Re: [E3-hacking] List etiquette

[Nick Griffin]

OK will do..

I tried to post the log of me flashing the 5 mtds so its was way to big,so I 
have posted on the forum,this is when it comes in handy… 

http://amstrad-e3-hacking.freeforums.net/thread/17/trying-flash-amstrad-original-firmware

Spanner..

http://amstrad-e3-hacking.freeforums.net

From: Jonathan McDowell
Sent: ‎Monday‎, ‎29‎ ‎April‎ ‎2019 ‎15‎:‎30
To: Discussion of the Amstrad E3 emailer 
hardware/software

I've just rejected a couple of multi-megabyte messages to the list;
please don't add big attachments, there are currently 124 people on the
list and I doubt they all want to receive such big emails. Post links
where appropriate.

(Great to see a revival of interest in the E3 though, I managed to find
mine in the attic but not the PSU yet.)

J.

--
"Making the impossible very|  .''`.  Debian GNU/Linux Developer
difficult" -- The OpenGALEN| : :' :  Happy to accept PGP signed
 website.  | `. `'   or encrypted mail - RSA
   |   `-key on the keyservers.

___
e3-hacking mailing list
e3-hacking@earth.li
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.earth.li%2Fmailman%2Flistinfo%2Fe3-hackingdata=02%7C01%7C%7Ca318ff33386f4da223ad08d6ccaf46ab%7C84df9e7fe9f640afb435%7C1%7C0%7C636921450507623020sdata=%2F%2BvreE5S9LwUORsjArGuQlQRYP%2FAEBX0%2B8h3gYU7lmk%3Dreserved=0
___
e3-hacking mailing list
e3-hacking@earth.li
https://www.earth.li/mailman/listinfo/e3-hacking

Re: [E3-hacking] Config / content filesystem

[Nick Griffin]

No still don’t load any well. Maybe Jonathan could help…? I don’t have a 
clue.

Spanner..

http://amstrad-e3-hacking.freeforums.net

From: Nick Griffin
Sent: ‎Wednesday‎, ‎24‎ ‎April‎ ‎2019 ‎19‎:‎39
To: Nick Griffin

I try again with the images with the oob in them and see if that works.

Spanner..

http://amstrad-e3-hacking.freeforums.net

From: Nick Griffin
Sent: ‎Wednesday‎, ‎24‎ ‎April‎ ‎2019 ‎19‎:‎37
To: Nick Griffin

Yes we need Jonathan I think, he understands this more.. I think he gave 
the code to remove it so you could look at the data in the files better by hex.

Spanner..

http://amstrad-e3-hacking.freeforums.net

From: Nick Griffin
Sent: ‎Wednesday‎, ‎24‎ ‎April‎ ‎2019 ‎19‎:‎23
To: Discussion of the Amstrad E3 emailer 
hardware/software

I  think it needs the OOB data in the image.
Just looked on the net about ,it say…

How does this combination of nandsim, nandwrite and nandddump decide which ECC 
scheme to use? The flash is from a TI AM335 system, and as far as I know, the 
ECC scheme is decided by a combination of the processor and OS. How do these 
utilities know what to do?


First of all the ECC scheme used does not necessarily have to be for all the 
flash erase blocks. There are ususally 3 different types of flash partitions 
used and for every type the method to specify the used ECC code differs:

  1.  The one that are accessed by the ROM bootcode
  2.  The ones that are accessed by the bootloader (usually u-boot)
  3.  The ones that are accessed by the operating system (assuming you are 
using Linux)

In general the use of a specific ECC method is limited by the OOB size of the 
flash. The AM335x_U-Boot_User's_Guide (cannot post link here because of 
reputation) explains it in sections BCH Flash OOB Layout and the example 
matches to the flash chip you are using. The 64 bytes per 2k page effectively 
limit the usable ECC algorithms to BCH8, BCH4 or HAMMING codes.

BCH Flash OOB Layout

For any ECC scheme we need to add some extra data while writing so as to detect 
and correct (if possible) the errors introduced by the NAND part. In case of 
BCH scheme some bytes are needed to store the ECC related info.

The section of NAND memory where addition info like ECC data is stored is 
referred to as Out Of Band or OOB section.

The first 2 bytes are used for Bad block marker – 0x => Good block

The next ‘N’ bytes is used for BCH bytes

N = B * Number of 512-byte sectors in a page

B = 8 bytes per 512 byte sector in BCH4 B = 14 bytes per 512 byte sector in 
BCH8 B = 26 bytes per 512 byte sector in BCH16

So for a 2k page-size NAND flash with 64-byte OOB size, we will use BCH8. This 
will consume 2 + (14*4) = 58 bytes out of 64 bytes available.

