bootloader v4 console utility

[pppd]

As I am not really fond of GUI stuff especially that has to be run with Mono I'd like to make a console utility that would work with the new bootloader. I can't offer a Python script as this is not my primary programming language but plain C or php script no problem.

My goal is to support only the BP so I am not sure if going through ds30 loader sources is the good choice. Maybe there's some short protocol description or a dump I could start with? I can also run a serial sniffer on vmware and dump the transaction myself, but if it's ready please post it here.

[ian]

Here's a dump. My understanding is this:

Send hello: 0xc1
Get 3 bytes: device ID, BL version MAJ, BL ver minor + revision
Get OK: 0x4b

In a loop:

erase 1 page (8 rows, must be page aligned):
00 00 00 01 01 FE
00 04 00 01 01 FA
00 08 00 01 01 F6
address | command | # of data bytes (includes checksum) | checksum
address = three bytes = table page (always 0) | high byte | low byte
command = erase = 0x01
crc = sum of bytes and checksum equals 0

ds30 Loader responds OK = 0x4b

Write 1 rows of program data 8 times:
00 00 00 02 C1 ... (row 0 )
00 00 80 02 C1 ... (row 1)
address | command | number of data bytes (includes CRC)| ...n data bytes... | checksum
address = 3 bytes = same as erase
command = 1 bytes = program (0x02)
number of data bytes including CRC = 0xc1 = 192 data + 1 CRC  per row
192 data bytes
CRC
 
ds30 Loader responds OK = 0x4b to each row.

[ian]

There is also a ds30 Loader console, but it hasn't been updated with the new features that were added for us.

[pppd]

Thanks Ian, I will play with it in a few minutes, just gotta do some grocery shopping. I believe it's safe to experiment it will not overwrite itself, right :) ?

[ian]

The bootloader won't let you overwrite it, and it will also force the correct jump instruction at location 0x0000 so it doesn't forget where to start after a bad burn.

[ian]

Here's the main bootloader source if it's helpful:
http://code.google.com/p/the-bus-pirate/source/browse/trunk/bootloader-v4/src/ds30loader.s

It also returns these values (if not OK):
      .equ   VERMAJ,      1      /*firmware version major*/
      .equ   VERMIN,      0      /*fimrware version minor*/
      .equ   VERREV,      2      /*firmware version revision*/

      .equ    HELLO,       0xC1      
      .equ    OK,       'K'            /*erase/write ok*/
      .equ    CHECKSUMERR,'N'         /*checksum error*/
      .equ   VERFAIL,   'V'               /*verification failed*/
      .equ      BLPROT,     'P'     /*bootloader overwrite error*/

[pppd]

Thanks, I am almost done with basic BL communication. I believe a testing version will be ready within the next 2 hours.

[mackey]

Yes it has, in the new package on the homepage. But it also requires mono.

There is also a ds30 Loader console, but it hasn't been updated with the new features that were added for us.

The flowchart in firmware manual might be interesting for you.

[ian]

Here's the manual:
http://mrmackey.no-ip.org/elektronik/ds30loader/files/documents/ds30%20loader%20-%20firmware%20manual.pdf

I thought I also saw a description of the protocol somewhere, but I couldn't find it. It might have been in the code.

[Sjaak]

Reading the asm :P hehe

I think the asm is good readable (i took me an hour to understand the main flow) AFAIK the opcodes of an pic resembles much C (or was it some other processor?) the bad/nasty thing is a separate data and programm memory.

[pppd]

I'm still working on it as I can't figure why the data sent by the uploader is not exactly the same as in the HEX file.

I know word size is 24bit/3bytes so every 4th byte from the HEX is ignored 0x00, but still something seems to be wrong or sth I am not aware of.

Edit:

After going through the C# code I think I know where I was wrong.

[pppd]

The console client for the v4 bootloader is ready or at least fully usable. It needs some better error handling but at this point it will do everything it should. That includes HEX parsing with CRC and address checking, etc.

I have tested it only with the latest firmware and BPv3 under MacOSX, FreeBSD 6.3 and Linux.

It is written in pure C and should compile on any POSIX compatible system. I guess it would work under Windows too, but some includes should be replaced.

I have attached it together with sources and pre-built binaries for MacOSX and Linux.

Usage is pretty simple:

Code: [Select]

./ds30client --dev=/path/to/device --hello
./ds30client --dev=/path/to/device --hex=/path/to/hexfile.hex [ --verbose

[ian]

Thank pppd, I'll post this for testers today.

I'm glad you figured it out. From the email notice it looked like you were having some issues, but when I read the post all looks ok.

The bootloader should be really safe, it won't allow itself to be overwritten, and it forces the correct jump instruction, so it should be impervious to most common modes of failure (there's always corner cases and unknown bugs though).

[pppd]

I'm glad you figured it out. From the email notice it looked like you were having some issues, but when I read the post all looks ok.

That's true, I lost a few hours because of a incomplete dump file made with portmon. It turns out it did not catch everything from the transaction and some things got mixed up. Maybe it's because I run it with vmware?

Anyway, I am waiting for any report that it works somewhere else too ;)

[ian]

Thanks for your fantastic work on this. I posted it to the front page, I'll also update the main how-to to include it. Hopefully we get some testers soon.