Cisco ON-100 k9_v01/_v02
The Cisco ON100 was a device sold for a now discontinued cloud monitoring service, think of it as a hardware version of Nmap wrapped with a silly UI. The cloud service has since been discontinued, but these could be easily repurposed for a neat 2-port router.
Supported Versions
Hardware Highlights
Installation
You need serial console because you need to use uboot bootloader for flashing.
Flashing can be performed over tftp, once “dhcp” has been issued:
tftpboot ${loadaddr} lede-kirkwood-on100-squashfs-factory.bin
nand erase 0x0c0000 ${filesize}
nand write ${loadaddr} 0x0c0000 ${filesize}
Once flashed, set environment variables to boot:
setenv bootcmd nand read ${loadaddr} 0x0c0000 0x540000 \; setenv bootargs \; bootm
saveenv
Hardware
Info
| Architecture: | ARMv5 |
| Vendor: | Marvell |
| Bootloader: | U-Boot |
| System-On-Chip: | Marvell 88F6282 |
| CPU/Speed | 1600 MHz |
| Flash-Chip: | Hynix HY27UF084G2B |
| Flash size: | 512 MiB |
| RAM: | 512 MiB |
| Wireless: | None |
| Ethernet: | 2x 1 Gbit/s w/ vlan support |
| USB: | 1x 2.0 |
| Serial: | Yes |
| JTAG: | Yes |
Flash Layout
root@OpenWrt:/# cat /proc/mtd dev: size erasesize name mtd0: 00200000 00020000 "u-boot" mtd1: 00500000 00020000 "uImage" mtd2: 1f900000 00020000 "ubi" dmesg | grep x [ 0.865586] 0x000000000000-0x000000200000 : "u-boot" [ 0.871897] 0x000000200000-0x000000700000 : "uImage" [ 0.877785] 0x000000700000-0x000020000000 : "ubi"
| Layer0 | Hynix HY27UF084G2B raw 512 MiB NAND Flash | ||||
|---|---|---|---|---|---|
| Layer1 | mtd0 u-boot 256 KiB | mtd1 uImage 54 KiB | mtd2 ubi/rootfs 64 MiB |
||
Photos
Opening the case
Opening the case for this device is pretty simple - you have four rubber feet on the bottom fixed in place with adhesive, remove these with a flat bladed screwdriver. Behind each of the four rubber feet is a cross head screw. Remove these screws. You will then likely want to use a spudger to unclip four clips on the case - there are two on each side, approximately an inch from each corner. There are no clips on the front or back, only two on each side.
Serial
JP1 on board, by front LEDs - J6, another 4-pin connector is immediately above this. You want the bottom one. Facing the LEDs, the pinouts are GND, TXD, RXD, NC. You can verify this if you want by checking GND to some other groundlike object on the board.
How to connect to the Serial Port of this specific device:
| Serial connection parameters for Cisco ON-100 k9_v01 | 115200, 8N1 |
|---|
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
JTAG port J4 is right next to the serial port, see picture above.
How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port
Bootlogs
OEM bootlog
__ __ _ _ | \/ | __ _ _ ____ _____| | | | |\/| |/ _` | '__\ \ / / _ \ | | | | | | (_| | | \ V / __/ | | |_| |_|\__,_|_| \_/ \___|_|_| _ _ ____ _ | | | | | __ ) ___ ___ | |_ | | | |___| _ \ / _ \ / _ \| __| | |_| |___| |_) | (_) | (_) | |_ \___/ |____/ \___/ \___/ \__| ** MARVELL BOARD: DB-88F6282A-BP LE U-Boot 1.1.4 (Feb 22 2011 - 14:06:09) Marvell version: 3.5.9 - Cisco Plasma U-Boot code: 00600000 -> 0067FFF0 BSS: -> 006D2340 Soc: 88F6282 A1CPU running @ 1600Mhz L2 running @ 533Mhz SysClock = 400Mhz , TClock = 200Mhz DRAM (DDR3) CAS Latency = 6 tRP = 6 tRAS = 15 tRCD=6 DRAM CS[0] base 0x00000000 size 256MB DRAM CS[1] base 0x10000000 size 256MB DRAM Total size 512MB 16bit width Addresses 8M - 0M are saved for the U-Boot usage. Mem malloc Initialization (8M - 7M): Done NAND:512 MB Flash: 0 kB CPU : Marvell Feroceon (Rev 1) Streaming disabled Write allocate disabled Module 0 is RGMII USB 0: host mode PEX 0: interface detected no Link. PEX 1: interface detected no Link. Net: egiga0 [PRIME], egiga1 Hit any key to stop autoboot: 3 2 1 0 ### JFFS2 loading 'boot.img' to 0x400000 Scanning JFFS2 FS: . | / - \ | / - done. ### JFFS2 load complete: 382 bytes loaded to 0x400000 ## Executing script at 00400000 "PLASMA Booting FIRST partition @ 0x400000" NAND read: device 0 offset 0x400000, size 0x600000 Reading data from 0x400000 -- 0% complete.Reading data from 0x40f000 -- 1% complete.Reading data from 0x41e800 -- 2% complete.Reading data from 0x42e000 -- 3% complete.Reading data from 0x43d000 -- 4% complete.Reading data from 0x44c800 -- 5% complete.Reading data from 0x45c000 -- 6% complete.Reading data from 0x46b800 -- 7% complete.Reading data from 0x47a800 -- 8% complete.Reading data from 0x48a000 -- 9% complete.Reading data from 0x499800 -- 10% complete.Reading data from 0x4a8800 -- 11% complete.Reading data from 0x4b8000 -- 12% complete.Reading data from 0x4c7800 -- 13% complete.Reading data from 0x4d7000 -- 14% complete.Reading data from 0x4e6000 -- 15% complete.Reading data from 0x4f5800 -- 16% complete.Reading data from 0x505000 -- 17% complete.Reading data from 0x514000 -- 18% complete.Reading data from 0x523800 -- 19% complete.Reading data from 0x533000 -- 