| Adding serial to SS 5200 or recovery alternative? Just curious to see if anyone tried the suggestions for a 5200 serial port in the thread here: »Adding serial to SS 5200 or recovery alternative? The thread was active for a while and then died out.
If anybody has tried this, I would be interested to know the results. |
|
 Doctor OldsI Need A Remedy For What's Ailing Me.Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18 | Re: Adding serial to SS 5200 or recovery alternati I have not heard anything further either.  No one has IM'ed me and my email for this site doesn't work so I can't tell if anyone sent any further updates that way. I hope they post in the Forum instead and not send email to me (that gets lost) or IM's that I would rather see shared with everyone in the Forum instead of just me.  However, I will not share IM if the person does not agree or has an issue outside the range of the Forum. Then my IM's stay private. I always ask permission to share from the IM sender if I think it would benefit the Forum.
Regards,
Doctor Olds |
|
| (reposting here)
Hello, any news about this?
I(in true,a friend of mine) have a death SS 5200 and we are looking for a way to recover it.
I found some JTAG programmer schemes on the sites posted on this topic and I think this can be done, so, anyone have any news about this?
Best Regards,
Julioc |
|
|
|
enry
join:2003-07-13
h0h0h0 | reply to buggage
Hi everyone,
So I was mucking with my 5200 and I managed to get the NVRAM in an inconsistent state, such that the unit now crashes every time it boots:
RAM size is 8388608 (0x800000).
Interrupt Stack Control @ 0x0.
Userland stack @ 0x947fffd8.
System clock rate is 100 MHz.
Bootloader compiled Sep 17 2003 at 13:55:59.
Loader starting...
FLASH: Macronix Mx29LV160 (Bottom Boot)
autoboot v2.0
LDR: Image @ 0xb0020000 is valid
LDR: Image @ 0xb0100000 is valid
LDR: backup image size OK
LDR: images do not match
LDR: backing up image to 0xb0100000 ... ok
LDR: Beginning Uncompress
LDR: Compressed length = 732928
LDR: Uncompressed to = 1839892
P R O J E C T
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXXXX
XXX
XXXXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX - MIPS
Copyright (c) 2001-2002, Efficient Networks, Inc.
Speedstream E240 is powered by Project X
Version 004-E240-A21, Build 70-7, Feb 3 2003 14:55:44
Expat - XML Parser Toolkit v1.2
Copyright (c) 1998-2000, Thai Open Source Software Center Ltd
---System Starting---
XSH: [ OK ]
FLASH: Macronix Mx29LV160 (Bottom Boot)
NVRAM: 003-7080-509, France Telecom PPPoA Full Router. NV5:60621
NVRAM: [ OK ]
INT: [ OK ]
TMR: [ OK ]
WDT: Internal timeout set to 30s
WDT: External enabled
WDT: [ OK ]
BUTTON: [ OK ]
LED: [ OK ]
SYSTASK: [ OK ]
SYSLOG: [ OK ]
XLOG: [ OK ]
IPFW: [ OK ]
ADSL: [ OK ]
BRG: [ OFF ]
"TLB Load" exception:
r0(zr): 0x00000000 r1(at): 0xa8610000 r2(v0): 0x00000002 r3(v1): 0x00000000
r4(a0): 0x00000000 r5(a1): 0x00000000 r6(a2): 0x941fa9bc r7(a3): 0x94240560
r8(t0): 0x00000001 r9(t1): 0xa8610000 r10(t2): 0x94180000 r11(t3): 0x00000001
r12(t4): 0x00000000 r13(t5): 0x00000000 r14(t6): 0x00000000 r15(t7): 0x00000000
r16(s0): 0x00000000 r17(s1): 0x941fa9bc r18(s2): 0x00000000 r19(s3): 0x00000000
r20(s4): 0x00000000 r21(s5): 0x00000000 r22(s6): 0x9407ae24 r23(s7): 0x94240560
r24(t8): 0xdeadbeef r25(t9): 0x94079cb4 r26(k0): 0x940108d4 r27(k1): 0x940704e8
r28(gp): 0x80000000 r29(sp): 0x941fa97c r30(s8): 0x94240560 r31(ra): 0x9408f4ac
PRId : 0x00018005 Status : 0x10000403 Cause : 0x10808008 EPC : 0x9406e0ac
BadVaddr: 0x00000000 Index : 0x80000000 Random : 0x00000006 EntryLo0: 0x00000011
EntryLo1: 0x00000011 Context : 0x40000000 EntryHi: 0x00000047 PageMask: 0x00000000
Wired : 0x00000000 Count : 0x5b63d3d3 Compare: 0x578cb6a8 Config : 0x80048083
LLAddr : 0x00000000 WatchLo : 0x00000000 WatchHi: 0x00000000 CacheERR: 0x00000000
ECC : 0x00000000 ErrorEPC: 0xb0001488 TagLo : 0x00000000 TagHi : 0x00000000
So you say, "but enry, how did you manage to get that dump?"; well, read my next post. |
|
enry
join:2003-07-13
h0h0h0
4 edits | My first step was to attempt to access the serial console. This is possible with a 5$ serial circuit as shown.
