Monthly Archives: July 2009

La Fonera Pt.9

via Wolf Paulus » Embedded

La Fonera 2.0 FON 2202 g

RedBoot details and booting into OpenWrt 8.09.1 Kamikaze

Like previously mentioned, the Fonera 2.0g (FON 2202) became available in Europe (on April 21st) and an all new 2.0n (with 802.11 N support) is expected to arrive in Europe as well as here in the US (US$ 99) in October, once again, making this the perfect time for a discovery mission into the Fonera FON 2202, which just like the FON 2100, isn’t a very complex but still a capable device.

The La Fonera 2.0 (FON 2202) developer version comes with ssh enabled but there is also the RedBoot v1.1 boot manager, which is based on the eCos real-time operating system Hardware Abstraction Layer (HAL), allows for downloading and execution of embedded applications via serial (X/Y-modem protocol) or Ethernet (TFTP protocol); there are plenty of sites that provide detailed recipes on how to get the Fonera into a state, where its bootloader becomes accessible.
RedBoot makes it easy to replace the currently deployed heavily customized Linux distribution with a more commonly used Linux distribution for wireless devices, like DD-WRT or OpenWrt.

During booting, the FON 2202, waits at IP address 192.168.1.1 on port 9000, for about 2 seconds, to receive an interrupting Control C. Meaning, if a host computer with an assigned IP of something like 192.168.1.2 is connected to the Fonara, issues this command:

echo -e "\0377\0364\0377\0375\0006" >break.bin; sudo nc -vvv 192.168.1.1 9000 < break.bin; telnet 192.168.1.1 9000

and the Fonera gets rebooted, RedBoot will pause the boot process and show the RedBoot> prompt.

Depending on the host’s OS, this can also be done, by simply launching telnet 192.168.1.1 9000 and pressing Control C. However, it may be necessary to re-configure telnet a little, for instance by putting this .telnetrc file in the user’s home directory.

# ~/.telnetrc
# Fonera 2100 Hacking
192.168.1.254 9000
mode line
# Fonera 220x Hacking
192.168.1.1
mode line

The boot process can also be interrupted, using the Fonera’s serial port (TTL, 9600, 8N1), accessible only after opening the Fonera’s enclosure. The Keyspan USA-19HS USB to Serial Adapter and a RS232 Level Shifter Adapter may be necessary accessories to access the Fonera through the serial port.

RedBoot Prompt

No matter if accessed through ethernet or serial port, entering Control C during the initial phase of the boot process will provide access to the bootloader prompt.

Entering the version command reveals that the bootloader operates in ROMRAM mode, where RedBoot resides in flash memory, but is copied to RAM memory before it starts executing. The RAM footprint is larger than for ROM mode, but it normally runs faster and it is able to update itself, i.e. the flash region where its image resides.

RedBoot> version

RedBoot(tm) bootstrap and debug environment [ROMRAM]
OpenWrt certified release, version 1.1 - built 12:40:38, Sep 3 2007

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

Board: FON 2202
RAM: 0x8000 0000-0x82000000, [0x80040290-0x80fe1000] available
FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.
RedBoot>

This output shows the Fonera’s 32 MB RAM (0×8200 0000 – 0×8000 0000 = 0×200 0000 = 33,554,432) and 8 MB Flash (0x7F0000 = 8,323,072)

Persistent State Flash-based Configuration and Control

Executing the fconfig -l command will list the configuration that is kept in FLASH memory. More details about the fconfig command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/configuring-the-redboot-environment.html.
RedBoot> fconfig -l
Run script at boot: true
Boot script:
.. fis load -l kernel
.. exec

Boot script timeout (1000ms resolution): 2
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 192.168.1.1
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.254
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
RedBoot>

Executing the fconfig -i command will interactively change and then persist the configuration. Important configuration information like the Serial Port’s communication speed (default is 9600 kbps), the TFTP server’s IP Address, or the file name of the Linux Kernel can be changed here.

RedBoot> fconfig -i
Initialize non-volatile configuration - continue (y/n)? y
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis load kernel
>> exec
>>
Boot script timeout (1000ms resolution): 5
Use BOOTP for network configuration: false
Gateway IP address:
Local IP address: 192.168.1.50
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.2
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .

fis load transfers an image from flash memory to RAM. More details about the fis command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/fis-load-command.html.

http://ecos.sourceware.org/docs-latest/redboot/fis-load-command.html

Flash Image System (FIS)

The Fonera’s Flash Image System can be accessed and modified using the fis.

