Author Topic: Bost - Built-in Onboard Self Test  (Read 8429 times)

fladda

  • Newbie
  • *
  • Posts: 17
    • View Profile
Bost - Built-in Onboard Self Test
« on: March 15, 2006, 09:07:45 am »
The original Siemens bootlader contains the code for BOST - the Simpad's Built-in Onboard Self Test routines. BOST even has an option to programme the fabdata string(s) - in answer to Digi's question this is how it can be done !

Not sure if you can access BOST using the standard Siemens 2.4 or 2.5.3 bootloaders. I managed to get BOST running by simply changing one byte of the 2.4 bootloader code, and then reflashing the modified 2.4 bootloader into my Simpad.

Instructions to follow (first I want to have a look at the test commands:-)

Ralph

BOST Commands:
a,A b,B  : Connect Audio Path Mike => Speaker and Headset, exit with 'e'
a,A h,H or s,S : Audio Path Mike => Headset or Speaker, exit with 'e'
a,A t,T  : Short Tone burst to Speaker and Headset
b,B 1..6 : Control Backlight brightness
c,C i,I  : Init and Accesstest CODEC UCB1200 / UCB1300
c,C j,J 1..3 : Get CODEC AD1: BL_POWER, AD2: DC_IN_FUSED, AD3: ICHARGE
c,C k,K  : Get P and X,Y-Coordinates from Touch Panel
c,C l,L  : Loop Get P and X,Y-Coordinates, exit with 'e'
d,D a,A  : ATM commands to DECT Modul MD34
d,D b,B  : Set DIV_BAUD for UART1 (default = 0x01)
d,D c,C  : Connect MD34 to DECT Base Station BS3070
d,D d,D or i,I : DECT Module Power Down or Init DECT Modul MD34
d,D e,E  : Escape Command +++ to DECT Modul
d,D f,F  : Back to Factory settings DECT Modul
f,F d,D or r,R : Display Fabdata Magic or Read Fabdata buffer
f,F s,S  : Write Serial number to Fabdata buffer
f,F t,T or l,L : Write Test Date Ttt.mm.jj or Load Date Ltt.mm.jj
g,G b,B or w,W : Fill Background with Black or White
g,G h,H or v,V : Fill Color Pattern horizontal or vertical
g,G l,L or n,N : Write White or Black Lines
h,H,?    : Help text
i,I b,B  : Set DIV_BAUD for UART2 (default = 0x01)
i,I r,R or t,T : Receive or Transmit 20 Bytes from/to IrDA
l,L 2 or 0 : Set LED2 on or off
m,M a,A  : Set ACCESS to RAM (default = 0x32)
m,M b,B or e,E : Set RAM BEGIN-ADR or END-ADR (default = 0)
m,M d,D or m,M : RAM Data Test or RAM Memory Test
n,N c,C or g,G or s,S : Get CODEC or GPIO or CS3 DIN Port
n,N k,K or m,M : Alternate Output 32kHz or 3.6MHz at GPIO_27
o,O h,H or l,L : High or Low to CS3 Latch Pins
o,O i,I or o,O : In or Out in GPIO Pin Direction Register (GPDR)
o,O c,C or s,S : Clear or Set GPIO Output Register (GPCR or GPSR)
p,P 0 or 3 or 5 : PCMCIA Vcc/Vpp to 0V or 3.3V or 5V
p,P a,A or s,S : Set ACCESS Variable or DOUT Variable
p,P d,D or m,M : PCMCIA RAM Data Test or PCMCIA Memory Test
p,P r,R or w,W : Read DIN from or write DOUT to PCMCIA Address
r,R      : Soft Reset
s,S a,A or s,S or i,I : Smart Card Answer to Reset (ATR) or Init TDA8007
u,U d,D or e,E : Disable or Enable USB Device Controller
u,U s,S  : Get UDC Status Register
v,V      : BOST Version
x,X      : Power Off
y,Y      : FLASH Burst Test
z,Z      : Memory Dump
(Textlen 2297 Bytes)

Digi

  • Newbie
  • *
  • Posts: 13
    • View Profile
Bost - Built-in Onboard Self Test
« Reply #1 on: March 15, 2006, 11:57:46 am »
These items look very familiar!!! I saw most of them looking at the bootloaders with a hex-editor, and thats what made me post the question with the extended commands. Veeery interesting!

