Альтернативные способы восстановления прошивки с200

Обсуждение Popcorn C200/A200

Moderator: Модераторы

Re: Альтернативные способы восстановления прошивки с200

Postby Reyter on Thu Sep 19, 2013 15:47

Опять я наверняка с дурацкими замечаниями: в другом источнике команда прошивки xos выглядит чуть иначе:
xkc xload 0x1c505 0xa7000000 <size> 0xc4000000
т.е отличаются 0x1c505 и 0x3131, или параметр lkey. Что это за параметр и имеет ли он какое-либо значение - хз. Хотя в доках по smp865x значение lkey такое же, которым вы пробовали прошивать.
TechnoSonic MP101 4MB 162 MHz 8500B DVD-drive: FUSS DV9929B f/w sp-mp-1.51
HDX BD-1 HDD 2TB f/w 4.14
User avatar
Reyter
Administrator
 
Posts: 989
Joined: Mon Nov 01, 2004 11:50
Location: Russia, Ryazan

Re: Альтернативные способы восстановления прошивки с200

Postby Fido on Thu Sep 19, 2013 16:45

None wrote:Eсли-бы xos/ios прогрузились удачно, то загрузка yamon с hdd была-бы возможна только со старого образа выложенного в ветке посвященной восстановлению традиционным способом(до степ-стоне прошивки), более того - если-бы Вы после этого залили в аппарат свой старый, ранее сохраненный, xenv, то удачно-бы восстановили прошивку.

Code: Select all
YAMON> load -b tftp://172.16.x.x/ios.bin.gz_8644_ES1_dev_0006.xload 0xa7000000
.....................................
XLOADING src=0x83000000, dest=0x00190000, size=0x00020a44
Waiting for XLOAD completion...
XLOAD done. status = 0x6 .. OK.

здесь ios загрузился удачно судя по последнему OK?

yamon грузится все тот же(новый)

сравнивал текущий и ранее сохраненный xenv побайтно - отличий нет
Fido
 
Posts: 18
Joined: Tue Jun 19, 2012 11:19

Re: Альтернативные способы восстановления прошивки с200

Postby None on Fri Sep 20, 2013 10:08

Fido wrote:yamon грузится все тот же(новый)

Это говорит о том, что ключи, используемые для дешифровки образа не поменялись, где они хранятся и как меняются я не знаю, по всей видимости не в ios/xos, спрашивайте у bombur-a
Fido wrote:сравнивал текущий и ранее сохраненный xenv побайтно - отличий нет
Так Вы-же писали, что, не сохраняли новый xenv перед первой попыткой восстановления, и, соответственно, прогрузили туда старый, сохраненный до step-stone обновления, поэтому и нет отличий, а как следствие - имеете ту проблему, которую имеете. И еще раз - надо искать способ возвращения старых ключей дешифрации, соответствующих имеющемуся у Вас xenv, по всей видимости эти ключи сохраняются не только в ios/xos. Признаком удачного изменения ключей будет то, что используемый Вами образ загрузки с hdd не будет загружаться, придется записать на диск другой, более ранний.
Полное описание процедуры компиляции и прошивки (для 8654) есть с сигмовской документации:
Code: Select all
Setup the Host System
On the host, you need to setup minicom with the following parameters
Baud rate = 57600 bps.
Data = 8 bits.
Parity = None.
Stop bit = 1.
Flow control = None.
Port = /dev/ttyS#.
These are the default values in most cases.
Configure the network on the host.
Plug-in everything and let us start.




Build the Software




Build toolchain
Untar and build the toolchain from the toolchain package
host> tar xf smp86xx_toolchain_R3.1.tar.bz2
host> cd smp86xx_toolchain_R3.1
host> cp .defconfig .config
host> make oldconfig
host> make
host> source toolchain-path.env


Setup CPU Keys and Utilities
The CPU keys package contains keys and utilities that are needed to build some of the software modules.
host> tar xf CPU_KEYS_SMP86xx_XYZ.tar.gz
host> cd CPU_KEYS_SMP86xx_XYZ
The CPU_KEYS.env file has to be edited to reflect the type (development/production) of the target type. The variables DEFAULT_KEY_DOMAIN, DEFAULT_ZBOOT_CERTID, DEFAULT_CPU_CERTID must be given a value.
For development chips:
DEFAULT_KEY_DOMAIN=8644_ES1_dev
DEFAULT_ZBOOT_CERTID=000b
DEFAULT_CPU_CERTID=0001
For production chips:
DEFAULT_KEY_DOMAIN=8644_ES1_prod
DEFAULT_ZBOOT_CERTID=0000
DEFAULT_CPU_CERTID=0001
The edited file must be sourced before building any of the other packages.
host> source CPU_KEYS.env