  • fis init — Initialize Flash Image System
  • fis list — List Flash Image System directory
  • fis free — Free flash image
  • fis create — Create flash image
  • fis load — Load flash image
  • fis delete — Delete flash image
  • fis lock — Lock flash area
  • fis unlock — Unlock flash area
  • fis erase — Erase flash area
  • fis write — Write flash area

More details about the fis command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/flash-image-system.html.

fis list

More details about fis list can be found can be found here: http://ecos.sourceware.org/docs-latest/redboot/fis-list-command.html
list lists the images currently available in the FIS.

RedBoot> fis list

Name FLASH addr Mem addr Length Entry point

RedBoot 0xA8000000 0xA8000000 0×00030000 0×00000000

FIS directory 0xA87E0000 0xA87E0000 0x0000F000 0×00000000

RedBoot config 0xA87EF000 0xA87EF000 0×00001000 0×00000000

RedBoot>

  • RedBoot – the bootloader itself, occupying about 192 KByte
  • FIS directory – a Partition Table, about 60 KByte, without it, RedBoot wouldn’t know what to load and boot.
  • RedBoot config – 4 Kbyte, contains the configuration for the bootloader.

Deleting all but the boot blocks is as simple as issuing the fis init command.
Here, the fis init command is executed followed by a fis list and a fis free

RedBoot> fis init

About to initialize [format] FLASH image system – continue (y/n)? y

*** Initialize FLASH Image System

… Erase from 0xa87e0000-0xa87f0000: .

… Program from 0x80ff0000-0×81000000 at 0xa87e0000: .

RedBoot> fis list

Name FLASH addr Mem addr Length Entry point

RedBoot 0xA8000000 0xA8000000 0×00030000 0×00000000

FIS directory 0xA87E0000 0xA87E0000 0x0000F000 0×00000000

RedBoot config 0xA87EF000 0xA87EF000 0×00001000 0×00000000

RedBoot> fis free

0xA8030000 .. 0xA87E0000

RedBoot>

Running reset shows that the OS has been removed and the Fonera now boots into the bootloader prompt.

RedBoot> reset

?Ethernet eth0: MAC address 00:18:84:**:**:**

IP: 192.168.1.50/255.255.255.0, Gateway: 0.0.0.0

Default server: 192.168.1.2

RedBoot(tm) bootstrap and debug environment [ROMRAM]

OpenWrt certified release, version 1.1 – built 12:40:38, Sep 3 2007

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

Board: FON 2202

RAM: 0×80000000-0×82000000, [0x80040290-0x80fe1000] available

FLASH: 0xa8000000 – 0xa87f0000, 128 blocks of 0×00010000 bytes each.

== Executing boot script in 5.000 seconds – enter ^C to abort

RedBoot> fis load loader

No image ‘loader’ found

RedBoot> exec

Can’t execute Linux – invalid entry address

RedBoot>

Running telnet 192.168.1.50 9000 will also immediately show the RedBoot prompt now:wpbook:~ wolf$ telnet 192.168.1.50 9000
Trying 192.168.1.50...
Connected to 192.168.1.50.
Escape character is '^]'.

RedBoot>

OpenWrt

Running the fis init command on the Fonera removes the OS and the only software available on the device now is the bootloader, i.e., we now need a new Linux distribution for this embedded device to bring it back to life. OpenWrt is one of the options and freely available via subversion.
cd ~/Work/Embedded/OpenWrt/branches/8.09.1
svn co svn://svn.openwrt.org/openwrt/tags/8.09.1 8.09.1

Generally, the following tools need to be pre-installed and if building on OS X, MacPorts and Porticus are recommended to simplify their installation.