Digi


Quote
The original Siemens bootlader contains the code for BOST - the Simpad's Built-in Onboard Self Test routines. BOST even has an option to programme the fabdata string(s) - in answer to Digi's question this is how it can be done !

Not sure if you can access BOST using the standard Siemens 2.4 or 2.5.3 bootloaders. I managed to get BOST running by simply changing one byte of the 2.4 bootloader code, and then reflashing the modified 2.4 bootloader into my Simpad.

Instructions to follow (first I want to have a look at the test commands:-)

Ralph

BOST Commands:
a,A b,B  : Connect Audio Path Mike => Speaker and Headset, exit with 'e'
a,A h,H or s,S : Audio Path Mike => Headset or Speaker, exit with 'e'
a,A t,T  : Short Tone burst to Speaker and Headset
b,B 1..6 : Control Backlight brightness
c,C i,I  : Init and Accesstest CODEC UCB1200 / UCB1300
c,C j,J 1..3 : Get CODEC AD1: BL_POWER, AD2: DC_IN_FUSED, AD3: ICHARGE
c,C k,K  : Get P and X,Y-Coordinates from Touch Panel
c,C l,L  : Loop Get P and X,Y-Coordinates, exit with 'e'
d,D a,A  : ATM commands to DECT Modul MD34
d,D b,B  : Set DIV_BAUD for UART1 (default = 0x01)
d,D c,C  : Connect MD34 to DECT Base Station BS3070
d,D d,D or i,I : DECT Module Power Down or Init DECT Modul MD34
d,D e,E  : Escape Command +++ to DECT Modul
d,D f,F  : Back to Factory settings DECT Modul
f,F d,D or r,R : Display Fabdata Magic or Read Fabdata buffer
f,F s,S  : Write Serial number to Fabdata buffer
f,F t,T or l,L : Write Test Date Ttt.mm.jj or Load Date Ltt.mm.jj
g,G b,B or w,W : Fill Background with Black or White
g,G h,H or v,V : Fill Color Pattern horizontal or vertical
g,G l,L or n,N : Write White or Black Lines
h,H,?    : Help text
i,I b,B  : Set DIV_BAUD for UART2 (default = 0x01)
i,I r,R or t,T : Receive or Transmit 20 Bytes from/to IrDA
l,L 2 or 0 : Set LED2 on or off
m,M a,A  : Set ACCESS to RAM (default = 0x32)
m,M b,B or e,E : Set RAM BEGIN-ADR or END-ADR (default = 0)
m,M d,D or m,M : RAM Data Test or RAM Memory Test
n,N c,C or g,G or s,S : Get CODEC or GPIO or CS3 DIN Port
n,N k,K or m,M : Alternate Output 32kHz or 3.6MHz at GPIO_27
o,O h,H or l,L : High or Low to CS3 Latch Pins
o,O i,I or o,O : In or Out in GPIO Pin Direction Register (GPDR)
o,O c,C or s,S : Clear or Set GPIO Output Register (GPCR or GPSR)
p,P 0 or 3 or 5 : PCMCIA Vcc/Vpp to 0V or 3.3V or 5V
p,P a,A or s,S : Set ACCESS Variable or DOUT Variable
p,P d,D or m,M : PCMCIA RAM Data Test or PCMCIA Memory Test
p,P r,R or w,W : Read DIN from or write DOUT to PCMCIA Address
r,R      : Soft Reset
s,S a,A or s,S or i,I : Smart Card Answer to Reset (ATR) or Init TDA8007
u,U d,D or e,E : Disable or Enable USB Device Controller
u,U s,S  : Get UDC Status Register
v,V      : BOST Version
x,X      : Power Off
y,Y      : FLASH Burst Test
z,Z      : Memory Dump
(Textlen 2297 Bytes)
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118703\"][{POST_SNAPBACK}][/a][/div]

fladda

  • Newbie
  • *
  • Posts: 17
    • View Profile
Bost - Built-in Onboard Self Test
« Reply #2 on: March 15, 2006, 01:55:02 pm »
I also found the BOST stuff whilst I was having a look at the bootloader code using my old Acorn RiscPC (which comes complete with a built in ARM dissassembler;-)

I had a very lucky guess that the BOST code was disabled by Siemens by removing the 'b' option in the Monitor menu. I just changed one of the other letters in the menu assembler code to a 'b'.