Data rate is 115,200bps, No parity, 8 bits, 1 stop bit, no flow control. Get teraterm. Don't use hyperterminal and complain that it's not doing what you want it to do. Just download tterm, it's free. STFW.
Oh yeah, you need to solder a 5 pin header onto J5, inside your modem. This should not be difficult. I did this, and did not blow up my unit. The usual disclaimer applies, if you do this and blow up your unit, burn your house, blah blah, it's not my responsibility.
Anyways, for you guys that are curious, yes, you can replace the firmware with this method. It's easy:
Starting BOST:
SRAM ok
timer0 ok
timer1 ok
emac internal loopback ok
emac external loopback ok
eth_loop ok
AAL5_loop ok
BOST OK
Reset Status Register (RSR) value: 0x0
RAM size is 8388608 (0x800000).
Interrupt Stack Control @ 0x0.
Userland stack @ 0x947fffd8.
System clock rate is 100 MHz.
Bootloader compiled Sep 17 2003 at 13:55:59.
Loader starting...
FLASH: Macronix Mx29LV160 (Bottom Boot)
Now press any key, you will get a boot prompt.
Press h, and u get
boot> gotta 68 h
help:
c commit X-Modem download to FLASH...
d dump X-Modem test results...
h print this help
l load application
r run application
v verify application
x X-modem image download
boot>
So now you go ahead and hit, x, and go File | Transfer | XModem, and choose the img file. Remember you need to "decrypt" (lol) the file using bcr.exe -k="EFNTEFNT" -d "xxxxxxxx.img.enc" foo.img... Anyways, it seems the unit is smart, it won't let you shoot yourself in the foot and flash it with an invalid image.
boot> gotta 71 q
boot> gotta 78 x
X-Modem image download...
boot>
When the x-modem image transfer is done, press c to to commit the transfer. This is what you should get (return 0)
boot> gotta 63 c
commit X-Modem download to FLASH...
commit_xmodem: preparing to write APP to flash...
commit_xmodem: flashWrite returned 0
boot>
If you get something other than 0 you messed up.
Then try to load the image l and verify it v:
boot> gotta 6c l
LDR: Beginning Uncompress
LDR: Compressed length = 732928
LDR: Uncompressed to = 1839892
boot> gotta 76 v
LDR: Image Addr 0xb0020000
LDR: Image Header 0xb0020000
LDR: Text Magic "ENI @(#)"
LDR: Description "Copyright 2001,2002, Efficient Networks, Inc. All Rights Reserved
Speedstream"
LDR: Modem Version "004-E240-A21-70-7"
LDR: ADSL Version "a6.02.00"
LDR: Checksum 0x03cb9aed
LDR: Image Length 0x000b2f00
LDR: Image Type 0x00000001
LDR: Product Type 0x00000000
LDR: Calc Checksum 0x03cb9aed
LDR: Image @ 0xb0020000 is valid
boot>
To boot it, press r or just power cycle the unit.
Anyways, I can freely change firmware, BUT, my unit still crashes. This happened halfway through a change I was doing over telnet, so I do not think it is hardware, just incorrect data in the NVRAM. My next attempt will be to use JTAG... but I doubt that will work, especially since I don't know the base address of the NVRAM.
Incidentally, I don't understand how it is possible to actually screw up your firmware. The unit keeps a backup of the firmware elsewhere in memory; if somethign goes wrong with the flash halfway, the bootloader (upon next boot) will see the image is incorrect (checksum mismatch), and copy the backup, otherwise if the current firmware is valid and different from the backup, it makes a backup. So yeah, I'm confused as to how you could actually "incorrectly flash" the unit. The only scenario I see is if the NVRAM doesn't match the firmware and causes a panic, like in my case.
