La Fonera 2.0 FON 2202 g
RedBoot details and booting into OpenWrt 8.09.1 Kamikaze
Like previously mentioned, the Fonera 2.0g (FON 2202) became available in Europe (on April 21st) and an all new 2.0n (with 802.11 N support) is expected to arrive in Europe as well as here in the US (US$ 99) in October, once again, making this the perfect time for a discovery mission into the Fonera FON 2202, which just like the FON 2100, isn’t a very complex but still a capable device.
The La Fonera 2.0 (FON 2202) developer version comes with ssh enabled but there is also the RedBoot v1.1 boot manager, which is based on the eCos real-time operating system Hardware Abstraction Layer (HAL), allows for downloading and execution of embedded applications via serial (X/Y-modem protocol) or Ethernet (TFTP protocol); there are plenty of sites that provide detailed recipes on how to get the Fonera into a state, where its bootloader becomes accessible.
RedBoot makes it easy to replace the currently deployed heavily customized Linux distribution with a more commonly used Linux distribution for wireless devices, like DD-WRT or OpenWrt.
During booting, the FON 2202, waits at IP address 192.168.1.1 on port 9000, for about 2 seconds, to receive an interrupting Control C. Meaning, if a host computer with an assigned IP of something like 192.168.1.2 is connected to the Fonara, issues this command:
echo -e "\0377\0364\0377\0375\0006" >break.bin; sudo nc -vvv 192.168.1.1 9000 < break.bin; telnet 192.168.1.1 9000
and the Fonera gets rebooted, RedBoot will pause the boot process and show the RedBoot> prompt.
Depending on the host’s OS, this can also be done, by simply launching telnet 192.168.1.1 9000 and pressing Control C. However, it may be necessary to re-configure telnet a little, for instance by putting this .telnetrc file in the user’s home directory.

# ~/.telnetrc
# Fonera 2100 Hacking
192.168.1.254 9000
mode line
# Fonera 220x Hacking
192.168.1.1
mode line
The boot process can also be interrupted, using the Fonera’s serial port (TTL, 9600, 8N1), accessible only after opening the Fonera’s enclosure. The Keyspan USA-19HS USB to Serial Adapter and a RS232 Level Shifter Adapter may be necessary accessories to access the Fonera through the serial port.
RedBoot Prompt
No matter if accessed through ethernet or serial port, entering Control C during the initial phase of the boot process will provide access to the bootloader prompt.
Entering the version command reveals that the bootloader operates in ROMRAM mode, where RedBoot resides in flash memory, but is copied to RAM memory before it starts executing. The RAM footprint is larger than for ROM mode, but it normally runs faster and it is able to update itself, i.e. the flash region where its image resides.
RedBoot> version
RedBoot(tm) bootstrap and debug environment [ROMRAM]
OpenWrt certified release, version 1.1 - built 12:40:38, Sep 3 2007
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.
Board: FON 2202
RAM: 0x8000 0000-0x82000000, [0x80040290-0x80fe1000] available
FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.
RedBoot>
This output shows the Fonera’s 32 MB RAM (0×8200 0000 – 0×8000 0000 = 0×200 0000 = 33,554,432) and 8 MB Flash (0x7F0000 = 8,323,072)
Persistent State Flash-based Configuration and Control
Executing the fconfig -l command will list the configuration that is kept in FLASH memory. More details about the fconfig command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/configuring-the-redboot-environment.html.
RedBoot> fconfig -l
Run script at boot: true
Boot script:
.. fis load -l kernel
.. exec
Boot script timeout (1000ms resolution): 2
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 192.168.1.1
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.254
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
RedBoot>
Executing the fconfig -i command will interactively change and then persist the configuration. Important configuration information like the Serial Port’s communication speed (default is 9600 kbps), the TFTP server’s IP Address, or the file name of the Linux Kernel can be changed here.
RedBoot> fconfig -i
Initialize non-volatile configuration - continue (y/n)? y
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis load kernel
>> exec
>>
Boot script timeout (1000ms resolution): 5
Use BOOTP for network configuration: false
Gateway IP address:
Local IP address: 192.168.1.50
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.2
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
fis load transfers an image from flash memory to RAM. More details about the fis command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/fis-load-command.html.
http://ecos.sourceware.org/docs-latest/redboot/fis-load-command.html
Flash Image System (FIS)
The Fonera’s Flash Image System can be accessed and modified using the fis.