=====================
Monitor:
=====================
Boot from Flash   'f'
Boot from Net     'n'
Power Off         'o'
Erase PSM+Registry'p'
Exit              'q'
Erase Registry    'r'
Soft  Reset       's'
Print Fab-String  'w'
->

Would make sense to change the 'q' to a 'b'. Then exiting from the monitor menu would take you straight into the BOST routines.

I will re-modify the code just to be sure, and then post the instructions how to modify the Siemens bootloader...

Ralph

Quote
These items look very familiar!!! I saw most of them looking at the bootloaders with a hex-editor, and thats what made me post the question with the extended commands. Veeery interesting!

Digi

[div align=\"right\"][a href=\"index.php?act=findpost&pid=118730\"][{POST_SNAPBACK}][/a][/div]

fladda

  • Newbie
  • *
  • Posts: 17
    • View Profile
Bost - Built-in Onboard Self Test
« Reply #3 on: March 15, 2006, 02:43:02 pm »
WARNING - THIS MODIFICATION MIGHT 'BRICK' YOUR SIMPAD. UNTIL THIS HAS BEEN VERIFIED I WOULD STRONGLY RECOMMEND THAT LOADING A MODIFIED BOOTLOADER INTO YOUR SIMPAD SHOULD ONLY BE UNDERTAKEN BY PEOPLE WHO KNOW HOW TO USE JTAG TO RECOVER THE BOOT LOADER.

OK to get the BOST code to run from the Siemens monitor menu.

1. Find a copy of the original Siemens bootloader version 2.4  "loader_bl".

2. Change the byte at offset address:-

0x0016b4  from 0x71 ("q") to 0x62 ("b") (this is the important bit)

000016B4 CMPNE  R0,#&71 changes to CMPNE R0,#&62

3. Then change the string at offset 0x01d820 (in the text near the end of the file)

From Exit    ...    'q'     to     BOST   ...    'b'

This is just a cosmetic change to alter the menu string, as below:-

=====================
Monitor:
=====================
Boot from Flash   'f'
Boot from Net     'n'
Power Off         'o'
Erase PSM+Registry'p'
BOST              'b'
Erase Registry    'r'
Soft  Reset       's'
Print Fab-String  'w'

5. Save the modified bootloader file - I used the filename 'bootmod'.

6. Assuming that the Simpad already had the Siemens 2.4 or 2.5.3 bootloader installed. Connect up the serial cable to a terminal (I use Hyperterminal on a win98 PC) at 38.4kb 8N1 hardware handshaking.

7. Reset the Simpad and get the monitor menu. If monitor menu does not appear, then continuously press the 'escape' key on the PC keyboard whilst you reset the Simpad. Alternatively hold the lower key down on the Simpad whilst you press the reset key - this will bring up the monitor menu.

8. Enter the extended command 'x'.

9. Type 'e' and then 'b' which should being up the menu to erase the existing boot image. Type 'y' to erase. Note that this does not appear to erase the master boot file from the 16-bit part of the Simpad's flash. When you reset the Simpad, it will re-load the boot image.

=====================
Monitor:
=====================
Boot from Flash   'f'
Boot from Net     'n'
Power Off         'o'
Erase PSM+Registry'p'
Exit              'q'
Erase Registry    'r'
Soft  Reset       's'
Print Fab-String  'w'
-> x

Extended Command
Enter hexcode to execute:eb
Erasing Bootstrap. Please Wait
[***************************************-]

Bootstrap Erased.
You will see me never again.
ByeBye !

10. Rest the Simpad again. The following test should appear:-

PBL V2.4 20.07.2001
Booting internal PBL image...
================================================
Siemens Switzerland Bootloader V2.4 20.07.2001
Running @206Mhz Processor ID 0x6901b118
Press ESC for monitor
Occupied Memory: [0x00004000-0x00008000],[0x01f00014-0x01f74b9c]
Flash Id 0x00000018 at virt adr 0x05000000 Size 0x01000000
No 32Bit Flash detected 0x00000000
FlashImage Checksum 0x05040014-0x05061ab0=0xffff7959 Image Update, Old Image unchecked
Fabdata Flash @0x05040014 Ram @0x01f21ab4 Init Fabdata... Done
[***************************************\]
Firmware Update Successfully Finished
Press Button to restart
Firmware Update Successfully Finished
Press Button to restart
Firmware Update Successfully Finished
Press Button to restart
etc.