20% complete.Reading data from 0x542800 -- 21% complete.Reading data from 0x551800 -- 22% complete.Reading data from 0x561000 -- 23% complete.Reading data from 0x570800 -- 24% complete.Reading data from 0x57f800 -- 25% complete.Reading data from 0x58f000 -- 26% complete.Reading data from 0x59e800 -- 27% complete.Reading data from 0x5ae000 -- 28% complete.Reading data from 0x5bd000 -- 29% complete.Reading data from 0x5cc800 -- 30% complete.Reading data from 0x5dc000 -- 31% complete.Reading data from 0x5eb800 -- 32% complete.Reading data from 0x5fa800 -- 33% complete.Reading data from 0x60a000 -- 34% complete.Reading data from 0x619800 -- 35% complete.Reading data from 0x628800 -- 36% complete.Reading data from 0x638000 -- 37% complete.Reading data from 0x647800 -- 38% complete.Reading data from 0x657000 -- 39% complete.Reading data from 0x666000 -- 40% complete.Reading data from 0x675800 -- 41% complete.Reading data from 0x685000 -- 42% complete.Reading data from 0x694000 -- 43% complete.Reading data from 0x6a3800 -- 44% complete.Reading data from 0x6b3000 -- 45% complete.Reading data from 0x6c2800 -- 46% complete.Reading data from 0x6d1800 -- 47% complete.Reading data from 0x6e1000 -- 48% complete.Reading data from 0x6f0800 -- 49% complete.Reading data from 0x6ff800 -- 50% complete.Reading data from 0x70f000 -- 51% complete.Reading data from 0x71e800 -- 52% complete.Reading data from 0x72e000 -- 53% complete.Reading data from 0x73d000 -- 54% complete.Reading data from 0x74c800 -- 55% complete.Reading data from 0x75c000 -- 56% complete.Reading data from 0x76b800 -- 57% complete.Reading data from 0x77a800 -- 58% complete.Reading data from 0x78a000 -- 59% complete.Reading data from 0x799800 -- 60% complete.Reading data from 0x7a8800 -- 61% complete.Reading data from 0x7b8000 -- 62% complete.Reading data from 0x7c7800 -- 63% complete.Reading data from 0x7d7000 -- 64% complete.Reading data from 0x7e6000 -- 65% complete.Reading data from 0x7f5800 -- 66% complete.Reading data from 0x805000 -- 67% complete.Reading data from 0x814000 -- 68% complete.Reading data from 0x823800 -- 69% complete.Reading data from 0x833000 -- 70% complete.Reading data from 0x842800 -- 71% complete.Reading data from 0x851800 -- 72% complete.Reading data from 0x861000 -- 73% complete.Reading data from 0x870800 -- 74% complete.Reading data from 0x87f800 -- 75% complete.Reading data from 0x88f000 -- 76% complete.Reading data from 0x89e800 -- 77% complete.Reading data from 0x8ae000 -- 78% complete.Reading data from 0x8bd000 -- 79% complete.Reading data from 0x8cc800 -- 80% complete.Reading data from 0x8dc000 -- 81% complete.Reading data from 0x8eb800 -- 82% complete.Reading data from 0x8fa800 -- 83% complete.Reading data from 0x90a000 -- 84% complete.Reading data from 0x919800 -- 85% complete.Reading data from 0x928800 -- 86% complete.Reading data from 0x938000 -- 87% complete.Reading data from 0x947800 -- 88% complete.Reading data from 0x957000 -- 89% complete.Reading data from 0x966000 -- 90% complete.Reading data from 0x975800 -- 91% complete.Reading data from 0x985000 -- 92% complete.Reading data from 0x994000 -- 93% complete.Reading data from 0x9a3800 -- 94% complete.Reading data from 0x9b3000 -- 95% complete.Reading data from 0x9c2800 -- 96% complete.Reading data from 0x9d1800 -- 97% complete.Reading data from 0x9e1000 -- 98% complete.Reading data from 0x9f0800 -- 99% complete.Reading data from 0x9ff800 -- 100% complete. 6291456 bytes read: OK ## Booting image at 00800000 ... Image Name: Linux-2.6.31.8PATCH-29 Created: 2011-06-01 21:56:16 UTC Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 2323016 Bytes = 2.2 MB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK OK Starting kernel ... Uncompressing Linux..................................................................................................................................................... done, booting the kernel. Linux version 2.6.31.8PATCH-29 (jamwyatt@aesop) (gcc version 4.3.2 (sdk3.2rc1-ct-ng-1.4.1) ) #1 Wed Jun 1 16:56:06 CDT 2011 CPU: Feroceon 88FR131 [56251311] revision 1 (ARMv5TE), cr=00053977 CPU: VIVT data cache, VIVT instruction cache Machine: Feroceon-KW Using UBoot passing parameters structure Memory policy: ECC disabled, Data cache writeback Built 1 zonelists in Zone order, mobility grouping off. Total pages: 130048 Kernel command line: console=ttyS0,115200 max_loop=64 mtdparts=nand_mtd:2m(uBoot)ro,2m(dualboot),6m(kernel1),8m(rootfs1),6m(kernel2),8m(rootfs2),470m(datafs),-(misc) root=/dev/mtdblock3 ro serialNo=SERIAL hwVer=ON100-K9_V01 ip=::::DB88FXX81:eth0:none rootfstype=jffs2 PID hash table entries: 2048 (order: 11, 8192 bytes) Dentry cache hash table entries: 65536 (order: 6, 262144 bytes) Inode-cache hash table entries: 32768 (order: 5, 131072 bytes) Memory: 256MB 256MB = 512MB total Memory: 510592KB available (4348K code, 315K data, 124K init, 0K