- fis init — Initialize Flash Image System
- fis list — List Flash Image System directory
- fis free — Free flash image
- fis create — Create flash image
- fis load — Load flash image
- fis delete — Delete flash image
- fis lock — Lock flash area
- fis unlock — Unlock flash area
- fis erase — Erase flash area
- fis write — Write flash area
More details about the fis command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/flash-image-system.html.
fis list
RedBoot> fis list
Name FLASH addr Mem addr Length Entry point
RedBoot 0xA8000000 0xA8000000 0×00030000 0×00000000
FIS directory 0xA87E0000 0xA87E0000 0x0000F000 0×00000000
RedBoot config 0xA87EF000 0xA87EF000 0×00001000 0×00000000
RedBoot>
- RedBoot – the bootloader itself, occupying about 192 KByte
- FIS directory – a Partition Table, about 60 KByte, without it, RedBoot wouldn’t know what to load and boot.
- RedBoot config – 4 Kbyte, contains the configuration for the bootloader.
Deleting all but the boot blocks is as simple as issuing the fis init command.
Here, the fis init command is executed followed by a fis list and a fis free
RedBoot> fis init
About to initialize [format] FLASH image system – continue (y/n)? y
*** Initialize FLASH Image System
… Erase from 0xa87e0000-0xa87f0000: .
… Program from 0x80ff0000-0×81000000 at 0xa87e0000: .
RedBoot> fis list
Name FLASH addr Mem addr Length Entry point
RedBoot 0xA8000000 0xA8000000 0×00030000 0×00000000
FIS directory 0xA87E0000 0xA87E0000 0x0000F000 0×00000000
RedBoot config 0xA87EF000 0xA87EF000 0×00001000 0×00000000
RedBoot> fis free
0xA8030000 .. 0xA87E0000
RedBoot>
Running reset shows that the OS has been removed and the Fonera now boots into the bootloader prompt.
RedBoot> reset
?Ethernet eth0: MAC address 00:18:84:**:**:**
IP: 192.168.1.50/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2
RedBoot(tm) bootstrap and debug environment [ROMRAM]
OpenWrt certified release, version 1.1 – built 12:40:38, Sep 3 2007
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.
Board: FON 2202
RAM: 0×80000000-0×82000000, [0x80040290-0x80fe1000] available
FLASH: 0xa8000000 – 0xa87f0000, 128 blocks of 0×00010000 bytes each.
== Executing boot script in 5.000 seconds – enter ^C to abort
RedBoot> fis load loader
No image ‘loader’ found
RedBoot> exec
Can’t execute Linux – invalid entry address
RedBoot>
Running
telnet 192.168.1.50 9000 will also immediately show the RedBoot prompt now:
wpbook:~ wolf$ telnet 192.168.1.50 9000
Trying 192.168.1.50...
Connected to 192.168.1.50.
Escape character is '^]'.
RedBoot>
OpenWrt
Running the fis init command on the Fonera removes the OS and the only software available on the device now is the bootloader, i.e., we now need a new Linux distribution for this embedded device to bring it back to life. OpenWrt is one of the options and freely available via subversion.
cd ~/Work/Embedded/OpenWrt/branches/8.09.1
svn co svn://svn.openwrt.org/openwrt/tags/8.09.1 8.09.1
Generally, the following tools need to be pre-installed and if building on OS X, MacPorts and Porticus are recommended to simplify their installation.
- gcc
- binutils
- patch
- bzip2
- flex
- bison
- make
- gettext
- pkg-config
- unzip
- libz-dev
- libc headers
- autoconf
- bison
- ccache
- flex
- gawk
- libncurses-dev.
- svn
- ccache
With OpenWrt Kamikaze 8.09.1 and all the tools downloaded, issuing make menuconfig will bring show the OpenWrt Configuration Menu where the Atheros 231x/5312 [2.6] target needs to be selected. To keep the initial image small, the following unessential tools can be deselected:
- Base System: bridge, firewall, iptables, opkg, uci, uclibc
- Network: ppp

Executing make after saving the configuration, results in deployable kernel image and root file system, both of which can be found here: ~/Work/Embedded/OpenWrt/barnches/8.09.1/bin/. Look for
- openwrt-atheros-vmlinux.lzma – (kernel) about 700 KB
- openwrt-atheros-root.squashfs – (root fs) about 900 KB
The image can be hosted using either an HTTP-Webserver or a TFTP server, like Fabrizio La Rosa’s.

