Tag Archives: Embedded

Embedded Scripting (Lua, Espruino, Micro Python)

via OSHUG

The thirty-second OSHUG meeting will take a look at the use of scripting languages with deeply embedded computing platforms, which have much more constrained resources than the platforms which were originally targeted by the languages.

Programming a microcontroller with Lua

eLua is a full version of the Lua programming language for microcontrollers, running on bare metal. Lua provides a modern high level dynamicaly typed language, with first class functions, coroutines and an API for interacting with C code, and yet which is very small and can run in a memory constrained environment. This talk will cover the Lua language and microcontroller environment, and show it running on-off-the-shelf ARM Cortex boards as well as the Mizar32, an open hardware design built especially for eLua.

Justin Cormack is a software developer based in London. He previously worked at a startup that built LED displays and retains a fondness for hardware. He organizes the London Lua User Group, which hosts talks on the Lua programming language.

Bringing JavaScript to Microcontrollers

This talk will discuss the benefits and challenges of running a modern scripting language on microcontrollers with extremely limited resources. In particular we will take a look at the Espruino JavaScript interpreter and how it addresses these challenges and manages to run in less than 8kB of RAM.

Gordon Williams has developed software for companies such as Altera, Nokia, Microsoft and Lloyds Register, but has been working on the Espruino JavaScript interpreter for the last 18 months. In his free time he enjoys making things - from little gadgets to whole cars.

Micro Python — Python for microcontrollers

Microcontrollers have recently become powerful enough to host high-level scripting languages and run meaningful programs written in them. In this talk we will explore the software and hardware of the Micro Python project, an open source implementation of Python 3 which aims to be as compatible as possible with CPython, whilst still fitting within the RAM and ROM constraints of a microcontroller. Many tricks are employed to put as much as possible within ROM, and to use the least RAM and minimal heap allocations as is feasible. The project was successfully funded via a Kickstarter campaign at the end of 2013, and the hardware is currently being manufactured at Jaltek Systems UK.

Damien George is a theoretical physicist who likes to write compilers and build robots in his spare time.

Note: Please aim to by 18:15 as the first talk will start at 18:30 prompt.

Sponsored by:

Privacy and Security (Security protocols in constrained environments, RFIDler, Indie Phone)

via OSHUG

The thirty-first OSHUG meeting is dedicated to privacy and security, with talks on implementing security protocols in constrained environments, an SDR RFID reader/writer/emulator, and a new initiative that will use design thinking and open source to create a truly empowering mobile phone.

Security protocols in constrained environments

Implementation of security protocols such as TLS, SSH or IPsec come with a memory and compute overhead. Whilst this has become negligible in full scale environments it's still a real issue for hobbyist and embedded developers. This presentation will look at the sources of the overheads, what can be done to minimise them, and what sort of hardware platforms can be made to absorb them. The benefits and potential pitfalls of hardware specific implementations will also be examined.

Chris Swan is CTO at CohesiveFT where he helps build secure cloud based networks. He's previously been a security guy at large Swiss banks, and before that was a Weapon Engineering Officer in the Royal Navy. Chris has tinkered with electronics since pre-school, and these days has a desk littered with various dev boards and projects.

RFIDler: A Software Defined RFID Reader/Writer/Emulator

Software Defined Radio has been quietly revolutionising the world of RF. However, the same revolution has not yet taken place in RFID. The proliferation of RFID/NFC devices means that it is unlikely that you will not interact with one such device or another on a daily basis. Whether it’s your car key, door entry card, transport card, contactless credit card, passport, etc. you almost certainly have one in your pocket right now!

RFIDler is a new project, created by Aperture Labs, designed to bring the world of Software Defined Radio into the RFID spectrum. We have created a small, open source, cheap to build platform that allows any suitably powerful microprocessor access to the raw data created by the over-the-air conversation between tag and reader coil. The device can also act as a standalone ‘hacking’ platform for RFID manipulation/examination. The rest is up to you!

Adam “Major Malfunction” Laurie is a security consultant working in the field of electronic communications, and a Director of Aperture Labs Ltd., who specialise in reverse engineering of secure systems. He started in the computer industry in the late Seventies, and quickly became interested in the underlying network and data protocols.

During this period, he successfully disproved the industry lie that music CDs could not be read by computers, and wrote the world’s first CD ripper, ‘CDGRAB’. He was also involved various early open source projects, including ‘Apache-SSL’ which went on to become the de-facto standard secure web server. Since the late Nineties he has focused his attention on security, and has been the author of various papers exposing flaws in Internet services and/or software, as well as pioneering the concept of re-using military data centres (housed in underground nuclear bunkers) as secure hosting facilities.

Andy Ritchie has been working in the computer and technology industry for over 20 years for major industry players such as ICL, Informix, British Airways and Motorola. Founding his first company, Point 4 Consulting at the age of 25, he built it into a multi-million pound technology design consultancy. Point 4 provided critical back end technology and management for major web sites such as The Electronic Telegraph, MTV, United Airlines, Interflora, Credit Suisse,BT, Littlewoods and Sony. Following Point 4 he went on to found Ablaise, a company that manages the considerable intellectual property generated by Point 4, and Aperture Labs. In his spare time he manages the worlds largest and longest running security conference, Defcon. Andy's research focuses on access control systems, biometric devices and embedded systems security, and he has spoken and trained at information security conferences in Europe and the US publicly and for private and governmental audiences. He is responsible for identifying major vulnerabilities in various access control and biometric systems, and has a passion for creating devices that emulate access control tokens either electronic physical or biometric. Andy has been responsible both directly and indirectly for changing access control guidelines for several western governments. Andy is currently a director of Aperture Labs Ltd, a company that specialises in reverse engineering and security evaluations of embedded systems.

Indie: a tale of privacy, civil liberties, and a phone

Can a phone really help protect our civil liberties? Aral Balkan thinks so. And he’s embarked on an audacious journey to make one. Join us to hear the introduction of a two-year story that is only just beginning.

Aral Balkan is is founder and designer of Indie Phone, a phone that empowers mere mortals to own their own data.

Note: Please aim to by 18:15 as the first talk will start at 18:30 prompt.

Sponsored by:

Extended list of 8-bit AVR Micro-Controllers, easily programmable with the Arduino IDE

via Wolf Paulus » Embedded

A couple days back, I wrote about ‘The $3 Arduino‘, how to leave the Arduino board behind and program an ATmega168 Micro-Controller directly, still using the Arduino IDE but with the AVRMSPII programmer. Of course, the ATmega168 isn’t the only MC available for something like that. In fact, I have quite a few 8-bit AVR Micro-Controllers in a small box right here, next to my desk.
Let’s minimize the ‘Minimal Arduino’ even more, for instance by using the tiny ATtiny85 Microcontroller. Just like we did with the ‘BareBones’ definition, we add board definitions for the Mircocontrollers that the Arduino IDE doesn’t support out-of-the-box. Board definition for the missing MCs can be found here and after moving the attiny folder into the ~/Document/Arduino/hardware folder and restartig the Arduino IDE, the IDE should now know about the new MCs. More details about this can be read here.

Minimizing the Minimal Arduino

Now that the Arduino IDE knows about the really tiny ATtiny85, we can set it’s internal clock to 8Mhz and flash a small program.


To flash the chip, we use the SPI (MOSI/MISO/SCK) Pins like shown here:

  1. RSET -> ATtiny85-Pin 1
  2. GND -> ATtiny85-Pin 4
  3. MOSI -> ATtiny85-Pin 5
  4. MISO -> ATtiny85-Pin 6
  5. SCK -> ATtiny85-Pin 7
  6. +5V -> ATtiny85-Pin 8

Switching the Internal Clock to 8MHz

Using the Fuse Calculator we can find the proper ATtiny85 fuse settings, to use the internal RC Oscillator and setting it to 8Mhz.
The avrdude arguments look something like this: -U lfuse:w:0xe2:m -U hfuse:w:0xdf:m -U efuse:w:0xff:m
Avrdude is one of the tools that the Arduino IDE deploys on your computer. You can either execute Avrdude with those arguments directly, like so:

avrdude -p t85 -b 115200 -P usb -c avrispmkII -V -e -U lfuse:w:0xe2:m -U hfuse:w:0xdf:m -U efuse:w:0xff:m

or just execute the ‘Burn Bootloader’ command in the Arduino IDE’s Tools menu.
While this will NOT burn a bootloader on the ATtiny85 chip, it will set the fuses appropriately. Either way, this step needs to be performed only once.

With the microcontroller still connected to the AT-AVR-ISP2 programmer, a simple program can be quickly uploaded:

int p = 3;                // LED connected to digital pin 13
void setup() {
  pinMode(p, OUTPUT);      // sets the digital pin as output
}

void loop() {
  digitalWrite(p, HIGH);   // sets the LED on
  delay(100);              // .. for 10th of a sec
  digitalWrite(p, LOW);    // sets the LED off again
  delay(1000);             //  waits for a second
  digitalWrite(p, HIGH);   // sets the LED on
  delay(500);              // .. for 1/2 a sec
  digitalWrite(p, LOW);    // sets the LED off again
  delay(500);              // .. for 1/2 a second
}

ATtiny2313 ($2.00)

The high-performance, low-power Atmel 8-bit AVR RISC-based microcontroller combines 2KB ISP flash memory, 128B ISP EEPROM, 128B internal SRAM, universal serial interface (USI), full duplex UART, and debugWIRE for on-chip debugging. The device supports a throughput of 20 MIPS at 20 MHz and operates between 2.7-5.5 volts.
By executing powerful instructions in a single clock cycle, the device achieves throughputs approaching 1 MIPS per MHz, balancing power consumption and processing speed.

ATtiny84 ($3.00)

The high-performance, low-power Atmel 8-bit AVR RISC-based microcontroller combines 8KB ISP flash memory, 512B EEPROM, 512-Byte SRAM, 12 general purpose I/O lines, 32 general purpose working registers, an 2 timers/counters (8-bit/16-bit) with two PWM channels each, internal and external interrupts, 8-channel 10-bit A/D converter, programmable gain stage (1x, 20x) for 12 differential ADC channel pairs, programmable watchdog timer with internal oscillator, internal calibrated oscillator, and four software selectable power saving modes.

