EC20 DFOTA » History » Version 5
zecke, 12/11/2016 05:08 PM
1 | 1 | zecke | h1. EC20/EC25 Delta Firmware over the air (DFOTA) upgrades |
---|---|---|---|
2 | |||
3 | An example of the DFOTA file is here: http://dfota.quectel-service.com:8088/Dfiles/EC20/EC20EQAR02A05V03-R02A09V02.zip |
||
4 | |||
5 | h2. Start delta upgrade |
||
6 | |||
7 | <pre> |
||
8 | AT+QFOTADL="http://dfota.quectel-service.com:8088/Dfiles/EC20/EC20EQAR02A05V03-R02A09V02.zip" |
||
9 | </pre> |
||
10 | |||
11 | It will start an internal connection manager to terminate data on the Linux module and then run wget to store the file to |
||
12 | "update.zip". If it worked a reboot into the recovery system will be made. |
||
13 | |||
14 | h2. Recovery image |
||
15 | |||
16 | It seems that /usr/bin/recovery will be started and finds a update.zip in the right partition and will then apply |
||
17 | the delta updates. |
||
18 | |||
19 | |||
20 | h2. Delta format |
||
21 | |||
22 | Delta updates are available for the bootloader (?), dsp, userdata and system. It is speculated that for the |
||
23 | system and userdata yaffs2 the actual filesystem will be mounted and individual files will be modified. |
||
24 | |||
25 | <pre> |
||
26 | struct upgrade_file_begin { |
||
27 | uint32_t checksum; // ???? different in all of these upgrades |
||
28 | 5 | zecke | uint32_t __le len; // len.. E.g. 184014 of a 184059 file, len includes the size of len+checksum too |
29 | 1 | zecke | ... still a lot of 32bit length.. not really TLV |
30 | }; |
||
31 | struct upgrade_file_trailer { |
||
32 | uint32_t __le len; |
||
33 | char name[len]; with trailing \0 |
||
34 | uint32_t null_end (four bytes 0x00) |
||
35 | }; |
||
36 | </pre> |
||
37 | 2 | zecke | |
38 | 1 | zecke | <pre> |
39 | 5 | zecke | Trailer... checksum.. len.. data.. chunks a 32bit aligned with 0x00 padding inbetween.. can be seen with the dsp2.diff |
40 | 3 | zecke | |
41 | 5 | zecke | # system.diff |
42 | 9c113566 2b00000050400100803801000000000000030000010000000700000073797374656d0000000000 |
||
43 | # userdata.diff |
||
44 | 05608f30 2d00000050400100803801000000000000030000010000000900000075736572646174610000000000 |
||
45 | 3 | zecke | # dsp2.diff |
46 | 5 | zecke | 66ecbcdc 20000000504001008038010000000000000300000000000000000000 |
47 | |||
48 | four byte? |
||
49 | 3 | zecke | </pre> |
50 | |||
51 | 2 | zecke | |
52 | h2. Kicking the recovery binary |
||
53 | |||
54 | * mount /dev/mtdblock14 /mnt.. |
||
55 | * Place update.zip to /cache/ |
||
56 | * echo "IP_START_UPDATE" > /cache/fota/ipth_config_dfs.txt to say what to do |
||
57 | |||
58 | Was difficult to repeat, e.g. creating backup and mounting system partition failed on second/third tries |
||
59 | |||
60 | <pre> |
||
61 | / # ./strace -o foo.txt -f ./recovery2 |
||
62 | mount: mounting none on /sys/kernel/debug failed: Device or resource busy |
||
63 | Starting recovery on Fri Oct 14 12:39:48 2016 |
||
64 | recovery filesystem table |
||
65 | ========================= |
||
66 | 0 /tmp ramdisk (null) (null) 0 |
||
67 | 1 / auto rootfs (null) 0 |
||
68 | 2 /proc proc proc (null) 0 |
||
69 | 3 /dev/pts devpts devpts (null) 0 |
||
70 | 4 /proc/bus/usb usbfs usbfs (null) 0 |
||
71 | 5 /dev/shm tmpfs tmpfs (null) 0 |
||
72 | 6 /cache yaffs2 /dev/mtdblock9 (null) 0 |
||
73 | 7 /media/card auto /dev/mmcblk0p1 (null) 0 |
||
74 | 8 /system yaffs2 /dev/mtdblock14 (null) 0 |
||
75 | 9 /data yaffs2 /dev/mtdblock15 (null) 0 |
||
76 | 10 /misc mtd /dev/mtdblock10 (null) 0 |
||
77 | |||
