On bcm6348 based devices, the standard bootloader is called the cfe. As well as boot strapping the board - so it can start the kernel - it also usually provides a few mechanisms for installing pre-built OS images. The process is simple: connect to the uart, wait for the "Press space key to stop auto run" message and press space. The boot is halted and you're given a 'CFE>' prompt where you can execute commands:
CFE version 1.0.37-21.6.8 for BCM96348 (32bit,SP,BE) Build Date: Thu Sep 22 10:49:20 CST 2005 (michaelc@AskeyBrcmServer) Flash Config: CS0(1f80000a,17),Base(bf800000),Size(8MB) Ethernet Network Device: Internal PHY Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : Default host flash file name : bcmModelName_fs_kernel Boot delay (1-9 seconds) : 9 Board Id Name : V2091_BB Psi size in KB : 24 Number of MAC Addresses (1-32) : 3 Ethernet MAC Address : 00:16:e3:1f:0d:1c WEP 128bit Key : a986888aa527c Memory size in MB : 16 ==== Press space key to stop auto run (9 seconds) ==== Auto run second count down(before hit space key): 4 CFE> help Available commands: w Write the whole image start from beginning of the flash e Erase [n]vram or [a]ll flash except bootrom r Run program from flash image or from host depend on [f/h] flag p Print boot line and board parameter info c Change booline parameters f Write image to the flash i Erase persistent storage data b Change board parameters reset Reset the board flashimage Flashes a compressed image after the bootloader. help Obtain help for CFE commands For more information about a command, enter 'help command-name' *** command status = 0 CFE>
However on the bt voyager 2091 that I've been working on recently, the bootloader doesn't stop and doesn't respond to space being pressed at all. I know that on other boards the boot delay is a configurable option from with the cfe shell; the menu looks like this:
CFE> c Press: <enter> to use current value Board IP address :[192.168.1.1:ffffff00]: Host IP address :[192.168.1.2]: Gateway IP address :[]: Run from flash/host (f/h) :[f]: Default host run file name :[]: Default host flash file name :[bcmModelName_fs_kernel]: Boot delay (1-9 seconds) :[9]:
I used jtag to pull the cfe (64k @0x1fc00000) and ran it through hexdump:
00000570 63 66 65 2d 76 01 00 25 15 06 08 00 00 00 00 00 |cfe-v..%........| 00000580 00 00 00 02 65 3d 31 39 32 2e 31 36 38 2e 31 2e |....e=192.168.1.| 00000590 31 3a 66 66 66 66 66 66 30 30 20 68 3d 31 39 32 |1:ffffff00 h=192| 000005a0 2e 31 36 38 2e 31 2e 32 20 67 3d 20 72 3d 66 20 |.168.1.2 g= r=f | 000005b0 66 3d 20 69 3d 62 63 6d 4d 6f 64 65 6c 4e 61 6d |f= i=bcmModelNam| 000005c0 65 5f 66 73 5f 6b 65 72 6e 65 6c 20 64 3d 31 20 |e_fs_kernel d=1 | 000005d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
It's not hard to see that there's a bunch of key=value pairs that match the expected data:
e=192.168.1.1:ffffff00 (Board IP address) h=192.168.1.2 (Host IP address) g= (Gateway IP address) r=f (Run from flash/host (f/h)) f= (Default host run file name) i=bcmModelName_fs_kernel (Default host flash file name) d=1 (Boot delay (1-9 seconds))
Using a hex editor I modified the boot delay value in 0x5ce from '1'(0x31) to '9'(0x39) and flashed it back to the 2091 - I was expecting that I'd at least have to find and fix up a checksum somewhere, and I was quite surprised when it booted with:
CFE version 1.0.37-21.6.8 for BCM96348 (32bit,SP,BE) Build Date: Thu Sep 22 10:49:20 CST 2005 (michaelc@AskeyBrcmServer) Flash Config: CS0(1f80000a,17),Base(bf800000),Size(8MB) Ethernet Network Device: Internal PHY *** Board is not initialized properly *** Press: <enter> to use current value Board Id Name (A-O) RTA1045VG -------- A RTA1045BVG -------- B RTA1046VW -------- C RTA1046BVW -------- D RTA1052BVW -------- E RTA1050V -------- F RTA1052V -------- G V220V_BBV -------- H V2091_BB -------- I V2090 -------- J V2110 -------- K V2500V_BBV -------- L V2500V_BB -------- M RTA1025W_16 -------- N RTA1025BW_16 -------- O :[I]: Number of MAC Addresses (1-32) :[0]: 3 Ethernet MAC Address :[]:00:16:e3:1f:0d:1c WEP 128bit Key :[a986888aa527c]: Save and Exit (y/n):y Save your cnofiguration to nvram........done Press any key to reset the board: CFE version 1.0.37-21.6.8 for BCM96348 (32bit,SP,BE) Build Date: Thu Sep 22 10:49:20 CST 2005 (michaelc@AskeyBrcmServer) Flash Config: CS0(1f80000a,17),Base(bf800000),Size(8MB) Ethernet Network Device: Internal PHY Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : Default host flash file name : bcmModelName_fs_kernel Boot delay (1-9 seconds) : 9 Board Id Name : V2091_BB Psi size in KB : 24 Number of MAC Addresses (1-32) : 3 Ethernet MAC Address : 00:16:e3:1f:0d:1c WEP 128bit Key : a986888aa527c Memory size in MB : 16 ==== Press space key to stop auto run (9 seconds) ====
And I could get into the cfe shell.
