?
Solved

recover firmware - reflash nand flash ?

Posted on 2010-03-28
101
Medium Priority
?
4,688 Views
Last Modified: 2012-05-09
I have a realtek rtd1283 chipset based HDD Multimedia player with 2 GB Nand Flash.
The official firmware is a linux based operating system. Linux 2.6.12.6-VENUS is used. The environment uses BusyBox 1.1.3 Built-in shell .
It boots from the nand flash.
it  supports also a Hard disk and a usb external HD.
I installed on it a wrong firmware and now the response of the player is just a screen showing " wrong hardware" and it is hanged. I cannot do anything to see the old menu to upgrade the firmware ( I have the img. file of the right firmware)
If I connect the player to a PC I can see the internal HD of the player.
The player has not any button to Restore to Factory Setting/Defaults
I Tried all options on remote control but there is no resposnse from the player
I Cannot anymore acces it using Putty.
I can just turn on/off it

What can I do to reinstall its own firmware.?
If I have to reflash the nand flash how to do it?
many thanks
0
Comment
Question by:oilitta
  • 54
  • 33
  • 8
  • +1
101 Comments
 
LVL 47

Expert Comment

by:David
ID: 28923890
A firmware image is an operating system. When you flash it, you just tell the boot loader to install the update and overwrite what it booted before.  Once the process completes, then the revised firmware is there, and is nonvolatile.  The only way to get things back is generally to send it back to the factory where they hook it up to some specialized hardware.  

Some of the boot loaders (like those in most hard drives, look at header information in the image to determine if the incoming firmware is appropriate for the particular disk AND firmware family.  If not, the bootloader spits out an error code and rejects everything else.

In your case, this did not happen. The boot loader completed.  Now your HDD is booting the revised firmware that does not belong.  You "bricked" it.  Sorry, you are scr*wed.  Contact the manufacturer and hope that they can de-brick the unit at the factory, and it will cost less than buying something else.

So sorry.
0
 
LVL 47

Expert Comment

by:David
ID: 28936303
.. equate your problem to the equivalent of overwriting the first few MB of your PC's C:\ drive with the contents of the embedded LINUX running in a Tivo.   It is a one way trip ... no going back.  Your multimedia player no longer *knows* how to flash firmware.
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 28960940
Sorry, but I am not so pessimist.
First you should find if it is possible to access the device via serial port - some embedded hardware have a "console" port that is a simple serial port.
Connect to it and open a serial terminal (hyperterminal under windows or minicom under linux), and see if when booting it shows dome message.
Maybe you can access the bootloader,  sometimes that kind of hardware allows it. If for example the bootloader is uboot ( http://www.denx.de/wiki/U-Boot ), you can write to the nand flash by issuing some command.
Only if you don't have access to the bootloader you are definitely locked out (but it's not perfectly true, you could also have access via JTAG connector, but it becomes too difficult to be done at home, without proper knowledge).
Check that, we'll see what to do after you have this answer.
0
Learn to develop an Android App

Want to increase your earning potential in 2018? Pad your resume with app building experience. Learn how with this hands-on course.

 

Author Comment

by:oilitta
ID: 28978860
HappyCactus,  I do not think it has a serial port anyhow here is the manual so you can understand better what it is and the ports it has.
HD18R-User-s-manual-Dayfly.pdf
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 28979899
oilitta, I intended to say that you must/should open the device... The serial port is generally reserved for servicing.
I forgot to mention that you could need some (little) experience in electronics...
0
 

Author Comment

by:oilitta
ID: 28981289
Thanks happycactus. I will open it an try to find if there is any pin ( any slot free) where to connect something.
0
 

Author Comment

by:oilitta
ID: 29077156
HAppycactus, I opened it and I saw that there is just one plug and it says is an UART, do you think it may help to solve the problem?
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29078024
yes it is. what kind of connector it is?
0
 

Author Comment

by:oilitta
ID: 29082468
Here is the image
60--compleanno-021.jpg
0
 
LVL 47

Expert Comment

by:David
ID: 29083914
... and let's say you figure out which 3 pins to connect to an RS232 interface without frying anything, have the correct baud rate and get an OK prompt.  Then what. Do you have an image you can install?   I see this as an interesting diversion, but pointless w/o an appropriately packaged firmware image to upload. How do you know that the image you do have wasn't encapsulated in such a way that it is even compatible.

I am not saying this won't work, I am saying that time might be better spent watching grass grow :)
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29085365
nobody said that it would be simple for a nonexperienced user.
Surely, it is simpler to send it to the assistence.
0
 

Author Comment

by:oilitta
ID: 29085642
I have the right install.img file.
0
 

Author Comment

by:oilitta
ID: 29085762
I cannot send it to an assistence center because I bought it from internet and there are no assistence centers I Know.
0
 

Author Comment

by:oilitta
ID: 29086744
I found on internet this scheme ( I can build it). Do you think it can help?
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29086777
Almost surely you'll need a ttl to rs232 converter. it's a simple circuit, but of course you'll need a bit of experience with soldering electronics components. You can find a schematic of the circuit here: http://www.scienceprog.com/simple-ttl-to-rs232-adapter/
If you do not know what I am talking about, you'll better address to someone with this experience, maybe a electronic repairing labs or an hobbyst.
0
 