  • gcc
  • binutils
  • patch
  • bzip2
  • flex
  • bison
  • make
  • gettext
  • pkg-config
  • unzip
  • libz-dev
  • libc headers
  • autoconf
  • bison
  • ccache
  • flex
  • gawk
  • libncurses-dev.
  • svn
  • ccache

With OpenWrt Kamikaze 8.09.1 and all the tools downloaded, issuing make menuconfig will bring show the OpenWrt Configuration Menu where the Atheros 231x/5312 [2.6] target needs to be selected. To keep the initial image small, the following unessential tools can be deselected:

  • Base System: bridge, firewall, iptables, opkg, uci, uclibc
  • Network: ppp

Executing make after saving the configuration, results in deployable kernel image and root file system, both of which can be found here: ~/Work/Embedded/OpenWrt/barnches/8.09.1/bin/. Look for

  • openwrt-atheros-vmlinux.lzma – (kernel) about 700 KB
  • openwrt-atheros-root.squashfs – (root fs) about 900 KB

The image can be hosted using either an HTTP-Webserver or a TFTP server, like Fabrizio La Rosa’s.

Load The Kernel Image

.. back on the device in RedBoot ..

ip_address

More details about ip_address here: http://ecos.sourceware.org/docs-latest/redboot/ip-address-command.html
ip_address sets the IP address of the default server. Use of this address is implied by other commands, such as load.

RedBoot> ip_address -h 192.168.1.2
IP: 192.168.1.50/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2
RedBoot>

load

More details about load can be found can be found here: http://ecos.sourceware.org/docs-latest/redboot/download-command.html
load downloads programs or data to the RedBoot platform. By default RedBoot loads images into some free RAM area which can be addressed later using the variable %{FREEMEMLO}.
-r specifies raw (or binary) data, which also implies that -b or -f must be used.
-b address in memory to load the data. Formatted data streams will have an implied load address, which this option may override.
-f address in flash to load the data. Formatted data streams will have an implied load address, which this option may override.

RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma
Using default protocol (TFTP)
Raw file loaded 0x80040400-0x801203ff, assumed entry at 0x80040400
RedBoot>

fis create

More details about fis create here: http://ecos.sourceware.org/docs-latest/redboot/fis-create-command.html.
This command creates an image in the FIS directory and obviously, the data for the image must exist in RAM memory before it can be copied. By default,fis create takes the data loaded by the last load command as input for a partition starting at the first free block of the flash space. Important are the values for the RAM address (-r) and entry point (-e), which are linux specific and need to have exactly these values. The partition name ‘kernel’ is configured within RedBoot (see above) as the default boot partition’s name and is of course changeable.

RedBoot> fis create -e 0x80041000 -r 0x80041000 kernel
... Erase from 0xa8030000-0xa8110000: ..............
... Program from 0x80040400-0x80120400 at 0xa8030000: ..............
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>

Load The Rootfs Image

Before loading the root filesystem, we issue fis list and fis free once again:

RedBoot> fis list
Name FLASH addr Mem addr Length Entry point
RedBoot 0xA8000000 0xA8000000 0x00030000 0x00000000
kernel 0xA8030000 0x80041000 0x000E0000 0x80041000
FIS directory 0xA87E0000 0xA87E0000 0x0000F000 0x00000000
RedBoot config 0xA87EF000 0xA87EF000 0x00001000 0x00000000

RedBoot> fis free
0xA8110000 .. 0xA87E0000

RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-root.squashfs
Using default protocol (TFTP)
Raw file loaded 0x80040400-0x801a03ff, assumed entry at 0x80040400

The information provided by fis free is now used like this:
0xA87E0000 minus 0xA8110000 = 0x6D0000, which is used to create the Root-Filesystem rootfs:

RedBoot> fis create -l 0x6D0000 rootfs
... Erase from 0xa8110000-0xa87e0000: ..........................................
... Program from 0x80040400-0x801a0400 at 0xa8110000: ......................
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>

Reset

This time, running reset will boot the Fonera into OpenWrt 8.09.1 …
RedBoot> reset

+Ethernet eth0: MAC address 00:18:84:**:**:**

IP: 192.168.1.50/255.255.255.0, Gateway: 0.0.0.0

Default server: 192.168.1.2

RedBoot(tm) bootstrap and debug environment [ROMRAM]

OpenWrt certified release, version 1.1 – built 12:40:38, Sep 3 2007

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

Board: FON 2202

RAM: 0×80000000-0×82000000, [0x80040290-0x80fe1000] available

FLASH: 0xa8000000 – 0xa87f0000, 128 blocks of 0×00010000 bytes each.

