User Tools

Site Tools


toh:zinwell:zw4400

Zinwell ZW-4400

I obtained the bare PCB from Titan Wireless (http://www.titanwirelessonline.com/ProductDetails.asp?ProductCode=TW-533-4).

The MAC addresses have a Zinwell OUI (00059E = Zinwell Corporation).

Hardware

Info

Architecture XScale IXP42x
Vendor Zinwell
Bootloader RedBoot
System-On-Chip Intel IXP425
CPU Speed 533 MHz
Flash size 16 MiB
RAM 64 MiB
Wireless 4x miniPCI
Ethernet 2x RJ45 10/100
USB No
Serial Yes (3.3V)
JTAG Yes (20pin ARM)
Power 48V POE

Serial Port

J2 (the unique header socket to the right of J4)

Pin 1 is marked with a triangle.

Pin 4 is 3.3V RX (input to board)

Pin 6 is 3.3V TX (output from board)

Pin 8 is 0V GND

Pin 9 is empty.

The terminal settings for the connection:

115200 / 8 data bits / no parity / 1 stop bit / no flow control

Photos

JTAG

There seems to be a 20 pin JTAG, but it is not that important as the RedBoot boatloader does not seem to be crippled.

Original software

PCI GPIO 0.1.2.6 CF-IDE GPIO 12 configured.
+
PHY 100/Full/Auto configured.
Ethernet eth0: MAC address 00:05:9e:44:00:a1
IP: 0.0.0.0/255.255.255.0, Gateway: 0.0.0.0
Default server: 0.0.0.0, DNS server IP: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [ROM]
ZinWell Release Version 1.0.0 - built 14:02:56, Mar 19 2007

Platform: Intel Generic Residential Gateway (XScale)
RAM: 0x00000000-0x04000000, 0x0001f860-0x03fd1000 available
FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each.
== Executing boot script in 1.000 seconds - enter ^C to abort
RedBoot> fis load initrd.bin
RedBoot> fis load zImage
RedBoot> exec -c
Using base address 0x00100000 and length 0x00100000
Uncompressing Linux................................................... done, booting the kernel.
Linux version 2.4.18_mvl30-ixdp425 (choise@RD3Linux.zintech.com.tw) (gcc version 3.2.1 20020930 (MontaVista)) #50 Thu Jun 28 15:33:33 CST 2007
CPU: Intel XScale-IXP4xx/IXC1100 revision 2
Machine: Intel IXP425 Residential Gateway Demo Platform
Warning: bad configuration page, trying to continue
On node 0 totalpages: 16384
zone(0): 16384 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS0,115200 root=/dev/ram ramdisk_size=32768 initrd=0x00200000,9M mem=64M
Calibrating delay loop... 527.56 BogoMIPS
Memory: 64MB = 64MB total
Memory: 53640KB available (1350K code, 241K data, 84K init)
XScale Cache/TLB Locking Copyright(c) 2001 MontaVista Software, Inc.
XScale cache_lock_init called
   Calling consistent alloc
   low_level_page initialized
   low_level_page @ 0xc4800000
      icache_lock_fn @ 0xc4800080
      dcache_lock_fn @ 0xc48000a0
      icache_unlock_fn @ 0xc4800098
      dcache_unlock_fn @ 0xc48000f0
Initializing TLB locking
TLB locking initialized
Dentry-cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode-cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)
Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
POSIX conformance testing by UNIFIX
coyote_pci_init
setup BARs in controller
PCI Autoconfig: Found Bus 0, Device 14, Function 0
PCI Autoconfig: BAR 0, Mem, size=0x10000, address=0x4bff0000
PCI Autoconfig: Found Bus 0, Device 15, Function 0
PCI Autoconfig: BAR 0, Mem, size=0x10000, address=0x4bfe0000
PCI: bus0: Fast back to back transfers enabled
vendor:8086 device:8500 slot:0 pin:1vendor:8086 device:8500 slot:0 pin:1 ==>IRQ:-1
vendor:168c device:1b slot:14 pin:1vendor:168c device:1b slot:2 pin:1 ==>IRQ:7
vendor:168c device:13 slot:15 pin:1vendor:168c device:13 slot:3 pin:1 ==>IRQ:6
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Disabling the Out Of Memory Killer
devfs: v1.10 (20020120) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001, 2002 Red Hat, Inc., designed by Axis Communications AB.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xff001003 (irq = 13) is a XScale UART
HDLC line discipline: version $Revision: 3.3 $, maxframe=4096
N_HDLC line discipline registered.
block: 128 slots per queue, batch=32
RAMDISK driver initialized: 16 RAM disks of 32768K size 1024 blocksize
loop: loaded (max 8 devices)
Creating 6 MTD partitions on "IXP425 Residential Gateway Demo Platform Flash":
0x00000000-0x00040000 : "RedBoot"
0x00040000-0x00140000 : "zImage"
0x00140000-0x00a40000 : "initrd.bin"
0x00a40000-0x00fc0000 : "unallocated space"
0x00fc0000-0x00fc1000 : "RedBoot config"
mtd: partition "RedBoot config" doesn't end on an erase block -- force read-only
0x00fe0000-0x01000000 : "FIS directory"
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 8192)
IP-Config: No network devices available.
ip_conntrack (512 buckets, 4096 max)
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 9216K
VFS: Mounted root (ext2 filesystem).
Mounted devfs on /dev
Freeing init memory: 84K
Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/ixp400.o
Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/ixp425_eth.o
ixp425_eth: Initializing IXP425 NPE Ethernet driver software v. 1.2
ixp425_eth: CPU clock speed (approx) = 527 MHz

