Tlaciaren Samsung ML-2525 - firmware

[rnbw]

Tak krokovanie funguje. Najprv mi to skakalo to tej prazdnej flash, ale potom sa to nejako (?!) umudrilo a ked som dal potom "resume 0x2600000", tak sa rozblikala LEDka! Uploadol som firmware, zastavil a spustil od 0x26008f0 - flashovanie prebehlo OK! (Teda robil som to dvakrat - prvykrat som uploadol nespravny subor).

Tlaciaren zije
Velke podakovanie pre Andreu za vydatnu pomoc

Kód: Vybrat vše

> resume 0x2600000
> halt
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x60000093 pc: 0x00000028
> mdw 0x2600000
0x02600000: eb000000
> step 0x2600000
target state: halted
target halted in ARM state due to single-step, current mode: Supervisor
cpsr: 0x60000093 pc: 0x02600008
> step
target state: halted
target halted in ARM state due to single-step, current mode: Supervisor
cpsr: 0x60000093 pc: 0x0260000c
> step
target state: halted
target halted in ARM state due to single-step, current mode: Supervisor
cpsr: 0x60000093 pc: 0x02600010
> step
target state: halted
target halted in ARM state due to single-step, current mode: Supervisor
cpsr: 0x60000093 pc: 0x02600014
> step
target state: halted
target halted in ARM state due to single-step, current mode: Supervisor
cpsr: 0x60000093 pc: 0x02600018
> step
target state: halted
target halted in ARM state due to single-step, current mode: Supervisor
cpsr: 0x60000093 pc: 0x0260002c
> step
target state: halted
target halted in ARM state due to single-step, current mode: Supervisor
cpsr: 0x60000093 pc: 0x02600030
> step
target state: halted
target halted in ARM state due to single-step, current mode: Supervisor
cpsr: 0x60000093 pc: 0x02600034
> step
target state: halted
target halted in ARM state due to single-step, current mode: Supervisor
cpsr: 0x80000093 pc: 0x02600038
> step
target state: halted
target halted in ARM state due to single-step, current mode: Supervisor
cpsr: 0x80000093 pc: 0x0260003c
> resume
> halt
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x60000093 pc: 0x000006dc
> step
target state: halted
target halted in ARM state due to single-step, current mode: Supervisor
cpsr: 0x60000093 pc: 0x000006e0
> resume 0x26008f0
> step
target not halted
in procedure 'step'
> halt
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x60000093 pc: 0x00000988
> step 0x26008f0
target state: halted
target halted in ARM state due to single-step, current mode: Supervisor
cpsr: 0x60000093 pc: 0x026007b4
> step
target state: halted
target halted in ARM state due to single-step, current mode: Abort
cpsr: 0x60000097 pc: 0x00000010
> step 0x26008f0
target state: halted
target halted in ARM state due to single-step, current mode: Abort
cpsr: 0x60000097 pc: 0x026007b4
> step
target state: halted
target halted in ARM state due to single-step, current mode: Abort
cpsr: 0x60000097 pc: 0x026007b8
> step
target state: halted
target halted in ARM state due to single-step, current mode: Abort
cpsr: 0x60000097 pc: 0x026007bc
................
> step
target state: halted
target halted in ARM state due to single-step, current mode: Abort
cpsr: 0x60000097 pc: 0x02609544
> step
target state: halted
target halted in ARM state due to single-step, current mode: Abort
cpsr: 0x60000097 pc: 0x0260951c
> resume
> halt
target state: halted
target halted in ARM state due to debug-request, current mode: Abort
cpsr: 0x60000097 pc: 0x02602180
> resume
> resume 0x2600000
target not halted
in procedure 'resume'
> halt
target state: halted
target halted in ARM state due to debug-request, current mode: Abort
cpsr: 0x60000097 pc: 0x026008ec
> resume 0x2600000
> halt
target state: halted
target halted in ARM state due to debug-request, current mode: Abort
cpsr: 0x60000097 pc: 0x026008ec
> resume 0x26008f0