The final difficulty with the cfe on this board, is that the network stack seems to be disabled or uninitialised until you change the board IP address. I'm not sure if that's down to my messing with the cfe or if maybe it was intentionally disabled at the factory.
Yet another BT device: a voyager 2091 - another BCM6348 device. UART is nice and easy to get at; even has headers soldered in:
Here's the full boot output:
CFE version 1.0.37-21.6.8 for BCM96348 (32bit,SP,BE) Build Date: Thu Sep 22 10:49:20 CST 2005 (michaelc@AskeyBrcmServer) Flash Config: CS0(1f80000a,17),Base(bf800000),Size(8MB) Ethernet Network Device: Internal PHY Auto-negotiation timed-out Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : Default host flash file name : bcmModelName_fs_kernel Boot delay (1-9 seconds) : 1 Board Id Name : V2091_BB Psi size in KB : 24 Number of MAC Addresses (1-32) : 4 Ethernet MAC Address : 00:16:e3:1f:0d:1c WEP 128bit Key : a986888aa527c Memory size in MB : 16 ==== Press space key to stop auto run (1 seconds) ==== Auto run second count down(before hit space key): 0 Code Address: 0x80010000, Entry Address: 0x8001046c Decompression OK! Entry at 0x8001046c Closing network. Starting program at 0x8001046c Flash Config: CS0(1f80000a,17),Base(bf800000),Size(8MB) FLASH_BASE bfc00000,blk 47 Total Flash size: 8192K with 135 sectors NVRAM @71 block Scratch pad is not used for this flash part. V2091_BB prom init CPU revision is: 00029107 Primary instruction cache 16kb, linesize 16 bytes (2 ways) Primary data cache 8kb, linesize 16 bytes (2 ways) Linux version 2.4.17 (michaelc@AskeyBrcmServer) (gcc version 3.1) #1 Mon Sep 26 10:37:13 CST 2005 Determined physical RAM map: memory: 00fa0000 @ 00000000 (usable) On node 0 totalpages: 4000 zone(0): 4000 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: root=/dev/mtdblock0 ro bcm_console_setup Calibrating delay loop... 239.20 BogoMIPS Memory: 14112k/16000k available (1171k kernel code, 1888k reserved, 84k data, 48k init, 0k highmem) Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes) Inode-cache hash table entries: 1024 (order: 1, 8192 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX PCI: Fixing up bus 0 Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd brcmboard: brcm_board_init entry Module bcm63xx_cons.c v1.1 Sep 26 2005 10:37:30 block: 64 slots per queue, batch=16 PPP generic driver version 2.4.1 NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) Linux IP multicast router 0.06 plus PIM-SM NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. Ebtables v2.0 registered<6>NET4: Ethernet Bridge 008 for NET4.0 VFS: Mounted root (cramfs filesystem) readonly. Freeing unused kernel memory: 48k freed init started: BusyBox v0.60.4 (2005.09.26-02:43+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5 BusyBox v0.60.4 (2005.09.26-02:43+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... atmapi: init_module entry 0xc0015060 blaadd: blaa_detect entry adsl: adsl_init entry var 1.0 initialised PCI: Enabling device 00:01.0 (0004 -> 0006) wl: srom not detected, using main memory mapped srom info (wombo board) wl0: Broadcom BCM4318 802.11 Wireless Controller 3.91.39.0 Broadcom BCM6348B0 Ethernet Network Device v0.1 Sep 26 2005 10:40:46 Ports 1 unit 1 Internal PHY BCM63xx_ENET: Auto-negotiation timed-out BCM63xx_ENET: 10 MB Half-Duplex (assumed) eth0: MAC Address: 00:16:E3:1F:0D:1C Broadcom BCM6348B0 USB Network Device v0.3 Sep 26 2005 10:40:47 usb0: MAC Address: 00 16 E3 1F 0D 1D usb0: Host MAC Address: 00 16 E3 1F 0D 1E USB Vendor id=069a, USB Product id=0318 ==> Bcm963xx Software Version: 2.21.05.08m_A2pB018c1.d16d <==
Before attempting to flash a router with openwrt, I like to jtag it so I can dump and restore the flash if it all goes horribly wrong. Unlike the the serial console, the jtag connections on the BT voyager 2091 aren't obvious - and unlike the previous bcm6348 boards I've jtag'd, someone hasn't already documented them.
Although the board has a large amount of exposed pads and/or vias, very few of these are labelled. On the underside however there's a small cluster of pads labelled BTP2, BTP3, BTP4 and BTP5. As jtag usually needs a minimum of TMS, TCK, TDO and TDI these four pads seemed like the best place to start.
I didn't want to have to manually walk through all possible combinations - especially if it turned out they weren't the correct pads and I'd have to expand my search to the numerous unlabelled pads - so I looked for a way to automate. After finding a couple of dedicated (but expensive) devices I eventually found jtagenum for the arduino. Jtagenum basically just brute forces it's way through all pin combinations and would be perfect if my arduino wasn't 5v; the 2091 is a 3.3v device.
Here's the 2091, my arduino mega and an eight-way level shifter on a breadboard, using a handful of mosfets (circuit borrowed from here).
