Welcome to GOFASTMOTORSPORTS.com ... ... ... Green Flag - Green Flag - Go Go Go ... ... Brought to you by Ricks Satellite - Where the Big Dish Rules!

Ricks Satellite Wildfeed and Backhaul Forum
Register Latest Topics
 
 
 


Reply
  Author   Comment   Page 3 of 4      Prev   1   2   3   4   Next
techjunkie02

Registered:
Posts: 2,310
Reply with quote  #31 
Is it possible to obtain a full system dump of a AZ Prem + that is running the factory file? Maybe then I could compare that to what I have and see what needs to be done, or find out what went wrong!!

I feel close, but I hate navigating in the dark, blindly following instructions that I'm just praying are correct for what I need. Be much nicer to know what things are supposed to look like, so then I can maybe see what I need to do to fix it [wink]


and a BIG THANKS to all who've given and offered help and suggestions, I really appreciate it !!!

__________________
--- a collection of semi-functional equipment, backed-up by a pile of questionable items!
merkin

Registered:
Posts: 770
Reply with quote  #32 
azbox-0.9.5020-patch.bin (this is Hockeynuts favorite version.  there is one other version worth mentioning which fixes the issue of skipping video when a dolby-e pid is present..i think its version azbox-0.9.5311-patch.bin)
https://drive.google.com/file/d/0B_1SqviRl7imdi1CMWxKcEpMRjA/view?usp=sharing

two days ago i gave you a clear first step to begin fixing this issue and you ignored it.  i am willing to try one more time, but you have to follow instructions.

also you keep saying that you have some difficulties with certain steps in the instructions, but you give no further details.  

what step are you getting hung up on?..are you able to get to the step2 on page22 of the instructions you posted?

if you are able to break the boot process and get a YAMON prompt than you are in business, but if the bootloader is corrupt than jtag is your only option (consider yourself lucky that its not an ELITE model).
wejones

Avatar / Picture

Registered:
Posts: 5,641
Reply with quote  #33 
Quote:
Originally Posted by merkin
.........

if you are able to break the boot process and get a YAMON prompt than you are in business, but if the bootloader is corrupt than jtag is your only option (consider yourself lucky that its not an ELITE model).


I'm curious re what is different about the Elite model?  I thought it was pretty much the same as the Premier other than the hard disk.  Doesn't it have a JTAG connector? 

Also, I'm curious if by chance you know where the bootloader is located on the Azbox?  Is it by chance in one of those MTD0 thru MTD3 sectors?  With the help of a url techjunkie gave me, I determined that the MTD4 is where the kernel is located, and MTD5 is the contents of the /DISK1 directory, but I don't know what is in MTD0 thru MTD3. 


EDIT: I just looked at the contents of MTDBLOCK3 with a binary editor, and it looks like that contains the YAMON thing you mentioned.  What is YAMON?

I'm just curious about how all this stuff works, so I'm investigating what's on my Elite, which is working OK.

EDIT2:  Just looked at MTDBLOCK2, and while it is initially all unrecognizable hex data, there is an area with a lot of text that looks a lot like it might be boot messages.
  Looked at MTDBLOCK1, and it has some text messages suggesting that it's related to setting up the network and other I/O devices.
  Looked at MTDBLOCK0, and initially, up to  &H20000 is the same as MTDBLOCK1, but has a lot more content after that.

merkin

Registered:
Posts: 770
Reply with quote  #34 
the ejtag port is populated on the Elite's pcb, but for some reason it seems the TDI pin on the CPU is disabled..no matter what tap command i send to the debug port, the only response i get is the CPUID..which makes sense because the CPUID is loaded to the register automatically on tap reset, so really just toggling CLK will get you the CPUID, but nothing else.

as far as the other models i cannot speak from experience, but there many reports that jtag access does work.  my personal theory is that the version of XOS running on the SMP8634 in the Elite model has the debug port disabled.  this is not uncommon practice for these "secure" SOCs.  for this particular CPU though, its not so secure as it should be secure https://sourceforge.net/projects/mramc/

i have tried reading the flash from other settops (cable/directv) with similar results.  the developers/engineers purposely lock down the devices.

these SMP8634's are in many devices (think NMT/Popcorn hour)

YAMON is a rom monitor..honestly google can tell you more than i can.

i am not sure where the boot is located on the filesystem, but the tsop flash holds the bootloader and the flash starts at virtual address 0xAC000000

just be careful while you investigate.  if you muck up the bootloader on the Elite, the only way to revive it is to remove the tsop flash and program it externally, then resolder.  i had to do this once and do not want to ever do it again.  if you have smd rework tools, than its not so bad, but i had to do everything by hand with a soldering iron.
techjunkie02

