Hi,
I just sucessfully got my own firmware to boot from a Palm IIIx's flash rom. I've seen other people asking on the newsgroups how to do it (with no answers), so I'd like to share it...
There's two bootloaders. One at 0x10c0.0000 and the other at
0x10c0.8000. I believe people have referred to these as the small rom & big roms. The big rom can be repaired if it gets corrupted, so you want to work with this one. And the small rom's bootloader works nicely with a gdb stub written for prctools, so you don't want to mess that one up.
I looked at the source code to the Palm emulator (POSE)--it filled in the missing pieces. The big rom sector is formatted with a "CardHeaderType" data structure. The src told me how this data is used.. At the beginning, you'll see 0xFEEDBEEF data bytes along with a string "PalmCard". These are signature data. See the POSE src (MemoryPrv.h) for details.
This bigrom area mirrors the small one in that the 1st DWORD is the address for the sp & the 2nd DWORD is the address for the pc. For MY rom, it was 0x10c0.823c. I say MY rom because that address changed when I upgraded it--be careful. At that address you'll find a jmp instruction (4e fa 00 d0). NOTE: right after this is a string "boot" followed by 0x2710. I think these are "magic words" for the bootloader, so I wanted to leave them intact.
So, if I did my math right, the above instruction says to jump to
0x10c0.830e. Now, I've never worked with m68k before, so I might be off by 2 bytes (it might be 0x10c08310), but I don't think so. Interestingly, that location is right after the string "ENTRYPOINT" (plus 0x0).
So, I placed my firmware at 0x10c0830e. That's about it.
One more thing. If you blow the big rom, place the unit in debug mode & install the palmos 3.3 "upgrade". That'll restore it.
Hope people find this info helpful...
Jim