Jtagenum really wants five pins: the usual four TMS/TCK/TDO/TDI and nTRST. As I don't have a candidate for nTRST I added and extra pin (40) to the pin[]/pinnames[] arrays and just left it unconnected. The four BTPx wires were connected to 24, 29, 32, and 37. Running the 'pattern scan' gave the following output:
================================ Starting scan for pattern:0110011101001101101000010111001001 active ntrst:32 tck:37 tms:24 tdo:29 tdi:40 bits toggled:3 active ntrst:32 tck:37 tms:40 tdo:29 tdi:24 bits toggled:6 active ntrst:40 tck:37 tms:24 tdo:29 tdi:32 bits toggled:58 active ntrst:40 tck:37 tms:32 tdo:29 tdi:24 bits toggled:6 ================================
As I knew that 40 was unconnected it couldn't be either of the first two 'active' lines; one has TMS as 40 the other has TDI as 40. This left just two combinations to try with my busblaster - first one didn't work but the second one made urjtag do this:
UrJTAG 0.10 #2039 Copyright (C) 2002, 2003 ETC s.r.o. Copyright (C) 2007, 2008, 2009 Kolja Waschk and the respective authors UrJTAG is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. There is absolutely no warranty for UrJTAG. warning: UrJTAG may damage your hardware! Type "quit" to exit, "help" for help. jtag> cable jtagkey vid=0x403 pid=0x6010 Connected to libftdi driver. jtag> detect IR length: 5 Chain length: 1 Device Id: 00000110001101001000000101111111 (0x0634817F) Manufacturer: Broadcom (0x17F) Part(0): BCM6348 (0x6348) Stepping: V1 Filename: /usr/local/share/urjtag/broadcom/bcm6348/bcm6348
Excellent :) working JTAG!
Pin outs:
BTP2 - TDI - red BTP3 - TDO - green BTP4 - TMS - blue BTP5 - TCK - purple
Soldering these tiny little spots was really tricky - considering all the coffee I'd consumed at that point!
A few weeks ago, Paul Fertser (one of the the openocd devs) mailed me to say that he had seen my post on using openocd and a buspirate to flash and dump bcm6348 boards and had written a firmware recovery script to make the process much simpler. A flash/dump can now be achieved in a single command line; here's how to show the help text:
openocd -f tools/firmware-recovery.tcl -c firmware_help
And the output:
lee@monkeybox ~/Downloads/openocd/openocd $ openocd -f tools/firmware-recovery.tcl -c firmware_help Open On-Chip Debugger 0.8.0-rc1-dev-00439-ga719779-dirty (2014-04-06-12:11) Licensed under GNU GPL v2 For bug reports, read http://openocd.sourceforge.net/doc/doxygen/bugs.html Firmware recovery helpers Use -c firmware_help to get help adapter speed: 1000 kHz Your OpenOCD command should look like this: openocd -f interface/<jtag adapter>.cfg -f tools/firmware-recovery.tcl -c "<commands>*; shutdown" Where: <jtag adapter> is one of the supported devices, e.g. ftdi/jtagkey2 <commands> are firmware-recovery commands separated by semicolon Supported commands: firmware_help get this help list_boards list known boards and exit board <name> select board you work with list_partitions list partitions of the currently selected board dump_part <name> <filename> save partition's contents to a file erase_part <name> erase the given partition flash_part <name> <filename> erase, flash and verify the given partition ram_boot <filename> load binary file to RAM and run it adapter_khz <freq> set JTAG clock frequency in kHz For example, to clear nvram and reflash CFE on an RT-N16 using TUMPA, run: openocd -f interface/ftdi/tumpa.cfg -f tools/firmware-recovery.tcl \ -c "board asus-rt-n16; erase_part nvram; flash_part CFE cfe-n16.bin; shutdown" shutdown command invoked Error: Debug Adapter has to be specified, see "interface" command in procedure 'init'
The script supports a handful of commands, that are specified using '-c' and that can be chained together by separating them with semi-colons and wrapping the whole string in quotes ("command1; command2; etc"). A list of supported boards can be seen like this:
lee@monkeybox ~/Downloads/openocd/openocd $ openocd -f tools/firmware-recovery.tcl -c list_boards Open On-Chip Debugger 0.8.0-rc1-dev-00439-ga719779-dirty (2014-04-06-12:11) Licensed under GNU GPL v2 For bug reports, read http://openocd.sourceforge.net/doc/doxygen/bugs.html Firmware recovery helpers Use -c firmware_help to get help adapter speed: 1000 kHz List of the supported boards: Board name Description ----------------------------------- asus-rt-n16 ASUS RT-N16 linksys-wrt54gl Linksys WRT54GL v1.1 netgear-dg834v3 Netgear DG834G v3 bt-homehubv1 BT HomeHub v1 Error: Debug Adapter has to be specified, see "interface" command in procedure 'init'
Two commands are chained together ("board bt-homehubv1; list_partitions") to select the BT Homehub and list it's partitions (I've included the busblaster interface config - change as fit for your programmer):
lee@monkeybox ~/Downloads/openocd/openocd $ openocd -f interface/busblaster.cfg -f \ tools/firmware-recovery.tcl -c "board bt-homehubv1; list_partitions" Open On-Chip Debugger 0.8.0-rc1-dev-00439-ga719779-dirty (2014-04-06-12:11) Licensed under GNU GPL v2 For bug reports, read http://openocd.sourceforge.net/doc/doxygen/bugs.html Info : only one transport option; autoselect 'jtag' Firmware recovery helpers Use -c firmware_help to get help adapter speed: 1000 kHz The currently selected board is known to have these partitions: Name Start Size Description ------------------------------------------------------- CFE 0xbe400000 0x00020000 Bootloader firmware 0xbe420000 0x007D0000 Kernel+rootfs fisdir 0xbebf0000 0x0000f000 FIS Directory nvram 0xbebff000 0x00001000 Config space Warn : Using DEPRECATED interface driver 'ft2232' Info : Consider using the 'ftdi' interface driver, with configuration files in interface/ftdi/... Error: unable to open ftdi device: device not found in procedure 'init'
