Zinwell ZW-4400
This device is also known as a Titan Wireless TW-533-4. The MAC addresses flashed to the board are a Zinwell OUI (00059E = Zinwell Corporation).
I obtained the bare PCB from Titan Wireless (http://www.titanwirelessonline.com/ProductDetails.asp?ProductCode=TW-533-4).
OpenWrt support
Until 18.06.8.
Hardware
Info
| Architecture | XScale IXP42x |
|---|---|
| Vendor | Zinwell |
| Bootloader | RedBoot |
| System-On-Chip | Intel IXP425 |
| CPU Speed | 533 MHz |
| Flash size | 16 MiB |
| RAM | 64 MiB |
| Wireless | 4x miniPCI |
| Ethernet | 2x RJ45 10/100 |
| USB | No |
| Serial | Yes (3.3V) |
| JTAG | Yes (20pin ARM) |
| Power | 48V POE |
Serial Port
J2 (the unique header socket to the right of J4)
Pin 1 is marked with a triangle.
Pin 4 is 3.3V RX (input to board)
Pin 6 is 3.3V TX (output from board)
Pin 8 is 0V GND
Pin 9 is empty.
The terminal settings for the connection:
115200 / 8 data bits / no parity / 1 stop bit / no flow control
Photos
JTAG
There seems to be a 20 pin JTAG, but it is not that important as the RedBoot boatloader does not seem to be crippled.
Basic configuration
Please follow the checks_and_troubleshooting guide.
Specific Configuration
Interfaces
The default network configuration is:
| Interface Name | Description | Default configuration |
|---|---|---|
| br-lan | LAN & WiFi | 192.168.1.1/24 |
| eth0 | LAN (port 0) | None |
| eth1 | WAN (port 1) | DHCP |
NOTE: eth0 must be connected with both power and Ethernet for interfaces br-lan and eth1 to be enabled and usable. Additionally, PoE circuit breakers prevent connection to some Gigabit Ethernet switches.
Original software
PCI GPIO 0.1.2.6 CF-IDE GPIO 12 configured. + PHY 100/Full/Auto configured. Ethernet eth0: MAC address 00:05:9e:44:00:a1 IP: 0.0.0.0/255.255.255.0, Gateway: 0.0.0.0 Default server: 0.0.0.0, DNS server IP: 0.0.0.0 RedBoot(tm) bootstrap and debug environment [ROM] ZinWell Release Version 1.0.0 - built 14:02:56, Mar 19 2007 Platform: Intel Generic Residential Gateway (XScale) RAM: 0x00000000-0x04000000, 0x0001f860-0x03fd1000 available FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each. == Executing boot script in 1.000 seconds - enter ^C to abort RedBoot> fis load initrd.bin RedBoot> fis load zImage RedBoot> exec -c Using base address 0x00100000 and length 0x00100000 Uncompressing Linux................................................... done, booting the kernel. Linux version 2.4.18_mvl30-ixdp425 (choise@RD3Linux.zintech.com.tw) (gcc version 3.2.1 20020930 (MontaVista)) #50 Thu Jun 28 15:33:33 CST 2007 CPU: Intel XScale-IXP4xx/IXC1100 revision 2 Machine: Intel IXP425 Residential Gateway Demo Platform Warning: bad configuration page, trying to continue On node 0 totalpages: 16384 zone(0): 16384 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: console=ttyS0,115200 root=/dev/ram ramdisk_size=32768 initrd=0x00200000,9M mem=64M Calibrating delay loop... 527.56 BogoMIPS Memory: 64MB = 64MB total Memory: 53640KB available (1350K code, 241K data, 84K init) XScale Cache/TLB Locking Copyright(c) 2001 MontaVista Software, Inc. XScale cache_lock_init called Calling consistent alloc low_level_page initialized low_level_page @ 0xc4800000 icache_lock_fn @ 0xc4800080 dcache_lock_fn @ 0xc48000a0 icache_unlock_fn @ 0xc4800098 dcache_unlock_fn @ 0xc48000f0 Initializing TLB locking TLB locking initialized Dentry-cache hash table entries: 8192 (order: 4, 65536 bytes) Inode-cache hash table entries: 4096 (order: 3, 32768 bytes) Mount-cache hash table entries: 1024 (order: 1, 8192 bytes) Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes) Page-cache hash table entries: 16384 (order: 4, 65536 bytes) POSIX conformance testing by UNIFIX coyote_pci_init setup BARs in controller PCI Autoconfig: Found Bus 0, Device 14, Function 0 PCI Autoconfig: BAR 0, Mem, size=0x10000, address=0x4bff0000 PCI Autoconfig: Found Bus 0, Device 15, Function 0 PCI Autoconfig: BAR 0, Mem, size=0x10000, address=0x4bfe0000 