w700v - kein Bootloader mehr?

[scolopender]

I'm starting to think the RAM is damaged...

No. The original bootloader (provided as bl0930.bin) does not work this way.
Reason: The original bootloader assumes itself starting from flash at address 0xb3000000, not from RAM at 0x80000000.

G., -#####o:

 

[Mona2000]

But I tried the blrecovery.hex too, and it didn't work (the router is different, but the hardware is very very similar, should at least display a message, no?)

Anyway, I'll try modifying the source code if I find that hardcoded b3000000.

Thanks

 

[scolopender]

But I tried the blrecovery.hex too, and it didn't work...

blrecover.hex and bl0930.bin are for the Speedport W700V only.

the router is different, but the hardware is very very similar...

Seems it makes a difference. What is it?

should at least display a message, no?

No.

G., -#####o:

 

[Mona2000]

Seems it makes a difference. What is it?

It's a Kraun KR.RN (a rebranded Edimax AR-7064Mg+).
Now that I've looked at some V700W pics I see that it's not all that similar.. still, it has "Serial Download".
When it boots it says

Version 1.0.1
Read EEPROM
Jump to Flash
Head : Amazon Version 1.0.0 D-Link
DRAM:  32 MB

Head : relocate_code start

And then it stops. My friend who owned it says it failed after upgrading the firmware, but I think he flashed something wrong on it because it's not D-Link and it has 16MB of RAM, not 32.

Not sure if it can help but I attached some pictures.
R44 does the same thing as R960 on the V700W
R60 does the same thing ad R966 on the V700W
I also found the third one (R959) but I don't remember which one was it.

 

[Mona2000]

Update: I built and loaded u-boot "RAM version" but it still does nothing. Meh.

Just curious, where did you get the BFC005F4 address? I don't see it mentioned on any of the header files.

 

[scolopender]

Update: I built and loaded u-boot "RAM version" but it still does nothing.

I don't know whether your Kraun uses the same processor (Infineon PSB 50505 "Amazon") or where Flash and RAM are located within the address space.

Just curious, where did you get the BFC005F4 address? I don't see it mentioned on any of the header files.

This is an address of the primary bootloader starting at address 0xbfc00000 (contained in the processor itself). I dumped and disassembled it (and detected the strap options). Look into the attachment (binary and disassembly).

G., -#####o:

 

[Mona2000]

I don't know whether your Kraun uses the same processor (Infineon PSB 50505 "Amazon") or where Flash and RAM are located within the address space.

Yes, it's that one.
Flash (4MB) is at 0xB3000000.
RAM (16 MB) is at 0x80000000.

This is an address of the primary bootloader starting at address 0xbfc00000 (contained in the processor itself). I dumped and disassembled it (and detected the strap options). Look into the attachment (binary and disassembly).

G., -#####o:

That's very interesting. I don't really know MIPS assembly (only a bit of x86), but (if I haven't misunderstood something) it should be fairly easy to use "Serial Download" to load some raw code that puts something into a0 (that's $4, no?) and calls putStr. At least that would tell me that the RAM bank is not broken.

 

[scolopender]

I don't really know MIPS assembly...

You should be a little bit familiar with that.

... that puts something into a0...

a0 ??? $4 is register number 4 (some other naming exists, too). Function parameters are passed in registers $4 ... $11, return values in $2 (may be additional $3 for 64bit).

... and calls putStr.

I didn't try that with my W700V (no "Hello World").

G., -#####o:

 

[Mona2000]

I did something even simpler.

lui	$8,0xBFC0
ori	$9,$8,0x05F4
jr	$9

It works. It jumps.
That means the bank is not broken. That means i now have to find why it doesn't like my u-boot image.

 

[Mona2000]

I managed to write a MIPS program that dumps memory and I tried it on BFC00000. It looks very similar (same?) to yours.

Unfortunately I now discovered that is very very difficult to make u-boot load from RAM: http://www.denx.de/wiki/view/DULG/CanUBootBeConfiguredSuchThatItCanBeStartedInRAM, so I was thinking that maybe it's a better idea to make a program that copies the bootloader right into flash memory.

 

[mola2k]

Sorry das ich nach so langer Zeit das Thema nochmal komplett hochhole.

Ich habe das gleiche Problem wie Mona2000: Nach übertragen von blrecover.hex über den Serial Download (596 Punkte fliegen bei mir rein) passiert leider garnichts mehr...

Hintergrund-Infos:
Ich habe meinen W 700V nicht regelmäsig am Stromnetz. Als ich ihn letzt wieder in Betrieb nehmen wollte kam er nicht mehr hoch (Power-, Status und T-DSL-LED leuchten). Allem anschein nach hat er den Bootloader oder noch mehr verloren oder gar ist RAM oder Flash tot.

Hardware-Revision ist laut Board-Print: 01B

Kann mir jemand helfen? Wie kann ich das RAM/Flash testen?

 

[mola2k]

Ich habe nun das gleiche getan wie Mona2000:

I did something even simpler.

lui	$8,0xBFC0
ori	$9,$8,0x05F4
jr	$9

It works. It jumps.
That means the bank is not broken. That means i now have to find why it doesn't like my u-boot image.

Ich habe also (da ich keinen MIPS compiler habe) den Maschinencode von Hand geschrieben und in ein Hexfile übersetzt:

800000003C08BFC0350905F40120000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
11111111F231C5BC000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
9999999980000000

Ich hoffe das dies nicht korrekt ist, da nach dem Upload in mein W 700V auch leider nichts passiert (auch keine Fehlermeldung)...
Kann mir jemand Gewissheit geben oder ist der RAM defekt?

Danke!