SB5100 Serial Cable Upgrade Written by cableguy69 Saturday, 10 November 2007

THIS TUTORIAL IS INTENDED FOR THEORETICAL USE ONLY, USE ON PRODUCTION SYSTEMS MAY VIOLATE YOUR ISP's TERMS OF SERVICE. THEORYSHARE TAKES NO RESPONSIBILITY FOR YOUR ACTIONS. THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. THIS SOFTWARE IS INTENDED FOR EDUCATIONAL USE ONLY AND MAY BE ILLEGAL IF USED IMPROPORLY. USERS ASSUME FULL RESPONSIBILITY FOR THEIR ACTIONS. How-to flash Sigma-X on rev3 and older using the serial cable on the SB5100 First off I want to state that this can break your modem! I'm going to assume you have a sb5100 with rev3 board or older with a serial connection and know how to use it. Note: It has been tested on rev3 and older, only using a MAX233CP serial cable. The Rev is printed on the bottom of the PBC board on the modem. You are going to need a terminal emulator, a tftp server, and a copy of sigma-x with the bootloader. I use Tera Term Pro for the terminal emulator and tftpd32 for the tftp server but it's up to you what you use. 1:Hook it all up, serial connection, ethernet ( set ip to 192.168.100.10, gateway to 192.168.100.1) and start the terminal emulator and the tftp server with the sigma-x and bootloader in the server directory. Go to Serial port setup in the terminal and set the

baud rate to 115200. 2:Start the modem and stop the boot by typing "p" (Enter '1', '2', or 'p' within 2 seconds or take default...) 3:Hit enter five times, you should see the boot menu now. - Board IP Address [192.168.100.1]: Board IP Mask [255.255.255.0]: Board IP Gateway [0.0.0.0]: Board MAC Address [00:10:18:ff:ff:ff]: Internal/External phy? (i/e)[i] 4:Type "e" then hit enter (Enter sector number:) 5:Type "8" then hit enter (Erase block 8 complete...) 6:Type "d" then hit enter (TFTP Get Selected) 7:Hit enter (Board TFTP Server IP Address [192.168.100.10]:)

8:Type "SB5100_SIGMA-X_1.05.bin" then hit enter (TFTP filename [vxram_sto_sb5100_271j_fat_5.bin]: SB5100_SIGMA-X_1.05.bin) 9:Type "y" then hit enter (Image does not have standard header. Do you wish to store it? [n] y) 10:Type "9" then hit enter (Enter sector to start store: 9) 11:Type "n" then hit enter (Store parameters to flash ? [n] n) 12:Type "d" then hit enter (TFTP Get Selected) 13:Hit enter (Board TFTP Server IP Address [192.168.100.10]:) 14:Type "TCNiSO_Bootloader_v2.5.91.bin" then hit enter (Enter TFTP filename [SB5100_SIGMA-X_1.05.bin]: TCNiSO_Bootloader_v2.5.91.bin) 15:Type "y" then hit enter (Image does not have standard header. Do you wish to store it? [n] y) 16:Type "0" then hit enter (Enter sector to start store: 0) 17:Type "n" then hit enter (Store parameters to flash ? [n] n) Done. Now you have to do is a hard reboot/unplug the power for a few seconds. Here is a log of it being done. It was in txt format so some of the info got wrapped around but its all there and should give you a good idea how things should go. Remember, this may very well be irreversible and one wrong step could mean a dead modem.

