¶ PSPBoot
PSPboot is the successor of adam2 but only slightly backwards compatible with it. See Adam2_versus_PSP_bootloader. It is the bootloader used e.g. on the Linksys WAG354G, WRTP54G and ADSL2MUE as well as the https://oldwiki.archive.openwrt.org/toh/netgear/sc101.
¶ User Guide
Here is the user guide of PSPBoot version 1.2:
What the guide is not saying is that the "boot" command supports placing a kernel command line. Every argument after "boot" gets passed.
¶ Startup sequence
free space start: 0xb0020000
free space end: 0xb0400000
Minimal POST completed... Success.
Last reset cause: Hardware reset (Power-on reset)
PSPBoot1.2 rev: 0.22.17
(c) Copyright 2002-2004 Texas Instruments, Inc. All Rights Reserved.
FlashType:
mac_init(): Find mac [00:13:10:F9:E2:CE] in location 0
Find mac [00:13:10:F9:E2:CE] in location 0
mac_value: 00:13:10:F9:E2:CE
Press ESC for monitor... 1
(psbl)
¶ Available commands
(psbl) help
reboot version info fa
printenv setenv unsetenv defragenv
fmt boot dm oclk
help
¶ Information on commands
(psbl) help reboot
reboot: Warm reboot the system
(psbl) help version
version: Dump build information and optional modules supported
(psbl) help info
info: Gives SoC specific information.
(psbl) help fa
fa: Displays flash allocation information
(psbl) help printenv
printenv: Print all configured system environment variables.
Usage: printenv [envlist]
(psbl) help setenv
setenv: Set a system environment variable
(psbl) help unsetenv
unsetenv: Delete a system environment variable
(psbl) help defragenv
defragenv: Defragment the system environment space
(psbl) help fmt
fmt: Erase a given area on Flash memory
Usage: fmt -a
fmt
(psbl) help boot
boot: Boot the OS image according to settings in 'BOOTCFG'
(psbl) help dm
dm: Dump memory from a given address
Usage: dm [ [num words]]
(psbl) help oclk
oclk: Configure/Dump the frequencies for CPU and System
¶ Version
(psbl) version
PSPBoot 1.2.1.5
Compiled gcc rev: 2.95.3 20010315 (release/MontaVista) [May 17 2005 18:36:51]
Built for AR7WRD board in Little Endian mode.
Optional modules included (+) or not (-):
+tibinary -elf -gzip -ffs -tftp -ftp -dhcp -pcapp
(psbl) boot
boot order: f
boot file: mtd1
¶ Info
(psbl) info
CHIP ID: TNETD73XX (0x5), REV: 0x21
MIPS Processor : 4KEc rev: 2.2.0
Cache mode : write-back, write-allocate.
Instruction cache: Associativity: 4, Line size: 16, Total size: 16KB
Data cache : Associativity: 4, Line size: 16, Total size: 16KB
Last reset cause: Software reset (memory controller also reset)
EMIF is running at the same speed of the processor.
Processor running in little endian mode.
Processor clock is asynchronous to internal bus clock.
¶ Environment
(psbl) printenv
bootloaderVersion 1.2.1.5
ProductID AR7WRD
HWRevision Unknown
SerialNumber none
IPA 192.168.1.1
MAC_PORT 1
SwRev 0.22.17
MEMSZ 0x1000000
FLASHSZ 0x400000
MODETTY0 38400,n,8,1,hw
MODETTY1 38400,n,8,1,hw
CPUFREQ 150000000
SYSFREQ 125000000
PROMPT (psbl)
mtd0 0x900e0000,0x903f0000
mtd1 0x90020000,0x903f0000
mtd2 0x90000000,0x90020000
mtd3 0x903f0000,0x90400000
mtd4 0x90020000,0x903f0000
pair_selection 0
HWA_0 00:13:10:F9:E2:CE
BOOTCFG m:f:mtd1
¶ Flash Allocation
(psbl) fa
Current Flash Allocation:
section : PSBL, base : 0xb0000000, size : 51616 bytes
section : ENV, base : 0xb0010000, size : 65536 bytes
unallocated Space Start: 0xb0020000
unallocated Space End : 0xb0400000
¶ TFTP flashing
PSPBoot accepts a TFTP upload of a new firmware while beeing in command line mode or during the boot wait. The boot wait is 3 seconds by default. This creates a very narrow windows for uploading. TFTP is possible at about 2 seconds after powerup for about 1 second.
With a serial console attached, it is also possible to stop the boot process by pressing ESC. The bootloader will then continue to accept uploads. The uploaded file has to be called upgrade_code.bin .
Without serial console, this procedure was successful on wag354g:
*unplug the router
*set static a configuration to the nic, with ip 192.168.1.xx(2-254) and netmask 255.255.255.0
*launch tftp:
tftp> verbose (for debugging purpose)
tftp> trace ( " " " )
tftp> rexmt 1
tftp> timeout 5
tftp> binary
tftp> connect 192.168.1.1
- plug the power to the router
- wait until the led switch turns on, and immediately enter:
<!-- -->
tftp> put upgrade_code.bin
*alternatively, just dont wait to press enter, and do some try till the right timing is guessed.
If transfer starts, the tftp output is like this:
....
sent DATA
received ACK
...
- wait until router reboots