Go Back   Sat Universe > HDTV And Ultra HDTV > VU+ > VU+ Solo SE Chat

Note: Visitors from certain countries might see in-text advertising(underlind words in posts) or pop-under ads.
It is only shown to unregistered visitors or members that haven't made any posts. So you can easily get rid of it.

World-Of-Satellite

Sunray SOLO3 (Solo SE) jtag

VU+ Solo SE Chat

Reply
  #1  
Old 24-09-2016, 14:54  Translate from English to Italian  Translate from English to French  Translate from English to German  Translate from English to Spanish  Translate from English to Dutch  Translate from English to Greek  Translate from English to Portuguese  Translate from English to Russian  Translate from English to Russian
gjstroom gjstroom is offline
Senior Member
 
Join Date: Dec 2009
Posts: 100
Thanks: 10
Thanked 643 Times in 50 Posts
Country: Country Flag
Default Sunray SOLO3 (Solo SE) jtag

I have a broken Sunray SOLO3.
It looks like a problem with the flash module, I exchanged it with the module of a working SOLO3, and then the box just works.
Probably a faulty Samsung k9f2g08u0c.
Anyone knows how to jtag this box ? It has a BCM7241.
Or maybe a flash module for sale ?
Reply With Quote
  #2  
Old 28-09-2016, 18:37  Translate from English to Italian  Translate from English to French  Translate from English to German  Translate from English to Spanish  Translate from English to Dutch  Translate from English to Greek  Translate from English to Portuguese  Translate from English to Russian  Translate from English to Russian
gjstroom gjstroom is offline
Senior Member
 
Join Date: Dec 2009
Posts: 100
Thanks: 10
Thanked 643 Times in 50 Posts
Country: Country Flag
Default

Broadbandstudio BCM97241 does not exist ?

I managed to build a rs232 cable, the rs232 signal is present on the RJ11 connector where you can connect the external IR receiver.

Code:
 1    LED
 2    Ground
 3    IR-Data (5V-TTL)
 4    +5V (Power IR-reciever) 47Ohm resistor
 5    RS232-DTX (Box-Output)
 6    RS232-DRX (Box-Input)

Connect the following:
Code:
RJ11     DB9
2          5
5          2
6          3
This is all output the box gives:
Code:
BCM74290010

M0080080000CZP#@

BCM97241B0 CFE v3.16, CFE core v3.45, Endian Mode: Little
BCM7241B2 CFE Build Date: Tue, Jun 24, 2014  3:15:47 PM   11.316.01 Vuplus team
Copyright (C) Broadcom Corporation.
The weird part is sometimes the box moves on flashing, but this happens mostly when it has been powered off for some time:
Code:
BCM74290010

M0080080000CZP#@

BCM97241B0 CFE v3.16, CFE core v3.45, Endian Mode: Little
BCM7241B2 CFE Build Date: Tue, Jun 24, 2014  3:15:47 PM   11.316.01 Vuplus team
Copyright (C) Broadcom Corporation.

CPU speed:            1305MHz
DDR Frequency:        800 MHz
DDR Mode:             DDR3
Total memory:         1024MB
DDR Width:            32
SCB clock:            277 MHz
RTS Version:          20121205235404_7241
Boot Device:          NAND
Total flash:          256MB

Initializing USB.
USB: Locating Class 09 Vendor 0000 Product 0000: USB Root Hub
USB: Locating Class 09 Vendor 0000 Product 0000: USB Root Hub
USB: Locating Class 09 Vendor 0000 Product 0000: USB Root Hub
USB: Locating Class 09 Vendor 0000 Product 0000: USB Root Hub

CFE initialized.
USB: Device disconnected from bus 0 hub 1 port 1
USB: New device connected to bus 0 hub 1 port 1
USB: Resetting device on bus 0 hub 1 port 1
USB: Locating Class 08 Vendor 090C Product 1000: Mass-Storage Device
USBMASS: Unit 0 connected
waiting for usb...done
checking usb
Found high priority Mass Storage bus = 0, index  = 0
checking front key
readFrontKey 0 0
Checking usbdisk0:/vuplus/solose/ignore.update......NO
Checking usbdisk0:/vuplus/solose/force.update......YES
Checking usbdisk0:/vuplus/solose/cfe_cfe_auto.bin......NO
Checking usbdisk0:/vuplus/solose/root_cfe_auto.bin......YES
Checking usbdisk0:/vuplus/solose/splash_cfe_auto.bin......YES
Checking usbdisk0:/vuplus/solose/kernel_cfe_auto.bin......YES
Checking usbdisk0:/vuplus/solose/reboot.update......NO
Update
Reading usbdisk0:/vuplus/solose/cfe_cfe_auto.bin:  Skipping...: File not found
Reading usbdisk0:/vuplus/solose/initrd_cfe_auto.bin:  Done. 5986485 bytes read

