Page 2 of 5 FirstFirst 1234 ... LastLast
Results 16 to 30 of 67

Thread: Does Homieflash work on a modified THD?

  1. #16
    Join Date
    Nov 2002
    Posts
    1,076
    Ok, those results you got from homieflash after running eepro-100 aren't right.
    Remember my disclaimer that I hadn't re-tested this since 1/2007?
    I just tried it again and there was a mistake in my instructions. For homieflash, the address you pass into it should be the address from the line *above* the "Expansion ROM" address reported by lspci. Then everything should work fine. Here's a complete working example.
    Code:
    % lspci -v -d 8086:1229 
    05:01.0 Ethernet controller: Intel Corporation 82557/8/9/0/1 Ethernet Pro 100 (rev 02)
    	Subsystem: Intel Corporation EtherExpress PRO/100B (TX)
    	Flags: bus master, medium devsel, latency 64, IRQ 19
    	Memory at cb100000 (32-bit, prefetchable) [size=4K]
    	I/O ports at d000 [size=32]
    	Memory at ca000000 (32-bit, non-prefetchable) [size=1M]
    	[virtual] Expansion ROM at c9000000 [disabled] [size=1M]
    	Kernel driver in use: e100
    	Kernel modules: e100
    
    % ./eepro100-diag -B -v
    eepro100-diag.c:v2.13 2/28/2005 Donald Becker (becker@scyld.com)
     http://www.scyld.com/diag/index.html
    Index #1: Found a Intel i82557/8/9 EtherExpressPro100 adapter at 0xd000.
    i82557 chip registers at 0xd000:
      01000000 00000000 00000000 00080002 18230150 00000000
      No interrupt sources are pending.
       The transmit unit state is 'Idle'.
       The receive unit state is 'Idle'.
      This status is unusual for an activated interface.
     The Command register has an unprocessed command 0100(?!).
    Intel EtherExpress Pro 10/100 EEPROM contents:
      Station address 00:A0:C9:5B:7B:EF.
      Receiver lock-up bug exists. (The driver work-around *is* implemented.)
      Board assembly 667280-003, Physical connectors present: RJ45
      Primary interface chip i82555 PHY #1.
    Primary transceiver is MII PHY #1. MII PHY #1 transceiver registers:
       3000 7809 02a8 0150 01e1 0000 0000 ffff
       ffff ffff ffff ffff ffff ffff ffff ffff
       0000 0000 0001 0000 0000 0000 0000 0000
       0000 0000 0000 0000 ffff ffff ffff ffff.
    Calling flash_show with data 0
     BIOS ROM ID 55 90, looking up vendor...
    Unknown BIOS ROM ID 55 90.
    0x000: 55 f0 55 f0 55 f0 55 f0 55 f0 55 f0 55 f0 55 f0 U.U.U.U.U.U.U.U.
    ...
    
    BIOS ROM dump done.
     Use '-a' or '-aa' to show device registers,
         '-e' to show EEPROM contents, -ee for parsed contents,
      or '-m' or '-mm' to show MII management registers.
    % ./homieflash -f ca000000 -d z
    Setting FLASH_START=ca000000
    flash id bfd5: SST39VF010
    Dumping flash contents to z...
    Saving to z complete
    % cmp z ../s3-hacked.bin 
    % ./homieflash -f ca000000 -w ../s3.bin
    Setting FLASH_START=ca000000
    flash id bfd5: SST39VF010
    erasing...
    programming...
    verifying...
    success!

  2. #17
    Join Date
    Nov 2002
    Posts
    1,076
    Quote Originally Posted by ciper View Post
    Bcc I tried your precompiled versions of Homieflash and eepro100-diag under MFSLive 1.3b, Ubuntu 7.1, Ubuntu 8.04 and Damn Small Linux 4.4.10 but they will not run...

