Announce: Open Source Cold Flasher for RX51 - maemo.org

pali · #1 2011-12-13, 17:59

Cold-flashing is process to flash NOLO bootloader when bootloader in RX51 is damaged - when normal flashing not working.

I successfully patched pusb (from omap-u-boot-utils) to send 2nd x-loader image to RX51. This was easy because protocol is same as for omap3 TI borard - only double ASIC ID reading does not working on RX51, which caused error.

I sent pusb patch for upstreaming, my post with patch is here: http://groups.google.com/group/beagl...3f2a446f36b2c6

Next part sending NOLO (secondary image) is difficult. This is handled by Nokia X-Loader, so other TI boards does not use it.

I patched libusb.so library + using ltrace to debug how flasher-3.5 cold-flashing. I spend one day with this and here is result: Open Source program for cold-flashing Nokia N900. Program working fine (with my N900)... Program has code for flashing x-loader and nolo too, so pusb is not needed.

Sorce code is attached (file cold-flasher-rx51.c)

EDIT:
Now magic 8 bytes is not secret

First 4 bytes is CRC32 checksum of file and second 4 bytes is CRC32 checksum of message. Why Nokia implemented 4bytes checksum of 12bytes message??

Source code is updated and now open source cold flashing is complete

EDIT:

Info - How is Cold-Flashing implemented:

Cold-Flashing is devided into two parts:
1. Sending 2nd X-Loader image
2. Sending Secondary NOLO image

1. For sending 2nd X-Loader image over USB bus is used standard OMAP mehod (reply to ASIC ID message). This is specified in "OMAP35X Technical Reference Manual" (spruf98u.pdf) section 25.4.5 Peripheral Booting. One of working OSS implementation is pusb tool (part of omap-u-boot-utils) with small patch here.

2. When 2nd X-Loader image is received by Omap BootROM it is automatically executed. Flasher tool must wait until X-Loader inilialize USB bus and is ready for next flashing.

Checking if X-Loader is ready can be done by X-Loader ping message. Answer is 4 bytes message.

When X-Loader is ready, flashing process is started by X-Loader init message and after that is NOLO image itself. When X-Loader receive NOLO image, it automatically start boot it.

X-Loader message struct:
0-3 byte - type
4-7 byte - size of image (low endian)
8-11 byte - crc32 of image
12-15 byte - crc32 of 0-11 byte of this X-Loader message

Ping X-Loader message has type (uint32_t)(0x6301326E), size and first crc32 is 0x00000000. Init X-Loader message has type (uint32_t)(0x6302326E), size and first crc32 belongs to secondary image (which will be send)

Sending over USB bus is done by libusb library (functions usb_blk_read, usb_blk_write), see pusb tool.

EDIT:

Cold flasher is now part of 0xFFFF open source flasher. Look here: http://talk.maemo.org/showthread.php?t=87996

Luke-Jr · #2 2011-12-13, 18:02

Possible to replace NOLO with U-Boot or such?

pali · #3 2011-12-13, 18:04

Quote:

Originally Posted by Luke-Jr

Possible to replace NOLO with U-Boot or such?

If somebody write rx51 board code to u-boot (same what do NOLO), yes. But we do not know what is NOLO doing...
And of course if somebody generate that 8 bytes...

bocephus · #4 2011-12-13, 18:49

Wow pali, you are keeping busy! I'm subscribing to this thread. Wish I could do more than that, but I hope you get the help you need!

farmatito · #5 2011-12-13, 20:46

Couldn't it be some kind of checksum of the to be sent nolo secondary image?
Just my 2 cents.
Ciao

farmatito · #6 2011-12-13, 20:56

BTW: you should change all occurrences of "responce" in the .c file to "response".

pali · #7 2011-12-13, 21:20

Quote:

Originally Posted by farmatito

Couldn't it be some kind of checksum of the to be sent nolo secondary image?
Just my 2 cents.
Ciao

Should be.

Quote:

Originally Posted by farmatito

BTW: you should change all occurrences of "responce" in the .c file to "response".

fixed,
sorry for my bad english

pali · #8 2011-12-14, 21:00

LD_PRELOAD library is in first post

nicolai · #9 2011-12-14, 22:37

What is the exact name for the snd.bin and secondary.bin ?
I unpacked the rx-51 rootfs image, but there are many
2nd.bin-RX-51.XXXX and secondary.bin-RX-51:XXX
files.

Nicolai

pali · #10 2011-12-14, 22:40

Quote:

Originally Posted by nicolai

What is the exact name for the snd.bin and secondary.bin ?
I unpacked the rx-51 rootfs image, but there are many
2nd.bin-RX-51.XXXX and secondary.bin-RX-51:XXX
files.

Nicolai

in FIASCO image is more 2nd.bin and more secondary.bin
You need to use that which is for your N900 HW revision (that XXXX).

If you do not know your HW revision, run flasher-3.5 -i (it write it)

The Following 65 Users Say Thank You to pali For This Useful Post:
AapoRantalainen, abbra, abubakar, ade, ahmadamaj, bocephus, Boemien, brad112358, Copernicus, crni_labud, daperl, don_falcone, Dvd25, ejasmudar, Estel, Fabry, fw190, gregoranderson, Helmuth, HtheB, Hurrian, ivgalvez, jcharpak, jurop88, klinglerware, lma, Luke-Jr, m750, MartinK, Mentalist Traceur, Mike Fila, moepda, mrsellout, mr_jrt, Natan_xy, Netweaver, nicolai, NIN101, nkirk, onion, OVK, pelago, peterleinchen, petur, pH5, PUNK, reinob, shanttu, sicelo, Skaven2k2, slonopotamus, smoothc, Sourav.dubey, sr00t, SSLMM, stlpaul, strange1712, Temporal, The Winter, theonelaw, thp, tswindell, vitaminj, woody14619, zoner

The Following 3 Users Say Thank You to bocephus For This Useful Post:
Estel, Minhaz, nkirk

The Following User Says Thank You to farmatito For This Useful Post:
Estel

The Following 2 Users Say Thank You to pali For This Useful Post:
Estel, Sourav.dubey

The Following User Says Thank You to pali For This Useful Post:
Estel

The Following User Says Thank You to nicolai For This Useful Post:
Estel