78 | rootfs on / type rootfs (rw) |
||
79 | /dev/root on / type yaffs2 (rw,relatime) |
||
80 | proc on /proc type proc (rw,relatime) |
||
81 | sysfs on /sys type sysfs (rw,relatime) |
||
82 | tmpfs on /dev type tmpfs (rw,relatime,size=64k,mode=755) |
||
83 | devpts on /dev/pts type devpts (rw,relatime,mode=600) |
||
84 | tmpfs on /dev/shm type tmpfs (rw,relatime,mode=777) |
||
85 | /dev/mtdblock15 on /usr type yaffs2 (rw,relatime) |
||
86 | /dev/mtdblock9 on /cache type yaffs2 (rw,relatime) |
||
87 | /dev/mtdblock13 on / type yaffs (rw,relatime) |
||
88 | tmpfs on /dev type tmpfs (rw,relatime,size=64k,mode=755) |
||
89 | /dev/mtdblock9 on /cache type yaffs2 (rw,relatime) |
||
90 | none on /sys type sysfs (rw,relatime) |
||
91 | none on /sys/kernel/debug type debugfs (rw,relatime) |
||
92 | proc on /proc type proc (rw,relatime) |
||
93 | total 3 |
||
94 | lrwxrwxrwx 1 root root 31 Jul 21 07:10 boot_hsic_composition -> /usr/bin/usb/compositions/empty |
||
95 | lrwxrwxrwx 1 root root 30 Jul 21 07:10 boot_hsusb_composition -> /usr/bin/usb/compositions/9215 |
||
96 | drwxr-xr-x 1 root root 2048 Jul 21 07:10 compositions |
||
97 | crw--w---- 1 root root 247, 0 Jan 8 1970 /dev/ttyGS0 |
||
98 | RB_Progress: fwrite "/dev/ttyGS1" fail |
||
99 | I:Checking delta update status... |
||
100 | handle_redbend_update: START_DELTA_UPDATE |
||
101 | I:Setting delta update status... |
||
102 | I:Delta update status is set to (IP_PREVIOUS_UPDATE_IN_PROGRESS 0) |
||
103 | I:Start delta update... |
||
104 | I:Setting recovery boot... |
||
105 | I:Recovery mode reached maximum retry. Clear boot message. |
||
106 | mtd: successfully wrote block at bebe0f4800000000 |
||
107 | I:Set boot command "" |
||
108 | I:boot.command= |
||
109 | I:boot.recovery= |
||
110 | I:Update location: /cache/update.zip |
||
111 | I:number of files in zip is 1 |
||
112 | I:verifying file at index 0 |
||
113 | I:No radio diff images found |
||
114 | I:system.diff found |
||
115 | E:No modem package available. |
||
116 | E:No modem update needed. returning O.K |
||
117 | mtd: successfully wrote block at bebe23a000000000 |
||
118 | I:Reset FOTA cookie done. |
||
119 | start fota update (/cache/fota/system.diff) |
||
120 | redbend_fs_entry: device_name: /dev/mtdblock14 |
||
121 | redbend_fs_entry: mount_point: /tmp/system |
||
122 | redbend_fs_entry: update_name: /cache/fota/system.diff |
||
123 | redbend_fs_entry: part_name: system |
||
124 | |||
125 | |||
126 | |||
127 | RB_GetDelta: offset 0x0(0), size 0x14(20) |
||
128 | RB_GetDelta: offset 0x0(0), size 0x18(24) |
||
129 | RB_GetDelta: offset 0x4(4), size 0x3508(13576) |
||
130 | RB_GetDelta: offset 0x0(0), size 0x40(64) |
||
131 | RB_GetDelta: offset 0x350c(13580), size 0x18(24) |
||
132 | RB_GetDelta: offset 0x3510(13584), size 0x27(39) |
||
133 | RB_GetDelta: offset 0x0(0), size 0x14(20) |
||
134 | RB_GetDelta: offset 0x0(0), size 0x18(24) |
||
135 | RB_GetDelta: offset 0x350c(13580), size 0x18(24) |
||
136 | RB_GetDelta: offset 0x0(0), size 0x18(24) |
||
137 | RB_GetDelta: offset 0x0(0), size 0x18(24) |
||
138 | RB_GetDelta: offset 0x350c(13580), size 0x18(24) |
||
139 | RB_GetDelta: offset 0x3524(13604), size 0x4(4) |
||
140 | RB_GetDelta: offset 0x3528(13608), size 0x4(4) |
||
141 | RB_GetDelta: offset 0x352c(13612), size 0x7(7) |
||
142 | RB_GetDelta: offset 0x0(0), size 0x40(64) |
||
143 | RB_GetDelta: offset 0x0(0), size 0x40(64) |
||
144 | RB_GetDelta: offset 0x40(64), size 0x304(772) |
||
145 | RB_GetDelta: offset 0x344(836), size 0xd(13) |