Programming...
done. 5986485 bytes written
Reading usbdisk0:/vuplus/solose/splash_cfe_auto.bin:  Done. 1036856 bytes read

Programming...
done. 1036856 bytes written
Reading usbdisk0:/vuplus/solose/kernel_cfe_auto.bin:  Done. 4119464 bytes read

Programming...
done. 4119464 bytes written
Checking usbdisk0:/vuplus/solose/root_cfe_auto.bin......YES
Loader:elf Filesys:raw Dev:flash0.initrd File: Options:[email protected] [email protected]
Loading: 0x80001000/12670464 0x80c16600/114576 Entry address is 0x804595d0
Starting program at 0x804595d0

Linux version 3.3.8-2.0-g298276c-dirty ([email protected]) (gcc version 4.5.3 (Broadcom stbgcc-4.5.3-2.4) ) #17 SMP Fri Aug 21 19:31:02 KST 2015
Fetching vars from bootloader... found 14 vars.
Options: moca=0 sata=1 pcie=0 usb=1
Using 1024 MB + 0 MB RAM (from CFE)
bootconsole [early0] enabled
CPU revision is: 00025a11 (Broadcom BMIPS5000)
FPU revision is: 00130001
Determined physical RAM map:
 memory: 10000000 @ 00000000 (usable)
 memory: 30000000 @ 20000000 (usable)
bmem: adding 192 MB RESERVED region at 64 MB ([email protected])
bmem: adding 160 MB RESERVED region at 512 MB ([email protected])
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00050000
Movable zone start PFN for each node
Early memory PFN ranges
    0: 0x00000000 -> 0x00010000
    0: 0x00020000 -> 0x00050000
PERCPU: Embedded 7 pages/cpu @8180a000 s5632 r8192 d14848 u32768
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 259584
Kernel command line: [email protected] [email protected]
PID hash table entries: 4096 (order: 2, 16384 bytes)
Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
Primary instruction cache 32kB, physically tagged, 4-way, linesize 64 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
MIPS secondary cache 256kB, 8-way, linesize 128 bytes.
Memory: 666552k/1048576k available (4534k kernel code, 382024k reserved, 1103k data, 6736k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:160
Measuring MIPS counter frequency...
Detected MIPS clock frequency: 1305 MHz (163.133 MHz counter)
Console: colour dummy device 80x25
Calibrating delay loop... 869.37 BogoMIPS (lpj=434688)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
SMP: Booting CPU1...
CPU revision is: 00025a11 (Broadcom BMIPS5000)
FPU revision is: 00130001
Primary instruction cache 32kB, physically tagged, 4-way, linesize 64 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
MIPS secondary cache 256kB, 8-way, linesize 128 bytes.
SMP: CPU1 is running
Brought up 2 CPUs
NET: Registered protocol family 16
USB0: power enable is active high; overcurrent is active low
USB1: power enable is active high; overcurrent is active low
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource wktmr
NET: Registered protocol family 2
IP route cache hash table entries: 32768 (order: 5, 131072 bytes)
TCP established hash table entries: 131072 (order: 8, 1048576 bytes)
TCP bind hash table entries: 65536 (order: 7, 524288 bytes)
TCP: Hash tables configured (established 131072 bind 65536)
TCP reno registered
UDP hash table entries: 512 (order: 2, 16384 bytes)
UDP-Lite hash table entries: 512 (order: 2, 16384 bytes)
NET: Registered protocol family 1
RPC: Registered named UNIX socket transport module.
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.18)
msgmni has been set to 1301
io scheduler noop registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
console [ttyS0] enabled, bootconsole disabled 52) is a 16550A
console [ttyS0] enabled, bootconsole disabled
serial8250.0: ttyS1 at MMIO 0x10406740 (irq = 53) is a 16550A
libscan: scanning eraseblock 1799 -- 100 % complete  a 1aseblock 738 -- 41 % complete
ubiformat: 1790 eraseblocks have valid erase counter, mean value is 16
ubiformat: 10 bad eraseblocks found, numbers: 38, 1390, 1792, 1793, 1794, 1795, 1796, 1797, 1798, 1799
ubiformat: flashing eraseblock 1174 -- 100 % complete
ubiformat: formatting eraseblock 1799 -- 100 % complete
Turning on LED
Update complete
Turning on LED
Update complete
Turning off LED
Looks fine, but after a powercycle nothing happens.

