[SOLVED] flashing NVRAM from U-Boot shell

Does it possible to flash NVRAM from U-Boot via the serial port? I know its possible from U-Boot to upload the firmware to router memory and install it. Here is an example, showing how to unbrick router with Serial Line Recovery, using HyperTerminal in Windows to transfer binary. Is it possible to use the same method for reflashing NVRAM by loading nvram backup from U-Boot via the serial port?(the host OS Windows).
Cable modem appears to have nvram corrupted. U-Boot 1.2.0 bootloader is working, I can connect to modem via serial interface, view boot process and upload firmware.

I dont know to which memory address to upload the nvram to.

loady 0x007b0000

What are the next steps after the upload is complete? (erase the NVRAM, then copy new, reset?)And what's target addresses in memory?

erase 0x007b0000 0x00800000
cp.b 0x00000000 0x007b0000 0x00050000
bootm 0x00000000

Flash memory structure, from U-Boot printenv:

Serial Flash [Bus:0 CS:0] : s25fl064a 8192KB, 128 sectors each  64KB
7 cmdlinepart partitions found on MTD device spansion
partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) }
partitions[1] = {.name = env1, .offset = 0x00020000,.size = 0x00010000 (64K) }
partitions[2] = {.name = env2, .offset = 0x00030000,.size = 0x00010000 (64K) }
partitions[3] = {.name = firmware_EH, .offset = 0x004a0000,.size = 0x002d0000 (2880K) }
partitions[4] = {.name = nvram, .offset = 0x007b0000,.size = 0x00050000 (320K) }
partitions[5] = {.name = UBFI1, .offset = 0x00040000,.size = 0x003b0000 (3776K) }
partitions[6] = {.name = UBFI2, .offset = 0x003f0000,.size = 0x003b0000 (3776K) }
Creating 7 MTD partitions on "spansion":
0x00000000-0x00020000 : "U-Boot"
0x00020000-0x00030000 : "env1"
0x00030000-0x00040000 : "env2"
0x004a0000-0x00770000 : "firmware_EH"
0x007b0000-0x00800000 : "nvram"
0x00040000-0x003f0000 : "UBFI1"
0x003f0000-0x007a0000 : "UBFI2"

FLASH memory information => flinfo

Bank # 1: Spansion Serial Flash FLASH_S25FL064A
  Size: 8 MB in 128 Sectors
  Sector Start Addresses:
    48000000 (RO) 48010000 (RO) 48020000 (RO) 48030000 (RO) 48040000
    48050000      48060000      48070000      48080000      48090000
    480A0000      480B0000      480C0000      480D0000      480E0000
    480F0000      48100000      48110000      48120000      48130000
    48140000      48150000      48160000      48170000      48180000
    48190000      481A0000      481B0000      481C0000      481D0000
    481E0000      481F0000      48200000      48210000      48220000
    48230000      48240000      48250000      48260000      48270000
    48280000      48290000      482A0000      482B0000      482C0000
    482D0000      482E0000      482F0000      48300000      48310000
    48320000      48330000      48340000      48350000      48360000
    48370000      48380000      48390000      483A0000      483B0000
    483C0000      483D0000      483E0000      483F0000      48400000
    48410000      48420000      48430000      48440000      48450000
    48460000      48470000      48480000      48490000      484A0000
    484B0000      484C0000      484D0000      484E0000      484F0000
    48500000      48510000      48520000      48530000      48540000
    48550000      48560000      48570000      48580000      48590000
    485A0000      485B0000      485C0000      485D0000      485E0000
    485F0000      48600000      48610000      48620000      48630000
    48640000      48650000      48660000      48670000      48680000
    48690000      486A0000      486B0000      486C0000      486D0000
    486E0000      486F0000      48700000      48710000      48720000
    48730000      48740000      48750000      48760000      48770000
    48780000      48790000      487A0000      487B0000      487C0000
    487D0000      487E0000      487F0000

I dont think the command 'erase' writes into NVRAM....

Look for an embedded app meant for writing data to nvram....Or you can write it by your own..
(*addr) = 0x0000;

Use tftp to get the nvram content into the RAM (any non-active empty space ex: 0x200000) ...Then use:
cp.b <copied_RAM_addr> <NVRAM physical address: get it from mapping table in u-boot> <size of content>


I think this should work...

Originally Posted by SIG_SEGV I dont think the command 'erase' writes into NVRAM.... Look for an embedded app meant for writing data to nvram....Or you can write it by your own.. (*addr) = 0x0000; Use tftp to get the nvram content into the RAM (any non-active empty space ex: 0x200000) ...Then use: cp.b <copied_RAM_addr> <NVRAM physical address: get it from mapping table in u-boot> <size of content> I think this should work...

I mean with command 'erase' old data should be erased first (as writing to flash memory may fail when the target area has not been erased). I don't have embedded app, I mean use U-Boot commands.
I want try Hyperterminal to transfer nvram content into the RAM.

