[Problem gelöst, FBF neu geflasht über JTag] FBF7050, adam2 Bootloader deadlock?

[stefanoIT]

Hi @flemming.

thank you for your support
do you confirm me 300 Ohm (for TSRT and cTRST to 3V3)?

I found that my flash chip MX29LV320ATTC-70
is fully compatible with MX29LV320T/B device
so I'll try these values
/fc:29 ............. MX29LV320B 2Mx16 BotB (4MB)
/fc:30 ............. MX29LV320B 2Mx16 BotB (4MB)
/fc:31 ............. MX29LV320T 2Mx16 TopB (4MB)
/fc:32 ............. MX29LV320T 2Mx16 TopB (4MB)

One question. I have to put the environment (mtd3 block 1640 byte long (0x66) in the flash memory.

which command is correct?

jtag.exe -flash:custom /instrlen:5 /window:90000000 /star
t:903C0000 /length:20000

or

jtag.exe -flash:custom /instrlen:5 /window:90000000 /star
t:903C0000 /length:668

thanks
stefano

[feadi]

which command is correct?

jtag.exe -flash:custom /instrlen:5 /window:90000000 /star
t:903C0000 /length:20000

or

jtag.exe -flash:custom /instrlen:5 /window:90000000 /star
t:903C0000 /length:668

both commands are correct.

btw. almost all cheap interfaces from ebay are not necessary terminated. try to solder a 2n2 cap on the TCK-line as close as possible to the 244.

regards
- Feadi

[stefanoIT]

@feadi

a 2n2 cap to GND?

thx

stefano

[Crake]

First of all sorry because i don't speak German, only Portuguese and English...

I need help (Someone recommended me Mr. Feadi !!) because i have a Fritz!box 7140 Annex B version AOL in German, and i tried to change it to English last version and Annex A, in order to work here in Portugal.

After read some "milions" of threads and topics, i followed this one:

So I won't take any responsibility for what you are doing.

First you have to double check where exactly the bootloader in your fritz is located. Therefore do the following:

Code: [Download] [Nascondi] [Select]
Code: [Download] [Mostra]
~ $ cat /proc/mtd
dev: size erasesize name
mtd0: 00800000 00010000 "phys_mapped_flash"
mtd1: 006ccb00 00010000 "filesystem"
mtd2: 00770000 00010000 "kernel"
mtd3: 00010000 00010000 "bootloader"
mtd4: 00040000 00010000 "tffs (1)"
mtd5: 00040000 00010000 "tffs (2)"
mtd6: 00200000 00010000 "jffs2"
mtd7: 00570000 00010000 "Kernel without jffs2"


As you see the bootloader is actually located on the mtd3 block (but you have to try this command on your machine. It may be on a different location). Now you can overwrite it with your own bootloader.

So, assuming the bootloader is on the mtd3 block, place your bootloader in the tftp server default directory, rename it mtd3.bin, start your tftp server (I recommend Solarwinds) and type the following:

tftp -g -l /var/mtd3.bin -r mtd3.bin <ip as appears on the tftp server window>

With this command you have transfered the bootloader in a temporary directory. Please double check it is actually there:

