Lars: Protected "The Freeze Fix Project" ([edit=sysop] (indefinite) [move=sysop] (indefinite)) [cascading]

2012-02-22T19:15:01Z

Protected "The Freeze Fix Project" ([edit=sysop] (indefinite) [move=sysop] (indefinite)) [cascading]

Lars: /* Running a Custom Firmware from NFS */

2012-02-04T05:45:51Z

‎Running a Custom Firmware from NFS

Lars: /* Building and Running a Custom Firmware */

2012-02-04T05:41:31Z

‎Building and Running a Custom Firmware

Lars: Created page with "== About == As you may know [http://en.wikipedia.org/wiki/Firmware firmware] 2.9.3 for [http://en.wikipedia.org/wiki/KISS_Technology KiSS] DP-50x players has the so called ''F..."

2012-02-03T09:13:18Z

Created page with "== About == As you may know [http://en.wikipedia.org/wiki/Firmware firmware] 2.9.3 for [http://en.wikipedia.org/wiki/KISS_Technology KiSS] DP-50x players has the so called ''F..."

New page

== About ==
As you may know [http://en.wikipedia.org/wiki/Firmware firmware] 2.9.3 for [http://en.wikipedia.org/wiki/KISS_Technology KiSS] DP-50x players has the so called ''Freeze Bug''. The aim of this project is to debug and eventually fix it.

There is another project called [[Stage2_Main|Stage2]] that works around the ''Freeze Bug'' by using components of different firmware versions.

Thanks to [http://www.divxplayer.nl divxplayer] who donated a DP-508 for this project.

'''All code examples on this page assume that you are doing this on a system running Linux.''' Use [http://en.wikipedia.org/wiki/Windows VmWare Player] to run Linux as a guest inside a [http://en.wikipedia.org/wiki/Windows Windows] system.

== PCB and Components ==

Components:
* [http://www.sigmadesigns.com/ EM8550 Media Processor] (ARM7 based) - [[Media:Em8550datasheet.pdf|Data Sheet]]
* 48LC2M32B2 32MBit [http://en.wikipedia.org/wiki/SDRAM SDRAM] (512K x 32 x 4banks) for the [http://en.wikipedia.org/wiki/Digital_signal_processor DSP] Quasar
* K4S641632F 64MBit [http://en.wikipedia.org/wiki/SDRAM SDRAM] (1M x 16 x 4banks) for the [http://en.wikipedia.org/wiki/ARM7 ARM7] Jasper
* AM29LV320DB 32MBit CMOS Boot Sector [http://en.wikipedia.org/wiki/Flash_memory Flash Memory] (4M x 8/2M x 16)
* DM9000E [http://en.wikipedia.org/wiki/Network_Interface_Controller NIC]
* WM8728 24Bit stereo [http://en.wikipedia.org/wiki/Digital-to-analog_converter DAC] with digital volume control

The EM8550 has two built-in [http://en.wikipedia.org/wiki/Uart UART] controller. One is used for the front panel controller and the other for the serial console. In the lower right corner of the board a [http://en.wikipedia.org/wiki/D-subminiature SUB9] (J18) can be connected. The driver chip (U17, 28pin) that converts from [http://en.wikipedia.org/wiki/Transistor%E2%80%93transistor_logic TTL] to [http://en.wikipedia.org/wiki/Rs232 RS232] voltage levels is not soldered on the board.
{| class="wikitable"
|-
|[[Image:dp508_pcb_upper_full.jpg|thumb]]
|[[Image:dp508_pcb_lower_full.jpg|thumb]]
|-
|}

== Console Access ==

=== Hardware ===

A data cable for [http://en.wikipedia.org/wiki/Mobile_phone mobile phones] (USB-to-Serial converter) is connected to the [http://en.wikipedia.org/wiki/Printed_circuit_board PCB] (T62 -> [http://en.wikipedia.org/wiki/RS-232 TxD], T63 -> [http://en.wikipedia.org/wiki/RS-232 RxD], chassis -> GND). A calliper is connected to J14 and acts as [http://en.wikipedia.org/wiki/Reset_%28computing%29 RESET].
{| class="wikitable"
|[[Image:freezefix_desktop.jpg|thumb]]
|[[Image:freezefix_cables.jpg|thumb]]
|[[Image:Dp50x_console.jpg|thumb]]
|}
Terminal settings are: 115200 [http://en.wikipedia.org/wiki/Baud Baud], [http://en.wikipedia.org/wiki/8N1 8N1], [http://en.wikipedia.org/wiki/Flow_control flow control] disabled.