ATtiny85 ($1.00)

The high-performance, low-power Atmel 8-bit AVR RISC-based microcontroller combines 8KB ISP flash memory, 512B EEPROM, 512-Byte SRAM, 6 general purpose I/O lines, 32 general purpose working registers, one 8-bit timer/counter with compare modes, one 8-bit high speed timer/counter, USI, internal and external Interrupts, 4-channel 10-bit A/D converter, programmable watchdog timer with internal oscillator, three software selectable power saving modes, and debugWIRE for on-chip debugging. The device achieves a throughput of 20 MIPS at 20 MHz and operates between 2.7-5.5 volts.

ATmega8 ($2.00)

The low-power Atmel 8-bit AVR RISC-based microcontroller combines 8KB of programmable flash memory, 1KB of SRAM, 512K EEPROM, and a 6 or 8 channel 10-bit A/D converter. The device supports throughput of 16 MIPS at 16 MHz and operates between 2.7-5.5 volts.

ATmega168 ($4.00)

The high-performance, low-power Atmel 8-bit AVR RISC-based microcontroller combines 16KB ISP flash memory, 1KB SRAM, 512B EEPROM, an 8-channel/10-bit A/D converter (TQFP and QFN/MLF), and debugWIRE for on-chip debugging. The device supports a throughput of 20 MIPS at 20 MHz and operates between 2.7-5.5 volts.

ATmeaga328 ($5.00)

The high-performance Atmel 8-bit AVR RISC-based microcontroller combines 32KB ISP flash memory with read-while-write capabilities, 1KB EEPROM, 2KB SRAM, 23 general purpose I/O lines, 32 general purpose working registers, three flexible timer/counters with compare modes, internal and external interrupts,serial programmable USART, a byte-oriented 2-wire serial interface, SPI serial port, 6-channel 10-bit A/D converter (8-channels in TQFP and QFN/MLF packages), programmable watchdog timer with internal oscillator, and five software selectable power saving modes. The device operates between 1.8-5.5 volts.

MC Flash (KB) SRAM (Bytes) EEPROM (Byte) SPI I2C UART ADC Chnnl (10bit) PWM Chnnl Timer RTC
ATtiny2312 2 128 128 2 1 1 4 2 No
ATtiny84 8 512 512 1 1 0 8 4 2 No
ATtiny85 8 512 512 1 1 0 4 6 2 No
ATmega8 8 1024 512 1 1 1 8 3 3 Yes
ATmega168 16 1024 512 2 1 1 8 6 3 Yes
ATmega328 32 2048 1024 2 1 1 8 6 3 Yes

The $3 Arduino

via Wolf Paulus » Embedded

Buying and using an official Arduino Board like the standard Arduino Uno is the perfect way to get started with the Arduino language, common electronic components, or your own embedded prototyping project. However, once you have mastered the initial challenges and have built some projects, the Arduino Board can get in the way.

For instance, many enthusiasts, who started out with hacking and extending the Arduino hardware and software, have now moved on to the Raspberry Pi, which is equally or even less expensive, but more powerful and complete. The Raspberry Pi comes with Ethernet, USB, HDMI, Analog-Audio-Out, a lot of memory, and much more; adding all these capabilities to the Arduino with Arduino-Shields, would probably cost several hundred Dollars. However, the Raspberry lacks some of Arduino’s I/O capabilities like Analog-Inputs.
Combining an Arduino with a Raspberry Pi, may make sense for a lot of project; but we don’t need or want to integrate an Arduino Board – the Arduino’s core, the ATMEGA Microcontroller, is all what’s needed.

We still want to program the Arduino with the familiar Arduino IDE, but the boot-loader doesn’t really help, once the ATMEGA Micro is programmed and is ready to communicate with the Raspi or any other platform.

This is probably the most minimal ATmega168-20PU based Arduino you can come up with. The ATmega168 (available of about $3) was the default Arduino chip for quite some time, before being replaced by the ATmega328, doubling the available memory. The chip is powered with +5V on Pin-7 and grounded via Pin-8; the LED is between Pins 19 and 22.

Here you see it processing this rather simple blinky program:

int p = 13;                // LED connected to digital pin 13
void setup() {
  pinMode(p, OUTPUT);      // sets the digital pin as output
}
  
void loop() {
  digitalWrite(p, HIGH);   // sets the LED on
  delay(100);              // .. for 10th of a sec 
  digitalWrite(p, LOW);    // sets the LED off again
  delay(1000);             //  waits for a second
  digitalWrite(p, HIGH);   // sets the LED on
  delay(500);              // .. for 1/2 a sec 
  digitalWrite(p, LOW);    // sets the LED off again
  delay(500);              // .. for 1/2 a second
}

Since we don’t want any bootloader (waiting for a serial upload of new software) on this chip but rather have it immediately start executing the program, we need to tell the Arduino IDE about our bare-bones board and the fact that it doesn’t have a boot loader.

Bare-Bones ATmega168 Board Definition

To add a new hardware definition to the Arduino IDE, create a hardware/BareBones folder inside your Arduino folder (the place where all your sketches are stored). Create a boards.txt file with the following content.
On the Mac for instance, I ended up with this:
/Users/wolf/Documents/Arduino/hardware/BareBones/boards.txt

minimal168.name=ATmega168 bare bone (internal 8 MHz clock)
minimal168.upload.speed=115200
minimal168.bootloader.low_fuses=0xE2
minimal168.bootloader.high_fuses=0xDD
minimal168.bootloader.extended_fuses=0×00
minimal168.upload.maximum_size=16384
minimal168.build.mcu=atmega168
minimal168.build.f_cpu=8000000L
minimal168.build.core=arduino:arduino
minimal168.build.variant=arduino:standard

Wiring up the ATmega-168

To flash the chip, we use the SPI (MOSI/MISO/SCK) Pins like shown here:

Connections from an AT-AVR-ISP2 to the ATmega-168 are as follows:

  1. GND -> ATmega168-Pin 8
  2. +5V -> ATmega168-Pin 7
  3. MISO -> ATmega168-Pin 18
  4. SCK -> ATmega168-Pin 19
  5. RSET -> ATmega168-Pin 1
  6. MOSI -> ATmega168-Pin 17

Burning without a Boot-Loader

Instead of an Arduino Board, I connected one of those shiny blue AT-AVR-ISP2 programmers from ATMEL (available for about $30) to the Mac. In the Arduino-IDE, in the Tools Menu, under Boards, I selected and ‘ATmega168 bare bone (internal 8 MHz clock)’ and under Programmers, ‘AVRISP mkII’.
Hitting ‘Upload’ will now use the AT-AVR-ISP2 to reset the chip, flash the program, and verify the new memory content. All in all, it takes about 75 seconds.
Once the chip is now powered, it will immediately start executing the program.

Switching the Internal Clock to 8MHz

Using the Fuse Calculator we can find the proper ATmega168 fuse settings, to use the internal RC Oscillator and setting it to 8Mhz.
The avrdude arguments look something like this: -U lfuse:w:0xe2:m -U hfuse:w:0xdf:m -U efuse:w:0x00:m.
Avrdude is one of the tools that the Arduino IDE deploys on your computer. You can either execute Avrdude with those arguments directly, like so:

avrdude -p m168 -b 115200 -P usb -c avrispmkII -V -e -U lfuse:w:0xe2:m -U hfuse:w:0xdf:m -U efuse:w:0x00:m

or just execute the ‘Burn Bootloader’ command in the Arduino IDE’s Tools menu.
While this will NOT burn a bootloader on the ATmege168 chip, it will set the fuses appropriately. Either way, this step needs to be performed only once.

ATtiny85

Let’s minimize the ‘Minimal Arduino’ even more, for instance by using the tiny ATtiny85 Microcontroller.
Read more: http://wolfpaulus.com/journal/embedded/avrmc

Embedded (Erlang, Parallella, Compiler Options and Energy Consumption)

via OSHUG

Embedded systems continue to grow in importance as they play an ever-increasing role in everyday life: more computing is done on the move as smartphone functionality catches up with desktops and services move to the Cloud; the Internet of Things is set to herald an age in which networked objects create and consume data on our behalves. These, and many other applications, are driving an insatiable demand for more powerful and energy-efficient embedded solutions.

At the twenty-second OSHUG meeting we will hear how Erlang can be used to bring concurrency to multi-core embedded systems, we will learn about the Parallella project which aims to make parallel computing accessible to everyone, and we will hear about vital research into optimising compiler options for energy-efficiency.

Erlang Embedded — Concurrent Blinkenlights and More!

Managing the resources and utilising the increasingly popular multi-core and heterogeneous aspects of modern embedded systems require new sets of tools and methodologies that differ from the traditional C/C++ flow.

Erlang provides features that are highly relevant to solve these issues and yet it is pretty much unknown in the embedded domain — which is surprising considering that it was originally designed for embedded applications at Ericsson!

This talk aims to provide an overview of Erlang and the current state of its usage in the embedded domain and talk about our plans to help speed up the adoption rate of Erlang in embedded projects.

Omer Kilic works on Erlang Embedded, a Knowledge Transfer Partnership project in collaboration with University of Kent. The aim of this project is to bring the benefits of concurrent systems development using Erlang to the field of embedded systems; through investigation, analysis, software development and evaluation.

Prior to joining Erlang Solutions, Omer was a research student in the Embedded Systems Lab at the University of Kent, working on a reconfigurable heterogeneous computing framework as part of his PhD thesis (which he intends to submit soon!)

Omer likes tiny computers, things that 'just work' and real beer.

Parallella — Supercomputing for Everyone

The Parallella computing platform is based on the Adapteva Epiphany processor. Implemented in 65nm or 28nm silicon, Epiphany offers 16 or 64 cores and delivers up to 50 GFLOPS/watt, and the entire Parallella board complete with a dual-core ARM A9 host will consume around 5 watts.