    I'm now officially going through Tivo withdrawal hahaha
    The versions I compiled were for 64 bit linux. My distro is fedora10 so the 64bit fedora10 live CD would exactly match my environment, but older fedora distros should be OK as well. I could make a 32 bit version too, but what you compiled from source is probably working right anyways; those compiler warnings are cosmetic.

  3. #18
    Join Date
    Jul 2005
    Posts
    504
    I will consider trying a fedora LiveCD though my system is 32bit so I may have to adjust the source slightly.
    Your new instructions have me hopeful however there are still some issues -

    To run a command as administrator (user "root"), use "sudo <command>ubuntu@ubuntu:~$ sudo su
    root@ubuntu:/home/ubuntu# lspci -v
    (irrelevant text removed)
    02:09.0 Ethernet controller: Intel Corporation 82557/8/9/0/1 Ethernet Pro 100 (rev 05)
    Subsystem: Hewlett-Packard Company Device 10c3
    Flags: bus master, medium devsel, latency 66, IRQ 21
    Memory at c4100000 (32-bit, prefetchable) [size=4K]
    I/O ports at 2000 [size=32]
    Memory at c4000000 (32-bit, non-prefetchable) [size=1M]
    [virtual] Expansion ROM at 30100000 [disabled] [size=1M]
    Capabilities: [dc] Power Management version 1
    Kernel driver in use: e100
    Kernel modules: e100, eepro100

    root@ubuntu:/home/ubuntu# /media/disk/eepro2/eepro100-diag -B -f -v
    eepro100-diag.c:v2.13 2/28/2005 Donald Becker (becker@scyld.com)
    http://www.scyld.com/diag/index.html
    Index #1: Found a Intel i82557/8/9 EtherExpressPro100 adapter at 0x2000.
    i82557 chip registers at 0x2000:
    00000050 00000000 00000000 00080002 18217809 000005e8
    No interrupt sources are pending.
    The transmit unit state is 'Suspended'.
    The receive unit state is 'Ready'.
    This status is normal for an activated but idle interface.
    Intel EtherExpress Pro 10/100 EEPROM contents:
    Station address 00:90:27:65:11:3E.
    Receiver lock-up bug exists. (The driver work-around *is* implemented.)
    Board assembly 701637-001, Physical connectors present: RJ45
    Primary interface chip i82555 PHY #1.
    Primary transceiver is MII PHY #1. MII PHY #1 transceiver registers:
    3000 7809 02a8 0150 05e1 0000 0000 ffff
    ffff ffff ffff ffff ffff ffff ffff ffff
    0000 0000 0001 0000 0000 0000 0000 0000
    0000 0000 0000 0000 ffff ffff ffff ffff.
    (noticed a missing entry here when compared to your output. "Calling flash_show with data 0" is not shown)
    BIOS ROM ID 55 90, looking up vendor...
    Unknown BIOS ROM ID 55 90.
    0x000: 55 f0 55 f0 55 f0 55 f0 55 f0 55 f0 55 f0 55 f0 U.U.U.U.U.U.U.U.
    ...

    BIOS ROM dump done.
    Flash operations not configured into this program.
    Use '-a' or '-aa' to show device registers,
    '-e' to show EEPROM contents, -ee for parsed contents,
    or '-m' or '-mm' to show MII management registers.
    root@ubuntu:/home/ubuntu# /media/disk/homieflash -f c4000000 -w /media/disk-1/256k
    Setting FLASH_START=c4000000
    flash id 89bd: unknown
    erasing...
    programming...
    FATAL: error writing to 00000000: wrote 0b, got 55
    I had to use the -f option with eepro100-diag because otherwise it told me the interface was busy (it's not connected to anything). There was a missing line of output from my run of eepro100-diag which probably doesn't matter. Homieflash still seems to have the same output as shown in this post http://www.dealdatabase.com/forum/sh...5&postcount=10

    This is with an Intel flash chip N28F020-150 256k 12v stolen from another device. I will try with the SST Tivo chip as well

