PnxStb

hacking a pnx8950 based set top box dvb-t board

links

system specific

http://www.mikrocontroller.net/topic/210759
- WARNING: lots of flame and uninteresting posts!
- HOWEVER: they managed to flash a wince based (moretv?) fimrware
- NICE: yes, however there are some exceptions!
- HINT: focus on contributions by David M., Muart232 and Stefan P., Raoul D. as well as AgentData? (flash dump + layout)
http://www.mikrocontroller.net/articles/Receiver-Mainboard_Plattform_Philips_PNX8950

booting

u-boot
- http://www.denx.de/wiki/U-Boot/WebHome
- http://www.denx.de/wiki/view/DULG/UBoot
(e)jtag
- http://www.baycom.org/~tom/ejtag/
- http://urjtag.org/ (-> doc/README.ejtag)
- https://forum.openwrt.org/viewtopic.php?id=4191

usefull

hardware

intro

http://www.pollin.de - product id: 390 052
similar:
parts:
- cpu ...
- ram ...
- pnx8510 ...
- flash (man code: 0xad)
  - 0x76: 3.3v x8
  - 0x56: 3.3v x16
  - 0x36: 1.8v x8
  - 0x46: 1.8v x16

reversing the pcb

uart and jtag

modifications / extensions

rs232

source: mikrocontroller.net !

unfortunately the pinout as visualized at mikrocontroller.net does not work, although a rs232<->10pin_header construction i own would perfectly fit!
there are logs available so it should work!
TODO: check contacts of the 10 pin header to the respective max232 ic!
STUPID ME: pin header assumes female rs232 port, i used a male one and a null modem to connect to the host => need to switch rx and tx

logs: http://hackdaworld.org/download/pnx/logs/orig_01.log

access jtag

board -> j1
there are only 5 + 1 drills, remove remaining 4 of a 10 pin header!
pins: starting top left to bottom left and bottom right: trst, tdi, tdo, tms, tck, gnd
j1 tdo <-> pnx8510 tdo
TODO: solder a converter for a low cost DLC5 parallel cable (http://hackdaworld.org/download/lc_jtag/) ... what about vcc?
SOLUTON: fortunately vdd of the 8510 can be found on the pin header of the 8051 core lpc

HOWEVER: until now, i am unable to detect devices!

 jtag> cable DLC5 parallel 0x378
 Initializing parallel port at 0x378
 jtag> detect
 Warning: TDO seems to be stuck at 1

SOLUTION: the cable does not connect the (n)trst signal => pull it high manually!

 jtag> detect
 IR length: 12
 Chain length: 2
 Device Id: 00010000100010011000000000101011 (0x000000001089802B)
   Manufacturer: Philips Semi. (Signetics)
   Unknown part!
 Device Id: 00010010010110100000000000101011 (0x00000000125A002B)
   Manufacturer: Philips Semi. (Signetics)
   Unknown part!
 chain.c(149) Part 0 without active instruction
 chain.c(200) Part 0 without active instruction
 chain.c(149) Part 0 without active instruction

now we have to inject code into the ram by (e)jtag => jtag tool (see code section)
STOP: according to david m., the pnx8550 is only found in the ejtag chain
his guess: next to pnx8510 the pci controller is in 'normal' jtag chain
soldered contacts to ejtag (see picture)

source: mikrocontroller.net!

do not forget to pull high (n)trst manually with a low cost DLC5
according to forum: switch 2 -> on
seems to work with switch 2 -> off, too!

 jtag> cable DLC5 ppdev /dev/parport0
 Initializing ppdev port /dev/parport0
 jtag> detect
 IR length: 10
 Chain length: 2
 Device Id: 0 (0x0000000000000000)
 Device Id: 0 (0x0000000000000000)
 chain.c(149) Part 0 without active instruction
 chain.c(200) Part 0 without active instruction
 chain.c(149) Part 0 without active instruction

urjtag include: http://www.hackdaworld.org/download/pnx/ejtag.inc

 jtag> part 0
 jtag> include ejtag.inc
 jtag> instruction BYPASS
 jtag> part 1
 jtag> include ejtag.inc
 jtag> instruction IDCODE
 jtag> shift ir
 jtag> shift dr
 jtag> dr
 00010010110000001000000000101011

idcode: 0x12c0802b <- definetely philips! :)
part 0 has id code 0x00000000
initialize ejtag bus (have to do this twice!)

 jtag> initbus ejtag
 ImpCode?=00100001010000000100000000000000 21404000
 EJTAG version: 2.5
 EJTAG Implementation flags: R4k DINTsup ASID_8 NoDMA? MIPS32
 Processor entered Debug Mode.
 ejtag.c(203) No processor access, ctrl=01000000000000001101000000001000
 jtag> initbus ejtag
 ImpCode?=00100001010000000100000000000000 21404000
 EJTAG version: 2.5
 EJTAG Implementation flags: R4k DINTsup ASID_8 NoDMA? MIPS32
 Processor entered Debug Mode.
 Initialized bus 1, active bus 0

first 4k of mem starting from 0x00 -> http://www.hackdaworld.org/download/pnx/ram_0-0x2000.bin.txt
TODO: trying to access flash, as e.g. in:
- https://forum.openwrt.org/viewtopic.php?id=4191
- http://www.mail-archive.com/urjtag-development@lists.sourceforge.net/msg00037.html
HOWEVER: we have a different memory address space!

