EC20 DFOTA » History » Version 3
zecke, 12/11/2016 10:48 AM
1 | 1 | zecke | h1. EC20/EC25 Delta Firmware over the air (DFOTA) upgrades |
---|---|---|---|
2 | |||
3 | An example of the DFOTA file is here: http://dfota.quectel-service.com:8088/Dfiles/EC20/EC20EQAR02A05V03-R02A09V02.zip |
||
4 | |||
5 | h2. Start delta upgrade |
||
6 | |||
7 | <pre> |
||
8 | AT+QFOTADL="http://dfota.quectel-service.com:8088/Dfiles/EC20/EC20EQAR02A05V03-R02A09V02.zip" |
||
9 | </pre> |
||
10 | |||
11 | It will start an internal connection manager to terminate data on the Linux module and then run wget to store the file to |
||
12 | "update.zip". If it worked a reboot into the recovery system will be made. |
||
13 | |||
14 | h2. Recovery image |
||
15 | |||
16 | It seems that /usr/bin/recovery will be started and finds a update.zip in the right partition and will then apply |
||
17 | the delta updates. |
||
18 | |||
19 | |||
20 | h2. Delta format |
||
21 | |||
22 | Delta updates are available for the bootloader (?), dsp, userdata and system. It is speculated that for the |
||
23 | system and userdata yaffs2 the actual filesystem will be mounted and individual files will be modified. |
||
24 | |||
25 | <pre> |
||
26 | struct upgrade_file_begin { |
||
27 | uint32_t checksum; // ???? different in all of these upgrades |
||
28 | uint32_t __le len; // len.. E.g. 184014 of a 184059 file |
||
29 | ... still a lot of 32bit length.. not really TLV |
||
30 | }; |
||
31 | struct upgrade_file_trailer { |
||
32 | uint32_t __le len; |
||
33 | char name[len]; with trailing \0 |
||
34 | uint32_t null_end (four bytes 0x00) |
||
35 | }; |
||
36 | </pre> |
||
37 | 2 | zecke | |
38 | 3 | zecke | <pre> |
39 | Trailer... |
||
40 | # system.diff |
||
41 | 50400100803801000000000000030000010000000700000073797374656d0000000000 |
||
42 | # userdata.doff |
||
43 | 50400100803801000000000000030000010000000900000075736572646174610000000000 |
||
44 | # recoveryfs.diff |
||
45 | 50400100803801000000000000030000010000000b0000007265636f7665727966730000000000 |
||
46 | # no length in the beginning just 07... or 09 for the length of the string.. and trailing zero |
||
47 | |||
48 | |||
49 | Odd but also no yaffs2.. 0050.. and 00000050.. but rest splits okay so far.. |
||
50 | # dsp2.diff |
||
51 | 00504001008038010000000000000300000000000000000000 |
||
52 | # boot.diff |
||
53 | 000000504001008038010000000000000300000000000000000000 |
||
54 | # |
||
55 | </pre> |
||
56 | |||
57 | 2 | zecke | |
58 | h2. Kicking the recovery binary |
||
59 | |||
60 | * mount /dev/mtdblock14 /mnt.. |
||
61 | * Place update.zip to /cache/ |
||
62 | * echo "IP_START_UPDATE" > /cache/fota/ipth_config_dfs.txt to say what to do |
||
63 | |||
64 | Was difficult to repeat, e.g. creating backup and mounting system partition failed on second/third tries |
||
65 | |||
66 | <pre> |
||
67 | / # ./strace -o foo.txt -f ./recovery2 |
||
68 | mount: mounting none on /sys/kernel/debug failed: Device or resource busy |
||
69 | Starting recovery on Fri Oct 14 12:39:48 2016 |
||
70 | recovery filesystem table |
||
71 | ========================= |
||
72 | 0 /tmp ramdisk (null) (null) 0 |
||
73 | 1 / auto rootfs (null) 0 |
||
74 | 2 /proc proc proc (null) 0 |
||
75 | 3 /dev/pts devpts devpts (null) 0 |
||
76 | 4 /proc/bus/usb usbfs usbfs (null) 0 |
||
77 | 5 /dev/shm tmpfs tmpfs (null) 0 |
||
78 | 6 /cache yaffs2 /dev/mtdblock9 (null) 0 |
||
79 | 7 /media/card auto /dev/mmcblk0p1 (null) 0 |
||
80 | 8 /system yaffs2 /dev/mtdblock14 (null) 0 |
||
81 | 9 /data yaffs2 /dev/mtdblock15 (null) 0 |