    Interesting... The SST 37vf010 has this result
    Setting FLASH_START=c4000000
    flash id 0bf0: ID COMMAND FAILED (may be older prom such as SST37)
    erasing...
    programming...
    FATAL: error writing to 0000000b: wrote 04, got 46
    With an Intel n28f001bx-t120 128k 12v
    Setting FLASH_START=c4000000
    flash id 9292: unknown
    erasing...
    programming...
    FATAL: error writing to 00000001: wrote f0, got f2
    I then tried the exact same command except using a different (non Tivo rom) and got
    FATAL: error writing to 00000000: wrote 09, got 0b
    Next I tried one of my old compiled versions of the code which was statically compiled to point to c4000000 and got the exact same result, which leads me to believe any of the most recent changes you made to the homeiflash code aren't the cause of the problem.

    Looking at the source it is invoking this line -
    if(flash[addr] != data)
    fatal("error writing to %08x: wrote %02x, got %02x",
    addr, data, flash[addr]);
    I am a novice so correct me if I am wrong, erasing a flash means writing all ones to it then burning the needed zeros. If that's the case could it be that the erase part of the program is not functioning?



    I'm going to try to dump the flash contents using homieflash and see what happens.
    Ok on my 128k intel flash (with unknown contents) your dynamic version of the program results in a file that displays in a text editor with the pattern "" repeating while my static compiled version pointing at c4000000 gives repeating.

    *On my 256k intel flash using your dynamic version gives a flash ID of 89bd and a 128k file which includes the text "Copyright (C) 1997-2001, Intel Corporation" and "PXE 2.1 Build 083 (WfM 2.0)" so the program is obviously able to read. Using my static compiled version I am getting ffff flash id and a file full of repeating so there must be something wrong with it.

    So this had me thinking about my previous theory. If the chip was actually being erased I should NOT see this Intel information right? I ran through the whole eepro100-diag -B -f -v and homieflash -f c4000000 tivohd.bin dance and then dumped the info again and it had not changed!

    *I used homieflash to dump my SST chip and can see the "TiVo/mips/Gen06/rel#v1.04-rel_c1" at the top. Problem is I also see it a few other places which confirms that the original Fboot tool did in fact have a bug and wrote the first 64k of my prom over and over again. This is bad and good news. Bad because my prom is corrupted. Good because we know the nic is able to write to the prom, my prom is not physically damaged and my TivoHD is not broken (this had been lingering in my mind for a while).

    I also have a few 29f040qc-90 512k 5v and a w29ee011p-90 128k 5v I could try but I'm afraid it might damage the NIC.
    I am downloading http://download.fedoraproject.org/pu...-i686-Live.iso as well
    Last edited by ciper; 12-17-2008 at 08:23 AM.

  4. #19
    Join Date
    Nov 2002
    Posts
    1,076
    Quote Originally Posted by ciper View Post
    I will consider trying a fedora LiveCD though my system is 32bit so I may have to adjust the source slightly.
    I'll just make some 32 bit binaries for you.
    Quote Originally Posted by ciper View Post
    I had to use the -f option with eepro100-diag because otherwise it told me the interface was busy
    I'd recommend you ifconfig the interface down instead of trying to do the flashing with the card running "hot".
    Code:
    flash id 89bd: unknown
    erasing...
    programming...
    FATAL: error writing to 00000000: wrote 0b, got 55
    Great, 89bd is right for intel, that would mean Intel 28f020. I can add this to the homieflash ID table (it does not list intel parts).