== Executing boot script in 5.000 seconds – enter ^C to abort

RedBoot> fis load -l kernel

Image loaded from 0×80041000-0×80313085

RedBoot> exec

Now booting linux kernel:

Base address 0×80030000 Entry 0×80041000

Cmdline :

Linux version 2.6.26.8 (wolf@wpbook) (gcc version 4.1.2) #2 Sat Jul 25 16:51:53 PDT 2009

CPU revision is: 00019064 (MIPS 4KEc)

Determined physical RAM map:

memory: 02000000 @ 00000000 (usable)

Initrd not found or empty – disabling initrd

Zone PFN ranges:

Normal 0 -> 8192

Movable zone start PFN for each node

early_node_map[1] active PFN ranges

0: 0 -> 8192

Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128

Kernel command line: console=ttyS0,9600 rootfstype=squashfs,jffs2 init=/etc/preinit ip=192.168.1.50

Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes.

Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 16 bytes

PID hash table entries: 128 (order: 7, 512 bytes)

console [ttyS0] enabled

Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)

Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)

Memory: 29176k/32768k available (2369k kernel code, 3592k reserved, 385k data, 136k init, 0k highme)

SLUB: Genslabs=6, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1

Mount-cache hash table entries: 512

net_namespace: 484 bytes

NET: Registered protocol family 16

Radio config found at offset 0xf8(0x1f8)

AR531x PCI init…

done

PCI: fixing up device 0,3,0

PCI: Failed to allocate mem resource #1:4000000@84000000 for 0000:00:03.0

NET: Registered protocol family 2

IP route cache hash table entries: 1024 (order: 0, 4096 bytes)

TCP established hash table entries: 1024 (order: 1, 8192 bytes)

TCP bind hash table entries: 1024 (order: 0, 4096 bytes)

TCP: Hash tables configured (established 1024 bind 1024)

TCP reno registered

NET: Registered protocol family 1

ar531x: Registering GPIODEV device

squashfs: version 3.0 (2006/03/15) Phillip Lougher

Registering mini_fo version $Id$

Installing knfsd (copyright (C) 1996 okir@monad.swb.de).

JFFS2 version 2.2. (NAND) (SUMMARY) ?© 2001-2006 Red Hat, Inc.

msgmni has been set to 56

io scheduler noop registered

io scheduler deadline registered (default)

gpiodev: gpio device registered with major 254

gpiodev: gpio platform device registered with access mask FFFFFFFF

Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing disabled

serial8250: ttyS0 at MMIO 0xb1100003 (irq = 37) is a 16550A

eth0: Atheros AR231x: 00:18:84:**:**:**, irq 4

ar2313_eth_mii: probed

eth0: Marvell 88E6060 PHY driver attached.

eth0: attached PHY driver [Marvell 88E6060] (mii_bus:phy_addr=0:1f)

cmdlinepart partition parsing not available

Searching for RedBoot partition table in spiflash at offset 0x7d0000

Searching for RedBoot partition table in spiflash at offset 0x7e0000

6 RedBoot partitions found on MTD device spiflash

Creating 6 MTD partitions on “spiflash”:

0×00000000-0×00030000 : “RedBoot”

0×00030000-0×00110000 : “kernel”

0×00110000-0x007e0000 : “rootfs”

mtd: partition “rootfs” set to be root filesystem

mtd: partition “rootfs_data” created automatically, ofs=250000, len=590000

0×00250000-0x007e0000 : “rootfs_data”

0x007e0000-0x007ef000 : “FIS directory”

0x007ef000-0x007f0000 : “RedBoot config”

0x007f0000-0×00800000 : “boardconfig”

Registered led device: gpio1

Registered led device: wlan

Registered led device: gpio3

Registered led device: gpio4

Registered led device: gpio7

eth0: Configuring MAC for full duplex

TCP vegas registered

NET: Registered protocol family 17

RPC: Registered udp transport module.

RPC: Registered tcp transport module.

802.1Q VLAN Support v1.8 Ben Greear greearb@candelatech.com

All bugs added by David S. Miller davem@redhat.com

IP-Config: Guessing netmask 255.255.255.0

IP-Config: Complete:

device=eth0, addr=192.168.1.50, mask=255.255.255.0, gw=255.255.255.255,

host=192.168.1.50, domain=, nis-domain=(none),

bootserver=255.255.255.255, rootserver=255.255.255.255, rootpath=

VFS: Mounted root (squashfs filesystem) readonly.

