Common Firmware Environment - Revision history

Michael: Correct Linksys casing

2009-06-28T23:31:36Z

Correct Linksys casing

Amallen at 22:08, 11 June 2008

2008-06-11T22:08:23Z

Agember: /* Getting into CFE */

2007-07-11T21:08:38Z

Getting into CFE

Agember at 21:07, 11 July 2007

2007-07-11T21:07:32Z

Agember at 21:25, 21 June 2007

2007-06-21T21:25:57Z

Justin: /* Getting into CFE */

2006-09-08T18:20:03Z

Getting into CFE

Justin at 18:17, 8 September 2006

2006-09-08T18:17:59Z

Phinze: Starting with some basics

2006-09-01T04:27:11Z

Starting with some basics

New page

The Common Firmware Environment (CFE) is the firmware developed by Broadcom for the BCM947xx SoC platform (among others). It is the first code that runs when the router boots and performs functions similar to Apple's Open Firmware:

* Initializes the system
* Sets up a basic environment in which code can run
* Optionally provides a command line interface non-standard usage
* Loads and executes a kernel image (expecting to be jettisoned shortly thereafter)

So, in normal operation, a user will not see CFE working at all; it will load the LinkSys kernel and send it on its merry way without hesitation. For us, however, CFE is crucial, because it provides us with the ability to load an image over the network using TFTP.

We have access to two major documents covering CFE, the reference manual, and the functional specification. Much of the content in these two documents overlaps.

@@ Line 22: / Line 22: @@
 == Command Line Interface ==
-The CFE Command Line Interface (CLI) is a very simple "shell-like" command prompt.  It had a few environmental variables and minimal functionality.  However, it is complex enough power to load a boot image over the network and begin executing code.  The User interface is described on page 19 of 145 in the [[:Image:Cfe-broadcom.pdf|CFE documentation]].
+The CFE Command Line Interface (CLI) is a very simple "shell-like" command prompt.  It has a few environmental variables and minimal functionality.  However, it is complex enough power to load a boot image over the network and begin executing code.  The User interface is described on page 19 of 145 in the [[:Image:Cfe-broadcom.pdf|CFE documentation]].
 To get the to the CLI, you can use either the power-on method or load OpenWRT and type reboot.  The CFE boot screen looks like:

@@ Line 18: / Line 18: @@
 Once you have that set up and you've [[How_to_connect|connected]] to the router, just type "reboot" (assuming [[OpenWRT]] is installed, it may be different for other firmwares) to reboot the router.  This can also be done by power-cycling the router.  As it's booting up, send a continuous stream of Ctrl+C characters to cancel booting and you'll be entered right into CFE.
-From there, you can prod around CFE's features or load your own kernel using the [[CFE_Command_Line_Interface|command line interface]].
+From there, you can prod around CFE's features or load your own kernel using the command line interface.
 == Command Line Interface ==

← Older revision		Revision as of 21:07, 11 July 2007
Line 19:		Line 19:

