Reflash with JTAG

Schueler

Newbie

Offline

Posts: 21

Reflash with JTAG

« on: June 05, 2009, 12:23:36 PM »

Hi,

I am trying to put new firmware on my device. I have the SMCWAPS-G.
First I tried the firmware "CHD2WLANU_R400b7unlock.BIN" which was successful flashed.
Then I flashed the "upgrade-v4.img" which also was successful. Disadvantage is the device is now a conceptronic... nevertheless, it should work now..
Next step was to place a harddrive with "autobootfs" on it.
It seems to work if I look at on the UART debug info.

but....

The network never comes alive.
No IP address is asked or given by the device.
The usual 192.168.123.254, 192.168.2.1 or 192.168.2.10 are not working and look@lan cannot find the device either.

So I tried to flash with the old firmware ( in this case the conceptronic "CHD2WLANU_R400b7unlock.BIN" ).
It was not allowed in webbased mode so I tried the trick with reset by power on but no leds are flashing and no IP address is available ( 192.168.123.254 ).

Next step, I took my Xilinx JTAG cable ( thanks Xilinx ) and connected it to my device.
The RDC Loader software detects my device ( after I soldered a 10K resistor at the SMD R24 position ) and was able to flash the "MGB100rb.bin". But somehow it doesn't work...

this is the mesage I get:

Code:

+Ethernet eth0: MAC address 00:00:01:02:03:04
IP: 192.168.123.254, Default server: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [ROM]
Non-certified release, version v2_0 - built 17:35:13, Aug 7 2007

Platform: PC (I386)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x00000000-0x000f0000, 0x00072390-0x000a0000 available
MGB100-RB by Schufti 07/08/07
<press Ctrl+C to enter prompt mode>

RedBoot>
mem_size: 2000000
Bootsector magic not found (0xffff @ 0x4001fe)
RedBoot>
mem_size: 2000000
Bootsector magic not found (0xffff @ 0x4001fe)
RedBoot>
mem_size: 2000000
Bootsector magic not found (0xffff @ 0x4001fe)
RedBoot>

I expected to be able to upload new firmware now but it is not possible...

When I uploaded the OVS firmware "20071114_Ovislink_WMU-6000FS_R400c3 1114.BIN" which I would like to have on my device because of the printer capability the RDC Loader tells me there are verifying errors.
Strange because this is the original firmware from the website.

Am I missing something or is there something I do wrong?
Please tell me...

Ben


	Logged

When does the hurt stop...

Ernst

Full Member

Offline

Posts: 112

Re: Reflash with JTAG

« Reply #1 on: June 05, 2009, 21:33:58 PM »

Ben,

1.
Did the device work before you tried the autobootfs, i.e. just after you flashed upgrade4.img?

2.
After flashing redboot using jtag you need to use redboot to flash a copy of the full 4 MB. flash. You cannot use redboot to flash firmware files, these need to be flashed from the recovery loader or web ui.

In schufti's repository there is a MTD.BIN file, which is a full dump of the flash memory that can be flashed using redboot.

But why did you try the jtag route if it worked before, or did it never work? In that case I suspect some LAN problem like cabling... or hardware fault of the SMCWAPS-G.

Ernst


	Logged

Schueler

Newbie

Offline

Posts: 21

Re: Reflash with JTAG

« Reply #2 on: June 06, 2009, 00:16:52 AM »

Thank you Ernst for the reply...
( btw, are you dutch? )

Well, As I mentioned I was able to install image_v4.bin which did look fine to me. But when I tried to use autobootfs, somehow that didn't work so well for me.
So I decided to flash the AirLive firmware because it has the printer support which I wanted the first place.
I noticed I couldn't install any other flash anymore.
That's how I came with the idea to use JTAG instead for flashing the kernel.

So I thought when I install redboot I would be able to install other flashes as well right?

WRONG!

I can not find the solution how to do it on the wiki.
Another thing is that I really don't know how to upload a kernel/firmware or whatsoever to redboot.
I used tftp ( pc windows side ) en the load on the device ( redboot ).
Timeout is only what I get.

So, how to upload MTD.BIN?

Ben


	Logged

When does the hurt stop...

