Re: [PATCH 1/8] get_dvb_firmware: Add firmware extractor for si2165
On 29.07.2014 21:45, Antti Palosaari wrote:
Do you need to know whole firmware version?
There is only 1 byte to be used and it is called patch version.
How did you obtain it, from
sniff?
Yes - but it also is visible in code near crc version (see below).
What happens if you don't tell fw version to chip at all?
In other places it is read to verify a fw was uploaded (compare to be
not equal 0x00).
I guess the exact value is never needed (so just for information).
But I did not try it.
Usually, almost 100%, firmware version as well all the other needed
information, is included to firmware image itself. I don't remember many
cases where special handling is needed. One (only one?) of such case is
af9013, where I resolved issues by calculating fw checksum by the
driver. IIRC chip didn't boot if there was wrong checksum for fw.
The checksum is not needed to get the device working.
The chip itself only calculates it when uploading data - and the driver
reads out the calculated checksum and compares it to the expected value.
It is only a verification of the correct upload.
Own headers and checksums causes troubles if I someone would like to
extract different firmwares from various windows binaries to test.
If windows driver needs to know that kind of things, those are usually
found very near firmware image from the driver binary. Most often just
dump 32 bytes after firmware image and it is somewhere there. Or before
firmware image. That is because those are values are stored to same
source code file = compiler puts that stuff ~same location.
I had a look at the driver - the code itself has the constants compiled
in - they are really mixed with the assembly code.
Rewritten in C it is code that has fixed values as parameters to functions.
ret = load_firmware(firmware,
0x12, /* patch version */
48, /* block count */
0xaa0c /* crc */
);
I also would prefer your version with static const variables near the data.
static const unsigned char firmware[] = {
0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,
0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff,
};
static const unsigned int firmware_checksum = 0x01234567;
static const unsigned int firmware_version = 0x002b;
Regards
Matthias
--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 1/8] get_dvb_firmware: Add firmware extractor for si2165
All-in-all, did I understand correctly none of those header values are
not required anymore?
hdr[0] own FW version. used by driver to print our own FW file version
hdr[1] --''--
hdr[2] vendor FW version. programmed to chip register but chip does not
need it. read back in order to detect if FW is loaded or not
hdr[3] padding. not used
hdr[4] number of FW blocks. driver could calculate it.
hdr[5] padding. not used
hdr[6] crc. not mandatory driver could calculate it. not 100% FW
related, chip uses it for every write. verify xfer errors
hdr[7] --''--
regards
Antti
On 07/30/2014 09:50 PM, Matthias Schwarzott wrote:
On 29.07.2014 21:45, Antti Palosaari wrote:
Do you need to know whole firmware version?
There is only 1 byte to be used and it is called patch version.
How did you obtain it, from
sniff?
Yes - but it also is visible in code near crc version (see below).
What happens if you don't tell fw version to chip at all?
In other places it is read to verify a fw was uploaded (compare to be
not equal 0x00).
I guess the exact value is never needed (so just for information).
But I did not try it.
Usually, almost 100%, firmware version as well all the other needed
information, is included to firmware image itself. I don't remember many
cases where special handling is needed. One (only one?) of such case is
af9013, where I resolved issues by calculating fw checksum by the
driver. IIRC chip didn't boot if there was wrong checksum for fw.
The checksum is not needed to get the device working.
The chip itself only calculates it when uploading data - and the driver
reads out the calculated checksum and compares it to the expected value.
It is only a verification of the correct upload.
Own headers and checksums causes troubles if I someone would like to
extract different firmwares from various windows binaries to test.
If windows driver needs to know that kind of things, those are usually
found very near firmware image from the driver binary. Most often just
dump 32 bytes after firmware image and it is somewhere there. Or before
firmware image. That is because those are values are stored to same
source code file = compiler puts that stuff ~same location.
I had a look at the driver - the code itself has the constants compiled
in - they are really mixed with the assembly code.
