4

Hello I have a 4G LTE router which is blocked. I have access to its serial interface and I have already dumped the partitions before via telnet from another device of the same model.

Here's the output of the serial interface:

    U-Boot 2010.09 (Sep 06 2016 - 10:08:39)GCT GDM7243



Build Info:

  date: 2016/09/06-10:08:44

  user: root@ubuntu-will

  svnr: 

  src: /home/will/DEVELOPMENT/LTE_Router/B5328_FDD/SDK/work/uboot

  ver: 0.46e



DRAM:  128 MiB (wbd-p2)

NAND:  Built-in ECC Nand
maf_id : 0x00000098, dev_id : 0x000000a1
Pagesize : 2Kbytes
Address cycle : 4
128 MiB
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
nand_read_bbt: Bad block at 0x000006000000
In:    serial
Out:   serial
Err:   serial
Net:    001cc910 Realtek8211  PHYCR1: 0000211c  Rx delay: 0x00802300 
    PHYCR2:0x842  mii0
Hit ENTER key to stop autoboot:  5  4  3  2  1  0 
GPIO RESET KEY OFF
00420000
---------------------
hdr chksum  : 0xffffffff
magic       : 0xffffffff
timstamp    : 0xffffffff
data chksum : 0xffffffff
data size   : 0xffffffff
---------------------
image header magic is invalid
00440000
---------------------
hdr chksum  : 0xa6160741
magic       : 0xcafebabe
timstamp    : 0x00000003
data chksum : 0xf314f304
data size   : 0x0001ffdc
---------------------
cmnnv current block is : 1
pesifwcheck=1
Erasing Nand...

Erasing at 0x80000 --  25% complete.
Erasing at 0xa0000 --  50% complete.
Erasing at 0xc0000 --  75% complete.
Erasing at 0xe0000 -- 100% complete.
Writing to Nand... done

boot from part_idx: 2
do_check_partition() type:linux2, ---------------------
hdr chksum  : 0x00000000
magic       : 0x00000000
timstamp    : 0x00000000
data chksum : 0x00000000
data size   : 0x00000000
---------------------
---------------------
hdr chksum  : 0x00000000
magic       : 0x00000000
timstamp    : 0x00000000
data chksum : 0x00000000
data size   : 0x00000000
---------------------
no valid header(0)
There are no valid headers
---------------------
hdr chksum  : 0x00000000
magic       : 0x00000000
timstamp    : 0x00000000
data chksum : 0x00000000
data size   : 0x00000000
---------------------
---------------------
hdr chksum  : 0x00000000
magic       : 0x00000000
timstamp    : 0x00000000
data chksum : 0x00000000
data size   : 0x00000000
---------------------
no valid header(1)
There are no valid headers
Erasing Nand...

Erasing at 0x80000 --  25% complete.
Erasing at 0xa0000 --  50% complete.
Erasing at 0xc0000 --  75% complete.
Erasing at 0xe0000 -- 100% complete.
Writing to Nand... done

---------------------
hdr chksum  : 0x00000000
magic       : 0x00000000
timstamp    : 0x00000000
data chksum : 0x00000000
data size   : 0x00000000
---------------------
---------------------
hdr chksum  : 0x00000000
magic       : 0x00000000
timstamp    : 0x00000000
data chksum : 0x00000000
data size   : 0x00000000
---------------------
no valid header(0)
---------------------
hdr chksum  : 0x00000000
magic       : 0x00000000
timstamp    : 0x00000000
data chksum : 0x00000000
data size   : 0x00000000
---------------------
---------------------
hdr chksum  : 0x00000000
magic       : 0x00000000
timstamp    : 0x00000000
data chksum : 0x00000000
data size   : 0x00000000
---------------------
no valid header(2)
---------------------
hdr chksum  : 0x00000000
magic       : 0x00000000
timstamp    : 0x00000000
data chksum : 0x00000000
data size   : 0x00000000
---------------------
---------------------
hdr chksum  : 0x00000000
magic       : 0x00000000
timstamp    : 0x00000000
data chksum : 0x00000000
data size   : 0x00000000
---------------------
no valid header(1)
bootdelay=5
bootargs (auto)
## Booting kernel from Legacy Image at d05fffc0 ...
   Image Name:   Linux-3.10.0-uc0
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2317840 Bytes = 2.2 MiB
   Load Address: d0600000
   Entry Point:  d0600000
   Verifying Checksum ... Bad Data CRC
ERROR: can't get kernel image!

If I try to boot from TFTP the image loads just fine and everything is working.

I flashed the linux.bin image to the respective partition but I don't know what I need to do to be able to get the device working again. Maybe flashing from U-Boot will get it to work .

Here's the boot process information from TFTP:

    Using mii0 device
TFTP from server 192.168.0.10; our IP address is 192.168.0.1
Filename 'linux.bin'.
Load address: 0xd05fffc0
Loading: *##T ###############################################################
     #################################################################
     #################################################################
     #################################################################
     ##########################
done
Bytes transferred = 4194304 (400000 hex)
Automatic boot of image at addr 0xD05FFFC0 ...
## Booting kernel from Legacy Image at d05fffc0 ...
   Image Name:   Linux-3.10.0-uc0
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2317840 Bytes = 2.2 MiB
   Load Address: d0600000
   Entry Point:  d0600000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
gipc-protocol address: d4880010
ipc config: 00000004
  router-device
s-ch_enabled: 0x10010001
s-ch_enabled: 0x10010001
s-ch_enabled: 0x10010001
ipc magic=0x40540103(12)
s-ch_enabled: 0x10010003

Here's the partition layout:

GDM7243> mtdparts


device nand0 <gdm7243>, # parts = 17
 #: name        size        offset      mask_flags
 0: u-boot              0x00080000  0x00000000  0
 1: env                 0x00080000  0x00080000  0
 2: rev0                0x00100000  0x00100000  0
 3: ltenv               0x00100000  0x00200000  0
 4: wmnv                0x00100000  0x00300000  0
 5: cmnnv               0x00100000  0x00400000  0
 6: cmnnv2              0x00100000  0x00500000  0
 7: rev1                0x00400000  0x00600000  0
 8: linux               0x00400000  0x00a00000  0
 9: linux2              0x00400000  0x00e00000  0
10: rootfs              0x01e00000  0x01200000  0
11: rootfs2             0x01e00000  0x03000000  0
12: tk                  0x00500000  0x04e00000  0
13: tk2                 0x00500000  0x05300000  0
14: customize           0x00080000  0x05800000  0
15: log                 0x00280000  0x05880000  0
16: update              0x02000000  0x05b00000  0

active partition: nand0,0 - (u-boot) 0x00080000 @ 0x00000000

defaults:
mtdids  : nand0=gdm7243
mtdparts: mtdparts=gdm7243:512k(u-boot),512k(env),1m(rev0),1m(ltenv),1m(wmnv),1m(cmnnv),1m(cmnnv2),4m(rev1),4m(linux),4m(linux2),30m(rootfs),30m(rootfs2),5m(tk),5m(tk2),512k(customize),2560k(log),32m(update)
  • Hi and welcome to RE.SE. This is borderline off-topic. But I sympathize, having been there. Have you checked the (U-Boot) environment? Typically the checksum will be stored there. Try to set the checksum value on the "bricked" device to the value of the working one (assuming that's the kernel you are trying to boot). I may be completely wrong here, but I have had devices working like that. The checksum is just that: a way to check the integrity of the kernel image, not primarily tamper-proofing a device. Alternatively try U-Boot's crc32 command on the address at which you loaded the kernel. – 0xC0000022L Jul 31 at 20:32
  • For showing the environment, try printenv and be sure that you have a valid U-Boot image (the file command may be of help). setenv and saveenv can be used to manipulate the environment and save your changes. – 0xC0000022L Jul 31 at 20:36
  • Hi Thanks for your help , i already know the commands for printenv et setenv saveenv , the problem here is that i don't understand the correct address to write the image from ram to nand device so that's why i'm asking so i won't have the device bricked. here's the output of the command printenv : or i already posted everything on github but no one responded . github.com/pepe2k/u-boot_mod/issues/231 – coolirc Aug 1 at 17:53
  • I already transferred the linux.bin image to the address 0xD05FFFC0 of size of 4194304 , so the problem here is what's the correct command to be able to write the image to 0x00a00000 ? I think there are some calculations to make before writing to that offset using nand write command from the ram – coolirc Aug 1 at 18:04
  • so I think the command would be first to erase the linux partition then do something like "nand write 0xD05FFFC0 0x00a00000 0x40000" but I'm not sure if this is correct or not – coolirc Aug 1 at 18:11
4

