ISTR that there was more to it than just enabling the bank; you had to do 8 (junked) accesses first to get the state machine set up correctly. The datasheet does say the right thing here though.

The e000 code is pretty small, you should be able to disassemble it with

arm-elf-objdump -bbinary -marm file.bin (or similar, sorry I can't try it myself).

This outputs the dump in a form that I believe is ok to source into gas. You need to then link it (otherwise forward references aren't fixed up, I believe) and objcopy it to binary - something like

arm-elf-objcopy -O binary input.linked output.bin

Maybe disassemble it again for good measure to check... you should be able to find the debug print code in there near the end (see where it calls it with r0 pointing to an obvious string?) and add some debug just in case everything falls over?

Possibly Peter or John or someone else who still has access to the old empeg cvs might be able to point a little more?

Hugo

edit: forgot to say, I think there are precompiled empeg toolchains around that will do just nicely for modifying this file... but you will need a modified kernel to actually notice the extra memory.