Rewritten in C it is code that has fixed values as parameters to functions.
ret = load_firmware(firmware,
0x12, /* patch version */
48, /* block count */
0xaa0c /* crc */
);
I also would prefer your version with static const variables near the data.
static const unsigned char firmware[] = {
0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,
0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff,
};
static const unsigned int firmware_checksum = 0x01234567;
static const unsigned int firmware_version = 0x002b;
Regards
Matthias
--
http://palosaari.fi/
--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 1/8] get_dvb_firmware: Add firmware extractor for si2165
On Tue, 29 Jul 2014 07:37:44 +0200
Matthias Schwarzott z...@gentoo.org wrote:
On 23.07.2014 22:10, Antonio Ospite wrote:
On Wed, 23 Jul 2014 21:03:14 +0200
Matthias Schwarzott z...@gentoo.org wrote:
[...]
The crc value:
It protects the content of the file until it is in the demod - so
calculating it on my own would only check if the data is correctly
transferred from the driver into the chip.
But for this I needed to know the algorithm and which data is
checksummed exactly.
Are the different algorithms for CRC values that give 16 bit of output?
You could try jacksum[1] and see if any algorithm it supports
gives you the expected result, there is a handful of 16 bits ones:
jacksum -a all -F #ALGONAME{i} = #CHECKSUM{i} payload.bin
Hi Antonio,
I tried jacksum on the complete firmware and on parts - but it never
matched the results from the chip.
I now found out, that the crc register changes after every 32bit write
to the data register - the fw control registers do not affect it.
So I can try what crc results from writing 32bit portions of data.
But even that did not help in guessing the algorithm, because I do not
want to do 100s of experiments.
some of my experiments:
crc=0x, data=0x - crc=0x
crc=0x, data=0x0001 - crc=0x1021
crc=0x, data=0x0002 - crc=0x2042
crc=0x, data=0x0004 - crc=0x4084
crc=0x, data=0x0008 - crc=0x8108
crc=0x, data=0x0010 - crc=0x1231
Is there some systematic way to get the formula?
I don't know much about crc, but the values you are getting look like
the entries in the table in lib/crc-itu-t.c so maybe compare the crc
you are getting with the ones calculated with crc_itu_t() from
include/linux/crc-itu-t.h
I just did a quick test with jacksum, the crc-itu-t parameters can
be expressed like this:
jacksum -x -a crc:16,1021,0,false,false,0 -q 0010
and the output is the expected 0x1231 for the 0x0010 sequence.
[...]
Ciao,
Antonio
--
Antonio Ospite
http://ao2.it
A: Because it messes up the order in which people normally read text.
See http://en.wikipedia.org/wiki/Posting_style
Q: Why is top-posting such a bad thing?
--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 1/8] get_dvb_firmware: Add firmware extractor for si2165
On 07/29/2014 11:53 AM, Antonio Ospite wrote:
On Tue, 29 Jul 2014 07:37:44 +0200
Matthias Schwarzott z...@gentoo.org wrote:
On 23.07.2014 22:10, Antonio Ospite wrote:
On Wed, 23 Jul 2014 21:03:14 +0200
Matthias Schwarzott z...@gentoo.org wrote:
[...]
The crc value:
It protects the content of the file until it is in the demod - so
calculating it on my own would only check if the data is correctly
transferred from the driver into the chip.
But for this I needed to know the algorithm and which data is
checksummed exactly.
Are the different algorithms for CRC values that give 16 bit of output?
You could try jacksum[1] and see if any algorithm it supports
gives you the expected result, there is a handful of 16 bits ones:
jacksum -a all -F #ALGONAME{i} = #CHECKSUM{i} payload.bin
Hi Antonio,
I tried jacksum on the complete firmware and on parts - but it never
matched the results from the chip.
I now found out, that the crc register changes after every 32bit write
to the data register - the fw control registers do not affect it.
So I can try what crc results from writing 32bit portions of data.
