Assistance Please! I need CFE for Netgear R8000P X6S AC4000

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Author Message
routerhacker
DD-WRT Novice


Joined: 20 Jul 2018
Posts: 34

PostPosted: Fri Oct 26, 2018 21:34    Post subject: Assistance Please! I need CFE for Netgear R8000P X6S AC4000 Reply with quote
I have a Netgear R8000P here and want to attempt to ressurect it via JTAG. It seems the CFE is corrupt so that bootloader doesn't load and run properly. The "rom based" 1st stage bootloader can show this via serial (shown below) so if I can get a copy of the CFE somewhere for this router, I plan on tapping into JTAG (I have written many jtag software programs before) once I have traced the proper pinouts.

The CFE I need equates to this one:
R8000P Platform Boot Code V1.0.8
CFE version 1.0.38-161.122 for BCM94908 (64bit,SP,LE)

Thanks for anyone willing to help. If I can get JTAG going, then there is no concern of bricks or devs on this site then ultimately supporting this router.

An here is the serial output before it just stops due to roasted bootloader:

----
BTRM
V1.6
CPU0
L1CD
MMUI
MMU7
DATA
ZBBS
MAIN
OTP?
OTPP
USBT
NAND
IMG?
IMGL
UHD?
UHDP
RLO?
RLOP
UBI?
UBIP
PASS
----
HELO
5.0202HNDrc7-1.0.38-161.122
CPU0
L1CD
MMUI
MMU>
CODE
ZBBS
MAIN
NVRAM memcfg 0x1427
MCB chksum 0xa89ec7d9, config 0x1427

MemsysInit lpf0_generic_aarch64 1.3.0.1 20150910
DDR3
900017E8 80018000 8001A000 00000000 00000000 0050371A
MCB rev=0x00040301 Ref ID=0x0371A Sub Bld=0x005
Dram Timing 11-11-11

DDR3-1600 CL11 total 512MB 1 16bits part[s] %1 SSC

Add/Ctl Alignment
no adjustment

ZQ Cal LP PHY
R in Ohm
P: Finger=0x2D0 Term=0x78 Drv=0x2A
N: Finger=0x2D0 Term=0x78 Drv=0x2A

PLL Ref(Hz)=0x02FAF080 UI STEPS=0x039
DDR CLK(MHz)=0x31B WL CLK dly(ps)=0x0C8 bitT(ps)=0x274 VDLsize(fs)=0x2B09 CLK_VDL=0x01A

SHMOO 28nm
8001A000 80018800 00000000 00020000 00000000

Shmoo WL

One UI Steps : 0x44

auto-clk result = 00B (filter=0C steps)
initial CLK shift = 01A
final CLK shift = 00B

00000000001111111111222222222233333333334444444444555555555566666666
01234567890123456789012345678901234567890123456789012345678901234567
00 S---------------X+++++++++++++++++++++++++++++++++++++++++++++++++++
01 S-----------------X+++++++++++++++++++++++++++++++++++++++++++++++++

Shmoo RD En
FORCED WR ODT = 0x18001800
DQSN DRIVE PAD CONTROL (from) (to)
B0 00031A31 00079A31
B1 00031A31 00079A31
B0 RISE UI=1 VDL=1A PICK UI=2 VDL=1A
B1 RISE UI=1 VDL=0F PICK UI=2 VDL=0F
00000000001111111111222222222233333333334444444444555555555566666666
01234567890123456789012345678901234567890123456789012345678901234567
00 --S-----------------------X+++++++++++++++++++++++++++++++++++++++++
01 --S------------X++++++++++++++++++++++++++++++++++++++++++++++++++++

Shmoo RD DQ NP
DQS :
B0 VDL=3A ok
B1 VDL=39 ok
00000000001111111111222222222233333333334444444444555555555566666666
01234567890123456789012345678901234567890123456789012345678901234567
00 -++++++++++++++++++++++++X+++++++++++++++++++++++++-----------------
01 -----++++++++++++++++++++++++X++++++++++++++++++++++++--------------
02 --++++++++++++++++++++++++X+++++++++++++++++++++++++----------------
03 --------+++++++++++++++++++++++X++++++++++++++++++++++++------------
04 ----++++++++++++++++++++++++X+++++++++++++++++++++++++--------------
05 -------+++++++++++++++++++++++++X+++++++++++++++++++++++++----------
06 -+++++++++++++++++++++++++X++++++++++++++++++++++++++---------------
07 ----------+++++++++++++++++++++++X++++++++++++++++++++++++----------
08 ---++++++++++++++++++++++++X+++++++++++++++++++++++++---------------
09 --+++++++++++++++++++++++++X+++++++++++++++++++++++++---------------
10 ----+++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
11 -+++++++++++++++++++++++++X++++++++++++++++++++++++++---------------
12 -----+++++++++++++++++++++++++X++++++++++++++++++++++++++-----------
13 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++--------------
14 -----++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
15 ------++++++++++++++++++++++++X++++++++++++++++++++++++-------------