Build zboot and zxenv2
This step requires sde-gcc, which can be freely downloaded from MIPS at the MIPS download site.
Untar and build xmboot_ezboot.
If you are not using a Sigma Reference Board, you may need to modify the zxenv2 key values in the config file for your particular board. Otherwise, skip this step and go to the next one. The 922-E2.config serves as the basis for all configurations, with patch files generating the xenv's for specific chips/boards. If you have an SMP8654, you should see the 922-A2.config.patch file. If you have the SMP8644, you should see the 946-E1.config.patch file. You can find these configuration files and patches in the package at xos/xboot2/xmasboot/configs. You can apply the patches like this (substitute either 922-A2 or 946-E1 for <your_board_id> below):
host> cd xos/xboot2/xmasboot/configs/
host> cp 922-E2.config <your_board_id>.config
# If you have SMP8654, use this:
host> patch <your_board_id>.config < 922-A2.config.patch
# ... otherwise, use this:
host> patch <your_board_id>.config < 946-E1.config.patch

# Then, use your favorite editor and you can modify the resulting config file: <your_board_id>.config
Setup your environment and build it:
host> export RMCFLAGS='-DEM86XX_CHIP=EM86XX_CHIPID_TANGO3 -DEM86XX_REVISION=1 -DDEMUX_PSF=1 -DEM86XX_MODE=EM86XX_MODEID_STANDALONE  -DWITH_XLOADED_UCODE=1 -DGCC4_TOOLCHAIN -DXBOOT2_SMP865X=1'
host> tar xf smp86xx_xmboot_ezboot_XYZ.tar.bz2
host> cd smp86xx_xmboot_ezboot_XYZ
host> make zboot
host> export RMCFLAGS=""
If you are using SMP8654, then phyblock0-0x20000padded.922-A2 is the binary that we will flash. If you are using SMP8644, then use phyblock0-0x20000padded.946-E1.
xmasboot.bin.gz_8644_ES1_dev_000b.xload is the binary that we will xload.
# For SMP8654:
host> ls -l ./xos/xboot2/xmasboot/nand_st2/phyblock0-0x20000padded.922-A2
# For SMP8644:
host> ls -l ./xos/xboot2/xmasboot/nand_st2/phyblock0-0x20000padded.946-E1

# For BOTH:
host> ls -l ./xos/xboot2/xmasboot/xmasboot.bin.gz_8644_ES1_dev_000b.xload


Build YAMON


Untar and build the YAMON package
host> tar xf smp86xx_yamon_Release_Candidate_0_R2.13-2.tar.bz2
host> cd smp86xx_yamon_Release_Candidate_0_R2.13-2
host> make yamon-2.13


zbimage-yamon-xload is the binary that we will flash
host> ls -l ./build/yamon-2.13/bin/EL/zbimage-yamon-xload




Build the Linux kernel (Overview)
Since the rootfs image will be linked together with Linux kernel for various reasons (easiness, security, etc.), building the kernel involves a few steps, as outlined below.



Build rootfs (1)
Untar and build the rootfs package
host> tar xf smp86xx_rootfs_Release_Candidate_0_R3.2.tar.bz2
host> cd smp86xx_rootfs_Release_Candidate_0_R3.2
host> make
* Customizing rootfs

Choose Package Selection for the target menu item.
Be sure Customize is chosen.
Save and exit.


Build rootfs (2)
The root file system now needs to pull the runtime shared libraries from the toolchain. To do that, you must define the SMP86XX_TOOLCHAIN_PATH environment variable to point to the main directory of your toolchain. * Compile rootfs in the main rootfs directory
host> make
When done, you have a preliminary root file system to work with the kernel source package in the next step.
When done, rootfs-path.env should be available. Source it.
host> source rootfs-path.env


Build the Kernel (1)
Untar the kernel package.
host> tar xjf smp86xx_kernel_source_Release_Candidate_0_R2.6.22-0.tar.bz2
host> cd smp86xx_kernel_source_Release_Candidate_0_R2.6.22-0
Run make with no argument to be reminded what targets are available.
Run make kernel-source-2.6.22.19 to prepare the kernel source.
host> make kernel-source-2.6.22.19
Your pre-configured Kernel source is ready under linux-2.6.22.19.