ECC used by ROM bootcode

The AM335x processor's ROM bootcode decides which ECC scheme to use for NAND 
flash depending on the mechanism expalined in the AM335x technical reference 
manual chapter 26.1.7.4 NAND

ECC Correction The default ECC correction applied is BCH 8b/sector using the 
GPMC and ELM hardware. For device ID codes D3h, C3h, D5h, C5h, D7h, C7h, DEh, 
CEh when manufacturer code (first ID byte) is 98h the Cell type information is 
checked in the 4th byte of ID data. If it is equal to 10b then the ECC 
correction applied is BCH 16b/sector. In addition ECC computation done by the 
ROM can be turned off completely by using SYSBOOT[9]. This is particularly 
useful when interfacing with NAND devices that have built in ECC engines.

Other ways to control the ECC behavior are ONFI or and I2C EEPROM but the 
H27U1G8F2BTR datasheet does not mention ONFI so I guess it is not supported by 
the flash chip.

So basically BCH8 or BCH16 or no ECC mechanism is used for the first 128K the 
ROM bootloader reads from NAND flash.

ECC used by the bootloader

The bootloader decides this on his own. For example for U-boot this information 
is compiled into u-boot and the first level bootloader (SPL/MLO) as well. The 
information is controlled by U-Boot configuration settings set at compile time. 
Recent versions of U-boot can switch the ecc at runtime using the nandecc 
command.

ECC used by the OS

The selection is completely OS specific. For Linux embedded systems using 
AM335x processors I know that this information is passed into the kernel using 
the device tree.

Which ECC method does nandsim use

There is a parameter called bch which can be passed to the nandsim module to 
select an ecc code. From the code I guess It is initialized to zero so it won't 
use any ECC code. So it seems that nandsim can use BCH8 and BCH16 but only one 
for the whole flash that is simulated.

modprobe nandsim bch=8 first_id_byte=0xad second_id_byte=0xf1 
third_id_byte=0x00 fourth_id_byte=0x1d

Which ECC method does nanddump/nandwrite use

Again, this depends on the OS/Linux you used to dump the 

Re: [E3-hacking] Config / content filesystem

[Nick Griffin]

I  think it needs the OOB data in the image.
Just looked on the net about ,it say…

How does this combination of nandsim, nandwrite and nandddump decide which ECC 
scheme to use? The flash is from a TI AM335 system, and as far as I know, the 
ECC scheme is decided by a combination of the processor and OS. How do these 
utilities know what to do?


First of all the ECC scheme used does not necessarily have to be for all the 
flash erase blocks. There are ususally 3 different types of flash partitions 
used and for every type the method to specify the used ECC code differs:

  1.  The one that are accessed by the ROM bootcode
  2.  The ones that are accessed by the bootloader (usually u-boot)
  3.  The ones that are accessed by the operating system (assuming you are 
using Linux)

In general the use of a specific ECC method is limited by the OOB size of the 
flash. The AM335x_U-Boot_User's_Guide (cannot post link here because of 
reputation) explains it in sections BCH Flash OOB Layout and the example 
matches to the flash chip you are using. The 64 bytes per 2k page effectively 
limit the usable ECC algorithms to BCH8, BCH4 or HAMMING codes.

BCH Flash OOB Layout

For any ECC scheme we need to add some extra data while writing so as to detect 
and correct (if possible) the errors introduced by the NAND part. In case of 
BCH scheme some bytes are needed to store the ECC related info.

The section of NAND memory where addition info like ECC data is stored is 
referred to as Out Of Band or OOB section.

The first 2 bytes are used for Bad block marker – 0x => Good block

The next ‘N’ bytes is used for BCH bytes

N = B * Number of 512-byte sectors in a page

B = 8 bytes per 512 byte sector in BCH4 B = 14 bytes per 512 byte sector in 
BCH8 B = 26 bytes per 512 byte sector in BCH16

So for a 2k page-size NAND flash with 64-byte OOB size, we will use BCH8. This 
will consume 2 + (14*4) = 58 bytes out of 64 bytes available.

ECC used by ROM bootcode

The AM335x processor's ROM bootcode decides which ECC scheme to use for NAND 
flash depending on the mechanism expalined in the AM335x technical reference 
manual chapter 26.1.7.4 NAND

ECC Correction The default ECC correction applied is BCH 8b/sector using the 
GPMC and ELM hardware. For device ID codes D3h, C3h, D5h, C5h, D7h, C7h, DEh, 
CEh when manufacturer code (first ID byte) is 98h the Cell type information is 
checked in the 4th byte of ID data. If it is equal to 10b then the ECC 
correction applied is BCH 16b/sector. In addition ECC computation done by the 
ROM can be turned off completely by using SYSBOOT[9]. This is particularly 
useful when interfacing with NAND devices that have built in ECC engines.

