<div dir="ltr">Thanks.<div><br></div><div>Correct with the memorydump, it was able to communicate with device, it does reset at the end which brought it back momentarily. </div><div><br></div><div><div># ./ramdumptool_arm9</div><div>-----------</div><div>RAMDUMPTOOL version undefined</div><div>-----------</div><div>Creating output directory: MemDumpOut</div><div>Initiating RAM Dump capture...</div><div>Detecting device ...</div><div>Port open Success : /dev/ttyUSB0</div><div>Querying device parameters...</div><div>Querying Memory Debug Info...</div><div>1: OCIMEM</div><div> [Base:0xFE800000, Length:0x00008800]</div><div>....</div><div>15: CMM Script</div><div> [Base:0x07FA9320, Length:0x00000474]</div><div>Reading memory...</div><div>100% Complete</div><div><br></div><div>Resetting device ...</div><div>RAM Dump capture SUCCESS!!</div><div>Exit Application!</div><div>#</div></div><div><br></div><div>Thanks for the info regarding the Sahara communication, I will take a look and see if there is something that I can do. I will try to manually re-produce the fault as well, so I can easier test.</div><div><br></div><div>As the current MC7455, after couple of ramdumps (and reboots), it stayed stable enough for me to quickly run qmi-firmware-update which succeeded.</div><div><br></div><div>Of course it would have been easier if I could only initiate the reboot via Sahara, the whole ramdump process takes some time.</div><div><br></div><div>I get back on this when I have something to share.</div><div><br></div><div>-Sebastian</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Nov 22, 2017 at 9:59 AM, Bjørn Mork <span dir="ltr"><<a href="mailto:bjorn@mork.no" target="_blank">bjorn@mork.no</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">Bjørn Mork <<a href="mailto:bjorn@mork.no">bjorn@mork.no</a>> writes:<br> <br> > I believe the bootloader places the modern in some sort of debug mode<br> > when it falls to boot. And it speaks a different protocol (Sahara?) in<br> > this mode. You can download a memory dump using the ramdump tool from<br> > the SDK. Unfortunately, the firmware tools don't speak this protocol.<br> ><br> > But you can switch to a mode which allows firmware updates using some<br> > magic Sahara command. I have done this once a long time ago. Will see<br> > if I can find my notes from back then.<br> <br> </span>OK, found it. But I see that I made a run-once-for-me-only tool, which<br> was too heavily inspired by the ramdump tool from the SDK. Which means<br> that it is copyrighted Sierra Wireless, and not distributable in any<br> form AFAICS. So I cannot provide you with that, unfortunately.<br> <br> But luckily, the most interesting parts of it did not come from the<br> SDK. I found them here: <a href="https://github.com/openpst/libopenpst" rel="noreferrer" target="_blank">https://github.com/openpst/<wbr>libopenpst</a><br> <br> This header is particularily useful, and GPL:<br> <a href="https://github.com/openpst/libopenpst/blob/master/include/qualcomm/sahara.h" rel="noreferrer" target="_blank">https://github.com/openpst/<wbr>libopenpst/blob/master/<wbr>include/qualcomm/sahara.h</a><br> <br> The necessary pseudo code is something along these lines:<br> <br> - probe sahara protocol support by sending a "switch mode" command (0x0C)<br> - if it responds with a sahara "hello" (0x01) then continue<br> - send "hello response" (0x02)<br> - send "switch mode" (0x0C) again, requesting command mode (0x03)<br> - send "hello response" (0x02) again on successful mode switch<br> - send "cmd exec" (0x0D), where the command to execute is either "switch<br> to DMSS" (0x04) or "switch to stream dload" (0x05)<br> <br> You'll find all the emums and structs in the referenced header file.<br> That's supposed to be all. I don't remember which one of the dload<br> protocols I had success with. Looks like I implemented both to be<br> sure...<br> <br> The above might be a unecessarily complicated. I'm not sure you need to<br> go through the "hello" exchange twice, for example. But it worked for<br> me.<br> <br> I guess minimalistic sahara support would be a nice addition to<br> qmi-firmware-update. At least enough to detect the protocol and<br> (opionally?) switch to one of the supported download protocols.<br> <span class="HOEnZb"><font color="#888888"><br> <br> Bjørn<br> </font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><span style="font-size:small">Sebastian Sjöholm</span><br style="font-size:small"><br style="font-size:small"><span style="font-size:small">Simborgarvägen 116</span><br style="font-size:small"><span style="font-size:small">SE-18439 Åkersberga</span><br style="font-size:small"><span style="font-size:small">Sverige</span><br style="font-size:small"><br style="font-size:small"><span style="font-size:small">Mobile : +46 76 335 0667</span><br style="font-size:small"><span style="font-size:small">Email : </span><a href="mailto:sebastian.sjoholm@gmail.com" style="color:rgb(17,85,204);font-size:small" target="_blank">sebastian.sjoholm@gmail.com</a><br style="font-size:small"><span style="font-size:small">Skype : ssjoholm</span><br></div></div></div> </div>