Connecting
Various options are available. Some sort of cable with 3.3 volt RS232-TTL connectors at one end is needed. Depending on the cable at least RX/TX and GND are connected to the mainboard as described here.
Login
Start your favorite telnet emulator capable of using your cable. Open the port and press a key, space for instance. Meanwhile fire up the MG. You should get the following output:
Jasper Bootloader v1.0.0 (Oct 25 2007 14:54:35)
Supports BootMenu Flash Network
This version of fips use micom with power control, version[3]
|
Followed by repeated characters of the key you are holding. Release the key and press enter. Enter the password as follows:
This version of fips use micom with power control, version[3]
MediaGate.
|
The password is case sensitive and it ends with a single dot, pressing enter will give some more information and the boot prompt:
0031.0033 mfr 0001 id 22c4 Bottom bootsector
Flash 0 at address 0x00000000
ID : AMD/Fujitsu Standard
Size : 4096 KB
Regions : 4
0 : 0x00000000 - 0x00008000 * 1
1 : 0x00008000 - 0x00004000 * 2
2 : 0x00010000 - 0x00010000 * 1
3 : 0x00020000 - 0x00020000 * 31
Found DM9000 chipset at I/O address 3f0000
DM9000 open
Welcome to JASPER boot loader
boot>
|
This MG does not have dhcp enabled, otherwise DM9000 (the network interface) will mention requesting an ip-address.
That's it, you are in the bootloader.
Commands
help : show list of commands
help [command] : help on command
boot [target] : boot kernel
flash : boot from flash (0x00006000)
kernel : boot kernel on RAM (0x01008000)
image : boot image on RAM (0x01400000)
[addr] : jump to specified address
config <name> [options] : configure boot loader
load : load configuration
serial <baudrate> : UART configuration
valid baud rate : 9600, 19200, 38400 (default), 57600, 115200
net : network configuration
file : download filename setting
download [media] <target> : download image via various media
[media] : serial / net (network)
<target> : boot / romfs / kernel / [addr]
dump [option] <addr> <len> : dump memory area
[option] : -d (4 bytes), -w (2 bytes), -b (1 byte)
flash [command] <options> : flash commands
probe <addr> : probe flash
list : show flash chip information
erase [addr] <len> : erase one or more sectors of flash memory
eraseall : erase all flash memory
writeb [addr] [data] : write one byte of data into specified address
writew [addr] [data] : write one word of data into specified even address
write [to] [from] [len] : write block of data into specified address
boot : write boot loader image on RAM into FLASH
romfs : write ROMFS image on RAM into FLASH
mem [op] <args> : read from or write to memory
rb [addr] : read one byte of data
rw [addr] : read two bytes of data
rl [addr] : read four bytes of data
wb [addr] [data] : write one byte of data
ww [addr] [data] : write two bytes of data
wl [addr] [data] : write four bytes of data
memcmp [addr1] [addr2] <len> : compare memory region
memcpy [to] [from] <len> : copy memory region
net [command] <args> : network commands
config : show current network configuration
up : enable networking
down : disable networking
arp : show entire ARP table
arp [IP addr] : get the hardware address of specfied host
ping [IP addr] : send ICMP echo message to specified host
dhcp : request DHCP
tftp [loader/romfs/kernel] : download via TFTP from server
tftp [IP addr] [filename] : download specified file from specified server
eeprom [command] : manipulate EEPROM connected to Ethernet chipset
dump : dump EEPROM contents
ww [reg] [data] : update EEPROM contents
dump : dump ethernet RX buffer contents
|
On the serial console we have commands to download kernel and cramfs filesystem, and even flash them.
pbarette: The bootloader saves the config settings, but I can't get it to save a new default serial baudrate. I usually connect at 38400 then issue "config serial 115200" and disconnect, change the baud on my comm port and reconnect. Since the serial interface is a 3-wire deal, the MG35 doesn't notice the dis/re-connect at all.
gadgetmind:
What "boot image" expects is a full rom image at 0x1400000
So -
boot> memcpy 0x1400000 0 0x400000 (4MBytes of rom to 0x1400000)
boot> boot image
Results in a successful inflate of the kernel and the box booting. However, it's currently hard to tell if it's using the new kernel and/or cramFS.