Buy RS232-to-TTL level converter at [http://www.pollin.de/shop/shop.php?cf=detail.php&pg=NQ==&a=MzY5OTgxOTk= Pollin.de], [http://www.elv.de/output/controller.aspx?cid=74&detail=10&detail2=6149 ELV.de], or [http://www.reichelt.de/?;ACTION=3;LA=2;GROUP=G79;GROUPID=875;ARTICLE=59974 Reichelt.de].

=== Software ===

The [http://en.wikipedia.org/wiki/Boot_loader boot loader] does not output anything to the [http://en.wikipedia.org/wiki/Computer_console console]. It has to be [http://en.wikipedia.org/wiki/Disassembler disassembled] to get further information on its function. It can boot the player from a [http://en.wikipedia.org/wiki/El_Torito_%28CD-ROM_standard%29 bootable CD] or from [http://en.wikipedia.org/wiki/Flash_memory flash], but not from [http://en.wikipedia.org/wiki/Hard_disk hard disk].

An unmodified player uses the [http://en.wikipedia.org/wiki/Computer_console console] only as output device. There is neither a [http://en.wikipedia.org/wiki/Getty_%28Unix%29 getty] nor a [http://en.wikipedia.org/wiki/Shell_%28computing%29 shell] process waiting for keyboard input. If we want to interact with the [http://en.wikipedia.org/wiki/Operating_system operating system] another [http://en.wikipedia.org/wiki/Process_(computing) process] beside the main DVD player application (in the folllowing called ''kissapp'') must run.

{| class="wikitable"
|[[Image:freezefix_minicom.jpg|thumb]]
|[[Image:freezefix_minicom2.jpg|thumb]]
|-
|align="center" colspan="2"|Boot messages from Linux kernel
|}

== Building and Running a Custom Firmware ==

Media players based on [http://www.sigmadesigns.com Sigma Desings'] EM85xx processors are in fact computers powered by special [http://en.wikipedia.org/wiki/Linux Linux] edition named [http://www.uclinux.org/ uCLinux]. [http://en.wikipedia.org/wiki/Firmware Firmwares] for this players are ordinary computer programs compiled for EM85xx processor - if we dig enough we will find [http://en.wikipedia.org/wiki/Linux_kernel Linux kernel], directories, graphics files and decoders prepared as any other application for [http://en.wikipedia.org/wiki/Linux Linux].

A wdoenrufl job. Super helpful information.

=== Building a Custom Kernel ===

[[Build_kernel|This page]] explains how to build a [http://en.wikipedia.org/wiki/Linux_kernel Linux kernel] from the source provided by [http://en.wikipedia.org/wiki/KISS_Technology KiSS]. Since the source does not contain the kernel modules ''fipmodule'', ''khwl'', ''kiss_khwl'' we are forced to use the binary modules.

=== Building a Firmware Image ===

After modifying the extracted [http://en.wikipedia.org/wiki/Firmware firmware] the below [http://en.wikipedia.org/wiki/Shell_script script] will build a [http://en.wikipedia.org/wiki/Firmware firmware] [http://en.wikipedia.org/wiki/ISO_image ISO image] from it.

<pre>
DIR=firmware_dir
ISO=firmware.iso
BOOT=boot293.img

cd ${DIR}
genromfs -v -d romfs -f romfs.bin -a 512 -V 'romfs'
md5sum romfs.bin
cp -f romfs.bin cdrom
md5sum cdrom/loader.bin | sed 's#^$[a-z0-9]*$ .*$#/loader.bin 0 131 \1#' > cdrom/layout.txt
md5sum cdrom/romfs.bin | sed 's#^$[a-z0-9]*$ .*$#/romfs.bin 0x6000 293 \1#' >> cdrom/layout.txt
cp -f $BOOT cdrom/boot.img
mkisofs -V 'KiSS DP-500' -P 'KiSS Technology A/S ' -o ${ISO} -c boot.cat -b boot.img -no-emul-boot -N -U -no-pad -hide boot.cat -hide boot.img cdrom
</pre>

You need the boot image ''boot293.img'', [http://www.dickson.me.uk/2007/06/08/extract-an-el-torito-boot-image-from-an-iso-file-under-linux/ extracted with ''geteltorito''] from the [http://en.wikipedia.org/wiki/Firmware firmware] [http://en.wikipedia.org/wiki/ISO_image ISO image], and a [http://kiss.molteni.net/ patched version of mkisofs] to create a bootable [http://en.wikipedia.org/wiki/ISO_image ISO image] of architecture type 3. Otherwise the [http://en.wikipedia.org/wiki/KISS_Technology KiSS] [http://en.wikipedia.org/wiki/Boot_loader boot loader] will not recognise the disc as a valid one.

