how to load an image over ethernet


DISCLAIMER: NOT RESPONSIBLE FOR ANY PROBLEMS. however, i'm willing to help if i can.



***introduction.***

this is an advanced way of loading an image onto the 900/900c! based on standard eboot.
should work with any bootloader version. BUT tested only with 4.10 and 3.0 so far.
this means version 4.5.1-6 might or might not be able to do it properly. (probably would work.)



***what you need is***

1. serial cable
2. ne2000 compatible ethernet card that actually works, 10mbps gives you a better chance. i use a socket LPE.
3. you DON'T need a CF card, that's special about this.
4. tftp client or platform builder. for tftp, tallsoft has a nice free gui client that works.
5. image file packaged up in flashable format, but named boot.bin or nk.bin (not xip.bin). this is not a bootloader image (i.e. not flashed in place of the existing bootloader). 

OR

there is an alternative hackish method that doesn't need serial (does need all the other stuff however) 
but this alternative method is not suitable for saving bricks. detailed below.



***MORE INFORMATION***

what is this useful for? may be able to unbrick a 900c with the buggy bootloader 4.5.1-6 as long as the bootloader is intact enough.
and definitely can unbrick a 900c with bootloader 3.0 (this combination reads the CF cards wrong on some 900c's so cannot flash properly). this has been tested.
or, you can avoid flashing the whole NOR even when you just want to update a small part of it.

THE METHODS: 
as you can see, the first half of the procedure is similar to the serial updating. so you need the serial cable.
you can use platform builder or a tftp client. 
- platform builder 4.2 works for both hpc2000 and cenet bootloaders. gives you more control over the process, you can jump to the image after download. 
this doesn't matter so much with a cenet bootloader, but greatly matters with hpc2000 bootloaders because those won't try to boot anything from RAM after a soft reset.
- a tftp client is easier to setup (also no need to download GB's for platform builder), but is suitable only for ce.net and only if you load the image in place of the default kernel.
- method without serial requires a special hacked version of bootloader 4.10 (can run on hpc2000 or cenet 900 too) and a hacked update.exe. separate steps for it are described below (scroll down to end of this whole desc).

DOWNLOAD FORMATS: 
- file name: the file name to load is NK.BIN if using platform builder, otherwise boot.bin. this is in the normal flashable format (MS BIN).
- flash vs load: the bootloaders i've tested seem to allow for downloading full OS images and flashing them right away (you definitely need platform builder for that one) or just loading into RAM. whether they are flashed or just loaded depend on the BIN header start addresses.
between 0x80000000-0x82000000 and 0x84000000-0x86000000 it will be flashed in, between 0x90000000-0x94000000 it will be just loaded into RAM.
the bootloader does NOT check whether the image being downloaded has start addresses in bootloader or OS area or RAM. it will just do its job.
hence, extreme caution has to be applied! do not try downloading random images because if they have a start (or end) address somewhere between 0x80000000-0x80040000 or 0x84000000-0x84040000, the existing bootloader code will likely be overwritten with invalid code. if it is between 0x80040000-0x80080000 or 0x84040000-0x84080000, it will just damage the boot splashscreen. anything higher than that, will damage the OS only.
- loading only: you can load kernel (if the bootloader is cenet) or any other code if it is suitable for the environment (hardware initialization etc.).
in this way, the addresses in the BIN headers have to be RAM addresses. so no loading of an ordinary OS image that way. it has to be a RAM OS.
the addresses should also be higher in RAM than the bootloader itself - i.e. can be 0x900E0000, or anything higher than 0x901B0000 or 0x90190000 (depending on bootloader version, 3.x or 4.x) or higher. not recommended to try any addresses (up to and including end address) between 0x90160000 and 0x901B0000/0x90190000!
if you load a ce.net kernel image (useful for testing without having to flash), the kernel will stay in RAM properly after a soft reset too, that's comfortable.
- good thing: you can download and flash a partial OS image too. only the corresponding blocks will be flashed. the rest will stay untouched. (more info on block size later, but probably 0x40000 bytes at most.) for example you can download and flash an OS without updating the kernel.
- not tested/confirmed: the images with RAM addresses probably aren't flashed, just loaded into RAM but don't take my word for that. i have only downloaded stuff with higher addresses then bootloader end in RAM (updater bootloader and kernel images).
warning here: if you aren't in the mood to risk bricking the device, no code should be downloaded to between 0x90060000 and 0x900E0000 and between 0x90160000-0x901B0000 except unmodified normal bootloader (but i bet it would crash the current bootloader anyway).
- more not tested: so far, i have not been able to download a NK.BIN with the cenet kernel attached to its end. but OS only (without kernel), works fine.

UNBRICKING: 
you can also load the updater bootloader for example! suitable for saving bricks. note: since it has been found how to flash an OS BIN over ethernet, the updater bootloader may not be needed any more for this.
anyway here is the method with the updater bootloader: you simply need to load the updater bootloader (start address: 0x900E0000) packaged into a BIN while having a properly named OS image file (BIN too) on an inserted CF card. 
to unbrick a 900c with hpc2000 bootloader on it, you must use platform builder, not a tftp client. 
reasons: 1) if you load the updater bootloader, you need to execute it somehow. only PB can send the command for that (or maybe there is a way to simulate that, this is to be checked out!) 2) if you want to flash an OS image right away, again you need a PB command.
do not try loading the modified normal bootloader this way (that is for ethernet without serial).

here is the updater bootloader image for this purpose: http://hpcmonex.net/nec900/files/specupdaterbootl.zip
note: the OS image to be placed on CF card for flashing by this bootloader has to be named XIR.BIN (not XIP.BIN). due to this, you can use this for RAM OS load method too.