||
82 | 10 /misc mtd /dev/mtdblock10 (null) 0 |
||
83 | |||
84 | rootfs on / type rootfs (rw) |
||
85 | /dev/root on / type yaffs2 (rw,relatime) |
||
86 | proc on /proc type proc (rw,relatime) |
||
87 | sysfs on /sys type sysfs (rw,relatime) |
||
88 | tmpfs on /dev type tmpfs (rw,relatime,size=64k,mode=755) |
||
89 | devpts on /dev/pts type devpts (rw,relatime,mode=600) |
||
90 | tmpfs on /dev/shm type tmpfs (rw,relatime,mode=777) |
||
91 | /dev/mtdblock15 on /usr type yaffs2 (rw,relatime) |
||
92 | /dev/mtdblock9 on /cache type yaffs2 (rw,relatime) |
||
93 | /dev/mtdblock13 on / type yaffs (rw,relatime) |
||
94 | tmpfs on /dev type tmpfs (rw,relatime,size=64k,mode=755) |
||
95 | /dev/mtdblock9 on /cache type yaffs2 (rw,relatime) |
||
96 | none on /sys type sysfs (rw,relatime) |
||
97 | none on /sys/kernel/debug type debugfs (rw,relatime) |
||
98 | proc on /proc type proc (rw,relatime) |
||
99 | total 3 |
||
100 | lrwxrwxrwx 1 root root 31 Jul 21 07:10 boot_hsic_composition -> /usr/bin/usb/compositions/empty |
||
101 | lrwxrwxrwx 1 root root 30 Jul 21 07:10 boot_hsusb_composition -> /usr/bin/usb/compositions/9215 |
||
102 | drwxr-xr-x 1 root root 2048 Jul 21 07:10 compositions |
||
103 | crw--w---- 1 root root 247, 0 Jan 8 1970 /dev/ttyGS0 |
||
104 | RB_Progress: fwrite "/dev/ttyGS1" fail |
||
105 | I:Checking delta update status... |
||
106 | handle_redbend_update: START_DELTA_UPDATE |
||
107 | I:Setting delta update status... |
||
108 | I:Delta update status is set to (IP_PREVIOUS_UPDATE_IN_PROGRESS 0) |
||
109 | I:Start delta update... |
||
110 | I:Setting recovery boot... |
||
111 | I:Recovery mode reached maximum retry. Clear boot message. |
||
112 | mtd: successfully wrote block at bebe0f4800000000 |
||
113 | I:Set boot command "" |
||
114 | I:boot.command= |
||
115 | I:boot.recovery= |
||
116 | I:Update location: /cache/update.zip |
||
117 | I:number of files in zip is 1 |
||
118 | I:verifying file at index 0 |
||
119 | I:No radio diff images found |
||
120 | I:system.diff found |
||
121 | E:No modem package available. |
||
122 | E:No modem update needed. returning O.K |
||
123 | mtd: successfully wrote block at bebe23a000000000 |
||
124 | I:Reset FOTA cookie done. |
||
125 | start fota update (/cache/fota/system.diff) |
||
126 | redbend_fs_entry: device_name: /dev/mtdblock14 |
||
127 | redbend_fs_entry: mount_point: /tmp/system |
||
128 | redbend_fs_entry: update_name: /cache/fota/system.diff |
||
129 | redbend_fs_entry: part_name: system |
||
130 | |||
131 | |||
132 | |||
133 | RB_GetDelta: offset 0x0(0), size 0x14(20) |
||
134 | RB_GetDelta: offset 0x0(0), size 0x18(24) |
||
135 | RB_GetDelta: offset 0x4(4), size 0x3508(13576) |
||
136 | RB_GetDelta: offset 0x0(0), size 0x40(64) |
||
137 | RB_GetDelta: offset 0x350c(13580), size 0x18(24) |
||
138 | RB_GetDelta: offset 0x3510(13584), size 0x27(39) |
||
139 | RB_GetDelta: offset 0x0(0), size 0x14(20) |
||
140 | RB_GetDelta: offset 0x0(0), size 0x18(24) |
||
141 | RB_GetDelta: offset 0x350c(13580), size 0x18(24) |
||
142 | RB_GetDelta: offset 0x0(0), size 0x18(24) |
||
143 | RB_GetDelta: offset 0x0(0), size 0x18(24) |
||
144 | RB_GetDelta: offset 0x350c(13580), size 0x18(24) |
||
145 | RB_GetDelta: offset 0x3524(13604), size 0x4(4) |
||
146 | RB_GetDelta: offset 0x3528(13608), size 0x4(4) |
||
147 | RB_GetDelta: offset 0x352c(13612), size 0x7(7) |
||
148 | RB_GetDelta: offset 0x0(0), size 0x40(64) |
||
149 | RB_GetDelta: offset 0x0(0), size 0x40(64) |
||
150 | RB_GetDelta: offset 0x40(64), size 0x304(772) |
||
