Posted: Tue Feb 17, 2009 19:28 Post subject: I can flash, but firmware won't boot. Serial/CFE no help...
My parent's WRTSL54GS spontaneously died, and just sat there flashing its power light.
I installed a serial port monitor, and could see that it was in an infinite loop, rebooting over and over every 5 seconds.
Boot_wait is on, and I can get to a CFE> prompt and can install new images.
Every image I have tried (factory, dd-wrt v24 mini, openwrt) will flash properly, but not boot properly. There are about 20 lines from 'nvram show', and none seem wrong to me. -- What should I try next? JTAG is not too easy given it's a wrtsl54gs...
I compared the nvram settings to another working WRTSL54GS. Most of the nvram settings on the working router do not exist on the non-functioning one (as expected). All of the other settings were identical between the two routers except for these two:
I have cleared the nvram, and tftp'd several different binaries. They all hang. oops in traps.c::do_be: line 385; some are line 254.
I've tried dd-wrt v23; dd-wrt v24; eko 11650; openwrt; factory firmware. I've tried micro, mini, and mega. They all show errors like the above but won't boot without error.
The thing that seems to be in common is that the errors all occur one or two lines after "PCI: Enabling device 01:01.0 (0004 -> 0006). I get a lot of "data bus error" messages.
I'm wondering if this box has had a hardware failure of some kind -- perhaps the SDRAM or flash chip. The CFE "memtest" command seems to be ok though. I'm running out of ideas for what to try.
Joined: 04 Jan 2007 Posts: 11564 Location: Wherever the wind blows- North America
Posted: Thu Feb 19, 2009 13:12 Post subject:
tcharron wrote:
I have cleared the nvram, and tftp'd several different binaries. They all hang. oops in traps.c::do_be: line 385; some are line 254.
I've tried dd-wrt v23; dd-wrt v24; eko 11650; openwrt; factory firmware. I've tried micro, mini, and mega. They all show errors like the above but won't boot without error.
The thing that seems to be in common is that the errors all occur one or two lines after "PCI: Enabling device 01:01.0 (0004 -> 0006). I get a lot of "data bus error" messages.
I'm wondering if this box has had a hardware failure of some kind -- perhaps the SDRAM or flash chip. The CFE "memtest" command seems to be ok though. I'm running out of ideas for what to try.
I really don't have any ideas for you either. I don't have a WRTSL54GS CFE to provide to you.
You said you have another box. If it is running dd-wrt firmware you could extract the CFE (without JTAG)....then embed the MAC address of the bad unit into that CFE and try to flash it back on the bad unit using JTAG. This problem could just be a corrupt CFE on the unit.
Send me that cfe.bin and your bad units MAC address in a PM. I'll embed it for you and send it back. (and...I'll have a WRTSL54GS CFE for my collection then for future requests)
If this is possible...let me know.
redhawk _________________ The only stupid question....is the unasked one.
Joined: 04 Jan 2007 Posts: 11564 Location: Wherever the wind blows- North America
Posted: Thu Feb 19, 2009 13:21 Post subject:
tcharron wrote:
I will send you the CFE.BIN from the working router.
I don't have jtag set up on this box (and think I mucked up the board so it may not be possible).
Is there any way to use the CFE> prompt to upgrade the CFE with a new one, using serial+ethernet rather than JTAG?
mucked up the board????? That could be your problem then.
If you have broken traces or solder splashes....this could be the reason for the reboot cycle and error messages.
In any case...yes...send me the cfe.bin and your mac....I'll send it right back.
At this point....I would inspect the area that is "mucked up" really close with a magnifying glass or jewers loupe....repair any damaged traces and attempt to communicate using JTAG.
There is no instructions that I have ever found to flash a CFE back to a unit through the Serial port.....if someone knows of a way...please speak up....I would like to hear it too.
redhawk _________________ The only stupid question....is the unasked one.