Author Comment

by:oilitta
ID: 29087585
Do not worry happycactus, you are trying to give me the only solution possible , I think.  II will try if The alternative is to throw it. But what exactly I have to do after obtaining a working connection between the player and the PC?
0
 

Author Comment

by:oilitta
ID: 29087819
I mean how to install the .img file .
0
 
LVL 47

Expert Comment

by:David
ID: 29087827
No, you have a firmware image designed for the boot loader that is no longer running.  think about it. If the former boot loader was operational, then you would not have to go through this exercise.  What if the old boot loader grabbed a byte count from the first 4 bytes, and the actual firmware image started.   How do you know that the embedded loader does the same?  You don't.
0
 

Author Comment

by:oilitta
ID: 29089396
diethe, sorry but I'm not expert i this matter and maybe i make silly questions. But how do they put the firmware into flash nand the first time?
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29089677
dlethe,

sorry, but I do not agree with you.
Under linux and arm platform you have at least 3 images: a bootloader that is installed in the very first "sector" of the flash, the kernel image and the root partition image.
Frequently, the bootloader is installed in a section that is protected from writing; the update image just updates the kernel and the root partition images, and let the bootloader untouched. Sometimes the bootloader is installed in a different flash (NOR flash) and the other in NAND flash. But not ever. These are design issues.
It should be very stupid to update all the three images, because in case of failure (as is the case), the bootloader keeps working, otherwise you should update it via JTAG, that is very expensive in terms of assistence costs (you need a specific jtag cable). Generally (not ever!) the update process only changes the kernel and the root, that are simply writable from the bootloader: uboot can update the flash by accepting the images from the serial cable but also from the ethernet, and it can also run from ethernet.

So, the image the author haves CAN be an image that CAN be loaded only from the running system, but it, maybe, CAN be loaded via bootloader, you can only say it by trying.

Again, it is not simple, but if you have time to spend and want to try...

@ oilitta,

you have to identify two pins that are TX and RX, I see from the photo that there are many writings on the PCB, so see if they are identified. if it is, you have to take vcc, gnd, tx and rx to the circuit I posted.
On the other side of the circuit, you'll have a standard serial port that you have to connect to your pc.
Pay attention to VCC and GND, this is certainly the one thing that can fry your circuit and your player. Help yourself with a voltmeter / tester.

When you have the circuit ready, you have to open minicom or hyperterminal and try to connect at various baudrates - 9600, 38400, 115200 , are the most frequently used, with 8bit data, 1 stop, no parity.

If you see a prompt, you are connected with the bootloader. After that, you must try if you understand what kind of bootloader it is, but I am confident that you'll find uboot.

Hope that helps, for now...
0
 

Author Comment

by:oilitta
ID: 29091038
happycactus, you are giving me a hope. Thank you very much .  I have time to try what you suggested. And even it will not work ( for my incompetence ) You gave me a lot of useful information. Do you think the scheme I posted is OK for our purpose?
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29092280
I think it is incomplete. this one is ok http://www.scienceprog.com/simple-ttl-to-rs232-adapter/ , only pay attention that the connector JP1 is not right, because the pin numbering are referring to some other hardware. I would also put an additional capacitor between VCC and GND, but ok, it should work as is.
Hope that helps

Ciao

0
 

Author Comment

by:oilitta
ID: 29092607
CIAO!  :-)
0
 

Author Comment

by:oilitta
ID: 29357387
Happycactus, I made the Rcs232 to TTL device but I think that the IC I used (Max232N ) is not the right one because it works at +- 5V . I measured the output from the UART  and the result is as in the image (3,5 V).
I tried to connect to the device using an Hyperterminal and it says that is connected to com2 but I cannot write anything inside it . The cursor is blinking but I cannot write anything. If the 2 devices are connected what I have to see on the Hyperterminal?
Moreover,please, Try you to understand the right connections between the UART and the interface ( the  project you suggested is surely for a different device). I think the right pin numbering on UART is from the left to right ( 1 to 6 ).
thanks
Image3.jpg
0
 
LVL 12

Assisted Solution

by:HappyCactus
HappyCactus earned 2000 total points
ID: 29358248
You can use the max3232 ( http://focus.ti.com/lit/ds/slls410i/slls410i.pdf ) that accept both5V and 3.3V.
You can take the ground soldering to one of the holes with the GND writing (just above the UART writing, in the img you posted).
the VCC can be the pin near the "6", but you should try.
make some test - start with the output (soldering RIN1 or RIN2 - pin 8 and 13 of the max3232)...

