Hi, everyone! I've got BCM63138 chip based router that looks like this:
I have UART connected to the device. (unfortunately, I couldn't find JTAG on board). Device itself goes into infinite reboot with 'power' led blinking when it reaches certain point. I wounder if there is some kind of watchdog that does it.
So far I've got access to truncated CFE where I dumped nvme (0x000000000000-0x000000040000 : "nvram") and image_update with rootfs (ubifs+jffs2) (0x000000040000-0x0x00000818000).
I'm looking for suggestions about this device, as I have lack of experience with embedded systems.
Is it possible to reimage either CFE with extended feature set or rootfs, so it can boots successfully ?
I have managed to load random file into device via tftp, but I couldn't figure out how to run some thing on the device. It seems like if I execute 'go' command in CFE it just stuck and does nothing, or I give it wrong offset....
PS.
There are available CFE commands:
CFE> h
Invalid command: "h"
Available commands: x, find, comp, fb, dn, phy, otpr, sm, db, dh, dw, w, e, wp, ws, go, r, p, c, i, ddr, a, b, reset, pmdio, spi, closeavs, cpufreq, force, help
*** command status = -1
CFE> help
Available commands:
x Change extra partitions size
find Find string in NAND
comp Compare NAND blocks
fb Find NAND bad blocks
dn Dump NAND contents along with spare area-1
phy Set memory or registers.
otpr Read btrm otp bits
sm Set memory or registers.
db Dump bytes.
dh Dump half-words.
dw Dump words.
w Write the whole image start from beginning of the flash
e Erase NAND flash
wp Write pmc (previously loaded through JTAG to flash block 0.
ws Write whole image (priviously loaded by kermit or JTAG) to flash .
go goto and execute from specefic address.
r Run program from flash image or from host depend on [f/h] flag
p Print boot line and board parameter info
c Change booline parameters
i Erase persistent storage data
ddr Change board DDR config
a Change board AFE ID
b Change board parameters
reset Reset the board
pmdio Pseudo MDIO access for external switches.
spi Legacy SPI access of external switch.
closeavs pmc close avs cmd
cpufreq set CPU frequency
force override chipid check for images.
help Obtain help for CFE commands
Memory map:
0x000008500000-0x0000102c0000 : "rootfs"
0x000000580000-0x000008180000 : "rootfs_update"
0x00001fb00000-0x00001ff00000 : "user"
0x000000000000-0x000000040000 : "nvram"
0x000008180000-0x0000102c0000 : "image"
0x000000040000-0x000008180000 : "image_update"
0x000008180000-0x000008500000 : "bootfs"
0x000000040000-0x000000580000 : "bootfs_update"
0x00001fa00000-0x00001fb00000 : "misc2"
0x000010300000-0x00001fa00000 : "misc1"
I will attach bootlog from both images that device has:
Image_0 bootlog:
Image_1 bootlog:
Device made by KAON Media company (http://www.kaonmedia.com/eng/product/pro02_2.asp?pgrp=41)
They don't have any updates available for it (DG3420), but device itself looks like (DG2100B) and I have no idea if they are compatible...