"Series2.5" / TCD540040 / "nightlight SA" / Humax / DirecTV R10 initial observations

[alldeadhomiez]

Series2.5 Worklog - MudShark's documentation of his Series2.5 hacking experience

Some DirecTV inside info - this is a thread filled with rumors and speculation regarding the new DirecTV R10 and the 6.1 software which will presumably run on it. Based on the evidence I have seen, I consider some of the assertions to be highly dubious; for instance, claims were made that the R10 will use the same NEC CPU and non-DDR SDRAM used in the Uma4/Uma6. Also, bogus "DirecTV R10" screenshots clearly taken from an HDVR2 were posted. Fun reading, but take it with a grain of salt.

[misterbryceguy]

These are pictures and screenshots of a DIRECTV R10 DVR I am borrowing. Here is what I found when I opened it:

CPU is BCM7317KPB9
Flash is SST37VF010 in PLCC32 package
Tuners, demodulator are the same as HDVR2
LNBP is combined into a dual LNBH221PDT
Crypto chip is same AT90SC6464C
No TIVO asic
No separate USB controller
RAM is one Micron MT46V32M16TG-75Z 32Mx16 (64MB)
AV1AWA RID chip
Modem is Si3018 and Si2434

Other:

New Reset button behind card slot door
Serial but no IR port
3-prong cord
TIVO Peanut remote
DIRECTV D1 access card
Reduced parts count on mainboard
Software is 6.1-01-2-521
System info does not say HDVR2

Update 12/6:

Program groups (folders) are supported
Guide is quick, each page renders in 1-2 seconds
Network adapters are detected and enabled, but only ports 2190 and 2191 are open. HMO features are not enabled.

If you can socket the prom for a reasonable price please PM me.

[misterbryceguy]

Thanks to the ddb regulars who helped me out over the past few days, I have bash on the new R10. A few new observations:

6.1 respects the active disk configuration so Jamie's fix is needed to expand the drive. Edit 12/12, this was based on bad information. I have verified that only mfs tools is needed to expand the drive in 6.1.

/GuideIndexV2 has changed to /GuideIndexV3:

Directory of /GuideIndexV3 starting at ''

    Name                      Type        FsId      Date  Time   Size    
    ----                      ----        ----      ----  ----   ----    
    Actor                     tyFile     49486  12/08/04 12:17 651396    
    ChannelTable              tyFile     49484  12/08/04 12:17   4484    
    Correlation.index         tyFile     49497  12/08/04 12:19      0    
    Correlation.key           tyFile     49498  12/08/04 12:19     24    
    Director                  tyFile     49485  12/08/04 12:17  51957    
    Genre.index               tyFile     49537  12/08/04 12:29  20324    
    Genre.key                 tyFile     49538  12/08/04 12:29     44    
    GenreTable                tyFile     49483  12/08/04 12:17   7208    
    Keyword                   tyFile     49491  12/08/04 12:19 2008084   
    Program.index             tyFile     49534  12/08/04 12:29 1267328   
    Program.key               tyFile     49536  12/08/04 12:29   2504    
    ProgramToSeries.index     tyFile     49495  12/08/04 12:19 422112    
    ProgramToSeries.key       tyFile     49496  12/08/04 12:19    440    
    Showing.index             tyFile     49531  12/08/04 12:29 1145592   
    Showing.key               tyFile     49532  12/08/04 12:29    408    
    Title                     tyFile     49492  12/08/04 12:19 304892    
    TitleKeyword              tyFile     49487  12/08/04 12:17 669013    
    Tms.index                 tyFile     49493  12/08/04 12:19 487344    
    Tms.key                   tyFile     49494  12/08/04 12:19   1928