Shmoo RD DQ P
00000000001111111111222222222233333333334444444444555555555566666666
01234567890123456789012345678901234567890123456789012345678901234567
00 -+++++++++++++++++++++++++X+++++++++++++++++++++++++----------------
01 -----++++++++++++++++++++++++X++++++++++++++++++++++++--------------
02 --++++++++++++++++++++++++X+++++++++++++++++++++++++----------------
03 -------++++++++++++++++++++++++X+++++++++++++++++++++++++-----------
04 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++--------------
05 ------+++++++++++++++++++++++++X++++++++++++++++++++++++++----------
06 --+++++++++++++++++++++++++X++++++++++++++++++++++++++--------------
07 --------+++++++++++++++++++++++++X+++++++++++++++++++++++++---------
08 ---++++++++++++++++++++++++X++++++++++++++++++++++++----------------
09 --++++++++++++++++++++++++X+++++++++++++++++++++++++----------------
10 -----++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
11 -+++++++++++++++++++++++++X++++++++++++++++++++++++++---------------
12 -----++++++++++++++++++++++++++X++++++++++++++++++++++++++----------
13 ---+++++++++++++++++++++++++X++++++++++++++++++++++++++-------------
14 -----+++++++++++++++++++++++++X+++++++++++++++++++++++++------------
15 -----++++++++++++++++++++++++X+++++++++++++++++++++++++-------------

Shmoo RD DQ N
00000000001111111111222222222233333333334444444444555555555566666666
01234567890123456789012345678901234567890123456789012345678901234567
00 -++++++++++++++++++++++++X+++++++++++++++++++++++++-----------------
01 ------+++++++++++++++++++++++X++++++++++++++++++++++++--------------
02 --+++++++++++++++++++++++++X+++++++++++++++++++++++++---------------
03 -------+++++++++++++++++++++++++X+++++++++++++++++++++++++----------
04 ----++++++++++++++++++++++++X+++++++++++++++++++++++++--------------
05 -------+++++++++++++++++++++++++X+++++++++++++++++++++++++----------
06 -+++++++++++++++++++++++++X++++++++++++++++++++++++++---------------
07 ----------+++++++++++++++++++++++X++++++++++++++++++++++++----------
08 --+++++++++++++++++++++++++X+++++++++++++++++++++++++---------------
09 --+++++++++++++++++++++++++X+++++++++++++++++++++++++---------------
10 ----+++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
11 --+++++++++++++++++++++++++X++++++++++++++++++++++++++--------------
12 -----+++++++++++++++++++++++++X++++++++++++++++++++++++++-----------
13 ---+++++++++++++++++++++++++X++++++++++++++++++++++++++-------------
14 ---+++++++++++++++++++++++++X++++++++++++++++++++++++++-------------
15 ------++++++++++++++++++++++++X+++++++++++++++++++++++++------------

RD DQS adjustments :
BL0: Start: 0x39 Final: 0x3A
BL1: Start: 0x39 Final: 0x39

Shmoo WR DQ
00000000001111111111222222222233333333334444444444555555555566666666
01234567890123456789012345678901234567890123456789012345678901234567
00 --++++++++++++++++++++++++X++++++++++++++++++++++++-----------------
01 ----+++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
02 --+++++++++++++++++++++++++X+++++++++++++++++++++++++---------------
03 ------+++++++++++++++++++++++++X++++++++++++++++++++++++++----------
04 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++--------------
05 ------+++++++++++++++++++++++++X++++++++++++++++++++++++++----------
06 -+++++++++++++++++++++++++X+++++++++++++++++++++++++----------------
07 -------+++++++++++++++++++++++++X+++++++++++++++++++++++++----------
08 ---++++++++++++++++++++++++X++++++++++++++++++++++++----------------
09 ---+++++++++++++++++++++++++X++++++++++++++++++++++++++-------------
10 ----++++++++++++++++++++++++X+++++++++++++++++++++++++--------------
11 --++++++++++++++++++++++++++X++++++++++++++++++++++++++-------------
12 ---++++++++++++++++++++++++++X++++++++++++++++++++++++++------------
13 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++--------------
14 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++--------------
15 -----++++++++++++++++++++++++++X++++++++++++++++++++++++++----------

Shmoo WR DM
WR DM
00000000001111111111222222222233333333334444444444555555555566666666
01234567890123456789012345678901234567890123456789012345678901234567
00 ----+++++++++++++++++++++++++++X++++++++++++++++++++++++++++--------
01 -+++++++++++++++++++++++++++X++++++++++++++++++++++++++++-----------
DDR test done successfully
FPS0
----
PAR0
UBI#
FFFF
NAN9
----
PAR1
UBI#
FFFF
NAN9
----
TRY0
NAN3
TRY0
NAN3
DIE0

<<<<<<< AND THIS IS WHERE THE CFE WOULD NORMALLLY START IF FOUND/NOT CORRUPT >>>>>>>
Sponsor
routerhacker
DD-WRT Novice


Joined: 20 Jul 2018
Posts: 34

PostPosted: Sat Oct 27, 2018 16:27    Post subject: Reply with quote
Anyone care to make a guess on JTAG pins on this board?


Here are more pictures:
http://koolshare.cn/thread-120057-1-1.html
routerhacker
DD-WRT Novice


Joined: 20 Jul 2018
Posts: 34

PostPosted: Sun Oct 28, 2018 21:27    Post subject: Reply with quote
So I found three "CFE" files in the source tree:

-rwxr-xr-x@ 1 user staff 77464 May 15 2017 cfe4908rom.bin*
-rwxr-xr-x@ 1 user staff 358548 May 15 2017 cfe4908ram.bin*
-rwxr-xr-x@ 1 user staff 129568 May 15 2017 cfe4908.bin*

A little puzzling, I assume the one flashed to NAND is either the cfe4908rom.bin or the cfe4908.bin one. Is that correct?

I am assuming the cfe4908ram.bin is probably more for dynamically loading during development as it seems to give many more options by looking at a hexdump.

Is that about right?
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7209
Location: Columbus, Ohio

PostPosted: Sun Oct 28, 2018 22:47    Post subject: Reply with quote
Smaller pictures.
_________________
I am far from a guru, I'm barely a novice.
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum