THIS TUTORIAL IS INTENDED FOR THEORETICAL USE ONLY, USE ON PRODUCTION
SYSTEMS MAY VIOLATE YOUR ISP's TERMS OF SERVICE. THEORYSHARE TAKES NO
RESPONSIBILITY FOR YOUR ACTIONS. THIS SOFTWARE IS PROVIDED ``AS IS''
AND ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
DAMAGE. THIS SOFTWARE IS INTENDED FOR EDUCATIONAL USE ONLY AND MAY BE
ILLEGAL IF USED IMPROPORLY. USERS ASSUME FULL RESPONSIBILITY FOR THEIR
ACTIONS.
How-to flash Sigma-X on rev3 and older using the serial cable on the SB5100
First off I want to state that this can break your modem! I'm going to assume you have a
sb5100 with rev3 board or older with a serial connection and know how to use it.
Note: It has been tested on rev3 and older, only using a MAX233CP serial cable.
The Rev is printed on the bottom of the PBC board on the modem.
You are going to need a terminal emulator, a tftp server, and a copy of sigma-x with the
bootloader. I use Tera Term Pro for the terminal emulator and tftpd32 for the tftp server
but it's up to you what you use.
1:Hook it all up, serial connection, ethernet ( set ip to 192.168.100.10, gateway to
192.168.100.1) and start the terminal emulator and the tftp server with the sigma-x and
bootloader in the server directory. Go to Serial port setup in the terminal and set the
baud rate to 115200.
2:Start the modem and stop the boot by typing "p"
(Enter '1', '2', or 'p' within 2 seconds or take default...)
3:Hit enter five times, you should see the boot menu now.
- Board IP Address [192.168.100.1]:
Board IP Mask [255.255.255.0]:
Board IP Gateway [0.0.0.0]:
Board MAC Address [00:10:18:ff:ff:ff]:
Internal/External phy? (i/e)[i]
4:Type "e" then hit enter (Enter sector number:)
5:Type "8" then hit enter (Erase block 8 complete...)
6:Type "d" then hit enter (TFTP Get Selected)
7:Hit enter (Board TFTP Server IP Address [192.168.100.10]:)
8:Type "SB5100_SIGMA-X_1.05.bin" then hit enter (TFTP filename
[vxram_sto_sb5100_271j_fat_5.bin]: SB5100_SIGMA-X_1.05.bin)
9:Type "y" then hit enter (Image does not have standard header.
Do you wish to store it? [n] y)
10:Type "9" then hit enter (Enter sector to start store: 9)
11:Type "n" then hit enter (Store parameters to flash ? [n] n)
12:Type "d" then hit enter (TFTP Get Selected)
13:Hit enter (Board TFTP Server IP Address [192.168.100.10]:)
14:Type "TCNiSO_Bootloader_v2.5.91.bin" then hit enter
(Enter TFTP filename [SB5100_SIGMA-X_1.05.bin]: TCNiSO_Bootloader_v2.5.91.bin)
15:Type "y" then hit enter (Image does not have standard header.
Do you wish to store it? [n] y)
16:Type "0" then hit enter (Enter sector to start store: 0)
17:Type "n" then hit enter (Store parameters to flash ? [n] n)
Done. Now you have to do is a hard reboot/unplug the power for a few seconds.
Here is a log of it being done. It was in txt format so some of the info got wrapped around
but its all there and should give you a good idea how things should go.
Remember, this may very well be irreversible and one wrong step could mean a dead modem.
So far this method has been tested twice, once by me and once by Josey who logged it for me.
Detected CPU .............. BCM3348A1
Ebi Initialized .....................000002020000001C
Sdram Initialized....................
Icache Size: ....................2000
Icache Linesize:.................0010
Dcache Size: ....................2000
Dcache Linesize:.................0010
Sdram access OK......................
Compressed Bootloader detected.......
ImageCSize: ...................0062D3
ImageLoc: ...................81F80000
Decompression Status: .......00000000
Dcompressed Image Size:......00011005
BSS Initialized......................