This talk will present the Epiphany architecture and explore the challenges of developing an effective GNU tool chain, and discuss the use of open source, and an approach to engineering that developed one of the fastest chips in the world from concept to second generation silicon for just a few million dollars.

Dr Jeremy Bennett is the founder of Embecosm, and an expert on hardware modelling and embedded software development. Prior to founding Embecosm, Dr Bennett was Vice President of ARC International PLC and previously Vice President of Marconi PLC.

In his earlier academic career, he pursued academic research in computer architecture, modelling and compiler technology at Bath and Cambridge Universities. He is the author of the popular textbook "Introduction to Compiling Techniques" (McGraw-Hill 1990, 1995, 2003).

Dr Bennett holds an MA and PhD in Computer Science from Cambridge University. He is a Member of the British Computer Society, a Chartered Engineer, a Chartered Information Technology Professional and Fellow of the Royal Society of Arts.

Measuring the impact of compiler options on energy consumption in embedded platforms

Energy efficiency is the highest priority for modern software-hardware co-design. The potential for compiler options to impact on power consumption of running programs has often been discussed. However there has never been a comprehensive analysis of the magnitude of that impact, or how it varies between processor architectures and compilers.

This presentation will describe a project undertook during the the Summer of 2012 at the University of Bristol Department of Computer Science and funded by Embecosm, to explore the effect of compiler options on energy consumption of compiled programs.

The talk will discuss the accurate measurement of power consumption on a range of small embedded systems. The whole setup was under control of an XMOS board, making it possible to run the tens of thousands of tests needed for statistical robustness in just a few weeks. The results of these tests will be discussed, the implications for compiling embedded systems, and the potential for future research in this area.

This research was unusual, in that it was funded as a completely open project. A wiki detailed progress from week to week, the relevant open source communities were kept regularly informed, and the results will be published in open access journals. The talk will also cover the issues around funding and running an academic research project in this manner.

James Pallister is a graduate of the University of Bristol, where he achieved joint First Class Honours in Computer Science and Electronics. During the summer of 2012, he led Embecosm's research program into the impact of compilers on energy consumption in embedded systems, which was a development of James' work at the University of Bristol with the XMOS multi-core processor.

Mr Pallister has returned to Bristol in October 2012, where he is studying for a PhD in low-power multi-core system design. He remains a Technical Advisor to Embecosm.

Simon Hollis is a lecturer in the Microelectronics Research Group, Department of Computer Science, University of Bristol. His interests lie in the creation of energy-efficient embedded systems, processor interconnects and parallel languages and run-times.

He is the creator of the RasP and Skip-link Networks-on-Chip, and is currently working on the Swallow many-core system, which targets 480 processing cores in under 200W. A main aim of the research is to re-investigate the memory/communication balance in large scale computing systems.

Note: Please aim to arrive for 18:45 or shortly after as the event will start at 19:00 prompt.

Streaming Your Webcam w/ Raspberry Pi

via Wolf Paulus » Embedded

[Last updated on Feb. 2. 2013 for (2012-12-16-wheezy-raspbian) Kernel Version 3.2.27+]

Three years ago, we bought two small Webcams and since we wanted to use them on Linux and OS X, we went with the UVC and Mac compatible Creative LIVE! CAM Video IM Ultra. This Webcam (Model VF0415) has a high-resolution sensor that lets you take 5.0-megapixel pictures and record videos at up to 1.3-megapixel; supported resolutions include 640×480, 1290×720, and 1280×960. If you like, you can go back and read what I was thinking about the IM Ultra, back in 2009. Today, it’s not much used anymore, but may just be the right accessory for a Raspberry Pi.

With the USB Camera attached to the Raspi, lsusb returns something like this:

lsusb

Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 0424:9512 Standard Microsystems Corp.
Bus 001 Device 003: ID 0424:ec00 Standard Microsystems Corp.
Bus 001 Device 004: ID 7392:7811 Edimax Technology Co., Ltd EW-7811Un 802.11n Wireless Adapter [Realtek RTL8188CUS]
Bus 001 Device 005: ID 041e:4071 Creative Technology, Ltd

Using the current Raspbian “wheezy” distribution (Kernel 3.2.27+), one can find the following related packages, ready for deployment:

  • luvcview, a camera viewer for UVC based webcams, which includes an mjpeg decoder and is able to save the video stream as an AVI file.
  • uvccapture, which can capture an image (JPEG) from a USB webcam at a specified interval

While these might be great tools, mpeg-streamer looks like a more complete, one-stop-shop kind-of solution.

Get the mpeg-streamer source code

Either install Subversion (svn) on the Raspberry Pi or use svn installed on your Mac or PC, to get the source-code before using Secure Copy (scp) to copy it over to your Raspi.

Here, I’m using svn, which is already installed on the Mac, before copying the files over to my Raspi, (username pi, hostname is phobos)

cd ~
mkdir tmp
cd tmp
svn co https://mjpg-streamer.svn.sourceforge.net/svnroot/mjpg-streamer mjpg-streamer
scp -r ./mjpg-streamer pi@phobos:mjpg-streamer

Please note: Looks like the repo got recently moved, Try this to check-out the code if the previous step does not work:

svn co https://svn.code.sf.net/p/mjpg-streamer/code/mjpg-streamer/ mjpg-streamer

Over on the Raspi, I tried to make the project, but quickly ran into error messages, hinting at a missing library.

ssh pi@phobos
cd mjpg-streamer/mjpg-streamer
make
...
jpeg_utils.c:27:21: fatal error: jpeglib.h: No such file or directory, compilation terminated.
make[1]: *** [jpeg_utils.lo] Error 1

After finding out, which libraries were available (apt-cache search libjpeg), I installed libjpeg8-dev like so: sudo apt-get install libjpeg8-dev. This time, I got a lot further, before hitting the next build error:


make
...
make[1]: *** [pictures/640x480_1.jpg] Error 127
make[1]: Leaving directory `/home/pi/mjpg-streamer/mjpg-streamer/plugins/input_testpicture'

After some google-ing, which resulted in installing ImageMagick like so: sudo apt-get install imagemagick, the next build attempt looked much more promissing:

make
..

and ls -lt shows the newly built files on top:

-rwxr-xr-x 1 pi pi 13909 Sep 8 07:51 input_file.so
-rwxr-xr-x 1 pi pi 168454 Sep 8 07:51 input_testpicture.so
-rwxr-xr-x 1 pi pi 31840 Sep 8 07:50 output_http.so
-rwxr-xr-x 1 pi pi 14196 Sep 8 07:50 output_udp.so
-rwxr-xr-x 1 pi pi 19747 Sep 8 07:50 output_file.so
-rwxr-xr-x 1 pi pi 29729 Sep 8 07:50 input_uvc.so
-rwxr-xr-x 1 pi pi 15287 Sep 8 07:50 mjpg_streamer
-rw-r--r-- 1 pi pi 1764 Sep 8 07:50 utils.o
-rw-r--r-- 1 pi pi 9904 Sep 8 07:50 mjpg_streamer.o

MJPG-streamer

MJPG-streamer is a command line tool to stream JPEG files over an IP-based network. MJPG-streamer relies on input- and output-plugins, e.g. an input-plugin to copy JPEG images to a globally accessible memory location, while an output-plugin, like output_http.so, processes the images, e.g. serve a single JPEG file (provided by the input plugin), or streams them according to existing mpeg standards.

Therefore, the important files that were built in the previous step are:

  • mjpg_streamer – command line tool that copies JPGs from a single input plugin to one or more output plugins.
  • input_uvc.so – captures such JPG frames from a connected webcam. (Stream up to 960×720 pixel large images from your webcam at a high frame rate (>= 15 fps) with little CPU load.
  • output_http.so – HTTP 1.0 webserver, serves a single JPEG file of the input plugin, or streams them according to M-JPEG standard.

Starting the Webcam Server

A simple launch command would look like this:
./mjpg_streamer -i "./input_uvc.so" -o "./output_http.so -w ./www"

MJPG Streamer Version: svn rev:
i: Using V4L2 device.: /dev/video0
i: Desired Resolution: 640 x 480
i: Frames Per Second.: 5
i: Format…………: MJPEG
o: HTTP TCP port…..: 8080
o: username:password.: disabled
o: commands……….: enabled

Open a Webbrowser on another computer on the LAN and open this url: http://{name or IP-address of the Raspi}:8080

However, experimenting with the resolution and frame rate parameters is well worth it and can improved the outcome.

UVC Webcam Grabber Parameters

The following parameters can be passed to this plugin:

-d video device to open (your camera)
-r the resolution of the video device,
can be one of the following strings:
QSIF QCIF CGA QVGA CIF VGA SVGA XGA SXGA
or a custom value like: 640×480
-f frames per second
-y enable YUYV format and disable MJPEG mode
-q JPEG compression quality in percent
(activates YUYV format, disables MJPEG)
-m drop frames smaller then this limit, useful
if the webcam produces small-sized garbage frames
may happen under low light conditions
-n do not initalize dynctrls of Linux-UVC driver
-l switch the LED “on”, “off”, let it “blink” or leave
it up to the driver using the value “auto”

HTTP Output Parameters

The following parameters can be passed to this plugin:

-w folder that contains webpages in flat hierarchy (no subfolders)
-p TCP port for this HTTP server
-c ask for “username:password” on connect
-n disable execution of commands

I have seen some good results with this
./mjpg_streamer -i "./input_uvc.so -n -f 15 -r 640x480" -o "./output_http.so -n -w ./www"
but even a much higher resolution didn’t impact the actually observed frame-rate all that much:
./mjpg_streamer -i "./input_uvc.so -n -f 15 -r 1280x960" -o "./output_http.so -n -w ./www"

MJPG Streamer Version: svn rev:
i: Using V4L2 device.: /dev/video0
i: Desired Resolution: 1280 x 960
i: Frames Per Second.: 15
i: Format…………: MJPEG
o: www-folder-path…: ./www/
o: HTTP TCP port…..: 8080
o: username:password.: disabled
o: commands……….: disabled

Webcam Stream Clients

The included Website (http://{name or IP-address of the Raspi}:8080) shows examples for how to connect a client to the Webcam stream. The easiest way is obviously a simple HTML page that works great with Google Chrome and Firefox but not so much with Safari. Anyways, it’s important to specify the width and height that was configured with the output_http.so, in the HTML as well


  <img alt="" src="http://phobos:8080/?action=stream" width="1280" height="960" />

Raspberry Pi Webcam Streamer

Taking the Raspberry Pi Web Stream Server Outside

This is the Raspberry Pi powered by a 5VDC, 700mA battery, with an (Edimax EW-7811Un) USB-WiFi Adapter and the Creative LIVE! CAM Video IM Ultra connected.