And finally, dumping the CFE bootloader (already flashed with redboot on my HomeHubv1):
lee@monkeybox ~/Downloads/openocd/openocd $ time sudo openocd -f interface/busblaster.cfg -f \ tools/firmware-recovery.tcl -c "board bt-homehubv1;dump_part CFE redboot.fwrecovery.test.bin; shutdown" Open On-Chip Debugger 0.8.0-rc1-dev-00439-ga719779-dirty (2014-04-06-12:11) Licensed under GNU GPL v2 For bug reports, read http://openocd.sourceforge.net/doc/doxygen/bugs.html Info : only one transport option; autoselect 'jtag' Firmware recovery helpers Use -c firmware_help to get help adapter speed: 1000 kHz Warn : Using DEPRECATED interface driver 'ft2232' Info : Consider using the 'ftdi' interface driver, with configuration files in interface/ftdi/... Info : max TCK change to: 30000 kHz Info : clock speed 1000 kHz Info : JTAG tap: bcm6348.cpu tap/device found: 0x0634817f (mfg: 0x0bf, part: 0x6348, ver: 0x0) target state: halted target halted in MIPS32 mode due to debug-request, pc: 0x9e40a4b0 Info : JTAG tap: bcm6348.cpu tap/device found: 0x0634817f (mfg: 0x0bf, part: 0x6348, ver: 0x0) Error: Error writing unexpected address 0xff202004 target state: halted target halted in MIPS32 mode due to debug-request, pc: 0x9e40a4b0 dumped 131072 bytes in 668.114136s (0.192 KiB/s) shutdown command invoked real 11m9.933s user 0m6.680s sys 0m13.300s
Board config files are pretty straight forward, just defining how the target, the flash and how the flash has been carved up (usually can be extracted from the bootloader):
#
# BT HomeHub v1
#
set partition_list {
CFE { Bootloader 0xbe400000 0x00020000 }
firmware { "Kernel+rootfs" 0xbe420000 0x007D0000 }
fisdir { "FIS Directory" 0xbebf0000 0x0000f000 }
nvram { "Config space" 0xbebff000 0x00001000 }
}
source [find target/bcm6348.cfg]
set _FLASHNAME $_CHIPNAME.norflash
flash bank $_FLASHNAME cfi 0xbe400000 0x00800000 2 2 $_TARGETNAME
The recovery script will be included in the 0.8.0 release and hopefully my patches for the bcm6348 target and the Home Hub will be too :)
I've added a connector to the DG834v4 so I can use the jtag pins to dump the flash, before attempting to install openwrt. If I end up bricking it I should just be able to write the dumped image back again.
The pins are detailed over on the openwrt wiki, but I've labelled them in the image above anyway. I've used urjtag to do the heavy lifting; capture of the session below. The "cable ..." line is for my Bus Blaster, you'll probably need to change it if you use something else.
UrJTAG 0.10 #2039 Copyright (C) 2002, 2003 ETC s.r.o. Copyright (C) 2007, 2008, 2009 Kolja Waschk and the respective authors UrJTAG is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. There is absolutely no warranty for UrJTAG. warning: UrJTAG may damage your hardware! Type "quit" to exit, "help" for help. jtag> cable jtagkey vid=0x403 pid=0x6010 Connected to libftdi driver. jtag> detect IR length: 5 Chain length: 1 Device Id: 00000110001101001000000101111111 (0x0634817F) Manufacturer: Broadcom (0x17F) Part(0): BCM6348 (0x6348) Stepping: V1 Filename: /usr/local/share/urjtag/broadcom/bcm6348/bcm6348 jtag> endian big jtag> initbus ejtag_dma ImpCode=00000000100000000000100100000100 EJTAG version: <= 2.0 EJTAG Implementation flags: R4k DMA MIPS32 Clear memory protection bit in DCR Clear Watchdog Potential flash base address: [0x1fc0000b], [0x0] Processor successfully switched in debug mode. jtag> detectflash 0x1fc00000 Query identification string: Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set) Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null) Query system interface information: Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV Typical timeout per single byte/word program: 16 us Typical timeout for maximum-size multi-byte program: 0 us Typical timeout per individual block erase: 1024 ms Typical timeout for full chip erase: 0 ms Maximum timeout for byte/word program: 512 us Maximum timeout for multi-byte program: 0 us Maximum timeout per individual block erase: 16384 ms Maximum timeout for chip erase: 0 ms Device geometry definition: Device Size: 4194304 B (4096 KiB, 4 MiB) Flash Device Interface Code description: 0x0002 (x8/x16) Maximum number of bytes in multi-byte program: 1 Number of Erase Block Regions within device: 2 Erase Block Region Information: Region 0: Erase Block Size: 8192 B (8 KiB) Number of Erase Blocks: 8 Region 1: Erase Block Size: 65536 B (64 KiB) Number of Erase Blocks: 63 Primary Vendor-Specific Extended Query: Major version number: 1 Minor version number: 1 Address Sensitive Unlock: Required Erase Suspend: Read/write Sector Protect: 4 sectors per group Sector Temporary Unprotect: Not supported Sector Protect/Unprotect Scheme: 29BDS640 mode (Software Command Locking) Simultaneous Operation: Not supported Burst Mode Type: Supported Page Mode Type: Not supported ACC (Acceleration) Supply Minimum: 11500 mV ACC (Acceleration) Supply Maximum: 12500 mV Top/Bottom Sector Flag: Bottom boot device jtag> readmem 0x1fc00000 0x400000 dg834v4.full.dump.4MB.bin address: 0x1FC00000 length: 0x00400000 reading: addr: 0x20000000 Done.
