Messages

1

Hardware / Re: Pirelli STB HY100 - AZBOX memory configuration

13. Sep 2010, 14:14

Thanks for your answer,

if you mean x.d0.cfg and x.d1.cfg, I alread changed them from:

x.d0.cfg 0xf34111ba
x.d1.cfg 0xe34111ba

to:

x.d0.cfg 0xf34111ba
x.d1.cfg 0xf34111ba


but nothing happens. Any other ideas, please?

Regards

Antonis

2

Hardware / Pirelli STB HY100 - AZBOX memory configuration

13. Sep 2010, 06:36

Hi all,

I have a Pirelli STB HY100 on which I successfully run AZBOX (v0.9.1314 - thanks to mce2222, Hoernchen and all others involved)

After that, I decided to add more RAM so that I make it MORE compatible with AZBOX firmware. I removed the two 32MB chips at dram1 and replaced them with two 64MB chips. So, in total I have:

- 2x64MB=132MB at dram0 (i.e. I haven't touched the dram0 chips)

- 2x64MB=132MB at dram1 (because I replaced the two 32MB chips with two 64MB chips)

In total, this makes 256MB which is the amount of RAM the original AZBOX set top box has.

After that, AZBOX firmware loads and runs as previously but I noticed two problems:

1.The set top is NOT given a valid IP address by my dsl router.
2.The second USB which I am supposed to use for my movies/photos etc is not recognized properly.

After that, I connected to UART1 to see what is going on. Here is the most of the console output:

Code: [Select]


**********************************
* SMP863x zboot start ...
* Version: 2.0.0-2.7.112.1
* Started at 0x91000000.
* Configurations (chip revision: 4):
*    Use 8KB DRAM as stack.
*    Support XLoad format.
*    Enabled BIST mode.
*    Enabled memory test mode.
* PIRELLI-STB based on v.2.7.120.0 DDC-20060519).
**********************************
Boot from flash (0x48000000) mapped to 0xac000000.
Found XENV block at 0xac000000.
CPU clock frequency: 297.00MHz.
System clock frequency: 198.00MHz.
DRAM0 dunit_cfg/delay0_ctrl (0xf34111ba/0x000a8888).
DRAM1 dunit_cfg/delay0_ctrl (0xe34111ba/0x00097787).
Using UART port 1 as console.
Board ID.: "Pirelli STB HY100"
Chip Revision: 0x8634:0x82 .. Mismatched.
Setting up H/W from XENV block at 0xac000000.
  Keeping <SYSCLK premux> to 0x00000203.
  Setting <SYSCLK avclk_mux> to 0x00000000.
  Setting <SYSCLK hostclk_mux> to 0x00000100.
  Setting <IRQ rise edge trigger lo> to 0xff28ca00.
  Setting <IRQ fall edge trigger lo> to 0x0000c000.
  Setting <IRQ rise edge trigger hi> to 0x0000009f.
  Setting <IRQ fall edge trigger hi> to 0x00000000.
  Setting <IRQ GPIO map> to 0x0d000a00.
  Setting <PB default timing> to 0x010e0008.
  Setting <PB timing0> to 0x010e0008.
  Setting <PB Use timing0> to 0x000003fc.
  Setting <PB timing1> to 0x00110101.
  Setting <PB Use timing1> to 0x000003f3.
  PB cs config: 0x000c10c0 (use 0x000c10c0)
  Enabled Devices: 0x00023efe
    BM/IDE PCIHost Ethernet IR FIP I2CM I2CS USB PCIDev1 PCIDev2 PCIDev3 PCIDev4 SCARD
  MAC: 00:1c:a2:a4:07:92
  PCI IRQ routing:
    IDSEL 1: INTA(#14) INTB(#14) INTC(#14) INTD(#14)
    IDSEL 2: INTA(#14) INTB(#14) INTC(#14) INTD(#14)
    IDSEL 3: INTA(#14) INTB(#14) INTC(#14) INTD(#14)
    IDSEL 4: INTA(#15) INTB(#15) INTC(#15) INTD(#15)
  Smartcard pin assignments:
    OFF pin = 0
    5V pin = 1
    CMD pin = 2
  Setting up Clean Divider 2 to 96000000Hz.
  Setting up Clean Divider 4 to 33333333Hz.
  GPIO dir/data = 0x00000000/0x00000000
  UART0 GPIO mode/dir/data = 0x6e/0x00/0x00
  UART1 GPIO mode/dir/data = 0x6e/0x00/0x00
XENV block processing completed.
Found existing memcfg: DRAM0(0x08000000), DRAM1(0x04000000)

I guess the above line should be:
Found existing memcfg: DRAM0(0x08000000), DRAM1(0x08000000)
or am I wrong?

