I have read all posts on this forum related to recovery of the bootloader, but none has been providing a good solution.

I would like to request 8devices support to resolve how the C2 bootloader can be recovered, inside a customer system, without soldering.

* some people suggest there is JTAG as test pads on the bottom. No confirmation from 8devices. This doesn't help if the modue is already soldered.
* some people have found that the C2 can be put in USB device mode by some bootstrapping GPIOs. They got it to enumerate as USB device, but nobody has indicated what kind of tool to use for actual recovery. Does anyone have information on the protocol or some tool for USB based flash programming?
* some people have indicated that the SPI pins are available externally, and that the SPI flash could be reprogrammed. However, apparently the AR9331 does not tri-state the SPI pins even during reset. This makes it impossible to reprogram the SPI flash from an external controller.

Can you please elaborate on how I can build a larger system including the C2, where I can ensure that no matter what, the bootloader can always be recovered, either via USB, serial, SPI or whatever other way of connecting another processor to the module.

Hi,

1) Yes, there is JTAG port on the bottom off the module. All of the the JTAG pins can be accessed via testpoints on the bottom of the Carambola2 module (http://8devices.com/media/gallery/text/ ... C_0002.png). If you are willing to use JTAG I can overview the schematics and tell you testpoint functions.
2) AR9331 can enter USB boot mode and become a custom USB device. However we have no drivers or any information on how to use this USB device.
3) The SPI pins are connected to AR9331 chip directly and when it is in the reset state it outputs active low. The clock and mosi lines are pulled down with equivalent of 25 ohm resistor, and a more powerfull pull up driver can actually set a HIGH level. But it can also damage the chip and it is unknown if the flash will be able to pull the miso line up. I might give it a go, but no promises.
4) All actions should be taken to avoid damaging the bootloader. For example you can set its partition as read only.

P.S. A bricked Carambola is somewhat like a car with a broken engine. If you want to fix it you have to open hood. Besides desoldering flash, reflashing and soldering it back is easier and faster than changing an oil filter And if you don't want to get your hands dirty, send it to us - we'll be happy to help!

First of all, Thanks for your quick and comprehensive response.

We don't actually have a bricked Carambola here. And If I had, there is no problem with unsoldering the flash and re-soldering it.

This entire topic is regarding a product that we are developing, and where we want to make absoultely sure that whatever happens (including bit flips in the SPI flash), we can recover. If you deploy equipment in remote locations and require high reliability, this is not an uncommon situation at all.

In all non-consumer type deployments, cost of equipment outage, human labor to replace a device, logistics, etc. is all much more expensive than thinking
ahead and anticipating even worst-case situations. I have seen various flash chips (NOR and NAND) fail in the past, including much sooner than advertised by their manufacturers.

Another case to consider is a malicious attack. Let's assume an attacker gains root access to the device via some yet un-patched or 0-day Linux vulnerability. In a device with a single boot-source, without any way to recover automatically or fall back on another boot source he can permanently brick the device.

If 8devices had anticipated such in-system-recovery, I would have assumed that either
a) JTAG is available on regular solder-pads, available to the surrounding system/board, and/or
b) USB tools for recovery would be made available, and/or
c) the SPI flash be connected via a tri-state driver between AR9331 and flash, and/or
d) an option of booting from external SPI flash would be provided, e.g. by multiplexing the CS0 so the user could select internal/external SPI as boot device by toggling an external pin/pad of the module.

From what you are telling me, it seems like the Carambola2 is not capable of doing any of this, and we will more likely have to do our own board design with the AR9331 or another WiFi SoC, rather than the Carambola2

As we are buying the Carambola2 from 8devices and don't have a direct channel to Qualcomm/Atheros, we are not able to obtain the USB recovery program ourselves. However, as 8devices is buying AR9331, I presume you would be able to request this software via your support/contact. Could you please try this? It would be much appreciated. Thanks in advance.

Alright, I think I understand your concerns now.

I will try to find out more about USB ROM bootloading. However I won't be the first person to do that and I know that Atheros (which, to complicate the matters, is now part of Qualcomm) is not too keen to give out information.

Not sure if this helps, but up to this point I haven't heard clients raise an issue of flash malfunction or malicious targeting.

Also, I'm interested what is your anticipated target volume?

Interesting how you can reach CPU and gain control over spi bus in USB device mode and write to spi flash. I hope Internal ROM not enough to write in such a software by Atheros.

LaF0rge,

The USB drivers are not maintained anymore, so the best solution is to use the JTAG. You can access them either by making solder pads on the PCB and using solder paste or making holes in those spots.

IMO the "not maintained" phrase (which is a quote from their response) either means that none knows about it or they're not willing to give any more details (which they didn't). I have a strong feeling that the USB ROM bootloader has too many issues to be used.

As for the JTAG, I am attaching a picture with named JTAG testpoints. We have no recommendations regarding the amount of solder, when soldering in "LGA style", this would have to determined by trial-and-error, but the testpoints are relatively large and so is the margin of error for the amount of solder paste. We have, however, did designs where we made a via/hole with a diameter of a testpoint (1.5mm) and soldered from the bottom side of the PCB.