I haven't needed to do it yet but to restore the image the command should be:
jtag> flashmem 0x1fc00000 dg834v4.full.dump.4MB.bin
The DG834v4 is unlike the v1/v2/v3 in that they are TI AR7 based and the v4 is another Broadcom BCM6348 board, clocked at 240MHz and with 16MB RAM. Initially I thought getting to the uart would just be a case of soldering headers, but after reading the openwrt wiki page it became apparent that there were unpopulated resistors on the underside of the board, on the rx/tx lines coming from the CPU (R521 and R522 in the image below).
Using a hot air station, I removed some 1K Ohm resistors from a dead laptop motherboard. Then using a toothpick, I put a little flux on the empty resistor pads to hopefully give the them something to stick to. A little flux on the end of the toothpick made it pretty easy to pick them up and drag them into position too. Placement accuracy is not that critical; once the solder melts the surface tension will pull the tiny resistors into line.
Above, the R521 and R522 pads have been populated - using the hot air station on a low speed and a high temperature. Once the board cooled, my Bus Pirate was connected to the rx, tx and ground pins and configure as a uart bridge.
Here's the stock boot:
CFE version 1.0.37-6.8 for BCM96348 (32bit,SP,BE) Build Date: Fri Feb 6 03:12:58 UTC 2009 (root@localhost.localdomain) Copyright (C) 2000-2005 Broadcom Corporation. Boot Address 0xbfc00000 Initializing Arena. Initializing Devices. Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB CPU type 0x29107: 240MHz, Bus: 133MHz, Ref: 26MHz Total memory: 16777216 bytes (16MB) Total memory used by CFE: 0x80401000 - 0x80527770 (1206128) Initialized Data: 0x8041EF50 - 0x80420350 (5120) BSS Area: 0x80420350 - 0x80425770 (21536) Local Heap: 0x80425770 - 0x80525770 (1048576) Stack Area: 0x80525770 - 0x80527770 (8192) Text (code) segment: 0x80401000 - 0x8041EF48 (122696) Boot area (physical): 0x00528000 - 0x00568000 Relocation Factor: I:00000000 - D:00000000 Board IP address : 192.168.0.1 Host IP address : 192.168.0.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : 96348W3 Psi size in KB : 24 Number of MAC Addresses (1-32) : 2 Base MAC Address : 00:24:b2:2e:73:10 Ethernet PHY Type : Internal Memory size in MB : 16 CMT Thread Number : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 pTag1!=NULL Code Address: 0x80010000, Entry Address: 0x801f6018 Decompression OK! Entry at 0x801f6018 Closing network. Starting program at 0x801f6018 Linux version 2.6.8.1 (root@BUILD_SERVER) (gcc version 3.4.2) #2 Fri Feb 29 17:52:52 CST 2008 Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB Total Flash size: 4096K with 71 sectors 96348W3 prom init CPU revision is: 00029107 Determined physical RAM map: memory: 00fa0000 @ 00000000 (usable) On node 0 totalpages: 4000 DMA zone: 4000 pages, LIFO batch:1 Normal zone: 0 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=31:0 ro noinitrd brcm mips: enabling icache and dcache... Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 8kB 2-way, linesize 16 bytes. PID hash table entries: 64 (order 6: 512 bytes) Using 120.000 MHz high precision timer. Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 13468k/16000k available (1639k kernel code, 2512k reserved, 300k data, 80k init, 0k highmem) Calibrating delay loop... 239.20 BogoMIPS Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Checking for 'wait' instruction... unavailable. NET: Registered protocol family 16 MPI: No Card is in the PCMCIA slot Can't analyze prologue code at 801a8894 devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 Initializing Cryptographic API PPP generic driver version 2.4.2 NET: Registered protocol family 24 Using noop io scheduler bcm963xx_mtd driver v1.0 kernel_addr == 0xbff39100 rootfs_addr == 0xbfc10100 Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. Creating 6 MTD partitions on "Physically mapped flash": 0x00010100-0x00339100 : "fs" mtd: partition "fs" doesn't start on an erase block boundary -- force read-only 0x00010000-0x003e0000 : "tag+fs+kernel" 0x00000000-0x00010000 : "bootloader" 0x003f0000-0x00400000 : "nvram" 0x00000000-0x00010000 : "bootloader" 0x003e0000-0x003f0000 : "DPF_file" brcmboard: brcm_board_init entry SES: Button GPIO 0x8023 is enabled SES: Button Interrupt 0x3 is enabled SES: LED GPIO 0x8023 is enabled bcm963xx_serial driver v2.0 NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) klips_info:ipsec_init: KLIPS startup, Openswan KLIPS IPsec stack version: 2.4.6rc3 NET: Registered protocol family 15 klips_info:ipsec_alg_init: KLIPS alg v=0.8.1-0 (EALG_MAX=255, AALG_MAX=251) klips_info:ipsec_alg_init: calling ipsec_alg_static_init() ipsec_3des_init(alg_type=15 alg_id=3 name=3des): ret=0 KLIPS cryptoapi interface: alg_type=15 alg_id=12 name=aes keyminbits=128 keymaxbits=256, found(0) KLIPS: lookup for