    There was a missing line of output from my run of eepro100-diag which probably doesn't matter.
    You're observant - that was just a debug line I added when trying to figure out what was going wrong
    On my 256k intel flash using your dynamic version gives a flash ID of 89bd and a 128k file which includes the text "Copyright (C) 1997-2001, Intel Corporation" and "PXE 2.1 Build 083 (WfM 2.0)"
    Great, homieflash is reading the prom just fine. This is the intel bootloader for the e100 card.
    Using my static compiled version I am getting ffff flash id and a file full of repeating so there must be something wrong with it.
    Yes, something is wrong there, are you sure you go the address right?
    So this had me thinking about my previous theory. If the chip was actually being erased I should NOT see this Intel information right? I ran through the whole eepro100-diag -B -f -v and homieflash -f c4000000 tivohd.bin dance and then dumped the info again and it had not changed!
    Right. But you haven't been able to get homieflash to write without producing a fatal error so this makes sense. I think you really got to figure out how to get eepro100-diag running without the -f.
    *I used homieflash to dump my SST chip and can see the "TiVo/mips/Gen06/rel#v1.04-rel_c1" at the top. Problem is I also see it a few other places which confirms that the original Fboot tool did in fact have a bug and wrote the first 64k of my prom over and over again. This is bad and good news. Bad because my prom is corrupted. Good because we know the nic is able to write to the prom, my prom is not physically damaged and my TivoHD is not broken (this had been lingering in my mind for a while).
    That's an sst39vf010? You might as well use that one as the one you wipe first since you know it's wrong.

  5. #20
    Join Date
    Nov 2002
    Posts
    1,076
    Here are 32 bit binaries of homieflash & eepro100-diag, with source.
    For homieflash, I added the intel part IDs.
    For eepro100-diag, I made it so that when you run it with -B it'll just setup read/write access to the PROM and not go on to produce all those errors.
    Remember to run eepro100-diag before homieflash or homieflash will *not* be able to write to the PROM.
    Last edited by bcc; 12-23-2008 at 03:32 PM. Reason: see later post for newer homieflash

  6. #21
    Join Date
    Jul 2005
    Posts
    504
    Quote Originally Posted by bcc View Post
    Here are 32 bit binaries of homieflash & eepro100-diag, with source.
    For homieflash, I added the intel part IDs.
    For eepro100-diag, I made it so that when you run it with -B it'll just setup read/write access to the PROM and not go on to produce all those errors.
    Remember to run eepro100-diag before homieflash or homieflash will *not* be able to write to the PROM.
    I downloaded these new versions, compiled from the source (no errors), and ran it under the ubuntu livecd. Setting ifconfig eth0 down before running eepro -B gave no errors. Homeighalsh however still didn't work with my SST chip
    Setting FLASH_START=c4000000
    flash id 0bf0: ID COMMAND FAILED (may be older prom such as SST37)
    erasing...
    programming...
    FATAL: error writing to 0000000b: wrote 04, got 46
    I'll try with the Intel 256k flash
    ubuntu@ubuntu:~$ sudo su
    root@ubuntu:/home/ubuntu# lspci -v
    (removed text)
    02:09.0 Ethernet controller: Intel Corporation 82557/8/9/0/1 Ethernet Pro 100 (rev 05)
    Subsystem: Hewlett-Packard Company Device 10c3
    Flags: bus master, medium devsel, latency 66, IRQ 21
    Memory at c4100000 (32-bit, prefetchable) [size=4K]
    I/O ports at 2000 [size=32]
    Memory at c4000000 (32-bit, non-prefetchable) [size=1M]
    [virtual] Expansion ROM at 30100000 [disabled] [size=1M]
    Capabilities: [dc] Power Management version 1
    Kernel driver in use: e100
    Kernel modules: e100, eepro100

    root@ubuntu:/home/ubuntu# ifconfig eth0 down
    root@ubuntu:/home/ubuntu# /media/disk-1/new/eepro100-diag -B
    eepro100-diag.c:v2.13 2/28/2005 Donald Becker (becker@scyld.com)
    http://www.scyld.com/diag/index.html
    Index #1: Found a Intel i82557/8/9 EtherExpressPro100 adapter at 0x2000.