GENERAL STEPS:

1. (after making sure your battery is not low, or if AC adapter is attached), insert the ne2000 card. you can physically connect it to the network now or later but definitely before you enter your selection in the bootmenu. 
the network can be, for example, a normal LAN with a router (that's what i have).

2. have the tftp client ready - or platform builder 4.2. 
platform builder has to be running and waiting in the connect settings menu where you can select the device. 
information on platform builder setup is detailed after the description of these steps. 
as for the tftp client setup: you have to use port 980 and file name boot.bin when uploading!

3. make sure the COM port you're going to use is disabled in activesync etc.

4. run your terminal program (hyperterminal is built in in XP)

5. select 115kbps and software xon/xoff flow control. no parity, 8 bits and stop bits 1.

6. connect your 900/900c with the serial cable

7. to test (as long as you have a bootable OS), turn your 900/900c on (or if it was on, then off and on again!)
you should get 1 line on your terminal, the bootloader announcing itself as bsquare bootloader for MP900 or similar.

8. hard reset your 900/900c. watch the terminal while it is booting. when it tells you to press ESC, do so, be quick.

9. the bootmenu comes up. you won't see anything referring to the ethernet flashing, it is in a hidden menu:

10. simply type the number 91. and press enter.

11. watch the terminal, verify the card connected to the network properly. if you use a tftp client, note the IP address in the terminal.
note: with bootloader 4.10, i was able to get DHCP easily. not so with bootloader 3.0, but it offered me a selection of IP, so i entered it manually and that worked.

12. when you see in the terminal that the bootloader started sending the BOOTME message, you can start the upload in the tftp client after specifying the IP. 
or select the device in platform builder (should appear in the device list at this point) and then start the download.

13. when the upload/download/whatever finished, it should be ready to execute the downloaded image (if it was a RAM image). 
with the tftp client, you can only play with kernel download. you are unable to send the jump to image command, so soft reset the device manually if you are running bootloader 4.10. (the bootloader will not overwrite the newly loaded kernel.)
if you have platform builder you can jump to it right away.



PLATFORM BUILDER SETUP:

some screenshots included to help. they are downloadable from: http://hpcmonex.net/nec900/files/pb42ethernet.zip

1. you first have to get platform builder 4.2 if you don't have it. spare a couple of GB's of space on your disk for it. 
send me an email if you cannot find the download for the evaluation version (email: contactchan at freemail.hu)
2. make a workspace. this is needed to be able to connect. just go to File/New Platform and click through the steps in the wizard. (some minimalist OS will be fine.)
3. now you are ready to connect to the 900/900c. do not have the device in bootloader mode yet. 
4. copy your file named NK.BIN to the release dir of your OS. you can usually find it here: \path for platform builder install\CE420\PUBLIC\yourworkspacename\RelDir\Release
5. go to Target menu/Configure Remote Connection (as image001 shows)
6. add a connection. configure it as you see it in image002: ethernet selected for download.
7. go to the settings tab and configure it as in image003. then go back to first tab (services) and click on "configure..." beside the ethernet selection for download. leave PB waiting there.
8. now you can go to bootloader mode on your 900/900c. have it connect to the LAN and let it start sending the bootme's. now you see something like in image004. select this new device in the list. click OK.
9. be quick!!! close the whole settings window, and now select Target menu/Download/Initialize as shown in image005.
10. it will then pop up a download window as shown in image006 - then pops up another dialog asking about KITL. say NO to it!
11. wait until the download finishes... as in image007 :)
12. after the 900/900c finished executing the downloaded image, etc. etc., you can now close platform builder but first make sure you disconnect as shown in image008. otherwise, if you connect the 900c later again to ethernet, it won't not enter BOOTME sending mode, instead told me it was not going to boot from DOC (the internal flash disk). there must be something platform builder managed to set. 
+13.: to be sure, i included image009-010-011 for additional settings to show how my copy of PB is setup. may not matter.



STEPS WITH NO SERIAL CABLE:

tested only on cenet OS so far (but tested with original 900). quite hack-ish but works. :) based on the normal 4.10 bootloader (cenet).

1. download package from here: http://hpcmonex.net/nec900/files/ezeth.zip
2. place update.exe, UPDBL.NB0 (rename it to UPDBLHPC.NB0 if current OS is hpc2000) on your 900/900c. preferably on a CF card. they have to be in the same folder or root. 
3. insert the ne2000 card NOW. also place the 900/900c on AC (may be edited later to eliminate this requirement)
4. run test_com.exe and type this command in it: w a001e838 1
5. exit testcom
6. run update.exe
7. as soon as you ran it, and while the display still has not changed, you must press and hold R and F keys for a couple of seconds. (it may be edited later to omit this step)
8. release them after screen goes black
9. it should now boot to ethernet flash mode, screen should say so.
10. wait a couple of seconds to allow it to find the card and then DHCP to pick up an IP, maybe 10-15 seconds or so.
11. from here refer to step 12-13 in general steps and/or platform builder setup...
12. ...with the exception that most of the time it will not be able to boot a downloaded kernel (even if done with platform builder). you must press the soft reset button to get it running (this is due to the method being too hackish right now).
13. last note: without a serial cable you can't see how the flashing is going so just wait like 6-7 mins before rebooting.