Hope that helps...
0
 

Author Comment

by:oilitta
ID: 29369109
OK. Tomorrow I will try to find the max3232.  Soldering Rin1 or rin2 to what ? the connections of the IC aren't the same of the scheme you sent and I used?
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29372110
Sorry, I made a mistake.
I intended to say T2IN in the scheme I provided before. The two ICs are pin-to-pin compatible.
0
 

Author Comment

by:oilitta
ID: 29375237
:-)
0
 

Author Comment

by:oilitta
ID: 29375696
T2IN ? there is any T2IN.  Do you mean DOUT2 ?
MAX3232.jpg
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29423774
Max232 and Max3232 have the same pin numbering.
So refer to the scheme I gave you: http://www.scienceprog.com/simple-ttl-to-rs232-adapter/
T2IN must be connected to the output of the board and brings data that the device send to the PC. I would start from that one. the pin is the 10 both on 232 and on 3232.
When you have found it (an hyperterminal should show some prompt), start looking for R1OUT/ROUT1 (pin 12). You find it when in the hyperterminal you see what you write.

Hope that helps
0
 

Author Comment

by:oilitta
ID: 29458017
I could not find the MAX3232. Do you think it is the same thing  using MAX232 powered from an external +-5V source ( of course not using the VCC and the GRD coming out from the player)?
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29458381
You can try to use the 3.3V of the player, but it is very unreliable. If you want to try to use an external 5V, you have also to connect the GND of the player with the minus of the power supply...
pay attention!
0
 

Author Comment

by:oilitta
ID: 29461930
I already tied to use the 3.5 power of the player but without results. I will try an external source as you suggested.
0
 

Author Comment

by:oilitta
ID: 29475126
I connected the PC and the device ( without connectictig the - of the power to the GRD ) when I turned on the player this is what I got from the Hyperterminal
4 || BB0bt
0
 

Author Comment

by:oilitta
ID: 29475699
I tried to write something but I can do it only if I check in properties ===>settings===>ASCII setup ====>Echo typed characters  locally
Going on?
0
 

Author Comment

by:oilitta
ID: 29476024
I connected also TX and now I can write into the terminal without checking the ASCII box. I think I'm connected to the player. And now?
0
 

Author Comment

by:oilitta
ID: 29476881
I used also winComm and when I connect to com2 ( and the player connected ) this is the result
Read byte from COM2: 1e, ffffffc0, 00, fffffffc
Read byte from COM2: 00
Read byte from COM2: fc
Read byte from COM2: 00, fffffffc
Read byte from COM2: 00
Read byte from COM2: fc, 00
Read byte from COM2: fc
Read byte from COM2: 00, fffffffc
Read byte from COM2: 00, fffffffc
Read byte from COM2: 00
Read byte from COM2: fc, 00
Read byte from COM2: fc
Read byte from COM2: 00, fffffffc
Read byte from COM2: 00
Read byte from COM2: fc, 00
Read byte from COM2: fc
Read byte from COM2: 00, fffffffc
Read byte from COM2: 00, fffffffc
Read byte from COM2: 00
Read byte from COM2: fc
Read byte from COM2: 00, fffffffc
Read byte from COM2: 00, fffffffc
Read byte from COM2: 00
Read byte from COM2: fc, 00
Read byte from COM2: fc
Read byte from COM2: 00
Read byte from COM2: fc, 00
Read byte from COM2: fc, 00
Read byte from COM2: fc
Read byte from COM2: 00, fffffffc
Read byte from COM2: 00, fffffffc
Read byte from COM2: 00
Read byte from COM2: fc
Read byte from COM2: 00, fffffffc
Read byte from COM2: 00, fffffffc
Read byte from COM2: 00
Read byte from COM2: fc
Read byte from COM2: 00, fffffffc, 00
Read byte from COM2: fc
Read byte from COM2: 00
Read byte from COM2: fc, 71
0
 

Author Comment

by:oilitta
ID: 29483396
when both T2IN and R1OUTare connected and I turn on the player nothing happens into Hyperterminal.  If I write something and press return the cursor goes back at the begining of the row.
 If I use WinComm and try to send something (E.G. 1) the response is :
Sending data:  Failed to write 01 to COM2 (6).  
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29485065
I think that it is working, you only have to find the correct baudrate.
0
 

Author Comment

by:oilitta
ID: 29487239
I will try to change the baudrate . What do think should be the response of the player?
0
 

Author Comment

by:oilitta
ID: 29504020
Using terminal instead of hyperterminal ( it seems to me works  better and has a lot of options)  https://sites.google.com/site/terminalbpp/Terminal20091126.zip?attredirects=0

1) Connecting only T2IN  every time I change baud rate and reconnect to com2 I get strange symbols ( AscII ) but it can be viewed also in HEX .

2) connecting both T2IN and R1OUT changing BAud rate doesn't happen anything. But it seems I'm able to send files to the player I sent a .txt file and it seemed was  transmitted. I tried so send the same file using Hyperterminal and it was transmitted(I think so because I didn't get any error message) and into the window of Hyperterminal appeared the text contained in text file.

3) I tried to send the same file with R1OUT not connected and of course nothing happened.
I used 19200 baudrate

Now, if the connections works what I vave to do?



0
 
LVL 47

Expert Comment

by:David
ID: 29725843
.. still standing on the sidelines all pessimistic, but interested, and hope I am wrong and you can bootstrap this.    