Video Lan Client for Viewing and Recording

Using Video Lan Client, you can view and also record the video stream, served by the Raspi.

Recorded Webcam Streamer

Movie, streamed from a Raspberry Pi

Raspberry Pi Webcam from Tech Casita Productions on Vimeo.

Let me know what Webcam software you found that works well on the Raspberry Pi.

Raspberry Pi, Battle of the Enclosures

via Wolf Paulus » Embedded

Overturned Basket with Raspberries and White Currants, 1882
By Eloise Harriet Stannard (1829 – 1915)

Eventually, you will start looking for an enclosure for the Raspberry Pi. Even during the early hardware development phase of your project, you can put the Raspberry Pi into an enclosure, given that the mainboard doesn’t have any on/off switches and that a Cobbler Breakout Kit provides easy access to the Raspi’s GPIO Pins (on a neighboring solderless breadboard).
Unlike for many other popular embedded development platforms, there are already many enclosures for the Raspberry Pi to chose from; many of which are listed over here at elinux.org.

We have bought two Adafruit Pi Boxes and two Raspberry Pi Cases from Barch Designs.

Adafruit Pi Box

  • Crystal-clear Acrylic (6 pieces)
  • Engraved Labels on all Connector Slots
  • Long Slot to connect a 26-pin IDC cable (e.g. Cobbler Breakout Kit)
  • No additional vents or cooling required
  • $14.95

Evaluation

The case has no screws or standoffs and the little feet have to be squeezed to make the pieces snap together.
Very elegant design, however, (probably accelerated by the Raspberry Pi’s heat emission) after a few days of use, the acrylic became extremely brittle and started to show cracks around the cutouts. One of the feet broke off, while we were trying to open the enclosure, rendering the case useless (all feet are needed to snap the enclosure parts together again.)
Despite operating extremely carefully, the same happened to the second case only a few days later. Kudos to Adafruit though. Once we mentioned our experience with the enclosure, a refund was issued.

While this could have been a temporary issue related to the acrylic used for our cases, we would not recommend the enclosure for longer use or if you needed to open and close the enclosure often or even rarely.

Raspberry Pi Case by Barch Designs

  • CNC Machined from Billet Aluminum
  • Customizable Engraving
  • Long Slot to connect a 26-pin IDC cable (e.g. Cobbler Breakout Kit)
  • Acts as a Heat Sink
  • LED Fiber Optics
  • $69.99 (incl. shipping)

Evaluation

This precisely enclosure is milled from Solid 6061-T6 Aircraft Grade Billet Aluminum in the USA. Fiber Optic cables that have been manufactured into the case and each cable is positioned directly above an LED.
The whole enclosure acts as an heat sink, even a small package of thermal paste is included.
While the price is about four times that of the Acrylic enclosure, if you need an enclosure that lasts you may want to consider this one. It is the Mercedes among the Pi cases, but money well spent.

Raspberry Pi / Case by Barch Designs / with EW-7811Un USB Wireless Adapter

Accessing Raspberry Pi via Serial

via Wolf Paulus » Embedded

Using a serial connection to connect to a Raspbery Pi has many advantages. The boot process (Kernel boot messages go to the UART at 115,200 bit/s) can be monitored, without the need to hookup an HDMI-Monitor. Once booted, you can of course login through a serial terminal as well, i.e. the serial connection allows logging-in form a remote computer without running an SSH daemon on the Raspi.

UART TXD and RXD pins are easily accessible (GPIO 14 and 15), however, like for all GPIO pins, the voltage levels are 3.3 V and are not 5 V tolerant!

Since most of the desktop and laptop computers don’t come equipped with a serial port anymore, accessing the Raspberry Pi via a Serial Connection requires some requisites. I have recently connected to the Raspberry Pi using three different hardware setups ..

1. USB to Serial Adapter

There are many USB-to-Serial adapters available and while not all of them are capable to handle the highest data transfer speeds, the Keyspan HS-19 (OS-X drivers are available here) is certainly one of the best.
However, adapters based on the Prolific 2303 chip, like the Zonet ZUC3100, seem to be a little less expensive, well-supported in Linux, and much more widespread. Drivers for 2303 based devices can be found here, if required, use GUEST as user name and password to gain access.
E.g. I’m currently using the Mac OS X Universal Binary Driver v1.4.0 on OS X 10.8.1 without any issues.

1.1. Level Shifter

Very few of those USB-to-Serial adapters have the standard RS-232 +/- 12V voltage levels on the serial ports (the Zonet ZUC3100 w/ the pl2303 chip however does!) and using a level shifter is certainly a very good idea. Since the Raspi wants no more than 3.3V, TTL-RS-232 level converters based on the Maxim MAX3232 are your best choice.

This photo shows the blue Zonet ZUC3100 Usb-to-Serial adapter, with a Maxim MAX3232 based level shifter. Since the level shifter needs to be powered, the Raspi’s 3.3V pin (red) and Ground (black) are connected to the Level-Shifter. Yellow and Orange are used for the Transmit and Receive lines.

On OS X, a simple Terminal with the screen /dev/tty.usbserial 115200 command issued is all what is needed to connect to the Raspberry Pi. A more dedicated application like CoolTerm may become handy as well.

2. FTDI Basic 3.3V – USB to Serial.

I have a basic breakout board for the FTDI FT232RL USB to serial IC, which is mainly used to program those Arduino boards that don’t have an USB connector. It can of course also be used for general serial applications. Big benefit here is that the FTDI Basic 3.3V already provides the 3.3V levels that the Raspbi requires. The Virtual COM Port Drivers (VCP-Drivers) for the host computer are available here
Since the FTDI Basic does’t need to be powered, only the TXD and RXD pins need to be connected.

This photo shows the FTDI Basic 3.3V Usb-to-Serial adapter, with only two (TXD and RXD) pins connected to the Raspberry Pi. Again, the FTDI Basic is powered through the USB connection coming from your host PC or Laptop. Still, the Raspberry Pi needs to be powered through its micro-usb port.

3. FTDI Basic 3.3V – USB to Serial.

If you look hard and long enough, you will find USB-to-Serial Cable, 6 Female Header Wires, 3.3V I/O, like this one over here at Micro Controller Shop. Adafruit has one as well here.

Cable like these are the easiest way ever to connect to the Raspberry Pi’s serial console port, since they can also power the Raspi.

The USB-to-Serial cable (uses an FTDI FT232RQ) is a USB-to-Serial (3.3V TTL level) converter cable which allows for a simple way to connect 3.3V TTL interface devices to USB.

The 3.3V TTL signals are color coded as follows:

  • Black – GND
  • Brown – CTS
  • Red – +5V DC supply from USB
  • Orange – TXD
  • Yellow – RXD
  • Green – RTS

This photo shows the Micro Controller Shop’s FTDI based 3.3V Usb-to-Serial adapter cable, powering the Raspberry Pi, as well as connecting to its TXD and RXD pins.

Tiny WiFi Adapter for Raspberry Pi

via Wolf Paulus » Embedded

[Updated on Feb. 2. 2013 for (2012-12-16-wheezy-raspbian) Kernel Version 3.2.27+]

The extremely small EW-7811Un USB wireless adapter looks like the perfect WiFi adapter for the Raspberry Pi. Not only is it tiny and relatively inexpensive, it also seems capable enough to be a great companion device for the Raspi. While elinux still shows that some users report timeouts trying to initialize the module, I cannot verify this with 2012-12-16-wheezy-raspbian.

WiFi is not really necessary for the Raspberry Pi. It already comes with an ethernet port, provides RS-232 (aka serial-) connectivity, and has two USB ports. However, in case you wanted to add WiFi to the Raspi, this little adapter seems to be as good as any. Here is why:

The Edimax EW-7811Un

  • complies with wireless IEEE802.11b/g/n standards
  • adjust transmission output by distance and CPU offload, to reduce power consumption when wireless is idle
  • is currently the smallest wireless adapter
  • currently cost between US$ 9 and US$ 15

more than enough reasons to cut the cord and add WiFi connectivity to the Raspberry Pi.

After performing the usual initial configuration in raspi-config, using WiFi Config (a GUI tool sitting at the desktop when starting LXDE with startx) is by far the easiest way to get the Edimax EW-7811Un configured.

But let’s quickly run through the steps of creating that bootable SDCard before dealing with the actual WiFi issues:

Creating that bootable SDCard

  1. Download the image file from http://www.raspberrypi.org/downloads
  2. Unzip the file to get to the image file.
  3. df -h to determine which drive is used for the sdcard, e.g. integrated SDCard Reader turned out to be disk2 for me.
  4. sudo diskutil unmount /dev/disk2s1
  5. sudo dd bs=1m if=/Users/wolf/Downloads/2012-12-16-wheezy-raspbian.img of=/dev/rdisk2
  6. sync
  7. sudo diskutil eject /dev/rdisk2

On a class 10 SD Card, the whole process shouldn’t take much longer than 70 seconds maybe. Insert the SDCard into the Raspi, power up, boot, and use the on screen menu:

In case you need to do this over a network, the Raspberry Pi’s default hostname is raspberrypi. I.e.
ssh pi@raspberrypi .. the pasword is raspberry

sudo raspi-config
to:

  • Expand root_fs
  • Change password
  • Change locale to EN_US.UTF-8 UTF-8 (un-select english UK and select select in long list)
  • Set Time zone (America / Los_Angeles)
  • Change memory split to 128:128
  • Enable ssh

Finally reboot: sudo shutdown -r now
Running the raspi-config again to execute update feature, reboot and login.
Now finding more updates and upgrades like so:

sudo apt-get update
sudo apt-get upgrade

Changing the PI’s hostname

Edit the host name in these two locations:

  • sudo nano /etc/hostname
  • sudo nano /etc/hosts

Adding WiFi support / EW-7811Un

With previous wheezy builds, I had to install the realtek firmware, blacklist the already installed 8192cu driver and install a new one. Not this time. ifconfig shows the wlan0 interface and iwlist wlan0 scan can be used to scan for available Wifi access-points, without any firmware installation or driver updates.