num_phys_to_set: 3
ixp425_eth: ixp0 is using NPEB and the PHY at address 2
ixp425_eth: ixp1 is using NPEC and the PHY at address 1
ixp425_eth: Use default MAC address 00:02:b3:01:01:01 for port 0
ixp425_eth: Use default MAC address 00:02:b3:02:02:02 for port 1
Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/net/rt61sta01.o
insmod: init_module: rt61sta01: No such device
Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/net/rt61sta03.o
insmod: init_module: rt61sta03: No such device
Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/net/rt61sta05.o
insmod: init_module: rt61sta05: No such device
Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/net/rt61sta07.o
insmod: init_module: rt61sta07: No such device
SIOCSIFHWADDR: No such device
SIOCSIFADDR: No such device
device ixp1 entered promiscuous mode
interface wlan0 does not exist!
br0: port 1(ixp1) entering listening state
wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan1     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.

wlan0     no private ioctls.


Please press Enter to activate this console. br0: port 1(ixp1) entering learning state
br0: port 1(ixp1) entering forwarding state
br0: topology change detected, propagating



BusyBox v1.00-rc2 (2006.08.08-09:59+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

$

Wilibox Firmware

PCI GPIO 0.1.2.6 CF-IDE GPIO 12 configured.
+
PHY 100/Full/Auto configured.
Ethernet eth0: MAC address 00:05:9e:44:00:a1
IP: 192.168.1.11/255.255.255.0, Gateway: 192.168.1.254
Default server: 192.168.1.254, DNS server IP: 192.168.1.254

RedBoot(tm) bootstrap and debug environment [ROM]
ZinWell Release Version 1.0.0 - built 14:02:56, Mar 19 2007