Since happy isn't around ... here are a few things to look into. Specifically, the parity, # of data bits, and number of stop bits (since you are only using 3 wires, then flow control needs to be either disabled or XON/XOFF)

9600, 8/N/1  (8-bit, no parity, 1 stop bit is common with many of the storage controllers I work with), I rarely see odd parity, but do see even parity.  I would say that 9600 is highest probability, followed by 1200, then followed by 19200. I can't remember seeing any other factory default baud rate.

Autobaud is also a possibility,

And, of course, you have no idea if it is waiting for you to type in some special sequence of keys.  I've worked with some  controllers that would ignore everything until it received just a capital "E".
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29770611
Hi again.
The most used baudrate is 9600 but with linux and bootloader like uboot I've seen 115200 and 38400. 8n1 is almost universally used. Even Parity is used sometimes, when the stop bit is ignored by one side, but I am confident that this is not the case.
No Flow Control is used almost ever. If you see junk data arriving, this means that the connection are probably ok, if you press a key and see junk data arrive, this can means that you only have to check the speed.
You do not need to disconnect the cable all the time, just change the software configuration (baudrate) and restart the player by powering down/up.
Hope that helps  
0
 

Author Comment

by:oilitta
ID: 29818043
OK, I understood about baudrate etc. But if the baudrate and the other settings are OK, what I have to get back from the device. Whrn it worked and I accessed it using Putty I was asked to insert the root password and then I had access into the root dir. Have I to get the same thing?
0
 

Author Comment

by:oilitta
ID: 29818092
Sorry. Happy Easter!!
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29818874
oilitta,

You should have some readable message, a prompt or maybe some error message.
It could be a some naif bootloader that do not show any readable message, but I do not think...
0
 

Author Comment

by:oilitta
ID: 29894134
Happy, I tried all the baudrates, but from the devices no response if tx and rx are connected when I connect/disconnect from it.
1)  I get strange symbols only with TX not connected.
2) with rx and tx connected, if I send something ( see the image) the response from the device is the same word I typed in and sent.
3) the toolbar at the bottom says that RX is OK
Any Idea?
terminal.jpg
0
 

Author Comment

by:oilitta
ID: 29894696
One more Thing : if the TX is non connected,as I already told, I get strang things from the device, but at the bottom toolbar it doesn't say any more "RX OK" but "FRAME ERROR"
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29894761
I can't see in your image if the "local echo" is enabled or not. it should not. If it is not enabled, it seems that your connection is working. what happens if you change to 38400 or 115200 bps? does it receive what you type? What if you type something while the player is off?
Secondly, what does it show if you power down and up while connected? do you see some message?

If you see what you type only when connected at 9600 bps and the player is on, it means for sure that it is working. You should see something when you power on the player, does it?
If you do not see anything but the connection is good, it means probably that also the bootloader is broken, you can throw away your player... if you see some message, please, post it.

0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29894878
if tx is unconnected, it catch noise and interprets it as a start frame, so the errors and the strange data. it must be connected
0
 

Author Comment

by:oilitta
ID: 29920170
Happy, I cannot find any option  regarding local echo in Terminal v1.9b (while it exixts in windows terminal ). Anyhow you can download it just to understand the software I'm using ( https://sites.google.com/site/terminalbpp/Terminal20091126.zip?attredirects=0) .

1) :-(    Yes, If the device is  off and I send something it appears in the Receive window

2) If I type something and send it I can see the word in the "receive window" whatever baudrate I use.

3)If  I  change the baudrate less than 38400  and  send something, at the toolbar in the bottom appears RX OK. If I use a baudrate higher than 38400 appears "Frame Error"

4) If I  power down and up while connected nothing happens. Anything appears in the receive window.

5) I Do not think that the bootloader is broken, because when I connect the player to the TV underlied the grey box telling "incorrect hardware" I can see the OSD menu ( the language menu )
terminal.jpg
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29921984
So it seems like some connection is not properly done.
Are pin 15 and 16 connected to vcc and gnd?  Are all the capacitors connected correctly? are tx and rx connected? start again in searching the transmit contact on the connector by connecting pin 7 of the max3232 with the serial connector (as shown by the scheme I provided you) and by trying each contact on the board connector with the pin 10 of the max3232, until you read something on the terminal. try every time with all the baudrate available.
Can you show me the connection you made?
0
 

Author Comment

by:oilitta
ID: 29922218
If I use 115200 baudrate and turn on/of the player I get this :
> ÿÏüÿÿäþïïïß¿ÿ>ÿÿþÿþþ>Œÿø øŽŸÿÿÿÿÿÿïïïßÿÿþþ>
0
 

Author Comment

by:oilitta
ID: 29924030
OK, I will check all again, even if I'm sure the connections are OK.
0
 

Author Comment

by:oilitta
ID: 29924407
See you later. Anyhow , Happy, thank you very much to be so patient with my problem.
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 29924961
Oilitta, no problem. I would help you even more, with proper instrumentation (that I have in my laboratory) it would be simpler, I understand your difficulties...
0
 

Author Comment

by:oilitta
ID: 30052703
Happy, I tried all connections and they are OK. (till now i tried without connecting the device to TV). Today I connected the TV and I saw that (with rx and tx connected ) the device hangs showing on the screen only the word "Loading" . If I connect one ( rx or tx ) it hangs showing the  grey rectangle " incorrect hardware! " and sometimes hangs showing only the language menu but I cannot do anything using the remote control or the buttons on the device.
foto1.jpg
foto3.jpg
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 30054462
Hi, Can you explain the connection you made?
0
 