/etc/wpa_supplicant/wpa_supplicant.conf

All what’s needed to do to connect the Raspberry Pi to a Wifi Network, is to add a network configuration to /etc/wpa_supplicant/wpa_supplicant.conf.

sudo nano /etc/wpa_supplicant/wpa_supplicant.conf

The network configuration depends very much on your network, SSID, Password Security etc. However, here is what I have added, to make the EW-7811Un connect to my WiFi network:


network={
ssid="MY_SSID"
psk="******"
proto=RSN
key_mgmt=WPA-PSK
pairwise=CCMP
auth_alg=OPEN
}

With the correct WiFi network configuration added to the wpa_supplicant.conf file, the ethernet cable can be removed and the Raspberry Pi will automatically switch over to WiFi.
This behavior is pre-configured in /etc/network/interfaces, which looks something like this:

auto lo

iface lo inet loopback
iface eth0 inet dhcp

allow-hotplug wlan0
iface wlan0 inet manual
wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf
iface default inet dhcp


Raspberry Pi – WiFi (Edimax EW-7811Un)

Backup the SD Card

Once done with setting up Raspian, I usually create an backup image that later can be copied onto the same or a different SD Card (of equal size).

Backup

Insert the perfect SDCard into the Card Reader and find out how to address it. Again, for me that usually is disk2s1.

sudo diskutil unmount /dev/disk2s1
sudo dd bs=1m if=/dev/rdisk2 of=~/RASP_3_2_27.img
sync
sudo diskutil eject /dev/rdisk2

Depending on the size of the SDCard, this will create a huge file (like 16GB) an may take a while (like 7min).

Restore or Copy

Insert am empty SDCard into the Card Reader and find out how to address it. Once again, for me that usually is disk2s1.

sudo diskutil unmount /dev/disk2s1
sudo dd bs=1m if=~/RASP_3_2_27.img of=/dev/rdisk2
sync
sudo diskutil eject /dev/rdisk2

Raspberry Pi – Where to start?

via Wolf Paulus » Embedded

At its core, the Raspberry Pi uses the Broadcom BCM2835 System-on-a-chip. This single chip contains

  • an ARM1176 CPU (normally clocked at 700MHz)
  • a VideoCore 4 GPU, i.e. a low-power mobile multimedia processor (also used in the Roku-2)
  • 256 MByte SDRAM
  • in addition to the ARM’s MMU, a second coarse-grained Memory Management Unit for mapping ARM physical addresses onto system bus addresses.

The memory needs to be divided into ARM and GPU memory (happens by including one of the supplied start*.elf files into the boot partition). The minimum amount of memory which can be given to the GPU is 32MB. However that will restrict the multimedia performance and 32MB does not provide enough buffering for the GPU to do 1080p30 video decoding.

The second, slightly smaller chip on the Raspberry Pi board, is an LAN9512, an USB 2.0 hub and 10/100 MBit Ethernet controllers. The LAN9512 is a low-cost, power-efficient, small-footprint USB to Ethernet and multi-port USB connectivity solution in a single package, contains a Hi-Speed USB 2.0 hub with two fully-integrated downstream USB 2.0 PHYs, an integrated upstream USB 2.0 PHY, a 10/100 Ethernet MAC/PHY controller, and an EEPROM controller.

Single-Chip, Hi-Speed USB 2.0 Hub and High-Performance 10/100 Ethernet Controllers

Boot Process

Besides the hardware board itself, starting with the boot process seems to be as good an idea as any… When the Raspberry Pi powers up, it’s the GPU that is active, looking for bootcode.bin, loader.bin, start.elf at the root dir of the first partition at the (fat formatted) SDCard. I.e., booting is hardcoded to happen from the SDCard.
The GPU reads and executes bootcode.bin, which then loads loader.bin, which loads start.elf.
Again in the root dir of the first partition it looks for config.txt, contains information like the arm speed (defaults to 700MHz), address from where to load kernel.img, etc.
Now it kernel.img (arm boot binary file) is copied it to memory and the ARM11 is reset that it runs from the address where kernel.img (default kernel_address 0×8000) was loaded.

Memory Split

The memory needs to be divided into ARM and GPU memory and currently, we have three start.elf files to choose from (see below for details).

  • arm128_start.elf: 1:1, 128MBytes for the ARM11 and 128MBytes for the GPU
  • arm192_start.elf: 3:1, 192MBytes for the ARM11 and 64MBytes for the GPU
  • arm224_start.elf: 7:1, 224MBytes for the ARM11 and 32MBytes for the GPU

Broadcom states in their BCM2835 documentation that 32MBytes might not be enough memory for the GPU and until you reach the point where 128MByte aren’t quite enough for the ARM, you may want to go with the 1:1 spit.

Minimal Boot Image and Blinky Program

Let’s put this Boot Process assumptions that were made above to the test.

  • Prepare an SDCard card (a 1 GByte Class-2 cards works just fine) by formatting it with the MS-DOS (FAT) file system.
  • Download a Raspberry Pi Distribution (currently wheezy-raspbian vers.2012-07-15), uncompress the zip file and open the resulting image file 2012-07-15-wheezy-raspbian.img, for instance with DiskImageMounter, if you are using Mac OS X.
  • Copy bootcode.bin form the wheezy-raspbian.img to the root directory of the SDCard.
  • Copy loader.bin form the wheezy-raspbian.img to the root directory of the SDCard.
  • Copy arm128_start.elf form the wheezy-raspbian.img to the root directory of the SDCard and rename it to start.elf.
  • Copy config.txt form the wheezy-raspbian.img to the root directory of the SDCard.
  • Add the following two lines to your config.txt:
    kernel blinky.bin
    kernel_address 0×8000
  • Uncompress and copy blinky.bin to the root directory of the SDCard.

Now insert the SDCard into your Raspberry Pi and power it up. If all goes well, you should see the Raspberry Pi’s OK LED blink.
The five files, which total just over 2MBytes are probably the closest and smallest you can get to an Hello_World style program for the Raspberry Pi.

Stay tuned for how to create your own Raspberry Pi Tool Chain and how to make blinky.

Tomba, the Home Explorer

via Wolf Paulus » Embedded

Tom’s LEGO NXT 2.0 based Home Explorer uses ultrasound to detect and bypass obstacles.
When driving, the NXT scans the surrounding using its ultrasound sensor. In case it gets too close to an obstacles, the NXT stops, backs-up a little, and makes a random turn (in a pre-defined range), before moving on.
Enjoy the movie, including cool onboard footage.

La Fonera Pt.9

via Wolf Paulus » Embedded

La Fonera 2.0 FON 2202 g

RedBoot details and booting into OpenWrt 8.09.1 Kamikaze

Like previously mentioned, the Fonera 2.0g (FON 2202) became available in Europe (on April 21st) and an all new 2.0n (with 802.11 N support) is expected to arrive in Europe as well as here in the US (US$ 99) in October, once again, making this the perfect time for a discovery mission into the Fonera FON 2202, which just like the FON 2100, isn’t a very complex but still a capable device.

The La Fonera 2.0 (FON 2202) developer version comes with ssh enabled but there is also the RedBoot v1.1 boot manager, which is based on the eCos real-time operating system Hardware Abstraction Layer (HAL), allows for downloading and execution of embedded applications via serial (X/Y-modem protocol) or Ethernet (TFTP protocol); there are plenty of sites that provide detailed recipes on how to get the Fonera into a state, where its bootloader becomes accessible.
RedBoot makes it easy to replace the currently deployed heavily customized Linux distribution with a more commonly used Linux distribution for wireless devices, like DD-WRT or OpenWrt.

During booting, the FON 2202, waits at IP address 192.168.1.1 on port 9000, for about 2 seconds, to receive an interrupting Control C. Meaning, if a host computer with an assigned IP of something like 192.168.1.2 is connected to the Fonara, issues this command:

echo -e "\0377\0364\0377\0375\0006" >break.bin; sudo nc -vvv 192.168.1.1 9000 < break.bin; telnet 192.168.1.1 9000

and the Fonera gets rebooted, RedBoot will pause the boot process and show the RedBoot> prompt.

Depending on the host’s OS, this can also be done, by simply launching telnet 192.168.1.1 9000 and pressing Control C. However, it may be necessary to re-configure telnet a little, for instance by putting this .telnetrc file in the user’s home directory.

# ~/.telnetrc
# Fonera 2100 Hacking
192.168.1.254 9000
mode line
# Fonera 220x Hacking
192.168.1.1
mode line

The boot process can also be interrupted, using the Fonera’s serial port (TTL, 9600, 8N1), accessible only after opening the Fonera’s enclosure. The Keyspan USA-19HS USB to Serial Adapter and a RS232 Level Shifter Adapter may be necessary accessories to access the Fonera through the serial port.

RedBoot Prompt

No matter if accessed through ethernet or serial port, entering Control C during the initial phase of the boot process will provide access to the bootloader prompt.

Entering the version command reveals that the bootloader operates in ROMRAM mode, where RedBoot resides in flash memory, but is copied to RAM memory before it starts executing. The RAM footprint is larger than for ROM mode, but it normally runs faster and it is able to update itself, i.e. the flash region where its image resides.

