"Series2.5" / TCD540040 / "nightlight SA" / Humax / DirecTV R10 initial observations

[alldeadhomiez]

I have procured one of the new silver SAS2 units, model TCD540040, TCD_ID 540-0001-xxxx-xxxx, manufacture date June 2004. These units run TiVo software version 5.3.N2 and have many differences from previous versions of the Series2 hardware; thus I have dubbed this architecture "Series2.5" and suggest referring to it as such so that users can use the term as a search keyword.

First off, I have been unable to boot the 5.3 drive on an HDVR2. The kernel locks up and silently fails. As HD TeAm reported last week, these units implement a new "TCD1" ABI, so the kernel image now starts at 0x80001fe0 instead of 0x80002000. The extra 0x20 bytes are used to hold "trusted" copies of the boot parameters, so that the hack used in killhdinitrd no longer works. It appears that versions of the TiVo software designed for the 7315-based units may not be backward compatible; we will know more once the 5.3 kernel source is posted. Interestingly, both brcmdrv-rb.o (Series2) and brcmdrv-7315.o (Series2.5) kernel modules were included in version 5.3. Even after replacing the stock kernel with a known good 2.4.20 kernel, 5.3 did not boot correctly on the HDVR2.

My TCD540040 came with PROM version 2.25. This version sports the pretty "sunrise" startup screens seen here instead of the drab gray screens seen on normal Series2 units. PROM version 2.25 does not boot on an HDVR2. The last known PROM version, 2.14 (found on the HR10-250) was backward compatible with all previous Series2 hardware.

The previous Series2 hardware used a NEC VR5432 MIPS processor running at ~166Mhz in big endian mode. Series2.5 hardware uses an "IRD on a chip" Broadcom BCM7317 IC, apparently an (undocumented) close a relative of the BCM7315; a BCM7315 IC includes an integrated MIPS32 CPU running at 175Mhz. On the Series2, the BCM7030-class chipset IC (used for MPEG decoding, PCI, TS demux, etc.) was separate from the CPU.

Several functions have been moved to the main processor in the Series2.5: the NEC USB 2.0 controller and the TiVo ASIC (IDE and scrambling functions) are the two most prominent ones. As far as I can tell, there is no longer even an internal PCI bus. Modem I/O is handled by an external Si2434; the MPEG encoder is still a BCM7040. Like the Series1, the CPU does not appear to support floating point operations, and seems quite a bit slower than the original Series2; the caches on the BCM7315 seem a bit lacking. No EHCI modules are available, and the BCM7315 marketing literature implies that USB 2.0 / High-speed transfers are not supported. Main system memory appears to be 32MB, provided by a single NT5DS16M16BT-6K 16-bit wide DDR component. The crypto chip is still an Atmel AT90SC6464C.

The mainboard is considerably smaller than the Series2 mainboard due to the reduced component count. The power supply looks similar but has noticeably fewer parts. The IDE cable is now an old ATA33 cable, not the ATA66 cable seen on the Series2.

Since there is no public software hack for these units, compromising a Series2.5 device currently requires socketing the PROM and loading a new image. Fortunately, the PROM is still the old, familiar SST37 in PLCC32 form. After modifying the PROM, replace_initrd was used to kill the initrd, and I was able to get a shell on ttyS1.

Overall, my assessment so far is that the Series2.5 is an attempt to lower the manufacturing cost and jack up the sticker price. I was very disappointed that the TiVo hardware is getting slower over time, not faster. I see no advantages to this hardware over a $49 refurb Series2.

Update 2004/12/15:

The 242Mhz BCM7317 CPU in the Series2.5 has been shown to be quicker at many operations than the Series2.0 VR5432, but slower at others (in particular this affects perl scripts and other software that uses the (now emulated) FPU). For more CPU information, see below.

The DirecTV R10 ships with an ATA-66 cable; the SA2.5 models I have seen have ATA-33 cables.

Summary of current known advantages over Series2.0 hardware: higher CPU clock speed, higher memory bandwidth, newer software (5.3/SA, 5.4/DVD, 6.1/DTV)

Known disadvantages: smaller CPU cache / no FPU, less available memory (DVD/Elmo models only), no working USB 2.0 / EHCI support, no software exploits, poor hack compatibility

Update 2005/01/04:

New USB drivers, which also have EHCI support, have been posted here.

Update 2005/01/07:

I did a short writeup on the chain of trust, i.e. why we need to socket the PROM to gain access to the Series2.5. Read and understand it before you ask any questions on this topic.