	From there, you can prod around CFE's features or load your own kernel using the [[CFE_Command_Line_Interface\|command line interface]].		From there, you can prod around CFE's features or load your own kernel using the [[CFE_Command_Line_Interface\|command line interface]].
		+
		+	== Command Line Interface ==
		+
		+	The CFE Command Line Interface (CLI) is a very simple "shell-like" command prompt. It had a few environmental variables and minimal functionality. However, it is complex enough power to load a boot image over the network and begin executing code. The User interface is described on page 19 of 145 in the [[:Image:Cfe-broadcom.pdf\|CFE documentation]].
		+
		+	To get the to the CLI, you can use either the power-on method or load OpenWRT and type reboot. The CFE boot screen looks like:
		+	<pre>
		+	CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
		+	Build Date: Fri Sep 23 17:46:42 CST 2005 (root@localhost.localdomain)
		+	Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
		+
		+	Initializing Arena
		+	Initializing Devices.
		+
		+	No DPN
		+	et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.90.37.0
		+	CPU type 0x29008: 200MHz
		+	Total memory: 16384 KBytes
		+
		+	Total memory used by CFE: 0x80300000 - 0x803A39C0 (670144)
		+	Initialized Data: 0x803398D0 - 0x8033BFE0 (10000)
		+	BSS Area: 0x8033BFE0 - 0x8033D9C0 (6624)
		+	Local Heap: 0x8033D9C0 - 0x803A19C0 (409600)
		+	Stack Area: 0x803A19C0 - 0x803A39C0 (8192)
		+	Text (code) segment: 0x80300000 - 0x803398D0 (235728)
		+	Boot area (physical): 0x003A4000 - 0x003E4000
		+	Relocation Factor: I:00000000 - D:00000000
		+
		+	Boot version: v3.7
		+	The boot is CFE
		+
		+	mac_init(): Find mac [00:16:B6:28:7D:4F] in location 0
		+	Nothing...
		+
		+	eou_key_init(): Find key pair in location 0
		+	The eou device id is same
		+	The eou public key is same
		+	The eou private key is same
		+	Device eth0: hwaddr 00-16-B6-28-7D-4F, ipaddr 192.168.1.1, mask 255.255.255.0
		+	gateway not set, nameserver not set
		+	Reading :: Failed.: Interrupted
		+	CFE> ^C
		+	CFE>
		+	</pre>
		+	Of course, items like the hwaddr will be different from router to router.
		+
		+	Once you have a command prompt, you can type <tt>help</tt> and get a listing of commands available:
		+	<pre>
		+	CFE> help
		+	Available commands:
		+
		+	rndis Broadcom USB RNDIS utility.
		+	et Broadcom Ethernet utility.
		+	modify Modify flash data.
		+	nvram NVRAM utility.
		+	reboot Reboot.
		+	flash Update a flash memory device
		+	memtest Test memory.
		+	f Fill contents of memory.
		+	e Modify contents of memory.
		+	d Dump memory.
		+	u Disassemble instructions.
		+	autoboot Automatic system bootstrap.
		+	batch Load a batch file into memory and execute it
		+	go Verify and boot OS image.
		+	boot Load an executable file into memory and execute it
		+	load Load an executable file into memory without executing it
		+	save Save a region of memory to a remote file via TFTP
		+	ping Ping a remote IP host.
		+	arp Display or modify the ARP Table
		+	ifconfig Configure the Ethernet interface
		+	show devices Display information about the installed devices.
		+	unsetenv Delete an environment variable.
		+	printenv Display the environment variables
		+	setenv Set an environment variable.
		+	help Obtain help for CFE commands
		+
		+	For more information about a command, enter 'help command-name'
		+	*** command status = 0
		+	CFE>
		+	</pre>
		+
		+	A command status of 0 is always a good thing, other command statuses are errors.
		+
		+	The next two commands are very important to booting a custon kernel image: <tt>ifconfig</tt> and <tt>boot</tt>.
		+
		+	<tt>ifconfig</tt> is just the Linux counterpart, it will set up the specified interface. For our router, we have the switch portion of the router connected to a xinu server (which is simply a TFTP and DHCP server). From there we type <tt>ifconfig -auto eth0</tt> which will ask the xinu server for an IP address and set up the router.
		+	<pre>
		+	CFE> ifconfig -auto eth0 � �
		+	Device eth0: hwaddr 00-16-B6-28-7D-4F, ipaddr 192.168.5.2, mask 255.255.254.0
		+	gateway 192.168.5.220, nameserver 192.168.5.220, domain xinu.mu.edu
		+	*** command status = 0
		+	CFE>
		+	</pre>
		+
		+	We now have an IP and can transfer our boot image.
		+
		+	For our purposes, we name our boot images after the unit on which it will load (supervoc is our demo router).
		+	<pre>
		+	CFE> boot -elf 192.168.5.220:supervoc.boot
		+	Loader:elf Filesys:tftp Dev:eth0 File:192.168.5.220:supervoc.boot Options:(null)
		+	Loading: 0x80001000/3145 0x80001c49/23 Entry at 0x80001000
		+	Closing network.
		+	Starting program at 0x80001000
		+	</pre>
		+
		+	Let's walk through these lines:
		+	boot -elf 192.168.5.220:supervoc.boot
		+	This will begin booting the <tt>supervoc.boot</tt> kernel that is located at 192.168.5.220 (our xinu server and, no, name resolution does not work).
		+	Loader:elf Filesys:tftp Dev:eth0 File:192.168.5.220:supervoc.boot Options:(null)
		+	A fairly explainitory line stating the file type it is loading (<tt>elf</tt>), the file system to be used (<tt>tftp</tt>), the device which it is using to transfer the image (<tt>eth0</tt>), and where that image is from (<tt>192.168.5.220:supervoc.boot</tt>).
		+	Loading: 0x80001000/3145 0x80001c49/23 Entry at 0x80001000
		+	This is also a line of explanation, the first portion (<tt>0x80001000/3145</tt>) tells us the 'physical' address of where we begin loading our image and the size of the image (in bytes). Next is the address of the end of the image (<tt>0x80001c49/23</tt>) and (I believe) the amount of padding to make the image size base 16. The last part is the address which CFE will branch to upon completion of upload, this is the start of your kernel.
		+	Closing network.
		+	Starting program at 0x80001000
		+	The closes the network and begins execution the code at address 0x8000100. Any lines of text outputted after this are from your boot image (unless CFE throws an exception and shows a memory dump).