Freeing unused kernel memory: 136k freed

Please be patient, while OpenWrt loads …

Algorithmics/MIPS FPU Emulator v1.5

- preinit -

Press CTRL-C for failsafe

switching to jffs2

mini_fo: using base directory: /

mini_fo: using storage directory: /jffs

- init -

Please press Enter to activate this console. PPP generic driver version 2.4.2

device eth0.0 entered promiscuous mode

device eth0 entered promiscuous mode

br-lan: port 1(eth0.0) entering learning state

br-lan: topology change detected, propagating

br-lan: port 1(eth0.0) entering forwarding state

ip_tables: (C) 2000-2006 Netfilter Core Team

nf_conntrack version 0.5.0 (1024 buckets, 4096 max)

wlan: trunk

ath_hal: module license ‘Proprietary’ taints kernel.

ath_hal: 2009-05-08 (AR5212, AR5312, RF5111, RF5112, RF2316, RF2317, REGOPS_FUNC, TX_DESC_SWAP, XR)

ath_rate_minstrel: Minstrel automatic rate control algorithm 1.2 (trunk)

ath_rate_minstrel: look around rate set to 10%

ath_rate_minstrel: EWMA rolloff level set to 75%

ath_rate_minstrel: max segment size in the mrr set to 6000 us

wlan: mac acl policy registered

ath_ahb: trunk

Atheros HAL provided by OpenWrt, DD-WRT and MakSat Technologies

wifi0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps

wifi0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps

wifi0: turboG rates: 6Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps

wifi0: H/W encryption support: WEP AES AES_CCM TKIP

ath_ahb: wifi0: Atheros 2315 WiSoC: mem=0xb0000000, irq=3

La Fonera Pt.8

via Wolf Paulus » Embedded

La Fonera 2.0 FON 2100 a/b/c

RedBoot details and booting into OpenWrt 8.09.1 Kamikaze

Some blog post take a little longer to write and this was certainly one of those. It wasn’t so much the writing but the building of the tools and tool-chain, running all the tests and scripts, and just to get things right.
The Fonera 2.0g (FON 2202) became available in Europe (on April 21st) and an all new 2.0n (with 802.11 N support) is expected to arrive in Europe as well as here in the US (US$ 99) in October, making this the perfect time for a discovery mission into the Fonera FON 2100, which isn’t a very complex piece hardware but still a very capable device.

The La Fonera 2.0 (FON 2100) doesn’t come with ssh enabled but its RedBoot v1.3.0 boot manager, which is based on the eCos real-time operating system Hardware Abstraction Layer (HAL), allows for downloading and execution of embedded applications via serial (X/Y-modem protocol) or Ethernet (TFTP protocol); there are plenty of sites that provide detailed recipes on how to get the Fonera into a state, where its bootloader becomes accessible.
RedBoot makes it easy to replace the currently deployed heavily customized Linux distribution with a more commonly used Linux distribution for wireless devices, like DD-WRT or OpenWrt.

During booting, the FON 2100, waits at IP address 192.168.1.254 on port 9000, for about 10 seconds, to receive an interrupting Control C. Meaning, if a host computer with an assigned IP of something like 192.168.1.2 is connected to the Fonara, issues this command:

echo -e "\0377\0364\0377\0375\0006" >break.bin; sudo nc -vvv 192.168.1.254 9000 < break.bin; telnet 192.168.1.254 9000

and the Fonera gets rebooted, RedBoot will pause the boot process and show the RedBoot> prompt.

Depending on the host’s OS, this can also be done, by simply launching telnet 192.168.1.254 9000 and pressing Control C. However, it may be necessary to re-configure telnet a little, for instance by putting this .telnetrc file in the user’s home directory.

# ~/.telnetrc
# Fonera 2100 Hacking
192.168.1.254 9000
mode line
# Fonera 220x Hacking
192.168.1.1
mode line

The boot process can also be interrupted, using the Fonera’s serial port (TTL, 9600, 8N1), accessible only after opening the Fonera’s enclosure. The Keyspan USA-19HS USB to Serial Adapter and a RS232 Level Shifter Adapter may be necessary accessories to access the Fonera through the serial port.

RedBoot Prompt

No matter if accessed through ethernet or serial port, entering Control C during the initial phase of the boot process will provide access to the bootloader prompt.

Entering the version command reveals that the bootloader operates in ROMRAM mode, where RedBoot resides in flash memory, but is copied to RAM memory before it starts executing. The RAM footprint is larger than for ROM mode, but it normally runs faster and it is able to update itself, i.e. the flash region where its image resides.