[alldeadhomiez]

Couple more notes:

To get serial output working correctly, you need to install a loadable module (normally this is done from the 5.3 startup scripts) and stty sane. Here is my new rc.sysinit that I installed to intercept the boot process:

#!/bin/bash

export PATH=/bin:/tvbin:/sbin:/var/hack
export MFS_DEVICE=/dev/hda10
export TIVO_ROOT=
insmod /lib/modules/bcm7315tty.o
stty 115200 sane < /dev/ttyS1
bash < /dev/ttyS1 >& /dev/ttyS1
exec /etc/rc.d/rc.sysinit.orig

Using a generic ax8817x adapter, OHCI drivers, and a completely idle system (no tivoapp loaded), I was able to receive data at 1.1 megabytes/sec and send at 800 kilobytes/sec over TCP with netcat. Some interesting excerpts from the kernel log:

<4>Algorithmics/MIPS FPU Emulator v1.5
<6>BCM7315 serial driver loaded, 2 ports starting at /dev/ttyS0
<6>usb.c: registered new driver usbdevfs
<6>usb.c: registered new driver hub
<6>usb_ohci.c: USB OHCI at membase 0xfffe8100, IRQ 8
<6>usb_ohci.c: usb-OHCI-Direct, BRCM-OHCI
<6>usb.c: new USB bus registered, assigned bus number 1
<6>hub.c: USB hub found
<6>hub.c: 2 ports detected
<6>usb_ohci.c: TiVo 2-chip USB Host Controller
<6>usb_ohci.c: v5.3 Roman Weissgaerber <weissg@vienna.at>, David Brownell
<6>usb_ohci.c: USB OHCI Host Controller Driver

Looks like the (GPL) OHCI module might have been modified to use the native Broadcom interfaces. The "v5.3" is just a coincidence.

[rc3105]

please post any non-development commentary here

TCD540040 - What can I do with this?

Edit 2004/11/12 by ADH:

Walkthrough to hacking your new Series2.5: newbie-friendly instructions by mrblack51
For Sale/Trade: post an offer here if you want to pay somebody to socket your PROM. Suggested subject line: "WTB: PROM socketing"

Edit 2004/12/13 by ADH:

Review and pictures of the DirecTV R10

[alldeadhomiez]

I just ran across a "new" Series2.5 unit at Sam's Club. They are now selling HUMAX branded TiVo units, model T800. The service number prefix is 590. They are 80 hour units selling for $249.99. This is what they look like:

http://www.jr.com/JRProductPage.proc..._Code=HUX+T800

[fixn278]

I also remember seeing an article that Humax would be releasing a 250gb version which would imply native LBA48 assuming they are only using a single drive

[alldeadhomiez]

Originally Posted by fixn278

I also remember seeing an article that Humax would be releasing a 250gb version which would imply native LBA48 assuming they are only using a single drive

5.x uses kernel 2.4.20, which does LBA48 natively.

Also, LBA48 support (needed to boot a kernel that lies past 137GB) was added in PROM version 2.14 on the HR10-250. I haven't checked but I'm pretty sure it's still in 2.25 on the Series2.5 boxes.

[alldeadhomiez]

I have attached a script, patch, and kernel conf file which illustrates the process of building a functional Uma2c-compatible 2.4.20 kernel for 5.3. Note that TiVo has patched 2.4.20 to use the 2.5/2.6 build system, so some of the legacy Makefiles (which I chose to use instead of the 2.5 stuff) are out of date.

I was not able to get EHCI working correctly (and am not convinced that it even exists on the 7317), but the driver is in the tree if you want to play with it.

If your cross compiler is not in /usr/local/tivo-mips, you will need to adjust $(CROSS_DIR) in linux-2.4/Makefile .

The kernel sources are available from: http://www.tivo.com/linux/

[AlphaWolf]

Originally Posted by alldeadhomiez

Overall, my assessment so far is that the Series2.5 is an attempt to lower the manufacturing cost and jack up the sticker price. I was very disappointed that the TiVo hardware is getting slower over time, not faster. I see no advantages to this hardware over a $49 refurb Series2.

But...it includes a free night light, and the regular S2 doesn't. Who in their right mind would resist a free night light?

[kafowler10]

Has anyone determined whether the new silver Tivos can support USB 2.0?