Hello I actually solved my problem , the answer was in the environnement if you read carfully you can get the commands that save the linux parition from the kernel_load_address : actually the problem could be solved by simply transferring the linux.bin image using ymodem to the memory of the device then simply write the image from the correct loaded address to the nand partition .

    linuxsave=image write ${kernel_load_addr} linux ${filesize}
linux0save=image write_part ${kernel_load_addr} linux ${filesize}
linux2save=image write_part ${kernel_load_addr} linux2 ${filesize}


linuxsave2=nand erase.part linux;nand write ${kernel_load_addr} linux ${filesize}


kernel_load_addr=0xd0600000
filesize=400000

so the correct command to issue first was to execute :

  • nand erase.part linux
  • nand write 0xd05fffc0 linux 400000
  • nand erase.part linux2
  • nand write 0xd05fffc0 linux2 400000 then reset the device . it should be working.

GDM7243> loady 0xd05fffc0 921600 ## Ready for binary (ymodem) download to 0xD05FFFC0 at 921600 bps... CCCxyzModem - CRC mode, 1(SOH)/4096(STX)/0(CAN) packets, 5 retries ## Total Size = 0x00400000 = 4194304 Bytes GDM7243> nand erase.part linux

NAND erase.part: partsize: 0x400000
device 0 offset 0xa00000, size 0x400000
Erasing at 0xde0000 -- 100% complete.
OK
GDM7243> nand write 0xd05fffc0 linux 400000
argc : 5

NAND write: device 0 offset 0xa00000, size 0x400000
 4194304 bytes written: OK
GDM7243> bootm
Wrong Image Format for bootm command
ERROR: can't get kernel image!
GDM7243> nand erase.part linux2

NAND erase.part: partsize: 0x400000
device 0 offset 0xe00000, size 0x400000
Erasing at 0x11e0000 -- 100% complete.
OK
GDM7243> nand write 0xd05fffc0 linux2 400000
argc : 5

NAND write: device 0 offset 0xe00000, size 0x400000
 4194304 bytes written: OK
GDM7243> reset
resetting ...
bootdelay=5
bootargs (auto)
## Booting kernel from Legacy Image at d05fffc0 ...
   Image Name:   Linux-3.10.0-uc0
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2317840 Bytes = 2.2 MiB
   Load Address: d0600000
   Entry Point:  d0600000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
gipc-protocol address: d4880010
ipc config: 00000004
  router-device
s-ch_enabled: 0x10010001
s-ch_enabled: 0x10010001
s-ch_enabled: 0x10010001
ipc magic=0x40540103(12)
s-ch_enabled: 0x10010003

Thanks to 0xC0000022L for giving me the hint to look at the environnement.

Still the issue persist after the second reboot. if I reboot after typing these commands the device actually boots up normally but if i restart a second time the error will reappear again . still something to investigate on the problem.

update :

Second issue resolved by performing the linuxsave command and the linux2save environnement command before resetting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.