[Isl3893-devel] md40900, Flash verify error !

[Wojtek A.]

Hi!

I have just got md40900, after first run, it stopped working
with info about not valid web page, or something simmilar.
So I played, a lot :)
I tried to upload just a web image, but it doesn't work,
then i tried a method with reset and tftp
http://www.sputnik.com/forum/index.php?t=msg&goto=1851&rid=0&S=90aae285c15331fd903eff54da85ca02
but still now luck, still invalid web.
So i thought I will try to flash "apfw.minimal.img", but when I tried
to download it from:
http://isl3893.sourceforge.net/download/firmware/siemens-wlanap600rp/apfw.minimal.img
I got "forbidden!".
So I was looking around, and found
http://www.personal.uni-jena.de/~p3kima/aldi.html
flashed 13.img with tftp, logged in, looked around and thought
that maybe I will erase some flash... (mtd's)
to flush all "bed" data,
I did erase_flash /dev/mtd1 and /dev/mtd2, and....
Router started in debug mode, as I expected, but..
I cannot tftp firmware any more!, all the time I get
"Flash verify error !",
how to unbrick my router?
is it possible to flash throught serial ?

Best wishes

Ericandor.


----------------------------------------------------
Masz własną stronę www? Szukasz taniej i suktecznej reklamy?
Zajrzyj na: WWW.Biznes.Szukaj.wp.pl
http://klik.wp.pl/?adr=www.biznes.szukaj.wp.pl&sid=735

[Johannes Steingraeber]

Post by Wojtek A.
[...]
Router started in debug mode, as I expected, but..
I cannot tftp firmware any more!, all the time I get
"Flash verify error !",
how to unbrick my router?
is it possible to flash throught serial ?

Can't say anything about serial but README says this:

| In development mode an additional image file is generated.
| This imagefile ( apfirmware.tfs ) is used by the bootstrap
| functionality of the bootrom.
| To have this file downloaded by the bootrom in case it can not find an
| valid image in flash perform the following manual steps.
| For poldhu:
| mv apfirmware.tfs to poldhu-<MAC address>.bin where MAC address equals
| the MAC address of the AP. Copy the resulting file to the /tfs directory
| of a machine in the same subnet as the AP.
| e.g. MAC address is 00:10:91:01:02:03 use
| mv apfirmware.tfs poldhu-001091010203.bin
| cp poldhu-001091010203.bin /tfs
| For 3893 chipset:
| See poldhu but replace poldhu- with 3893-

Looks like you could setup BOOTP and device will try to download
firmware with given name e.g. 3893-0060B3xxyyzz.bin (replace
0060B3xxyyzz with REAL MAC address of your router).

Good luck!
Johannes

[Wojtek A.]

Hi!

Post by Johannes Steingraeber
| In development mode an additional image file is generated.
...
Looks like you could setup BOOTP and device will try to download
firmware with given name e.g. 3893-0060B3xxyyzz.bin (replace
0060B3xxyyzz with REAL MAC address of your router).

Thx for Your reply!

Where Did You get this Readme? Is it from SDK ?

Is it possible to flash firmware throught JTAG ?
I mean, is there an appropriate software for that ?
(JTAG cable is not a problem for me...)

Best wishes

Erciandor


----------------------------------------------------
Jan Garbarek w Polsce 3-8 czerwca 2006 - Gdansk, Koszalin, Poznan,
Bydgoszcz, Szczecin, Wroclaw
wiecej informacji: http://klik.wp.pl/?adr=www.JanGarbarek.pl&sid=740

[Johannes Steingraeber]

Post by Wojtek A.
Where Did You get this Readme? Is it from SDK ?

This README is from AP-600RP_GNU_source-code.zip.

BTW the minimal image you are looking for may be here:

http://www.personal.uni-jena.de/~p3kima/aldi.html

It's not a fully working image but a point to start from.

You may also be interested in this posting:

http://sourceforge.net/mailarchive/message.php?msg_id=12509543

Good luck!
Johannes

[Wojtek A.]

Hi!

Thank You Johannes for hints :)

I did create 3893-0060B3xxyyzz.bin image
(just set BUILD env variable to "develope" before make image
eg. in bash export BUILD=develope)

But I cannot force router to download it.
I did setup dhcpd server with bootp support under linux,
but router just gets IP from dhcpd, and no firmware image.

I tried to tftp this image as I would normaly (in failsafe mode)
, but I just got "invalid image".

I also have one more md40900, I looked into sources and found
interesting script called bstrap (apfw_bstrap),
As I understand it changes flash content to force bootloader to
boot from tftp, or tfs (what's tfs anyway?). So I build image,
flashed it to working md40900, run apfw_bstrap with option
"tftp", restarted router, it went to failsafe mode, but I didn't
see any changes in its behaviour (I had tcpdump running).
Any Ideas ?

Options for apfw_bstrap makes me wonder what's the difference
between tftp and tfs. :)

Best wishes

Ericandor


----------------------------------------------------
Grupa dEUS w ramach dwudniowej muzycznej imprezy
Alternation Festival #1.
http://klik.wp.pl/?adr=http%3A%2F%2Fadv.reklama.wp.pl%2Fas%2Fdues.html&sid=738

[Johannes Steingraeber]

Post by Wojtek A.
Options for apfw_bstrap makes me wonder what's the difference
between tftp and tfs. :)

Sorry, I can't help with this.

[Wojtek A.]

Hi!