RedBoot> version

RedBoot(tm) bootstrap and debug environment [ROMRAM]
Non-certified release, version v1.3.0 - built 16:57:58, Aug 7 2006

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

Board: ap51
RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] available
FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.
RedBoot>

This output shows that of the Fonera’s 16 MB RAM (0×81000000 – 0×80000000 = 0×1000000 = 16,777,216) almost all (0x80fe1000 – 0×80040450 =0xFA0BB0 = 16,386,992) is available. An OS is still stored in the 8 MB Flash (0x7F0000 = 8,323,072) i.e. 64K are occupied.

Board Information

Entering the bdshow command reveals the Atheros Board Data information

RedBoot> bdshow
name: MR3201A-FLF-FON
magic: 35333131
cksum: 5eb3
rev: 5
major: 1
minor: 0
pciid: 0013
wlan0: yes 00:18:84:**:**:**
wlan1: no ff:ff:ff:ff:ff:ff
enet0: yes 00:18:84:**:**:**
enet1: no ff:ff:ff:ff:ff:ff
localbus: no ff:ff:ff:ff:ff:ff
PCI: no ff:ff:ff:ff:ff:ff
uart0: yes
sysled: yes, gpio 2
factory: yes, gpio 6
serclk: external
cpufreq: configured -1 Hz
sysfreq: configured -1 Hz
memcap: disabled
watchdg: enabled
serialNo: 8647******
RedBoot>

Persistent State Flash-based Configuration and Control

Executing the fconfig -l command will list the configuration that is kept in FLASH memory. More details about the fconfig command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/configuring-the-redboot-environment.html.

RedBoot> fconfig -l
Run script at boot: true
Boot script:

Boot script timeout (1000ms resolution): 10
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 192.168.1.254
Local IP address mask: 255.255.255.0
Default server IP address: 0.0.0.0
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false

Executing the fconfig -i command will interactively change and then persist the configuration. Important configuration information like the Serial Port’s communication speed (default is 9600 kbps), the TFTP server’s IP Address, or the file name of the Linux Kernel can be changed here.

RedBoot> fconfig -i
Initialize non-volatile configuration - continue (y/n)? y
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis load -l vmlinux.bin.l7
>> exec
>>
Boot script timeout (1000ms resolution): 5
Use BOOTP for network configuration: false
Gateway IP address:
Local IP address: 192.168.1.1
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.2
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .

fis load transfers an image from flash memory to RAM. More details about the fis command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/fis-load-command.html.

Flash Image System (FIS)

The Fonera’s Flash Image System can be accessed and modified using the fis.

  • fis init — Initialize Flash Image System
  • fis list — List Flash Image System directory
  • fis free — Free flash image
  • fis create — Create flash image
  • fis load — Load flash image
  • fis delete — Delete flash image
  • fis lock — Lock flash area
  • fis unlock — Unlock flash area
  • fis erase — Erase flash area
  • fis write — Write flash area

More details about the fis command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/flash-image-system.html.
Deleting all but the boot blocks is as simple as issuing the fis init command. Here, the fis init command is executed followed by a fis list and a fis free

Running reset shows that the OS has been removed and the Fonera now boots into the bootloader prompt.

RedBoot> reset
+PHY ID is 0022:5521
Ethernet eth0: MAC address 00:18:84:**:**:**
IP: 192.168.1.254/255.255.255.0, Gateway: 0.0.0.0
Default server: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [ROMRAM]
Non-certified release, version v1.3.0 - built 16:57:58, Aug 7 2006

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

Board: ap51
RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] available
FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.
== Executing boot script in 10.000 seconds - enter ^C to abort
RedBoot>

Running telnet 192.168.1.254 9000 will also immediately show the RedBoot prompt now:

wpbook:~ wolf$ telnet 192.168.1.254 9000
Trying 192.168.1.254...
?Invalid command: 9000
Connected to 192.168.1.254.
Escape character is '^]'.
RedBoot>

OpenWrt

Running the fis init command on the Fonera removes the OS and the only software available on the device now is the bootloader, i.e., we now need a new Linux distribution for this embedded device to bring it back to life. OpenWrt is one of the options and freely available via subversion.
cd ~/Work/Embedded/OpenWrt/branches/8.09.1
svn co svn://svn.openwrt.org/openwrt/tags/8.09.1 8.09.1

Generally, the following tools need to be pre-installed and if building on OS X, MacPorts and Porticus are recommended to simplify their installation.