||
146 | RB_GetDelta: offset 0x351(849), size 0x4a8(1192) |
||
147 | FS partition delta dump |
||
148 | RedBend: Delta Info: delta_sig - 0x6d0d05e5 |
||
149 | RedBend: Delta Info: delta_size - 13580 |
||
150 | RedBend: Delta Info: ver - 82000 |
||
151 | RedBend: Delta Info: scout_ver - 80000 |
||
152 | RedBend: Delta Info: flags - 0x80000000 |
||
153 | RedBend: Delta Info: runtype_flags - 0x280 |
||
154 | RedBend: Delta Info: ram_size - 0x200c8 |
||
155 | RedBend: Delta Info: sector_size - 0x40000 |
||
156 | RedBend: Delta Info: dic_sz - 0xdc8 |
||
157 | RedBend: Delta Info: compress_sz - 0x4b5 |
||
158 | RedBend: Delta Info: min_alloc_ram_use - 0x22 |
||
159 | RedBend: Delta Info: ext_info_sz - 2 |
||
160 | RedBend: Delta Info: num_copy - 0 |
||
161 | RedBend: Delta Info: num_diff - 95 |
||
162 | RedBend: Delta Info: num_insert - 3 |
||
163 | RedBend: Delta Info: num_delete - 0 |
||
164 | RedBend: Delta Info: num_del_dirs - 0 |
||
165 | RedBend: Delta Info: num_dirs - 0 |
||
166 | RedBend: Delta Info: num_del_link - 0 |
||
167 | RedBend: Delta Info: num_link - 4 |
||
168 | RedBend: Delta Info: num_critical_update - 95 |
||
169 | RedBend: Delta Info: num_critical_insert - 3 |
||
170 | RB_CreateFolder: /cache/fota/a, mode:0x1ff |
||
171 | open file /cache/fota/a/backup |
||
172 | RB_OpenFile: Path:/cache/fota/a/backup | Mode: RDONLY |
||
173 | First open() with error 2 |
||
174 | open file /tmp/system/etc/version |
||
175 | RB_OpenFile: Path:/tmp/system/etc/version | Mode: RDONLY |
||
176 | First open() with error 2 |
||
177 | open file /tmp/system/etc/version |
||
178 | RB_OpenFile: Path:/tmp/system/etc/version | Mode: RDONLY |
||
179 | First open() with error 2 |
||
180 | RedBend: Error in scout, file signature mismatch in file /tmp/system/etc/version |
||
181 | umount: can't umount /tmp/system: No such file or directory |
||
182 | fota update fail (/cache/fota/system.diff) |
||
183 | I:fs:/cache/update.zip update err |
||
184 | mtd: successfully wrote block at bebe23a000000000 |
||
185 | I:Reset FOTA cookie done. |
||
186 | mtd: successfully wrote block at bebe0f3800000000 |
||
187 | I:Set boot command "" |
||
188 | I:Setting delta update status... |
||
189 | I:Delta update status is set to (IP_PREVIOUS_UPDATE_FAILED 500) |
||
190 | handle_redbend_update: DELTA_UPDATE_IN_PROGRESS |
||
191 | I:Setting delta update status... |
||
192 | I:Delta update status is set to (IP_PREVIOUS_UPDATE_IN_PROGRESS 0) |
||
193 | I:Start delta update... |
||
194 | I:Setting recovery boot... |
||
195 | I:Error opening recovery count file. Ignore. |
||
196 | mtd: successfully wrote block at bebe0f4800000000 |
||
197 | I:Set boot command "boot-recovery" |
||
198 | I:boot.command=boot-recovery |
||
199 | I:boot.recovery=recovery |
||
200 | |||
201 | I:Update location: /cache/update.zip |
||
202 | E:Can't open /cache/update.zip |
||
203 | (No such file or directory) |
||
204 | mtd: successfully wrote block at bebe0f3800000000 |
||
205 | I:Set boot command "" |
||
206 | I:Setting delta update status... |
||
207 | I:Delta update status is set to (IP_PREVIOUS_UPDATE_FAILED 410) |
||
208 | mtd: successfully wrote block at bebe23a000000000 |
||
209 | I:Reset FOTA cookie done. |
||
210 | RB_Progress: fwrite "/dev/ttyGS1" fail |
||
211 | precent:0 total:1 cur:1 |
||
212 | Rebooting after recovery |
||
213 | I:Rebooting at the end of recovery module. |
||
214 | mtd: successfully wrote block at bebe0f8000000000 |
||
215 | I:Set boot command "" |
||
216 | </pre> |