The resulting ''firmware.iso'' can be burned on CD and [[Firmware_update|flashed into the player]].

=== Running a Custom Firmware from NFS ===

The above described procedure is very time consuming when testing small changes. The [http://en.wikipedia.org/wiki/Firmware firmware] uses [http://en.wikipedia.org/wiki/Romfs ROMFS] as [http://en.wikipedia.org/wiki/Filesystem filesystem] for the [http://en.wikipedia.org/wiki/Flash_memory flash], which is a read-only [http://en.wikipedia.org/wiki/Filesystem filesystem]. To overcome this limitation, [http://en.wikipedia.org/wiki/Romfs ROMFS] has to be replaced with a read-writeable [http://en.wikipedia.org/wiki/Filesystem filesystem]. This could be [http://en.wikipedia.org/wiki/JFFS2 JFFS2] or [http://en.wikipedia.org/wiki/Network_File_System_%28protocol%29 NFS] among others.

[http://en.wikipedia.org/wiki/Network_File_System_%28protocol%29 NFS] is used by [[Stage2_Main|Stage2]] to simmulate a [http://en.wikipedia.org/wiki/Hard_disk hard disk] over the [http://en.wikipedia.org/wiki/Computer_network network]. So it is obvious to use [http://en.wikipedia.org/wiki/Network_File_System_%28protocol%29 NFS ] also as an alternative for [http://en.wikipedia.org/wiki/Romfs ROMFS]. A server [[NFS_server_setup|can be set up]] very easy.

[[Root_on_NFS|Some more preparations]] are needed to run from [http://en.wikipedia.org/wiki/Network_File_System_%28protocol%29 NFS].

Fralnky I think that's absolutely good stuff.

== The Freeze ==

There are three applications running on the player:

* ''kissapp'' is the [http://en.wikipedia.org/wiki/GUI GUI] and the control [http://en.wikipedia.org/wiki/Computer_program program]. It runs continuously in the [http://en.wikipedia.org/wiki/Background_%28computer_software%29 background], waiting for button presses on the [http://en.wikipedia.org/wiki/Front_panel front panel] or on the [http://en.wikipedia.org/wiki/Remote_control remote]. If needed, it will call other programs to play the media files.
** [http://en.wikipedia.org/wiki/Red_Book_(audio_CD_standard) Audio-CD], [http://en.wikipedia.org/wiki/Video_CD VCD], [http://en.wikipedia.org/wiki/Super_Video_CD SVCD], [http://en.wikipedia.org/wiki/DVD#DVD-Video Video-DVD], [http://en.wikipedia.org/wiki/Jpeg Picture]
* ''fileplayer'' will play the indicated file but will '''not''' update the screen. Instead, it will print a heartbeat message on [http://en.wikipedia.org/wiki/Computer_console console] at every second.
** [http://en.wikipedia.org/wiki/Mp3 MP3], [http://en.wikipedia.org/wiki/Windows_Media_Audio WMA], [http://en.wikipedia.org/wiki/Ogg OGG], [http://en.wikipedia.org/wiki/Dolby_Digital AC3], [http://en.wikipedia.org/wiki/Divx DIVX], [http://en.wikipedia.org/wiki/Shoutcast Webradio]
* ''mpegplayer'' will play the indicated file but will '''not''' update the screen. Instead, it will print a heartbeat message on [http://en.wikipedia.org/wiki/Computer_console console] at every second.
** [http://en.wikipedia.org/wiki/MPEG-1 MPEG1], [http://en.wikipedia.org/wiki/MPEG-2 MPEG2]

On other player models there is a fourth application called ''pclinkmpeg''. Details are not kwown.

=== When and how does it freeze ===

It has been observed that the freeze only happens to ''kissapp''. ''Fileplayer'' and ''mpegplayer'' do not freeze.