  • gcc
  • binutils
  • patch
  • bzip2
  • flex
  • bison
  • make
  • gettext
  • pkg-config
  • unzip
  • libz-dev
  • libc headers
  • autoconf
  • bison
  • ccache
  • flex
  • gawk
  • libncurses-dev.
  • svn
  • ccache

With OpenWrt Kamikaze 8.09.1 and all the tools downloaded, issuing make menuconfig will bring show the OpenWrt Configuration Menu where the Atheros 231x/5312 [2.6] target needs to be selected. To keep the initial image small, the following unessential tools can be deselected:

  • Base System: bridge, firewall, iptables, opkg, uci, uclibc
  • Network: ppp

Executing make after saving the configuration, results in deployable kernel image and root file system, both of which can be found here: ~/Work/Embedded/OpenWrt/barnches/8.09.1/bin/. Look for

  • openwrt-atheros-vmlinux.lzma – (kernel) about 700 KB
  • openwrt-atheros-root.squashfs – (root fs) about 900 KB

The image can be hosted using either an HTTP-Webserver or a TFTP server, like Fabrizio La Rosa’s.

Load The Kernel Image

.. back on the device in RedBoot ..

ip_address

More details about ip_address here: http://ecos.sourceware.org/docs-latest/redboot/ip-address-command.html
ip_address sets the IP address of the default server. Use of this address is implied by other commands, such as load.

RedBoot> ip_address -h 192.168.1.2
IP: 192.168.1.254/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2
RedBoot>

load

More details about load can be found can be found here: http://ecos.sourceware.org/docs-latest/redboot/download-command.html
load downloads programs or data to the RedBoot platform. By default RedBoot loads images into some free RAM area which can be addressed later using the variable %{FREEMEMLO}.
-r specifies raw (or binary) data, which also implies that -b or -f must be used.
-b address in memory to load the data. Formatted data streams will have an implied load address, which this option may override.
-f address in flash to load the data. Formatted data streams will have an implied load address, which this option may override.

RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma
Using default protocol (TFTP)
Raw file loaded 0x80040800-0x800f07ff, assumed entry at 0x80040800
RedBoot>

fis create

More details about fis create here: http://ecos.sourceware.org/docs-latest/redboot/fis-create-command.html.
This command creates an image in the FIS directory and obviously, the data for the image must exist in RAM memory before it can be copied. By default,fis create takes the data loaded by the last load command as input for a partition starting at the first free block of the flash space. Important are the values for the RAM address (-r) and entry point (-e), which are linux specific and need to have exactly these values. The partition name ‘vmlinux.bin.l7′ is configured within RedBoot (see above) as the default boot partition’s name and is of course changeable.

RedBoot> fis create -e 0x80041000 -r 0x80041000 vmlinux.bin.l7
... Erase from 0xa8030000-0xa80e0000: ...........
... Program from 0x80040800-0x800f0800 at 0xa8030000: ...........
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>

Load The Rootfs Image

Before loading the root filesystem, we issue fis list and fis free once again:

RedBoot> fis list
Name FLASH addr Mem addr Length Entry point
RedBoot 0xA8000000 0xA8000000 0x00030000 0x00000000
vmlinux.bin.l7 0xA8030000 0x80041000 0x000B0000 0x80041000
FIS directory 0xA87E0000 0xA87E0000 0x0000F000 0x00000000
RedBoot config 0xA87EF000 0xA87EF000 0x00001000 0x00000000

RedBoot> fis free
0xA80E0000 .. 0xA87E0000

RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-root.squashfs
Using default protocol (TFTP)
Raw file loaded 0x80040800-0x801207ff, assumed entry at 0x80040800

The information provided by fis free is now used like this:
0xA87E0000 minus 0xA80E0000 = 0×700000, which is used to create the Root-Filesystem rootfs:

RedBoot> fis create -l 0x700000 rootfs
... Erase from 0xa80e0000-0xa87e0000: ................................................................................................................
... Program from 0x80040800-0x80120800 at 0xa80e0000: ..............
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>

Reset

This time, running reset will boot the Fonera into OpenWrt …
RedBoot> reset