It's about this flash module, definitely another pcb layout as the Sunray Solo2 box.

Top (K9F2G08U0C-SCB0 2Gb nand flash memory)


Bottom (EPM3064A CPLD - Complex Programmable Logic Devices)
Reply With Quote
  #3  
Old 28-09-2016, 22:55  Translate from English to Italian  Translate from English to French  Translate from English to German  Translate from English to Spanish  Translate from English to Dutch  Translate from English to Greek  Translate from English to Portuguese  Translate from English to Russian  Translate from English to Russian
darius1 darius1 is offline
Senior Member
 
Join Date: Oct 2007
Posts: 113
Thanks: 41
Thanked 63 Times in 36 Posts
Country: Country Flag
Default

jtag do not work for your box.coz Broadbandstudio BCM97241 does not exist.
Reply With Quote
  #4  
Old 30-09-2016, 13:53  Translate from English to Italian  Translate from English to French  Translate from English to German  Translate from English to Spanish  Translate from English to Dutch  Translate from English to Greek  Translate from English to Portuguese  Translate from English to Russian  Translate from English to Russian
gjstroom gjstroom is offline
Senior Member
 
Join Date: Dec 2009
Posts: 100
Thanks: 10
Thanked 643 Times in 50 Posts
Country: Country Flag
Default

I made some progress in my quest to program a virgin K9F2G08U0C-SCB0 chip.

For this I need the the dump of a working box, lucky I have 2
I seems you can interrupt the bootloader when you hook up a serial console (putty/teraterm/hyperterm/minicom etc), just press control-c some times when text appears in your console.
Code:
BCM74290010

M0080080000CZP#@

BCM97241B0 CFE v3.16, CFE core v3.45, Endian Mode: Little
BCM7241B2 CFE Build Date: Tue, Jun 24, 2014  3:15:47 PM   11.316.01 Vuplus team
Copyright (C) Broadcom Corporation.

******************************************
Automatic startup canceled via Ctrl-C
******************************************

CPU speed:            1305MHz
DDR Frequency:        800 MHz
DDR Mode:             DDR3
Total memory:         1024MB
DDR Width:            32
SCB clock:            277 MHz
RTS Version:          20121205235404_7241
Boot Device:          NAND
Total flash:          256MB

Initializing USB.
USB: Locating Class 09 Vendor 0000 Product 0000: USB Root Hub
USB: Locating Class 09 Vendor 0000 Product 0000: USB Root Hub
USB: Locating Class 09 Vendor 0000 Product 0000: USB Root Hub
USB: Locating Class 09 Vendor 0000 Product 0000: USB Root Hub

CFE initialized.
waiting for usb...done
checking usb
No Priority Usb
checking front key
readFrontKey 0 0
Checking usbdisk0:/vuplus/solose/ignore.update......NO
Checking usbdisk0:/vuplus/solose/force.update......NO
Checking usbdisk0:/vuplus/solose/cfe_cfe_auto.bin......NO
Checking usbdisk0:/vuplus/solose/root_cfe_auto.bin......NO
....NO
Checking usbdisk0:/vuplus/solose/splash_cfe_auto.bin......NO
Checking usbdisk0:/vuplus/solose/kernel_cfe_auto.bin......NO
Starting splash screen.
Found splash image - Width = 720 Height = 480
Non Interlaced Replace list 043f8100 0c800000Interlaced Replace list 043f86a0 0c8005a0
CFE>
Now we can enter the following commands
Code:
CFE> help
Available commands:

ts                  Time stamp utility
info                Show CFE configuration information
set console         Change the active console device
loop                Loop a command
reboot              Reboot the system
dir                 List the directory of a FAT file system
macprog             Program MAC addresses.
macprog2            Program a specific MAC address.
flash               Update a flash memory device
memtest             Test memory.
t                   Test contents of memory.
f                   Fill contents of memory.
e                   Modify contents of memory.
d                   Dump memory.
u                   Disassemble instructions.
batch               Load a batch file into memory and execute it
go                  Start a previously loaded program.
load                Load an executable file into memory without executing it
save                Save a region of memory to a remote file via TFTP
boot                Load an executable file into memory and execute it
ephycfg             Configure Ethernet PHY interface
ping                Ping a remote IP host.
ifconfig            Configure the Ethernet interface
sleep               Sleep for specified milliseconds.
waitusb             Wait for USB device to be installed.
show usb            Display devices connected to USB bus.
show heap           Display information about CFE's heap
show memory         Display the system physical memory map.
show devices        Display information about the installed devices.
testenv             Tests environment variable for various conditions. Default is test the existence of the variable
incenv              Increment an integer environment variable.
unsetenv            Delete an environment variable.
printenv            Display the environment variables
setenv              Set an environment variable.
help                Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0
CFE>
One command in particular is interesting, the macprog2. With this command you can change the mac-address of the box, which is quite handy if you have more as one Solo SE on the same network, knowing that each box shares the same mac-address (00-DE-FA-11-80-00).
To change the mac-address to 00-DE-FA-11-80-01
Code:
macprog2 00-DE-FA-11-80-01
But the most interesting command is the save command, this allows you to save the memory content to a file by tftp. Which I need to program the nand.
For this to work you first need to initialize the network, I use dhcp, for static addresses you need some more commands, just type 'help ifconfig' for some info about this.
Code:
CFE> ephycfg