TMP Stack initialized................
Perm Stack initialized...............
MemSize: ......................... 8M
Flash detected @0xbe000000
Signature: 3348
Broadcom BootLoader Version: 2.1.4b
Build Date: Jul 05 2002
Build Time: 13:55:24
Image 1 Program Header:
Signature: 3348
Control: 0004
Major Rev: 0002
Minor Rev: 0000
Build Time: 2002/10/24 19:47:48 Z
File Length: 956487 bytes
Load Address: 80010000
Filename: SB5100-1.1.1.1-SCM01-NOSH.bin
HCS: 2e4d
CRC: 09a777d4
HCS failed on Image 2 Program Header
Enter '1', '2', or 'p' within 2 seconds or take default...
.
Board IP Address [192.168.100.1]:
Board IP Mask [255.255.255.0]:
Board IP Gateway [0.0.0.0]:
Board MAC Address [00:10:18:ff:ff:ff]:
Internal/External phy? (i/e)[i]
Init EMAC, DMA, and MII PHY...
Autonegotiation started, waiting for completion...Autonegotiation successful...
MAC setup for FullDuplex
Main Menu:
==========
d) Download and PROGRAM
g) Download and GO
b) Boot from flash
e) Erase Sector
m) Set mode
s) Store parameters
i) Init ethernet
r) Read memory
w) Write memory
Enter sector number:8
Erase block 8 complete...
Main Menu:
==========
d) Download and PROGRAM
g) Download and GO
b) Boot from flash
e) Erase Sector
m) Set mode
s) Store parameters
i) Init ethernet
r) Read memory
w) Write memory
TFTP Get Selected
Board TFTP Server IP Address [192.168.100.10]:
Enter TFTP filename [vxram_sto_sb5100_271j_fat_5.bin]: SB5100_SIGMA-X_1.05.bin
Free store: a0500000
Starting TFTP of SB5100_SIGMA-X_1.05.bin from 192.168.100.10
Getting SB5100_SIGMA-X_1.05.bin using octet mode
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
.
Tftp complete
Received 985910 bytes
HCS failed on Image 0 Program Header
Image does not have standard header. Do you wish to store it? [n] y
Programming 985910 bytes
Flash Configuration
Flash Base: be000000
Device size: [2097152] bytes, or [16] Mbit
2 erase regions
0 byte Write Buffer
Enter sector to start store: 9
Stored 65536 bytesStored 131072 bytesStored 196608
bytesStored 262144 bytesStored 327680 bytesStored 393216 bytesStored
458752 bytesStored 524288 bytesStored 589824 bytesStored 655360 bytes
Stored 720896 bytesStored 786432 bytesStored 851968 bytesStored 917504
bytesStored 983040 bytesStored 985910 bytes
Verified 65536 bytesVerified 131072 bytesVerified 196608 bytesVerified 262144
bytesVerified 327680 bytesVerified 393216 bytesVerified 458752 bytesVerified
524288 bytesVerified 589824 bytesVerified 655360 bytesVerified 720896 bytesVerified
786432 bytesVerified 851968 bytesVerified 917504 bytesVerified 983040 bytesVerified 985910 bytes
Store parameters to flash ? [n] n
Main Menu:
==========
d) Download and PROGRAM
g) Download and GO
b) Boot from flash
e) Erase Sector
m) Set mode
s) Store parameters
i) Init ethernet
r) Read memory
w) Write memory
TFTP Get Selected
Board TFTP Server IP Address [192.168.100.10]:
Enter TFTP filename [SB5100_SIGMA-X_1.05.bin]: TCNiSO_Bootloader_v2.5.91.bin
Free store: a0500000
Starting TFTP of TCNiSO_Bootloader_v2.5.91.bin from 192.168.100.10
Getting TCNiSO_Bootloader_v2.5.91.bin using octet mode
.................