Load The Kernel Image
.. back on the device in RedBoot ..
ip_address
More details about ip_address here: http://ecos.sourceware.org/docs-latest/redboot/ip-address-command.html
ip_address sets the IP address of the default server. Use of this address is implied by other commands, such as load.
RedBoot> ip_address -h 192.168.1.2
IP: 192.168.1.50/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2
RedBoot>
load
More details about load can be found can be found here: http://ecos.sourceware.org/docs-latest/redboot/download-command.html
load downloads programs or data to the RedBoot platform. By default RedBoot loads images into some free RAM area which can be addressed later using the variable %{FREEMEMLO}.
-r specifies raw (or binary) data, which also implies that -b or -f must be used.
-b address in memory to load the data. Formatted data streams will have an implied load address, which this option may override.
-f address in flash to load the data. Formatted data streams will have an implied load address, which this option may override.
RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma
Using default protocol (TFTP)
Raw file loaded 0x80040400-0x801203ff, assumed entry at 0x80040400
RedBoot>
fis create
More details about fis create here: http://ecos.sourceware.org/docs-latest/redboot/fis-create-command.html.
This command creates an image in the FIS directory and obviously, the data for the image must exist in RAM memory before it can be copied. By default,fis create takes the data loaded by the last load command as input for a partition starting at the first free block of the flash space. Important are the values for the RAM address (-r) and entry point (-e), which are linux specific and need to have exactly these values. The partition name ‘kernel’ is configured within RedBoot (see above) as the default boot partition’s name and is of course changeable.
RedBoot> fis create -e 0x80041000 -r 0x80041000 kernel
... Erase from 0xa8030000-0xa8110000: ..............
... Program from 0x80040400-0x80120400 at 0xa8030000: ..............
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>
Load The Rootfs Image
Before loading the root filesystem, we issue fis list and fis free once again:
RedBoot> fis list
Name FLASH addr Mem addr Length Entry point
RedBoot 0xA8000000 0xA8000000 0x00030000 0x00000000
kernel 0xA8030000 0x80041000 0x000E0000 0x80041000
FIS directory 0xA87E0000 0xA87E0000 0x0000F000 0x00000000
RedBoot config 0xA87EF000 0xA87EF000 0x00001000 0x00000000
RedBoot> fis free
0xA8110000 .. 0xA87E0000
RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-root.squashfs
Using default protocol (TFTP)
Raw file loaded 0x80040400-0x801a03ff, assumed entry at 0x80040400
The information provided by fis free is now used like this:
0xA87E0000 minus 0xA8110000 = 0x6D0000, which is used to create the Root-Filesystem rootfs:
RedBoot> fis create -l 0x6D0000 rootfs
... Erase from 0xa8110000-0xa87e0000: ..........................................
... Program from 0x80040400-0x801a0400 at 0xa8110000: ......................
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>
Reset
This time, running reset will boot the Fonera into OpenWrt 8.09.1 …
RedBoot> reset
+Ethernet eth0: MAC address 00:18:84:**:**:**
IP: 192.168.1.50/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2
RedBoot(tm) bootstrap and debug environment [ROMRAM]
OpenWrt certified release, version 1.1 – built 12:40:38, Sep 3 2007
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.
Board: FON 2202
RAM: 0×80000000-0×82000000, [0x80040290-0x80fe1000] available
FLASH: 0xa8000000 – 0xa87f0000, 128 blocks of 0×00010000 bytes each.
== Executing boot script in 5.000 seconds – enter ^C to abort
RedBoot> fis load -l kernel
Image loaded from 0×80041000-0×80313085
RedBoot> exec
Now booting linux kernel:
Base address 0×80030000 Entry 0×80041000
Cmdline :
Linux version 2.6.26.8 (wolf@wpbook) (gcc version 4.1.2) #2 Sat Jul 25 16:51:53 PDT 2009
CPU revision is: 00019064 (MIPS 4KEc)
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Initrd not found or empty – disabling initrd
Zone PFN ranges:
Normal 0 -> 8192
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0 -> 8192
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
Kernel command line: console=ttyS0,9600 rootfstype=squashfs,jffs2 init=/etc/preinit ip=192.168.1.50
Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 16 bytes
PID hash table entries: 128 (order: 7, 512 bytes)
console [ttyS0] enabled
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 29176k/32768k available (2369k kernel code, 3592k reserved, 385k data, 136k init, 0k highme)
SLUB: Genslabs=6, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Mount-cache hash table entries: 512
net_namespace: 484 bytes
NET: Registered protocol family 16
Radio config found at offset 0xf8(0x1f8)
AR531x PCI init…
done
PCI: fixing up device 0,3,0
PCI: Failed to allocate mem resource #1:4000000@84000000 for 0000:00:03.0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
ar531x: Registering GPIODEV device
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
JFFS2 version 2.2. (NAND) (SUMMARY) ?© 2001-2006 Red Hat, Inc.