Kód: Vybrat vše

======================
  Start flash_writer
======================
[Iflash]=== Iflash_HWProtection ===
verify_Image : 0x02700000
i_header->pul_start_addr : 0xE59FF060
i_header->ul_count : 0xE59FF060
temp_buf : ���`
SIG : $IMG
Download Image from PC
{
Download destination Address : 0x02700000
Please send data via usb (ISP1582)!!!
USB Chip Device ID= 0000001500008230
Image includes PJL(0000001B) -> Waste 45 bytes
[[524300 Bytes received]] - Complete Downloading

Download end
0x0008000C bytes Received
}/*Download End*/
verify_Image : 0x02700000
i_header->pul_start_addr : 0x00000000
i_header->ul_count : 0x00080000
temp_buf : $IMG
SIG : $IMG

 IFlashCheckSum START!!!
   start addr(0x0270000C) - end addr(0x0278000C)
   checksum(0x0000A5A5) - end addr(0x0278000C)
 IFlashCheckSum return TRUE END!!!

Source Checksum is valid
Found new kernel(0x0271C00C)!!!!
[[[FFFFFFF8]]], [[[000F69A4]]]
Image is invalid
Reset and Download Again

[[[[[ Internal Flash Writing : BASE : 0x00000000]]]]]
start_addr 0x00000000, end_addr = 0x00080000
stat_sector 0x00000000, end_sector 0x00000200
image_start_addr = 0x0270000C

 IFlashMemChipErase START!!!
 IFlashMemChipErase return TRUE END!!!


 IFlashMemProgram START!!!
   src addr(0x0270000C)
   dest start addr(0x00000000) - dest end addr(0x00080000)
   addr(0x00000000) - value(0xE59FF060)
   addr(0x00010000) - value(0xDA000000)
   addr(0x00020000) - value(0x89C4B870)
   addr(0x00030000) - value(0xD40485FB)
   addr(0x00040000) - value(0xDC479765)
   addr(0x00050000) - value(0x209B248C)
   addr(0x00060000) - value(0xE5981000)
   addr(0x00070000) - value(0xA2972DE3)
   addr(0x0007FFFC) - value(0xFFFF0AA3)
 IFlashMemProgram return TRUE END!!!

[Iflash]=== Iflash_HWProtection ===

 ==============================
 Firmware Download completed!!!
 Reset printer
 ==============================

[HWIC]
1PLL
2IOC
3SDRAM
4GPIO
5AHB
[END][Y]
Decompression ***********
-->>>> GO Kernel
jump_ExecCode() : ul_addr - 0x02008000
/***************************/
/*       PBA Test Mode     */
/***************************/
 InitializeWDT
[0x207CCD8]

[Andrea]

Ufffff

Jinak ten ARM má asi od adresy 0x800000 vnitřní periferie a jednou z periferií je nejspíš nějaké rozhraní k té FLASH, protože to tam pořád něco zapisuje a čte. Ale rozluštit to bez datašítu je na palici, jsem moc ráda, že jsi to rozchodil dřív, než mě z toho kleplo.

[rnbw]

Nieco som nasiel uz od 0x400000. Takze na 0x800000 to asi pokracuje. Periferii to ma ako nasranych: LPT, UART, USB, GPIO, PLL, flash, radic SDRAM, riadenie laseru, A/D prevodnik, PWM a riadenie motorov.

Inak 8MB SDRAM je na 0x02000000.

[Andrea]

Když tak nad tím ještě přemýšlím, on ten hw breakpoint nejspíš i fungoval, akorát že byl na špatném místě, měl být na té kopii v RAMce.
Jeden špatný bit a jakou paseku to nadělá. Ve vesmíru by taková tiskárna asi dlouho netiskla. A Soudruzi z Ťamťungu asi udělali někde chybu, když poškození fw blokuje možnost nahrát nový. Ale třeba je to tak schválně.