Platform: Intel Generic Residential Gateway (XScale)
RAM: 0x00000000-0x04000000, 0x0001f860-0x03fd1000 available
FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each.
== Executing boot script in 10.000 seconds - enter ^C to abort
RedBoot> fis load kernel1
RedBoot> exec -c "root=/dev/mtdblock2 init=/linuxrc ro"
Using base address 0x01600000 and length 0x00100000
Uncompressing Linux................................................................ done, booting the kernel.
[17179569.184000] Linux version 2.6.18.8 (buildd2@builder) (gcc version 4.1.2 20061007 (prerelease)) #1 Tue Feb 12 03:13:20 EET 2008
[17179569.184000] CPU: XScale-IXP42x Family [690541c2] revision 2 (ARMv5TE), cr=000039ff
[17179569.184000] Machine: Zinwell ZW4400 Development Platform
[17179569.184000] Memory policy: ECC disabled, Data cache writeback
[17179569.184000] CPU0: D VIVT undefined 5 cache
[17179569.184000] CPU0: I cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
[17179569.184000] CPU0: D cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
[17179569.184000] Built 1 zonelists.  Total pages: 16384
[17179569.184000] Kernel command line: root=/dev/mtdblock2 console=ttyS0,115200 ro init=/linuxrc root=/dev/mtdblock2 init=/linuxrc ro
[17179569.184000] PID hash table entries: 512 (order: 9, 2048 bytes)
[17179569.184000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[17179569.184000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[17179569.188000] Memory: 64MB = 64MB total
[17179569.188000] Memory: 62860KB available (1588K code, 327K data, 88K init)
[17179569.288000] Mount-cache hash table entries: 512
[17179569.288000] CPU: Testing write buffer coherency: ok
[17179569.288000] NET: Registered protocol family 16
[17179569.292000] IXP4xx: Using 16MiB expansion bus window size
[17179569.292000] PCI: IXP4xx is host
[17179569.292000] PCI: IXP4xx Using direct access for memory space
[17179569.292000] PCI: bus0: Fast back to back transfers enabled
[17179569.292000] dmabounce: registered device 0000:00:0e.0 on pci bus
[17179569.292000] dmabounce: registered device 0000:00:0f.0 on pci bus
[17179569.292000] PCI: map_irq(slot=14, pin=1) = 7
[17179569.292000] PCI: map_irq(slot=15, pin=1) = 6
[17179569.292000] NET: Registered protocol family 2
[17179569.332000] IP route cache hash table entries: 512 (order: -1, 2048 bytes)
[17179569.332000] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[17179569.332000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[17179569.332000] TCP: Hash tables configured (established 2048 bind 1024)
[17179569.332000] TCP reno registered
[17179569.332000] NetWinder Floating Point Emulator V0.97 (double precision)
[17179569.332000] squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
[17179569.332000] squashfs: LZMA suppport for slax.org by jro
[17179569.332000] JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
[17179569.332000] Initializing Cryptographic API
[17179569.332000] io scheduler noop registered (default)
[17179569.452000] IXP4xx Watchdog Timer: heartbeat 60 sec
[17179569.452000] ixp425_gpio: IXP425 GPIO driver loaded
[17179569.452000] Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
[17179569.456000] serial8250.0: ttyS0 at MMIO 0xc8001000 (irq = 13) is a XScale
[17179569.704000] PPP generic driver version 2.4.2
[17179569.712000] PPP Deflate Compression module registered
[17179569.716000] PPP BSD Compression module registered
[17179569.720000] NET: Registered protocol family 24