I guess I'd also need -
mem wl 0x1440000 0x014e2809
to tell it to use the new cramFS
Also note that there's an unlisted "config save" command, but that doesn't seem to change the default baudrate either.
"config file" - This lets you set the file names of the loader, linux, romfs and image. The most useful is probably setting the romfs to somewhere in /tftpboot so you can use tftp to download new romfs without needing heavy tftp server reconfiguration. Quite what the names of the loader and linux are for isn't known - there are no path names on the default version.
Danny:
While testing newer versions created by JD we've found a various interesting things.
Downloading from tftp server
Downloading doesn't work when DHCP is enabled, if you have DHCP enabled you can change it to static from the bootloader prompt:
(192.168.1.10 is my local server)
boot> config net
Protocol : (0) None (1) Static IP (2) BOOTP (3) DHCP : (3) 1
MAC Address : (FF:FF:FF:FF:FF:FF)
IP Address : (192.168.1.6)
Netmask : (255.255.255.0)
Gateway : (192.168.1.1)
DNS : (192.168.1.10)
Server : (192.168.1.10)
Writing : 0x00025250
.
boot>
|
The first five lines can be modified to suite your setup. After you have changed the setup you'll need to reboot.
Next, the network connection always needs to be initialized. I found these steps work:
Welcome to JASPER boot loader
boot> net arp
192.168.1.6 FF:FF:FF:FF:FF:FF
boot> net arp 192.168.1.10
192.168.1.10 FF:FF:FF:FF:FF:FF
boot> download net romfs
Connecting...
Receiving : ....................................
Received 3221327 (0x31274f) bytes at address 01400000
boot>
|
The above command will retrieve a file named "/home/tftp/bigmo/romfs.m35" if you wish to use another filename you can use the command "config file" to change it. Path names entered here are always relative to the tftp root path! So if the tftp root path is /tftproot the romfs.m35 file should be located in /tftproot/home/tftp/bigmo/.
Debricking
Now if all you wish to do is debrick and boot your box enter the command "flash romfs" and "boot flash". This should give the following output:
boot> flash romfs
This will write data on RAM 0x01400000 into flash 0x00040000
0x00040000 - 0x0035ffff will be erased
0x00040000 - 0x0035274e will be written
Erasing : ........................................................................................
Writing : ................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
..........
boot> boot flash
Inptr=
00000014
Inflating....
Final Inptr=00090743
Original LEN =001287ECOutCnt = 001287EC
Original CRC =AEF8FCA7
Computed CRC =AEF8FCA7
01008000
|
Other goodies
As shown in the command list the box is able to download more than just romfs, other options are boot and kernel. This is where the fun part starts, since boot is able to start these downloaded files! This way it's possible to test modified kernels and bootloaders without flashing your box! below is the incomplete output of a kernel which is configured to output to the console:
boot> boot kernel
01008000Linux version 2.4.17-uc0 (adam@adam-desktop) (gcc version 2.95.3 20010315 (release)(ColdFire patches - 20010318 from http://fidd8
Processor: ARM pt110 revision 0
Architecture: JASPER
Jasper2 rev.A CPU 99 Mhz
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/cdroms/cdrom0
setup_timer: Timer value = 30937
serial_jasper: setup_console @ 38400
jasperuart change speed 80
Calibrating delay loop... 49.25 BogoMIPS
Memory: 16MB = 16MB total
Memory: 14708KB available (1112K code, 218K data, 44K init)
Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode-cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
sk_init: wmem_max 32767 default 32767, rmem_max 32767 default 32767
Initializing RT netlink socket
Starting kswapd
devfs: v1.7 (20011216) Richard Gooch (rgooch@atnf.csiro.au)
|
Comments (0)
You don't have permission to comment on this page.