Registered:
Posts: 2,310
Reply with quote  #35 
Quote:
Originally Posted by merkin
azbox-0.9.5020-patch.bin (this is Hockeynuts favorite version.  there is one other version worth mentioning which fixes the issue of skipping video when a dolby-e pid is present..i think its version azbox-0.9.5311-patch.bin)
https://drive.google.com/file/d/0B_1SqviRl7imdi1CMWxKcEpMRjA/view?usp=sharing

two days ago i gave you a clear first step to begin fixing this issue and you ignored it.  i am willing to try one more time, but you have to follow instructions.

also you keep saying that you have some difficulties with certain steps in the instructions, but you give no further details.  

what step are you getting hung up on?..are you able to get to the step2 on page22 of the instructions you posted?

if you are able to break the boot process and get a YAMON prompt than you are in business, but if the bootloader is corrupt than jtag is your only option (consider yourself lucky that its not an ELITE model).



Thank you, and sorry for my confusion. I have gone through this procedure twice now, and although it seemed to be working while I was doing it, in the end, I still only had "BOOTING" displayed on the VFD. The first time, I wasn't sure what I was doing, and I think I made some mistakes. Then I read some more, found another set of instructions that helped make it clearer for me, and completed the procedure again, last night. But still only have "BOOTING" and the only response it has is if i hold POWER button for a second or so, it will display "REBOOT", and then go right back to the "BOOTING" (forever)..LOL!  But, it did respond and do everything via the USB-TTL cable and TFTP, that all worked, but didn't fix it.

__________________
--- a collection of semi-functional equipment, backed-up by a pile of questionable items!
wejones

Avatar / Picture

Registered:
Posts: 5,641
Reply with quote  #36 
Quote:
Originally Posted by merkin
the ejtag port is populated on the Elite's pcb, but for some reason it seems the TDI pin on the CPU is disabled..no matter what tap command i send to the debug port, the only response i get is the CPUID..which makes sense because the CPUID is loaded to the register automatically on tap reset, so really just toggling CLK will get you the CPUID, but nothing else.
.......
.....

YAMON is a rom monitor..honestly google can tell you more than i can.

i am not sure where the boot is located on the filesystem, but the tsop flash holds the bootloader and the flash starts at virtual address 0xAC000000
.....


Thanks for the info on the Elite. Interesting.
I'm a bit confused relative to what I was looking at in those MTDBLOCKs though.
Doing a df on the Elite gives:
Quote:
BJ-Azbox[~]$ df
Filesystem                Size      Used Available Use% Mounted on
/dev/mtdblock5            1.0M    392.0k    632.0k  38% /DISK1
/dev/hda1               135.6M    108.3M     20.3M  84% /MMP
/dev/hda2                15.5M      2.8M     11.8M  19% /PLUGINS
/dev/hda3                 7.7M      4.5M      2.9M  61% /DISK2
/dev/hda4                78.4M     54.3M     20.1M  73% /Download
BJ-Azbox[~]$

I had assumed that the first item, ie the mtdblock5/DISK1 item, was on the flash memory, mainly because I did a google on mtdblock and it came up with documents mentioning drivers for EEPROMs and other similar things. 
  First, am I right or wrong about the MTDBLOCKS being the flash memory? 
If wrong, then what is it?
If right, and it's the flash memory, then I'm confused relative to why you need JTAG or removal of the chip to write to it?  That MTBLOCK5/DISK1 can be written to by remounting it as R/W, so it seems like the other blocks would be accessable in a similar way.  I was reading from them with a dd command. Seems like you could just reverse that to send an image file back to the chip?
  I assume I'm wrong and mixed up but am curious re how and why.  [smile]


majortom

Avatar / Picture

Registered:
Posts: 4,938
Reply with quote  #37 
MTD - Memory Technology Device

In my limited experience it's commonly used in embedded systems where there is limited storage space.
ie - Flash memory is limited.

One should be careful unless you really know the box inside and out. Every embedded system is gonna be different based on the designer's needs. So can't speak one iota bout the specifics of an Az.

Generally speaking, if the device has it's operating system in flash as MTD Blocks (or partitions),
one could archive a copy of the flash, and use mtd-utils on your linux PC to get a better understanding
of how it's laid out.

It's generally gonna be a bad idea to blindly write to MTD partitions without prior knowledge of the repercussions and potential recovery methods if any. For example certain partitions might be checksummed, such that the bootloader won't load it up if it fails a checksum. Or the partition might even be encrypted as written, and decrypted upon boot.

That's why I was pointing ya to a few books on the subject.

rule #1, never write anything to an MTD Partition of any device unless you have a known good complete backup of the flash contents,
and have a means to recover if you screw up.