Other ways to control the ECC behavior are ONFI or and I2C EEPROM but the 
H27U1G8F2BTR datasheet does not mention ONFI so I guess it is not supported by 
the flash chip.

So basically BCH8 or BCH16 or no ECC mechanism is used for the first 128K the 
ROM bootloader reads from NAND flash.

ECC used by the bootloader

The bootloader decides this on his own. For example for U-boot this information 
is compiled into u-boot and the first level bootloader (SPL/MLO) as well. The 
information is controlled by U-Boot configuration settings set at compile time. 
Recent versions of U-boot can switch the ecc at runtime using the nandecc 
command.

ECC used by the OS

The selection is completely OS specific. For Linux embedded systems using 
AM335x processors I know that this information is passed into the kernel using 
the device tree.

Which ECC method does nandsim use

There is a parameter called bch which can be passed to the nandsim module to 
select an ecc code. From the code I guess It is initialized to zero so it won't 
use any ECC code. So it seems that nandsim can use BCH8 and BCH16 but only one 
for the whole flash that is simulated.

modprobe nandsim bch=8 first_id_byte=0xad second_id_byte=0xf1 
third_id_byte=0x00 fourth_id_byte=0x1d

Which ECC method does nanddump/nandwrite use

Again, this depends on the OS/Linux you used to dump the flash. Similar to the 
nandsim module real mtd drivers have ways to specify the used ECC scheme 
(kernel parameters, device tree). But you can instruct nanddump to ignore the 
ECC information, too.

References

  *   AM335x technical reference manual http://www.ti.com/lit/gpn/am3359
  *   bch Linux Kernel parameter for nandsim 
http://lxr.free-electrons.com/source/drivers/mtd/nand/nandsim.c#L175
  *   The AM335x_U-Boot_User's_Guide





Spanner..

http://amstrad-e3-hacking.freeforums.net

From: Ralph Corderoy
Sent: ‎Wednesday‎, ‎24‎ ‎April‎ ‎2019 ‎18‎:‎30
To: Discussion of the Amstrad E3 emailer 
hardware/software

Hi Nick,

> I copied it twice not

What's the output of copying it once?

> Amstrad Delta - PBL V4.9 Build:1311 Assert Debug ICE
> PBL 32MB NAND
> 0MB.-->MEMv01.00.002,CopyLim=0022h,CodeEnd=0140h-->PBL..1MB...2MB*

What if you try reading 

Re: [E3-hacking] E1

[David Given]

The Pocket Dockit interface is just a TTL serial connection attached to (I
think) the other UART on the processor, although I've no idea whether it's
inverted or not. It's probably really easy to reverse engineer and spoof,
with some basic electronics skills and a logic analyser. I know if anyone's
investigated it.

It'd theoretically be possible to exploit bugs in the emailer software, if
there are any, to break into the stock firmware that way even on a PBL 5.1
system. That'd be a *hellish* amount of work, though.

On Mon, 29 Apr 2019 at 02:02, Nick Griffin  wrote:

> I noticed you were talking about the E1 and the Pocket Dock IT, How far
> did your investigations get with the E1..?
>
> Does anyone know how the Pocket Dock IT works and the slot it connects to
> on the E-mailer(E1/2/3) I ask this because you can use the Pocket Dock IT
> to copy the Configuration Change Set Up from one E-mailer to another
> E-mailer but has to be the same model and activated. I was wondering how it
> copies the setup over to the Pocket Dock IT and back, if we could interface
> with the dock or Pocket Dock IT we could maybe save the setup from the
> E-mailer or Pocket Dock IT to the PC.
>
> If the batteries in the Pocket Dock IT run out, the setup from the
> E-mailer gets deleted.
>
> Just a idea..??
>
> Spanner..
>
> http://amstrad-e3-hacking.freeforums.net/thread/6/e1
> ___
> e3-hacking mailing list
> e3-hacking@earth.li
> https://www.earth.li/mailman/listinfo/e3-hacking
>


-- 
┌─── http://www.cowlark.com ───
│ "I have always wished for my computer to be as easy to use as my
│ telephone; my wish has come true because I can no longer figure out
│ how to use my telephone." --- Bjarne Stroustrup
___
e3-hacking mailing list
e3-hacking@earth.li
https://www.earth.li/mailman/listinfo/e3-hacking