Need help on a Motorola 922

BDM (NT) on Star Choice
usbbdm
Posts: 8627
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Thu May 19, 2011 10:06 am

Use "flshdct" to detect the flash type.

wolffie454
Posts: 34
Joined: Mon Jul 05, 2010 12:49 pm
Location: Somewhere in space and time

Post by wolffie454 » Thu May 19, 2011 4:12 pm

\
D0= 00A01031 D1= 00000030 D2= 0000000C D3= 0000000C
D4= 00000000 D5= 00000001 D6= 544F0000 D7= 544F5021
A0= FFB597FC A1= FFB59810 A2= FFB59758 A3= FFB597FC
A4= FFB5974C A5= FFB59794 A6= FFB59740 A7= FFB59730

RPC = 000E976A PCC = 000E9754 SR = 00000000 USP = FFB59730
SSP = FF80396C SFC = 00000005 DFC = 00000005 ATEMP= 00000005
FAR = 000E976A VBR = FF800202


flshdct=
Found Address= 00000000 AMD 29lv160DB

usbbdm
Posts: 8627
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Thu May 19, 2011 6:31 pm

Then you have the flash detected.

wolffie454
Posts: 34
Joined: Mon Jul 05, 2010 12:49 pm
Location: Somewhere in space and time

Post by wolffie454 » Sat Jun 04, 2011 8:05 pm

I realize that, but it won't allow me to write it back to receiver. Why?

It would be great if someone here discovered how to turn updates and ratings ceiling off. There are a lot of free channels still on 4dtv, although hidden and not mapped. I am mapping them in, but some have ratings bug, and updates get trashed by some streams. I know there is a way to toggle updates but I haven't found it yet. TDT overflow seems to have no effect on updates.

Obviously the ratings bug etc is in firmware, so we need to be able to update/modify the firmware.

usbbdm
Posts: 8627
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Wed Jun 15, 2011 9:13 pm

To program the box here is how to get the faster speed.

Code: Select all

Copyright (C) 2010,2011,2012
USB BDM NT    0.49
Target: DSR405
-speed 1
-R
-RESET 1
-R
-init
-FLSHDCT 0
Found Address= 00000000 CFI AMD 29lv160DB
-r a7 ffb5ff00
F:/DCT/jtag/dishird/dsr922/00000000.bin loaded
-PROGRAM plat
Erase starts...
Erase time 00:00:03 (.203)
Program Starts...
Program speed 75.14 KB/s
Program time 00:00:06 (.759)
Program pass, if no further programming needed, power off/on the target
The r r7 ffb5ff00 is important. If this is not set then the program failed.
Slow mode can also program the flash without set r7 but too slow for AMD based flash (8KB/s)
I hope this will help people program the DSR922 and DSR405.
Attachments
TDSR922.rar
(335 Bytes) Downloaded 134 times

azcoder
Posts: 13
Joined: Thu Feb 17, 2011 3:01 pm

TDSR922.xml changes

Post by azcoder » Sun Jun 19, 2011 11:22 am

The ram on the DSR 922 is 2MB. The posted TDSR922.xml shows it starting at 0xffb00000 and size 0x100000. It should be 0xffa00000 and size 0x200000. I have attached the modified file. The DSR920 has a different memory structure, so it will require different settings than the DSR922. Do you have any insight into what they should be?

When you change boot, plat, or app memory how is the new checksum generated? Does USBBDM NT do it, or do we have to do it ourselves? If we have to, how do we generate a new checksum?
Attachments
TDSR922.rar
(331 Bytes) Downloaded 133 times

usbbdm
Posts: 8627
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Sun Jun 19, 2011 12:35 pm

azcoder wrote:The ram on the DSR 922 is 2MB. The posted TDSR922.xml shows it starting at 0xffb00000 and size 0x100000. It should be 0xffa00000 and size 0x200000. I have attached the modified file. The DSR920 has a different memory structure, so it will require different settings than the DSR922. Do you have any insight into what they should be?

When you change boot, plat, or app memory how is the new checksum generated? Does USBBDM NT do it, or do we have to do it ourselves? If we have to, how do we generate a new checksum?
In the DCT2224 there is DLL to do the firmware checksum based on the bootloader. I have not studied the firmware of 922. If you know how to generate it let me know and I might be able to create dll for it. The RAM is not important. To program BDM you only need 128KB memory. (Less efficient than JTAG when normally the ram is much bigger than flash and we can preload full flash and make the programming much faster). Then NVRAM is very important.

azcoder
Posts: 13
Joined: Thu Feb 17, 2011 3:01 pm

Post by azcoder » Sun Jun 19, 2011 4:37 pm

The rom has three different sets of code. Each has its own checksum. Boot is 0-0x3ffc and checksum is at 0x3ffc, plat is at 0x4000-0x7fffc and checksum is at 0x7fffc and app is at 0x80000-0x180000 and checksum (I think) is at 0x175c40. I have not looked at how it is generated. I was hoping you would have a suggestion. The sections of code are connected by pointers in nvram to call various functions, so decoding is going to be pretty tough.

azcoder
Posts: 13
Joined: Thu Feb 17, 2011 3:01 pm

Post by azcoder » Sun Jun 26, 2011 7:03 pm

The checksum for each segment is the sum of the unsigned bytes. Bytes are 0-255 and are added for region start to end - 4 bytes. Checksum is stored in last 32 bit long word of region.

usbbdm
Posts: 8627
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm » Sun Jun 26, 2011 8:33 pm

azcoder wrote:The checksum for each segment is the sum of the unsigned bytes. Bytes are 0-255 and are added for region start to end - 4 bytes. Checksum is stored in last 32 bit long word of region.
That is very easy to calculate then.

Pichardo
Posts: 74
Joined: Tue Jun 17, 2008 11:19 pm

Post by Pichardo » Wed Jan 11, 2012 11:48 pm

The NVRAM has checksum too ?

Keep Trying . . . !

Pichardo
Posts: 74
Joined: Tue Jun 17, 2008 11:19 pm

Post by Pichardo » Thu Jan 12, 2012 7:56 am

usbbdm wrote:That is very easy to calculate then.
The NVRAM has checksum too?

Keep Trying . . . !

Locked