The BCM7315 is USB 1.1 only, but USB 2.0 support could be one of the differences between the BCM7315 and the BCM7317 in the new "Series 2.5" Tivo.

Also, has it also been confirmed whether the BCM7317 has the same 175MHz processor in the BCM7315? Or might it have something closer to the 250MHz processor in the BCM7320?

[alldeadhomiez]

Originally Posted by kafowler10

Has anyone determined whether the new silver Tivos can support USB 2.0?

The BCM7315 is USB 1.1 only, but USB 2.0 support could be one of the differences between the BCM7315 and the BCM7317 in the new "Series 2.5" Tivo.

Well, it didn't work for me, but there is some sort of (hacked-in) 7317 special handling in drivers/usb/tivo/bcm-usb.h:

static int brcm_ehcd_init (void)
{   
    int status = 0;

        {   // Init BRCM USB setup registers for board and HC specific issues
        __u32 *setup = (__u32 *) HC_BASE_ADDR;
        writel( BRCM_USB_SETUP_REG_VAL, &setup[BrcmUsbSetup] );
        writel( BRCM_PLL_CONTROL_REG_VAL, &setup[BrcmPllControl] );

        }

#if 1   //for BCM7317 only
    //straighten out frame length
    writel( 0x000c0020, (volatile u32 *) 0xfffe81f8 );

    //set generic_ctl_11 (USB_UTMICTRL)
    writel( (readl( (u32 *) 0xfffe81ec ) | (1 << 11)), (u32 *) 0xfffe81ec );
#endif

    Pci_ehci_dev = kmalloc( sizeof( struct pci_dev ), GFP_KERNEL );
    if( !Pci_ehci_dev )
        return -ENOMEM;
    strcpy( Pci_ehci_dev->name, "BRCM-EHCI" );
    strcpy( Pci_ehci_dev->slot_name, "EHCI-Direct" );
    pci_resource_start(Pci_ehci_dev, 0) = EHC_BASE_ADDR;
    pci_resource_end(Pci_ehci_dev, 0) = EHC_END_ADDR;
    Pci_ehci_dev->irq = EHC_INT_VECTOR;
    status = usb_hcd_pci_probe (Pci_ehci_dev, &brcm_ehci_pci_ids[0]);

    return( status );
}

I'm pretty sure that's not a real PCI device though - especially because the default Uma2c kernels don't even build PCI support (CONFIG_PCI), and because bcm-usb.h overrides any PCI support functions that are called by the Linux USB code. Thus, the PCI probe is faked, although it does look like usb_hcd_pci_probe() attempts to initialize the hardware and would fail if the EHCI hardware was not present.

They also don't build the EHCI driver, which makes sense because it is very broken when I build it. The whole USB setup on these chips is a bit curious and needs to be explored further.

[kafowler10]

Broadcom recently updated their web site with specifications for the BCM7317. It is quite a bit more robust than the BCM7315 described above.

BCM7317 Specifications

Features include:

• 242 MHz MIPS CPU
  
• 16-bit 133MHz DDR memory controller
  
• Integrated USB 2.0 host controller
  
• ATA5 / Ultra ATA66 controller

The hardware in the new silver Series2 Tivo does appear to be a slight upgrade from the previous Series2 model, not a downgrade as previously suggested.

[alldeadhomiez]

Originally Posted by kafowler10

The hardware in the new silver Series2 Tivo does appear to be a slight upgrade from the previous Series2 model, not a downgrade as previously suggested.

It's a tradeoff.

NEC VR5432:

• 166Mhz
• Separate 32KB instruction and data caches
• FPU
• 83Mhz multiplexed memory interface

BCM7317:

• 242Mhz
• Separate 8KB instruction and data caches
• No FPU
• 133Mhz 16-bit DDR memory interface

The small caches on the BCM7317 might slow things down, but on the VR5432 the cost of a cache miss is probably substantially higher.

Also, if they never release working Uma2c EHCI support, that could be a disadvantage.

The VR5432 info is at http://tivoutils.sf.net .

[my0gr81]

Anyone notice the 8KB onchip boot rom on the BM7317? That does not bode well for the prom mods does it?

[ronnythunder]

well, except for this in the original post:

Originally Posted by alldeadhomiez

Fortunately, the PROM is still the old, familiar SST37 in PLCC32 form.

ronny

[my0gr81]

For this release of hardware it is true, the rom is still separate.

This new "set top box in a chip" solution does offer possibilities for TIVO to forego the separate rom and use the built in one for future releases.