Build the Kernel (2)
You now have a regular Linux kernel source tree. Build the kernel
host> cd linux-2.6.22.19
host> make menuconfig
Note: if you are using Fedora Core 7, you may get the error cannot find -lncurses. You can resolve this by copying the libncurses.a from Fedora Core 5 to /usr/lib.
Note: if you are using a Debian-based distribution (e.g., Ubuntu), you need to apt-get -i.
libncurses5-dev
zlib1g-dev


Build the Kernel (3)
Continue building the kernel.
host> make all   
host> make modules
host> make modules_install   // put them in rootfs
After these steps, you have built the kernel modules and they are installed in the root file system package's customization directory.


Build the Kernel (4)
You now built the final kernel image with the correct ZBF header, after pulling the completed root file system from the rootfs package directory. The build system also produces a ROM file system image suitable for flashing, named zbimage-linux-xload.
host> make all zbimage-linux-xload
Kernel image zbimage-linux-xload is in the ./arch/mips/boot/ directory.


Build Proprietary Drivers
Go to the root directory of the kernel source package.
Set the UCLINUX_KERNEL path to the directory of your compiled kernel (be sure to start from root).
host> export UCLINUX_KERNEL=<path to your compiled kernel>
Build the proprietary drivers:
host> make proprietary


Build MRUA SDK
Obtain and uncompress the MRUA SDK package:
host> tar xzf mrua_SMP8654_Release_Candidate_0_3_0_2_dev.mips.tgz
host> cd mrua_SMP8654_Release_Candidate_0_3_0_2_dev.mips
host> source MRUA.env
host> make





The kernel modules are now available under modules/2.6.22.19-tango3-es1 or modules/mips-2.4.30.
The sample applications are now available under bin.


MRUA Firmware Binaries: Obtain and Uncompress the Package
The firmware binaries are separated from the MRUA SDK package for modularity and flexibility. They must be loaded before the applications can use them.
This is what is inside a MRUA firmware binary package:
host> tar xzf mruafw_SMP8654_Release_Candidate_0_3_0_2.mips.dts.tgz
host> ls mruafw_SMP8654_Release_Candidate_0_3_0_2.mips.dts
audio_microcode_tango3.xload
demuxpsf_microcode_tango3.xload
video_microcode_tango3.xload
ios_tango3.xload
All of these binaries need to be made accessible from the target. We will see how to load them later.


Flash the Software
Now all binary files are ready. This page will show you how to flash zboot, YAMON, and the kernel into NAND flash.


Use YAMON's nflash to flash into nand
The process consists essentially in:
Upload the binary from the PC to the board's memory.
Ask YAMON to read the binary from the board's memory and write it on the flash.
The binaries can be safely uploaded to virtual address 0xa7000000 in the board's memory, because we know that there's nothing there when YAMON is running.
In this tutorial, we will upload the contents to the board's memory using UART. Note: you may need to install sharutils package if host reports that you do not have uuencode .
* Some system might have gmime-uuencode instead uuencode.





Flash zboot and z-xenv2 (UART)




The physical block 0 image is called phyblock0-0x20000padded.922-A2 (for SMP8654) and phyblock0-0x20000padded.946-E1 (for SMP8644). You should find this in the smp86xx_xmboot_ezboot_XX release package, after building it (in the location specified in the build section). Examples given below assume use of SMP8654, but you should substitute the filename of the phyblock you are actually using if necessary.
Download the zboot image to the DRAM.
YAMON> load uu -z 0xa7000000
host> gzip -c phyblock0-0x20000padded.922-A2 | uuencode x > /dev/ttyS0
host> cksum phyblock0-0x20000padded.922-A2
Flash the downloaded image to offset 0x0
YAMON> cksum 0xa7000000 0x20000
YAMON> nflash erase -p 0 0x20000 0
YAMON> nflash write -p 0 0xa7000000 0x20000 0
YAMON> nflash read -p 0 0xa7020000 0x20000 0
YAMON> cksum 0xa7020000 0x20000


readback and verify the checksum.