11. Close the terminal session to release the serial port.

12. Use serial load programme to load in the modified bootloader.

C:\simpad> serload <filename>

13. When completed, reset the Simpad and you should now get the monitor option to enter BOST. Type 'h' for a list of the commands.

=====================
Monitor:
=====================
Boot from Flash   'f'
Boot from Net     'n'
Power Off         'o'
Erase PSM+Registry'p'
BOST              'b'
Erase Registry    'r'
Soft  Reset       's'
Print Fab-String  'w'
-> b

 Start BOST Siemens

BOST SIMPAD V1.01

etc...

e.g. memory monitor allows you to look as memory locations:-


z(b)yte,(w)ord,(l)ong :Adr: $00080000
 00080000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080010 ff bf ff ff ff ff ff ff ff ff ff ff bf ff ff ff ................
 00080020 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080030 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080040 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080050 ff ff ff ff ff ff ff ff ff ff ff ff fe ff ff ff ................
 00080060 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080070 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080080 ff bf ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080090 ff ff ff ff ff ff ff ff fd ff ff ff df ff ff ff ................
 000800a0 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 000800b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 000800c0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 000800d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 000800e0 ff ff ff ff ff ff ff ff fe ff ff ff ff ff ff ff ................
 000800f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ef ff ff ................

Some of the commands appear to be vaguely useful, especially if you have a Simpad that has an unresolved problem (like one of mine:-().

A similar 'modification' will probably also work for the Siemens 2.5.3 bootloader, although I've not tried this yet. Note that I've found that the original Siemens rev. 2.4 bootloader to be easier to use for loading images, as the 2.4 bootloader never has a problem 'seeing' the incoming serial data. I often have to do 20-30 resets in succession with the 2.5.3 loader before it 'sees' that there is a serload 'in progress'. I suspect that this has caused many people to believe that their Simpad is 'bricked' !

And for all I know you can enter BOST directly without modifying the bootloader. If anybody knows how to do this, then please do let us know...

Hope that somebody out there finds this useful...

Ralph
« Last Edit: March 15, 2006, 05:33:36 pm by fladda »

Digi

  • Newbie
  • *
  • Posts: 13
    • View Profile
Bost - Built-in Onboard Self Test
« Reply #4 on: March 15, 2006, 03:00:48 pm »
Is it really necessary to erase the bootstrap first? Can't you just load the modified bootloader with serload?

As for entering BOST other than that... I'm sure there is a back door, like a string of extended commands in a certain order or something like that. But on the other hand, your method is easy enough not to worry about that anymore.

Do you think, with the new commands at our disposal now, there is an easy way to
replace a PBL 1.4 with 2.4? I'm upgrading 16/32MB Simpads to 32/64, and this is always a pain in the butt.

Digi

Quote
8. Enter the extended command 'x'.

9. Type 'e' and then 'b' which should being up the menu to erase the existing boot image. Type 'y' to erase. Note that this does not appear to erase the master boot file from the 16-bit part of the Simpad's flash. When you reset the Simpad, it will re-load the boot image.

=====================
Monitor:
=====================
Boot from Flash   'f'
Boot from Net     'n'
Power Off         'o'
Erase PSM+Registry'p'
Exit              'q'
Erase Registry    'r'
Soft  Reset       's'
Print Fab-String  'w'
-> x

Extended Command
Enter hexcode to execute:eb
Erasing Bootstrap. Please Wait
[***************************************-]

Bootstrap Erased.
You will see me never again.
ByeBye !

10. Rest the Simpad again. The following test should appear:-

PBL V2.4 20.07.2001
Booting internal PBL image...
================================================
Siemens Switzerland Bootloader V2.4 20.07.2001
Running @206Mhz Processor ID 0x6901b118
Press ESC for monitor
Occupied Memory: [0x00004000-0x00008000],[0x01f00014-0x01f74b9c]
Flash Id 0x00000018 at virt adr 0x05000000 Size 0x01000000
No 32Bit Flash detected 0x00000000
FlashImage Checksum 0x05040014-0x05061ab0=0xffff7959 Image Update, Old Image unchecked
Fabdata Flash @0x05040014 Ram @0x01f21ab4 Init Fabdata... Done
[***************************************\]
Firmware Update Successfully Finished
Press Button to restart
Firmware Update Successfully Finished
Press Button to restart
Firmware Update Successfully Finished
Press Button to restart
etc.