So far this method has been tested twice, once by me and once by Josey who logged it for me. Detected CPU .............. BCM3348A1 Ebi Initialized .....................000002020000001C Sdram Initialized.................... Icache Size: ....................2000 Icache Linesize:.................0010 Dcache Size: ....................2000 Dcache Linesize:.................0010 Sdram access OK...................... Compressed Bootloader detected....... ImageCSize: ...................0062D3 ImageLoc: ...................81F80000 Decompression Status: .......00000000 Dcompressed Image Size:......00011005 BSS Initialized...................... TMP Stack initialized................ Perm Stack initialized............... MemSize: ......................... 8M Flash detected @0xbe000000 Signature: 3348 Broadcom BootLoader Version: 2.1.4b Build Date: Jul 05 2002 Build Time: 13:55:24 Image 1 Program Header: Signature: 3348 Control: 0004 Major Rev: 0002 Minor Rev: 0000 Build Time: 2002/10/24 19:47:48 Z File Length: 956487 bytes Load Address: 80010000 Filename: SB5100-1.1.1.1-SCM01-NOSH.bin

HCS: 2e4d CRC: 09a777d4 HCS failed on Image 2 Program Header Enter '1', '2', or 'p' within 2 seconds or take default... . Board IP Address [192.168.100.1]: Board IP Mask [255.255.255.0]: Board IP Gateway [0.0.0.0]: Board MAC Address [00:10:18:ff:ff:ff]: Internal/External phy? (i/e)[i] Init EMAC, DMA, and MII PHY... Autonegotiation started, waiting for completion...Autonegotiation successful... MAC setup for FullDuplex Main Menu: ========== d) Download and PROGRAM g) Download and GO b) Boot from flash e) Erase Sector m) Set mode s) Store parameters i) Init ethernet r) Read memory w) Write memory Enter sector number:8 Erase block 8 complete... Main Menu: ========== d) Download and PROGRAM g) Download and GO b) Boot from flash e) Erase Sector m) Set mode s) Store parameters i) Init ethernet r) Read memory w) Write memory TFTP Get Selected Board TFTP Server IP Address [192.168.100.10]: Enter TFTP filename [vxram_sto_sb5100_271j_fat_5.bin]: SB5100_SIGMA-X_1.05.bin Free store: a0500000 Starting TFTP of SB5100_SIGMA-X_1.05.bin from 192.168.100.10 Getting SB5100_SIGMA-X_1.05.bin using octet mode ................................................................................ ................................................................................ ................................................................................ ................................................................................ ................................................................................ ................................................................................ . Tftp complete Received 985910 bytes HCS failed on Image 0 Program Header Image does not have standard header. Do you wish to store it? [n] y Programming 985910 bytes Flash Configuration Flash Base: be000000 Device size: [2097152] bytes, or [16] Mbit 2 erase regions

0 byte Write Buffer Enter sector to start store: 9 Stored 65536 bytesStored 131072 bytesStored 196608 bytesStored 262144 bytesStored 327680 bytesStored 393216 bytesStored 458752 bytesStored 524288 bytesStored 589824 bytesStored 655360 bytes Stored 720896 bytesStored 786432 bytesStored 851968 bytesStored 917504 bytesStored 983040 bytesStored 985910 bytes Verified 65536 bytesVerified 131072 bytesVerified 196608 bytesVerified 262144 bytesVerified 327680 bytesVerified 393216 bytesVerified 458752 bytesVerified 524288 bytesVerified 589824 bytesVerified 655360 bytesVerified 720896 bytesVerified

786432 bytesVerified 851968 bytesVerified 917504 bytesVerified 983040 bytesVerified 985910 b Store parameters to flash ? [n] n Main Menu: ========== d) Download and PROGRAM g) Download and GO b) Boot from flash e) Erase Sector m) Set mode s) Store parameters i) Init ethernet r) Read memory w) Write memory TFTP Get Selected Board TFTP Server IP Address [192.168.100.10]: Enter TFTP filename [SB5100_SIGMA-X_1.05.bin]: TCNiSO_Bootloader_v2.5.91.bin Free store: a0500000 Starting TFTP of TCNiSO_Bootloader_v2.5.91.bin from 192.168.100.10 Getting TCNiSO_Bootloader_v2.5.91.bin using octet mode ................. Tftp complete Received 32768 bytes HCS failed on Image 0 Program Header Image does not have standard header. Do you wish to store it? [n] y Programming 32768 bytes Flash Configuration Flash Base: be000000 Device size: [2097152] bytes, or [16] Mbit 2 erase regions 0 byte Write Buffer Enter sector to start store: 0 Stored 8192 bytesStored 16384 bytesStored 24576 bytesStored 32768 bytes Verified 8192 bytesVerified 16384 bytesVerified 24576 bytesVerified 32768 bytes Store parameters to flash ? [n] n Main Menu: ========== d) Download and PROGRAM g) Download and GO b) Boot from flash e) Erase Sector