__________________
Perfect 10 7.5' mesh Chapparal C/Ku Co-Rotor feed, Norsat 8115 CBAND, Norsat 4106A Ku Thomson Saginaw Actuator, Vbox positioner,
Home Brew Polarotor683 Servo circuit. Openbox S9, Prof7500, v4l-updatelee linux drivers installed.
ricardo's geo-orbit archive: https://web.archive.org/web/20150516202529/http://www.geo-orbit.org:80/sizepgs/tuningp2.html#anchor469886
merkin

Registered:
Posts: 770
Reply with quote  #38 
yes, mtdblock5 is the flash..the size is a dead giveaway.

$ cat /proc/mtd
dev:        size      erasesize       name
mtd0: 00800000 00010000 "CS2: Physically mapped flash"
mtd1: 00020000 00010000 "CS2-Part1"
mtd2: 00020000 00010000 "CS2-Part2"
mtd3: 00040000 00010000 "CS2-Part3"
mtd4: 00680000 00010000 "CS2-Part4"
mtd5: 00100000 00010000 "CS2-Part5"

the entire firmware is made up of several parts such as bootloader, yamon, kernel, filesystem,..etc.

try also running the following command for more flash info (replace X with one of the above blocks):
$ mtd_debug info /dev/mtdX

consider this..how will you rewrite the data to the flash if the box will not boot up after a shutdown?  if you write other data to the first block you will corrupt the bootloader.  the next time you turn on the box it will not boot.  the only way to fix the bootloader is by accessing the flash via jtag or programming the flash externally.  

here is a nice slide on the boot process of the smp8634:
http://d1.amobbs.com/bbs_upload782111/files_31/ourdev_570961.pdf

merkin

Registered:
Posts: 770
Reply with quote  #39 
@techjunkie02
not sure what to say at this point.  i thought you were having trouble on some of the steps.  if you went through the entire process without error and it still does not boot than i dont know what could be wrong.

i would like to see the entire boot process.  instead of pressing CTRL+C, let the entire boot process complete and copy+paste the output of the putty window.
wejones

Avatar / Picture

Registered:
Posts: 5,641
Reply with quote  #40 
Quote:
Originally Posted by majortom
MTD - Memory Technology Device

.......
It's generally gonna be a bad idea to blindly write to MTD partitions without prior knowledge of the repercussions and potential recovery methods if any. For example certain partitions might be checksummed, such that the bootloader won't load it up if it fails a checksum. Or the partition might even be encrypted as written, and decrypted upon boot.
.....
rule #1, never write anything to an MTD Partition of any device unless you have a known good complete backup of the flash contents,
and have a means to recover if you screw up.



Thanks.
 
This brings up another Azbox related topic.  The two programs that many {?most?} Azbox users use with the Azbox, ie MAZ and ACC BOTH change the MTD5/DISK1 partition from RO to RW.  And ACC apparently writes to that partition every time you upload.  I haven't detected MAZ actually writing to it but it does make it RW for some unknown reason.  As soon as I realized this, I stopped using ACC, and only used MAZ on a couple occasions.  Back then, I posted several times suggesting that it could be dangerous to even have that partition R/W, even if you don't write to it, because if it's R/W, you could have a power failure and the partition could get corrupted.  And writing to it is bad because that particular partition is used for good backup files, and writing to it makes it possible for corrupted files to become the backups.   But I was told by another member to stop posting warnings that were confusing people, so I gave up.

Chris

Avatar / Picture

Registered:
Posts: 3,227
Reply with quote  #41 
techjunkie here is a step by step, not in English, but easily followed of what i believe you attempted. Try it again and see at what point yours fails.

wejones

Avatar / Picture

Registered:
Posts: 5,641
Reply with quote  #42 
Thanks.
 Yesterday, I used dd to make images of the 6 partitions, just in case, although you're right, if something goes wrong with the first few partitions, I'm probably out of luck.  I was hoping that at least if you can get to that YAMON stage, that it might be possible to replace the kernel, although I don't know what commands are available at that stage. .  I was thinking that techjunkie's kernel might be bad, but the file he used was identical to the mtd4 image I made from my Azbox.
   I'm curious re what "erasesize" implies?
Another thing I'm curious about is that in /dev there are mtdx , mtdxro, and mtdblockx for each value of x, and all three seem to be identical, at least for the ones I looked at.   I assume that the "ro" ones must be backup protection in case there is corruption, but I'm not sure what the difference between the mtdx device and mtdblockx device is? 
  

Quote:
Originally Posted by merkin
yes, mtdblock5 is the flash..the size is a dead giveaway.