Please contribute to the tables by using the [[Talk:The_Freeze_Fix_Project|'''discussion tab''']] of this page. The hardware revision is printed on the back side of the player, the EM8550 revision on the chip. If you do not want to open your player, burn and boot this [[Media:Revtest.iso.bz2|firmware ISO]].

{| class="wikitable" border="1" cellpadding="5" align="center" cellspacing="0"
|+ Freeze Matrix by revision
! rowspan="2"|Hardware !! colspan="2"|EM8550
|-
! width="50"|A !! width="50"|B
|-
! 1
| align="center" bgcolor="red"|Yes || align="center"|?
|-
! 2
| align="center"|? || align="center" bgcolor="red"|Yes
|-
! 3
| align="center"|? || align="center" bgcolor="green"|No
|}

{| class="wikitable" border="1" cellpadding="5" align="center" cellspacing="0"
|+ Freeze Matrix by file type
! rowspan="2"|Type !! colspan="3"|Source
|-
! width="70"|CD/DVD !! width="70"|Harddisk !! width="70"|Network
|-
! Audio-CD
| align="center" bgcolor="green"|No || align="center"|- || align="center"|-
|-
! VCD/SVCD
| align="center" bgcolor="green"|No || align="center"|- || align="center"|-
|-
! Video-DVD
| align="center" bgcolor="green"|No || align="center"|- || align="center"|-
|-
! MP3
| align="center" bgcolor="green"|No || align="center" bgcolor="red"|Yes || align="center" bgcolor="green"|No *
|-
! MPEG1
| align="center" bgcolor="green"|No || align="center"|? || align="center"|?
|-
! MPEG2
| align="center" bgcolor="green"|No || align="center"|? || align="center"|?
|-
! DIVX
| align="center" bgcolor="green"|No || align="center" bgcolor="red"|Yes || align="center" bgcolor="green"|No *
|-
! Webradio
| align="center" | - || align="center" | - || align="center" bgcolor="red"|Yes
|-
! Picture
| align="center" | ? || align="center" | ? || align="center" |?
|-
! Navigation
| align="center" | ? || align="center" bgcolor="red"| Yes || align="center" bgcolor="red"| Yes
|}

* see [[Talk:The_Freeze_Fix_Project|'''discussion tab''']] for reason

Player freezes randomly during playback or file browsing (1-4 times per hour); it hangs during 2 min, and then playback continues.

=== Technical Aspects ===

So far I have observed that ''kissapp'' hangs in an ioctl to the realmagic device (/dev/realmagichwl0).

khwl.o contains functions for accessing eeprom, i2c bus, EM85xx, video memory, overlay, etc and is accesed via /dev/realmagichwl0.

<code>
0.010000 open("/dev/fip", O_RDONLY|O_NONBLOCK) = 3
0.000000 open("/dev/realmagichwl0", O_RDONLY) = 4
....
0.010000 ioctl(4, 0x5393, 0x1465dc0) = 0
0.000000 ioctl(3, 0xc004f11a, 0x1465e20) = 0
</code>

After weeks and months of disassembling the khwl.o from 2.8.8 and 2.9.3 and debugging it I came to the conclusion that the error is within the Quasar microcode.

=== The Solution ===

I am afraid there will be no solution until [http://en.wikipedia.org/wiki/KISS_Technology KiSS] releases the source of the khwl.o driver and the Quasar microcode. Either go for [[Stage2_Main|Stage2]] or drop the player for a different one.

== Download ==

Here you will find [http://en.wikipedia.org/wiki/Firmware firmware] [http://en.wikipedia.org/wiki/ISO_image ISO images] for testing purpose. [[Firmware_update|Flash]] your player with it and report the test result either in the [[Talk:The_Freeze_Fix_Project|'''discussion tab''']] of this page or in [http://www.mpcclub.com/modules.php?name=Forums&file=viewtopic&t=12919 ''The Freeze Fix'' thread] at the [http://www.mpcclub.com/modules.php?name=Forums&file=viewforum&f=101 ''Stage2'' forum].