msgmni has been set to 56
io scheduler noop registered
io scheduler deadline registered (default)
gpiodev: gpio device registered with major 254
gpiodev: gpio platform device registered with access mask FFFFFFFF
Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0xb1100003 (irq = 37) is a 16550A
eth0: Atheros AR231x: 00:18:84:**:**:**, irq 4
ar2313_eth_mii: probed
eth0: Marvell 88E6060 PHY driver attached.
eth0: attached PHY driver [Marvell 88E6060] (mii_bus:phy_addr=0:1f)
cmdlinepart partition parsing not available
Searching for RedBoot partition table in spiflash at offset 0x7d0000
Searching for RedBoot partition table in spiflash at offset 0x7e0000
6 RedBoot partitions found on MTD device spiflash
Creating 6 MTD partitions on “spiflash”:
0×00000000-0×00030000 : “RedBoot”
0×00030000-0×00110000 : “kernel”
0×00110000-0x007e0000 : “rootfs”
mtd: partition “rootfs” set to be root filesystem
mtd: partition “rootfs_data” created automatically, ofs=250000, len=590000
0×00250000-0x007e0000 : “rootfs_data”
0x007e0000-0x007ef000 : “FIS directory”
0x007ef000-0x007f0000 : “RedBoot config”
0x007f0000-0×00800000 : “boardconfig”
Registered led device: gpio1
Registered led device: wlan
Registered led device: gpio3
Registered led device: gpio4
Registered led device: gpio7
eth0: Configuring MAC for full duplex
TCP vegas registered
NET: Registered protocol family 17
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
802.1Q VLAN Support v1.8 Ben Greear greearb@candelatech.com
All bugs added by David S. Miller davem@redhat.com
IP-Config: Guessing netmask 255.255.255.0
IP-Config: Complete:
device=eth0, addr=192.168.1.50, mask=255.255.255.0, gw=255.255.255.255,
host=192.168.1.50, domain=, nis-domain=(none),
bootserver=255.255.255.255, rootserver=255.255.255.255, rootpath=
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 136k freed
Please be patient, while OpenWrt loads …
Algorithmics/MIPS FPU Emulator v1.5
- preinit -
Press CTRL-C for failsafe
switching to jffs2
mini_fo: using base directory: /
mini_fo: using storage directory: /jffs
- init -
Please press Enter to activate this console. PPP generic driver version 2.4.2
device eth0.0 entered promiscuous mode
device eth0 entered promiscuous mode
br-lan: port 1(eth0.0) entering learning state
br-lan: topology change detected, propagating
br-lan: port 1(eth0.0) entering forwarding state
ip_tables: (C) 2000-2006 Netfilter Core Team
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
wlan: trunk
ath_hal: module license ‘Proprietary’ taints kernel.
ath_hal: 2009-05-08 (AR5212, AR5312, RF5111, RF5112, RF2316, RF2317, REGOPS_FUNC, TX_DESC_SWAP, XR)
ath_rate_minstrel: Minstrel automatic rate control algorithm 1.2 (trunk)
ath_rate_minstrel: look around rate set to 10%
ath_rate_minstrel: EWMA rolloff level set to 75%
ath_rate_minstrel: max segment size in the mrr set to 6000 us
wlan: mac acl policy registered
ath_ahb: trunk
Atheros HAL provided by OpenWrt, DD-WRT and MakSat Technologies
wifi0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
wifi0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
wifi0: turboG rates: 6Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
wifi0: H/W encryption support: WEP AES AES_CCM TKIP
ath_ahb: wifi0: Atheros 2315 WiSoC: mem=0xb0000000, irq=3