[17179569.728000] IXP4XX-Flash.0: Found 1 x16 devices at 0x0 in 16-bit bank
[17179569.732000]  Intel/Sharp Extended Query Table at 0x0031
[17179569.740000] Using buffer write method
[17179569.744000] cfi_cmdset_0001: Erase suspend on write enabled
[17179569.748000] Searching for RedBoot partition table in IXP4XX-Flash.0 at offset 0xfe0000
[17179569.872000] drivers/mtd/redboot.c: adjusted dev mtd1 size from 4096 to 131072 bytes
[17179569.880000] 9 RedBoot partitions found on MTD device IXP4XX-Flash.0
[17179569.888000] Creating 9 MTD partitions on "IXP4XX-Flash.0":
[17179569.892000] 0x00000000-0x00040000 : "RedBoot"
[17179569.896000] 0x00040000-0x00140000 : "kernel1"
[17179569.900000] 0x00140000-0x00640000 : "cramfs1"
[17179569.908000] 0x00640000-0x00740000 : "kernel2"
[17179569.912000] 0x00740000-0x00c40000 : "cramfs2"
[17179569.916000] 0x00c40000-0x00cc0000 : "cfg"
[17179569.920000] 0x00ce0000-0x00fc0000 : "etc"
[17179569.924000] 0x00fc0000-0x00fe0000 : "RedBoot config"
[17179569.932000] 0x00fe0000-0x01000000 : "FIS directory"
[17179569.936000] TCP bic registered
[17179569.940000] NET: Registered protocol family 1
[17179569.952000] VFS: Mounted root (squashfs filesystem) readonly.
[17179569.956000] Freeing init memory: 88K
Populating '/etc/' directory structure ... done.
Linking '/usr/etc/*' files under '/etc' ... done
Starting /sbin/init ...
init started: BusyBox v1.5.0 (2008-02-12 03:09:29 EET) multi-call binary
starting pid 76, tty '': '/etc/rc.d/rc.sysinit'
[17179572.812000] ixp400: module license 'unspecified' taints kernel.
[17179573.192000] ixp400_eth: Initializing IXP400 NPE Ethernet driver software v. 1.6
[17179573.200000] ixp400_eth: CPU clock speed (approx) = 532 MHz
[17179573.620000] [error] ixEthMiiPhyScan, Mii 0: unexpected Mii PHY ID 02430d80
[17179574.024000] [error] ixEthMiiPhyScan, Mii 1: unexpected Mii PHY ID 02430d80
[17179574.428000] ixp400_eth: ixp0 is using NPEB and the PHY at address 0
[17179574.432000] ixp400_eth: ixp1 is using NPEC and the PHY at address 1
[17179574.440000] ixp400_eth: Use default MAC address 00:02:b3:01:01:01 for port 0
[17179574.452000] ixp400_eth: Use default MAC address 00:02:b3:02:02:02 for port 1
[17179574.656000] ath_hal: 0.9.18.0 (AR5210, AR5211, AR5212, RF5111, RF5112, RF2413, RF5413, REGOPS_FUNC)
[17179574.928000] wlan: 0.8.4.2 (svn r18792)
[17179575.068000] wlan: mac acl policy registered
modprobe: module ath_rate_minstrel not found
modprobe: failed to load module ath_rate_minstrel
[17179575.348000] ath_rate_sample: 1.2 (svn r18792)
[17179575.512000] ath_pci: 0.9.4.5 (svn r18792)
[17179575.516000] PCI: enabling device 0000:00:0e.0 (0340 -> 0342)
[17179576.216000] ath_find_eeprom: macaddr location in hal found at c02ba6a8 offset from last chan 6788
[17179576.224000] ath_print_eeprom: mac: 00:0c:42:1f:3d:ac, version 0x5003, regdomain 0x0 A/B/G=1/1/1
[17179576.232000] ath_print_eeprom: antennaGain= 0x4/0x1
[17179576.240000] ath_print_eeprom: cntls:0x10:0x13:0x11:0x12:0x14:0x40:0x41:0x42:0x30:0x31:0x32:0x34:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0
[17179576.256000] wifi0: 11a rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
[17179576.264000] wifi0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
[17179576.268000] wifi0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
[17179576.280000] wifi0: turboA rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
[17179576.288000] wifi0: turboG rates: 6Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