Author Comment

by:oilitta
ID: 30055094
do you mean the connections of MAX232 and the RS-232 ?
0
 

Author Comment

by:oilitta
ID: 30056881
If is that , I'm sure I connected each pin of the MAX232 to the right place and I tested also for interruptions.
 Can the power be the reason for not working?  I tested the terminal of TX (R1out) and it has a power of +5,5 V.    while the T2IN is +2V  . I will try to find in Italy a device like this and then try with it
http://cgi.ebay.it/ws/eBayISAPI.dll?ViewItem&item=120529633660#shId
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 30089190
Did you connect the 1uF capacitors to pins 2, 1+3, 4+5 and 6 ?
I think that the device you found on ebay should work very well, and it doesn't cost much ($10 worth the time spent in buying the components, assembling it, testing, ...).
I am also from Italy...
0
 

Author Comment

by:oilitta
ID: 30110234
Scusa happy, allora forse possiamo parlare italiano, o credi che sia non appropriato e contro le regole di experts-exchange? Proverò a rifare le saldature, chissà che non fosse qualche saldatura fasulla anche se ho provato e la continuità c'è in ognuna di esse.

yes the capacitors are connected 1+3, 4+5   pin 2 to c1 ===> vcc +5v  6 to c2 ===> GRD
0
 

Author Comment

by:oilitta
ID: 30111464
Here is an image
max232.jpg
0
 

Author Comment

by:oilitta
ID: 30137002
Happy, I found this forum and a user is doing the same thing I try to do . Give a look at it, maybe it helps to understand what I'm doing wrong.

http://www.hwupgrade.it/forum/archive/index.php/t-2069468-p-2.html

http://snico.webege.com/N200/ 

0
 

Author Comment

by:oilitta
ID: 30137234
on  
http://snico.webege.com/N200/ 
give a look to these images

scheda.jpg
scheda_connettori.jpg
 scheda_connettori_assenti.jpg
 scheda_id.jpg

seriale_connettori.jpg
 seriale_link.jpg
 seriale_pin.jpg
seriale_terminal.jpg
0
 

Author Comment

by:oilitta
ID: 30138009
http://snico.webege.com/N200/max232-circuito.jpg    

it connects pin 2 and 6 with a capacitor . Is it the same thing to connect pin 2 to vcc and pin 6 to GRD ( as in the scheme we used ) ?
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 30138086
Is the same hardware you have? The serial pinout do not resemble that one you have on your board. If it is the same hardware, the pinout is in the seriale_pin.jpg ... but the voltage you measured make me think that it is not .
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 30139087
No, it is not the same, infacts that circuit is wrong. V+ and V- are the charge-pump output of max232, and the must be connected through a capacitor to ground to stabilize the charge-pump output.
C1+ , C1- and c2+ , c2- must be connected through a capacitor to pump the charge. The correct circuit is the one I gave you.
0
 

Author Comment

by:oilitta
ID: 30546006
Happy, I made again the interface but the result is always the same: I get only those strange symbols. Probably I make something wrong , but I cannot understand what. Anyhow The points are yours because I understood that the only way to solve the problem is the solution you gave. As this question cannot be leaved longer without closing it or accept a solution I just want to know what to do if I can connect the PC and the device. How can I restore the original firmware.
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 30604511
See what kind of bootloader is installed.
The bootloader frequently haves command to write to the flash. You should write the firmware into the flash.
but it depends on the bootloader installed, so the first step is to reach a prompt.
 
Hope that helps...
0
 

Author Comment

by:oilitta
ID: 30922759
HAppy, at last I got the interface working ( I bought a new one with max3232) . turning on the device I got this :

?hello  world!
525802 80w waaiitA
REALTEK ROM Monitor, Revision 0000.0201.0019.
Copyright (c) Realtek Semiconductor Corp. - All Rights Reserved.

For a list of available commands, type 'help'.

Compilation time /version=      Jan  5 2010  18:21:16  /0000.0201.0019

MAC address =                   00.11.6d.00.78.29

Processor Company ID/options =  0x01 (MIPS Technologies, Inc.) / 0x00

Processor ID/revision =         0x93 / 0x78

Endianness =                    Little
Flash memory size =             256 MByte

SDRAM size =                    128 MByte

First free SDRAM address =      0x800f8a00


Press 'ESC' to Monitor mode

Linux Kernel:

      FW Image from 0xa2020000, to 0x80100000, size=0x413085

Audio FW:

      FW Image from 0xa2440000, to 0x81b00000, size=0x1b3bc0

Video FW:

      FW Image from 0xa2600000, to 0x81d80000, size=0x211578

NTSC logo

5280Go 5280Go BgoardoBondin g 0 0x0000818x08
0100000 mtdparts=rtk_nand:161280k,79488k(/),8192k(/usr/local/etc),13184k rootfstype=yaffs2 root=31:01

Reset Ethernet Mac.