Schueler

Newbie

Offline

Posts: 21

Re: Reflash with JTAG

« Reply #3 on: June 06, 2009, 01:41:50 AM »

Ok, this is what I got this far...

RedBoot is running
pressed CTRL-C when asked and is ready to receive commands...

RedBoot> ip_address -l 192.168.1.150

c:\> ping 192.168.1.150
send 4, received 4 ( 100%)

So far so good.

c:\> tftp -i 192.168.1.150 PUT mtd.bin

RedBoot> load -r -v -m tftp -h 192.168.1.90 -b 0x400000 mtd.bin

At this put I on both a time out.

What do I do wrong?
IP address of the PC is 192.168.1.90

Ben


	Logged

When does the hurt stop...

Schueler

Newbie

Offline

Posts: 21

Re: Reflash with JTAG

« Reply #4 on: June 06, 2009, 10:38:03 AM »

I forgot to mention that the ping also worked for the Device to PC.

Code:

RedBoot> ping -n 3 -h 192.168.1.90
Network PING - from 192.168.1.150 to 192.168.1.90
PING - received 3 of 3 expected

One sentence of my previous reply was a bit strange... ( as seen at the time stamp... maybe that was the reason Wink

)

What I mend was: "At this point they both give a timeout."

Ben


	Logged

When does the hurt stop...

Ernst

Full Member

Offline

Posts: 112

Re: Reflash with JTAG

« Reply #5 on: June 06, 2009, 10:45:00 AM »

(Yes I am Dutch.)

As for your second post; let me repeat that flash update annd upgrade files you find on the internet for this box, can only be flashed to the box using the recovery loader (if still working) or the web ui. Thes files contain checksums, headers etc, that only the recovery loader and web ui understand.

Using JTAG to flash redboot and then using redboot to recover the system, you need a full 4.096 KB, dump of the flash, such as MTD.BIN or a dump of your own system. Using someone elses dump means that the box will get their MAC address. So before flashing change it using a hex editor (details in the wiki).

The commands you use in your third post are correct according to my notes.

Are you using a direct connection between PC and MGB100? If not; perhaps try it that way...

I am not very experienced using redboot. Perhaps schufti reads this (otherwise PM him)...

Ernst


	Logged

Schueler

Newbie

Offline

Posts: 21

Re: Reflash with JTAG

« Reply #6 on: June 06, 2009, 11:12:21 AM »

Thanks for your repley.

The last few days I have been searching the internet about this topic. All the bits are scattered around the wikis and forums. To get the complete picture its hard to find. But nevertheless it doesn't stop me of trying Wink

I tried both ways, directly coupled and via a router. Both did work in the way that they where able to see each other.
There is a way to program the flash via xmodem which I tried but got the same result: timeout.

So... it gets a bit frustrating here...

The tip of contacting Schufti is maybe the best idea. His name pops up all the time.

Ben


	Logged

When does the hurt stop...

Schueler

Newbie

Offline

Posts: 21

Re: Reflash with JTAG

« Reply #7 on: June 06, 2009, 14:04:09 PM »

Ok, one step closer to the light...

I am able to upload the mtd.bin file via xmodem.
Beats me why I was not able to at the first time but ok.
I am not able to reproduce the problem.

Nevertheless, This is what I did.
I flashed the MGB100 via JTAG and the RDC loader with the MGB100RB.BIN file
Started the device and hit CTRL-C
Change the IP address to 192.168.1.150 ( this is in my network range )
Checked with the PC if I could ping the device.
Started an upload stream via xmodem
Selected the file ( via terminal -> send file -> xmodem) named mtd.bin
flash the flash...

Code:

RedBoot> ip_address -l 192.168.1.150
IP: 192.168.1.150, Default server: 0.0.0.0
RedBoot> load -r -v -m xmodem -b 0x400000 mtd.bin
CCCCCRaw file loaded 0x00400000-0x007fffff, assumed entry at 0x00400000
xyzModem - CRC mode, 32769(SOH)/0(STX)/0(CAN) packets, 7 retries
RedBoot> fl -s 0x400000 -d 0xffc00000 -l 0x400000
NOR Flash ID = 22a7

[First Sector=0h,Last Sector=46h]

Erase sector................................................................<Fai
l erase 3f,Retry ..>.<Fail erase 3f,Retry ..>.<Fail erase 3f,Retry ..>.<Fail era
se 3f,Retry ..>.<Fail erase 3f,Retry ..><Fail erase 3f>
Upgrading fail,please try again
RedBoot>

At this point I do not know exactly what to do...
I loaded a file of 4MB to fill the whole Flash.
Somewhere in this wiki schufti stated that you cannot flash the whole memory.
My question: how to flash the the stored mtd.bin in memory to flash?