If anyone has had any luck re-writing the NVRAM through serial port or JTAG, please let me know.
Also, because my unit is now dead, I am looking to buy another cheap unit, or, in exchange, I will provide a working serial adapter, as well my experience in working with it... you can reach me at enry . at . enry . dot . net
Good luck! |
|
enry
join:2003-07-13
h0h0h0 | Oh yeah, also, I'll take any busted 5200's out there. Will paypal you shipping cost. I really liked my 5200 and want it back . Now I am on a 5360.
--
enry |
|
Doctor OldsI Need A Remedy For What's Ailing Me.Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18 | reply to enry
said by enry:
FLASH: Macronix Mx29LV160 (Bottom Boot)
autoboot v2.0
LDR: Image @ 0xb0020000 is valid
LDR: Image @ 0xb0100000 is valid
LDR: backup image size OK
LDR: images do not match
LDR: backing up image to 0xb0100000 ... ok
Copyright (c) 2001-2002, Efficient Networks, Inc.
Speedstream E240 is powered by Project X
Version 004-E240-A21, Build 70-7, Feb 3 2003 14:55:44
XSH: [ OK ]
FLASH: Macronix Mx29LV160 (Bottom Boot)
NVRAM: 003-7080-509, France Telecom PPPoA Full Router. NV5:60621
Your 5200 has a mix-match of Firmwares installed in it from what it looks like.
The A21 Firmware is Telmex and yet your output also mentions France Telecom which is the A3J Firmware. Could that be your problem??
This is what I can confirm.
A3J = "France Telecom PPPoA Full Router" (1,574,972 bytes)
A29 = "France Telecom Simple Router" (1,513,341 bytes)
A2W = "Telemar Full Router"
A21 = "TelMex Full Router 2"
A0X = "Full Router GA configuration"
A21 Output
xsh> show flash
AMD Am29LV160B (Bottom Boot)
AMD Am29LV160B (Top Boot)
AMD Am29LV320 (Bottom Boot)
AMD Am29LV320 (Top Boot)
AMD Am29DL323 (Bottom Boot)
AMD Am29DL323 (Top Boot)
Fujitsu MBM29LV160B (Bottom Boot)
Fujitsu MBM29LV160B (Top Boot)
Fujitsu MBM29LV320 (Bottom Boot)
Fujitsu MBM29LV320 (Top Boot)
STMicro M29W160B (Bottom Boot)
STMicro M29W160B (Top Boot)
STMicro M29W800 (Bottom Boot)
STMicro M29W800 (Top Boot)
Tosh Tc58fvb160 (Bottom Boot)
Tosh Tc58fvt160 (Top Boot)
Macronix Mx29LV160 (Bottom Boot)
Protection map:
Macronix Mx29LV160 (Top Boot)
Macronix Mx29LV320 (Bottom Boot)
Macronix Mx29LV320 (Top Boot)
Sharp LH28F160BJE (Bottom Boot)
Tosh Tc58fvt321 (Top Boot)
ST M29W320 (Top Boot)
ST M29W320 (Bottom Boot)
probed and found device: "Macronix Mx29LV160 (Bottom Boot)"
xsh>
+++++++++++++++++++++++++
A3J output:
xsh> show flash
AMD Am29LV160B (Bottom Boot)
AMD Am29LV160B (Top Boot)
AMD Am29LV320 (Bottom Boot)
AMD Am29LV320 (Top Boot)
AMD Am29DL323 (Bottom Boot)
AMD Am29DL323 (Top Boot)
Fujitsu MBM29LV160B (Bottom Boot)
Fujitsu MBM29LV160B (Top Boot)
Fujitsu MBM29LV320 (Bottom Boot)
Fujitsu MBM29LV320 (Top Boot)
STMicro M29W160B (Bottom Boot)
STMicro M29W160B (Top Boot)
STMicro M29W800 (Bottom Boot)
STMicro M29W800 (Top Boot)
Tosh Tc58fvb160 (Bottom Boot)
Tosh Tc58fvt160 (Top Boot)
Macronix Mx29LV160 (Bottom Boot)
Protection map:
Macronix Mx29LV160 (Top Boot)
Macronix Mx29LV320 (Bottom Boot)
Macronix Mx29LV320 (Top Boot)
Sharp LH28F160BJE (Bottom Boot)
Tosh Tc58fvt321 (Top Boot)
ST M29W320 (Top Boot)
ST M29W320 (Bottom Boot)
probed and found device: "Macronix Mx29LV160 (Bottom Boot)"
xsh>
Regards,
Doctor Olds |
|
enry
join:2003-07-13
h0h0h0 | The mismatch only occurred because, after it stopped working, I started feeding it other images in vain hope that it was an isolated bug; but, this did not help.