PCI: bus0: Fast back to back transfers enabled vendor:8086 device:8500 slot:0 pin:1vendor:8086 device:8500 slot:0 pin:1 ==>IRQ:-1 vendor:168c device:1b slot:14 pin:1vendor:168c device:1b slot:2 pin:1 ==>IRQ:7 vendor:168c device:13 slot:15 pin:1vendor:168c device:13 slot:3 pin:1 ==>IRQ:6 Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd Disabling the Out Of Memory Killer devfs: v1.10 (20020120) Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 JFFS2 version 2.1. (C) 2001, 2002 Red Hat, Inc., designed by Axis Communications AB. pty: 256 Unix98 ptys configured Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled ttyS00 at 0xff001003 (irq = 13) is a XScale UART HDLC line discipline: version $Revision: 3.3 $, maxframe=4096 N_HDLC line discipline registered. block: 128 slots per queue, batch=32 RAMDISK driver initialized: 16 RAM disks of 32768K size 1024 blocksize loop: loaded (max 8 devices) Creating 6 MTD partitions on "IXP425 Residential Gateway Demo Platform Flash": 0x00000000-0x00040000 : "RedBoot" 0x00040000-0x00140000 : "zImage" 0x00140000-0x00a40000 : "initrd.bin" 0x00a40000-0x00fc0000 : "unallocated space" 0x00fc0000-0x00fc1000 : "RedBoot config" mtd: partition "RedBoot config" doesn't end on an erase block -- force read-only 0x00fe0000-0x01000000 : "FIS directory" NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 4096 bind 8192) IP-Config: No network devices available. ip_conntrack (512 buckets, 4096 max) ip_tables: (C) 2000-2002 Netfilter core team NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com RAMDISK: Compressed image found at block 0 Freeing initrd memory: 9216K VFS: Mounted root (ext2 filesystem). Mounted devfs on /dev Freeing init memory: 84K Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/ixp400.o Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/ixp425_eth.o ixp425_eth: Initializing IXP425 NPE Ethernet driver software v. 1.2 ixp425_eth: CPU clock speed (approx) = 527 MHz num_phys_to_set: 3 ixp425_eth: ixp0 is using NPEB and the PHY at address 2 ixp425_eth: ixp1 is using NPEC and the PHY at address 1 ixp425_eth: Use default MAC address 00:02:b3:01:01:01 for port 0 ixp425_eth: Use default MAC address 00:02:b3:02:02:02 for port 1 Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/net/rt61sta01.o insmod: init_module: rt61sta01: No such device Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/net/rt61sta03.o insmod: init_module: rt61sta03: No such device Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/net/rt61sta05.o insmod: init_module: rt61sta05: No such device Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/net/rt61sta07.o insmod: init_module: rt61sta07: No such device SIOCSIFHWADDR: No such device SIOCSIFADDR: No such device device ixp1 entered promiscuous mode interface wlan0 does not exist! br0: port 1(ixp1) entering listening state wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan1 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. wlan0 no private ioctls. Please press Enter to activate this console. br0: port 1(ixp1) entering learning state br0: port 1(ixp1) entering forwarding state br0: topology change detected, propagating BusyBox v1.00-rc2 (2006.08.08-09:59+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. $
Wilibox Firmware
PCI GPIO 0.1.2.6 CF-IDE GPIO 12 configured. + PHY 100/Full/Auto configured. Ethernet eth0: MAC address 00:05:9e:44:00:a1 IP: 192.168.1.11/255.255.255.0, Gateway: 192.168.1.254 Default server: 192.168.1.254, DNS server IP: 192.168.1.254 RedBoot(tm) bootstrap and debug environment [ROM] ZinWell Release Version 1.0.0 - built 14:02:56, Mar 19 2007 Platform: Intel Generic Residential Gateway (XScale) RAM: 0x00000000-0x04000000, 0x0001f860-0x03fd1000 available FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each. == Executing boot script in 10.000 seconds - enter ^C to abort RedBoot> fis load kernel1 RedBoot> exec -c "root=/dev/mtdblock2 init=/linuxrc ro" Using base address 0x01600000 and length 0x00100000 Uncompressing Linux................................................................ done, booting the kernel. [17179569.184000] Linux version 2.6.18.8 (buildd2@builder) (gcc version 4.1.2 20061007 (prerelease)) #1 Tue Feb 12 03:13:20 EET 2008 [17179569.184000] CPU: XScale-IXP42x Family [690541c2] revision 2 (ARMv5TE), cr=000039ff [17179569.184000] Machine: Zinwell ZW4400 Development Platform [17179569.184000] Memory policy: ECC disabled, Data cache writeback [17179569.184000] CPU0: D VIVT undefined 5 cache [17179569.184000] CPU0: I cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets [17179569.184000] CPU0: D cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets [17179569.184000] Built 1 zonelists. Total pages: 16384 [17179569.184000] Kernel command line: root=/dev/mtdblock2 console=ttyS0,115200 ro init=/linuxrc root=/dev/mtdblock2 init=/linuxrc ro [17179569.184000] PID hash table entries: 512 (order: 9, 2048 bytes) [17179569.184000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [17179569.184000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [17179569.188000] Memory: 64MB = 64MB total [17179569.188000] Memory: 62860KB available (1588K code, 327K data, 88K init) [17179569.288000] Mount-cache hash table entries: 512 [17179569.288000] CPU: Testing write buffer coherency: ok [17179569.288000] NET: Registered protocol family 16 [17179569.292000] IXP4xx: Using 16MiB expansion bus window size [17179569.292000] PCI: IXP4xx is host [17179569.292000] PCI: IXP4xx Using direct access for memory space [17179569.292000] PCI: bus0: Fast back to back transfers enabled [17179569.292000] dmabounce: registered device 0000:00:0e.0 on pci bus [17179569.292000] dmabounce: registered device 0000:00:0f.0 on pci bus [17179569.292000] PCI: map_irq(slot=14, pin=1) = 7 [17179569.292000] PCI: map_irq(slot=15, pin=1) = 6 [17179569.292000] NET: Registered protocol family 2 [17179569.332000] IP route cache hash table entries: 512 (order: -1, 2048 bytes) [17179569.332000] TCP established hash table entries: 2048 (order: 1, 8192 bytes) [17179569.332000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [17179569.332000] TCP: Hash tables configured (established 2048 bind 1024) [17179569.332000] TCP reno registered [17179569.332000] NetWinder Floating Point Emulator V0.97 (double precision) [17179569.332000] squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher [17179569.332000] squashfs: LZMA suppport for slax.org by jro [17179569.332000] JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc. [17179569.332000] Initializing Cryptographic API [17179569.332000] io scheduler noop registered (default) [17179569.452000] IXP4xx Watchdog Timer: heartbeat 60 sec [17179569.452000] ixp425_gpio: IXP425 GPIO driver loaded [17179569.452000] Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled [17179569.456000] serial8250.0: ttyS0 at MMIO 0xc8001000 (irq = 13) is a XScale [17179569.704000] PPP generic driver version 2.4.2 [17179569.712000] PPP Deflate Compression module registered [17179569.716000] PPP BSD Compression module registered [17179569.720000] NET: Registered protocol family 24 [17179569.728000] IXP4XX-Flash.0: Found 1 x16 devices at 0x0 in 16-bit bank [17179569.732000] Intel/Sharp Extended Query Table at 0x0031 [17179569.740000] Using buffer write method [17179569.744000] cfi_cmdset_0001: Erase suspend on write enabled [17179569.748000] Searching for RedBoot partition table in IXP4XX-Flash.0 at offset 0xfe0000 [17179569.872000] drivers/mtd/redboot.c: adjusted dev mtd1 size from 4096 to 131072 bytes [17179569.880000] 9 RedBoot partitions found on MTD device IXP4XX-Flash.0 [17179569.888000] Creating 9 MTD partitions on "IXP4XX-Flash.0": [17179569.892000] 0x00000000-0x00040000 : "RedBoot" [17179569.896000] 0x00040000-0x00140000 : "kernel1" [17179569.900000] 0x00140000-0x00640000 : "cramfs1" [17179569.908000] 0x00640000-0x00740000 : "kernel2" [17179569.912000] 