[17179576.296000] wifi0: H/W encryption support: WEP AES AES_CCM TKIP
[17179576.300000] wifi0: mac 10.5 phy 6.1 radio 6.3
[17179576.308000] wifi0: Use hw queue 1 for WME_AC_BE traffic
[17179576.312000] wifi0: Use hw queue 0 for WME_AC_BK traffic
[17179576.316000] wifi0: Use hw queue 2 for WME_AC_VI traffic
[17179576.324000] wifi0: Use hw queue 3 for WME_AC_VO traffic
[17179576.328000] wifi0: Use hw queue 8 for CAB traffic
[17179576.332000] wifi0: Use hw queue 9 for beacons
[17179576.340000] wifi0: TX99 support enabled
[17179576.344000] wifi0: Atheros 5212: mem=0x48000000, irq=7
[17179576.348000] PCI: enabling device 0000:00:0f.0 (0340 -> 0342)
[17179576.996000] ath_find_eeprom: macaddr location in hal found at c347a6a8 offset from last chan 6788
[17179577.004000] ath_print_eeprom: mac: 00:0c:42:1b:df:5c, version 0x5002, regdomain 0x0 A/B/G=1/1/1
[17179577.012000] ath_print_eeprom: antennaGain= 0x4/0x1
[17179577.016000] ath_print_eeprom: cntls:0x10:0x13:0x11:0x12:0x14:0x40:0x30:0x31:0x32:0x34:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0
[17179577.036000] wifi1: 11a rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
[17179577.044000] wifi1: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
[17179577.048000] wifi1: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
[17179577.060000] wifi1: turboA rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
[17179577.068000] wifi1: turboG rates: 6Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
[17179577.076000] wifi1: H/W encryption support: WEP AES AES_CCM TKIP
[17179577.080000] wifi1: mac 10.5 phy 6.1 radio 6.3
[17179577.084000] wifi1: Use hw queue 1 for WME_AC_BE traffic
[17179577.092000] wifi1: Use hw queue 0 for WME_AC_BK traffic
[17179577.096000] wifi1: Use hw queue 2 for WME_AC_VI traffic
[17179577.100000] wifi1: Use hw queue 3 for WME_AC_VO traffic
[17179577.108000] wifi1: Use hw queue 8 for CAB traffic
[17179577.112000] wifi1: Use hw queue 9 for beacons
[17179577.116000] wifi1: TX99 support enabled
[17179577.120000] wifi1: Atheros 5212: mem=0x48010000, irq=6
RedBoot config checksum OK
ixp0: 00 05 9E 44 00 A1
ixp1: 00 05 9E 44 00 A2
[17179577.420000] NET: Registered protocol family 17
[17179577.428000] ixp0: lost carrier
Waiting for reset to factory defaults packet.....
[17179580.832000] ixp0: carrier detected
starting pid 146, tty '': '/usr/etc/rc.d/rc-bg'
starting pid 150, tty '/dev/ttyS0': '/sbin/getty'
ath0
[17179583.444000] ip_tables: (C) 2000-2006 Netfilter Core Team
[17179583.660000] ip_conntrack version 2.4 (512 buckets, 4096 max) - 212 bytes per conntrack
/usr/etc/init.d/plugin: line 98: ethtool: not found
/usr/etc/init.d/plugin: line 98: ethtool: not found
/usr/etc/init.d/plugin: line 98: ethtool: not found
00:00:15 [I] Launched 'sshd' successfully in respawning mode.
ls: /etc/persistent/skins/*.tgz: No such file or directory
00:00:15 [I] Launched 'httpd' successfully in respawning mode.
[17179585.668000] process `snmpd' is using obsolete setsockopt SO_BSDCOMPAT
00:00:16 [I] Launched 'snmpd' successfully in respawning mode.
[17179585.916000] process `rcmsd' is using obsolete setsockopt SO_BSDCOMPAT
00:00:16 [I] Launched 'rcms' successfully in respawning mode.
00:00:16 [I] Launched 'discoveryd' successfully in respawning mode.
00:00:16 [I] Launched 'udhcpdixp0' successfully in respawning mode.
00:00:16 [I] Launched 'udhcpdath0' successfully in respawning mode.
00:00:17 [I] Launched 'udhcpcixp1' successfully in respawning mode.