highmem) Hierarchical RCU implementation. NR_IRQS:128 Console: colour dummy device 80x30 Calibrating delay loop... 1599.07 BogoMIPS (lpj=7995392) Mount-cache hash table entries: 512 CPU: Testing write buffer coherency: ok NET: Registered protocol family 16 Feroceon L2: Enabling L2 Feroceon L2: Cache support initialised. CPU Interface ------------- SDRAM_CS0 ....base 00000000, size 256MB SDRAM_CS1 ....base 10000000, size 256MB SDRAM_CS2 ....disable SDRAM_CS3 ....disable PEX0_MEM ....base e0000000, size 128MB PEX0_IO ....base f2000000, size 1MB PEX1_MEM ....base e8000000, size 128MB PEX1_IO ....base f2100000, size 1MB INTER_REGS ....base f1000000, size 1MB NFLASH_CS ....base fa000000, size 2MB SPI_CS ....base f4000000, size 16MB BOOT_ROM_CS ....no such DEV_BOOTCS ....no such CRYPT_ENG ....base f0000000, size 2MB Marvell Development Board (LSP Version KW_LSP_5.1.3_patch29)-- DB-88F6282A-BP Soc: 88F6282 A1 LE Detected Tclk 200000000 and SysClk 400000000 MV Buttons Device Load btns_init_data - plasma btns_init_data - Number of configured buttons: 1 Marvell USB EHCI Host controller #0: d0054740 PEX0 interface detected no Link. PEX1 interface detected no Link. PCI: bus0: Fast back to back transfers enabled PCI: bus1: Fast back to back transfers enabled bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NET: Registered protocol family 2 IP route cache hash table entries: 16384 (order: 4, 65536 bytes) TCP established hash table entries: 65536 (order: 7, 524288 bytes) TCP bind hash table entries: 65536 (order: 6, 262144 bytes) TCP: Hash tables configured (established 65536 bind 65536) TCP reno registered NET: Registered protocol family 1 rtc mv_rtc: rtc core: registered kw-rtc as rtc0 RTC registered cpufreq: Init kirkwood cpufreq driver Kirkwood hwmon thermal sensor initialized. XOR registered 4 channels XOR 2nd invalidate WA enabled cesadev_init(c000c990) mvCesaInit: sessions=640, queue=64, pSram=f0000000 Warning: TS unit is powered off. MV Buttons Driver Load JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc. msgmni has been set to 997 alg: No test for cipher_null (cipher_null-generic) alg: No test for ecb(cipher_null) (ecb-cipher_null) alg: No test for digest_null (digest_null-generic) alg: No test for compress_null (compress_null-generic) alg: No test for stdrng (krng) alg: No test for hmac(digest_null) (hmac(digest_null-generic)) Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) io scheduler noop registered io scheduler anticipatory registered (default) Initializing ths8200_init Initializing dove_adi9889_init Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A console [ttyS0] enabled loop: module loaded Integrated Sata device found IRQ 21/mvSata: IRQF_DISABLED is not guaranteed on shared IRQs scsi0 : Marvell SCSI to SATA adapter scsi1 : Marvell SCSI to SATA adapter Loading Marvell Ethernet Driver: o Cached descriptors in DRAM o DRAM SW cache-coherency o 2 Giga ports supported o Single RX Queue support - ETH_DEF_RXQ=0 o Single TX Queue support - ETH_DEF_TXQ=0 o TCP segmentation offload (TSO) supported o Large Receive offload (LRO) supported o Receive checksum offload supported o Transmit checksum offload supported o Network Fast Processing (Routing) supported - (Disabled) o Driver ERROR statistics enabled o Proc tool API enabled o SKB Reuse supported - (Disabled) o SKB Recycle supported - (Disabled) o Rx descripors: q0=128 o Tx descripors: q0=532 o Loading network interface(s): o register under mv88fx_eth platform o eth0, ifindex = 2, GbE port = 0 o eth1, ifindex = 3, GbE port = 1 mvFpRuleDb (d07f0000): 16384 entries, 65536 bytes Counter=0, opIdx=6, overhead=16 Counter=1, opIdx=2, overhead=0 Counter=2, opIdx=1, overhead=18 Counter=3, opIdx=2, overhead=0 Intel(R) PRO/1000 Network Driver - version 7.3.21-k3-NAPI Copyright (c) 1999-2006 Intel Corporation. e1000e: Intel(R) PRO/1000 Network Driver - 1.0.2-k2 e1000e: Copyright (c) 1999-2008 Intel Corporation. e100: Intel(R) PRO/100 Network Driver, 3.5.24-k2-NAPI e100: Copyright(c) 1999-2006 Intel Corporation tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> usbcore: registered new interface driver asix usbcore: registered new interface driver cdc_ether usbcore: registered new interface driver net1080 usbcore: registered new interface driver cdc_subset usbcore: registered new interface driver zaurus NAND device: Manufacturer ID: 0xad, Chip ID: 0xdc (Hynix NAND 512MiB 3,3V 8-bit) Scanning device for bad blocks Bad eraseblock 2000 at 0x00000fa00000 8 cmdlinepart partitions found on MTD device nand_mtd Using command line partition definition Creating 8 MTD partitions on "nand_mtd": 0x000000000000-0x000000200000 : "uBoot" 0x000000200000-0x000000400000 : "dualboot" 0x000000400000-0x000000a00000 : "kernel1" 0x000000a00000-0x000001200000 : "rootfs1" 0x000001200000-0x000001800000 : "kernel2" 0x000001800000-0x000002000000 : "rootfs2" 0x000002000000-0x00001f600000 : "datafs" 0x00001f600000-0x000020000000 : "misc" ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver ehci_marvell ehci_marvell.70059: Marvell Orion EHCI ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1 ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100 ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver uhci_hcd: USB Universal Host Controller Interface driver usbcore: registered new interface driver usblp Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. usbcore: registered new interface driver ums-datafab usbcore: registered new interface driver ums-freecom usbcore: registered new interface driver ums-jumpshot usbcore: registered new interface driver ums-sddr09 usbcore: registered new interface driver ums-sddr55 usbcore: registered new interface driver ums-usbat mice: PS/2 mouse device common for all mice i2c /dev entries driver Orion Watchdog Timer: Initial timeout 21 sec sdhci: Secure Digital Host Controller Interface driver sdhci: Copyright(c) Pierre Ossman mmc0: mvsdio driver initialized, lacking card detect (fall back to polling) Registered led device: plasma:green:s1 Registered led device: plasma:red:s1 Registered led device: plasma:green:s2 Registered led device: plasma:red:s2 GRE over IPv4 tunneling driver TCP cubic registered NET: Registered protocol family 17 RPC: Registered udp transport module. RPC: Registered tcp transport module. 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> rtc mv_rtc: setting system clock to 2017-11-05 04:23:44 UTC (1509855824) CLEANMARKER node found at 0x00000000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00020000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00040000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00060000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00080000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x000a0000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x000c0000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x000e0000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00100000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00120000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00140000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00160000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00180000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x001a0000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x001c0000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x001e0000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00200000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00220000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00240000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00260000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00280000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x002a0000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x002c0000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x002e0000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00300000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00320000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00340000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00360000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x00380000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x003a0000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x003c0000 has totlen 0xc != normal 0x0 CLEANMARKER node found at 0x003e0000 has totlen 0xc != normal 0x0 VFS: Mounted root (jffs2 filesystem) readonly on device 31:3. Freeing init memory: 124K Creating R/W root Start up on R/W root Root Filesystem Version: 18.45 Set LED STATE to: init_state Linux ON100_AABBCCDDEE 2.6.31.8PATCH-29 #1 Wed Jun 1 16:56:06 CDT 2011 eth0: link down eth0: started eth0: link up, full duplex, speed 1 Gbps eth1: started initFinish.sh: Starting HTTPD - Status info now available UBI: attaching mtd6 to ubi0 UBI: physical eraseblock size: 131072 bytes (128 KiB) UBI: logical eraseblock size: 129024 bytes UBI: smallest flash I/O unit: 2048 UBI: sub-page size: 512 UBI: VID header offset: 512 (aligned 512) UBI: data offset: 2048 UBI: attached mtd6 to ubi0 UBI: MTD device name: "datafs" UBI: MTD device size: 470 MiB UBI: number of good PEBs: 3759 UBI: number of bad PEBs: 1 UBI: max. allowed volumes: 128 UBI: wear-leveling threshold: 4096 UBI: number of internal volumes: 1 UBI: number of user volumes: 1 UBI: available PEBs: 0 UBI: total number of reserved PEBs: 3759 UBI: number of PEBs reserved for bad PEB handling: 37 UBI: max/mean erase counter: 9/5 UBI: image sequence number: 948014444 UBI: background thread "ubi_bgt0d" started, PID 749 UBI device number 0, total 3759 LEBs (485001216 bytes, 462.5 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB) initFinish.sh: ubiattach was successful to ubi0 initFinish.sh: mknod was successful for /dev/ubi0 initFinish.sh: Starting mount of internal flash .... ubi0 onto /mnt/INTFLASH UBIFS: recovery needed UBIFS: recovery completed UBIFS: mounted UBI device 0, volume 0, name "datafs" UBIFS: file system size: 477904896 bytes (466704 KiB, 455 MiB, 3704 LEBs) UBIFS: journal size: 23869440 bytes (23310 KiB, 22 MiB, 185 LEBs) UBIFS: media format: w4/r0 (latest is w4/r0) UBIFS: default compressor: lzo UBIFS: reserved for root: 4952683 bytes (4836 KiB) initFinish.sh: .... successfully completed mount Set LED STATE to: netconf_active killall: udhcpc: no process killed info, udhcpc (v0.9.9-pre) started debug, Sending discover... debug, Sending select for 192.168.2.138... info, Lease of 192.168.2.138 obtained, lease time 864000 udhcpc.sh: update default gw udhcpc.sh: deleting routes udhcpc.sh: Router is 192.168.2.1 eth0 udhcpc.sh: skip update dns Set LED STATE to: net_complete initFinish.sh: Attempting to mount /dev/sda1 flash device mount: Mounting /dev/sda1 on /mnt/EXTFLASH failed: No such device or address mount: Mounting /dev/sda1 on /mnt/EXTFLASH failed: No such device or address net.ipv4.neigh.eth0.gc_stale_time = 360 net.ipv4.neigh.default.gc_stale_time = 360 net.ipv4.conf.all.arp_filter = 1 vm.swappiness = 0 initFinish.sh: No CRAMFS file, we have run out of options .... failsafe time Set LED STATE to: netconf_active info, udhcpc (v0.9.9-pre) started debug, Sending discover... debug, Sending select for 192.168.2.138... info, Lease of 192.168.2.138 obtained, lease time 864000 udhcpc.sh: update default gw udhcpc.sh: deleting routes udhcpc.sh: Router is 192.168.2.1 eth0 udhcpc.sh: skip update dns Set LED STATE to: net_complete Set LED STATE to: failsafe ap_failSafeUpdate: Beginning fail safe recovery ap_failSafeUpdate: Cleaning up left-over rogue processes ... should already have stopped UBIFS: un-mount UBI device 0, volume 0 ap_failSafeUpdate: Beginning reformat of internal flash .... ubi0 Volumes count: 1 Logical eraseblockUBI: mtd6 is detached from ubi0 size: 129024 bytes, 126.0 KiB Total amount of logical eraseblocks: 3759 (485001216 bytes, 462.5 MiB) Amount of available logical eraseblocks: 0 (0 bytes) Maximum count of volumes 128 Count of bad physical eraseblocks: 1 Count of reserved physical eraseblocks: 37 Current maximum erase counter value: 9 Minimum input/output unit size: 2048 bytes Character device major/minor: 252:0 Present volumes: 0 ap_formatInternalFlash-ON100: Detached the UBI volume from mtd6 ubiformat: mtd6 (nand), size 492830720 bytes (470.0 MiB), 3760 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes libscan: scanning eraseblock 3759 -- 100 % complete ubiformat: 3759 eraseblocks have valid erase counter, mean value is 5 ubiformat: 1 bad eraseblocks found, numbers: 1744 ubiformat: formatting eraseblock 3759 -- 100 % complete ap_formatInternalFlash-ON100: UBI Format completedUBI: attaching mtd6 to ubi0 UBI: physical eraseblock size: 131072 bytes (128 KiB) UBI: logical eraseblock size: 129024 bytes UBI: smallest flash I/O unit: 2048 UBI: sub-page size: 512 UBI: VID header offset: 512 (aligned 512) UBI: data offset: 2048 UBI: attached mtd6 to ubi0 UBI: MTD device name: "datafs" UBI: MTD device size: 470 MiB UBI: number of good PEBs: 3759 UBI: number of bad PEBs: 1 UBI: max. allowed volumes: 128 UBI: wear-leveling threshold: 4096 UBI: number of internal volumes: 1 UBI: number of user volumes: 0 UBI: available PEBs: 3718 UBI: total number of reserved PEBs: 41 UBI: number of PEBs reserved for bad PEB handling: 37 UBI: max/mean erase counter: 10/6 UBI: image sequence number: 226370003 UBI: background thread "ubi_bgt0d" started, PID 1271 UBI device number 0, total 3759 LEBs (485001216 bytes, 462.5 MiB), available 3718 LEBs (479711232 bytes, 457.5 MiB), LEB size 129024 bytes (126.0 KiB) ap_formatInternalFlash-ON100: ubiattach was successful to ubi0 ap_formatInternalFlash-ON100: mknod was successful for /dev/ubi0 Set volume size to 479711232 Volume ID 0, size 3718 LEBs (479711232 bytes, 457.5 MiB), LEB size 129024 bytes (126.0 KiB), dynamic, name "datafs", alignment 1 ap_formatInternalFlash-ON100: ubimkvol was successful for /dev/ubi0 UBIFS: default file-system created UBIFS: mounted UBI device 0, volume 0, name "datafs" UBIFS: file system size: 477904896 bytes (466704 KiB, 455 MiB, 3704 LEBs) UBIFS: journal size: 23869440 bytes (23310 KiB, 22 MiB, 185 LEBs) UBIFS: media format: w4/r0 (latest is w4/r0) UBIFS: default compressor: lzo UBIFS: reserved for root: 4952683 bytes (4836 KiB) ap_failSafeUpdate: .... Format Completed ap_failSafeUpdate: Attempt #1 to retrieve http://failsafe.imageboot.com/failsafe/failsafe.html?model=ON100&mac=MAC&serial=SERIAL&pid=ON100-K9&vid=01 ap_failSafeUpdate: Bundle download was successful - in terms of a successful transfer ... ap_failSafeUpdate: Downloaded the bundle fine, but the tar file is corrupt ap_failSafeUpdate: Failed attempt 1 to download the recovery file!