Please select the board PHY design for eth0 interface

1) Internal 10/100Mbps PHY (build-in PHY)
2) MII to external 10/100Mbps PHY (e.g. bcm53101E)
3) RGMII ID mode disabled for external 10/100/1000Mbps PHY (e.g. bcm5461x)
4) RGMII to external Gigabit Switch (e.g. bcm531x5)
5) RGMII ID mode disabled for external Gigabit Switch
6) RGMII to RGMII (e.g. STB<->3383)
Selection: 1
*** command status = 0
CFE> ifconfig -auto eth0
100 Mbps Full-Duplex
Device eth0:  hwaddr 00-DE-FA-11-80-00, ipaddr 192.168.0.248, mask 255.255.255.0
        gateway 192.168.0.1, nameserver 192.168.0.250, domain xxxxx
*** command status = 0
CFE>
You also need to start a tftp server on your client, I use Tftpd64.
Code:
CFE> save 192.168.0.10:wholeflash.bin 87000000 100000
1048576 bytes written to 192.168.0.10:wholeflash.bin
*** command status = 0
CFE>
This is where I am stuck right now, I can't find the right address where the nand is located.
Above file does list a part of the cfe (bootloader), but I am not sure if this is a ram part instead of the rom.

Who knows the right memory addresses where the nand is located ?

Found on the dd-wrt forum:
The address space of the mips cpu is divided into segments, kseg0 from address 0 to 7fffffff and kseg1 from 80000000 to ffffffff.
Everything in kseg0 is also present in kseg1 but there are different access rights between these segments.
kseg0 is system space and kseg1 is user space and user programs running in kseg1 are prevented from accessing kseg0 directly.

In the normal bootlog I find KSEG1 : 0x80000000
Reply With Quote
The Following User Says Thank You to gjstroom For This Useful Post:
snakie (09-10-2016)
  #5  
Old 22-03-2020, 15:59  Translate from English to Italian  Translate from English to French  Translate from English to German  Translate from English to Spanish  Translate from English to Dutch  Translate from English to Greek  Translate from English to Portuguese  Translate from English to Russian  Translate from English to Russian
gjstroom gjstroom is offline
Senior Member
 
Join Date: Dec 2009
Posts: 100
Thanks: 10
Thanked 643 Times in 50 Posts
Country: Country Flag
Default

It's been a while since I posted this, but my problem is resolved by using Broadband Studio 3 version 3.1.60125.8 and Broadband Studio 3 bcm97429 found int this thread: https://jb8a8f8.com/support/index.ph...0-receiver.65/
The Sunray Solo3 boot loader I dumped from my working box https://gjstroom.stackstorage.com/s/VeoDwLKdywMwbHa
Reply With Quote
The Following User Says Thank You to gjstroom For This Useful Post:
aliraza63 (30-03-2020)
  #6  
Old 22-03-2020, 17:47  Translate from English to Italian  Translate from English to French  Translate from English to German  Translate from English to Spanish  Translate from English to Dutch  Translate from English to Greek  Translate from English to Portuguese  Translate from English to Russian  Translate from English to Russian
gjstroom gjstroom is offline
Senior Member
 
Join Date: Dec 2009
Posts: 100
Thanks: 10
Thanked 643 Times in 50 Posts
Country: Country Flag
Default

The correct link should be:
https://jb8a8f8.com/support/index.ph...-i2c-info.401/
Reply With Quote
The Following 2 Users Say Thank You to gjstroom For This Useful Post:
aliraza63 (30-03-2020), Ferret (22-03-2020)
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT +2. The time now is 13:52.


Powered by vBulletin
Copyright ©2006-2019 - Sat Universe