mlord
join:2006-11-05
Nepean, ON
kudos:9 Reviews:
 ·Start Communicat..
 ·TekSavvy Cable
·TekSavvy DSL
1 edit | reply to mlord
Re: Upgrading Firmware on Thompson DCM475 Okay, there are several distinct regions within the 4MBytes of flash.
The first 64KB appears to be a fixed "bootloader" area, including MAC address and various crypto certificates.
The area from 0x010000 to 0x1fffff (2MB less 64KB in size) is likely the "factory image" area. This consists of a firmware code image, plus padding. The odd thing is, there's a bunch of "junk" in the first few 64KB blocks following the "used portion" of the image here, possibly leftovers from an earlier/larger "manufacturing/test image" at the factory. The "regular" image padding appears to be 16KB blocks of 0xffffffff, except with the first 32-bits of each 16KB block zeroed out 0x00000000.
The area from 0x200000 to 0x3effff (same size as above) looks like the "secondary image" area, used for new firmware downloads in the field. The suspicion is that if a valid image is found here, then the booloader uses it rather than the "factory" image. Currently on my modem, it's a duplicate of the factory image, minus the "junk", with "regular" padding as described above.
It's not clear if field upgrades alternate between the two images, or always go only to the second image. I can probably find out with some experimentation once I have the 02.16 image to play with alongside the 02.08 image.
The final 64KB of flash is mainly used as a set (two sets?) of log buffers.
Since none of the flash has been write-protected, it's easy to do all kinds of experimentation without having to lift the WE (Write Enable) pin. 
Time to start erasing/programming things now. |
|
| Is Rogers the only company refusing to upgrade firmware? How about Videotron? Are they holding the same deplorable attitude and practice? |
|
mlord
join:2006-11-05
Nepean, ON
kudos:9 | Dunno. But for most modems, we can now do it ourselves, or take/send it to Toronto to have it done. I'll be offering updates to DCM-475 modems here in Ottawa shortly.
Cheers |
|
 GonePremium
join:2011-01-24
Fort Erie, ON
kudos:3
·Start Communicat..
| reply to vientito1
said by vientito1:Is Rogers the only company refusing to upgrade firmware? How about Videotron? Are they holding the same deplorable attitude and practice?
For what it's worth, Cogeco will update the firmware of any supported modem connected to its network, regardless of who owns it. |
|
| Please give out sites where we could find info about DIY flashing of most brands we find on market. I have googled but failed to get any useful info so far. |
|
 omasse
join:2004-12-21
Montreal, QC
·ELECTRONICBOX
 ·voip.ms
·Videotron
| reply to vientito1
said by vientito1:Is Rogers the only company refusing to upgrade firmware? How about Videotron? Are they holding the same deplorable attitude and practice?
Couldn't tell for sure, but mine updated itself from STAC.55.01 to STAC.55.04 the first time it joined their network last Februrary. They deactivated the web interface a month later and I haven't been commited enough to find out if they pushed new versions since then.
That's a fascinating thread thanks to mlord and Teddy Boom. Lots of good info in here. |
|
 Teddy Boomk kudos Received
join:2007-01-29
Toronto, ON
kudos:5 | reply to vientito1
said by vientito1:Please give out sites where we could find info about DIY flashing of most brands we find on market. I have googled but failed to get any useful info so far.
Lots of references in this thread to starting points. I hate to be like this, but if you aren't finding anything you aren't looking hard enough. I don't want to go any further in the direction of "how to hack cable internet" so I'm not going to hold your hand on this.
--
electronicsguru.ca/for_sale/Cablemodems |
|
mlord
join:2006-11-05
Nepean, ON
kudos:9 Reviews:
·Start Communicat..
·TekSavvy Cable
·TekSavvy DSL
| reply to mlord
said by mlord:Time to start erasing/programming things now.
Hit a snag here. The USB/Serial code in Arduino is buggy on the receive side, so I've yet to get it to reliably receive programming data from the host. After banging against the wall for a very long time, I found this discussion of the exact same issue:
»code.google.com/p/arduino/issues···l?id=998
So.. I'll have to implement a workaround, I guess. Or figure out how to rebuild/reprogram the Arduino system software.
Cheers |
|
Teddy Boomk kudos Received
join:2007-01-29
Toronto, ON
kudos:5 | said by mlord:Hit a snag here. D'oh! You were making very impressive progress! Everything was going a little too well for you, I guess, time to pay
--
electronicsguru.ca/for_sale/Cablemodems |
|
mlord
join:2006-11-05
Nepean, ON
kudos:9 Reviews:
·Start Communicat..
·TekSavvy Cable
·TekSavvy DSL
2 edits | Workaround now implemented, doing some dry-runs with it now: transfering data, and pretending to erase/program without actually doing it.
Edit: 15 minutes and 6 seconds to transfer the data, without programming the flash for real./edit
Slow. Might take 20 minutes to program the 2MB- file. That's not horrendous, though I was hoping to do it in under 10 minutes. Bedtime now. I'll continue this after work on Friday.