{| class="wikitable" border="1" cellpadding="5" align="center" cellspacing="0"
|+ Firmware ISO images
! Player || Comment || Purpose || Download
|-
| DP508 || based on original 2.9.3<BR> without the network driver || check if playback from hard disk freezes || [[Media:Dp508_tffp_wo_net.zip|dp508_tffp_wo_net.zip]]
|-
| DP50x || based on original 2.9.3<BR> with stage2 1.0 merged || just for fun || [[Media:Dp50x_tffp_stage2.zip|dp50x_tffp_stage2.zip]]
|}

== Links ==

* Thread: [http://www.mpcclub.com/modules.php?name=Forums&file=viewtopic&t=12919 debug and fix the freeze bug]
* Thread: [http://www.mpcclub.com/modules.php?name=Forums&file=viewtopic&t=5244 Official FREEZE Problem Tracking for DP-50x players]
* Thread: [http://www.gooddvdstuff.com/kissdvd/viewtopic.php?t=4828 FW 2.9.3 freeze bug solution? (new clue)]
* Thread: [http://www.gooddvdstuff.com/kissdvd/viewtopic.php?t=5978 FW 2.9.4 for DP-50X with freeze fix and BiG modifications]
* [http://www.linuxconf.eu/2007/papers/Sirotkin.pdf Hacking Embedded Linux Based Home Appliances]
* [http://www.blackhat.com/presentations/bh-europe-04/bh-eu-04-dehaas/bh-eu-04-dehaas.pdf Reverse Engineering ARM Based Devices]
* [http://www.semiconductors.philips.com/acrobat_download/datasheets/SAA7118_5.pdf SAA7118 Datasheet]
* [http://www.arm.com/miscPDFs/9658.pdf ARM: Assembly Language Programming]
* [http://infocenter.arm.com/help/topic/com.arm.doc.dui0068b/DUI0068.pdf ARM Developer Suite: Assembler Guide]
* [http://martin.hinner.info/ARM-Microcontroller-HOWTO/ARM-Microcontroller-HOWTO.html ARM Microcontroller HOWTO]
* [http://dxr3.sourceforge.net/ Linux DXR3 and Hollywood+ Driver Project]
* [http://www.convergent.com.sg/brochure/DVD8500refdesign.pdf EM8500 progressive DVD player reference design]
* [http://www.ibm.com/developerworks/linux/library/l-debug/ Mastering Linux debugging techniques]
* [http://oss.sgi.com/projects/kdb/ kdb project page], [ftp://oss.sgi.com/projects/kdb/download/old/v2.1 kdb download]
* [http://mediagate.pbwiki.com/ Mediagate MG-35 WIKI], [http://mg35tools.svn.sourceforge.net/viewvc/mg35tools/trunk/ MG-35 Tools]
* [http://www.linuxjournal.com/content/reverse-engineering-malware-linux-ida-pro Reverse Engineering Malware on Linux with IDA Pro]

← Older revision	Revision as of 19:15, 22 February 2012
(No difference)

@@ Line 94: / Line 94: @@
 [[Root_on_NFS|Some more preparations]] are needed to run from [http://en.wikipedia.org/wiki/Network_File_System_%28protocol%29 NFS].
-Fralnky I think that's absolutely good stuff.
+Frankly I think that's absolutely good stuff.
 == The Freeze ==

@@ Line 57: / Line 57: @@
 Media players based on [http://www.sigmadesigns.com Sigma Desings'] EM85xx processors are in fact computers powered by special [http://en.wikipedia.org/wiki/Linux Linux] edition named [http://www.uclinux.org/ uCLinux]. [http://en.wikipedia.org/wiki/Firmware Firmwares] for this players are ordinary computer programs compiled for EM85xx processor - if we dig enough we will find [http://en.wikipedia.org/wiki/Linux_kernel Linux kernel], directories, graphics files and decoders prepared as any other application for [http://en.wikipedia.org/wiki/Linux Linux].
-A wdoenrufl job. Super helpful information.
+A wonderfuld job. Super helpful information.
 === Building a Custom Kernel ===

The Freeze Fix Project - Revision history

Lars: Protected "The Freeze Fix Project" ([edit=sysop] (indefinite) [move=sysop] (indefinite)) [cascading]

Lars: /* Running a Custom Firmware from NFS */

Lars: /* Building and Running a Custom Firmware */

Lars: Created page with "== About == As you may know [http://en.wikipedia.org/wiki/Firmware firmware] 2.9.3 for [http://en.wikipedia.org/wiki/KISS_Technology KiSS] DP-50x players has the so called ''F..."