Good morning.
Uboot for ALI processors will be a useful tool for repairing set-top boxes, but unfortunately there’s a problem with UART communication.
I bought a second set-top box to check whether it was down to the processor settings, but I don’t think that’s the case. I’ll outline the tests point by point to make it easier to understand the problem.
1. The Globo N3 set-top box displays messages after booting the original software, after a reset, and after switching to U-Boot without turning off the power. So it works if there are any entries left in the registers.
2. The Globo set-top box sometimes displayed text from uboot if, before switching on the set-top box via uboot, I held down the Enter key on my computer’s keyboard, which sent a signal to the set-top box via HyperTerminal. This method rarely works and only on the Globo. It didn’t work even once on the second set-top box.
3. I bought a Cabletech 195 set-top box with the same processor. It has no buttons on the front panel. There is no test tool on this set-top box. Launching u-boot after a reset does not display any text other than ‘UP’.
4. I checked how uboot works using a disassembler, and it appears that it only displays ‘UP’ because this is shown by the command 0x2573, i.e. %s.
Other commands – 2566, 2578 and 2561 – which are used, do not display anything.
I reckon there’s some sort of error in the registers where the addresses of the data to be displayed are written. If the original software writes something there, the text is displayed; if not, it isn’t.
The ‘UP’ text is displayed slightly differently, as it is written to register 2, not 0.
ROM:AFC04FF0 C1 AF 02 3C 40 94 42 24 la $v0, aUp # "UP"
ROM:AFC04FF8 03 00 00 10 b loc_AFC05008 # Branch Always
ROM:AFC04FFC 00 00 00 00 nop
ROM:AFC05000 # ---------------------------------------------------------------------------
ROM:AFC05000
ROM:AFC05000 loc_AFC05000: # CODE XREF: sub_AFC04E0C+1DC
ROM:AFC05000 C1 AF 02 3C 44 94 42 24 la $v0, aDown # "DOWN"
ROM:AFC05008
ROM:AFC05008 loc_AFC05008: # CODE XREF: sub_AFC04E0C+1EC ctej
ROM:AFC05008 25 30 40 00 move $a2, $v0 <<<<<<<<<<<<<< Here, the address of the ‘UP’ label is written to register 2 and this is displayed, whilst the data from register 0 is only displayed occasionally.
ROM:AFC0500C 18 00 C5 8F lw $a1, 0x70+var_58($fp) # Load Word
ROM:AFC05010 C1 AF 02 3C lui $v0, 0xAFC1 # Load Upper Immediate
ROM:AFC05014 4C 94 44 24 addiu $a0, $v0, (aPinDIsNowS - 0xAFC10000) # "Pin %d is now %s!\n\r"
ROM:AFC05018 25 01 F0 0F jal sub_AFC00494 # Jump And Link
ROM:AFC0501C 00 00 00 00 nop
You could try copying the register that the subroutine receives for displaying text somewhere into RAM and comparing what is written without the original software with what is written after a reset…
I can’t find it at the moment. I don’t know enough about MIPS.
5. I’ve managed to get something that could be called an ‘echo’ after sending data.
If I don’t touch anything after start-up, pressing the up key after a few minutes causes ‘UP’ to be displayed.
However, if, after switching it on, I press and hold a key on the keyboard for about 10–20 seconds, pressing a key on the panel will no longer display ‘UP’, but rather ‘hex characters’..
This is an extract from the binary log.
FF E0 FF FF
00 00 FF FF FF FF FF
FF FF FF
FF FF FF FF FF FF
E0 FF FF
FF FF FF FF FF FF
C0 FF
FF FF E0
00 FF FF FF 00 00
Clearly, pressing a key triggers a response, but the word ‘UP’ is no longer displayed.
I would ask the author of this thread to add a read operation to the U-Boot at start-up for processor register B8000000, perhaps with a size of 0x100. Since the PIO pin states are displayed, a list could be provided and it could read those 40 positions. The read address can be changed later using a hex editor to read something else, such as the UART or I2C registers, etc. Alternatively, you could write the data from the registers displaying the messages to RAM and replace the U-Boot with one that shows this result, thereby helping to identify the problem.
The original boot process checks the hardware version somewhere around B80000xx.
