trebisky / esp8266 Goto Github PK

Just a thought, it seems that rcons is the AES RCON. Now, what's lame is that they seem to have hardcoded that address into the ROM, so the AES ROM uses a fixed key schedule, so I think you can only have one thread/context at a time using it.

Hey, ive seen your awesome development at bootrom disassembly, as im not very aware with this processor arch, im looking for a way to disable the bootrom output, at least the bootrom log that is sent during boot.

As i see the main method has this logic
40001069: 054601 call0 400024cc <ets_printf>

What comes to my mind is to edit those first string sent to ets_printf setting first byte to null, which dont require to hex edit, reassamble or or bootrom modification (i dont know if this part is even writable)

3fffd674     db      '\n ets %s,rst cause:%d, boot mode:(%d,%d)\n\n\0'
3fffd700     db      'load 0x%08x, len %d, room %d \n\0'
3fffd734     db      'tail %d\n\0'
3fffd740     db      'chksum 0x%02x\n\0'
...

So just writing a '\0' on the first byte of each string should silence the bootup process

Im not very sure about this processor arch, and how to do it, and not even sure this part is even writable, im total noob on this ic developing, maybe you can help me out with this?

Maybe esptool can be used to just write that bytes? or even using the spi_flash_read/write from bootrom in a custom firmware (https://github.com/sheinz/esp-spi-flash-test)

Regards

Hey, congrats for your work!

Regarding 52MHz startup "issue" it's simple :)

The ESP8266, like any other MCU (+ internal OSC + PLL) can work with a range of crystals, say 24...40 MHz like they initially specify in datasheet. The range is limited by OSC design and PLL's VCO inside lock range.

Appears that default (power on reset) PLL settings is x2 for any given crystal value in that range. This is because they used a 40MHz crystal in their first design. This yields in 80MHz CPU and 80MHz APB clock (peripherals). For UART in instance, there is another hard-coded divider (POR or set by bootloader I didn't check) with value of 694 (or 695), making a nice ~115200 as 1'st stage bootloader baud rate.

Now probably the 26 MHz crystal is cheaper and/or, the EMI requirements didn't pass with 40 MHz so all modules I've seen lately use this value for crystal. Because chip cannot be changed, the CPU (APB, etc) will start on 52 MHz and UART baud rate will be that "odd" 74820 bps.

Regards,
Edi

Fun Repo ;-)
I am coding a boot loader that will detect bad code or power cycles. If detected, it will start an OTA program that will try to download less buggy code. All in the esp-open-rtos eco-system. (ref).
Based on your experiments I wonder if you have an idea how to get a reference for the time that passes in the sequence

• boot loader (t=x)
• user code
• crash/other event
• boot loader (t=y)
• calc y-x

I believe the ROM does not have the system_get_time() call and I have not been able to find an alternative so far.
In RTC memory I could find the WDT values, but I do not yet see how I could leverage those...

Thanks in advance for a slice of your mind,
HacK