Ben


	Logged

When does the hurt stop...

Schueler

Newbie

Offline

Posts: 21

Re: Reflash with JTAG

« Reply #8 on: June 06, 2009, 16:11:59 PM »

Just to be sure if flash could work or not I tried this:

Code:

RedBoot> fl -s 0x400000 -d 0xffc00000 -l 0x3f0000
NOR Flash ID = 22a7

[First Sector=0h,Last Sector=3eh]

Erase sector...............................................................
Programming.....................................................................
...........................................................

So, that seems to work...
Bad thing is it will not start because the image was not fully programmed.

The length of the code is very important. I just don't know what this should be.

Ben


	Logged

When does the hurt stop...

Ernst

Full Member

Offline

Posts: 112

Re: Reflash with JTAG

« Reply #9 on: June 06, 2009, 16:47:04 PM »

Ben,

From my notes the proper flash command is:

RedBoot> fl -s 0x400000 -d 0xffff0000 -l 0x10000

The remark in the wiki that you cannot flash the full 4 Mb. is not referring to using redboot but using the RDC Loader (DT_4MB_XP.zip) available on the net. That version of the RDC Loader contains a bug or doesn't recognize the flash chip properly so that some sectors in the lower end of memory will contain errors. That is why you need to first flash redboot using the RDC Loader and then use redboot to flash the full 4 Mb. memory dump. Bit of a kludge but it works.

Hope it works with the command above.

Ernst

P.S. Your question on me being Dutch was because you are Dutch also?


	Logged

Schueler

Newbie

Offline

Posts: 21

Re: Reflash with JTAG

« Reply #10 on: June 06, 2009, 17:03:43 PM »

Ernst,

ok, thank you.
I noticed these comments in the wiki but as I read it, this was only if you still had you boot loader and wanted to install your "original" backuped firmware...

I will try this right away, but I have to upload redboot first ( erased be my previous action Wink

)

Ben

P.S.: Yep, i'm dutch too


	Logged

When does the hurt stop...

Schueler

Newbie

Offline

Posts: 21

Re: Reflash with JTAG

« Reply #11 on: June 06, 2009, 18:36:35 PM »

uhm...
didn'work.

But, as shown by load the length should be 0x3fffff ( 0x400000 - 0x7fffff ).
Right?

With -l 10000 it will program 64kB instead of 4MB.
I assume this is for the original bootloader or firmware... ?!?

this is a dump of terminal

Code:

+Ethernet eth0: MAC address 00:00:01:02:03:04
IP: 192.168.123.254, Default server: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [ROM]
Non-certified release, version v2_0 - built 17:35:13, Aug 7 2007

Platform: PC (I386)
Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x00000000-0x000f0000, 0x00072390-0x000a0000 available
MGB100-RB by Schufti 07/08/07
<press Ctrl+C to enter prompt mode>

RedBoot> ^C
RedBoot> load -r -v -m xmodem -b 0x400000 mtd.bin
CRaw file loaded 0x00400000-0x007fffff, assumed entry at 0x00400000
xyzModem - CRC mode, 32769(SOH)/0(STX)/0(CAN) packets, 3 retries
RedBoot> fl -s 0x400000 -d 0xffff0000 -l 0x10000
NOR Flash ID = 22a7

[First Sector=3fh,Last Sector=46h]

Erase sector.<Fail erase 3f,Retry ..>.<Fail erase 3f,Retry ..>.<Fail erase 3f,Re
try ..>.<Fail erase 3f,Retry ..>.<Fail erase 3f,Retry ..><Fail erase 3f>
Upgrading fail,please try again
RedBoot>

As shown, it seems it is not possible to erase memory at this point.
Beats me why. I found some chinees website who used the firmware from macsat and schufti. ( thank google translator to make it readable for me Wink

). But they all didn't give a working solution. They never tried the methods, only mentioning them. So, another dead end.