Flash YAMON
Flashing YAMON is tied to flashing xos/xmboot/ezboot.
The bootloader (zbimage-yamon-xload) should be in directory smp86xx_yamon_R2.13/bin
Download the YAMON image to the DRAM then write to offset 0x80000 on flash. Verify checksums at each step:
YAMON> load uu 0xa7000000
host> uuencode zbimage-yamon-xload x > /dev/ttyS0
host> cksum zbimage-yamon-xload
YAMON> cksum 0xa7000000 <size>
YAMON> nflash write 0x80000 0xa7000000 0x40000 0
YAMON> nflash read 0x80000 0xa7400000 0x40000 0
YAMON> cksum 0xa7400000 <size>




Flash xos
Here is the procedure to update xos:
YAMON> load uu 0xa7000000
host> uuencode xosu-xos2D2c-8644_ES1_dev_000a.xload x > /dev/ttyS0
host> cksum xosu-xos2D2c-8644_ES1_dev_000a.xload
YAMON> cksum 0xa7000000 <size>
Verify that the checksum matches. Then:

YAMON> xkc xload 0x1c505 0xa7000000 <size> 0xc4000000


Flash xmboot
To update xmboot:
YAMON> load uu 0xa7000000
host> uuencode xmasboot.bin.gz_8644_ES1_dev_000b.xload x > /dev/ttyS0
host> cksum xmasboot.bin.gz_8644_ES1_dev_000b.xload
YAMON> cksum 0xa7000000 <size>
Verify that the checksum matches. Then:

YAMON> xkc xload 0x1c58007 0xa7000000 <size> 0xc4000000


Flash Linux Kernel
Load image to DRAM and burn to flash at offset 0xc0000
YAMON> load uu 0xa7000000
host> uuencode zbimage-linux-xload x > /dev/ttyS0
YAMON> nflash write 0xc0000 0xa7000000 <size> 0


Run the Software
Boot Linux
At a Yamon prompt, type this command (it is a YAMON macro contained in the xenv):
YAMON> nflash read 0x0c0000 0xa7000000 0x740000 0; dump romfs 0xa7000000; load zbf 0xa7000090; go


After the kernel boots, enter root at the login prompt and press return.
You are now logged in on the Linux system running on your standalone SMP8654!


Load and Run MRUA Driver and Sample Applications
The following procedure assumes that the non-flashed software (MRUA drivers, test applications and firmware) will be accessed through an NFS mount. Other options include a USB or a SATA drive, but they are not described here.
Assume that you have burned the MIPSUtils (boot loader, Yamon and kernel) into the parallel flash as shown earlier.
Start the board, get a Yamon prompt and boot it to the kernel. (See Boot Linux above)
YAMON> $b1
Login as root.
Setup a network if necessary.
target$ ifconfig eth0 172.30.18.113 netmask 255.255.192.0
target$ route add default gw 172.30.0.3
NFS mount to the host where MRUA was compiled. Note: you must have setup NFS on the host first. For this example, we assume that your MRUA packages are on the host under the /export directory and that your host's IP address is 172.30.18.64. Please modify the command line as necessary.
target$ mkdir sdk
target$ modprobe nfs
target$ mount -t nfs -o nolock 172.30.18.64:/export/ /sdk
Setup some useful enviornment variables.
target$ export EM8XXX_SERVER=":0"
target$ export MRUA_PACKAGE_DIR="/sdk/mrua_SMP8654_3_1_0.mips/"
target$ export MRUAFW_PACKAGE_DIR="/sdk/mruafw_SMP8654_3_1_0.mips.dts/"
target$ export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$MRUA_PACKAGE_DIR/lib/
target$ export PATH=$PATH:$MRUA_PACKAGE_DIR/bin
target$ export PATH=$PATH:$MRUA_PACKAGE_DIR/MRUA_src/llad_xtest
target$ export PATH=$PATH:$MRUA_PACKAGE_DIR/MRUA_src/rmchannel/xos2k_client
target$ export PATH=$PATH:$MRUA_PACKAGE_DIR/MRUA_src/llad_smallapps
Create the nodes needed for Sigma's device drivers.
target$ mknod /dev/mum0 c 126 0
target$ mknod /dev/em8xxx0 c 127 0
Insert the llad kernel module. Warning: the path may be different depending on the settings of the UCLINUX_KERNEL that you used.
target$ insmod $MRUA_PACKAGE_DIR/modules/2.6.22/llad.ko
The firmware is loaded using the xkc application.
Load and run the microcode:
target$ DA=$(rmmalloc 0 2340777)
target$ xkc xload 0xcafebbbb $MRUAFW_PACKAGE_DIR/video_*.xload $DA 0
target$ xkc xload 0xcafeaaaa $MRUAFW_PACKAGE_DIR/audio_*.xload $DA 0
target$ xkc xload 0xcafedddd $MRUAFW_PACKAGE_DIR/demux_*.xload $DA 0
target$ xkc ustart 0xcafedddd d
target$ xkc ustart 0xcafedddd D
target$ xkc ustart 0xcafebbbb v
target$ xkc ustart 0xcafebbbb V
target$ xkc ustart 0xcafeaaaa a
target$ xkc ustart 0xcafeaaaa A
target$ rmfree 0 $DA