Believe me, even with the correct image for the data in NVRAM, it still panics. |
|
Doctor OldsI Need A Remedy For What's Ailing Me.Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18 | You don't setup a 5200 using a file from a Bell crippled unit to config it using the CLI with full Router Firmware and that is what started this case of instability. Now you have a mix of Firmware versions installed. Bell Canada will most likely charge you for the modem replacement when they get it back and look at it.
You should pick one version and FTP all the files over. The FAQ that is in the Sympatico Forum never suggested any of the procedures you used.
Regards,
Doctor Olds |
|
ICGabe
join:2003-09-25
Dallas, TX | reply to enry
Great info. I guess the 5200 serial connection mystery is solved  |
|
enry
join:2003-07-13
h0h0h0 | Hey, if they wanna bill me, I can live with that, after all, it's my screwup, but consider that in order to figure out what's wrong with the poor unit, they will have to solder a serial port header on it and debug over console.. at least 1 hour process for technically savvy person, and for what, the modem MSRP is under 100$, not worth it!
--
enry |
|
Doctor OldsI Need A Remedy For What's Ailing Me.Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18
1 edit | Did you (once getting it semi responding), try to Flash the A21 and then A3J firmware updates (the EXE installers) to get the unit stable with matched boot and config files since neither of those two updaters require hacking or passwords to get them to run (they didn't in my case on a Bell Bridge I purchased online 14 months ago).
If your unit shows dead to Bell, they may just give you another unit at "no charge" (I hope so ), but if you do this again with trying to upload Bell's config file to a different Firmware, be prepared for a nice fee from them because it will kill it again.. I think they charge you `$180.00 for replacement of a hacked 5200.
Regards,
Doctor Olds |
|
enry
join:2003-07-13
h0h0h0 | The unit crashes while booting, before its network stack is initialized, therefore it is impossible to flash it with the software.
I think I will buy a unit myself off ebay for testing.
--
enry |
|
Doctor OldsI Need A Remedy For What's Ailing Me.Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18 | Have you tried sending the original Bell Firmware back over the serial?
I still don't understand how you have the A21 boot and the A3J running code mixed on your 5200 and I would think if you got the matching files uploaded it would start working again.
Regards,
Doctor Olds |
|
enry
join:2003-07-13
h0h0h0 | I don't think you understand properly.. the unit starts booting, then crashes, and reboots. I never have the option to replace the NVRAM, only the firmware. Even with the matching firmware, it still crashes. |
|
Doctor OldsI Need A Remedy For What's Ailing Me.Premium,VIP
join:2001-04-19
1970 442 W30
kudos:18 | OK. You have the French/France Telecom PPPoA Router NVRAM "A3J", but you are running the Mexican Telco PPPoE TelMex "A21" Firmware so they currently do NOT match. Have you not been able to install the French A3J Firmware so it matches the current French A3J NVRAM? That is what I'm suggesting.
Then try a reset or reboot (or both as you may need to experiment) to see if you can get the Bell Config you tried to upload out of the unit and a default French A3J config to load instead. Then all three will come up at boot and see that the Firmware and NVRAM and config now match?
Regards,
Doctor Olds |
|
| reply to buggage
Re: Adding serial to SS 5200 or recovery alternative? Ok, so I spent this afternoon making the serial circuit. Been a long time since I've put anything like this together. Can't get it to work though. Have everything wired up to my modem. Everything LOOKS to be right. Definitly have 12V and 3V coming in to the circuit. Connected the power and didn't blow anything up. When I connect to COM1 or COM2 however, I don't get anything more than a blank screen. Tried shutting down/powering up the modem, but nothing. Hit keys on the terminal session, but no luck. Anyone know the voltages that I should be getting throughout the circuit, so I can compare? Anyone have any suggestions? |
|
| Well, after a little tweaking, I am getting a bit further. Though the most that I get to display are random characters, sometimes single or double, when I power up the modem.