Tftp complete
Received 32768 bytes
HCS failed on Image 0 Program Header
Image does not have standard header. Do you wish to store it? [n] y
Programming 32768 bytes
Flash Configuration
Flash Base: be000000
Device size: [2097152] bytes, or [16] Mbit
2 erase regions
0 byte Write Buffer
Enter sector to start store: 0
Stored 8192 bytesStored 16384 bytesStored 24576 bytesStored 32768 bytes
Verified 8192 bytesVerified 16384 bytesVerified 24576 bytesVerified 32768 bytes
Store parameters to flash ? [n] n
Main Menu:
==========
d) Download and PROGRAM
g) Download and GO
b) Boot from flash
e) Erase Sector
m) Set mode
s) Store parameters
i) Init ethernet
r) Read memory
w) Write memory
TCNiSO 5100 Bootstrap CPU = BCM3348A1
Ebi Initialized: 000002020000001C
Sdram Initialized: [ OK ]
CPU instruction cache size: 2000
CPU instruction cache line size: 0010
CPU data cache size: 2000
CPU data cache line size: 0010
Sdram access: [ OK ]
TCNiSO Compressed bootloader detected
Compressed bootloader size: 0062D3
Compressed Image location: 81F80000
Decompression Status: 00000000
Dcompressed Bootloader size: 00011008
BSS Initialized: [ OK ]
TMP Stack initialized: [ OK ]
Perm Stack initialized: [ OK ]
MemSize: ......................... 8M
Flash detected @0xbe000000
TCNiSO BootLoader v 2.5.91 LITE
Build Date: Jan 26 2004
Image 1 Program Header:
Location: 0xBEC20000
Signature: 3348
Control: 0000
Major Rev: 0002
Minor Rev: 0001
Build Time: 2005/3/31 07:09:05 Z
File Length: 985818 bytes
Load Address: 80500000
Filename: SIGMA-X-1.05.bin_decompressor.bin
Image 2 Program Header:
Location: 0xBEE00000
Firmware header Not Found!
Press '1', '2', or 'm' within 2 seconds or take default...
. .
Bypassing CRC Verifiction on Image 1...
Loading Image 1...
Executing Image 1...
TCNiSO FirmwareDecompressor v2.0.3
Detected Compressed Firmware..... Decompressing...
Target Address: 0x80010000
...................
Decompressed length: 4981576
3348
TCNiSO SIGMA-X Version 1.05
usrRoot:usrNetInit: complete!
SIGMA-X Version 1.05
No SIGMA config space found...
Installing Default SIGMA Config space...
Reclaming 1343 bytes 0x803da880 to 0x803dadbf
Reclaming 5184 bytes 0x80450bd0 to 0x80452010
Reclaming 23315 bytes 0x80419fdc to 0x8041faef
Reclaming 458 bytes 0x80010000 to 0x800101ca
Reclaming 144 bytes 0x80010a98 to 0x80010b28
Reclaming 308 bytes 0x80010d74 to 0x80010ea8
Reclaming 140 bytes 0x80011194 to 0x80011220
Reclaming 176 bytes 0x80264180 to 0x80264230
Reclaming 48 bytes 0x802eace0 to 0x802ead10
Reclaming 180 bytes 0x8030ed10 to 0x8030edc4
Reclaming 92 bytes 0x80010794 to 0x800107f0
Reclaming 208 bytes 0x802630e0 to 0x802631b0
Reclaming 212 bytes 0x802eb150 to 0x802eb224
Reclaming 108 bytes 0x80306380 to 0x803063ec
Reclaming 48 bytes 0x802ead14 to 0x802ead44
Reclaming 52 bytes 0x800108f8 to 0x8001092c
Reclaming 348 bytes 0x80305150 to 0x803052ac
TCNiSO SIGMA Symbol manager v1.0
Compact symbol table at 0x804B3B30 17708 bytes, type 5
VxWorks Symbol Table Address 0x807E4410
SIGMA Compact Symbol Table Address 0x804B3B38
Special thanks to Josey for the logs and testing.
|
