to the console utility, so if there is someone without .NET framework willing to update now they can.
I have not fully tested it, just tried --hello mode to see if it communicates properly so I would like to ask sb with native Windows installation to give it a go. It is just a compatibility port so it does not use any overlapped IO instead I emulate select by probing the COM port for data every 250ms. This should work well enough I guess.
Usage is exactly the same as in UNIXes, just put --dev=COM1 as the device path or whatever the COM{X} is correct for your system.
I compiled this on my PowerPC MAC, and it runs, but I get an error, I previously upgraded the bootloader using the old python loader script.
Here's what happens on my BPv3:
Parsing HEX file [BPv3-Firmware-v4.1.hex]
Found 21503 words (64509 bytes)
Fixing bootloader/userprogram jumps
Opening serial device /dev/cu.usbserial-A7004E19...OK
Configuring serial port settings...OK
Sending Hello to the Bootloader...OK
Device ID: PIC24FJ64GA002 [d4]
Bootloader version: 1,02
00 00 00 01 01 FE
Erasing page 0, 0000...OK
Writing page 0 row 0, 0000...OK
00 00 00 02 C1 04 00 A8 00 00 00 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 0F
Writing page 0 row 1, 0080...OK
00 00 00 02 C1 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 00 26 79 7D
Writing page 0 row 2, 0100...ERROR
Error updating firmware :(
I'm afraid it is not compatible with Big Endian machines at the moment as I use some direct 32bit address casting to byte arrays with C unions. The source code is included so feel free to give it a go or wait until I post a BE/LE compatible code.
All,
Have just worked with pppd to test a MAC OSX PowerPC compatible version - and it works! I expect he'll update you all soon with a new archive.
Thanks,
Will.
It is now compatible with BigEndian machines so it works with PowerPC Macs too :) (@will_j, thanks for testing)
Ian, there are a few zips now.. shall I remove the old ones and leave the latest only, or we could think of a better way of handling this like including it in the repository?
Thank you, I much prefer command line and wasn't looking forward to installing Mono. osx_ppc worked great for upgrading my v3. Haven't tried with my v2go yet, currently using it for AVR.
Bus Pirate v3
Firmware v4.1 Bootloader v4.1
DEVID:0x0447 REVID:0x3003 (A3)
http://dangerousprototypes.com
@pppd - Thanks! Great work. I'll put it in SVN. Would you like access to work on it?
If that saves you some time why not. Just tell me where should I put it not to make mess in your repository :) Did you have a chance to try the Windows port?
i created a folder and source folder under /bootloader-v4/. I called it pirate loader, i hope that's ok:
http://code.google.com/p/the-bus-pirate ... ate-loader (http://code.google.com/p/the-bus-pirate/source/browse/#svn/trunk/bootloader-v4/pirate-loader)
I haven't had a chance to try it yet, but I plan to this afternoon. I just got a load of prototype pcbs in the mail so I've been pretty distracted today :)
Please PM or email me a Google Code registered email address so I can add you to the project.
Hi all,
Tried the bootloader update program utility on a mac, but no luck yet.
I use the version that is in the zipfile as directed by pppds post in this forum,
but the mac version bails out with:
Opening serial device /dev/tty.usbserial-A600aSsn...OK
Configuring serial port settings...OK
Sending Hello to the Bootloader...ERROR
No reply from the bootloader, or invalid reply received: 0
Please make sure that PGND and PGC are connected, replug the devide and try again
Serial device is the right device, pins are connected, mode led is on.
We're talking about a BP v3a, (sep 2009) that otherwise runs fine:
Bus Pirate v3
Firmware 3.5
DEVID:0x0447 REVID:0x3043 (B5)
http://dangerousprototypes.com (http://dangerousprototypes.com)
Any idea what's wrong ?
Thanks
Rudi
Hello Rudi,
Have you upgraded your Bootloader to v4?