m) Set mode s) Store parameters i) Init ethernet r) Read memory w) Write memory TCNiSO 5100 Bootstrap CPU = BCM3348A1 Ebi Initialized: 000002020000001C Sdram Initialized: [ OK ] CPU instruction cache size: 2000 CPU instruction cache line size: 0010 CPU data cache size: 2000 CPU data cache line size: 0010 Sdram access: [ OK ] TCNiSO Compressed bootloader detected Compressed bootloader size: 0062D3 Compressed Image location: 81F80000 Decompression Status: 00000000 Dcompressed Bootloader size: 00011008 BSS Initialized: [ OK ] TMP Stack initialized: [ OK ] Perm Stack initialized: [ OK ] MemSize: ......................... 8M Flash detected @0xbe000000 TCNiSO BootLoader v 2.5.91 LITE Build Date: Jan 26 2004 Image 1 Program Header: Location: 0xBEC20000 Signature: 3348 Control: 0000 Major Rev: 0002 Minor Rev: 0001 Build Time: 2005/3/31 07:09:05 Z File Length: 985818 bytes Load Address: 80500000 Filename: SIGMA-X-1.05.bin_decompressor.bin Image 2 Program Header: Location: 0xBEE00000 Firmware header Not Found! Press '1', '2', or 'm' within 2 seconds or take default... . . Bypassing CRC Verifiction on Image 1... Loading Image 1... Executing Image 1... TCNiSO FirmwareDecompressor v2.0.3 Detected Compressed Firmware..... Decompressing... Target Address: 0x80010000 ................... Decompressed length: 4981576 3348 TCNiSO SIGMA-X Version 1.05 usrRoot:usrNetInit: complete! SIGMA-X Version 1.05 No SIGMA config space found... Installing Default SIGMA Config space... Reclaming 1343 bytes 0x803da880 to 0x803dadbf Reclaming 5184 bytes 0x80450bd0 to 0x80452010 Reclaming 23315 bytes 0x80419fdc to 0x8041faef Reclaming 458 bytes 0x80010000 to 0x800101ca Reclaming 144 bytes 0x80010a98 to 0x80010b28

Reclaming 308 bytes 0x80010d74 to 0x80010ea8 Reclaming 140 bytes 0x80011194 to 0x80011220 Reclaming 176 bytes 0x80264180 to 0x80264230 Reclaming 48 bytes 0x802eace0 to 0x802ead10 Reclaming 180 bytes 0x8030ed10 to 0x8030edc4 Reclaming 92 bytes 0x80010794 to 0x800107f0 Reclaming 208 bytes 0x802630e0 to 0x802631b0 Reclaming 212 bytes 0x802eb150 to 0x802eb224 Reclaming 108 bytes 0x80306380 to 0x803063ec Reclaming 48 bytes 0x802ead14 to 0x802ead44 Reclaming 52 bytes 0x800108f8 to 0x8001092c Reclaming 348 bytes 0x80305150 to 0x803052ac TCNiSO SIGMA Symbol manager v1.0 Compact symbol table at 0x804B3B30 17708 bytes, type 5 VxWorks Symbol Table Address 0x807E4410 SIGMA Compact Symbol Table Address 0x804B3B38 Special thanks to Josey for the logs and testing.