RedBoot> version

RedBoot(tm) bootstrap and debug environment [ROMRAM]
OpenWrt certified release, version 1.1 - built 12:40:38, Sep 3 2007

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

Board: FON 2202
RAM: 0x8000 0000-0x82000000, [0x80040290-0x80fe1000] available
FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.
RedBoot>

This output shows the Fonera’s 32 MB RAM (0×8200 0000 – 0×8000 0000 = 0×200 0000 = 33,554,432) and 8 MB Flash (0x7F0000 = 8,323,072)

Persistent State Flash-based Configuration and Control

Executing the fconfig -l command will list the configuration that is kept in FLASH memory. More details about the fconfig command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/configuring-the-redboot-environment.html.
RedBoot> fconfig -l
Run script at boot: true
Boot script:
.. fis load -l kernel
.. exec

Boot script timeout (1000ms resolution): 2
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 192.168.1.1
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.254
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
RedBoot>

Executing the fconfig -i command will interactively change and then persist the configuration. Important configuration information like the Serial Port’s communication speed (default is 9600 kbps), the TFTP server’s IP Address, or the file name of the Linux Kernel can be changed here.

RedBoot> fconfig -i
Initialize non-volatile configuration - continue (y/n)? y
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis load kernel
>> exec
>>
Boot script timeout (1000ms resolution): 5
Use BOOTP for network configuration: false
Gateway IP address:
Local IP address: 192.168.1.50
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.2
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .

fis load transfers an image from flash memory to RAM. More details about the fis command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/fis-load-command.html.

http://ecos.sourceware.org/docs-latest/redboot/fis-load-command.html

Flash Image System (FIS)

The Fonera’s Flash Image System can be accessed and modified using the fis.

  • fis init — Initialize Flash Image System
  • fis list — List Flash Image System directory
  • fis free — Free flash image
  • fis create — Create flash image
  • fis load — Load flash image
  • fis delete — Delete flash image
  • fis lock — Lock flash area
  • fis unlock — Unlock flash area
  • fis erase — Erase flash area
  • fis write — Write flash area

More details about the fis command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/flash-image-system.html.

fis list

More details about fis list can be found can be found here: http://ecos.sourceware.org/docs-latest/redboot/fis-list-command.html
list lists the images currently available in the FIS.

RedBoot> fis list

Name FLASH addr Mem addr Length Entry point

RedBoot 0xA8000000 0xA8000000 0×00030000 0×00000000

FIS directory 0xA87E0000 0xA87E0000 0x0000F000 0×00000000

RedBoot config 0xA87EF000 0xA87EF000 0×00001000 0×00000000

RedBoot>

  • RedBoot – the bootloader itself, occupying about 192 KByte
  • FIS directory – a Partition Table, about 60 KByte, without it, RedBoot wouldn’t know what to load and boot.
  • RedBoot config – 4 Kbyte, contains the configuration for the bootloader.

Deleting all but the boot blocks is as simple as issuing the fis init command.
Here, the fis init command is executed followed by a fis list and a fis free

RedBoot> fis init

About to initialize [format] FLASH image system – continue (y/n)? y

*** Initialize FLASH Image System

… Erase from 0xa87e0000-0xa87f0000: .

… Program from 0x80ff0000-0×81000000 at 0xa87e0000: .

RedBoot> fis list

Name FLASH addr Mem addr Length Entry point

RedBoot 0xA8000000 0xA8000000 0×00030000 0×00000000

FIS directory 0xA87E0000 0xA87E0000 0x0000F000 0×00000000

RedBoot config 0xA87EF000 0xA87EF000 0×00001000 0×00000000

RedBoot> fis free

0xA8030000 .. 0xA87E0000

RedBoot>

Running reset shows that the OS has been removed and the Fonera now boots into the bootloader prompt.

RedBoot> reset

?Ethernet eth0: MAC address 00:18:84:**:**:**

IP: 192.168.1.50/255.255.255.0, Gateway: 0.0.0.0

Default server: 192.168.1.2

RedBoot(tm) bootstrap and debug environment [ROMRAM]

OpenWrt certified release, version 1.1 – built 12:40:38, Sep 3 2007

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

Board: FON 2202

RAM: 0×80000000-0×82000000, [0x80040290-0x80fe1000] available

FLASH: 0xa8000000 – 0xa87f0000, 128 blocks of 0×00010000 bytes each.

== Executing boot script in 5.000 seconds – enter ^C to abort

RedBoot> fis load loader

No image ‘loader’ found

RedBoot> exec

Can’t execute Linux – invalid entry address

RedBoot>

Running telnet 192.168.1.50 9000 will also immediately show the RedBoot prompt now:wpbook:~ wolf$ telnet 192.168.1.50 9000
Trying 192.168.1.50...
Connected to 192.168.1.50.
Escape character is '^]'.

RedBoot>

OpenWrt

Running the fis init command on the Fonera removes the OS and the only software available on the device now is the bootloader, i.e., we now need a new Linux distribution for this embedded device to bring it back to life. OpenWrt is one of the options and freely available via subversion.
cd ~/Work/Embedded/OpenWrt/branches/8.09.1
svn co svn://svn.openwrt.org/openwrt/tags/8.09.1 8.09.1

Generally, the following tools need to be pre-installed and if building on OS X, MacPorts and Porticus are recommended to simplify their installation.

  • gcc
  • binutils
  • patch
  • bzip2
  • flex
  • bison
  • make
  • gettext
  • pkg-config
  • unzip
  • libz-dev
  • libc headers
  • autoconf
  • bison
  • ccache
  • flex
  • gawk
  • libncurses-dev.
  • svn
  • ccache

With OpenWrt Kamikaze 8.09.1 and all the tools downloaded, issuing make menuconfig will bring show the OpenWrt Configuration Menu where the Atheros 231x/5312 [2.6] target needs to be selected. To keep the initial image small, the following unessential tools can be deselected:

  • Base System: bridge, firewall, iptables, opkg, uci, uclibc
  • Network: ppp

Executing make after saving the configuration, results in deployable kernel image and root file system, both of which can be found here: ~/Work/Embedded/OpenWrt/barnches/8.09.1/bin/. Look for

  • openwrt-atheros-vmlinux.lzma – (kernel) about 700 KB
  • openwrt-atheros-root.squashfs – (root fs) about 900 KB

The image can be hosted using either an HTTP-Webserver or a TFTP server, like Fabrizio La Rosa’s.

Load The Kernel Image

.. back on the device in RedBoot ..

ip_address

More details about ip_address here: http://ecos.sourceware.org/docs-latest/redboot/ip-address-command.html
ip_address sets the IP address of the default server. Use of this address is implied by other commands, such as load.

RedBoot> ip_address -h 192.168.1.2
IP: 192.168.1.50/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2
RedBoot>

load

More details about load can be found can be found here: http://ecos.sourceware.org/docs-latest/redboot/download-command.html
load downloads programs or data to the RedBoot platform. By default RedBoot loads images into some free RAM area which can be addressed later using the variable %{FREEMEMLO}.
-r specifies raw (or binary) data, which also implies that -b or -f must be used.
-b address in memory to load the data. Formatted data streams will have an implied load address, which this option may override.
-f address in flash to load the data. Formatted data streams will have an implied load address, which this option may override.

RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma
Using default protocol (TFTP)
Raw file loaded 0x80040400-0x801203ff, assumed entry at 0x80040400
RedBoot>

fis create

More details about fis create here: http://ecos.sourceware.org/docs-latest/redboot/fis-create-command.html.
This command creates an image in the FIS directory and obviously, the data for the image must exist in RAM memory before it can be copied. By default,fis create takes the data loaded by the last load command as input for a partition starting at the first free block of the flash space. Important are the values for the RAM address (-r) and entry point (-e), which are linux specific and need to have exactly these values. The partition name ‘kernel’ is configured within RedBoot (see above) as the default boot partition’s name and is of course changeable.

RedBoot> fis create -e 0x80041000 -r 0x80041000 kernel
... Erase from 0xa8030000-0xa8110000: ..............
... Program from 0x80040400-0x80120400 at 0xa8030000: ..............
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>

Load The Rootfs Image

Before loading the root filesystem, we issue fis list and fis free once again:

RedBoot> fis list
Name FLASH addr Mem addr Length Entry point
RedBoot 0xA8000000 0xA8000000 0x00030000 0x00000000
kernel 0xA8030000 0x80041000 0x000E0000 0x80041000
FIS directory 0xA87E0000 0xA87E0000 0x0000F000 0x00000000
RedBoot config 0xA87EF000 0xA87EF000 0x00001000 0x00000000

RedBoot> fis free
0xA8110000 .. 0xA87E0000

RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-root.squashfs
Using default protocol (TFTP)
Raw file loaded 0x80040400-0x801a03ff, assumed entry at 0x80040400

The information provided by fis free is now used like this:
0xA87E0000 minus 0xA8110000 = 0x6D0000, which is used to create the Root-Filesystem rootfs:

RedBoot> fis create -l 0x6D0000 rootfs
... Erase from 0xa8110000-0xa87e0000: ..........................................
... Program from 0x80040400-0x801a0400 at 0xa8110000: ......................
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>

Reset

This time, running reset will boot the Fonera into OpenWrt 8.09.1 …
RedBoot> reset

+Ethernet eth0: MAC address 00:18:84:**:**:**

IP: 192.168.1.50/255.255.255.0, Gateway: 0.0.0.0

Default server: 192.168.1.2

RedBoot(tm) bootstrap and debug environment [ROMRAM]

OpenWrt certified release, version 1.1 – built 12:40:38, Sep 3 2007

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

Board: FON 2202

RAM: 0×80000000-0×82000000, [0x80040290-0x80fe1000] available

FLASH: 0xa8000000 – 0xa87f0000, 128 blocks of 0×00010000 bytes each.

== Executing boot script in 5.000 seconds – enter ^C to abort

RedBoot> fis load -l kernel

Image loaded from 0×80041000-0×80313085

RedBoot> exec

Now booting linux kernel:

Base address 0×80030000 Entry 0×80041000

Cmdline :

Linux version 2.6.26.8 (wolf@wpbook) (gcc version 4.1.2) #2 Sat Jul 25 16:51:53 PDT 2009

CPU revision is: 00019064 (MIPS 4KEc)

Determined physical RAM map:

memory: 02000000 @ 00000000 (usable)

Initrd not found or empty – disabling initrd

Zone PFN ranges:

Normal 0 -> 8192

Movable zone start PFN for each node

early_node_map[1] active PFN ranges

0: 0 -> 8192

Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128

Kernel command line: console=ttyS0,9600 rootfstype=squashfs,jffs2 init=/etc/preinit ip=192.168.1.50

Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes.

Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 16 bytes

PID hash table entries: 128 (order: 7, 512 bytes)

console [ttyS0] enabled

Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)

Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)

Memory: 29176k/32768k available (2369k kernel code, 3592k reserved, 385k data, 136k init, 0k highme)

SLUB: Genslabs=6, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1

Mount-cache hash table entries: 512

net_namespace: 484 bytes

NET: Registered protocol family 16

Radio config found at offset 0xf8(0x1f8)

AR531x PCI init…

done

PCI: fixing up device 0,3,0

PCI: Failed to allocate mem resource #1:4000000@84000000 for 0000:00:03.0

NET: Registered protocol family 2

IP route cache hash table entries: 1024 (order: 0, 4096 bytes)

TCP established hash table entries: 1024 (order: 1, 8192 bytes)

TCP bind hash table entries: 1024 (order: 0, 4096 bytes)

TCP: Hash tables configured (established 1024 bind 1024)

TCP reno registered

NET: Registered protocol family 1

ar531x: Registering GPIODEV device

squashfs: version 3.0 (2006/03/15) Phillip Lougher

Registering mini_fo version $Id$

Installing knfsd (copyright (C) 1996 okir@monad.swb.de).

JFFS2 version 2.2. (NAND) (SUMMARY) ?© 2001-2006 Red Hat, Inc.

msgmni has been set to 56

io scheduler noop registered

io scheduler deadline registered (default)

gpiodev: gpio device registered with major 254

gpiodev: gpio platform device registered with access mask FFFFFFFF

Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing disabled

serial8250: ttyS0 at MMIO 0xb1100003 (irq = 37) is a 16550A

eth0: Atheros AR231x: 00:18:84:**:**:**, irq 4

ar2313_eth_mii: probed

eth0: Marvell 88E6060 PHY driver attached.

eth0: attached PHY driver [Marvell 88E6060] (mii_bus:phy_addr=0:1f)

cmdlinepart partition parsing not available

Searching for RedBoot partition table in spiflash at offset 0x7d0000

Searching for RedBoot partition table in spiflash at offset 0x7e0000

6 RedBoot partitions found on MTD device spiflash

Creating 6 MTD partitions on “spiflash”:

0×00000000-0×00030000 : “RedBoot”

0×00030000-0×00110000 : “kernel”

0×00110000-0x007e0000 : “rootfs”

mtd: partition “rootfs” set to be root filesystem

mtd: partition “rootfs_data” created automatically, ofs=250000, len=590000

0×00250000-0x007e0000 : “rootfs_data”

0x007e0000-0x007ef000 : “FIS directory”

0x007ef000-0x007f0000 : “RedBoot config”

0x007f0000-0×00800000 : “boardconfig”

Registered led device: gpio1

Registered led device: wlan

Registered led device: gpio3

Registered led device: gpio4

Registered led device: gpio7

eth0: Configuring MAC for full duplex

TCP vegas registered

NET: Registered protocol family 17

RPC: Registered udp transport module.

RPC: Registered tcp transport module.

802.1Q VLAN Support v1.8 Ben Greear greearb@candelatech.com

All bugs added by David S. Miller davem@redhat.com

IP-Config: Guessing netmask 255.255.255.0

IP-Config: Complete:

device=eth0, addr=192.168.1.50, mask=255.255.255.0, gw=255.255.255.255,

host=192.168.1.50, domain=, nis-domain=(none),

bootserver=255.255.255.255, rootserver=255.255.255.255, rootpath=

VFS: Mounted root (squashfs filesystem) readonly.

Freeing unused kernel memory: 136k freed

Please be patient, while OpenWrt loads …

Algorithmics/MIPS FPU Emulator v1.5

- preinit -

Press CTRL-C for failsafe

switching to jffs2

mini_fo: using base directory: /

mini_fo: using storage directory: /jffs

- init -

Please press Enter to activate this console. PPP generic driver version 2.4.2

device eth0.0 entered promiscuous mode

device eth0 entered promiscuous mode

br-lan: port 1(eth0.0) entering learning state

br-lan: topology change detected, propagating

br-lan: port 1(eth0.0) entering forwarding state

ip_tables: (C) 2000-2006 Netfilter Core Team

nf_conntrack version 0.5.0 (1024 buckets, 4096 max)

wlan: trunk

ath_hal: module license ‘Proprietary’ taints kernel.

ath_hal: 2009-05-08 (AR5212, AR5312, RF5111, RF5112, RF2316, RF2317, REGOPS_FUNC, TX_DESC_SWAP, XR)

ath_rate_minstrel: Minstrel automatic rate control algorithm 1.2 (trunk)

ath_rate_minstrel: look around rate set to 10%

ath_rate_minstrel: EWMA rolloff level set to 75%

ath_rate_minstrel: max segment size in the mrr set to 6000 us

wlan: mac acl policy registered

ath_ahb: trunk

Atheros HAL provided by OpenWrt, DD-WRT and MakSat Technologies

wifi0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps

wifi0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps

wifi0: turboG rates: 6Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps

wifi0: H/W encryption support: WEP AES AES_CCM TKIP

ath_ahb: wifi0: Atheros 2315 WiSoC: mem=0xb0000000, irq=3

La Fonera Pt.8

via Wolf Paulus » Embedded

La Fonera 2.0 FON 2100 a/b/c

RedBoot details and booting into OpenWrt 8.09.1 Kamikaze

Some blog post take a little longer to write and this was certainly one of those. It wasn’t so much the writing but the building of the tools and tool-chain, running all the tests and scripts, and just to get things right.
The Fonera 2.0g (FON 2202) became available in Europe (on April 21st) and an all new 2.0n (with 802.11 N support) is expected to arrive in Europe as well as here in the US (US$ 99) in October, making this the perfect time for a discovery mission into the Fonera FON 2100, which isn’t a very complex piece hardware but still a very capable device.

The La Fonera 2.0 (FON 2100) doesn’t come with ssh enabled but its RedBoot v1.3.0 boot manager, which is based on the eCos real-time operating system Hardware Abstraction Layer (HAL), allows for downloading and execution of embedded applications via serial (X/Y-modem protocol) or Ethernet (TFTP protocol); there are plenty of sites that provide detailed recipes on how to get the Fonera into a state, where its bootloader becomes accessible.
RedBoot makes it easy to replace the currently deployed heavily customized Linux distribution with a more commonly used Linux distribution for wireless devices, like DD-WRT or OpenWrt.

During booting, the FON 2100, waits at IP address 192.168.1.254 on port 9000, for about 10 seconds, to receive an interrupting Control C. Meaning, if a host computer with an assigned IP of something like 192.168.1.2 is connected to the Fonara, issues this command:

echo -e "\0377\0364\0377\0375\0006" >break.bin; sudo nc -vvv 192.168.1.254 9000 < break.bin; telnet 192.168.1.254 9000

and the Fonera gets rebooted, RedBoot will pause the boot process and show the RedBoot> prompt.

Depending on the host’s OS, this can also be done, by simply launching telnet 192.168.1.254 9000 and pressing Control C. However, it may be necessary to re-configure telnet a little, for instance by putting this .telnetrc file in the user’s home directory.

# ~/.telnetrc
# Fonera 2100 Hacking
192.168.1.254 9000
mode line
# Fonera 220x Hacking
192.168.1.1
mode line

The boot process can also be interrupted, using the Fonera’s serial port (TTL, 9600, 8N1), accessible only after opening the Fonera’s enclosure. The Keyspan USA-19HS USB to Serial Adapter and a RS232 Level Shifter Adapter may be necessary accessories to access the Fonera through the serial port.

RedBoot Prompt

No matter if accessed through ethernet or serial port, entering Control C during the initial phase of the boot process will provide access to the bootloader prompt.

Entering the version command reveals that the bootloader operates in ROMRAM mode, where RedBoot resides in flash memory, but is copied to RAM memory before it starts executing. The RAM footprint is larger than for ROM mode, but it normally runs faster and it is able to update itself, i.e. the flash region where its image resides.

RedBoot> version

RedBoot(tm) bootstrap and debug environment [ROMRAM]
Non-certified release, version v1.3.0 - built 16:57:58, Aug 7 2006

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

Board: ap51
RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] available
FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.
RedBoot>

This output shows that of the Fonera’s 16 MB RAM (0×81000000 – 0×80000000 = 0×1000000 = 16,777,216) almost all (0x80fe1000 – 0×80040450 =0xFA0BB0 = 16,386,992) is available. An OS is still stored in the 8 MB Flash (0x7F0000 = 8,323,072) i.e. 64K are occupied.

Board Information

Entering the bdshow command reveals the Atheros Board Data information

RedBoot> bdshow
name: MR3201A-FLF-FON
magic: 35333131
cksum: 5eb3
rev: 5
major: 1
minor: 0
pciid: 0013
wlan0: yes 00:18:84:**:**:**
wlan1: no ff:ff:ff:ff:ff:ff
enet0: yes 00:18:84:**:**:**
enet1: no ff:ff:ff:ff:ff:ff
localbus: no ff:ff:ff:ff:ff:ff
PCI: no ff:ff:ff:ff:ff:ff
uart0: yes
sysled: yes, gpio 2
factory: yes, gpio 6
serclk: external
cpufreq: configured -1 Hz
sysfreq: configured -1 Hz
memcap: disabled
watchdg: enabled
serialNo: 8647******
RedBoot>

Persistent State Flash-based Configuration and Control

Executing the fconfig -l command will list the configuration that is kept in FLASH memory. More details about the fconfig command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/configuring-the-redboot-environment.html.

RedBoot> fconfig -l
Run script at boot: true
Boot script:

Boot script timeout (1000ms resolution): 10
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 192.168.1.254
Local IP address mask: 255.255.255.0
Default server IP address: 0.0.0.0
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false

Executing the fconfig -i command will interactively change and then persist the configuration. Important configuration information like the Serial Port’s communication speed (default is 9600 kbps), the TFTP server’s IP Address, or the file name of the Linux Kernel can be changed here.