So far:
I am borrowing 12Volts to the circuit from the power supply, and the 3Volts from the bottom pin of the second half of J4. I am getting ground from the 5th pin down on the same second half of J4.
When modem powered up these are the voltage I get:
J4 (1) Ground
J4 (2) 1V
J4 (3) .72V
J4 (5) 3.3V
J5 (2) .01V
J5 (3) .79V
J5 (5) Ground
When modem powered up and connected to serial port, these are the voltage I get:
J4 (1) Ground
J4 (2) 1V
J4 (3) 3.3V
J4 (5) 3.3V
J5 (2) .01V
J5 (3) -.68V
J5 (5) Ground
By the way, I am using TeraTerm and have it set for 115200baud, 8bits, No parity, 1stop, No flow.
One thing I don't quite understand is, why a 5 pin header on J5? Aren't there only connections to pins 2,3, and 5?
Enry, if you're still around, maybe you can post a picture of how your connection is set up. |
|
 starstuffFly By WirePremium
join:2001-12-05
Mcallen, TX | reply to enry
Re: Adding serial to SS 5200 or recovery alternati I can't beleive I did what you did without any 'official' documentation, but what the heck I did it.
I have a 5100b from SBC and I saw a suspicious 5 pin empty header in the PCB. Could this be the same as the one in your post? I did some tests with a logic probe and an oscilloscope. Hmm, the waveform looks like a RS232 pulse train... could this be the same?
I soldered a 5 pin .100 header and with a 1488/1489 RS232 line drivers I connected it to a COM port in my computer.
What a surprise! it is a RS232 interface. |
|
starstuffFly By WirePremium
join:2001-12-05
Mcallen, TX
1 edit | Forgot to post this... for those interested.
Is it possible to enable SNMP in this unit.
External watchdog disabled
Starting BOST:
SRAM ok
BOST OK
Reset Status Register (RSR) value: 0x0
RAM size is 8388608 (0x800000).
Interrupt Stack Control @ 0x0.
Userland stack @ 0x947fffd8.
CPU clock rate is 150 MHz.
System clock rate is 125 MHz.
Bootloader compiled Nov 26 2003 at 08:43:09.
Loader starting...
FLASH: AMD Am29LV160B (Bottom Boot)
autoboot v2.0
LDR: Image @ 0xb0020000 - Valid
LDR: Beginning Uncompress
LDR: Compressed length = 745484
LDR: Uncompressed to = 2593004
P R O J E C T
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXXXX
XXX
XXXXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX - MIPS
Copyright (c) 2001-2002, Efficient Networks, Inc.
*
Speedstream E142 is powered by Project X
Version 004-E142-A13, Build 75-SBC-39, Apr 8 2004 10:36:19
*
Expat - XML Parser Toolkit v1.2
Copyright (c) 1998-2000, Thai Open Source Software Center Ltd
*
---System Starting---
XSH: [ OK ]
*
FLASH: AMD Am29LV160B (Bottom Boot)
UNIQUE ID: 000b2368f009
NVRAM: 003-9015-INT, SBC Modem Configuration. NV'G':93895
*
NVRAM: [ O
*
INT: [ OK ]
*
TMR: [ OK ]
*
WDT: Internal timeout set to 30s
WDT: [ OK ]
*
LED: [ OK ]
*
BUTTON: [ OK ]
*
SYSTASK: [ OK ]
*
XLOG: Persistent Log Disabled.
SNTPC: [ OFF ]
*
SYSLOG: [ OFF ]
*
XLOG: [ OK ]
IPFW: [ OK ]
ADSL: [ OK ]
BRG: [ OK ]
ETH1: [ OK ]
2684: [ OK ]
2364: [ OK ]
ATM: [ OK ]
L2XP [ OK ]
UPNP: [ OK ]
DNSRELAY: [ OFF ]
LANCLIENT: [ OFF ]
DDNSD: [ OFF ]
FWUPDATE: [ OK ]
QOS: [ OFF ]
---System Ready---
ADSL: DataPump Version 01.01.00.00
ADSL: DOWN
ADSL: WAITING
UPNP: Added IF: br0 to UPnP multi-cast group
ADSL: INITIALIZING
ADSL: HYBRID 1
ADSL: Link up 1 US 608 DS 6016 (FAST:G.dmt)
(*) WARNING 14 long line(s) split
|
|