Code: [Select]


Default boot index: 0
MIGRATE PROCEDURE
NO MIGRATE.
Scanning ROMFS image at 0xac280000 (0x48280000) .. Found.
ROMFS found at 0xac280000, Volume name = YAMON_XRPC
Found 1 file(s) to be processed in ROMFS.
Processing xrpc_xload_yamon-normal_ES4_prod.bin (start: 0xac2800a0, size: 0x00039414)
  Checking zboot file signature .. Not found.
  Trying xrpc_xload format .. OK
  Checking zboot file signature at 0x13000000 .. OK
  Warning: header version mismatched.
  Decompressing to 0x91160000 .. OK (527568/0x80cd0).
  Load time total 350 msec.
  Execute at 0x91160000 ..


stand_by 0x0 i 0x40
DISPLAY SPLASHES
ROMFS found at 0xac180000, Volume name = SPLASH_TEST

Trovati 7 files da processare in ROM-FS
Processing 11xrpc_xload_video_ucode_SMP8634_2.7.172.1_facsprod.mips.nodts.bin
(start: 0xac182070, size: 0x0004e9d4)
  Checking zboot file signature .. Not found.
  Trying xrpc_xload format at 0xb3800000 .. Failed (not an xrpc_xload file)
Processing 12xrpc_xload_demux_ucode_SMP8634_2.7.172.1_facsprod.mips.nodts.bin
(start: 0xac206850, size: 0x00007954)
  Checking zboot file signature .. Not found.
  Trying xrpc_xload format at 0xb3800000 .. Failed (not an xrpc_xload file)
Processing 30vsyncparam.zbf
(start: 0xac1d0ae0, size: 0x00001aab)
  Checking zboot file signature .. OK.
  Warning: header version mismatched
(0x02010000 instead expected 0x02000000).
  Decompressing 0xac1d0b00 to 0x10001000 .. Output length: 0x00007dc0(32192)
OK (32192/0x7dc0).
Processing 31bitmap.zbf
(start: 0xac180080, size: 0x00001f84)
  Checking zboot file signature .. OK.
  Warning: header version mismatched
(0x02010000 instead expected 0x02000000).
  Decompressing 0xac1800a0 to 0x17cacdc4 .. Output length: 0x0015223c(1385020)
OK (1385020/0x15223c).
Processing 32xrpc_xload_dviinit_ES4_prod.bin
(start: 0xac2042b0, size: 0x00002534)
  Checking zboot file signature .. Not found.
  Trying xrpc_xload format at 0xb3800000 .. OK
  Checking zboot file signature at 0x13000000 .. OK
  Warning: header version mismatched
(0x02010000 instead expected 0x02000000).
  Decompressing 0xb3000020 to 0xb0400000 .. Output length: 0x000046e0(18144)
OK (18144/0x46e0).
  Execute at 0xb0400000 ..
Processing 33xrpc_xload_irq_handler_SMP8634_2.7.172.1_facsprod.mips.nodts.bin
(start: 0xac1d25f0, size: 0x00031c74)
  Checking zboot file signature .. Not found.
  Trying xrpc_xload format at 0xb3800000 .. OK
  Checking zboot file signature at 0x00000000 .. OK (but no ZBF header)
Processing dvi.bin
(start: 0xac1d0a70, size: 0x00000040)
  Checking zboot file signature .. Not found.
  Trying xrpc_xload format at 0xb3800000 .. Failed (not an xrpc_xload file)
File 31bitmap.zbf found

~~~~~~ hdr=0xac180060 load_addr = 0x17cacdc4 ~~~~~~

inizio bitmap = 0xb7cad3fc, romfs_addr 0xac180000


A valid bitmap has been found:
init the scart controller

selected scart OUT to display splash screen

**********************************
* YAMON ROM Monitor
* Revision 02.06-SD-01-2.7.112.1-PIRELLI-20080619
**********************************
Memory:  code: 0x11000000-0x11040000, 0x11160000-0x11164000
reserved data: 0x111a0000-0x123a0000, PCI memory: 0x123a0000-0x127a0000
Environment variable 'start' exists. After 10 seconds
it will be interpreted as a YAMON command and executed.
Press Ctrl-C (or do BREAK) to bypass this.

Copying...Done

> LZMA kernel loader for smp86xx modified by Hoernchen/t-hack.com
> RAMSTART@0x92000000 RAMSIZE 0x100000 KERNEL_ENTRY@0x90020000
>       icache line size:0x10
>       icache size:0x4000
>       dcache line size:0x10
>       dcache size:0x4000
> enabling REV C USB
> enabing pirelli usb
> gpio get dir 0x0 data 0xf0f
> gpio verify dir 0xc data 0xf03
> lzma data @0x9140045d, lc 1, lp 2, pb 2, osize 3893687
> unpacking, please wait...
> blast d-cache, i-cache & start

Linux version 2.6.15-sigma (root@debian) (gcc version 4.0.4) #61 PREEMPT Sun Jun 21 23:18:05 CEST 2009