$ cd /var
/var $ ls -la
Code: [Download] [Nascondi] [Select]
Code: [Download] [Mostra]
drwxr-xr-x 9 root root 0 Sep 21 20:35 .
drwxrwxrwx 1 root root 90 Sep 21 18:58 ..
lrwxrwxrwx 1 root root 19 Jan 1 2000 TZ -> /etc/default.049/TZ
-rw-r--r-- 1 root root 0 Jan 1 2000 USB-proc-bus-usb-001-001-hub-001
-rw-r--r-- 1 root root 1951 Jan 1 2000 config.def
lrwxrwxrwx 1 root root 27 Jan 1 2000 default -> /etc/default.Fritz_Box_7141
-rw-r--r-- 1 root root 420 Jan 1 2000 devices
-rw-r--r-- 1 root root 934 Sep 21 20:32 env
-rw-r--r-- 1 root root 4060 Jan 1 2000 env.cache
drwxr-xr-x 2 root root 0 Sep 21 20:32 flash
lrwxrwxrwx 1 root root 34 Jan 1 2000 flash.html -> /var/html/html/de/tools/flash.html
lrwxrwxrwx 1 root root 31 Jan 1 2000 fx_moh -> /etc/default.049/fx_moh.default
lrwxrwxrwx 1 root root 12 Jan 1 2000 html -> /usr/www/avm
-rw-r--r-- 1 root root 4 Jan 1 2000 led
drwxr-xr-x 2 root root 0 Jan 1 2000 lock
drwxr-xr-x 2 root root 0 Jan 1 2000 log
drwxr-xr-x 10 root root 0 Jan 1 2000 mod
-rw-r--r-- 1 root root 65536 Sep 21 20:35 mtd3.bin
-rwxr-xr-x 1 root root 624 Jul 10 13:47 post_install
drwxr-xr-x 2 root root 0 Jan 1 2000 run
drwxr-xr-x 3 root root 0 Jan 1 2000 spool
lrwxrwxrwx 1 root root 4 Jan 1 2000 sysfs -> /sys
drwxr-xr-x 4 root root 0 Sep 21 19:10 tmp

You can see the mtd3.bin (whose size is 65536) is actually there. Now you can enter the potentially dangerous command.
Again, you do it at your own risk So keep your fingers crossed and enter:

cat /var/mtd.3.bin > /dev/mtdblock3

It will take a couple of seconds. Now you can reboot and hope that everything went fine.

The problem is that after that i got no access to the Fritz, neither by Ftp nor by Telnet.
I also tried to use a recover image, but it just couldn't find my Fritz.

By the way, the ip on the Laptop used in all this process was always the 192.168.178.23, and now is 169.254.194.20, but if i run a ipconfig /all, i can't see the Fritz.

Also i have never got again the Wan light on. Now the only light i see is the Power one, and is always blinking.

Someone can HELP me ???

Thanks, Crake.

[stefanoIT]

Hi folks,
Success!! I solved the problem.

Using a very very short cable I put mtd3 and mtd4 in the box and ATA came back to life.
Just a recovery and now it's fully working.
I can confirm that all suggestions was right.

I used flash type /fc:31

Thanks you all.
stefano

[feadi]

@ StefanoIT:

Congraz!

@ Crake:

You will need a serial-console-cable, you can either build one by yourself, or buy one like this:
http://cgi.ebay.de/SIEMENS-USB-DATEN...QQcmdZViewItem

regards,
Feadi

[Crake]

@ Crake:

You will need a serial-console-cable, you can either build one by yourself, or buy one like this:
http://cgi.ebay.de/SIEMENS-USB-DATEN...QQcmdZViewItem

regards,
Feadi

OK, i have just bought the cable by Ebay, as you suggested.

When i receive it what should i do ??

Thanks, Crake.

[feadi]

Connect GND, TX and RX with your FBF. pinout: http://pinouts.ru/CellularPhonesCabl...0_pinout.shtml

After this, take a look at the serial console outputs.

best Regards,
- Feadi

[Alpamayo]

Crake, do you have, by any chance, DHCP enabled on your computer???

[Crake]

Crake, do you have, by any chance, DHCP enabled on your computer???

Yes, i'm sure i have.

[Alpamayo]

Ok. Please DISABLE it. Enter a fixed ip address like the following one:

ip 192.168.178.20
mask 255.255.255.0
Gateway 192.168.178.1

Also, please enter the registry, find DisableDHCPMediaSense and set to 1. Disable also firewall, antivirus etc. Finally do not use any wireless connection to perform any operation. Use the cable.

Now try again to connect to your router.

Alpamayo

[Crake]

Ok. Please DISABLE it. Enter a fixed ip address like the following one:

ip 192.168.178.20
mask 255.255.255.0
Gateway 192.168.178.1

Also, please enter the registry, find DisableDHCPMediaSense and set to 1. Disable also firewall, antivirus etc. Finally do not use any wireless connection to perform any operation. Use the cable.

Now try again to connect to your router.

Alpamayo

Hi There My Friend !!!