Address = 0x80100000


Realtek LINUX (DC ALIAS) started...
Venus setting:
      ROSs have 2621440 bytes RAM.
      System CPU has 2 UARTs.
      System CPU uses external timer interrupt.
      Bootloader version: 0000.0201.0019. This version string is of new format.
      The information of this board: Company ID:0x0    CPU ID: 0x12    Board ID: 0x201
      Ethernet Mac address: 00.11.6D.00.78.29
parse_series_variable,272: Error! Not legal number char!
      Model Config length=-1
Config serial console: console=ttyS0,115200n8r
prom_flashsize = 0x10000000
Linux version 2.6.12.6-VENUS (zpl1025@meledev) (gcc version 3.4.4 mipssde-6.03.00-20051020) #18 Thu Dec 10 14:11:15 CST 2009
audio addr: 1b00000
CPU revision is: 00019378
Determined physical RAM map:
 memory: 00100000 @ 00000000 (usable)
 memory: 004b0000 @ 00100000 (reserved)
 memory: 01550000 @ 005b0000 (usable)
 memory: 00500000 @ 01b00000 (reserved)
 memory: 06000000 @ 02000000 (usable)
  show info: max_low_pfn:32768
  show info: min_low_pfn:1456
Built 1 zonelists
Kernel command line: mtdparts=rtk_nand:161280k,79488k(/),8192k(/usr/local/etc),13184k rootfstype=yaffs2 root=31:01 console=ttyS0,115200n8r ip=192.168.0.9::192.168.0.254:255.0.0.0:::
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
PID hash table entries: 256 (order: 8, 4096 bytes)
Estimate value: CPU frequency 405.02 MHz
Using 27.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 119028k/121152k available (3435k kernel code, 2112k reserved, 592k data, 144k init, 0k highmem)
Warning! Unknown board id.
==================== Warning! The calculated loops_per_jiffy is not similar to the default one. ====================
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
========== board id: 201 ==========
[INFO] neptune mode...
boot_param value: a0002800
mode: 0
size: 1131
color1: 0x4eac6e
color2: 0x4ea96d
color3: 0x619b9d
color4: 0x8080eb
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
se init module major number = 254
size of RPC_POLL_Dev 52 and RPC_INTR_Dev 52...
   Hello, Realtek TLB Mapper
squashfs: version 3.1 (2006/08/19) Phillip Lougher
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
YAFFS Driver Rev:268981 (2009-09-21)
YAFFS Driver is successfully installing.
Initializing Cryptographic API
Generic RTC Driver v1.07
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IR

[Audio Firmware Version] 286276
[Binary src compiled at] Dec 17 2009 10:23:39

Q sharing enabled
ttyS0 at MMIO 0x0 (irq = 3) is a 16550A
ttyS1 at MMIO 0x0 (irq = 3) is a 16550A
io scheduler noop registered
RAMDISK driver initialized: 1 RAM disks of 128K size 1024 blocksize
loop: loaded (max 8 devices)
this  MARS eth RX_OFFSET = 0x0
8139cplus: 10/100 PCI Ethernet driver v1.2 (Mar 22, 2004)
MAC address = 0x00.11.6D.00.78.29
eth0: RTL-8139C+ at 0xb8016000, 00:11:6d:00:78:29, IRQ 2
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
NET: Registered protocol family 24
cp_hotplug
VenusSFC MTD init
serial flash inaccessible
physmap flash device: 10000000 at fd00000
Realtek NAND Flash Driver Rev:268236 (2009-09-17)
One HY27UF082G2B chip has 1 die(s) on board
nand part=HY27UF082G2B, id=adda1095, device_size=268435456, chip_size=268435456, num_chips=1, isLastPage=0
[rtk_nand_scan_bbt] have created bbt B0, just loads it !!
[dump_BBT] Nand BBT Content
[0] (0, 1944, 0, 2047)
4 cmdlinepart partitions found on MTD device rtk_nand
RTK: using dynamic nand partition
Creating 4 MTD partitions on "rtk_nand":
0x00000000-0x09d80000 : "Partition_000"
0x09d80000-0x0eb20000 : "/"
0x0eb20000-0x0f320000 : "/usr/local/etc"
0x0f320000-0x10000000 : "Partition_003"
0x00000000-0x10000000 : "disc"
Realtek Nand Flash Driver is successfully installing.
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
i2c /dev entries driver
[I2C0] i2c speed changed to 100 KHz
I2C0 Bus Status Check.... OK
=========================
= VER : 2.0a              
=========================
= PHY : 0              
= MODE: MARS              
= SPD : 100              
= SAR : 0x024 (7 bits)
= TX FIFO DEPTH : 8    
= RX FIFO DEPTH : 8    
= FIFO THRESHOLD: 4    
= BUS JAM RECORVER : ON  
= NON STOP WRITE : ON  
= SP PROTECT : ON  
=========================
[I2C1] i2c speed changed to 100 KHz
I2C1 Bus Status Check.... OK
=========================
= VER : 2.0a              
=========================
= PHY : 1              
= MODE: MARS              
= SPD : 100              
= SAR : 0x024 (7 bits)
= TX FIFO DEPTH : 8    
= RX FIFO DEPTH : 8    
= FIFO THRESHOLD: 4    
= BUS JAM RECORVER : ON  
= NON STOP WRITE : ON  
= SP PROTECT : ON  
=========================
NET: Registered protocol family 2
IP: routing cache hash table of 1024 buckets, 8Kbytes
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
NET: Registered protocol family 1
NET: Registered protocol family 17
Realtek Venus Power Management, (c) 2006 Realtek Semiconductor Corp.
cp_open
alloc rings cp->rxdesc_buf =0xa19ad000 , cp->ring_dma=0x19ad000
init_hw
init_hw finished
IP-Config: Com
0
 