[rnbw]

Tiez si myslim, ze by to v RAM islo. Mohlo mi to aj skor napadnut, ked tam pri zastaveni bola adresa 0x260XXXX. No hlavne, ze tlaciaren prezila.

Predpokladam, ze ten boot loader nikto v takomto stave neskusal. Mozno v minulosti pri vyvoji (na tu ML-6060, co im tam aj ostal retazec?) a potom to uz len upravovali. A niekto tam pridal tu kontrolu (mozno ako reakcia na Rusov, ktori robili upravene FW, aby tlaciaren tlacila aj ked toner nema chip), kvoli ktorej je to nefunkcne.
Podobne je to aj s BIOSmi na zakladnych doskach PC - bootblock je malokedy funkcny, kedysi som daval ISA floppy radic do slotu, pretoze bootblock nevedel inicializovat ten na doske...

Keby bol dostupny datasheet k tomu Jupiter4E, tak je to jednoducha zalezitost - cez piny PROGRAM, SDA a SCL sa da pravdepodobne prepisat flash externe. Robia to tak asi vo vyrobe, pretoze su tieto piny vyvedene na test pointy a este aj oznacene.

[FlashK]

Hello
printer firmware dead ML-1660
There Jlink. Help please download the firmware to flash through openOCD-0.8.0
How to configure the Target?

[Heno]

Teda rnbw aj Andrea klobúk dole.
Orientoval som sa v tom len velmi malo, ale je mi jasne, že ste o pár levelov vyššie odomna

[FlashK]

sorry translate.google...

по русски:
проблема в том, что ml-1660 с испорченной прошивкой и нужно прошить fullflash.
Я подключил jtag, в openOCD вижу процессор, но не могу настроить его для прошивки flash.

translate:
the problem is that the ml-1660 had a bad firmware and need to flash fullflash.
I connected the jtag, in openOCD see the processor, but I can not configure it for firmware flash.

[rnbw]

You can't flash the firmware directly using OpenOCD as it does not support the Jupiter4E built-in flash. You have to use the bootloader to flash the firmware using USB port. Use serial console to check if the boot loader works.

[FlashK]

can be flash openOСD
See program https://www.youtube.com/watch?v=QLXa8ysqZbQ#t=27
download demo https://yadi.sk/d/zWpqCTyZZJmM9

[Heno]

Pre rmbw - tusim, že si sudruhovia na urale urobili z toho biznis
Ak si nevieš rady s azbukou, mozem pomoct.

P.S. Andrea je teraz Lesana?

[FlashK]

What is a PIN 1 ?

[rnbw]

Nedavno som mal dalsi kus s poskodenym firmware, ale tento isiel bez problemov preflashovat pomocou bootloaderu cez USB.

[rnbw]

Dalsi kus, tentokrat to cez USB nejde, takze musim najst a "prevetrat" ten Wiggler...

[rnbw]

Tentokrat som OpenOCD nekompiloval, pouzil som 0.8.0 z Debianu Jessie. Trochu vzdoroval, pretoze nechcel otvorit paralelny port:

Kód: Vybrat vše

# openocd -f /usr/share/openocd/scripts/interface/parport.cfg
Open On-Chip Debugger 0.8.0 (2014-10-20-22:02)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.sourceforge.net/doc/doxygen/bugs.html
Warn : Adapter driver 'parport' did not declare which transports it allows; assuming legacy JTAG-only
Info : only one transport option; autoselect 'jtag'
parport port = 0x378
Error: cannot open device. check it exists and that user read and write rights are set. errno=2
in procedure 'init'

Cez strace som zistil, ze sa pokusa otvorit /dev/parport888. Treba zmenit v /usr/share/openocd/scripts/interface/parport.cfg _PARPORTADDR na 0 (aby pouzil parport0)!

Potom uz stacilo klasicky zapnut s drzanim CANCEL, poslat cez USB firmware a po hlaseni "Image is invalid" zadat prikazy "halt" a "resume 0x26008f0".