CPU and memory info:

system type             : TiVo UMA2C board
processor               : 0
cpu model               : unknown V0.6
BogoMIPS                : 242.48
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : no
spurious interrupts     : 129
cycle counter frequency : 121644531

        total:    used:    free:  shared: buffers:  cached:
Mem:  44998656 40595456  4403200        0  1523712 27443200
Swap: 67104768  7626752 59478016
MemTotal:        43944 kB
MemFree:          4300 kB
MemShared:           0 kB
Buffers:          1488 kB
Cached:          25320 kB
SwapCached:       1480 kB
Active:          19612 kB
Inactive:        11336 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        43944 kB
LowFree:          4300 kB
SwapTotal:       65532 kB
SwapFree:        58084 kB

netstat:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:2190            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:2191            0.0.0.0:*               LISTEN      
udp        0      0 0.0.0.0:2190            0.0.0.0:*                           
udp        0      0 0.0.0.0:68              0.0.0.0:*                           
udp        0      0 0.0.0.0:5353            0.0.0.0:*

The kernel is 2.4.20 so it supports the lba48.

The 30 second skip works. You can use the code or you can use the patch.

I have not seen the video on demand features yet.

TWP 1.0 final and 1.1 beta don't work right.

Overall the R10 is very responsive but the startup time is terrible. I would put it on a ups so it does not have to reboot much.

[ronnythunder]

so the startup time is lengthy even after the prom hack and disabling initrd?

ronny

[alldeadhomiez]

Introduction

Today we will talk about RAM on the Series2.5 SA units.

Please be aware that SMD rework on your TiVo mainboard could render it unusable, and will absolutely void your warranty. If you are new to TSOP rework, it would be a good idea to practice on something else first (or, even better, hire a professional).

Understanding and Upgrading RAM on your Series2.5

The Series2.5 standalone models have only 32MB of main memory. By "main memory," I am referring to the DDR SDRAM IC that is connected directly (through resistor packs) to the BCM7317 CPU. On the Series2.5 DVD units, such as the Humax DRT800, the ESS DVD processor also has 32MB of DDR SDRAM, and the 1394 controller appears to also have dedicated RAM. Also, the Kfir-II MPEG encoder on all Series2.0/2.5 SA units has dedicated RAM. However, none of this "extra" memory is of any interest to us, because Linux applications running on the box cannot directly occupy it. Thus, the only IC relevant to this discussion is the main memory connected to the BCM7317.

Out of the 32MB of main memory accessible to the MIPS CPU on a Series2.5 unit, somewhere between ~8.5MB-14MB is taken up by various buffers used by the OSD controller, MPEG decoder, kernel, etc. On the DRT800, the reserved memory is a whopping 14MB, leaving ~18MB free for the TiVo software, daemons, and hacks. After loading the bloated 5.4 software and its prerequisites, there isn't much room left for hacks. In my configuration, TWP used at least 3MB of its own, which is almost 20% of the main memory available to Linux applications. With just a few hacks loaded, I experienced constant thrashing; in fact, the system could not even boot without swap enabled. This had a negative impact on UI response times, drive noise, and my overall satisfaction with the unit.

Upon opening the unit, I found that it used a Samsung K4H561638F-TCB3 IC for the main system memory. This IC is a 16Mbit x 16 DDR333 CL2.5 array in a TSOP-66 package. misterbryceguy notes that his DirecTV R10, also based on the BCM7317, uses for its main memory a Micron MT46V32M16TG-75Z, a 32Mbit x 16 DDR266 CL2 array. We see from the BCM7317 specification that the memory interface is 16 bits wide and runs at 133Mhz DDR. Judging from the fact that address lines unused in a 32MB configuration are still connected to the CPU on the SA2.5 units, I theorized that a larger IC could be substituted to improve the performance of a hacked SA2.5 box.