<4>Configured for SMP863x (revision ES6/RevA), detected SMP8634 (revision ES7/RevB).
Configured for SMP863x (revision ES6/RevA), detected SMP8634 (revision ES7/RevB).
prom console registered
SMP863x/SMP865x Enabled Devices under Linux/XENV 0x48000000 = 0x00023efe
BM/IDE PCIHost Ethernet IR FIP I2CM I2CS USB PCIDev1 PCIDev2 PCIDev3 PCIDev4 SCARD
Valid MEMCFG found at 0x10000fc0.


Does the above mean that the memory size is somewhere hardcoded? If so, where?

Code: [Select]


CPU revision is: 00019068
Determined physical RAM map:
memory: 0bfe0000 @ 10020000 (usable)
User-defined physical RAM map:
memory: 06be0000 @ 10020000 (usable)


Do the above lines reflect the real situatuion?

Code: [Select]


On node 0 totalpages: 93184
  DMA zone: 93184 pages, LIFO batch:31
  DMA32 zone: 0 pages, LIFO batch:0
  Normal zone: 0 pages, LIFO batch:0
  HighMem zone: 0 pages, LIFO batch:0
Built 1 zonelists
Kernel command line: console=ttyS0 root=/dev/sda1 rw rootdelay=20 mem=108m
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 16kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 2048 (order: 11, 32768 bytes)
Using 148.500 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 103040k/110464k available (3142k kernel code, 7296k reserved, 509k data, 148k init, 0k highmem)
Calibrating delay loop... 292.86 BogoMIPS (lpj=146432)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
tangox: creating TLB mapping for 0x20000000 at 0xc0000000, size 0x04000000.
PCI: Initializing SMP863x/SMP865x PCI host controller
PCI: Remapped PCI I/O space 0x58000000 to 0xc4020000, size 64 kB
PCI: Remapped PCI config space 0x50000000 to 0xc4004000, size 10 kB
PCI: Configured SMP863x/SMP865x as PCI slave with 128MB PCI memory
PCI: Region size is 16384KB
PCI: Map DMA memory 0x10020000-0x16c00000 for PCI at 0x11000000
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
Created /proc/cpucache_info entry.
Initializing Cryptographic API
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered
Software Watchdog Timer: 0.07 initialized. soft_noboot=0 soft_margin=60 sec (nowayout= 0)
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 10) is a 16550A
serial8250: ttyS1 at MMIO 0x0 (irq = 9) is a 16550A
tango2_enet: ethernet driver for SMP863x internal mac
tango2_enet: detected phy at address 0x01
tango2_enet: mac address 00:1c:a2:a4:07:92
Uniform Multi-Platform E-IDE driver Revision: 7.00alpha2
ide: Assuming 50MHz system bus speed for PIO modes; override with idebus=xx
ide0: SMP863x/SMP865x Bus Mastering IDE controller
Probing IDE interface ide0...
physmap flash device CS2: 4000000 at 48000000
CS2: Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
CS2: Physically mapped flash: CFI does not contain boot bank location. Assuming top.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Using physmap partition definition
Adding partition #1-#9
Creating 9 MTD partitions on "CS2: Physically mapped flash":
0x00000000-0x00020000 : "CS2-Part1"
0x00020000-0x00120000 : "CS2-Part2"
0x00120000-0x00140000 : "CS2-Part3"
0x00140000-0x00180000 : "CS2-Part4"
0x00180000-0x00280000 : "CS2-Part5"
0x00280000-0x002c0000 : "CS2-Part6"
0x002c0000-0x004c0000 : "CS2-Part7"
0x004c0000-0x006c0000 : "CS2-Part8"
0x006c0000-0x04000000 : "CS2-Part9"
physmap flash device CS3: 4000000 at 4c000000
CFI: Found no CS3: Physically mapped flash device at location zero
ohci_hcd: 2005 April 22 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI)
USB Universal Host Controller Interface driver v2.3
driver tangox-ehci-hcd, 10 Dec 2004
TangoX USB initializing...
tangox-ehci-hcd tangox-ehci-hcd: TangoX USB 2.0
tangox-ehci-hcd tangox-ehci-hcd: new USB bus registered, assigned bus number 1
tangox-ehci-hcd tangox-ehci-hcd: irq 48, io mem 0xa0021500
tangox-ehci-hcd tangox-ehci-hcd: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
TangoX USB was initialized.