Post by Johannes Steingraeber
Sorry, I can't help with this.

[Ruben Faelens]

Hi,

First of all, I'd like to explain the boot process in recovery mode.
When you hook up a serial console, you will see this:
-> The router sends out a bootp-request. This is +- the same as a
DHCP-request. I didn't try this method, so I don't know what it does.
-> The router also binds to it's standard IP-adress. I can't remember
what that was though...
-> If the router doesn't get a valid bootp-answer, it will still bind to
the adress the DHCP-server supplied. It will bind a TFTP-server to both
ip-adresses. You can then upload a firmware image using tftp.

Secondly:
The "invalid web filesystem" error is common with md40900-routers. It
suffised to start the router in recovery mode (hold the reset switch
while booting) and uploading an updated firmware image (you can find it
at medion.de). This will probably not work, since you flashed some
firmware image which repartitioned the flash.
So to fix this, you should probably follow my guide for flashing large
firmware images
(http://www.student.kuleuven.ac.be/~s0169612/isl3893.html#flashing-large-firmwares)
to flash the default medion firmware image. Your router should be saved.

As a last note, a question to the group:
What's the status of JTAG? Did someone already manage to hack into the
isl3893-chip using JTAG? I thought we still needed a BSD-file?
(I'd love to see the proprietary datastore reverse-engineered!)

Greetings,
Ruben Faelens aka parasietje

Note: Could everyone with sourceforge.net access please change their
default umask to 002 instead of 022? This will make sure there are no
further problems with people unable to change other people's files.

[Wojtek A.]

Hi!

Post by Ruben Faelens
First of all, I'd like to explain the boot process in recovery mode.
-> The router sends out a bootp-request. This is +- the same as a
DHCP-request.
I didn't try this method, so I don't know what it does.

I know that DHCP is just improved BOOTP
(let's say evolution of bootp) :)

What I am sure that I have following entry in dhcpd.conf
file: (it is taken from man page)

host isl3896 {
hardware ethernet 00:xx:xx:xx:xx:xx:;
fixed-address 192.168.0.15;
filename "3893-00xxxxxxxxx.bin";
}

and dhcp server send 192.168.0.15 ip address to router,
but doesn't send info about bootfile name.

When I sniff dhcpdiscover packet from md40900 to dhcp server
it contains request for following options:
- Subnet Mask
- Router
- Router something request :)

there is no request for boot file, and I think that why dhcpd
doesn't send boot file name.

I need to get myself just BOOTP server no BOOTP/DHCP server, because
it looks for me that when BOOTP/DHCP sees DHCP options
then it ignores BOOTP. (but that's just my own theory :) )

Post by Ruben Faelens
-> The router also binds to it's standard IP-adress.
I can't remember
what that was though...
-> If the router doesn't get a valid bootp-answer,
it will still bind to
the adress the DHCP-server supplied.
It will bind a TFTP-server to both
ip-adresses. You can then upload a firmware image using tftp.

My binds to 169.254.xx.66,
then sends DHCP,
and finally binds to also to 192.0.2.93

Post by Ruben Faelens
The "invalid web filesystem" error is common with md40900-routers.
It suffised to start the router in recovery mode
(hold the reset switch while booting)
and uploading an updated firmware image
(you can find it at medion.de).

As I understand, You mean that the latest firmware fixes
"invalid web filesystem" once and forever ?
So when I flash my router with it I will never ever get the problem
again? It would be great, because I have two of them with
"invalid web filesystem" problem, and played just with one of them,
so there is a hope for the other one :)
btw. before all the mess I tried to flash just the webpage image,
but it did not help.
(btw. guy that sold me this router said that it has already
the latest firmware flashed, I didn't check is it true.)

Post by Ruben Faelens
This will probably not work, since you flashed some
firmware image which repartitioned the flash.
So to fix this, you should probably follow my guide for flashing
large firmware images
to flash the default medion firmware image.
Your router should be saved.

The only problem is that I cannot flash firmware in rescue mode
because of "Flash verify error !", and I think that's another issue.

Best wishes and thx for reply

Ericandor


----------------------------------------------------
Grupa dEUS w ramach dwudniowej muzycznej imprezy
Alternation Festival #1.
http://klik.wp.pl/?adr=http%3A%2F%2Fadv.reklama.wp.pl%2Fas%2Fdues.html&sid=738

[Geert Stappers]

On Sun, Apr 30, 2006 at 09:04:13PM +0200, Wojtek A. wrote:
<snip/>

Post by Wojtek A.
When I sniff dhcpdiscover packet from md40900 to dhcp server
- Subnet Mask
- Router
- Router something request :)
there is no request for boot file, and I think that why dhcpd
doesn't send boot file name.
I need to get myself just BOOTP server no BOOTP/DHCP server, because
it looks for me that when BOOTP/DHCP sees DHCP options
then it ignores BOOTP. (but that's just my own theory :) )

"allow bootp" and "allow booting" from ISC DHCP Server came to my mind,
but reading the manual did not clearify it. I also found
"always-reply-rfc1048"

| The always-reply-rfc1048 statement
|
| always-reply-rfc1048 flag;
|
| Some BOOTP clients expect RFC1048-style responses, but do not fol-
| low RFC1048 when sending their requests. You can tell that a
| client is having this problem if it is not getting the options you
| have configured for it and if you see in the server log the message
| "(non-rfc1048)" printed with each BOOTREQUEST that is logged.


I think it is worth trying ...

GSt