Cheers
Edit: For the curious, the receive buffer seems to overflow after 63-64 bytes on this Arduino board. So, I'm sending the page (256 bytes) data as a series of buffer-fill commands, with each command line never longer than 62 bytes. The Arduino sends back an ack to the host after receipt of each buffer-fill, and the host waits for the ack before sending the next one. After all 256 bytes have been buffered, the host then sends a "program page" command to the Arduino. I could get rid of that last step with some optimization, but it's in there for now.
The 63-64 byte limit likely comes from the USB packet size of 64 bytes for a "full speed" connection like this one. Unnecessary, but due to an Arduino bug that's the limit. |
|
mlord
join:2006-11-05
Nepean, ON
kudos:9 Reviews:
·Start Communicat..
·TekSavvy Cable
·TekSavvy DSL
| said by mlord::) Workaround now implemented, doing some dry-runs with it now: transfering data, and pretending to erase/program without actually doing it.
Edit: 15 minutes and 6 seconds to transfer the data, without programming the flash for real./edit I've now figured out how to hack the Arduino core software, and got the transfer time down to under 9 minutes now. Much better! |
|
Teddy Boomk kudos Received
join:2007-01-29
Toronto, ON
kudos:5 | A fellow Teksavvy reseller brought over a couple of DCM475s this morning. I've now got a copy of 2.16, and I was able to upgrade a modem. Not very thoroughly tested yet, because the upgraded modem is not subscribed on an account, but it certainly did the basics.
Funny how we are both making progress at the same time after most of a year of the issue, but better late than never
--
electronicsguru.ca/for_sale/Cablemodems |
|
 HiVoltPremium
join:2000-12-28
Toronto, ON
kudos:17
·TekSavvy Cable
·TekSavvy DSL
| said by Teddy Boom:Funny how we are both making progress at the same time after most of a year of the issue, but better late than never
That's nice, but what isn't funny is that TekSavvy isn't getting anywhere in getting these issues resolved the way they should be, by a simple firmware push. |
|
 TSI GabePremium,VIP
join:2007-01-03
Chatham, ON
kudos:2 | Trust me...we are working on this. On many different levels. Including looking at hacks like in this thread. |
|
|
|
HiVoltPremium
join:2000-12-28
Toronto, ON
kudos:17 Reviews:
·TekSavvy Cable
·TekSavvy DSL
| said by TSI Gabe:Trust me...we are working on this. On many different levels. Including looking at hacks like in this thread.
Good to hear. |
|
mlord
join:2006-11-05
Nepean, ON
kudos:9 Reviews:
·Start Communicat..
·TekSavvy Cable
·TekSavvy DSL
| reply to Teddy Boom
said by Teddy Boom:A fellow Teksavvy reseller brought over a couple of DCM475s this morning. I've now got a copy of 2.16 Peachy. Which of the two flash images did you replace, the first one, or the second?
I ripped 02.16 from another modem this afternoon, and found it in the first partition. The second partition had 02.08. So perhaps the "factory" image is the one at 00200000 rather than the one at 00010000.
Or more likely, it doesn't matter.. bootloader just picks the newest valid image (?). |
|
Teddy Boomk kudos Received
join:2007-01-29
Toronto, ON
kudos:5 | said by mlord:Which of the two flash images did you replace, the first one, or the second?
I ripped 02.16 from another modem this afternoon, and found it in the first partition. The second partition had 02.08. So perhaps the "factory" image is the one at 00200000 rather than the one at 00010000.
Cheers
I found the same thing. On the 2.16 modem it was 2.16 in image0 and 2.08 in image1. On the 2.08 modem it had 2.08 in both locations. I replaced both on the 2.08 modem. I had to erase and flash the entire firmware at the time, because I didn't have a proper USBJTAG xml file for the DCM475. I've now created that xml, so I could experiment, but I don't have any modems to play with any more
I don't know if my theory about the two images works. It seems to mostly work, and on the DCM425 it seems to always work that way, but... I guess there must be an environment variable that chooses which fw to boot from. Annoying.
--
electronicsguru.ca/for_sale/Cablemodems |
|
mlord
join:2006-11-05
Nepean, ON
kudos:9 Reviews:
·Start Communicat..
·TekSavvy Cable
·TekSavvy DSL
1 edit | reply to Teddy Boom
said by Teddy Boom:Not very thoroughly tested yet, because the upgraded modem is not subscribed on an account, but it certainly did the basics. Once I've reprogrammed my own modem a few times (also not subscribed), I will likely borrow a subscribed stac 02.08 modem from a different buddy, and try it on that one. That should be the acid test, I think. |
|
Teddy Boomk kudos Received
join:2007-01-29
Toronto, ON
kudos:5 | said by mlord:Once I've reprogrammed my own modem a few times (also not subscribed), I will likely borrow a subscribed stac 02.08 modem from a different buddy, and try it on that one. That should be the acid test, I think. To be honest, if it boots it is good. I'm just a little paranoid
--
electronicsguru.ca/for_sale/Cablemodems |
|
mlord
join:2006-11-05
Nepean, ON
kudos:9 Reviews:
·Start Communicat..
·TekSavvy Cable
·TekSavvy DSL
| reply to mlord
Up-to-date, at last! |
Also verified that the MAC address is still the original, and it is.
|
|
