CFE

 

介紹

 

CFE (Common Firmware Environment)

https://en.wikipedia.org/wiki/Common%20Firmware%20Environment

Hardware Info: ASUS_RT-AC66U

https://wikidevi.com/wiki/ASUS_RT-AC66U

Serial: yes, 3.3V TTL (115200)

FLA1: 128 MiB (Samsung K9F1G08U0D-SCB0)
FLA2: 2 MiB (Macronix MX25L1606EM2I-12G)
RAM1: 256 MiB (Samsung K4T1G164QF-BCF7 x 2)


TTL Converter Module

 

HW: USB to RS232 TTL Converter Module

Most routers come with an UART( computer hardware device that translates data between parallel and serial forms) integrated into the System-on-chip and its pins are routed on the Printed Circuit Board (PCB) to allow debugging, firmware replacement or serial device connection (like modems).

So in contrast to the JTAG-Port, the Serial Port needs some software running on the CPU so we can use it!

If the bootloader is damaged, or doesn't offer such a feature, the port is useless.

recovery methods <--  bootloader is responsible for listening on it

Your computer's TX should be connected to the device's RX, and your computer's RX should be connected to the device's TX.

The computer's GND should connect the the device's GND.

想知 HW support Serial

https://wikidevi.com/wiki/ASUS_RT-AC66U

Serial: yes, 3.3V TTL

 


Boot msg

 

CFE version 6.30.39.29 (r338244) based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 一 10月 15 10:41:41 CST 2012 (yau@wireless-pub2)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Found an ST compatible serial flash with 32 64KB blocks; total size 2MB
Found a AMD NAND flash with 1024B pages or 128KB blocks; total size 128MB
bcm_robo_enable_switch: EEE is disabled
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.30.39.29 (r338244)
CPU type 0x19749: 600MHz
Tot mem: 131072 KBytes

CFE mem:    0x80700000 - 0x8094EDE0 (2420192)
Data:       0x80738B70 - 0x8073BE10 (12960)
BSS:        0x8073BE10 - 0x8074CDE0 (69584)
Heap:       0x8074CDE0 - 0x8094CDE0 (2097152)
Stack:      0x8094CDE0 - 0x8094EDE0 (8192)
Text:       0x80700000 - 0x80738B70 (232304)

Device eth0:  hwaddr 10-C3-7B-??-??-??, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Null Rescue Flag.
boot the image...
I/O error
I/O error
Check 2 trx result: -4, -4
Hello!! Enter Rescue Mode: (Check error)

Reading :: TFTP Server.
Failed.: Timeout occured
Reading :: TFTP Server.
Failed.: Timeout occured

 


Help

CFE> help
Available commands:

show devices        Display information about the installed devices.
show clocks         Show current values of the clocks.
nvram               NVRAM utility.
reboot              Reboot.
flash               Update a flash memory device
batch               Load a batch file into memory and execute it
go                  Verify and boot OS image.
boot                Load an executable file into memory and execute it
load                Load an executable file into memory without executing it
save                Save a region of memory to a remote file via TFTP
ping                Ping a remote IP host.
arp                 Display or modify the ARP Table
ifconfig            Configure the Ethernet interface
help                Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0

 


show command

 

CFE> show clocks

Current clocks: 600/300/150/25 Mhz.
*** command status = 0

 

CFE> show devices

Device Name          Description
-------------------  ---------------------------------------------------------
uart0                NS16550 UART at 0x18000300
uart1                NS16550 UART at 0x18000400
flash0               ST Serial flash size 2048KB
flash0.boot          ST Serial flash offset 00000000 size 256KB
flash0.trx           ST Serial flash offset 00040000 size 1KB
flash0.os            ST Serial flash offset 0004001C size 1728KB
flash0.nvram         ST Serial flash offset 001F0000 size 64KB
flash1.boot          ST Serial flash offset 00000000 size 256KB
flash1.trx           ST Serial flash offset 00040000 size 1728KB
flash1.nvram         ST Serial flash offset 001F0000 size 64KB
nflash0.trx          Unknown type 146 NAND flash offset 00000000 size 1KB
nflash0.os           Unknown type 146 NAND flash offset 0000001C size 131072KB
nflash1.trx          Unknown type 146 NAND flash offset 00000000 size 32768KB
nflash1.brcmnand     Unknown type 146 NAND flash offset 02000000 size 98304KB
nflash2.prefix       Unknown type 146 NAND flash offset 00000000 size 65536KB
nflash2.trx          Unknown type 146 NAND flash offset 04000000 size 32768KB
eth0                 Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller
*** command status = 0

 


nvram

 

CFE> nvram show

size: 3842 bytes (61694 left)
*** command status = 0

CFE> nvram erase

*** command status = 0

CFE> nvram get bl_version

1.0.1.4
*** command status = 0

 


Config network

 

CFE> ifconfig -auto eth0

CFE> ifconfig -addr=192.168.29.128 -gw=192.168.29.1 -mask=255.255.255.0 eth0

 

 


tftp

 

window client

tftp [-i] [<Host>] [{get | put}] <Source> [<Destination>]

-i           # Specifies binary image transfer mode (also called octet mode).

Example:

ping 192.168.1.1

tftp -i 192.168.1.1 put tomato-RT-AC66U_AT-RT-AC6x-3.1-134-AIO-64K.trx

output

順利傳輸: 13 秒內傳送 22175744 個位元組,每秒 1705826 個位元組

console

- last blk -
Done. 22175744 bytes read
Download of 0x1526000 bytes completed
Write kernel and filesystem binary to FLASH
Programming...copysize=22175744, amtcopy=-4
Failed.: I/O error

*** This is very important to pass [destination-device] argument or CFE will write to the flash0 device overwriting the CFE!

CFE tftp Client

flash -noheader 192.168.1.100:RT-AC66U_3.0.0.4_376_2524-g0013f52.trx flash1.trx

Programming...copysize=26234880, amtcopy=-4
Failed.: I/O error

-noheader    Override header verification, flash binary without checking
-ctheader    Check header of CyberTAN

CFE tftp Server

It's also possible to make flash start a TFTP server that will accept firmware for "few seconds"

flash : flash1.trx

flash -noheader : nflash1.trx

flash -ctheader : flash1.trx