Initializing TangoX USB OHCI Controller Polling mode, Membase=0xa0021500 Status=0x0
tangox-ohci-hcd tangox-ohci-hcd: USB Host Controller
tangox-ohci-hcd tangox-ohci-hcd: new USB bus registered, assigned bus number 2
tangox-ohci-hcd tangox-ohci-hcd: io mem 0xa0021500
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
Initializing USB Mass Storage driver...

All in all, is this a software issue that I can fix? Or does it mean that there is some problem with the two memory chips I used?


Any help on the matter is GREATLY appreciated. Thanks in advance

Antonis

3

WinCE / Re: BT Vision (DIT7421, DIT9719): Step By Step

24. Jul 2010, 07:46

Thank you both is0-mick and DarkNeo,

This is very bad news indeed. I guess there is nothing useful I can EASILY do with the box right now, is there?

A new TV client from scratch would be the best approach, I suppose. I am a programmer myself (I own www.winasm.net) but I have no .net skills for the time being. If we have DarkNeo's starting skeleton, I will be deeply involved and try to learn as much as possible and contribute.

Looking forward to your replies,

Antonis

4

WinCE / Re: BT Vision (DIT7421, DIT9719): Step By Step

23. Jul 2010, 09:44

Hi again!

Ok, I made a little progress 

The TV2ClientCE.exe file I should patch resides in ETC.bin and not in NK.BIN. Most questions are still valid:

1.What should I search for in TV2ClientCE.exe file to patch? The available info on the TV2ClientCE.exe file is VERY limited. Any help on this matter is highly appreciated.

2. I tried to use the nkpatcher.exe by Dark Neo that adds support for disabling the Watchdog but failed miserably. Here is what I got :
Index was out of range. Must be non-negative and less than the size ...

Any ideas why ?



All in all, did I do anything wrong? Do I need to do anything else that haven't done yet?

Looking forward to your kind support,

Regards,

akyprian

5

WinCE / BT Vision (DIT7421, DIT9719): Step By Step

23. Jul 2010, 08:45

Hi all,

I have been reading and implementing a lot lately; Here is what I have come up with:

1. I own a DIT7421/05 (the one with the JTAG on board but with the pull up resistors missing). I managed to build the modchip and it is working proplerly. If anybody wants any help with this box on this matter, please let me know.

2. I extracted default.hv and boot.hv from NK.BIN using:
binmod.exe -e default.hv
binmod.exe -e boot.hv

3. I replaced SigCheckFilter.dll to SigCheckFilter.dl1 in both (default.hv and boot.hv) files.

4. I inserted the modified default.hv and boot.hv to NK.BIN using:
binmod.exe -r default.hv
binmod.exe -r boot.hv

5. I used the ORIGINAL nkpatcher.exe by Iso-Mick and all was OK.

6. I tried to use the nkpatcher.exe by Dark Neo that adds support for disabling the Watchdog but failed miserably. Here is what I got :

Index was out of range. Must be non-negative and less than the size ...

Any ideas why ?

7. I copied the patched BootstrapDiag.xml, Start.xml, tv2config.xml found on t-hack to \Hard Disk\TV2ClientCE\Content.

8. I dumped the contents of the nk.bin with:

-viewbin.exe nk.bin

-cvrtbin -r -a START -w 32 -l LENGTH nk.bin

-dumprom.exe -d dump -v -5 nk.nb0

Now I have the contents of the nk.bin in the directory "dump".

The files I got are shown on the picture attached. I have read here on t-hack that there should be a TV2ClientCE.exe file among them. As you can see, there is NO such file. Any ideas? I also read that the TV2ClientCE.exe file that resides in  \Hard Disk\TV2ClientCE\  is dummy and is NOT used at all.

Which  TV2ClientCE.exe file should I patch? What should I search for in TV2ClientCE.exe file to patch?

The available info on the TV2ClientCE.exe file is VERY limited. Any help on this matter is highly appreciated.

All in all, did I do anything wrong? Do I need to do anything else that haven't done yet?


Looking forward to your kind support,

Regards,

akyprian