11. Close the terminal session to release the serial port.

12. Use serial load programme to load in the modified bootloader.

C:\simpad> serload <filename>

13. When completed, reset the Simpad and you should now get the monitor option to enter BOST. Type 'h' for a list of the commands.

=====================
Monitor:
=====================
Boot from Flash   'f'
Boot from Net     'n'
Power Off         'o'
Erase PSM+Registry'p'
BOST              'b'
Erase Registry    'r'
Soft  Reset       's'
Print Fab-String  'w'
-> b

 Start BOST Siemens

BOST SIMPAD V1.01

etc...

e.g. memory monitor allows you to look as memory locations:-


z(b)yte,(w)ord,(l)ong :Adr: $00080000
 00080000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080010 ff bf ff ff ff ff ff ff ff ff ff ff bf ff ff ff ................
 00080020 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080030 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080040 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080050 ff ff ff ff ff ff ff ff ff ff ff ff fe ff ff ff ................
 00080060 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080070 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080080 ff bf ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 00080090 ff ff ff ff ff ff ff ff fd ff ff ff df ff ff ff ................
 000800a0 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 000800b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 000800c0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 000800d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
 000800e0 ff ff ff ff ff ff ff ff fe ff ff ff ff ff ff ff ................
 000800f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ef ff ff ................

Some of the commands appear to be vaguely useful, especially if you have a Simpad that has an unresolved problem (like one of mine:-().

A similar 'modification' will probably also work for the Siemens 2.5.3 bootloader, although I've not tried this yet. Note that I've found that the original Siemens rev. 2.4 bootloader to be easier to use for loading images, as the 2.4 bootloader never has a problem 'seeing' the incoming serial data. I often have to do 20-30 resets in succession with the 2.5.3 loader before it 'sees' that there is a serload 'in progress'. I suspect that this has caused many people to believe that their Simpad is 'bricked' !

And for all I know you can enter BOST directly without modifying the bootloader. If anybody knows how to do this, then please do let us know...

Hope that somebody out there finds this useful...

Ralph
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118748\"][{POST_SNAPBACK}][/a][/div]

fladda

  • Newbie
  • *
  • Posts: 17
    • View Profile
Bost - Built-in Onboard Self Test
« Reply #5 on: March 15, 2006, 03:40:31 pm »
>Is it really necessary to erase the bootstrap first? Can't you just load the modified >bootloader with serload?

I get a memory overlap error when I try serial loading things using the 2.4 bootloader. However this might be something wrong with the Simpad that I'm using, as I still haven't worked out why it won't work after flashing it with a WinCE 4.1 image (I suspect a damaged flash chip:-()

>As for entering BOST other than that... I'm sure there is a back door, like a string of >extended commands in a certain order or something like that. But on the other hand, >your method is easy enough not to worry about that anymore.

I did have quick look in the 2.4 bllotloader code for this. Could be there, but I couldn't find it. However I didn't look very hard or far...

>Do you think, with the new commands at our disposal now, there is an easy way to
>replace a PBL 1.4 with 2.4? I'm upgrading 16/32MB Simpads to 32/64, and this is >always a pain in the butt.

Sorry I have no experience of the older Simpads. Most of the BOST commands are for test purposes, and few if any actually modify the flash. Are you currently using JTAG for to get the bootloaders into the modified Simpads ?

Ralph

Digi

  • Newbie
  • *
  • Posts: 13
    • View Profile
Bost - Built-in Onboard Self Test
« Reply #6 on: March 15, 2006, 03:46:47 pm »
I go via blupdater.img, but that way I loose the FabData (which I can restore now, thanks ;-))

Quote
Sorry I have no experience of the older Simpads. Most of the BOST commands are for test purposes, and few if any actually modify the flash. Are you currently using JTAG for to get the bootloaders into the modified Simpads ?

Ralph
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118752\"][{POST_SNAPBACK}][/a][/div]

fladda

  • Newbie
  • *
  • Posts: 17
    • View Profile
Bost - Built-in Onboard Self Test
« Reply #7 on: March 15, 2006, 05:42:12 pm »
Well I reloaded the 4.1 WinCE image onto my Simpad using the modified 2.4 bootloader, and the bootloader is now shown as corrupt. However this Simpad has a fault somewhere so I'm not sure if this is anything to do with my modified bootloader or not !