I was in fact able to locate two suitable ICs, which I successfully used to upgrade my DRT800 and TCD540040:

Micron MT46V32M16TG-75E, pulled from scrap equipment (DDR266 CL2)
Kingston D3216DE4T-6U, pulled from a KVR333SO/512R SODIMM (DDR333 CL2.5)

Once upgraded, the unit should function normally. In fact, it will function "too" normally: it will not recognize the extra 32MB. In order to use the entire 64MB, you need to patch the kernel. Fortunately, I have attached a new kernel to this post. This kernel supports a new command line option: "mems=". The "mems" option takes a decimal value specified in megabytes, and overrides the default memory size for your BORD type. On my setup, I appended "mems=64" to the kernel command line in the bootpage. After making this change and booting the modified kernel, /proc/meminfo will now show about 50MB instead of the usual 18MB for MemTotal.

After installing the new RAM the thrashing has ceased completely, swap usage is minimal, and the system is a lot more pleasant to use.

(continued...)

[alldeadhomiez]

(...continued)

Attachment Notes

kernel/series25-2.4.20.patch is the same patch I posted earlier, except netfilter (not CONFIG_FILTER) has been turned off to improve network performance. The kernel I included should work properly with the stock af_packet.o, and therefore DHCP will work.

kernel/mems-2.4.20.patch is the patch that adds the "mems" option for Series2.5 boards.

Unresolved Questions

Can these systems take DDR266/CL2.5 memory, or is it necessary to install DDR266/CL2 or better?

What other 32Mbit x 16 ICs can be used? (512MB+ SODIMMs are a good source, but you must be careful to make sure you are getting modules with eight TSOP-66 ICs. Many variants exist.) Results from testing MT46V32M16TG-6 ICs from a Crucial SODIMM are thus far inconclusive.

Can these systems handle 64Mbit x 16 (128MB) ICs? If so, is there a performance advantage or a good use for the extra RAM? Can we reconfigure the MFS application buffers to use this memory to cache a larger portion of the database?

References

Micron MT46V32M16 datasheet

Samsung K4H561638F-TCB3 datasheet (in attachment)

JEDEC DDR specification (in attachment)

Kernel patch (in attachment)

Sleeper's SMD removal instructions

9th tee SMD installation instructions

Output

/proc/meminfo after the upgrade:

        total:    used:    free:  shared: buffers:  cached:
Mem:  51863552 50405376  1458176        0   843776 36192256
Swap: 268427264  9105408 259321856
MemTotal:        50648 kB
MemFree:          1424 kB
MemShared:           0 kB
Buffers:           824 kB
Cached:          33956 kB
SwapCached:       1388 kB
Active:          16324 kB
Inactive:        23156 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        50648 kB
LowFree:          1424 kB
SwapTotal:      262136 kB
SwapFree:       253244 kB

[alldeadhomiez]

I constantly see these myths propagated (especially at TCF and other non-technical sites), so I will attempt to put them to rest now:

Myth: The DirecTV R10 has more RAM than the Uma4 or Uma6 boards.
Fact: Both units have 64MB of RAM. For details, reread this thread.

Myth: The DirecTV R10 6.1 kernel might boot on a Series2.0 DTiVo.
Fact: Kernels for Series2.5 units, as well as some of their modules, are compiled only for the Series2.5. Specifically, the chipset initialization code is different, there is no PCI support (as the BCM7317 has no PCI bus), the IDE driver is completely different (as the Series2.5 does not use a TiVo ASIC for this), and the USB driver is completely different (using a hackish emulation layer to fake out the PCI function calls). For more information, download the 5.3 kernel source from TiVo and look in arch/mips/tivo . Also, look for any references to CONFIG_TIVO_UMA2C. In my experience, the signature check on a Series2.5 kernel will pass on a Series2.0 box, but the system will lock up almost immediately after control is passed to the kernel, because the Series2.5 kernel is looking for peripherals that just don't exist on the Series2.0.

It is unclear at this point whether the userland Series2.5 6.1 software will run on a Series2.0 with a different kernel and different (say, 5.x) modules, but I wouldn't get my hopes up.