I wonder how the manufactures where able to load the firmware.
Normally you generate a flash single image for factory flash and for prototyping a bootloader and separate flash parts for website, data, etc.

So, what bootloader did amit use to upload the update images?
And, how do they program it. ( I know the answer but anyway ).

Ben


	Logged

When does the hurt stop...

Ernst

Full Member

Offline

Posts: 112

Re: Reflash with JTAG

« Reply #12 on: June 06, 2009, 18:53:22 PM »

Sorry; indeed I gave you the info to just flash the top 64 Kb.

But those notes (that I collected from reading various posts) suggest that that way you program just the BIOS and recovery loader and subsequently can use the recovery loader to flash any firmware that fits the branding...

So strip of the top 64 Kb of MTD.BIN and flash that using redboot...

In post:

http://www.macsat.com/macsat/component/option,com_smf/Itemid,50/topic,851.msg4759/#msg4759

There is info how to flash the full memory using redboot. But it also finishes off with the remark to subsequently use the recovery loader...

The maker of these boxes (AMIT) probably uses a totally different tool to flash these boxes during production. The RDC loader comes from the R8610 evalaution board, not from AMIT.

You can read from some posts by schufti here that a newer version of the RDC loader exists that can flash the full 4 Mb. without errors. But that version is not generally available.

Ernst


	Logged

schufti

Sr. Member

Offline

Posts: 272

Re: Reflash with JTAG

« Reply #13 on: June 06, 2009, 18:58:02 PM »

Hi,

just some points for clarification:

1) I did state it in numerous post, the wiki, etc, that one should NOT use the damn unlock.bin

2) autoboot fs doesn't have networking out of the box. You'd have to read a lot of pots - or be *nix savvy - to master networking, more so for WLAN.

3) the m$ tftp command is not working with redboot, get a proper tftp server (e.g. solarwinds free tftp server).

4) this should give you enough info on using redboot (did you read the RB manual?)

Code:

RAM: 0x00000000-0x000F0000, 0x00072390-0x000a0000 available
MGB100-RB by Schufti 07/08/07
<press Ctrl+C to enter prompt mode>

RedBoot> ^C
RedBoot>
RedBoot> ip_address -l 192.168.22.108
IP: 192.168.22.108, Default server: 0.0.0.0
RedBoot> load -r -v -m tftp -h 192.168.22.55 -b 0x400000 mtd.bin
|
Raw file loaded 0x00400000-0x007FFFFF, assumed entry at 0x00400000
RedBoot> fl -s 0x400000 -d 0xFFC00000 -l 0x400000
NOR Flash ID = 22a7

[First Sector=00h,Last Sector=46h]

Erase sector........
Programming...

@ernst: flashing only bios and rec-loader won't suffice, you have to flash the kernel, too.
boot stages are: BIOS -> Kernel-loader -> (rec-loader if keys pressed ->) Kernel

schufti


« Last Edit: June 06, 2009, 19:02:12 PM by schufti »	Logged

I won't answer posts or PMs about repair/recovery after bad flash until proven that the wiki was read and followed!
find all my MGB100 files here, pass: mgb100

Ernst

Full Member

Offline

Posts: 112

Re: Reflash with JTAG

« Reply #14 on: June 06, 2009, 19:02:05 PM »

Second thought; as documented in the wiki; the recovery loader needs a working linux boot sector and kernel. So only flashing the top 64 Kb. is not enough if linux has been shot during previous flash attempts...

So yes; you need to flash redboot using jtag and flash a full image using redboot. There is no other way and the redboot command lines documented in:

http://www.macsat.com/macsat/component/option,com_smf/Itemid,50/topic,851.msg4759/#msg4759

are the proper ones as far as I can tell. So if that doesn't work on your system, something is wrotten in the state of Denmark...

E.


	Logged

Pages: [1] 2 3 Go Up

« previous next »

	Author	Topic: Reflash with JTAG (Read 3303 times)
0 Members and 1 Guest are viewing this topic.