WILIBOX login:

MontaVista Firmware

PCI GPIO 0.1.2.6 CF-IDE GPIO 12 configured.
+
PHY 100/Full/Auto configured.
Ethernet eth0: MAC address 00:05:9e:44:00:a1
IP: 192.168.1.11/255.255.255.0, Gateway: 192.168.1.254
Default server: 192.168.1.254, DNS server IP: 192.168.1.254

RedBoot(tm) bootstrap and debug environment [ROM]
ZinWell Release Version 1.0.0 - built 14:02:56, Mar 19 2007

Platform: Intel Generic Residential Gateway (XScale)
RAM: 0x00000000-0x04000000, 0x0001f860-0x03fd1000 available
FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each.
== Executing boot script in 10.000 seconds - enter ^C to abort
RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0x50000000  0x50000000  0x00040000  0x00000000
RedBoot config    0x50FC0000  0x50FC0000  0x00001000  0x00000000
FIS directory     0x50FE0000  0x50FE0000  0x00020000  0x00000000
kernel            0x50040000  0x00100000  0x00100000  0x00100000
initrd            0x50100000  0x00200000  0x00820000  0x00200000
RedBoot> fis load initrd
RedBoot> fis load kernel
RedBoot> exec
Using base address 0x00100000 and length 0x000bad78
Uncompressing Linux..................................................... done, booting the kernel.
Linux version 2.4.18_mvl30-ixdp425 (mercy1@RD3Linux.zintech.com.tw) (gcc version 3.2.1 20020930 (MontaVista)) #26 Tue Mar 13 10:36:33 CST 2007
CPU: Intel XScale-IXP4xx/IXC1100 revision 2
Machine: Intel IXP425 Residential Gateway Demo Platform
Warning: bad configuration page, trying to continue
On node 0 totalpages: 16384
zone(0): 16384 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS0,115200 root=/dev/ram ramdisk_size=32768 initrd=0x00200000,9M mem=64M
Calibrating delay loop... 527.56 BogoMIPS
Memory: 64MB = 64MB total
Memory: 53568KB available (1405K code, 258K data, 84K init)
XScale Cache/TLB Locking Copyright(c) 2001 MontaVista Software, Inc.
XScale cache_lock_init called
   Calling consistent alloc
   low_level_page initialized
   low_level_page @ 0xc4800000
      icache_lock_fn @ 0xc4800080
      dcache_lock_fn @ 0xc48000a0
      icache_unlock_fn @ 0xc4800098
      dcache_unlock_fn @ 0xc48000f0
Initializing TLB locking
TLB locking initialized
Dentry-cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode-cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)
Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
POSIX conformance testing by UNIFIX
coyote_pci_init
setup BARs in controller
PCI Autoconfig: Found Bus 0, Device 14, Function 0
PCI Autoconfig: BAR 0, Mem, size=0x10000, address=0x4bff0000
PCI Autoconfig: Found Bus 0, Device 15, Function 0
PCI Autoconfig: BAR 0, Mem, size=0x10000, address=0x4bfe0000
PCI: bus0: Fast back to back transfers enabled
vendor:8086 device:8500 slot:0 pin:1vendor:8086 device:8500 slot:0 pin:1 ++++++IRQ:-1
vendor:168c device:1b slot:14 pin:1vendor:168c device:1b slot:2 pin:1 ++++++IRQ:7
vendor:168c device:13 slot:15 pin:1vendor:168c device:13 slot:3 pin:1 ++++++IRQ:6
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Disabling the Out Of Memory Killer
devfs: v1.10 (20020120) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001, 2002 Red Hat, Inc., designed by Axis Communications AB.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xff001003 (irq = 13) is a XScale UART
HDLC line discipline: version $Revision: 3.3 $, maxframe=4096
N_HDLC line discipline registered.
block: 128 slots per queue, batch=32
RAMDISK driver initialized: 16 RAM disks of 32768K size 1024 blocksize
Uniform Multi-Platform E-IDE driver Revision: 6.31
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
loop: loaded (max 8 devices)
Creating 6 MTD partitions on "IXP425 Residential Gateway Demo Platform Flash":
0x00000000-0x00040000 : "RedBoot"
0x00040000-0x00140000 : "kernel"
0x00100000-0x00920000 : "initrd"
0x00920000-0x00fc0000 : "unallocated space"
0x00fc0000-0x00fc1000 : "RedBoot config"
mtd: partition "RedBoot config" doesn't end on an erase block -- force read-only
0x00fe0000-0x01000000 : "FIS directory"
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 8192)
IP-Config: No network devices available.
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
cryptoapi: loaded
cryptoapi: Registered aes-ecb (0)
cryptoapi: Registered aes-cbc (65536)
cryptoapi: Registered aes-cfb (262144)
NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 9216K
VFS: Mounted root (ext2 filesystem).
Mounted devfs on /dev
Freeing init memory: 84K
Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/ixp400.o
Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/ixp425_eth.o
ixp425_eth: Initializing IXP425 NPE Ethernet driver software v. 1.2
ixp425_eth: CPU clock speed (approx) = 527 MHz
ixp425_eth: ixp0 is using NPEB and the PHY at address 2
ixp425_eth: ixp1 is using NPEC and the PHY at address 1
ixp425_eth: Use default MAC address 00:02:b3:01:01:01 for port 0
ixp425_eth: Use default MAC address 00:02:b3:02:02:02 for port 1
Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/net/rt61ap.o
insmod: init_module: rt61ap: No such device
SIOCSIFADDR: No such device
device ixp1 entered promiscuous mode
interface ra0 does not exist!
br0: port 1(ixp1) entering listening state

Flash layout

RedBoot> fis list
Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0x50000000  0x50000000  0x00040000  0x00000000
RedBoot config    0x50FC0000  0x50FC0000  0x00001000  0x00000000
FIS directory     0x50FE0000  0x50FE0000  0x00020000  0x00000000
zImage            0x50040000  0x00100000  0x00100000  0x00100000
initrd.bin        0x50140000  0x00200000  0x00900000  0x00200000
RedBoot>

Telnet into RedBoot

You can change the RedBoot configuration, so you can later telnet into this bootloader in order to reflash this device from there, without having serial access.

The default form of the fconfig command will force you to enter the data, change and confirm every initialized variable. To avoid reentering the Boot script data and harming unnecessary variables, run the “fconfig list” command first to look at variable names and values:

RedBoot> fconfig -l -n
boot_script: true
boot_script_data:
.. fis load initrd.bin
.. fis load zImage
.. exec -c

boot_script_timeout: 1
bootp: false
bootp_my_gateway_ip: 0.0.0.0
bootp_my_ip: 0.0.0.0
bootp_my_ip_mask: 0.0.0.0
bootp_server_ip: 0.0.0.0
console_baud_rate: 115200
dns_ip: 0.0.0.0
gdb_port: 9000
info_console_force: false
net_debug: false
net_device: i82559_eth0
npe_eth0_esa: 0x00:0x05:0x9E:0x44:0x00:0xA1
npe_eth1_esa: 0x00:0x05:0x9E:0x44:0x00:0xA2
RedBoot>

Next change only necessary variables (using their names from the previous listing) and update the RedBoot non-volatile configuration after the last change:

RedBoot> fconfig boot_script_timeout 10
boot_script_timeout: Setting to 10
Update RedBoot non-volatile configuration - continue (y/n)? n
RedBoot> fconfig bootp_my_gateway_ip 192.168.1.254
bootp_my_gateway_ip: Setting to 192.168.1.254
Update RedBoot non-volatile configuration - continue (y/n)? n
RedBoot> fconfig bootp_my_ip 192.168.1.11
bootp_my_ip: Setting to 192.168.1.11
Update RedBoot non-volatile configuration - continue (y/n)? n
RedBoot> fconfig bootp_server_ip 192.168.1.254
bootp_server_ip: Setting to 192.168.1.254
Update RedBoot non-volatile configuration - continue (y/n)? n
RedBoot> fconfig dns_ip 192.168.1.254
dns_ip: Setting to 192.168.1.254
Update RedBoot non-volatile configuration - continue (y/n)? n
RedBoot> fconfig bootp_my_ip_mask 255.255.255.0
bootp_my_ip_mask: Setting to 255.255.255.0
Update RedBoot non-volatile configuration - continue (y/n)? y
... Unlock from 0x50fc0000-0x50fc1000: .
... Erase from 0x50fc0000-0x50fc1000: .
... Program from 0x03fd2000-0x03fd3000 at 0x50fc0000: .
... Lock from 0x50fc0000-0x50fc1000: .
RedBoot>

Note: The configuration is only in the RAM until you update the RedBoot non-volatile configuration. If you reset the device without updating, the configuration will not be changed. You can use changes without the update for temporary settings.

Verify the configuration by listing the aliases this time:

RedBoot> fconfig -l
Run script at boot: true
Boot script:
.. fis load initrd.bin
.. fis load zImage
.. exec -c

Boot script timeout (1000ms resolution): 10
Use BOOTP for network configuration: false
Gateway IP address: 192.168.1.254
Local IP address: 192.168.1.11
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.254
Console baud rate: 115200
DNS server IP address: 192.168.1.254
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Default network device: i82559_eth0
Network hardware address [MAC] for NPE eth0: 0x00:0x05:0x9E:0x44:0x00:0xA1
Network hardware address [MAC] for NPE eth1: 0x00:0x05:0x9E:0x44:0x00:0xA2
RedBoot>

I specified a 10 second timeout here, so I have this 10 second time frame to telnet into RedBoot. If you are not able to hit the enter-key within 10 seconds after powering up, go for a larger time frame.

$ arping -qf 192.168.1.11 ; telnet 192.168.1.11 9000
WARNING: interface is ignored: Operation not permitted
Trying 192.168.1.11...
?Invalid command
Connected to 192.168.1.11.
Escape character is '^]'.
== Executing boot script in 9.940 seconds - enter ^C to abort
^C
RedBoot>

Resources

Tags

toh/zinwell/zw4400.txt · Last modified: 2018/06/23 12:00 by tmomas