Author Comment

by:oilitta
ID: 30923426
Reconnecting the terminal ( without turning off the player) I do not get anymore the above message but I get this message:
watchdog test pid 180, threshold: 50
watchdog test
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 30927702
Very Good!

ok. you should enter monitor mode by pressing "esc" when you see the "Press 'ESC' to Monitor mode" line.
I found some documentation on how to reflash the Realtek rom monitor - this is a step-by-step instruction: http://monitor.espec.ws//files/1073_pcba_upgrading_instruction_118.pdf

I think that it applies also to your model, but before starting, check to see if you find something specific to your appliance. I have put "realtek rom monitor" into google and found many documents - to it by appending your model name and see if you find something useful.

0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 30927938
Please post the output of the following commands:

set
info boot
info cpu
info board
info memory
info uart

0
 

Author Comment

by:oilitta
ID: 30934501
the first time I received these messages:

HISTFILE='/.ash_history'
HISTSIZE='1000'
HOME='/'
HOSTNAME='PlayonHD'
IFS='       
'
OPTIND='1'
PATH='/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/uinfo boot
-sh: info board
-sh:info memory
-sh: info:

trying again I get these:

                                        set
BusyBox v1.1.3 (2009.10.29-07:51+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
/ # watchdog test

                                           info boot
-sh: info boot
-sh: info: not found
/ # watchdog test pid 183, threshold: 50



0
 

Author Comment

by:oilitta
ID: 30934772
Press 'ESC' to Monitor mode  .   I do not see that message from the terminal. Have I to use Putty?
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 30935012
That message was printed as soon as the board was turned on.
So:
Connect the serial cable, Open the terminal, turn on the appliance and press esc repeatedly until you see a "realtek> " prompt.

See the first lines of your message:


?hello  world!
525802 80w waaiitA
REALTEK ROM Monitor, Revision 0000.0201.0019.
Copyright (c) Realtek Semiconductor Corp. - All Rights Reserved.

For a list of available commands, type 'help'.

Compilation time /version=      Jan  5 2010  18:21:16  /0000.0201.0019

MAC address =                   00.11.6d.00.78.29

Processor Company ID/options =  0x01 (MIPS Technologies, Inc.) / 0x00

Processor ID/revision =         0x93 / 0x78

Endianness =                    Little
Flash memory size =             256 MByte

SDRAM size =                    128 MByte

First free SDRAM address =      0x800f8a00


Press 'ESC' to Monitor mode

Open in new window

0
 

Author Comment

by:oilitta
ID: 30936803
Sorry. I tried to use the "ESC" but it clears the receive box as in the terminal I'm using it is a hot key to clear it.
I will try with windows terminal
0
 

Author Comment

by:oilitta
ID: 30939822
I do not know why, but I cannot get any more the above information when I turn on/off the device. I get always " watchdog test pid 183, threshold: 50"
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 30941431
It is not really off. Detach the power cord and wait few seconds before powering on.
Also eventually detach the usb connector and reattach it before powering on.
0
 

Author Comment

by:oilitta
ID: 31124372
happy, I cannot get the prompt  realtek >  neither using terminal nor putty. I tried several times to press "esc" as soon as the message appears, I also tried to keep it pressed and then release it but the terminal continues showing the script till it shows repeatedly " watchdog test pid 182, threshold: 50" and I cannot write into the terminal or Putty.

 Now on Turning on/off the device I get always  this long script ( please give a look ) : http://www.itcrende.it/hdplayer/hello  world.doc

maybe you can find something that can help.
0
 

Author Comment

by:oilitta
ID: 31125083
0
 

Author Comment

by:oilitta
ID: 31131790
happy, At last I got from the terminal to send The command "help" . The response was :

Built-in commands:
-------------------
      . : alias bg break cd chdir continue eval exec exit export false
      fg getopts hash help jobs kill let local pwd read readonly return
      set shift times trap true type ulimit umask unalias unset wait

I can send also linux commands like  ls - cd ..
but there is the "watchdog test pid 182, threshold: 50"  that appears continuosly , can I disable that daemon?

Now I think we can try to modify the files of the wrong firmware.
0
 

Accepted Solution

by:
oilitta earned 0 total points
ID: 31142198
SOLVED!!!
Happy, I solved the problem. I restored the original firmware.
Procedure:
1) Connected the player to  my wired LAN and using terminal I assigned an IP address to the player :
 # ifconfig eth0 192.168.250.5  
  (the IP is  in the same network of my PC ==> 192.168.250.3 )
2) Copied the install.img file (the original firmware ) into the root of my local webserver
3)Opening a session in Telnet with Putty I got the prompt and  entered as root.
4)prepare the player to download and flash the firmware image. The loader_a command can NOT be used directly to restore the firmware to the device, as it tried to create a writable directory in the root of the filesystem. Needed to create a file in the ramdisk and store the URL of the file in it.