 Active bus:
 *0: EJTAG compatible bus driver via PrAcc? (JTAG part No. 1)
      start: 0x00000000, length: 0x20000000, data width: 8 bit
      start: 0x20000000, length: 0x20000000, data width: 16 bit
      start: 0x40000000, length: 0x20000000, data width: 32 bit

WARNING, david m. bricked his board writing uboot image to 0x00010000 !!

eeprom

eeprom content

TODO: clarify!

accessing the eeprom

flash

flash content

source of investigation: flashdump by stefan p. (the brutal way!)
STOP: agentdatat did it! -> forum: Datum: 04.04.2011 16:03

http://hackdaworld.org/download/pnx/orig_nand_layout__by_agentdata.txt

bootloader

accessing the flash

TODO: examine -> bootloader, upgrade code ...

pnx8550 memory address mapping

guess memory address space of the pnx8550

source: jtag memory dump (0x00000000 - 0x00200000 by now)
additional: raoul d. using grabit (see forum)
.
0x00100000 - 0x00200000 continue here ...
0x00020000 - 0x000fffff :
0x0001c000 - 0x0001ffff :
0x00014000 - 0x0001bfff :
0x0000c000 - 0x00013fff :
0x00004000 - 0x0000bfff :
0x00000000 - 0x00003fff :
.
probably everything is ram by now ...
maybe stupid idea -> linux kernel: arch/mips/pnx8550/* and arch/mips/include/asm/mach-pnx8550
- enable tlb: set (1<<19) on coprocessor config 0 register 7
- ...

analyzing the way urjtag is doing things

and compare it to the way the ejtag baycom tool is doing stuff

and what does the mips (ejtag) std say ...

DO: read about
- ejtag system
- ejtag debug control and coprocesser 0 registers
- memory mapped ejtag memory segment
...
...
...

utility code

pnx8950 based/related code is available at: http://www.hackdaworld.org/cgi-bin/gitweb.cgi?p=my-code/pnx.git;a=tree

in the following some code and some results are explained ...

host tools

jtag - tool to play with the (e)jtag capable pnx8550

build & usage:

gcc -Wall jtag.c -o jtag
sudo ./jtag

completed:

query jtag chain -> number of devices, ir length
function to easily set instructions

todo:

find out individual ir lenght of each device
find instructions

PAUSED: urjtag is great and we deal with common mips ejtag on con1 !!!

efp_extract - tool to extract elecard efp files

usage and output looks like this. you will end up with 7 files ...

 hackbard@tx2:~/projects/pnx$ ./efp_extract /scratch/stb/elecard/STB820.rel.256.rev0036.201101111002.master.svn7576.pal_retail_itelec.ENG.wf.smithy.efp 
 number of files: 7
 file 1:
  - wtf: 36
  - len: 5537280
  - offset: 190
  - next estimated offset: 5537470
 file 2:
  - wtf: 36
  - len: 16351232
  - offset: 5537470
  - next estimated offset: 21888702
 file 3:
  - wtf: 36
  - len: 20381696
  - offset: 21888702
  - next estimated offset: 42270398
 file 4:
  - wtf: 16
  - len: 7512
  - offset: 42270398
  - next estimated offset: 42277910
 file 5:
  - wtf: 16
  - len: 27260
  - offset: 42277910
  - next estimated offset: 42305170
 file 6:
  - wtf: 36
  - len: 5537280
  - offset: 42305170
  - next estimated offset: 47842450
 file 7:
  - wtf: 36
  - len: 1553
  - offset: 47842450
  - next estimated offset: 47844003
 mapping file into memory ...
 hackbard@tx2:~/projects/pnx$ file file_0*
 file_01: sticky data
 file_02: sticky Linux jffs2 filesystem data little endian
 file_03: sticky Linux jffs2 filesystem data little endian
 file_04: sticky data
 file_05: sticky data
 file_06: sticky data
 file_07: sticky gzip compressed data, was "fwinfo.tar", from Unix, last modified: Tue Jan 11 05:03:45 2011
 hackbard@tx2:~/projects/pnx$

content of the files:

file_02 and file_03 - jffs2 images
- the 2 jffs2 images can be mounted as, for instance, described in http://wiki.maemo.org/Modifying_the_root_image
- content:

 hackbard@tx2:~/projects/pnx$ ls content_file0*
 content_file02:
 bin     config.defaults   dev   lib    opt      samba  sys  usr
 boot    config.firmware   etc   media  proc     sbin   tmp  var
 config  config.templates  home  mnt    profile  share  usb
 
 content_file03:
 bin	      config.templates  etc  samba  share   xworks
 config.defaults  dvb	       lib  sbin   webkit

file_07 - this is a tar file, which can be extracted as usual. just some firmware information ...
file_01 - equal to file_06, contains boot file, kernel and initrd (rev: 36), which can be accessed as follows:
- gzipped initrd cpio archive at 0x0036a400
  - dd if=file_01 of=intrd.img.gz ibs=1 skip=3580928
  - gunzip initrd.img.gz
  - mkdir initrd && cd initrd
  - cpio -id --no-absolute-filenames < ../initrd.img
  - have fun ...
- boot.sys and vmlinux.raw? how to access?
file_05 boot loader, revision: 16
file_04 ?!? revision: 16 -> another loader (confirmed by muart232 -> microbtm)

mips(el) toolchain

that was easy!

added

deb http://www.emdebian.org/debian/ unstable main

to /etc/apt/sources.list and installed gcc-4.3-mipsel-linux-gnu and gcc-4.3-mips-linux-gnu

thanks (em)debian!

stb code

TODO: u-boot, kernel, rootfs ...

Edit PnxStb HackDaWorld PageList RecentChanges PageHistory