TcBoot

TcBoot is a minimalist bootloader for EcoNet devices derived from TrendChip's TC3262.

It is unfortunately also something that is often patched and modified by vendors, so its behavior is not always the same. We describe the common behavior found on many devices here.

You can stop the bootloader from UART by pressing enter in the first seconds of device startup, it will leave you with a command prompt bldr>.

Press any key in 3 secs to enter boot command mode.
..............
bldr>

• Flashing: TFTP or XMODEM tclinux.trx, then flash <flash addr> 80020000 <file length hex>
• Debricking: TFTP or XMODEM initramfs-kernel.bin, then jump 80020000
• Password: If unsure, try telecomadmin / nE7jA%5m

• https://github.com/cjdelisle/EN751221-Linux26/blob/master/tclinux_phoenix/bootrom/ Reference source code
• https://econet-linux.pkt.wiki/en/bootloader

If it always boots the factory firmware, that just means you need to switch the OS, see device pages for OS switching.

TcBoot has a builtin TFTP server. By design it will only accept two filenames, tcboot.bin (the bootloader) or tclinux.bin (the firmware), then writes the content to the corresponding flash address. However, the upload happens before the filename check, so we may provide a wrong filename and use it to upload any file into the memory.

1. Connect your USB serial adapter to your computer and the serial pins to the UART headers TX, RX, GND on the board.
2. Switch device on and press a key to stop the bootloader, enter username / password if needed.
3. Connect to device using ethernet cable, set the IP address of your computer to 192.168.1.X
4. Upload the image using a filename other than tcboot.bin or tclinux.bin: tftp 192.168.1.1 -m binary -v -c put image.bin.
   

   Starting the TFTP download...
   ...
   Total 5624466 (0x55D292) bytes received
   Received file: image.bin
   rcvdata_size = 5624466
   start = 0x80020000
   Invalid filename, upload failed
   
   Valid filename: Bootloader  : tcboot.bin
                   Linux Kernel: tclinux.bin
   ...

5. Once the transfer has completed successfully, type jump 80020000 to boot the kernel from memory, or flash with flash <flash addr> 80020000 <file length hex>.

1. Connect your USB serial adapter to your computer and the serial pins to the UART headers TX, RX, GND on the board.
2. Connect to device with XMODEM capability, e.g.
   • Windows:
     1. Use TeraTerm from here: https://github.com/TeraTermProject/teraterm/releases
     2. Run ttermpro.exe as normal by double-clicking the icon.
     3. Cancel the “new connection” window.
     4. Go to > Setup > Serial port...
     5. Specify your active COM[x] port as per your device manager and set speed to 115200.
     6. File → New connection→ Choose Serial and your active COM[x] port.
   • Linux: picocom --send-cmd lsx -vv -b 115200 /dev/ttyUSB0
3. Switch device on and press a key to stop the bootloader, enter username / password if needed.
4. Get the length of the image file in hex:
   • Windows: use Calculator
   • Linux: printf '%X\n' “$(stat -c%s *tclinux.trx)”
5. Type the XMODEM receive command (don't press enter yet): xmdm 80020000 <file length hex>
6. Copy the filename to your clipboard, you'll need it in a second.
7. Press enter and then *quickly* start XMODEM and send the file
   • TeraTerm: Once you see “CC..” on the terminal screen then go to TeraTerm title bar and click File→ Transfer→ XMODEM→ Send → .. and select your trx openwrt file.
   • picocom: ctrl+a ctrl+s <paste-the-file-name> enter.
     

     bldr> xmdm 80020000 <file length hex>
     CCCC
     *** file: openwrt-en75-en751221-smartfiber_xp8421-b-squashfs-tclinux.trx
     $ lsx -vv openwrt-en75-en751221-smartfiber_xp8421-b-squashfs-tclinux.trx
     Sending openwrt-en75-en751221-smartfiber_xp8421-b-squashfs-tclinux.trx, 61644 blocks: Give your local XMODEM receive command now.

8. Once the transfer has completed successfully, type jump 80020000 to boot the kernel from memory, or flash with flash <flash addr> 80020000 <file length hex>.

For reference only. Your mileage may vary.

bldr> ?

?                                   Print out help messages.
help                                Print out help messages.
go                                  Booting the linux kernel.
decomp                              Decompress kernel image to ram.
memrl <addr>                        Read a word from addr.
memwl <addr> <value>                Write a word to addr.
dump <addr> <len>                   Dump memory content.
jump <addr>                         Jump to addr.
flash <dst> <src> <len> <oob>       Write to flash from src to dst(oob: write nand oob if 1).
imginfo                             Show images info.
spi nand rw test                    SPI NAND Test
bdstore <flash dst> <bin src>       Do backdoor config store
bdshow                              Show backdoor config
bdswitch[1|0]                       Enable or disable backdoor function
ddrcalswitch[1|0]                   Enable or disable ddr calibration funciton
drambistswitch[0|1|2]               disable or enable, and quick or normal test
xmdm <addr> <len>                   Xmodem receive to addr.
miir <phyaddr> <reg>                Read ethernet phy reg.
miiw <phyaddr> <reg> <value>        Write ethernet phy reg.
cpufreq <freq num> / <m> <n>        Set CPU Freq <156~450>(freq has to be multiple of 6)
ipaddr <ip addr>                    Change modem's IP.
httpd                               Start Web Server
ddrdrv <..>                         Change DDR driving length

All size arguments must be unprefixed hex values, for example if the memory location is 0x80020000, you write 80020000, if the length is 256, you write 100.

The HTTP upload form accepts two filenames: tcboot.bin, which overwrites the bootloader (!!!), and tclinux.bin, which vendors may forget to change and writes to a completely wrong address (!!!). Just don't use it.

Most devices come with dual boot support, unfortunately it's where vendors patched heavily. Please refer to device pages for details.