Fortis 4th generation HD receivers: some info

[Audioniek]

The L8.XX bootloader

With the fourth generation of Fortis HD receivers, the major bootloader version number has been changed to 8. Compared to the previous version 7 loaders there are two new features, as already mentioned:

• USB drivers have been improved and now use USB specification 2.0. The net result is that almost any USB stick can now be used to flash the receiver, and that reading the flash file is quite a bit faster.
• Immediately on power up the loader outputs a picture on all available video outputs. The picture is stored in flash memory in mtd3 as a .gz file and can be (re)flashed using IRD-partition 9. Inside the .gz file is a file called resellername.Booting.gam which seems to be a 24-bit uncompressed bitmap file without a colour table. The picture size is 1280x720 pixels.

As customary with Fortis, flashing can be induced by powering up the receiver with a depressed channel-up key on the frontpanel. The current 8.XX loaders do not support switching to booting directly from USB by holding channel-down; at least I have not seen such loaders yet.

The flash memory map

By memory address:

Start         End         Size         Type   Purpose      MTD IRD  fixed  DecSt  DecSz
0x000000000 - 0x0000FFFFF 0x000100000  Flash, bootloader    0   0     Y     0 MB   1 MB
0x000180000 - 0x00037FFFF 0x000200000  Flash, logo          3   9     Y   1.5 MB   2 MB
0x000380000 - 0x0003FFFFF 0x000080000  Flash, EEPROM        4   -     Y   3.5 MB 0.5 MB
0x000400000 - 0x0007FFFFF 0x000400000  Flash, kernel        1   6     Y     4 MB   4 MB
0x000800000 - 0x00BDFFFFF 0x00B600000  Flash, rootfs (UBI)  2   1     Y     8 MB 182 MB
0x008000000 - 0x0080FFFFF 0x000100000  Flash, Configuration 5   -     Y   128 MB   1 MB
0x00BE00000 - 0x00FDFFFFF 0x004000000  Flash, User          6   -     Y   190 MB  64 MB
0x00FE00000 - 0x00FFFFFFF 0x000020000  Flash, config1       8   -     Y   254 MB   2 MB

By MTD:

MTD Start         End         Size         Type   Purpose       IRD  fixed  DecSt  DecSz
 0  0x000000000 - 0x0000FFFFF 0x000100000  Flash, bootloader     0     Y     0 MB   1 MB
 1  0x000400000 - 0x0007FFFFF 0x000400000  Flash, kernel         6     Y     4 MB   4 MB
 2  0x000800000 - 0x00BDFFFFF 0x00B600000  Flash, rootfs (UBI)   1     Y     8 MB 182 MB
 3  0x000180000 - 0x00037FFFF 0x000200000  Flash, logo           9     Y   1.5 MB   2 MB
 4  0x000380000 - 0x0003FFFFF 0x000080000  Flash, EEPROM         -     Y   3.5 MB 0.5 MB
 5  0x008000000 - 0x0080FFFFF 0x000100000  Flash, Configuration  -     Y   128 MB   1 MB
 6  0x00BE00000 - 0x00FDFFFFF 0x004000000  Flash, User           -     Y   190 MB  64 MB
 7  0x000000000 - 0x00FFFFFFF 0x010000000  Flash, entire         -     Y     0 MB 256 MB 
 8  0x00FE00000 - 0x00FFFFFFF 0x000020000  Flash, config1        -     Y   254 MB   2 MB
 
By IRD partition:

IRD Start         End         Size         Type   Purpose        MTD fixed  DecSt  DecSz
 0  0x000000000 - 0x0003FFFFF 0x000100000  Flash, bootloader      0    Y     0 MB   1 MB
 1  0x000800000 - 0x00BDFFFFF 0x00B600000  Flash, rootfs (UBI)    2    Y     8 MB 182 MB
 6  0x000400000 - 0x0007FFFFF 0x000400000  Flash, kernel          1    Y     4 MB   4 MB
 9  0x000180000 - 0x00037FFFF 0x000200000  Flash, logo            3    Y   1.5 MB   2 MB

Compared to the previous loader family L7.xx the following can be noted:

1. The configuration partition mtd5 still exists, but cannot be flashed, and is also located in the exact middle of the flash memory, inside the rootfs. It seems to be not used but it apparently exists for compatibility reasons.
2. The storage for the logo picture is in mtd3, which used to be the dev-partition. It can be (re)flashed using IRD partition 9. I have not yet figured out the precise file format of the picture file apart from the info given above, but solala has given some info towards that goal (see his posting below).
3. Although it cannot be deduced from the info above, the user-partition is no longer used to hold the var folder. The Fortis stock firmware used it to store additional modules such as FreeTV and the plugins. The var folder is now part of the rootfs.
4. The maximum bootloader size has been increased from 256 kbyte to 1 Mbyte.
5. The maximum kernel size has been increased from 3 MB to 4 MB.
6. The maximum rootfs size has been almost doubled from 96 MB to 182 MB. The filesystem in use is still UBI.
7. The user partition has been shrunk from 144 MB to 64 MB and does seem to be used anymore: on all receivers I have seen so far is it is in its erased state. It is however still large enough to hold Neutrino, so maybe someone can figure out a dual boot system in the future.
8. The set of mtd blocks do not cover the entire flash memory; these is a hole of 512 kbyte at 0x00100000 (1 Mbyte).

This memory layout can also be used to hold/run Enigma2 or Neutrino without resorting to exotic tricks like remapping and/or mtd partition concatenation. So far I have used this layout to develop Enigma2 with because with this approach Enigma2/Neutrino can be run in flash without changing anything in the bootloader.

As usual, Fortis uses the tens of the minor version number to indicate the receiver model(s). The earliest minor unit number I have seen is 4, with 5 being current.
At the moment all receivers with a resellerID starting with 0x2A use loader L8.37.

The bootloader environment is held at 0x00100000 (1Mbyte) and has a size of 0x20000 (128 kbyte), This memory area is not part of any mtd block.

Flashing from an .IRD file (loader 8.XX)
The flash process seems to be as follows. First, the loader will load the entire contents of the .IRD in to RAM, starting at address 0x84000000. Each partition will be loaded into RAM in the order they occur in the .IRD file.
The loader will check the CRC checksums in the .IRD against the data read and unpacked (the partitions in the .IRD are Zlib-compressed). The order in which the partitions are flashed is: 0, 1, 6 and 9. Partitions that are absent in the .IRD file are skipped and it does not matter in which order the partitions are present in the .IRD file.
Prior to flashing a partition, the whole partition will be erased. With loader 6.00 and earlier this used to be only the erase blocks that were going to be written to (observed with partitions 6 and 1).

Partition 0 (boot loader) if present in the .IRD will always be flashed at address 0x0 and has a maximum size of 0x00100000 (1 Mbyte).
The kernel partition (6) is always flashed at address 0x00400000.
The next flashable partition (1) will be flashed at the fixed address 0x00800000. This partition must contain a valid UBI file system with the entire rootfs in it.
Partitions 2, 3, 4, 5, 7 and 8 cannot be flashed: if any of them are present in the .IRD file, the flashing process aborts with an Er.11 on the display (size error).
Partition 9 is optional; flashing a boot picture is not mandatory.
As usual, there is no way to change the bootargs by flashing an .IRD file.

More to follow...

Regards,

Audioniek.