ciphername=twofish: not found KLIPS: lookup for ciphername=serpent: not found KLIPS: lookup for ciphername=cast5: not found KLIPS: lookup for ciphername=blowfish: not found KLIPS cryptoapi interface: alg_type=15 alg_id=3 name=des3_ede keyminbits=192 keymaxbits=192, found(0) KLIPS cryptoapi interface: alg_type=15 alg_id=2 name=des keyminbits=64 keymaxbits=64, found(0) ip esp init: can't add protocol ip_conntrack version 2.1 (125 buckets, 0 max) - 376 bytes per conntrack ip_conntrack_h323: init ip_nat_h323: initialize the module! ip_tables: (C) 2000-2002 Netfilter core team Initializing IPsec netlink socket NET: Registered protocol family 1 NET: Registered protocol family 17 Bridge firewalling registered NET: Registered protocol family 8 NET: Registered protocol family 20 VFS: Mounted root (squashfs filesystem) readonly. Mounted devfs on /dev Freeing unused kernel memory: 80k freed init started: BusyBox v1.00 (2007.12.20-13:11+0000) multi-call binary init started: BusyBox v1.00 (2007.12.20-13:11+0000) multi-call binary Starting pid 48, console /dev/tts/0: '/usr/etc/rcS' Algorithmics/MIPS FPU Emulator v1.5 bcm_enet: module license 'Proprietary' taints kernel. Broadcom BCM6348B0 Ethernet Network Device v0.3 Jan 11 2008 17:18:52 Config Ethernet Switch Through SPI Slave Select 0 dgasp: kerSysRegisterDyingGaspHandler: eth0 registered eth0: MAC Address: 00:24:B2:2E:73:10 insmod: cannot insert `/lib/modules/vnet.ko': Success (6): Success blaadd: blaa_detect entry adsl: adsl_init entry netfilter PSD loaded - (c) astaro AG ipt_random match loaded device eth0 entered promiscuous mode ap_name=wlan action=stop SIOCGIFFLAGS: No such device interface wl0 does not exist! /usr/sbin/wlctl: wl driver adapter not found /usr/sbin/wlctl: wl driver adapter not found killall: wlctl: no process killed killall: nas: no process killed BcmAdsl_Initialize=0xC0080478, g_pFnNotifyCallback=0xC00992A4 AnnexCParam=0x7FFF7E68 AnnexAParam=0x00003987 adsl2=0x00000003 pSdramPHY=0xA0FFFFF8, 0x90001100 0xA0011901 AdslCoreHwReset: AdslOemDataAddr = 0xA0FFA4D4 AnnexCParam=0x7FFF7E68 AnnexAParam=0x00003987 adsl2=0x00000003 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered ap_name=(null) action=start br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state /bin/echo GMT+0 > /etc/TZ killall: udhcpd: no process killed killall: upnpd: no process killed killall: upnpd: no process killed killall: dnrd: no process killed Notice: caching turned off Warning: Using /etc/hosts will be removed in a future version. Please use only the /etc/dnrd/master file or use -m off. dnrd -a 192.168.0.1 -m hosts -c off --timeout=0 -b Setting SSID "recipes4vegans" Setting SSID "Guest" Setting country code using abbreviation: "GB" Receive: good packet 0, bad packet 0 Transmit: good packet 0, bad packet 0 Please press Enter to activate this console. Starting pid 341, console /dev/tts/0: '/bin/sh' BusyBox v1.00 (2007.12.20-13:11+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands.
And the bootloader (CFE):
CFE version 1.0.37-6.8 for BCM96348 (32bit,SP,BE) Build Date: Fri Feb 6 03:12:58 UTC 2009 (root@localhost.localdomain) Copyright (C) 2000-2005 Broadcom Corporation. Boot Address 0xbfc00000 Initializing Arena. Initializing Devices. Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB CPU type 0x29107: 240MHz, Bus: 133MHz, Ref: 26MHz Total memory: 16777216 bytes (16MB) Total memory used by CFE: 0x80401000 - 0x80527770 (1206128) Initialized Data: 0x8041EF50 - 0x80420350 (5120) BSS Area: 0x80420350 - 0x80425770 (21536) Local Heap: 0x80425770 - 0x80525770 (1048576) Stack Area: 0x80525770 - 0x80527770 (8192) Text (code) segment: 0x80401000 - 0x8041EF48 (122696) Boot area (physical): 0x00528000 - 0x00568000 Relocation Factor: I:00000000 - D:00000000 Board IP address : 192.168.0.1 Host IP address : 192.168.0.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : 96348W3 Psi size in KB : 24 Number of MAC Addresses (1-32) : 2 Base MAC Address : 00:24:b2:2e:73:10 Ethernet PHY Type : Internal Memory size in MB : 16 CMT Thread Number : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 1 CFE> CFE> help Available commands: h Http Download d Download a Asmod c Change booline parameters b Change board parameters reset Reset the board help Obtain help for CFE commands For more information about a command, enter 'help command-name' *** command status = 0
Having never used JTAG before I thought I'd see what I could do with my new Bus Pirate and one of the old ADSL routers I have lying around - ideally reading/writing to the flash. The v1 BT Home Hub is a Broadcom BCM6348-based device with 32MB RAM, that I'd previously added headers for the serial uart and replaced the bootloader with RedBoot and the OS with openwrt. You can see a small breakout with a TTL level converter and an FTDI uart<->USB on the right, and the Bus Pirate on the left in the picture above.