OpenWrt bootlog
__ __ _ _ | \/ | __ _ _ ____ _____| | | | |\/| |/ _` | '__\ \ / / _ \ | | | | | | (_| | | \ V / __/ | | |_| |_|\__,_|_| \_/ \___|_|_| _ _ ____ _ | | | | | __ ) ___ ___ | |_ | | | |___| _ \ / _ \ / _ \| __| | |_| |___| |_) | (_) | (_) | |_ \___/ |____/ \___/ \___/ \__| ** MARVELL BOARD: DB-88F6282A-BP LE U-Boot 1.1.4 (Feb 22 2011 - 14:06:09) Marvell version: 3.5.9 - Cisco Plasma U-Boot code: 00600000 -> 0067FFF0 BSS: -> 006D2340 Soc: 88F6282 A1CPU running @ 1600Mhz L2 running @ 533Mhz SysClock = 400Mhz , TClock = 200Mhz DRAM (DDR3) CAS Latency = 6 tRP = 6 tRAS = 15 tRCD=6 DRAM CS[0] base 0x00000000 size 256MB DRAM CS[1] base 0x10000000 size 256MB DRAM Total size 512MB 16bit width Addresses 8M - 0M are saved for the U-Boot usage. Mem malloc Initialization (8M - 7M): Done NAND:512 MB Flash: 0 kB CPU : Marvell Feroceon (Rev 1) Streaming disabled Write allocate disabled Module 0 is RGMII USB 0: host mode PEX 0: interface detected no Link. PEX 1: interface detected no Link. Net: egiga0 [PRIME], egiga1 Hit any key to stop autoboot: 0 Plasma>> boot NAND read: device 0 offset 0x200000, size 0x200000 Reading data from 0x3ff800 -- 100% complete. 2097152 bytes read: OK ## Booting image at 02000000 ... Image Name: ARM OpenWrt Linux-4.4.14 Created: 2017-02-05 12:06:41 UTC Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1865550 Bytes = 1.8 MB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK OK Starting kernel ... [ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 4.4.14 ([removed]@[removed].ec.aa.net.uk) (gcc version 5.3.0 (OpenWrt GCC 5.3.0 50104) ) #2 Sun May 21 13:00:23 UTC 2017 [ 0.000000] CPU: Feroceon 88FR131 [56251311] revision 1 (ARMv5TE), cr=0005397f [ 0.000000] CPU: VIVT data cache, VIVT instruction cache [ 0.000000] Machine model: Cisco Systems ON-100 [ 0.000000] Memory policy: Data cache writeback [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 130048 [ 0.000000] Kernel command line: console=ttyS0,115200 max_loop=64 mtdparts=nand_mtd:0x200000@0x0(u-boot),0x400000@0x200000(uImage),-@0x700000(data) ubi.mtd=2 root=/dev/mtdblock2 rootfstype=jffs2 rw [ 0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes) [ 0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes) [ 0.000000] Memory: 513968K/524288K available (3810K kernel code, 130K rwdata, 1408K rodata, 164K init, 192K bss, 10320K reserved, 0K cma-reserved) [ 0.000000] Virtual kernel memory layout: [ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB) [ 0.000000] fixmap : 0xffc00000 - 0xfff00000 (3072 kB) [ 0.000000] vmalloc : 0xe0800000 - 0xff800000 ( 496 MB) [ 0.000000] lowmem : 0xc0000000 - 0xe0000000 ( 512 MB) [ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB) [ 0.000000] .text : 0xc0008000 - 0xc0520dc4 (5220 kB) [ 0.000000] .init : 0xc0521000 - 0xc054a000 ( 164 kB) [ 0.000000] .data : 0xc054a000 - 0xc056aba0 ( 131 kB) [ 0.000000] .bss : 0xc056aba0 - 0xc059ae04 ( 193 kB) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:16 nr_irqs:16 16 [ 0.000000] clocksource: orion_clocksource: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns [ 0.000007] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns [ 0.000070] Calibrating delay loop... 1594.16 BogoMIPS (lpj=7970816) [ 0.040060] pid_max: default: 32768 minimum: 301 [ 0.040155] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.040171] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.040627] CPU: Testing write buffer coherency: ok [ 0.040926] Setting up static identity map for 0x81e0 - 0x821c [ 0.041159] mvebu-soc-id: MVEBU SoC ID=0x6282, Rev=0x1 [ 0.044743] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.044864] pinctrl core: initialized pinctrl subsystem [ 0.045784] NET: Registered protocol family 16 [ 0.046134] DMA: preallocated 256 KiB pool for atomic coherent allocations [ 0.046838] cpuidle: using governor ladder [ 0.047137] Feroceon L2: Enabling L2 [ 0.047173] Feroceon L2: Cache support initialised. [ 0.047387] [Firmware Info]: /ocp@f1000000/ethernet-controller@72000/ethernet0-port@0: local-mac-address is not set [ 0.047463] [Firmware Info]: /ocp@f1000000/ethernet-controller@76000/ethernet1-port@0: local-mac-address is not set [ 0.060195] SCSI subsystem initialized [ 0.060459] usbcore: registered new interface driver usbfs [ 0.060518] usbcore: registered new interface driver hub [ 0.060566] usbcore: registered new device driver usb [ 0.061315] clocksource: Switched to clocksource orion_clocksource [ 0.062089] NET: Registered protocol family 2 [ 0.062525] TCP established hash table entries: 4096 (order: 2, 16384 bytes) [ 0.062588] TCP bind hash table entries: 4096 (order: 2, 16384 bytes) [ 0.062647] TCP: Hash tables configured (established 4096 bind 4096) [ 0.062696] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.062718] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.062847] NET: Registered protocol family 1 [ 0.063512] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.074825] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.074842] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.076847] io scheduler noop registered [ 0.076862] io scheduler deadline registered (default) [ 0.077737] kirkwood-pinctrl f1010000.pin-controller: registered pinctrl driver [ 0.078185] irq: Cannot allocate irq_descs @ IRQ34, assuming pre-allocated [ 0.078461] irq: Cannot allocate irq_descs @ IRQ66, assuming pre-allocated [ 0.103000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled [ 0.103807] console [ttyS0] disabled [ 0.103861] f1012000.serial: ttyS0 at MMIO 0xf1012000 (irq = 25, base_baud = 12500000) is a 16550A [ 0.556535] console [ttyS0] enabled [ 0.561218] nand: Could not find valid ONFI parameter page; aborting [ 0.567660] nand: device found, Manufacturer ID: 0xad, Chip ID: 0xdc [ 0.574050] nand: Hynix NAND 512MiB 3,3V 8-bit [ 