RedBoot> fconfig -i
Initialize non-volatile configuration - continue (y/n)? y
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis load -l vmlinux.bin.l7
>> exec
>>
Boot script timeout (1000ms resolution): 5
Use BOOTP for network configuration: false
Gateway IP address:
Local IP address: 192.168.1.1
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.2
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .

fis load transfers an image from flash memory to RAM. More details about the fis command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/fis-load-command.html.

Flash Image System (FIS)

The Fonera’s Flash Image System can be accessed and modified using the fis.

  • fis init — Initialize Flash Image System
  • fis list — List Flash Image System directory
  • fis free — Free flash image
  • fis create — Create flash image
  • fis load — Load flash image
  • fis delete — Delete flash image
  • fis lock — Lock flash area
  • fis unlock — Unlock flash area
  • fis erase — Erase flash area
  • fis write — Write flash area

More details about the fis command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/flash-image-system.html.
Deleting all but the boot blocks is as simple as issuing the fis init command. Here, the fis init command is executed followed by a fis list and a fis free

Running reset shows that the OS has been removed and the Fonera now boots into the bootloader prompt.

RedBoot> reset
+PHY ID is 0022:5521
Ethernet eth0: MAC address 00:18:84:**:**:**
IP: 192.168.1.254/255.255.255.0, Gateway: 0.0.0.0
Default server: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [ROMRAM]
Non-certified release, version v1.3.0 - built 16:57:58, Aug 7 2006

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

Board: ap51
RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] available
FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.
== Executing boot script in 10.000 seconds - enter ^C to abort
RedBoot>

Running telnet 192.168.1.254 9000 will also immediately show the RedBoot prompt now:

wpbook:~ wolf$ telnet 192.168.1.254 9000
Trying 192.168.1.254...
?Invalid command: 9000
Connected to 192.168.1.254.
Escape character is '^]'.
RedBoot>

OpenWrt

Running the fis init command on the Fonera removes the OS and the only software available on the device now is the bootloader, i.e., we now need a new Linux distribution for this embedded device to bring it back to life. OpenWrt is one of the options and freely available via subversion.
cd ~/Work/Embedded/OpenWrt/branches/8.09.1
svn co svn://svn.openwrt.org/openwrt/tags/8.09.1 8.09.1

Generally, the following tools need to be pre-installed and if building on OS X, MacPorts and Porticus are recommended to simplify their installation.

  • gcc
  • binutils
  • patch
  • bzip2
  • flex
  • bison
  • make
  • gettext
  • pkg-config
  • unzip
  • libz-dev
  • libc headers
  • autoconf
  • bison
  • ccache
  • flex
  • gawk
  • libncurses-dev.
  • svn
  • ccache

With OpenWrt Kamikaze 8.09.1 and all the tools downloaded, issuing make menuconfig will bring show the OpenWrt Configuration Menu where the Atheros 231x/5312 [2.6] target needs to be selected. To keep the initial image small, the following unessential tools can be deselected:

  • Base System: bridge, firewall, iptables, opkg, uci, uclibc
  • Network: ppp

Executing make after saving the configuration, results in deployable kernel image and root file system, both of which can be found here: ~/Work/Embedded/OpenWrt/barnches/8.09.1/bin/. Look for

  • openwrt-atheros-vmlinux.lzma – (kernel) about 700 KB
  • openwrt-atheros-root.squashfs – (root fs) about 900 KB

The image can be hosted using either an HTTP-Webserver or a TFTP server, like Fabrizio La Rosa’s.

Load The Kernel Image

.. back on the device in RedBoot ..

ip_address

More details about ip_address here: http://ecos.sourceware.org/docs-latest/redboot/ip-address-command.html
ip_address sets the IP address of the default server. Use of this address is implied by other commands, such as load.

RedBoot> ip_address -h 192.168.1.2
IP: 192.168.1.254/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2
RedBoot>

load

More details about load can be found can be found here: http://ecos.sourceware.org/docs-latest/redboot/download-command.html
load downloads programs or data to the RedBoot platform. By default RedBoot loads images into some free RAM area which can be addressed later using the variable %{FREEMEMLO}.
-r specifies raw (or binary) data, which also implies that -b or -f must be used.
-b address in memory to load the data. Formatted data streams will have an implied load address, which this option may override.
-f address in flash to load the data. Formatted data streams will have an implied load address, which this option may override.

RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma
Using default protocol (TFTP)
Raw file loaded 0x80040800-0x800f07ff, assumed entry at 0x80040800
RedBoot>

fis create

More details about fis create here: http://ecos.sourceware.org/docs-latest/redboot/fis-create-command.html.
This command creates an image in the FIS directory and obviously, the data for the image must exist in RAM memory before it can be copied. By default,fis create takes the data loaded by the last load command as input for a partition starting at the first free block of the flash space. Important are the values for the RAM address (-r) and entry point (-e), which are linux specific and need to have exactly these values. The partition name ‘vmlinux.bin.l7′ is configured within RedBoot (see above) as the default boot partition’s name and is of course changeable.

RedBoot> fis create -e 0x80041000 -r 0x80041000 vmlinux.bin.l7
... Erase from 0xa8030000-0xa80e0000: ...........
... Program from 0x80040800-0x800f0800 at 0xa8030000: ...........
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>

Load The Rootfs Image

Before loading the root filesystem, we issue fis list and fis free once again:

RedBoot> fis list
Name FLASH addr Mem addr Length Entry point
RedBoot 0xA8000000 0xA8000000 0x00030000 0x00000000
vmlinux.bin.l7 0xA8030000 0x80041000 0x000B0000 0x80041000
FIS directory 0xA87E0000 0xA87E0000 0x0000F000 0x00000000
RedBoot config 0xA87EF000 0xA87EF000 0x00001000 0x00000000

RedBoot> fis free
0xA80E0000 .. 0xA87E0000

RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-root.squashfs
Using default protocol (TFTP)
Raw file loaded 0x80040800-0x801207ff, assumed entry at 0x80040800

The information provided by fis free is now used like this:
0xA87E0000 minus 0xA80E0000 = 0×700000, which is used to create the Root-Filesystem rootfs:

RedBoot> fis create -l 0x700000 rootfs
... Erase from 0xa80e0000-0xa87e0000: ................................................................................................................
... Program from 0x80040800-0x80120800 at 0xa80e0000: ..............
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>

Reset

This time, running reset will boot the Fonera into OpenWrt …
RedBoot> reset

La Fonera Pt.7

via Wolf Paulus » Embedded

La Fonera 2.0 Preview

The Fonera 2.0 just became available in Europe (on April 21st) and is expected to arrive here in the US in May, making this the perfect time for taking a first look at the new 2.0 software.

I had gotten my hands on the La Fonera 2.0 beta hardware back in December 2008 and had deployed an OpenWrt 8.09 RC release soon there after, which was still on there. This meant that I needed to somehow reflash the router with the new loader and firmware before I could see what the new Software was all about.

Putting The Original (Or Newer) Firmware Back On A Fonera FON 2.0

During booting, the FON 2200, waits at IP address 192.168.1.1 on port 9000, for a brief moment, to receive an interrupting Control-C. The process of how to get to the bootloader prompt is described in some detail over here: La Fonera 2.0 (FON 2202) Hacking, Cleaning House

Files

The following 3 files are required during re-flashing and need to be made available to the router via TFTP.

Also, check here for a more current Fonera 2 image: http://download.fonosfera.org

RedBoot Prompt

Here are steps required to put the three files back on the fonera router. Writing to flash takes some time, especially the last step, in which a 4.4 MBytes are written, requires some patience.

#========================================================
# Reset the current flash and the partition table
#========================================================
RedBoot> fis init
About to initialize [format] FLASH image system – continue (y/n)? y
*** Initialize FLASH Image System
… Erase from 0xa87e0000-0xa87f0000: .
… Program from 0x80ff0000-0×81000000 at 0xa87e0000: .

#========================================================
# Tell RedBoot about the TFTP-Server’s IP
#========================================================
RedBoot> ip_address -l 192.168.1.1/24 -h 192.168.1.2
IP: 192.168.1.1/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2

#========================================================
# write the 2nd stage bootloader into flash
#========================================================
RedBoot> load -r -b %{FREEMEMLO} loader.bin
Using default protocol (TFTP)
Raw file loaded 0×80040400-0x800503ff, assumed entry at 0×80040400

RedBoot> fis create -e 0×80100000 -r 0×80100000 loader
… Erase from 0xa8030000-0xa8040000: .
… Program from 0×80040400-0×80050400 at 0xa8030000: .
… Erase from 0xa87e0000-0xa87f0000: .
… Program from 0x80ff0000-0×81000000 at 0xa87e0000: .

#========================================================
# load into RAM and write the failsafe image into flash
#========================================================
RedBoot> load -r -b %{FREEMEMLO} failsafe.image
Using default protocol (TFTP)
Raw file loaded 0×80040400-0x801803ff, assumed entry at 0×80040400

RedBoot> fis create -f 0xA8660000 image2
… Erase from 0xa8660000-0xa87a0000: ………………..
… Program from 0×80040400-0×80180400 at 0xa8660000: ………………..
… Erase from 0xa87e0000-0xa87f0000: .
… Program from 0x80ff0000-0×81000000 at 0xa87e0000: .

#========================================================
# load into RAM and write the image (4+ MB) into flash
#========================================================
RedBoot> load -r -b %{FREEMEMLO} flipper.image
Using default protocol (TFTP)
Raw file loaded 0×80040400-0x804b0403, assumed entry at 0×80040400

RedBoot> fis create image
… Erase from 0xa8040000-0xa84b0004: ………………………………………………………………
… Program from 0×80040400-0x804b0404 at 0xa8040000: ………………………………………………………………
… Erase from 0xa87e0000-0xa87f0000: .
… Program from 0x80ff0000-0×81000000 at 0xa87e0000: .
RedBoot>

When the re-flashing is finally done, all what’s left to do to is to reboot the router.

Fonera 2.0 UI