The JTAG pads are on the back of the board, behind the BCM6348; they are documented over on the openwrt wiki. I've soldered a short length of ribbon cable - held in place with a strip of duck tape to ease the mechanical stress on them.
As the v3 Bus Pirate doesn't have enough space for the openocd JTAG module in the stock build, I needed to flash the custom hex image I found here that has it compiled in.
The default install of openocd on Mint 20.04 doesn't support the Bus Pirate either, so it has to be built from source - remembering to add "--enable-buspirate" option:
./configure --enable-buspirate make sudo make install
Although openocd now detects the Bus Pirate, it needs a config (openocd.cfg) putting together so it knows it's dealing with a MIPS chip and where the flash lives. After much googling and trial and error I came up with this:
source [find interface/buspirate.cfg] buspirate_port /dev/ttyUSB0 set _CHIPNAME bcm6348 jtag_nsrst_delay 100 jtag_ntrst_delay 100 reset_config trst_and_srst jtag newtap $_CHIPNAME cpu -irlen 5 -ircapture 0x1 -irmask 0x1f -expected-id 0x0634817f set _TARGETNAME $_CHIPNAME.cpu target create $_TARGETNAME mips_m4k -endian big -chain-position $_TARGETNAME # setup working area somewhere in RAM #$_TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x20000 #$_TARGETNAME configure -work-area-phys 0xa0600000 -work-area-size 0x40000 # serial SPI capable flash # flash bank <driver> <base> <size> <chip_width> <bus_width> set _FLASHNAME $_CHIPNAME.flash #4mb #flash bank $_FLASHNAME cfi 0x1fc00000 0x00400000 2 2 $_TARGETNAME #8MB flash bank $_FLASHNAME cfi 0x1f800000 0x00800000 2 2 $_TARGETNAME
I'm sure it's still very incomplete as I can't inspect the state of registers. The important bits: halting the CPU, dumping memory to file and write to flash from a file seem to work though. In the openocd telnet shell - halting:
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> targets
TargetName Type Endian TapName State
-- ------------------ ---------- ------ ------------------ ------------
0* bcm6348.cpu mips_m4k big bcm6348.cpu running
> halt
target state: halted
target halted in MIPS32 mode due to debug-request, pc: 0x00000000
> targets
TargetName Type Endian TapName State
-- ------------------ ---------- ------ ------------------ ------------
0* bcm6348.cpu mips_m4k big bcm6348.cpu halted
Dumping the boot loader:
> dump_image bootloader 0x1fc00000 0x00020000 dumped 131072 bytes in 465.079559s (0.275 KiB/s)
Restoring the boot loader:
> flash write_image bootloader 0x1fc00000 No working memory available. Specify -work-area-phys to target. not enough working area available(requested 140) Programming at 0x1fc00000, count 0x00020000 bytes remaining Programming at 0x1fc00100, count 0x0001ff00 bytes remaining Programming at 0x1fc00200, count 0x0001fe00 bytes remaining ...
To final test, I zero'd out the first couple of K of the bootloader and cycled the power; device was now bricked. Nothing on the serial console and two of the LEDs wedged on. I used openocd to halt the CPU and then flash the bootloader back @ 0x1fc00000 - this took a couple of attempts and found the flash worked best when the CPU was halted as soon as possible after power on. When the flash was finished the device booted perfectly into RedBoot and then onto openwrt.
This is another BCM6348 based device, a BT Voyager 220V. Before attempting to install openwrt on it, I added the seven pin header to expose the JTAG pins and dumped the bootloader - just in case. Wasn't needed as it turned out as the CFE lets you flash openwrt images anyway.
Another BT device - this one is a Voyager 220V. It uses same type of processor as the home hub and again, the four serial uart pins (+v, gnd, rx and tx) were close by. On the 220V they already had a connector soldered in:
To identify the pins, the process was roughly:
Finally connect a TTL serial interface - I'm using a FTDI breakout and level shift as needed. The 220V is a 3.3v system and my FTDI board is 5v so I use a Spark Fun board to do the shifting (on the little red breadboard in the first image). A bit of trial and error may be required to find the RX pin but it's usually next to the TX. (OLS will also guess the baud rate but I've chopped that bit off in my screen grab.)