Myth: The DirecTV R10 is mostly a cosmetic change from the Uma6-based models. Variations: "they only released it so they can change the brand name," "it's the same stuff with a rearranged board," and other such nonsense.
Fact: Almost every major component on the mainboard has been changed in the Series2.0->Series2.5 transition. This was probably done to capitalize on improvements in technology to cut costs and reduce component count. Information on the new components can be found in this thread.

Myth: A naive approach (trying the Sleeper ISO, running killhdinitrd, "just editing rc.sysinit," etc.) is likely to allow you to bypass the Series2.5 security mechanism.
Fact: You will either need to develop a new software exploit, socket the PROM, or enjoy your stock TiVo. This thread documents the procedure for the second option. BASH_ENV is out of the question because that hole was closed way back in 3.1.0. killhdinitrd is out of the question because that hole was closed prior to the release of 5.3 (Spring 2004).

Myth: Series2.0 software releases will run on a Series2.5 because they're both MIPS.
Fact: Series2.0 software releases lack many critical kernel modules needed to support the Series2.5 peripheral devices. Getting, say, the 4.0 software to run on a Series2.5 is likely to involve a substantial amount of effort.

Myth: TCF is a good place to get accurate technical information about how TiVos work.
Fact: Although I respect David Bott's right to bar DDB links from his site, the fact that TCF users are unable to reference threads such as this one prevents them from pointing people to accurate, reliable sources of information from the people who are actually taking the time to document how the system works. The end result of this policy is that the accuracy and timeliness of information available on TCF has been dealt a serious blow. For this reason, I recommend that readers directly consult the technical threads at DDB, AO, etc. instead of relying on the secondhand, occasionally correct information found at TCF.

[AlphaWolf]

Guide is quick, each page renders in 1-2 seconds

I was hoping they would do a bit better than that. Even first generation directv receivers can render a page from the guide in less than a second. I am curious if this speed will be any different (be it faster or slower) on the regular S2 units.

[alldeadhomiez]

Myth: The DirecTV R10 has more RAM than the Uma4 or Uma6 boards.
Fact: Both units have 64MB of RAM. For details, reread this thread.

To elaborate on the RAM and CPU questions, let's take a look at the evidence we have:

On the topic of CPU speed, I have not measured the clock speed of any of these units. However, what we do know is that Series2.0 SA (excluding the old 60-hour boards) and the Series2.0 DTiVos (including the HR10-250) show ~162 BogoMIPS. We know that the NEC CPU is rated for 166Mhz, and the memory interface is rated at 83Mhz. We know that the system needs a 27Mhz reference clock for MPEG2 purposes, so we can reasonably theorize that the CPU is running at 6 x 27Mhz = 162Mhz, and the memory bus is running at half that. Likewise, the Series2.5 shows ~242 BogoMIPS, which is about 9 x 27Mhz = 242Mhz. This is consistent with the information in the BCM7317 datasheet, mentioned earlier in this thread. I would guess that the external memory interface is running at 121Mhz, with two data transfers per clock (i.e. DDR). I assume that a MIPS core is likely to approach 1 CPI in a tight loop with no stalls, e.g. the BogoMIPS measurement loop.

As mentioned earlier in this thread, the BCM7317 clearly runs at a faster clock speed and has a better external memory interface, but it lacks an FPU and has pitifully small caches. Because of this, some things will run more quickly and other things will not.

In terms of RAM, the Series2.0 boards have four SDRAM ICs. My Uma4 HDVR2 has four Hynix HY57V281620 8M x 16 (16MB) ICs, for a grand total of 64MB. It has been reported that the HR10-250 has four Samsung K4S561632E-TC60 16M x 16 (32MB) ICs, for a total of 128MB. And my TCD240040 has four Hynix HY57V641620HG 4M x 16 (8MB) ICs, for a total of 32MB.

I posted the known Series2.5 memory configurations last night. In a nutshell: SA2.0 and SA2.5 units all have 32MB, and DTiVo Series2.0 and Series2.5 units (except for the HR10-250) all have 64MB. The DirecTV R10 does not have more memory than its Series2.0 predecessors. Any speed improvements seen on the R10 stem from algorithmic optimizations, a higher clock rate, and/or a faster external memory interface. This makes it difficult to forecast the performance of a Uma4/Uma6 running the 6.1 software.

It is also worth noting that the amount of reserved memory on a DTiVo is quite large, which may help to explain why they have historically shipped with double the RAM of an equivalent SA. The Uma4, Uma6, and Bryce configurations reserve 19MB, so ~45MB is left for the kernel and for user applications. On the Elmo (Humax DVD) platform, 12.5MB is reserved, and on the Uma7/Uma2c (TCD540040), 7.2MB is reserved.

[ronnythunder]

here's the meminfo from a stock hr10-250:

bash-2.02# cat /proc/meminfo
        total:    used:    free:  shared: buffers:  cached:
Mem:  93495296 69791744 23703552        0 15728640 35196928
Swap: 134209536   765952 133443584
MemTotal:        91304 kB
MemFree:         23148 kB
MemShared:           0 kB
Buffers:         15360 kB
Cached:          33724 kB
SwapCached:        648 kB
Active:          41160 kB
Inactive:        13652 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:        91304 kB
LowFree:         23148 kB
SwapTotal:      131064 kB
SwapFree:       130316 kB

ronny

[compwiz312]

ADH, running your nonetfilter kernel seems to work fine except for one bug/issue I noticed. If you try and run DHCP (which requires af_packet.o), upon insmoding it, is says it has unresolved symbols to

sk_run_filter

. Upon doing a little research, I found this to be enabled by netfilter, so if you could possibly correct it in the source, it would be much appreciated.

Justin

[alldeadhomiez]

ADH, running your nonetfilter kernel seems to work fine except for one bug/issue I noticed. If you try and run DHCP (which requires af_packet.o), upon insmoding it, is says it has unresolved symbols to

sk_run_filter

. Upon doing a little research, I found this to be enabled by netfilter, so if you could possibly correct it in the source, it would be much appreciated.

That's an issue with CONFIG_FILTER. Here is the kernel I am using now, which has CONFIG_FILTER enabled, but CONFIG_NETFILTER disabled (still). I don't think CONFIG_FILTER should hurt performance, as it does not seem to apply to TCP according to the description. It also includes the recent mems= patch and other patches from this thread.

This kernel is based on the new 5.4.1 sources (thanks alunj), in which a few things have changed from 5.3:

VM changes: added new "priority" memory type
new support for the BCM7317 TLB
new SCSI drivers to support the DVD drive and the bridge ASIC (modules - not included here)
new performance monitoring stuff (perfmon and ktop), probably used in remote debugging
reduction in the reserved memory region on Elmo (DVD boards)

As it turns out, the DRT-800 performance is quite a bit better with this kernel than it was with the older 5.3-based kernel I used, but the 64MB upgrade still makes the UI more responsive.

[compwiz312]

Before I go and install this, possibly hosing my TiVo, would the modules from your previous build or from TiVo default work with this kernel?

BTW, thanks for your continued help and support and Happy Holidays...

[alldeadhomiez]

Before I go and install this, possibly hosing my TiVo, would the modules from your previous build or from TiVo default work with this kernel?

Works for me, but no guarantees. Most things that we are likely to change will not break the kernel module ABI.

Back up your old kernel first (or understand how to get it from the GZkernel SwModule).

[justmike]

Not to butt in but what the heck .... I have a new Humax DRT-800 and have yet to crack the case (wanted some of the warrantee to run out first) but if the pictures are correct that were posted earlier in the thread then the DVD is a Dual Layer drive?

(http://www.pioneerelectronics.com/pn...551420,00.html)

Mike

Edit - Removed some dumb stuff