But even that did not help in guessing the algorithm, because I do not
want to do 100s of experiments.
some of my experiments:
crc=0x, data=0x - crc=0x
crc=0x, data=0x0001 - crc=0x1021
crc=0x, data=0x0002 - crc=0x2042
crc=0x, data=0x0004 - crc=0x4084
crc=0x, data=0x0008 - crc=0x8108
crc=0x, data=0x0010 - crc=0x1231
Is there some systematic way to get the formula?
I don't know much about crc, but the values you are getting look like
the entries in the table in lib/crc-itu-t.c so maybe compare the crc
you are getting with the ones calculated with crc_itu_t() from
include/linux/crc-itu-t.h
I just did a quick test with jacksum, the crc-itu-t parameters can
be expressed like this:
jacksum -x -a crc:16,1021,0,false,false,0 -q 0010
and the output is the expected 0x1231 for the 0x0010 sequence.
maybe crc = crc + crc(val)
Antti
--
http://palosaari.fi/
--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 1/8] get_dvb_firmware: Add firmware extractor for si2165
On 29.07.2014 13:34, Antti Palosaari wrote:
On 07/29/2014 11:53 AM, Antonio Ospite wrote:
On Tue, 29 Jul 2014 07:37:44 +0200
Matthias Schwarzott z...@gentoo.org wrote:
On 23.07.2014 22:10, Antonio Ospite wrote:
On Wed, 23 Jul 2014 21:03:14 +0200
Matthias Schwarzott z...@gentoo.org wrote:
[...]
The crc value:
It protects the content of the file until it is in the demod - so
calculating it on my own would only check if the data is correctly
transferred from the driver into the chip.
But for this I needed to know the algorithm and which data is
checksummed exactly.
Are the different algorithms for CRC values that give 16 bit of
output?
You could try jacksum[1] and see if any algorithm it supports
gives you the expected result, there is a handful of 16 bits ones:
jacksum -a all -F #ALGONAME{i} = #CHECKSUM{i} payload.bin
Hi Antonio,
I tried jacksum on the complete firmware and on parts - but it never
matched the results from the chip.
I now found out, that the crc register changes after every 32bit write
to the data register - the fw control registers do not affect it.
So I can try what crc results from writing 32bit portions of data.
But even that did not help in guessing the algorithm, because I do not
want to do 100s of experiments.
some of my experiments:
crc=0x, data=0x - crc=0x
crc=0x, data=0x0001 - crc=0x1021
crc=0x, data=0x0002 - crc=0x2042
crc=0x, data=0x0004 - crc=0x4084
crc=0x, data=0x0008 - crc=0x8108
crc=0x, data=0x0010 - crc=0x1231
Is there some systematic way to get the formula?
I don't know much about crc, but the values you are getting look like
the entries in the table in lib/crc-itu-t.c so maybe compare the crc
you are getting with the ones calculated with crc_itu_t() from
include/linux/crc-itu-t.h
I just did a quick test with jacksum, the crc-itu-t parameters can
be expressed like this:
jacksum -x -a crc:16,1021,0,false,false,0 -q 0010
and the output is the expected 0x1231 for the 0x0010 sequence.
maybe crc = crc + crc(val)
It worked to apply crc_itu_t to the written data in 32bit blocks,
but starting with the last byte:
crc = crc_itu_t_byte(crc, *(data+offset+3));
crc = crc_itu_t_byte(crc, *(data+offset+2));
crc = crc_itu_t_byte(crc, *(data+offset+1));
crc = crc_itu_t_byte(crc, *(data+offset+0));
It would also have worked without knowing the crc because it is only
actively read and compared in the driver - but better to know if upload
did work.
Now I am still not sure if it is worth to change the firmware file to
now have the crc explicitly.
Counting blocks is also easy todo.
But the firmware version is not inside the data I think.
So there will still remain something to be added to the raw data.
Regards
Matthias
--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 1/8] get_dvb_firmware: Add firmware extractor for si2165
On 07/29/2014 10:22 PM, Matthias Schwarzott wrote:
On 29.07.2014 13:34, Antti Palosaari wrote:
On 07/29/2014 11:53 AM, Antonio Ospite wrote:
On Tue, 29 Jul 2014 07:37:44 +0200
Matthias Schwarzott z...@gentoo.org wrote:
On 23.07.2014 22:10, Antonio Ospite wrote:
On Wed, 23 Jul 2014 21:03:14 +0200
Matthias Schwarzott z...@gentoo.org wrote:
[...]
The crc value:
It protects the content of the file until it is in the demod - so
calculating it on my own would only check if the data is correctly
transferred from the driver into the chip.
But for this I needed to know the algorithm and which data is
checksummed exactly.
Are the different algorithms for CRC values that give 16 bit of
output?
You could try jacksum[1] and see if any algorithm it supports
gives you the expected result, there is a handful of 16 bits ones:
jacksum -a all -F #ALGONAME{i} = #CHECKSUM{i} payload.bin
Hi Antonio,
I tried jacksum on the complete firmware and on parts - but it never
matched the results from the chip.
I now found out, that the crc register changes after every 32bit write
to the data register - the fw control registers do not affect it.
So I can try what crc results from writing 32bit portions of data.
But even that did not help in guessing the algorithm, because I do not
want to do 100s of experiments.
some of my experiments:
crc=0x, data=0x - crc=0x
crc=0x, data=0x0001 - crc=0x1021
crc=0x, data=0x0002 - crc=0x2042
crc=0x, data=0x0004 - crc=0x4084
crc=0x, data=0x0008 - crc=0x8108
crc=0x, data=0x0010 - crc=0x1231
Is there some systematic way to get the formula?
I don't know much about crc, but the values you are getting look like
the entries in the table in lib/crc-itu-t.c so maybe compare the crc
you are getting with the ones calculated with crc_itu_t() from
include/linux/crc-itu-t.h
I just did a quick test with jacksum, the crc-itu-t parameters can
be expressed like this:
jacksum -x -a crc:16,1021,0,false,false,0 -q 0010
and the output is the expected 0x1231 for the 0x0010 sequence.
maybe crc = crc + crc(val)
It worked to apply crc_itu_t to the written data in 32bit blocks,
but starting with the last byte:
crc = crc_itu_t_byte(crc, *(data+offset+3));
crc = crc_itu_t_byte(crc, *(data+offset+2));
crc = crc_itu_t_byte(crc, *(data+offset+1));
crc = crc_itu_t_byte(crc, *(data+offset+0));
It would also have worked without knowing the crc because it is only
actively read and compared in the driver - but better to know if upload
did work.
Now I am still not sure if it is worth to change the firmware file to
now have the crc explicitly.
Counting blocks is also easy todo.
But the firmware version is not inside the data I think.
So there will still remain something to be added to the raw data.
Do you need to know whole firmware version? How did you obtain it, from
sniff? What happens if you don't tell fw version to chip at all?
Usually, almost 100%, firmware version as well all the other needed
information, is included to firmware image itself. I don't remember many
cases where special handling is needed. One (only one?) of such case is
af9013, where I resolved issues by calculating fw checksum by the
driver. IIRC chip didn't boot if there was wrong checksum for fw.
Own headers and checksums causes troubles if I someone would like to
extract different firmwares from various windows binaries to test.
If windows driver needs to know that kind of things, those are usually
found very near firmware image from the driver binary. Most often just
dump 32 bytes after firmware image and it is somewhere there. Or before
firmware image. That is because those are values are stored to same
source code file = compiler puts that stuff ~same location.
static const unsigned char firmware[] = {
0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,
0x88,0x99,0xaa,0xbb,0xcc,0xdd,0xee,0xff,
};
static const unsigned int firmware_checksum = 0x01234567;
static const unsigned int firmware_version = 0x002b;
regards
Antti
--
http://palosaari.fi/
--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 1/8] get_dvb_firmware: Add firmware extractor for si2165
On 23.07.2014 22:10, Antonio Ospite wrote:
On Wed, 23 Jul 2014 21:03:14 +0200
Matthias Schwarzott z...@gentoo.org wrote:
[...]
The crc value:
It protects the content of the file until it is in the demod - so
calculating it on my own would only check if the data is correctly
transferred from the driver into the chip.
But for this I needed to know the algorithm and which data is
checksummed exactly.
Are the different algorithms for CRC values that give 16 bit of output?
You could try jacksum[1] and see if any algorithm it supports
gives you the expected result, there is a handful of 16 bits ones:
jacksum -a all -F #ALGONAME{i} = #CHECKSUM{i} payload.bin
Hi Antonio,
I tried jacksum on the complete firmware and on parts - but it never
matched the results from the chip.
I now found out, that the crc register changes after every 32bit write
to the data register - the fw control registers do not affect it.
So I can try what crc results from writing 32bit portions of data.
But even that did not help in guessing the algorithm, because I do not
want to do 100s of experiments.
some of my experiments:
crc=0x, data=0x - crc=0x
crc=0x, data=0x0001 - crc=0x1021
crc=0x, data=0x0002 - crc=0x2042
crc=0x, data=0x0004 - crc=0x4084
crc=0x, data=0x0008 - crc=0x8108
crc=0x, data=0x0010 - crc=0x1231
Is there some systematic way to get the formula?
I can write arbitrary data and check what crc it results in.
I don't know if it is worth using the crc algorithm compared to storing
the crc with the firmware, because currently it is an end to end
verification of firmware data.
Regards
Matthias
--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 1/8] get_dvb_firmware: Add firmware extractor for si2165
Moikka Matthias
On 07/22/2014 11:12 PM, Matthias Schwarzott wrote:
Signed-off-by: Matthias Schwarzott z...@gentoo.org
---
Documentation/dvb/get_dvb_firmware | 33 -
1 file changed, 32 insertions(+), 1 deletion(-)
diff --git a/Documentation/dvb/get_dvb_firmware
b/Documentation/dvb/get_dvb_firmware
index d91b8be..26c623d 100755
--- a/Documentation/dvb/get_dvb_firmware
+++ b/Documentation/dvb/get_dvb_firmware
@@ -29,7 +29,7 @@ use IO::Handle;
af9015, ngene, az6027, lme2510_lg, lme2510c_s7395,
lme2510c_s7395_old, drxk, drxk_terratec_h5,
drxk_hauppauge_hvr930c, tda10071, it9135, drxk_pctv,
- drxk_terratec_htc_stick, sms1xxx_hcw);
+ drxk_terratec_htc_stick, sms1xxx_hcw, si2165);
# Check args
syntax() if (scalar(@ARGV) != 1);
@@ -783,6 +783,37 @@ sub sms1xxx_hcw {
$allfiles;
}
+sub si2165 {
+my $sourcefile = model_111xxx_122xxx_driver_6_0_119_31191_WHQL.zip;
+my $url = http://www.hauppauge.de/files/drivers/;;
+my $hash = 76633e7c76b0edee47c3ba18ded99336;
+my $fwfile = dvb-demod-si2165.fw;
+my $tmpdir = tempdir(DIR = /tmp, CLEANUP = 1);
+
+checkstandard();
+
+wgetfile($sourcefile, $url . $sourcefile);
+verify($sourcefile, $hash);
+unzip($sourcefile, $tmpdir);
+extract($tmpdir/Driver10/Hcw10bda.sys, 0x80788, 0x81E08-0x80788,
$tmpdir/fw1);
+
+delzero($tmpdir/fw1,$tmpdir/fw1-1);
+#verify($tmpdir/fw1,5e0909858fdf0b5b09ad48b9fe622e70);
+
+my $CRC=\x0A\xCC;
+my $BLOCKS_MAIN=\x27;
+open FW,$fwfile;
+print FW \x01\x00; # just a version id for the driver itself
+print FW \x9A; # fw version
+print FW \x00; # padding
+print FW $BLOCKS_MAIN; # number of blocks of main part
+print FW \x00; # padding
+print FW $CRC; # 16bit crc value of main part
+appendfile(FW,$tmpdir/fw1);
I have to say I little bit dislike that kind of own headers. There is no
way to read firmware version from binary itself (very often there is)?