I'm very happy because your instructions did work perfectly !!!

I'm now trying to confirm that all is OK, and i have no breakdowns on my ADSL connection.

I have now one last question:

- Here in my country, Portugal, the plug on analogue connections on the wall are in RJ11 format. The Y cable that came with my Fritz!Box has the three connectors on RJ45 format. I'm not sure in what converters from RJ11 to RJ45 shall i buy.

Once again many thanks to you, and apology my late response, due to lots of work around, crake.

[Alpamayo]

Hi There My Friend !!!

I'm very happy because your instructions did work perfectly !!!

I'm now trying to confirm that all is OK, and i have no breakdowns on my ADSL connection.

I have now one last question:

- Here in my country, Portugal, the plug on analogue connections on the wall are in RJ11 format. The Y cable that came with my Fritz!Box has the three connectors on RJ45 format. I'm not sure in what converters from RJ11 to RJ45 shall i buy.

Once again many thanks to you, and apology my late response, due to lots of work around, crake.

I'm glad you managed to solve your problem.
The quickest way to make a cable is to use a Portugese cable with RJ11 plugs and plug it into the RJ45 socket on the fritz. It should fit nicely in the center.
If you want to use an RJ45 plug instead, you need to modify one end of a RJ11-to-RJ11 cable and replace one of the RJ11 plugs with a RJ45. The pins you have to connect are 4 and 5 .

Alpamayo

[Crake]

I'm glad you managed to solve your problem.
The quickest way to make a cable is to use a Portugese cable with RJ11 plugs and plug it into the RJ45 socket on the fritz. It should fit nicely in the center.
If you want to use an RJ45 plug instead, you need to modify one end of a RJ11-to-RJ11 cable and replace one of the RJ11 plugs with a RJ45. The pins you have to connect are 4 and 5 .

Alpamayo

Yes, but what about the phone.

Now it's plugged to an ADSL microfilter, wich has two female connections: One for Internet and another one to Phone.

What should i buy ??

Thanks, Crake.

[Alpamayo]

Yes, but what about the phone.

Now it's plugged to an ADSL microfilter, wich has two female connections: One for Internet and another one to Phone.

What should i buy ??

Thanks, Crake.

In this case you need to build a cable with 4 leads. On the fritzbox side you will use a RJ45 and you will connect pin 4 and 5 for the ADSL line, and pin 3 and 6 for the analogue telephone line. On the other side you will use 2 RJ11 plugs accordingly.

Alpamayo

[fritsv]

AVM delivers the international box with the standard Y-cable [3xRJ45] and also in the shipping-box are two converters/adaptors female RJ45 to male RJ11. Maybe you can buy them either in Portugal or directly from AVM

[Crake]

AVM delivers the international box with the standard Y-cable [3xRJ45] and also in the shipping-box are two converters/adaptors female RJ45 to male RJ11. Maybe you can buy them either in Portugal or directly from AVM

Thank you by your support, but do you know where can i buy it ??

I searched on the AVM Site, and some Portuguese Shops, but found nothing...

Crake.

[fritsv]

Why dont you sent an email to AVM-support and ask them

[Crake]

Why dont you sent an email to AVM-support and ask them

I have already done it !

But i'm afraid they take to long to answer me, and i cannot experiment my equipment !!!

[stefanoIT]

Hi all,
I'm trying to use my EJTAG interface on a FBF 7050.
That interface worked well on a FBF ATA

These are the connections:

TRST -> 3V3 330 Ohm
cTRST -> 3v3 330 Ohm
TDI  -> (pin 2)
TDO -> (pin 13)
TMS -> (pin 4)
TCK -> (pin 3)
3V3 
GND

this is the interface layout
http://www.ip-phone-forum.de/attachm...4&d=1190638043

I get this message:

- EJTAG IMPCODE ....... : 00000000000000000000000000000000 (00000000)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Skipped

Probing Flash at (Flash Window: 0x90000000) ...
*** Unknown or NO Flash Chip Detected ***

There is a difference beteween ATA and 7050, 7050 have a coprocesso so
TDO became cTDO.
Maybe this the cause of problem?

thank you
stefano