$ cat /proc/mtd
dev:        size      erasesize       name
mtd0: 00800000 00010000 "CS2: Physically mapped flash"
mtd1: 00020000 00010000 "CS2-Part1"
mtd2: 00020000 00010000 "CS2-Part2"
mtd3: 00040000 00010000 "CS2-Part3"
mtd4: 00680000 00010000 "CS2-Part4"
mtd5: 00100000 00010000 "CS2-Part5"

the entire firmware is made up of several parts such as bootloader, yamon, kernel, filesystem,..etc.

try also running the following command for more flash info (replace X with one of the above blocks):
$ mtd_debug info /dev/mtdX

consider this..how will you rewrite the data to the flash if the box will not boot up after a shutdown?  if you write other data to the first block you will corrupt the bootloader.  the next time you turn on the box it will not boot.  the only way to fix the bootloader is by accessing the flash via jtag or programming the flash externally.  

here is a nice slide on the boot process of the smp8634:
http://d1.amobbs.com/bbs_upload782111/files_31/ourdev_570961.pdf

techjunkie02

Registered:
Posts: 2,310
Reply with quote  #43 
Quote:
Originally Posted by merkin
@techjunkie02
not sure what to say at this point.  i thought you were having trouble on some of the steps.  if you went through the entire process without error and it still does not boot than i dont know what could be wrong.

i would like to see the entire boot process.  instead of pressing CTRL+C, let the entire boot process complete and copy+paste the output of the putty window.


Here is the log file...txt puttylog.txt     

This time it stopped with the message it was not a zboot file... I don't think it did that the first time I did it, although I was paying more attention to watching for the "CTRL-C" prompt than watching the rest of the output.

If you would, please give me your comments and how you recommend that I proceed from here.

And, Thanks again!!


__________________
--- a collection of semi-functional equipment, backed-up by a pile of questionable items!
merkin

Registered:
Posts: 770
Reply with quote  #44 
the only issue is YAMON is loaded by the bootloader..YAMON is not mentioned on the slide, but its loaded by the second stage bootloader (zboot2).  

when you erase a flash device its done in blocks.  all bits in the block are turned to 1's during erase.  similairly when the flash is programmed, all that happens is certain bits are turned from 1's to 0's.  but you cannot just individually reprogram these "0" bits back to 1's.  the only way to turn a "0" to a "1" is to first erase the entire block which contains the "0", then that block can be reprogrammed (1's > 0's).  if you download the datasheet of the flash it should have all this block erase info.

my best guess is that when @techjunkie02's azbox was updated from the stock firmware, the bootloader was also updated (azbox original bootloader uses sigma's public sdk keys, so this allowed 3rd party developers to re-write/re-sign and use a different bootloader).  


techjunkie02

Registered:
Posts: 2,310
Reply with quote  #45 
Quote:
Originally Posted by merkin
the only issue is YAMON is loaded by the bootloader..YAMON is not mentioned on the slide, but its loaded by the second stage bootloader (zboot2).  

when you erase a flash device its done in blocks.  all bits in the block are turned to 1's during erase.  similairly when the flash is programmed, all that happens is certain bits are turned from 1's to 0's.  but you cannot just individually reprogram these "0" bits back to 1's.  the only way to turn a "0" to a "1" is to first erase the entire block which contains the "0", then that block can be reprogrammed (1's > 0's).  if you download the datasheet of the flash

my best guess is that when @techjunkie02's azbox was updated from the stock firmware, the bootloader was also updated (azbox original bootloader uses sigma's public sdk keys, so this allowed 3rd party developers to re-write/re-sign and use a different bootloader).  




at the end of the log text I posted, it says....

**********************************


* YAMON ROM Monitor


* Revision 02.06-SIGMADESIGNS-01-2.8.0.1


**********************************


Memory:  code: 0x11000000-0x11040000, 0x11200000-0x11204000


reserved data: 0x11240000-0x12440000, PCI memory: 0x12440000-0x12840000


Environment variable 'start' exists. After 1 seconds


it will be interpreted as a YAMON command and executed.


Press Ctrl-C (or do BREAK) to bypass this.

__________________
--- a collection of semi-functional equipment, backed-up by a pile of questionable items!
Previous Topic | Next Topic
Print
Reply

Quick Navigation:

Easily create a Forum Website with Website Toolbox.

Fellow Members, your posts are welcome here! Do not worry about posting everything perfect. Different receivers and LNB's will give you different Frequencies and Symbol Rates. Some set top boxes, PCI cards and USB receivers, Do Not Require all of the same information that others may need. It is not Required to post everything that others may need to tune in a feed. It is just most important to share the find. We can always adjust the Frequency and Symbol Rates and try the various Modulations and FEC's on our own receivers until we get a lock and then give a polite reply with what works for your receiver, as that information might help others as well. We all appreciate the efforts and energy of the Posters!

Thank You for Visiting GOFASTMOTORSPORTS.com - Keep Your Eyes on the Sky and the Track!