Mucked might be too strong a word. I have a lot of soldering experience, and know that I didn't damage anything other than the jtag pads.
There is no jtag port on this board, but the various lines are available via solder pads. Some of the solder pads lifted when I heated them - it seems that the solder pads are laid on top of the etch resist material, and the heat from the soldering iron causes them to come loose. I ended up exposing the electrical traces leading to the solder pads, and then soldering wire meant to be used in electrical windings (about 1/10th the diameter of a human hair) directly to that. It is a slow and tedious job (done entirely while wearing a jeweler's loupe) and I still have one line to complete before I can try to JTAG again.
The recycle boot and error messages occurred before I went anywhere near the JTAG pads.
The CFE/serial install seems like it should be doable. I was reading the CFE docs last night (a broadcom document), and while light on details, it seems like it should be possible. They went to all the effort of providing the serial interface - it would have been negligent not to build this capability in!
Joined: 04 Jan 2007 Posts: 11564 Location: Wherever the wind blows- North America
Posted: Thu Feb 19, 2009 13:38 Post subject:
OK...check your PM box...and thank you for the cfe.
Yes...you are correct...if they go to all the trouble of putting in a Serial interface...then it would make sense that they have some way of communicating with the chip via serial/ethernet.
redhawk _________________ The only stupid question....is the unasked one.
OK...check your PM box...and thank you for the cfe.
Yes...you are correct...if they go to all the trouble of putting in a Serial interface...then it would make sense that they have some way of communicating with the chip via serial/ethernet.
redhawk
Thanks for the custom CFE.
I've downloaded the source for the CFE and will hopefully have some time to dive into it a bit in the next couple of weeks. Hopefully there is a way to load a new cfe image directly using the CFE (non-jtag).
I was able to figure out the relevant parts of the CFE source pretty quick. The current source code (v 1.4.2) includes explicit references to loading CFE over TFTP. My version is 1.0.37, but I'm hoping that this works there too. Here's what I've done:
1. Read CFE.PDF -- CFE funcitonal specification. One useful bit of information is on page 86 of 152:
"cfe.flash -- Flash update file (can be put on a TFTP server and downloaded to a target to update its flash"
2. Ok. Go and get the CFE source code. The makefile for cfe.flash is cfe_link.mk. It shows:
- We don't need the serial records (.srec file)
- We have (or can extract a good ) cfe.bin.
- The swapflashimage is not needed
- So, to conver the cfe.bin to cfe.flash, we need mkflashimage.
This code adds a 64 byte header to the CFE.BIN file that includes version number, target board type, checksums, andian state, etc. I didn't want to do this by hand, so decided to compile mkflashimage on my windows box.
Some very minor tweaks were required to get this to complile under windows.
- One important one was to make sure that the conversion of the input cfe.bin didn't convert every 0x0A character to 0x0D/0x0A (lf conversion to crlf) (I edited the 4th open statement)
My WRTsl54GS CFE prompt boots up with: "CFE version 1.0.37 for BCM947XX (32bit,SP,LE)"
This tells me it is little-endian, the version, and the board type.
Now I have a cfe.flash. I think I just need to boot into the CFE, and tftp this file to my box using the tftp command.
Before I do that, I'd like to confirm that my CFE is in fact corrupt. I'll need to use the SAVE command to extract 0xBFC40000 (I think) to a TFTP destination. Once I have that I can compare to a known good CFE file.
In the meantime, is anyone willing to try this tool and see if it works? I'm reluctant to use my device as a guinea pig since I don't have a working JTAG interface on it!
While this tool may help others, it won't help me. I think that this router has developed a hardware problem. It has not booted properly since it was mailed to me by my parents.
I was able to extract the CFE and confirm that it matches the one in an identical router, except for the MAC address and Serial number.
I was also able to flash a new dd-wrt flash image and then extract it to confirm that the flash is still accepting writes properly.
I may try to replace the dram chip as that's the only other thing I can think of that is easy to check.
with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