151 | RB_GetDelta: offset 0x344(836), size 0xd(13) |
||
152 | RB_GetDelta: offset 0x351(849), size 0x4a8(1192) |
||
153 | FS partition delta dump |
||
154 | RedBend: Delta Info: delta_sig - 0x6d0d05e5 |
||
155 | RedBend: Delta Info: delta_size - 13580 |
||
156 | RedBend: Delta Info: ver - 82000 |
||
157 | RedBend: Delta Info: scout_ver - 80000 |
||
158 | RedBend: Delta Info: flags - 0x80000000 |
||
159 | RedBend: Delta Info: runtype_flags - 0x280 |
||
160 | RedBend: Delta Info: ram_size - 0x200c8 |
||
161 | RedBend: Delta Info: sector_size - 0x40000 |
||
162 | RedBend: Delta Info: dic_sz - 0xdc8 |
||
163 | RedBend: Delta Info: compress_sz - 0x4b5 |
||
164 | RedBend: Delta Info: min_alloc_ram_use - 0x22 |
||
165 | RedBend: Delta Info: ext_info_sz - 2 |
||
166 | RedBend: Delta Info: num_copy - 0 |
||
167 | RedBend: Delta Info: num_diff - 95 |
||
168 | RedBend: Delta Info: num_insert - 3 |
||
169 | RedBend: Delta Info: num_delete - 0 |
||
170 | RedBend: Delta Info: num_del_dirs - 0 |
||
171 | RedBend: Delta Info: num_dirs - 0 |
||
172 | RedBend: Delta Info: num_del_link - 0 |
||
173 | RedBend: Delta Info: num_link - 4 |
||
174 | RedBend: Delta Info: num_critical_update - 95 |
||
175 | RedBend: Delta Info: num_critical_insert - 3 |
||
176 | RB_CreateFolder: /cache/fota/a, mode:0x1ff |
||
177 | open file /cache/fota/a/backup |
||
178 | RB_OpenFile: Path:/cache/fota/a/backup | Mode: RDONLY |
||
179 | First open() with error 2 |
||
180 | open file /tmp/system/etc/version |
||
181 | RB_OpenFile: Path:/tmp/system/etc/version | Mode: RDONLY |
||
182 | First open() with error 2 |
||
183 | open file /tmp/system/etc/version |
||
184 | RB_OpenFile: Path:/tmp/system/etc/version | Mode: RDONLY |
||
185 | First open() with error 2 |
||
186 | RedBend: Error in scout, file signature mismatch in file /tmp/system/etc/version |
||
187 | umount: can't umount /tmp/system: No such file or directory |
||
188 | fota update fail (/cache/fota/system.diff) |
||
189 | I:fs:/cache/update.zip update err |
||
190 | mtd: successfully wrote block at bebe23a000000000 |
||
191 | I:Reset FOTA cookie done. |
||
192 | mtd: successfully wrote block at bebe0f3800000000 |
||
193 | I:Set boot command "" |
||
194 | I:Setting delta update status... |
||
195 | I:Delta update status is set to (IP_PREVIOUS_UPDATE_FAILED 500) |
||
196 | handle_redbend_update: DELTA_UPDATE_IN_PROGRESS |
||
197 | I:Setting delta update status... |
||
198 | I:Delta update status is set to (IP_PREVIOUS_UPDATE_IN_PROGRESS 0) |
||
199 | I:Start delta update... |
||
200 | I:Setting recovery boot... |
||
201 | I:Error opening recovery count file. Ignore. |
||
202 | mtd: successfully wrote block at bebe0f4800000000 |
||
203 | I:Set boot command "boot-recovery" |
||
204 | I:boot.command=boot-recovery |
||
205 | I:boot.recovery=recovery |
||
206 | |||
207 | I:Update location: /cache/update.zip |
||
208 | E:Can't open /cache/update.zip |
||
209 | (No such file or directory) |
||
210 | mtd: successfully wrote block at bebe0f3800000000 |
||
211 | I:Set boot command "" |
||
212 | I:Setting delta update status... |
||
213 | I:Delta update status is set to (IP_PREVIOUS_UPDATE_FAILED 410) |
||
214 | mtd: successfully wrote block at bebe23a000000000 |
||
215 | I:Reset FOTA cookie done. |
||
216 | RB_Progress: fwrite "/dev/ttyGS1" fail |
||
217 | precent:0 total:1 cur:1 |
||
218 | Rebooting after recovery |
||
219 | I:Rebooting at the end of recovery module. |
||
220 | mtd: successfully wrote block at bebe0f8000000000 |
||
221 | I:Set boot command "" |
||
222 | </pre> |