After loading WinCE 4.1 image via serload I reset the Simpad and got:-

PBL V2.4 20.07.2001
Booting...
================================================
Siemens Switzerland Bootloader V2.4 20.07.2001
Running @206Mhz Processor ID 0x6901b118
Press ESC for monitor
Occupied Memory: [0x00004000-0x00008000],[0x00008014-0x0007cb9c]
Flash Id 0x00000018 at virt adr 0x05000000 Size 0x01000000
No 32Bit Flash detected 0x00000000
FlashImage Checksum 0x05040014-0x05061ab0=0x9dfa36c6 Bootloader Image OK
Fabdata Flash @0x05061ab4 Ram @0x00029ab4 FABDATA:
MSC2=0x211954e0 :: MQ200 - Revision ID=2 ...
Initialise PCMCIA Interface... done.
Codec UCB1200 ID:0x1005 Ver.5 Dev.0 Suppl.1 IO 0x00000000
No PCMCIA Card Attached
No serial download request
Boothdr at 0x05080000 -> 0x31415926
Loading executable with header 0x0000
[*********************/] 15209kB/sec
Done

<had very faint tartan screen (no backlight?) and nothing else, which is how this Simpad has been for weeks>

Then I reset the Simpad and got :-

PBL V2.4 20.07.2001
Booting...
================================================
Siemens Switzerland Bootloader V2.4 20.07.2001
Running @206Mhz Processor ID 0x6901b118
Press ESC for monitor
Occupied Memory: [0x00004000-0x00008000],[0x00008014-0x0007cb9c]
Flash Id 0x00000018 at virt adr 0x05000000 Size 0x01000000
No 32Bit Flash detected 0x00000000
FlashImage Checksum 0x05040014-0x05061ab0=0xc1a8fc2a BOOTLOADER DEFECT !
Fabdata Flash @0x05061ab4 Ram @0x00029ab4 FABDATA:
MSC2=0x211954e0 :: MQ200 - Revision ID=2 ...

<and nothing else>

Therefore, I strongly recommend that only those people with JTAG ports, cables and knowledge should attempt to load a modified boot-loader into their Simpads. At least until this has been tested a bit more.

Ralph

fladda

  • Newbie
  • *
  • Posts: 17
    • View Profile
Bost - Built-in Onboard Self Test
« Reply #8 on: March 16, 2006, 05:55:18 pm »
Tonight I managed to get the same corrupt bootloader message after re-loading the original Siemens 2.4 boot-loader with JTAG. So I'm pretty sure that the corrupt bootloader message is being caused by a corrupt flash EEPROM chip on this Simpad, and does not appear to be anything to do with the modified bootloader. That said, I would still recommend that only experienced JTAGers try the modified bootloader until it is proved to be 'safe'.

Since then I have successfully loaded my modified bootloader onto another Simpad, and this Simpad SL then successfully booted OK into WinCE 4.1 several times without incident.

I then went back and wrote the FabData string into this second Simpad using the BOST 'fs' (fabdata serial write) command. This was successful, but appeared to somehow corrupt the 4.1 WinCE image, as the next time the Simpad was reset I just got a continuous 'tartan reset' screen, with no sign of WinCE 4.1 appearing.

Ralph

Digi

  • Newbie
  • *
  • Posts: 13
    • View Profile
Bost - Built-in Onboard Self Test
« Reply #9 on: March 17, 2006, 04:13:55 pm »
I modified my "SLC" (upgraded Swisscom) runnig on the english 4.1 and wrote the original FabData (C420...) without any problems. I made a mistake once en route though and found the PBL replaced my modified BL because of that. So the PBL needs to be modified, too. For the simpadSL.rom look at offsets 0x24B4 and 0x1E620.

Digi

Quote
Tonight I managed to get the same corrupt bootloader message after re-loading the original Siemens 2.4 boot-loader with JTAG. So I'm pretty sure that the corrupt bootloader message is being caused by a corrupt flash EEPROM chip on this Simpad, and does not appear to be anything to do with the modified bootloader. That said, I would still recommend that only experienced JTAGers try the modified bootloader until it is proved to be 'safe'.