Piotr
Hi rudivd,
It sounds like you don't have the v4 bootloader installed yet, there's a like to the upgrade instructions in this FAQ:
http://whereisian.com/forum/index.php?t ... 88#msg1988 (http://whereisian.com/forum/index.php?topic=256.msg1988#msg1988)
Thanks,
Looks like I missed the step programming the bootloader. Did that, got to the point where I have my bp telling me:
DS30 Loader installer v0.2 (ALPHA)
(C)hris 2010
Released under Creative Commons null license.
This will install bootloader v4.1.
Type 'Yes' to program the new bootloader.
Disconnect power if unsure (no harm done).
Fine, but when I type the magic 'yes' word (yes, without quotes),
it does not accept my chars as correct, and keeps repeating the
message on every keystroke. (I use Zterm on mac, 115200/n/8/1 the terminal that just works on my bp, never had problems with sending chars).
So: something might be wrong...
Maybe a wrong version of the image ?? I used BPv3-v2blupdaterVa3-v4.1.hex from http://code.google.com/p/the-bus-pirate ... te-va3.zip (http://code.google.com/p/the-bus-pirate/downloads/detail?name=v2tov41-bootloader-update-va3.zip) ...
any idea ?? I'll go and check another terminal program...
Thanks again
Rudi
Use "screen /dev/tty.usbserial-A600aSsn 115200" and remember about capital Y in Yes
typing yes is case insensitive so it should not be a problem. You sure nothing is laying on a modifier button (ctrl/alt/mac)? or a sudden change in keyboard map (don't know how this works on mac, but in windows there is a keystroke with ctrl+alt shift which cycles between various keymaps, and i hit it occassional) on german keyboard the y and z are swapped (don't know your location)
You see something echoed back or just the repeating message?
The display printout doesn't look right for the new a3 bootloader installer. I might have messed up the new package. How does this one work for you:
http://code.google.com/p/the-bus-pirate ... update.zip (http://code.google.com/p/the-bus-pirate/downloads/detail?name=v2tov41-bootloader-update.zip)
OK, seems that now everything works....
I tried to connect using screen, that messed up the ftdi driver I think as
it generated a kernel panic, which resulted in a reboot of the mac, no big
deal.... After that, I reconnected, using screen, saw the msg, typed yes
(lowercase), worked...
Then I used the ds30 command line util and upgraded to firmware 4.1..
All is fine now (and a happy user again)...
THANKS for the support !
Rudi
HiZ>i
Bus Pirate v3
Firmware v4.1 Bootloader v4.1
DEVID:0x0447 REVID:0x3043 (B5)
http://dangerousprototypes.com (http://dangerousprototypes.com)
HiZ>
Glad you got it working.
Here's how the output of the latest ds30 loader installer should look (in the va3 upgrade package):
Universal DS30 Loader installer v0.3 (C)hris 2010
Released under Creative Commons null license.
Found bootloader v unknown (probably v2)
Will install bootloader v4.1
Type 'Yes' to program the new bootloader.
Disconnect power if unsure (no harm done).
yes
Erasing 0xA400... done
Erasing 0xA800... done
Writing row 0 1 2 3 4 5 6 7 done
Erasing 0x0000... done
Writing row 0... done
Success!
Upload new firmware with the ds30 Loader app to complete the upgrade.
Regarding forum topic:
http://whereisian.com/forum/index.php?topic=296.0 (http://whereisian.com/forum/index.php?topic=296.0)
I had a case where pirate_loader_lnx failed on an 850MHz system. In the thread I give a patch to pirate-loader.c that fixes the problem on this old computer. It is:
$ svn diff
Index: bootloader-v4/pirate-loader/source/pirate-loader.c
===================================================================
--- bootloader-v4/pirate-loader/source/pirate-loader.c (revision 313)
+++ bootloader-v4/pirate-loader/source/pirate-loader.c (working copy)
@@ -459,6 +459,7 @@
puts("OK");
+ sleep(0);
if( g_verbose ) {
dumpHex(command, HEADER_LENGTH + command[LENGTH_OFFSET]);
}