    BIOS ROM setup for read/write access
    Use '-a' or '-aa' to show device registers,
    '-e' to show EEPROM contents, -ee for parsed contents,
    or '-m' or '-mm' to show MII management registers.
    root@ubuntu:/home/ubuntu# /media/disk-1/new/homie/homieflash -f c4000000 -w /media/disk/TiVo.PROM.Gen06.v1.05.C1.PATCHED-modified.bin
    Setting FLASH_START=c4000000
    flash id 89bd: Intel 28F020
    erasing...
    programming...
    FATAL: error writing to 00000000: wrote 0b, got 55
    Same results as before. I'll try under the fedora livecd in a bit. Time for food now!
    Last edited by ciper; 12-17-2008 at 07:04 PM.

  7. #22
    Join Date
    Nov 2002
    Posts
    1,076
    Quote Originally Posted by ciper View Post
    Homeighalsh however still didn't work with my SST chip
    Which sst chip is that?
    I'll try with the Intel 256k flash
    Why don't you try with the sst flash chip that fboot was able to write to. I notice the intel 28f020 spec says that it requires 6.5V to disable write protect and the e100 might not do that, thus explaining your write failure on that chip.

  8. #23
    Join Date
    Jul 2005
    Posts
    504
    Quote Originally Posted by bcc View Post
    Which sst chip is that?Why don't you try with the sst flash chip that fboot was able to write to.
    37vf010 which is the one fboot wrote to originally which caused the whole mess in the first place lol. I have no other loose SST chip.

    I notice the intel 28f020 spec says that it requires 6.5V to disable write protect and the e100 might not do that, thus explaining your write failure on that chip.
    The fboot readme says that the Intel 28F010 and Intel 28F020 are both supported according to the bottom of this page http://sandeen.net/fwfix/index.html . I believe I wrote to it with fboot or IBAUtil previously.

    It is also supposed to officially support the SST 29LE512, 39SF512, 39VF512, 39VF010 and 39VF020 which have essentially the same specs as the Tivo's original prom.

    I'll try to use fboot or ibautil to write to the 28f010 to make sure. I formatted one of my USB sticks to be a dos 6.22 boot disk
    Quote Originally Posted by fboot
    Programming Intel(R) Boot Agent Version 4.0.22
    Fill FLASH Device with Zeros... 100% (counted up from 0 slowly)
    Erasing FLASH Device... 100% (up from 0)

    Programming 58K to FLASH Device... 100% (up from 0)
    I programed it again with the Tivo 64k repeating prom image and then dumped the contents after to verify it is in fact writing.
    Last edited by ciper; 12-18-2008 at 03:34 AM.

  9. #24
    Join Date
    Nov 2002
    Posts
    1,076
    Quote Originally Posted by ciper View Post
    37vf010 which is the one fboot wrote to originally. I have no other loose SST chip.
    You sure? The sst37 requires 12V to program.

  10. #25
    Join Date
    Nov 2002
    Posts
    1,076
    As for the intel chips, it looks like they use a slightly different command set to flash them; different than what homieflash is using. If you have an SST39 or an AMD flash chip (known writable by homieflash), that would be best. Otherwise I could probably mod homieflash to support intel chips, but you'd have to do all the testing...

  11. #26
    Join Date
    Jul 2005
    Posts
    504
    Quote Originally Posted by bcc View Post
    As for the intel chips, it looks like they use a slightly different command set to flash them;
    The documents are confusing and misleading! The Intel chip will go into write enable mode with voltages between 6.5 and 12. It will work with 6.5 volts but the required amount for stable operation is actually 12v. The following quotes are from http://www.alldatasheet.com/datashee...8F020-150.html

    Page:1
    "With the 12.0 V VPP supply, the 28F020 performs 100,000 erase and program cycles"
    Page:6
    WRITE ENABLE: Controls writes to the control register and the array. Write enable is active low. Addresses are latched on the falling edge and data is latched on the rising edge of the WE# pulse.
    Note: With VPP less than or equal to 6.5 V, memory contents cannot be altered.
    Page:22
    VPPH - VPP during Read/Write Operations - mininum 11.40 - maximum 12.60 V



    Quote Originally Posted by bcc View Post
    You sure? The sst37 requires 12V to program.
    I swear the (with a halo above my head) the fboot utility and proset tools are able to write to both the Intel flash chip and the SST37 with a 58k rom image with no errors! I wrote to the SST37 with two different rom images and in between flashes dumped the contents to verify the write procedure had taken place. The data matched.