0.578515] nand: 512 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 [ 0.586126] Scanning device for bad blocks [ 0.642384] Bad eraseblock 869 at 0x000006ca0000 [ 0.710247] Bad eraseblock 1924 at 0x00000f080000 [ 0.754810] Bad eraseblock 2589 at 0x0000143a0000 [ 0.849850] 3 ofpart partitions found on MTD device orion_nand [ 0.855717] Creating 3 MTD partitions on "orion_nand": [ 0.860880] 0x000000000000-0x000000200000 : "u-boot" [ 0.867169] 0x000000200000-0x000000700000 : "uImage" [ 0.873080] 0x000000700000-0x000020000000 : "ubi" [ 0.879789] libphy: orion_mdio_bus: probed [ 0.884766] mv643xx_eth: MV-643xx 10/100/1000 ethernet driver version 1.4 [ 0.893175] mv643xx_eth_port mv643xx_eth_port.0 eth0: port 0 with MAC address 64:00:f1:21:1f:2a [ 0.902766] mv643xx_eth_port mv643xx_eth_port.1 eth1: port 0 with MAC address 64:00:f1:21:1f:2b [ 0.911571] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 0.918126] ehci-pci: EHCI PCI platform driver [ 0.922659] ehci-platform: EHCI generic platform driver [ 0.928019] ehci-orion: EHCI orion driver [ 0.932177] orion-ehci f1050000.ehci: EHCI Host Controller [ 0.937702] orion-ehci f1050000.ehci: new USB bus registered, assigned bus number 1 [ 0.945507] orion-ehci f1050000.ehci: irq 29, io mem 0xf1050000 [ 0.971329] orion-ehci f1050000.ehci: USB 2.0 started, EHCI 1.00 [ 0.977878] hub 1-0:1.0: USB hub found [ 0.981804] hub 1-0:1.0: 1 port detected [ 0.986073] usbcore: registered new interface driver usb-storage [ 1.032748] NET: Registered protocol family 10 [ 1.042217] NET: Registered protocol family 17 [ 1.046722] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this. [ 1.059407] 8021q: 802.1Q VLAN Support v1.8 [ 1.065159] ubi0: attaching mtd2 [ 1.260317] ubi0: scanning is finished [ 1.271888] ubi0: attached mtd2 (name "ubi", size 505 MiB) [ 1.277406] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytes [ 1.284334] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 512 [ 1.291060] ubi0: VID header offset: 512 (aligned 512), data offset: 2048 [ 1.297881] ubi0: good PEBs: 4037, bad PEBs: 3, corrupted PEBs: 0 [ 1.304011] ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128 [ 1.311265] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1070480583 [ 1.320439] ubi0: available PEBs: 0, total reserved PEBs: 4037, PEBs reserved for bad PEB handling: 77 [ 1.330034] hctosys: unable to open rtc device (rtc0) [ 1.336203] ubi0: background thread "ubi_bgt0d" started, PID 834 [ 1.411356] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, PID 837 [ 1.462216] UBIFS (ubi0:0): start fixing up free space [ 1.537110] UBIFS (ubi0:0): free space fixup complete [ 1.572040] UBIFS (ubi0:0): UBIFS: mounted UBI device 0, volume 0, name "rootfs" [ 1.579476] UBIFS (ubi0:0): LEB size: 129024 bytes (126 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 1.589461] UBIFS (ubi0:0): FS size: 508999680 bytes (485 MiB, 3945 LEBs), journal size 9033728 bytes (8 MiB, 71 LEBs) [ 1.600213] UBIFS (ubi0:0): reserved for root: 0 bytes (0 KiB) [ 1.606084] UBIFS (ubi0:0): media format: w4/r0 (latest is w4/r0), UUID 7FCB5CC6-3D5F-4048-83F6-9AD59868BF28, small LPT model [ 1.662736] VFS: Mounted root (ubifs filesystem) on device 0:11. [ 1.669336] Freeing unused kernel memory: 164K (c0521000 - c054a000) [ 1.842725] init: Console is alive [ 2.035382] sata_mv f1080000.sata: slots 32 ports 1 [ 2.051639] scsi host0: sata_mv [ 2.055019] ata1: SATA max UDMA/133 irq 32 [ 2.401338] ata1: SATA link down (SStatus 0 SControl F300) [ 2.418614] init: - preinit - Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 5.647803] mount_root: mounting /dev/root [ 5.669408] procd: - early - [ 6.546420] procd: - ubus - [ 6.600536] random: ubusd urandom read with 12 bits of entropy available [ 6.623532] procd: - init - Please press Enter to activate this console. [ 7.634721] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 7.656304] i2c /dev entries driver [ 7.673357] Loading modules backported from Linux version wt-2016-05-12-0-g7a54796 [ 7.680962] Backport generated by backports.git backports-20160216-0-ge3c56e4 [ 7.713066] ip_tables: (C) 2000-2006 Netfilter Core Team [ 7.733669] lib80211: common routines for IEEE802.11 drivers [ 7.751056] nf_conntrack version 0.5.0 (8033 buckets, 32132 max) BusyBox v1.24.2 () built-in shell (ash) _______ ________ __[ 7.812527] xt_time: kernel timezone is -0000 | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- DESIGNATED DRIVER (Bleeding Edge, 50104) ----------------------------------------------------- * 2 oz. Orange Juice Combine all juices in a * 2 oz. Pineapple Juice tall glass filled with * 2 oz. Grapefruit Juice ice, stir well. * 2 oz. Cranberry Juice ----------------------------------------------------- root@(none):/# [ 7.923759] libertas_sdio: Libertas SDIO driver [ 7.928313] libertas_sdio: Copyright Pierre Ossman [ 7.956619] PPP generic driver version 2.4.2 [ 7.972109] NET: Registered protocol family 24 [ 11.422325] mv643xx_eth_port mv643xx_eth_port.0 eth0: link up, 1000 Mb/s, full duplex, flow control disabled [ 11.432232] mv643xx_eth_port mv643xx_eth_port.0 eth0: link down [ 11.472807] device eth0 entered promiscuous mode [ 11.482013] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 14.542372] mv643xx_eth_port mv643xx_eth_port.0 eth0: link up, 1000 Mb/s, full duplex, flow control disabled [ 14.552813] br-lan: port 1(eth0) entered forwarding state [ 14.558262] br-lan: port 1(eth0) entered forwarding state [ 14.581341] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready [ 16.551325] br-lan: port 1(eth0) entered forwarding state [ 73.121340] random: nonblocking pool is initialized
Notes
It appears to be possible to boot OpenWrt on the Cisco ON-100. A modified device profile is available on GitHub which enables an image to be quickly built for this device.