Load and Run ios
target$ xkc xload 0xcafe0105 $MRUAFW_PACKAGE_DIR/ios.bin*.xload


Insert the EM8xxx module. Warning: the path may be different depending on the settings of the UCLINUX_KERNEL that you used.
target$ insmod $MRUA_PACKAGE_DIR/modules/2.6.22/em8xxx.ko
Sanity test with a basic sample application.
target$ cd bin
target$ ./colorbars
You should see vertical colorbars on the TV hooked up to composite and component output.
Video playback with test_rmfp (composite).
target$ set_outports -analog -f NTSC_M
target$ test_rmfp any_mpeg2_file.mpg
Video playback with test_rmfp (internal HDMI 720p).
target$ set_outports -digital -f HDMI_720p59 -analog -f NTSC_M
target$ test_rmfp any_mpeg2_file.mpg
Тренируйте лоб, ещё очень много не пробитых стен!
User avatar
None
Administrator
 
Posts: 1162
Joined: Tue Nov 02, 2004 10:19
Location: Москва

Re: Альтернативные способы восстановления прошивки с200

Postby Gennadyi on Sat Sep 21, 2013 10:50

к делу не относится, но может кому-то будет полезно
SMP865X Windows CE 6.doc - на китайском !!!
Gennadyi
Moderator
 
Posts: 941
Joined: Mon Nov 01, 2004 16:43

Re: Альтернативные способы восстановления прошивки с200

Postby Mark_V on Wed Jul 23, 2014 20:38

а эти приблуды чем-то могут быть полезны?

_http://hardwarebug.org/2010/05/03/hacking-the-popcorn-hour-c-200/
User avatar
Mark_V
 
Posts: 8
Joined: Mon Jul 21, 2014 14:47

Re: Альтернативные способы восстановления прошивки с200

Postby None on Thu Jul 24, 2014 11:42

Mark_V wrote:_http://hardwarebug.org/2010/05/03/hacking-the-popcorn-hour-c-200/
Актуально было только для очень старых прошивок, на год публикации посмотрите.
Тренируйте лоб, ещё очень много не пробитых стен!
User avatar
None
Administrator
 
Posts: 1162
Joined: Tue Nov 02, 2004 10:19
Location: Москва

Re: Альтернативные способы восстановления прошивки с200

Postby Mark_V on Thu Jul 24, 2014 18:30

None wrote:
Mark_V wrote:_http://hardwarebug.org/2010/05/03/hacking-the-popcorn-hour-c-200/
Актуально было только для очень старых прошивок, на год публикации посмотрите.

с этим ясно

вот еще один сайт с сервисными делами
и завораживающим файлом "repair_loader_with_telnet.zip 70518KB Jan 27 2011 11:16:35"
но он под архивом
http://s1a.andboson.com/Tools/index.php ... order=desc

это или фейк или реальный способ repair_with_telnet
User avatar
Mark_V
 
Posts: 8
Joined: Mon Jul 21, 2014 14:47

Re: Альтернативные способы восстановления прошивки с200

Postby None on Fri Jul 25, 2014 13:41

Mark_V wrote:вот еще один сайт с сервисными делами
Там больше половины у нас содрано. Поверьте, что все возможные и реально работающие методы восстановления сигмовских прошивок у нас так или иначе описаны плюс к тому-же опробированы в условиях сервис-центра (Popcorn, HDX, ViewLab). Представлять интерес могут только материалы и разработки 2013-14 годов.
Тренируйте лоб, ещё очень много не пробитых стен!
User avatar
None
Administrator
 
Posts: 1162
Joined: Tue Nov 02, 2004 10:19
Location: Москва

Previous

Return to Popcorn C200/A200

Who is online

Users browsing this forum: Web crawler and 0 guests