NWR04B: Not so easy

The continuing saga of the NWR04b, um, continues.

As I mentioned, I was looking at using the rmem command on the NWR firmware to read out memory and maybe figure out the checksum code. I came up with a small expect script (well, grabbed rddmm.exp and butchered it 'til it did what I wanted) to do just that, but it seems to be a little buggy: after a while, the output freezes. If I fire up minicom, I get a whole crapload of memory output from the serial port -- the stuff the expect script had been reading all along. It continues until I reset the board, but after that the characters from the board are all messed up: you can see where the menu and prompts are, but every other character or so is wrong. If I exit minicom then start again, letting it reset the serial port in the process, everything's fine. This makes me think my expect script is maybe going too fast, or not grabbing the output fast enough, or something else that just messes up the state of the serial port temporarily.

I was going to work on it a bit and give it the option of starting at a particular offset (which would've taken a while, since I'm almost completely new to expect), but got distracted when I found the NWR's SEEKRIT MENU! At power-on, you see this prompt:

Got the 6HYNIX_16bits Flash ROM ADM5106
Boot:

Welp, turns out that if you hit the space bar three times right then, you get this menu:

Loader Menu ================
(a) Download POST ...
(b) Exit
Please enter your key :

Woohoo, a quick way to download ARMboot! Or so I hoped. (I did try UP LEFT UP LEFT RIGHT RIGHT DOWN RIGHT UP LEFT to see if that would run Linux automagically, but no.)

First, a cross-compiling toolchain was needed. I found this page, which had both a fully-compiled toolchain ready to download, or a script that would build everything for you and required lots of mysterious patches to be downloaded in advance. Since I'm more manly than smart, I went for the script. (Though obviously I'm not that manly, since I was depending on a script in the first place...) I ran into troubles with uClibc, though -- for some reason, the script would just refuse to build it. Eventually, I just gave up and downloaded the pre-compiled version.

Now, on to the actual compiling of ARMboot. Codeman, the original hacker, posted a bunch of files that included (I think) a modified version of ARMboot for the chip on the NWR. A quick make cx84200_config and make CROSS_COMPILE=/path/to/arm-uclinux-tools/bin/arm-uclinux- all worked, with a couple hiccups along the way. First off, I got this error:

cc1: error: invalid option `short-load-bytes'

A quick Google turned up this message from the CrossGCC project, saying that this option had been renamed alignment-traps. A bit of script-fu took care of that:

find . -type f -exec grep -l short-load-bytes {} ; | xargs perl -i.bak -pe's/-mshort-load-bytes/-malignment-traps/'

God, I love Unix.

I tried make again, and came up with this error:

flash.c: 181: error: label at end of compound statement

The code in question looked like this:

default:
    printf("Unknown Chip Typen");
    goto Done;
    break;
}
/* Some stuff I'm leaving out... */
printf ("n");
Done:
}

I moved the Done: label to before the last printf statement, and everything seemed to work fine: ARMboot compiled, and I had armboot.bin ready to go. Doubtless there's a better way of doing that, but this seemed to work well enough for now.

Now to try uploading:

Loader Menu
================
(a) Download POST ...
(b) Exit
Please enter your key : a
Downloading............PASS
Verifying file......file corrupt -- FAIL

Well, crap: I was able to upload it by Xmodem, as I suspected, but it's still checksumming the thing, which means I was busted again. I'm still not giving up, though. I'm hoping to figure out the checksum; I found this page, which has a lot of pointers on how to do it. I think I'll try some of the things he talks about and see if I can figure out more about the checksum.