Active Topics

 


Reply
Thread Tools
Posts: 2,153 | Thanked: 8,462 times | Joined on May 2010
#1
Cold-flashing is process to flash NOLO bootloader when bootloader in RX51 is damaged - when normal flashing not working.

I successfully patched pusb (from omap-u-boot-utils) to send 2nd x-loader image to RX51. This was easy because protocol is same as for omap3 TI borard - only double ASIC ID reading does not working on RX51, which caused error.

I sent pusb patch for upstreaming, my post with patch is here: http://groups.google.com/group/beagl...3f2a446f36b2c6

Next part sending NOLO (secondary image) is difficult. This is handled by Nokia X-Loader, so other TI boards does not use it.

I patched libusb.so library + using ltrace to debug how flasher-3.5 cold-flashing. I spend one day with this and here is result: Open Source program for cold-flashing Nokia N900. Program working fine (with my N900)... Program has code for flashing x-loader and nolo too, so pusb is not needed.

Sorce code is attached (file cold-flasher-rx51.c)

EDIT:
Now magic 8 bytes is not secret First 4 bytes is CRC32 checksum of file and second 4 bytes is CRC32 checksum of message. Why Nokia implemented 4bytes checksum of 12bytes message??

Source code is updated and now open source cold flashing is complete

EDIT:

Info - How is Cold-Flashing implemented:

Cold-Flashing is devided into two parts:
1. Sending 2nd X-Loader image
2. Sending Secondary NOLO image

1. For sending 2nd X-Loader image over USB bus is used standard OMAP mehod (reply to ASIC ID message). This is specified in "OMAP35X Technical Reference Manual" (spruf98u.pdf) section 25.4.5 Peripheral Booting. One of working OSS implementation is pusb tool (part of omap-u-boot-utils) with small patch here.

2. When 2nd X-Loader image is received by Omap BootROM it is automatically executed. Flasher tool must wait until X-Loader inilialize USB bus and is ready for next flashing.

Checking if X-Loader is ready can be done by X-Loader ping message. Answer is 4 bytes message.

When X-Loader is ready, flashing process is started by X-Loader init message and after that is NOLO image itself. When X-Loader receive NOLO image, it automatically start boot it.

X-Loader message struct:
0-3 byte - type
4-7 byte - size of image (low endian)
8-11 byte - crc32 of image
12-15 byte - crc32 of 0-11 byte of this X-Loader message

Ping X-Loader message has type (uint32_t)(0x6301326E), size and first crc32 is 0x00000000. Init X-Loader message has type (uint32_t)(0x6302326E), size and first crc32 belongs to secondary image (which will be send)

Sending over USB bus is done by libusb library (functions usb_blk_read, usb_blk_write), see pusb tool.

EDIT:

Cold flasher is now part of 0xFFFF open source flasher. Look here: http://talk.maemo.org/showthread.php?t=87996
Attached Files
File Type: gz cold-flasher-rx51.c.gz (2.8 KB, 172 views)

Last edited by pali; 2013-01-24 at 23:17.
 

The Following 65 Users Say Thank You to pali For This Useful Post:
Posts: 53 | Thanked: 40 times | Joined on May 2009 @ Brooksville, Florida
#2
Possible to replace NOLO with U-Boot or such?
 
Posts: 2,153 | Thanked: 8,462 times | Joined on May 2010
#3
Originally Posted by Luke-Jr View Post
Possible to replace NOLO with U-Boot or such?
If somebody write rx51 board code to u-boot (same what do NOLO), yes. But we do not know what is NOLO doing...
And of course if somebody generate that 8 bytes...

Last edited by pali; 2011-12-13 at 18:07.
 
Posts: 150 | Thanked: 169 times | Joined on Nov 2011 @ Sweden
#4
Wow pali, you are keeping busy! I'm subscribing to this thread. Wish I could do more than that, but I hope you get the help you need!
 

The Following 3 Users Say Thank You to bocephus For This Useful Post:
Posts: 69 | Thanked: 55 times | Joined on Nov 2009
#5
Couldn't it be some kind of checksum of the to be sent nolo secondary image?
Just my 2 cents.
Ciao
 
Posts: 69 | Thanked: 55 times | Joined on Nov 2009
#6
BTW: you should change all occurrences of "responce" in the .c file to "response".
 

The Following User Says Thank You to farmatito For This Useful Post:
Posts: 2,153 | Thanked: 8,462 times | Joined on May 2010
#7
Originally Posted by farmatito View Post
Couldn't it be some kind of checksum of the to be sent nolo secondary image?
Just my 2 cents.
Ciao
Should be.

Originally Posted by farmatito View Post
BTW: you should change all occurrences of "responce" in the .c file to "response".
fixed,
sorry for my bad english
 

The Following 2 Users Say Thank You to pali For This Useful Post:
Posts: 2,153 | Thanked: 8,462 times | Joined on May 2010
#8
LD_PRELOAD library is in first post
 

The Following User Says Thank You to pali For This Useful Post:
nicolai's Avatar
Posts: 1,637 | Thanked: 4,424 times | Joined on Apr 2009 @ Germany
#9
What is the exact name for the snd.bin and secondary.bin ?
I unpacked the rx-51 rootfs image, but there are many
2nd.bin-RX-51.XXXX and secondary.bin-RX-51:XXX
files.

Nicolai
 

The Following User Says Thank You to nicolai For This Useful Post:
Posts: 2,153 | Thanked: 8,462 times | Joined on May 2010
#10
Originally Posted by nicolai View Post
What is the exact name for the snd.bin and secondary.bin ?
I unpacked the rx-51 rootfs image, but there are many
2nd.bin-RX-51.XXXX and secondary.bin-RX-51:XXX
files.

Nicolai
in FIASCO image is more 2nd.bin and more secondary.bin
You need to use that which is for your N900 HW revision (that XXXX).

If you do not know your HW revision, run flasher-3.5 -i (it write it)
 

The Following User Says Thank You to pali For This Useful Post:
Reply

Tags
cold-flash, flasher, open source

Thread Tools

 
Forum Jump


All times are GMT. The time now is 04:03.