@@ Line 1: / Line 1: @@
-=== About ===
+== About ==
 The Common Firmware Environment (CFE) is the firmware developed by Broadcom for the BCM947xx SoC platform (among others).  It is the first code that runs when the router boots and performs functions similar to Apple's Open Firmware:
@@ Line 12: / Line 12: @@
 We have access to two major documents covering CFE, the reference manual, and the functional specification.  Much of the content in these two documents overlaps.
-=== Getting into CFE ===
+== Getting into CFE ==
 To get into CFE, it will be very helpful to enable "boot wait" from the Administration Tab under the router's Web GUI.  This will cause the router to wait on startup for a signal to stop booting into the firmware and enter CFE.

@@ Line 14: / Line 14: @@
 === Getting into CFE ===
-To get into CFE, it will be very helpful to enable "boot wait" from the Administration Tab under the router's Web GUI.  This will cause the router to wait on startup for a signal to stop booting the loaded kernel and enter CFE.
+To get into CFE, it will be very helpful to enable "boot wait" from the Administration Tab under the router's Web GUI.  This will cause the router to wait on startup for a signal to stop booting into the firmware and enter CFE.
 Once you have that set up and you've [[How_to_connect|connected]] to the router, just type "reboot" (assuming [[OpenWRT]] is installed, it may be different for other firmwares) to reboot the router.  This can also be done by power-cycling the router.  As it's booting up, send a continuous stream of Ctrl+C characters to cancel booting and you'll be entered right into CFE.
 From there, you can prod around CFE's features or load your own kernel using the [[CFE_Command_Line_Interface|command line interface]].

@@ Line 8: / Line 8: @@
 * Loads and executes a kernel image (expecting to be jettisoned shortly thereafter)
-So, in normal operation, a user will not see CFE working at all; it will load the LinkSys kernel and send it on its merry way without hesitation.  For us, however, CFE is crucial, because it provides us with the ability to load an image over the network using TFTP.
+So, in normal operation, a user will not see CFE working at all; it will load the Linksys kernel and send it on its merry way without hesitation.  For us, however, CFE is crucial, because it provides us with the ability to load an image over the network using TFTP.
 We have access to two major documents covering CFE, the reference manual, and the functional specification.  Much of the content in these two documents overlaps.

← Older revision		Revision as of 18:17, 8 September 2006
Line 1:		Line 1:
		+	=== About ===
		+
	The Common Firmware Environment (CFE) is the firmware developed by Broadcom for the BCM947xx SoC platform (among others). It is the first code that runs when the router boots and performs functions similar to Apple's Open Firmware:		The Common Firmware Environment (CFE) is the firmware developed by Broadcom for the BCM947xx SoC platform (among others). It is the first code that runs when the router boots and performs functions similar to Apple's Open Firmware:

Line 9:		Line 11:

	We have access to two major documents covering CFE, the reference manual, and the functional specification. Much of the content in these two documents overlaps.		We have access to two major documents covering CFE, the reference manual, and the functional specification. Much of the content in these two documents overlaps.
		+
		+	=== Getting into CFE ===
		+
		+	To get into CFE, it will be very helpful to enable "boot wait" from the Administration Tab under the router's Web GUI. This will cause the router to wait on startup for a signal to stop booting the loaded kernel and enter CFE.
		+
		+	Once you have that set up and you've [[How_to_connect\|connected]] to the router, just type "reboot" (assuming [[OpenWRT]] is installed, it may be different for other firmwares) to reboot the router. This can also be done by power-cycling the router. As it's booting up, send a continuous stream of Ctrl+C characters to cancel booting and you'll be entered right into CFE.
		+
		+	From there, you can prod around CFE's features or load your own kernel using the [[CFE_Command_Line_Interface\|command line interface]].