    Are you sure an SST37 would work? Is the Intel NIC able to run at 3v? I would be afraid to damage the flash if the NIC can only do 12v. I could try if you like with one of the 5v parts above assuming it wouldn't damage the NIC. I don't mind to sacrifice one of the flash chips I have now.

    This is what I have on hand currently
    w29ee011p-90 128k 5v
    *n28f001bx-t120 128k 12v
    *N28F020-150 256k 12v
    m27c256b 32k 12.75 cannot erase
    am27c512-200jc 512k 12 cannot erase
    29f040qc-90 512k 5v
    *SST37VF010 128k 12v


    Early on I did almost let the magic smoke out of another Intel NIC. I grabbed the wrong chip (m27c256b 15c1 k) and shortly after turning the power on I heard a noise and immediately pulled the power plug. The processor on this nic now has two nice cracks and black liquid escaped from them! The strange thing is that the NIC still seems to work but I don't want to risk using it anymore.
    Last edited by ciper; 12-18-2008 at 05:59 AM.

  12. #27
    Join Date
    Jul 2005
    Posts
    504
    I booted up a copy of fedora10 and used the precompiled 32bit versions of the utilities you linked previously. I got essentially the same results as in post #18 for the Intel chip.

    Do you think it would be safe to hibernate the machine, take the nic out, swap the flash, reinstall the nic then power the system back up? It's essentially the same as hot swapping right?

    Now here is an interesting thing. I took the rom that fboot will happily flash to both the SST and Intel then told homieflash to use it and it also didn't work!
    Through the process of elimination it seems the problem must lie with either eepro enabling the writes or homieflash starting the erase.
    Last edited by ciper; 12-18-2008 at 06:05 AM.

  13. #28
    Join Date
    Nov 2002
    Posts
    1,076
    Are you sure an SST37 would work?
    ?? Are you confusing sst37 & sst39? I said, and showed, that sst39 does work with homieflash. I said that last I tried with an sst37, 2 years ago, I couldn't flash it with homieflash. I just tried an sst37 again; same result (I can read it but not ID it or flash it).

    Homieflash does flash writing using bytes written to DMA'd memory in special patterns. No such patterns are documented in the sst37 spec. In the intel spec, the pattern is different than what homieflash does (which is what is documented for sst39&the amd equivalent).

  14. #29
    Join Date
    Jul 2005
    Posts
    504
    Quote Originally Posted by bcc View Post
    ?? Are you confusing sst37 & sst39? I said, and showed, that sst39 does work with homieflash. I said that last I tried with an sst37, 2 years ago, I couldn't flash it with homieflash. I just tried an sst37 again; same result (I can read it but not ID it or flash it).

    Homieflash does flash writing using bytes written to DMA'd memory in special patterns. No such patterns are documented in the sst37 spec. In the intel spec, the pattern is different than what homieflash does (which is what is documented for sst39&the amd equivalent).
    Yeah that last quote was meant to say SST39. If the SST39 works on the NIC then I should try to track one of those down. Otherwise I will try to find real eprom writing device.

    Those special write patterns must be what is preventing this from working properly. I didn't realize the other tools contained the appropriate configuration for so many different flash chips. Does that mean Homieflash only works with the SST39 and nothing else?

    It's not all bad. Later on when someone decides to flash their own Tivo they can look at this thread for updated tools and know for certain that Fboot only works with images which are less than 64k.

  15. #30
    Join Date
    Nov 2002
    Posts
    1,076
    Here's a version of homieflash which includes commands to flash intel 28f020 chips. Untested of course as I have no such chip. Should be safe to try however.

    Write support for SST39&AMD flash chips are still supported as well.
    Last edited by bcc; 12-23-2008 at 03:33 PM. Reason: see later post for newer homieflash

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •