Details about MediaMaster Flash Memory Upgrades =============================================== Last update: 29-11-97 Original text file by Icecool. Disclaimer Statement -------------------- This file has been written in order to help people understand the basic upgrade processes or techniques and related information about the Nokia MediaMaster 9200/9500/9600 for pure educational reasons. I may not be held responsible of the use or missuse one may make with this document. Introduction ------------ To begin with, one must understand a little about how the dbox functions. The dbox is actually a quite powerful multimedia computer, and as such has a Processor or CPU, exactly the 68340 by Motorola, RAM for program processing, an operating system with software and finally a non volatile storage device which contains the operating system thus relative operating software. This memory is called Flash RAM which maintains the data stored on it after power is removed from the unit - hence "non volatile". The great advantage that characterises this type of RAM is it's fast response time (speed), hence "Flash RAM". Infact this type of RAM is used in order to minimise DRAM usage and fisical pcb space and architecture because it works just as well as DRAM does and nearly just as fast (there is a 90ns military flash version). One can think of it as a sort of storage device like your HD on your PC with a much much faster access time (HD 10millisec. Flash 100nanosecs!) and no mechanical or moving parts but with a MUCH higher cost per Megabyte (for now). Dbox Flash RAM types -------------------- There are two types of Flash RAM that dboxes can come with: 29F400 or 29F800. Typically the new 9500 dboxes come with a one MegaByte 29f800 flash installed instead of having two 29f400 like the first revisions - this leaves room for easy expandibility:). As one can deduce the 29f400 has 512KBytes per chip. It is important to understand that the CPU indexes the RAM in the same way independantly of the number of chips, what changes is the Chip selection or Chip Enable (CE) in order to index the correct amount of data in the chip and switch to another when over the Top Address but this is done transparantly to the calling program. So this basically means that a software written for a double chip will work just as well on a single chip (maybe even faster:) just think of the RAM expansion on your PC, just add it and work! What does change with different Flash types is the so called "BDM" upgrade process because the CPU is receiving low-level intructions in order to program the Flash RAMS meaning that one must also specify the chip or bank to program but we will see the Background Debugging Mode later more in detail. Dbox Flash RAM Organisation --------------------------- All Flash RAMs are divided into different sectors which are delimited by memory addresses; the 29f800 for ex. has 19 sectors each and each sector is not always the same size for memory versatility purposes. It has 15 64KByte sectors, one 32KByte, one 16KByte and two 8KByte adding to a total of 1MByte. The dbox has certain sectors of the flash RAM write protected via an onboard jumper labeled "XP06". The location of this jumper varies depending on the M/B version: on the newer revisions (29f800) this jumper is located near the CAM slot / modem serial plug , but on the older versions it is "hidden" very well under some plastic housing. As far as I have seen and studied, the dbox's total Flash memory is divided as follows: +-------------------------------+00000h | Prime Boot Loader Sector | 16Kbytes (*) +-------------------------------+03fffh +-------------------------------+04000h | | 8KBytes | +06000h | Custom Program Settings | 8KBytes | +08000h | | 32KBytes +-------------------------------+0ffffh +-------------------------------+10000h | Secondary Boot/System Sector | 64KBytes (*) +-------------------------------+1ffffh +-------------------------------+20000h | | | | | The 14 "Software" Sectors | . . 896KBytes (14x64Kb) . written by the serial loader . . . | | | | +-------------------------------+fffffh (*) = Write protected sector via jumper XP06. Through a quick calculation we find: 896Kbytes = 896 x 1024 = 917.504Bytes of maximum s/w capacity. This means that one cannot load a s/w bigger than 917.504 bytes in the 9500 unless the memory usage is reorganised/optimised - for ex. less storage space for channels could leave more space to program area. I have noticed that the 9600 s/w is actually only a sector bigger than the 9500 one so one could actually optimise it for the 9500 reducing the channel space area - ofcourse one could always add another 29f800 and resolve this once and for all. This "slight" increase of space makes me wonder if the 9600 s/w had been increased on purpose, but I'd have to decompile the code to find out:). Infact, if one tries to install it on a 9500, you will notice that the dbox will receive 15 blocks and not 14; but alas the last block "zaps" through being there no fisical Flash RAM to write and resulting in download error (just re-upload via serial your normal s/w again and everything goes back to normal:). Background Debugging Mode interface ----------------------------------- As you all should know by now, BDM is an acronym for Background Debugging Mode and is a quite indispensable tool for debugging new softwares applied to new systems such as the dbox. Not only, this is a very powerful diagnostic tool enabling qualified servicing personnel to peek and poke all of the dbox's register's, RAM and hardware to see what is going on. It is a fisical "backdoor" on supervisor level that can be opened at any time and can stop any program execution in order to edit/read/write all attached peripherals (ex. mpeg dec type brand, flash ram type, DRAM, firmware etc). This is why one can access the flash RAM using the BDM. Through specific instructions of the CPU one can instruct it to execute a write operation in a determined flash RAM address. This done manually through the BDM software would take a very long time and would be a taedious process; this is why the dboxbdm.exe program has been written. This little program executes a specific routine created specifically for the dbox flash ram upgrade and makes the process a whole lot easier:) Just select the .bin file and dump it to the selected eeprom zone. If your dbox has a non-serial updateable software such as old Multi Choice, DF1 or italian Telepiu s/w V1.51 or 2.051, then you will NEED a BDM to write the new serial loader in the Flash RAM. Infact, the quickest way to update any dbox to a new loader is to only program the loader area (boot kernel area) and then proceed to the normal serial upgrade. If this fails, one can simply write the first .bin file to eeprom0 (overwriting channel settings but also bootloader) and then proceed to the serial upgrade even if the bdox flash ram is now inconsistent or corrupted (it will be overwritten anyway). Remember that to overwrite the bootloader area you will have to jumper XP06 (at power off) or you will have waited for nothing:) NOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTE !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Remember that opening your dbox VOIDS your warranty! Before you dissassemble or remove anything from your dbox, be sure the power cable has been UNPLUGGED from the mains! There are live 220V around the power supply area and this can KILL YOU if touched! Always remember that CMOS electronic components are very very ESD sensistive devices and are damaged irrepairabely by it so before touching any of the inside components of your dbox be sure to ground yourself by touching a grounded metal surface! Now back to the explanation. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! NOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTENOTE The BDM "plug" is located inside your dbox under the modem pcb, which is the card that is screwed on the back of the dbox and has the RJ-11 phone plug. To gain access to it you have to unscrew the modem pcb and unplug it from it's connector coming from the main motherboard (rs232 serial). Once removed you will easily access the 5dil pin connector situated on the back side of your dbox. You can connect here your BDM interface connector being careful to match pin 1 of the dil pins (toward the back of the dbox) with pin 1 of your BDM connector (marked with a red line or an arrow on the connector). Once this has been connected you can proceed by plugging the BDM to the parallel port (LPT1) of your PC (powered off!). If you are running win95, you will need to boot to DOS by pressing F8 at startup and selecting DOS PROMPT option from the menu. Be sure not to load any TSRs before running the dboxbdm.exe program in order to avoid timing problems. Memory Dump .BIN files ---------------------- Via the dboxbdm.exe file and ofcourse a correctly connected and working BDM/SDI interface, one can easily dump/save the entire contents of the dbox's Flash RAM to a file on your HD for later retrieval or backup. One achieves this by launching the dboxbdm.exe and selecting the correct printer port (1 or 2) and subsequently selecting the correct system "timing": for Pentium based systems "100" will do, but for 486/386 the settings may be lower (386/33 = around 40). Here is a CPU speed / BDM settings table comparison: PC Clock Speed (in MegaHertz) BDM s/w Delay Parameter =============================================================== Processor: XT 286,386 486 Pentium 4.77 0 0 8 0 0 10 0 0 12 0 16 1 20 2 10 25 3 12 33 5 15 40 8 20 50 25 60 30 75 66 35 85 75 (est.) 40 95 83 (est.) 50 100 100 (est.) 60 100 =============================================================== For more specific info regarding the original BDM software you can easily find the docs on the net. Once in the program just select the required function for reading (F1) and name the new file (ex. eeprom0.bin) - the dump will start. This process can take from 20 to 40 minutes depending on system performance and parallel settings (it is best to set SPP type LPT mode, but on some Pentium systems EPP mode works faster). This program is quite slow in upgrading probably because it is not really optimised for sector flash updates - whilst the serial upgrade version dumps a sector then writes it in a single block through its own internal loader (yes the famous serial loader is actually a program above a program that is called only at effective power up and has a flash RAM programming method). The writing process is exactly the same, just press + and select the bin file you want to upload in your flash. Remember that if you want to overwrite the bootloader in order to upgrade it to a newer one or to a serial updatable one, you will have to set the XP06 jumper! If you don't, you will achieve maybe an updated s/w version but with NO serial upgrade or just a bad BOOT error! By the way, once you have upgraded your loader, you probably will never use your BDM again, unless a completely new loader is released or a copmletely new organised s/w! Serial Bin files Vs dual BDM Bin files -------------------------------------- As you may have noticed, the original Nokia serial upgrade file(s) are one big .bin file around 900K of length and may vary, but the ones produced by the dboxbdm,exe are TWO 500K .bin files which are exactly the same all the time! This is because the dboxbdm program reads ALL the contents of your flash, regardless whether it is empty or not so achieving the exact dimension of your flash RAM which is exactly 2 x 524.288bytes long(1.048.576) which are the two bin files. Now, why is the normal serial file anyway smaller than the sum of the two bins? Well, considering the fact that the normal serial update version doesn't contain the loader neither the channel settings, your question is nearly answered! By checking the above memory table, you can easily find out that the area occupied by channels and loader is equal to 146.456Bytes which subtracted from the 1.048.576 give us a value which is more or less the same as the big bin file we have for the serial update. Now there is a last point: the serial upload routine automatically "fills" the missing bytes (because most probably the s/w is always a bit smaller than the total amount of s/w allocated flash RAM which is 917.504bytes) in order to reach the end of the last sector. This is why we never have a serial .bin file that is exactly 917.504 bytes long! The only longer version is the 9600 serial upgrade which is about 10bytes longer - and for only ten bytes we 9500 users get the axe! If any of you have comments or suggestions feel free to email me at icecool@dominance.net. If you are looking for any other info or utilities please visit us at these sites: http://www.dominance.net (main site) http://members.planet.it/freewww/icecool (my little website:) If you think you can contribute to this document please do so by adding whatever note you think valuable at the end of it. In no way must any of the preceeding parts be modified prior to my explicit consense. This document may be distrubuted freely.