Whats is benefit of telling how many blocks there is? Isn't it possible
to detect somehow by examining firmware image itself runtime?
Anyhow, you are the author of that driver and even I don't personally
like those, I think it is up to your decision as a author.
regards
Antti
+
+$fwfile;
+}
+
# ---
# Utilities
--
http://palosaari.fi/
--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 1/8] get_dvb_firmware: Add firmware extractor for si2165
On 23.07.2014 11:20, Antti Palosaari wrote: Moikka Matthias Moikka Antti, On 07/22/2014 11:12 PM, Matthias Schwarzott wrote: + +my $CRC=\x0A\xCC; +my $BLOCKS_MAIN=\x27; +open FW,$fwfile; +print FW \x01\x00; # just a version id for the driver itself +print FW \x9A; # fw version +print FW \x00; # padding +print FW $BLOCKS_MAIN; # number of blocks of main part +print FW \x00; # padding +print FW $CRC; # 16bit crc value of main part +appendfile(FW,$tmpdir/fw1); I have to say I little bit dislike that kind of own headers. There is no way to read firmware version from binary itself (very often there is)? Whats is benefit of telling how many blocks there is? Isn't it possible to detect somehow by examining firmware image itself runtime? Anyhow, you are the author of that driver and even I don't personally like those, I think it is up to your decision as a author. I thought a bit about the need for the header. And yes, some fields I can get rid of. firmware version: I guess that the exact version number is not really needed - it is just written to a seperate register - and later only read to check if firmware was already downloaded (but for documentation it might be interesting). I have no clue where it could be in the raw block - it looks like it is writing to just some memory addresses. But for the pure process it would also work to write a random number != 0x00. For $BLOCKS_MAIN: The firmware is downloaded like this: * write 1 block * reset crc logic * write $BLOCKS_MAIN * read out crc and compare against $CRC in header * write last 5 blocks so the number of blocks in $BLOCKS_MAIN could be checked by iterating over all blocks counting them and then substracting 6. The crc value: It protects the content of the file until it is in the demod - so calculating it on my own would only check if the data is correctly transferred from the driver into the chip. But for this I needed to know the algorithm and which data is checksummed exactly. Are the different algorithms for CRC values that give 16 bit of output? Matthias -- To unsubscribe from this list: send the line unsubscribe linux-media in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH 1/8] get_dvb_firmware: Add firmware extractor for si2165
On Wed, 23 Jul 2014 21:03:14 +0200
Matthias Schwarzott z...@gentoo.org wrote:
[...]
The crc value:
It protects the content of the file until it is in the demod - so
calculating it on my own would only check if the data is correctly
transferred from the driver into the chip.
But for this I needed to know the algorithm and which data is
checksummed exactly.
Are the different algorithms for CRC values that give 16 bit of output?
You could try jacksum[1] and see if any algorithm it supports
gives you the expected result, there is a handful of 16 bits ones:
jacksum -a all -F #ALGONAME{i} = #CHECKSUM{i} payload.bin
Ciao,
Antonio
[1] http://www.jonelo.de/java/jacksum/
--
Antonio Ospite
http://ao2.it
A: Because it messes up the order in which people normally read text.
See http://en.wikipedia.org/wiki/Posting_style
Q: Why is top-posting such a bad thing?
--
To unsubscribe from this list: send the line unsubscribe linux-media in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