GPIO Mappings
GPIO on this thing seems very sulky, still figuring this out. Touching the wrong GPIO seems to cause it to hang execution.
| GPIO | Function | Direction | Polarity |
|---|---|---|---|
| 3 | Sets flash chip readonly | Any | Active High |
| 9 | Stops CPU execution... | Any | Active High |
| 10 | Stops CPU execution... | Any | Active High |
| 11 | Stops CPU execution... | Any | Active High |
| 41 | Reset button | Input | Active High |
| 44 | Status LED 1 - Green | Output | Active Low |
| 45 | Status LED 1 - Red | Output | Active Low |
| 46 | Status LED 2 - Green | Output | Active Low |
| 47 | Status LED 2 - Red | Output | Active Low |
Building Cisco ON100 image
A pull request has been submitted to GitHub, it's not in trunk yet but you can get the source to build an image for this device as follows.
mkdir openwrt-ciscoon100; cd openwrt-ciscoon100; git init git remote add origin https://github.com/openwrt/openwrt.git git fetch --no-tags origin +refs/pull/476/merge: git checkout -qf FETCH_HEAD export FORCE_UNSAFE_CONFIGURE=1 make defconfig
You can now proceed to make menuconfig, select the Cisco Systems ON100 target, and once saved, issue make to make your images. You final images will be in /bin/kirkwood/, and you will want the openwrt-kirkwood-ciscoon100-uImage and openwrt-kirkwood-ciscoon100-rootfs.ubi images to put on your tftp server for flashing.
U-Boot installation
This step is optional - the units already ship with U-Boot. Power on the unit, and wait for the boot interrupt prompt - hit any key here and you should be into the U-Boot bootloader.
tftpboot ${loadaddr} u-boot-db88f6282bp_400ddr3db_nand.bin ; nand erase 0x000000 0xa0000 ; nand write ${loadaddr} 0x00000 0xa0000
If u-boot has been replaced or the environment variables cleared somehow, you will need to write your MAC addresses back with the following (use your MACs as per the label on your device, instead of the example)
setenv ethaddr 64:00:F1:00:00:00 setenv eth1addr 64:00:F1:00:00:01 saveenv
Get Networking in U-Boot
I guess this bit is kind of important. I had a DHCP server on my network, advertising DHCP Options 66 and 150 to point at a TFTP server's IP address. This was where I then uploaded my images. The port marked LAN is your first ethernet port, I used this during installation. The port marked MON is your second interface. To get DHCP IP and TFTP from network, in U-Boot prompt, enter:
dhcp
You should see output similar (but not the same) as below:
Plasma>> dhcp BOOTP broadcast 1 DHCP client bound to address 10.100.100.151
You can also try issuing the tftp command - this will fail as the file will not be there, but this can verify you are talking to TFTP:
Plasma>> tftp *** Warning: no boot file name; using '0A646497.img' Using egiga0 device TFTP from server 10.73.1.1; our IP address is 10.100.100.151 Filename '0A646497.img'. Load address: 0x2000000 Loading: * TFTP error: 'File not found' (1) Starting again Plasma>>
Program OpenWrt to flash
In U-Boot prompt, enter:
tftpboot ${loadaddr} openwrt-kirkwood-ciscoon100-uImage ; nand erase 0x200000 0x600000 ; nand write ${loadaddr} 0x200000 0x600000
nand erase 0x700000 0x1f900000
tftpboot ${loadaddr} openwrt-kirkwood-ciscoon100-rootfs.ubi ; nand erase 0x700000 ${filesize} ; nand write ${loadaddr} 0x700000 ${filesize}
Setup U-Boot variables
Still in your U-Boot prompt, enter
setenv owrt_bootargs_root ubi.mtd=2 root=/dev/mtdblock2 rootfstype=jffs2 rw
setenv owrt_mtdparts mtdparts=nand_mtd:0x200000@0x0(u-boot),0x400000@0x200000(uImage),-@0x700000(data)
setenv owrt_boot nand read.e \${loadaddr} 0x200000 0x200000 \; setenv bootargs \$(console) \$(owrt_mtdparts) \${owrt_bootargs_root} \; bootm \${loadaddr}
setenv bootcmd run owrt_boot
saveenv
When you're ready, enter boot, and your image will boot.