 # echo "http://192.168.250.3/install.img" > /tmp/installing_source

5) Start the restore process.
 # kill -6 1
This causes the initd to reinitialize the system executive (the main process, PID 1). The executive process will terminate all low priviledge processes (and will terminate the telnet session) and run the /etc/reexec/init.script file, which moves the root filesystem to the ramdisk, and starts the restore process.

The telnet session will terminate, and the player will start to download the flash image. The screen will remain blank, and after several minutes, the display will appear and the flashing process will begin.
After about 7-8 minutes the new firmware was installed.

Whow!! it was a long studying but at last the player is alive again.

Thanks very much for your patience and all your advices. without your help I could not have the problem solved. As I told above the points are yours for having encouraged me and for the advices.
 
0
 

Author Comment

by:oilitta
ID: 31142970
Happy is there a way to give you the points and set as solution my post?
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 31217978
Ask the administrator by "requesting attention", and explain what do you want to do. I think there will not be any problem.
I am very happy that you solved your issue.

ciao

Federico
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 32867858
It seems to be the good dongle, just pay attention to the pinout, don't exchange Vcc and GND, or you'll fry your new dongle ;-)
0
 

Expert Comment

by:kszynio
ID: 32868011
Thanks, I will post my findings soon ;)
0
 

Expert Comment

by:kszynio
ID: 32951891
I wonder - what I should connect as Vcc to my dongle? +3,3V or +5V?
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 32951928
Do not connect it - probably you do not need it.
0
 

Expert Comment

by:kszynio
ID: 32951932
oilitta, can you give me the wiring?]

http://snico.webege.com/N200/ expired or something...
0
 
LVL 47

Expert Comment

by:David
ID: 32952283
My congratulations to HappyCactus.  I have *NEVER* seen anybody go to this amount of effort on an issue via EE.  oilitta, you should contact the moderators.  There should be a special expert award called the "HappyCactus" in honor of you.   Well, to both of you, for hanging in there.  
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 32952437
@ kszynio, see the comment #30137234, there is some link to image. And read carefully the entire thread, there should be many suggestions. IIRC, oilitta did a trial-and-error procedure to find the connections, you only have to connect GND to a known GND on the board and try TXD and RXD connections. Leave alone VCC - you do not need it.

@ dlethe , :-)
0
 

Expert Comment

by:kszynio
ID: 32952494
@HappyCactus

This server is down, I've tried it ;)
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 32952591
0
 
LVL 12

Expert Comment

by:HappyCactus
ID: 32952634
0
 

Expert Comment

by:kszynio
ID: 32959904
I've connected to the box and will try to fix it on weekend - it's much more to do because there is a kernel panic (rootfs is broken). I will have to flash it using realtek monitor.

Thanks for your help!
0
 

Expert Comment

by:kszynio
ID: 32976984
I've failed to restore proper software using builtin kernel... Now I'm gonna try to build new kernel with cramfs, nfs and initramfs (injected root filesystem into the kernel).

It's compiling now... ;) I can't wait to see it in action ;)
0
 

Expert Comment

by:kszynio
ID: 32978589
Success!

Steps to reproduce (I think it will be ok for any realtek 1073/1273 based player):

1. Download mips toolchain (links from http://forum.xtreamer.net/viewtopic.php?f=38&t=7646&sid=d46a64ad057f9dcbbb2a27e32d9e7695&start=40)
2. Install it (I've used fedora 11 inside vmware guest VM)
3. build the kernel using rescue config:

cd GPL/Linux/linux-2.6.12
cp config.rescue.old .config
make

4. Copy vmlinux.bin into your tftp server

5. load and boot it:
Realtek> fread tftp://192.168.0.10//var/lib/tftpboot/vmlinux.bin 0x80100000
About to binary read tftp://192.168.0.10//var/lib/tftpboot/vmlinux.bin
...
Realtek> go 80100000
Address = 0x80100000

6. untar install.img to your usb flashdrive and put it into your player
7. run install_a:

# /mnt/usbmounts/sdb1/install_a /mnt/usbmounts/sdb1/install.img

8. You should have working player now.

If you want to use kernel built by me you can download it from:

http://dl.dropbox.com/u/987493/vmlinux.bin

Thanks to oilitta and HappyCactus for inspiration ;)
0

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Stellar Exchange Toolkit: this 5 in 1 toolkit comes loaded with mega-software tool. Here’s an introduction to tools’ usage and advantages:
Eseutil Hard Recovery is part of exchange tool and ensures Exchange mailbox data recovery when mailbox gets corrupt due to some problem on Exchange server.
In this Micro Tutorial viewers will learn how to restore single file or folder from Bare Metal backup image of their system. Tutorial shows how to restore files and folders from system backup. Often it is not needed to restore entire system when onl…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…

599 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question