Here's the full boot output (captured with "cu -l /dev/ttyUSB0 -s 115200"):
CFE version 1.0.37-21.6.5 for BCM96348 (32bit,SP,BE) Build Date: Tue Jul 19 17:51:53 CST 2005 (michaelc@AskeyBrcmServer) Ethernet Network Device: Internal PHY Auto-negotiation timed-out Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : Default host flash file name : bcmModelName_fs_kernel Boot delay (1-9 seconds) : 1 Board Id Name : RTA1052V Psi size in KB : 24 Number of MAC Addresses (1-32) : 3 Ethernet MAC Address : 00:11:f5:8d:53:be Memory size in MB : 16 ==== Press space key to stop auto run (1 seconds) ==== Auto run second count down(before hit space key): 0 Code Address: 0x80010000, Entry Address: 0x8001046c Decompression OK! Entry at 0x8001046c Closing network. Starting program at 0x8001046c Flash 88c5 with cs0 0x00000015 Total Flash size: 4096K with 71 sectors Scratch pad is not used for this flash part. RTA1052V prom init CPU revision is: 00029107 Primary instruction cache 16kb, linesize 16 bytes (2 ways) Primary data cache 8kb, linesize 16 bytes (2 ways) Linux version 2.4.17 (michaelc@AskeyBrcmServer) (gcc version 3.1) #1 Thu Jul 28 22:15:28 CST 2005 Determined physical RAM map: memory: 00fa0000 @ 00000000 (usable) On node 0 totalpages: 4000 zone(0): 4000 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: root=/dev/mtdblock0 ro bcm_console_setup Calibrating delay loop... 255.59 BogoMIPS Memory: 14140k/16000k available (1146k kernel code, 1860k reserved, 84k data, 44k init, 0k highmem) Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes) Inode-cache hash table entries: 1024 (order: 1, 8192 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd brcmboard: brcm_board_init entry Module bcm63xx_cons.c v1.1 Jul 28 2005 22:15:50 block: 64 slots per queue, batch=16 PPP generic driver version 2.4.1 NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 512 bind 1024) Linux IP multicast router 0.06 plus PIM-SM NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. Ebtables v2.0 registered<6>NET4: Ethernet Bridge 008 for NET4.0 VFS: Mounted root (cramfs filesystem) readonly. Freeing unused kernel memory: 44k freed init started: BusyBox v0.60.4 (2005.07.28-14:25+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5 BusyBox v0.60.4 (2005.07.28-14:25+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... atmapi: init_module entry 0xc000d060 blaadd: blaa_detect entry adsl: adsl_init entry var 1.0 initialised Endpoint: endpoint_init entry BOS: Enter bosInit BOS: Enter bosAppInit BOS: Exit bosAppInit BOS: Exit bosInit Endpoint: endpoint_init COMPLETED Broadcom BCM6348A2 Ethernet Network Device v0.1 Jul 28 2005 22:22:53 Ports 1 unit 0 Internal PHY BCM63xx_ENET: Auto-negotiation timed-out BCM63xx_ENET: 10 MB Half-Duplex (assumed) eth0: MAC Address: 00:11:F5:8D:53:BE Broadcom BCM6348A2 USB Network Device v0.3 Jul 28 2005 22:22:54 usb0: MAC Address: 00 11 F5 8D 53 BF usb0: Host MAC Address: 00 11 F5 8D 53 C0 USB Vendor id=069a, USB Product id=0319 ==> Bcm963xx Software Version: 2.21.05.07_A2pB018c1.d16d <== The MGCP client is already stopped ##Client==>Server>B:Call agent is NOT ready ##Client==>Server>D:Internet Connection is down
And here's the CFE boot loader:
CFE version 1.0.37-21.6.5 for BCM96348 (32bit,SP,BE) Build Date: Tue Jul 19 17:51:53 CST 2005 (michaelc@AskeyBrcmServer) Ethernet Network Device: Internal PHY Auto-negotiation timed-out Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.2 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : Default host flash file name : bcmModelName_fs_kernel Boot delay (1-9 seconds) : 1 Board Id Name : RTA1052V Psi size in KB : 24 Number of MAC Addresses (1-32) : 3 Ethernet MAC Address : 00:11:f5:8d:53:be Memory size in MB : 16 ==== Press space key to stop auto run (1 seconds) ==== Auto run second count down(before hit space key): 1 web info: Waiting for connection on socket 0. CFE> CFE> ? Invalid command: "?" Available commands: w, e, r, p, c, f, i, b, reset, flashimage, help *** command status = -1 CFE> help Available commands: w Write the whole image start from beginning of the flash e Erase [n]vram or [a]ll flash except bootrom r Run program from flash image or from host depend on [f/h] flag p Print boot line and board parameter info c Change booline parameters f Write image to the flash i Erase persistent storage data b Change board parameters reset Reset the board flashimage Flashes a compressed image after the bootloader. help Obtain help for CFE commands
This one was pretty easy to guess at - there's a row of four standard pitch holes just to the right of the CPU (the large Broadcom chip) - and as openwrt has been ported, it was pretty easy to verify too :)
I've soldered female headers on to this one and in the image above you can see the braided black/green/yellow wires that lead off to a level converter and FTDI board on a small red breadboard that's just out of shot.
It's got a 250MHz MIPS cpu, 32MB of RAM, two 100Mb wired interfaces, 802.11bg, USB and just maybe the DECT bits might be usable (no ADSL though) - wonder what to do with it!
As it's really just a Speedtouch 7G, the best information can be found here. (Including pinouts and links on how to install redboot and openwrt.)