For erase command, is this correct [start] [end] addresses for "nvram"?

erase 0x007b0000 0x00800000

What specifically is the non-active empty space address in my case?

NVRAM physical address from mapping table in u-boot: is it 0x007b0000?

How to get size of content bytes, NVRAM.bin in proper format?

I mean with command 'erase' old data should be erased first (as writing to flash memory may fail when the target area has not been erased). I don't have embedded app, I mean use U-Boot commands. I want try Hyperterminal to transfer nvram content into the RAM. For erase command, is this correct [start] [end] addresses for "nvram"? erase 0x007b0000 0x00800000

erase cmd is meant for erasing flash (NOR/NAND) and erase basincally mean wrirting 0xfffff...
So after u execute erase with your NVRAM addr, it internally checks whether those addr come in constraint of addr mapped under flash area....Since nvram addr are not flash addr...it ignores writing to ur specified area....

so ur cmd
erase 0x007b0000 0x00800000
doesnt work hopefully....

Jst write your own app wth instrs as below:

for loop with nvram constraint addr
{
*(volatile unsigned long *)addr = 0xffffffff (or) 0x0000;
incr add wth 4;
}

What specifically is the non-active empty space address in my case?

find out what RAM addr does your bootloader/kernel uploader app uses in boot loader env.
Coz, these cmds use empty space in RAM to copy data from tftp to RAM and then to flash via
cp.b/w/l

Normally uboot resides at bottom region of RAM... So, i think you can use top area of ram to copy nvram image/content.

NVRAM physical address from mapping table in u-boot: is it 0x007b0000?

Yes it is: You can even check it in bootloader/include/configs/processor-name_configs.h

You should find all the interface mapping here.......

How to get size of content bytes, NVRAM.bin in proper format?

du -sh <file_name>
or
ls -l <file_name>

Ohh, I have no firmware source code at all, so can't check bootloader/include/configs/processor-name_configs. U-boot have the following commands. Host OS is Windows as well.

When doing firmware update from TFTP server, the firmware Load address is 0x80000100: can it be used as non-active empty space for loading nvram?

Ohh, I have no firmware source code at all, so can't check bootloader/include/configs/processor-name_configs. I can only use this U-boot commands available. Host OS is Windows as well. So, nvram does not allows writing to specified area. But when the target area hasn't been erased, or if its write-protected, writing to flash memory may fail. Is there a solution with U-Boot then? I just re-read the guide about Flashing from U-boot, there are mentioned commands 'erase the NVRAM'. Perhaps I'm missing something.

You can use "mw" command to write/erase NVRAM area from the commands link you hve given ...
ex: mw.l <addr> <data> <Length of memory/4>

When doing firmware update from TFTP server, the firmware Load address is 0x80000100: can it be used as non-active empty space for loading nvram?

Yes you can use same addr....for copying NVRAM.bin to RAM (from tftp command) and then copy that image from RAM ( 0x80000100) to NVRAM physical area (0x007b0000) using cp.b cmd & specifying the size of image....

Better hve a linux OS....Coz i dont have idea of tftp in windows...If you know you can carry on!!!

Thanks for tips. I found the sequence of commands U-boot use for upgrades. Based on this it should be:

tftp 0x80000100 nvram.bin 

protect off 0x007b0000 +0x00050000
erase 0x007b0000 +0x00050000 
sleep 3
cp.b 0x80000100 0x007b0000 0x00050000
protect on 0x007b0000 +0x00050000

I tried commands, but got error 'bad address format' (I tried also another representation of addresses):

=> tftp 0x80000100 NVRAM.bin
TFTP from server 192.168.100.2; our IP address is 192.168.100.1
Filename 'NVRAM.bin'.
Load address: 0x80000100
Loading: T #################################################################
done
Bytes transferred = 327680 (50000 hex)
=> protect off 0x007b0000 +0x00050000
Error: end address (0x007fffff) not in flash!
Bad address format
=> protect off 0x7b0000 +0x50000
Usage:
protect - enable or disable FLASH write protection

That's why i told you erase doesn't work for you since NVRAM area address you are specifying is not under flash region.

erase only works for flash area...

Try writing to NVRAM using

mw.l

as i mentioned above

But I tried unprotect nvram area, not erase. It doesn't allow unprotect?

Use mw.l on NVRAM addresses directly... and try


Don not use protect off/on

not sure the second value (any data?) and third argument (327680/4 = 81920)?

mw.l 0x007b0000 0x44400000  81920

why any data....
better give a 0xffffffff or 0x00000000 for uniform pattern as a function of erase.

the lenght of memory(1/4) in decimal (81920) or hex (0x00014000)?

give a hex 0x....

tried, nothing has been updated after command

=> mw.l 0x007b0000 0xffffffff 0x00014000
=> cp.b 0x80000100 0x007b0000 0x00050000
=>