Since then I have successfully loaded my modified bootloader onto another Simpad, and this Simpad SL then successfully booted OK into WinCE 4.1 several times without incident.

I then went back and wrote the FabData string into this second Simpad using the BOST 'fs' (fabdata serial write) command. This was successful, but appeared to somehow corrupt the 4.1 WinCE image, as the next time the Simpad was reset I just got a continuous 'tartan reset' screen, with no sign of WinCE 4.1 appearing.

Ralph
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118926\"][{POST_SNAPBACK}][/a][/div]

Digi

  • Newbie
  • *
  • Posts: 13
    • View Profile
Bost - Built-in Onboard Self Test
« Reply #10 on: March 17, 2006, 04:48:25 pm »
Ooops, that was quoted too early, ran into the same problem later. Simple reset gave me permanent checkered pattern, hard reset permanent white screen. Trying to reflash the Windows image now...

Digi

Quote
I modified my "SLC" (upgraded Swisscom) runnig on the english 4.1 and wrote the original FabData (C420...) without any problems. I made a mistake once en route though and found the PBL replaced my modified BL because of that. So the PBL needs to be modified, too. For the simpadSL.rom look at offsets 0x24B4 and 0x1E620.

Digi

Quote
Tonight I managed to get the same corrupt bootloader message after re-loading the original Siemens 2.4 boot-loader with JTAG. So I'm pretty sure that the corrupt bootloader message is being caused by a corrupt flash EEPROM chip on this Simpad, and does not appear to be anything to do with the modified bootloader. That said, I would still recommend that only experienced JTAGers try the modified bootloader until it is proved to be 'safe'.

Since then I have successfully loaded my modified bootloader onto another Simpad, and this Simpad SL then successfully booted OK into WinCE 4.1 several times without incident.

I then went back and wrote the FabData string into this second Simpad using the BOST 'fs' (fabdata serial write) command. This was successful, but appeared to somehow corrupt the 4.1 WinCE image, as the next time the Simpad was reset I just got a continuous 'tartan reset' screen, with no sign of WinCE 4.1 appearing.

Ralph
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118926\"][{POST_SNAPBACK}][/a][/div]
[div align=\"right\"][a href=\"index.php?act=findpost&pid=119059\"][{POST_SNAPBACK}][/a][/div]

Digi

  • Newbie
  • *
  • Posts: 13
    • View Profile
Bost - Built-in Onboard Self Test
« Reply #11 on: March 17, 2006, 05:39:48 pm »
reflashed CE alright! So if you change the FabData, for some reason you have to reflash Windows afterwards...


Quote
Ooops, that was quoted too early, ran into the same problem later. Simple reset gave me permanent checkered pattern, hard reset permanent white screen. Trying to reflash the Windows image now...

Digi

Quote
I modified my "SLC" (upgraded Swisscom) runnig on the english 4.1 and wrote the original FabData (C420...) without any problems. I made a mistake once en route though and found the PBL replaced my modified BL because of that. So the PBL needs to be modified, too. For the simpadSL.rom look at offsets 0x24B4 and 0x1E620.

Digi

Quote
Tonight I managed to get the same corrupt bootloader message after re-loading the original Siemens 2.4 boot-loader with JTAG. So I'm pretty sure that the corrupt bootloader message is being caused by a corrupt flash EEPROM chip on this Simpad, and does not appear to be anything to do with the modified bootloader. That said, I would still recommend that only experienced JTAGers try the modified bootloader until it is proved to be 'safe'.

Since then I have successfully loaded my modified bootloader onto another Simpad, and this Simpad SL then successfully booted OK into WinCE 4.1 several times without incident.

I then went back and wrote the FabData string into this second Simpad using the BOST 'fs' (fabdata serial write) command. This was successful, but appeared to somehow corrupt the 4.1 WinCE image, as the next time the Simpad was reset I just got a continuous 'tartan reset' screen, with no sign of WinCE 4.1 appearing.

Ralph
[div align=\"right\"][a href=\"index.php?act=findpost&pid=118926\"][{POST_SNAPBACK}][/a][/div]
[div align=\"right\"][a href=\"index.php?act=findpost&pid=119059\"][{POST_SNAPBACK}][/a][/div]
[div align=\"right\"][a href=\"index.php?act=findpost&pid=119063\"][{POST_SNAPBACK}][/a][/div]