changing the cfe boot delay with jtag
On bcm6348 based devices, the standard bootloader is called the cfe. As well as boot strapping the board - so it can start the kernel - it also usually provides a few mechanisms for installing pre-built OS images. The process is simple: connect to the uart, wait for the "Press space key to stop auto run" message and press space. The boot is halted and you're given a 'CFE>' prompt where you can execute commands:
CFE version 1.0.37-21.6.8 for BCM96348 (32bit,SP,BE)
Build Date: Thu Sep 22 10:49:20 CST 2005 (michaelc@AskeyBrcmServer)
Flash Config: CS0(1f80000a,17),Base(bf800000),Size(8MB)
Ethernet Network Device: Internal PHY
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.2
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name :
Default host flash file name : bcmModelName_fs_kernel
Boot delay (1-9 seconds) : 9
Board Id Name : V2091_BB
Psi size in KB : 24
Number of MAC Addresses (1-32) : 3
Ethernet MAC Address : 00:16:e3:1f:0d:1c
WEP 128bit Key : a986888aa527c
Memory size in MB : 16
==== Press space key to stop auto run (9 seconds) ====
Auto run second count down(before hit space key): 4
CFE> help
Available commands:
w Write the whole image start from beginning of the flash
e Erase [n]vram or [a]ll flash except bootrom
r Run program from flash image or from host depend on [f/h] flag
p Print boot line and board parameter info
c Change booline parameters
f Write image to the flash
i Erase persistent storage data
b Change board parameters
reset Reset the board
flashimage Flashes a compressed image after the bootloader.
help Obtain help for CFE commands
For more information about a command, enter 'help command-name'
*** command status = 0
CFE>
However on the bt voyager 2091 that I've been working on recently, the bootloader doesn't stop and doesn't respond to space being pressed at all. I know that on other boards the boot delay is a configurable option from with the cfe shell; the menu looks like this:
CFE> c
Press: <enter> to use current value
Board IP address :[192.168.1.1:ffffff00]:
Host IP address :[192.168.1.2]:
Gateway IP address :[]:
Run from flash/host (f/h) :[f]:
Default host run file name :[]:
Default host flash file name :[bcmModelName_fs_kernel]:
Boot delay (1-9 seconds) :[9]:
I used jtag to pull the cfe (64k @0x1fc00000) and ran it through hexdump:
00000570 63 66 65 2d 76 01 00 25 15 06 08 00 00 00 00 00 |cfe-v..%........|
00000580 00 00 00 02 65 3d 31 39 32 2e 31 36 38 2e 31 2e |....e=192.168.1.|
00000590 31 3a 66 66 66 66 66 66 30 30 20 68 3d 31 39 32 |1:ffffff00 h=192|
000005a0 2e 31 36 38 2e 31 2e 32 20 67 3d 20 72 3d 66 20 |.168.1.2 g= r=f |
000005b0 66 3d 20 69 3d 62 63 6d 4d 6f 64 65 6c 4e 61 6d |f= i=bcmModelNam|
000005c0 65 5f 66 73 5f 6b 65 72 6e 65 6c 20 64 3d 31 20 |e_fs_kernel d=1 |
000005d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
It's not hard to see that there's a bunch of key=value pairs that match the expected data:
e=192.168.1.1:ffffff00 (Board IP address)
h=192.168.1.2 (Host IP address)
g= (Gateway IP address)
r=f (Run from flash/host (f/h))
f= (Default host run file name)
i=bcmModelName_fs_kernel (Default host flash file name)
d=1 (Boot delay (1-9 seconds))
Using a hex editor I modified the boot delay value in 0x5ce from '1'(0x31) to '9'(0x39) and flashed it back to the 2091 - I was expecting that I'd at least have to find and fix up a checksum somewhere, and I was quite surprised when it booted with:
CFE version 1.0.37-21.6.8 for BCM96348 (32bit,SP,BE)
Build Date: Thu Sep 22 10:49:20 CST 2005 (michaelc@AskeyBrcmServer)
Flash Config: CS0(1f80000a,17),Base(bf800000),Size(8MB)
Ethernet Network Device: Internal PHY
*** Board is not initialized properly ***
Press: <enter> to use current value
Board Id Name (A-O)
RTA1045VG -------- A
RTA1045BVG -------- B
RTA1046VW -------- C
RTA1046BVW -------- D
RTA1052BVW -------- E
RTA1050V -------- F
RTA1052V -------- G
V220V_BBV -------- H
V2091_BB -------- I
V2090 -------- J
V2110 -------- K
V2500V_BBV -------- L
V2500V_BB -------- M
RTA1025W_16 -------- N
RTA1025BW_16 -------- O :[I]:
Number of MAC Addresses (1-32) :[0]: 3
Ethernet MAC Address :[]:00:16:e3:1f:0d:1c
WEP 128bit Key :[a986888aa527c]:
Save and Exit (y/n):y
Save your cnofiguration to nvram........done
Press any key to reset the board:
CFE version 1.0.37-21.6.8 for BCM96348 (32bit,SP,BE)
Build Date: Thu Sep 22 10:49:20 CST 2005 (michaelc@AskeyBrcmServer)
Flash Config: CS0(1f80000a,17),Base(bf800000),Size(8MB)
Ethernet Network Device: Internal PHY
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.2
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name :
Default host flash file name : bcmModelName_fs_kernel
Boot delay (1-9 seconds) : 9
Board Id Name : V2091_BB
Psi size in KB : 24
Number of MAC Addresses (1-32) : 3
Ethernet MAC Address : 00:16:e3:1f:0d:1c
WEP 128bit Key : a986888aa527c
Memory size in MB : 16
==== Press space key to stop auto run (9 seconds) ====
And I could get into the cfe shell.
The final difficulty with the cfe on this board, is that the network stack seems to be disabled or uninitialised until you change the board IP address. I'm not sure if that's down to my messing with the cfe or if maybe it was intentionally disabled at the factory.