0x00740000-0x00c40000 : "cramfs2" [17179569.916000] 0x00c40000-0x00cc0000 : "cfg" [17179569.920000] 0x00ce0000-0x00fc0000 : "etc" [17179569.924000] 0x00fc0000-0x00fe0000 : "RedBoot config" [17179569.932000] 0x00fe0000-0x01000000 : "FIS directory" [17179569.936000] TCP bic registered [17179569.940000] NET: Registered protocol family 1 [17179569.952000] VFS: Mounted root (squashfs filesystem) readonly. [17179569.956000] Freeing init memory: 88K Populating '/etc/' directory structure ... done. Linking '/usr/etc/*' files under '/etc' ... done Starting /sbin/init ... init started: BusyBox v1.5.0 (2008-02-12 03:09:29 EET) multi-call binary starting pid 76, tty '': '/etc/rc.d/rc.sysinit' [17179572.812000] ixp400: module license 'unspecified' taints kernel. [17179573.192000] ixp400_eth: Initializing IXP400 NPE Ethernet driver software v. 1.6 [17179573.200000] ixp400_eth: CPU clock speed (approx) = 532 MHz [17179573.620000] [error] ixEthMiiPhyScan, Mii 0: unexpected Mii PHY ID 02430d80 [17179574.024000] [error] ixEthMiiPhyScan, Mii 1: unexpected Mii PHY ID 02430d80 [17179574.428000] ixp400_eth: ixp0 is using NPEB and the PHY at address 0 [17179574.432000] ixp400_eth: ixp1 is using NPEC and the PHY at address 1 [17179574.440000] ixp400_eth: Use default MAC address 00:02:b3:01:01:01 for port 0 [17179574.452000] ixp400_eth: Use default MAC address 00:02:b3:02:02:02 for port 1 [17179574.656000] ath_hal: 0.9.18.0 (AR5210, AR5211, AR5212, RF5111, RF5112, RF2413, RF5413, REGOPS_FUNC) [17179574.928000] wlan: 0.8.4.2 (svn r18792) [17179575.068000] wlan: mac acl policy registered modprobe: module ath_rate_minstrel not found modprobe: failed to load module ath_rate_minstrel [17179575.348000] ath_rate_sample: 1.2 (svn r18792) [17179575.512000] ath_pci: 0.9.4.5 (svn r18792) [17179575.516000] PCI: enabling device 0000:00:0e.0 (0340 -> 0342) [17179576.216000] ath_find_eeprom: macaddr location in hal found at c02ba6a8 offset from last chan 6788 [17179576.224000] ath_print_eeprom: mac: 00:00:00:00:00:00, version 0x5003, regdomain 0x0 A/B/G=1/1/1 [17179576.232000] ath_print_eeprom: antennaGain= 0x4/0x1 [17179576.240000] ath_print_eeprom: cntls:0x10:0x13:0x11:0x12:0x14:0x40:0x41:0x42:0x30:0x31:0x32:0x34:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0 [17179576.256000] wifi0: 11a rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps [17179576.264000] wifi0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps [17179576.268000] wifi0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps [17179576.280000] wifi0: turboA rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps [17179576.288000] wifi0: turboG rates: 6Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps [17179576.296000] wifi0: H/W encryption support: WEP AES AES_CCM TKIP [17179576.300000] wifi0: mac 10.5 phy 6.1 radio 6.3 [17179576.308000] wifi0: Use hw queue 1 for WME_AC_BE traffic [17179576.312000] wifi0: Use hw queue 0 for WME_AC_BK traffic [17179576.316000] wifi0: Use hw queue 2 for WME_AC_VI traffic [17179576.324000] wifi0: Use hw queue 3 for WME_AC_VO traffic [17179576.328000] wifi0: Use hw queue 8 for CAB traffic [17179576.332000] wifi0: Use hw queue 9 for beacons [17179576.340000] wifi0: TX99 support enabled [17179576.344000] wifi0: Atheros 5212: mem=0x48000000, irq=7 [17179576.348000] PCI: enabling device 0000:00:0f.0 (0340 -> 0342) [17179576.996000] ath_find_eeprom: macaddr location in hal found at c347a6a8 offset from last chan 6788 [17179577.004000] ath_print_eeprom: mac: 00:0c:42:1b:df:5c, version 0x5002, regdomain 0x0 A/B/G=1/1/1 [17179577.012000] ath_print_eeprom: antennaGain= 0x4/0x1 [17179577.016000] ath_print_eeprom: cntls:0x10:0x13:0x11:0x12:0x14:0x40:0x30:0x31:0x32:0x34:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0:0x0 [17179577.036000] wifi1: 11a rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps [17179577.044000] wifi1: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps [17179577.048000] wifi1: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps [17179577.060000] wifi1: turboA rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps [17179577.068000] wifi1: turboG rates: 6Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps [17179577.076000] wifi1: H/W encryption support: WEP AES AES_CCM TKIP [17179577.080000] wifi1: mac 10.5 phy 6.1 radio 6.3 [17179577.084000] wifi1: Use hw queue 1 for WME_AC_BE traffic [17179577.092000] wifi1: Use hw queue 0 for WME_AC_BK traffic [17179577.096000] wifi1: Use hw queue 2 for WME_AC_VI traffic [17179577.100000] wifi1: Use hw queue 3 for WME_AC_VO traffic [17179577.108000] wifi1: Use hw queue 8 for CAB traffic [17179577.112000] wifi1: Use hw queue 9 for beacons [17179577.116000] wifi1: TX99 support enabled [17179577.120000] wifi1: Atheros 5212: mem=0x48010000, irq=6 RedBoot config checksum OK ixp0: 00 05 9E 44 00 A1 ixp1: 00 05 9E 44 00 A2 [17179577.420000] NET: Registered protocol family 17 [17179577.428000] ixp0: lost carrier Waiting for reset to factory defaults packet..... [17179580.832000] ixp0: carrier detected starting pid 146, tty '': '/usr/etc/rc.d/rc-bg' starting pid 150, tty '/dev/ttyS0': '/sbin/getty' ath0 [17179583.444000] ip_tables: (C) 2000-2006 Netfilter Core Team [17179583.660000] ip_conntrack version 2.4 (512 buckets, 4096 max) - 212 bytes per conntrack /usr/etc/init.d/plugin: line 98: ethtool: not found /usr/etc/init.d/plugin: line 98: ethtool: not found /usr/etc/init.d/plugin: line 98: ethtool: not found 00:00:15 [I] Launched 'sshd' successfully in respawning mode. ls: /etc/persistent/skins/*.tgz: No such file or directory 00:00:15 [I] Launched 'httpd' successfully in respawning mode. [17179585.668000] process `snmpd' is using obsolete setsockopt SO_BSDCOMPAT 00:00:16 [I] Launched 'snmpd' successfully in respawning mode. [17179585.916000] process `rcmsd' is using obsolete setsockopt SO_BSDCOMPAT 00:00:16 [I] Launched 'rcms' successfully in respawning mode. 00:00:16 [I] Launched 'discoveryd' successfully in respawning mode. 00:00:16 [I] Launched 'udhcpdixp0' successfully in respawning mode. 00:00:16 [I] Launched 'udhcpdath0' successfully in respawning mode. 00:00:17 [I] Launched 'udhcpcixp1' successfully in respawning mode. WILIBOX login: <WRAP bootlog> <nowiki> ===== MontaVista Firmware ===== <code> PCI GPIO 0.1.2.6 CF-IDE GPIO 12 configured. + PHY 100/Full/Auto configured. Ethernet eth0: MAC address 00:05:9e:44:00:a1 IP: 192.168.1.11/255.255.255.0, Gateway: 192.168.1.254 Default server: 192.168.1.254, DNS server IP: 192.168.1.254 RedBoot(tm) bootstrap and debug environment [ROM] ZinWell Release Version 1.0.0 - built 14:02:56, Mar 19 2007 Platform: Intel Generic Residential Gateway (XScale) RAM: 0x00000000-0x04000000, 0x0001f860-0x03fd1000 available FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each. == Executing boot script in 10.000 seconds - enter ^C to abort RedBoot> fis list Name FLASH addr Mem addr Length Entry point RedBoot 0x50000000 0x50000000 0x00040000 0x00000000 RedBoot config 0x50FC0000 0x50FC0000 0x00001000 0x00000000 FIS directory 0x50FE0000 0x50FE0000 0x00020000 0x00000000 kernel 0x50040000 0x00100000 0x00100000 0x00100000 initrd 0x50100000 0x00200000 0x00820000 0x00200000 RedBoot> fis load initrd RedBoot> fis load kernel RedBoot> exec Using base address 0x00100000 and length 0x000bad78 Uncompressing Linux..................................................... done, booting the kernel. Linux version 2.4.18_mvl30-ixdp425 (mercy1@RD3Linux.zintech.com.tw) (gcc version 3.2.1 20020930 (MontaVista)) #26 Tue Mar 13 10:36:33 CST 2007 CPU: Intel XScale-IXP4xx/IXC1100 revision 2 Machine: Intel IXP425 Residential Gateway Demo Platform Warning: bad configuration page, trying to continue On node 0 totalpages: 16384 zone(0): 16384 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: console=ttyS0,115200 root=/dev/ram ramdisk_size=32768 initrd=0x00200000,9M mem=64M Calibrating delay loop... 527.56 BogoMIPS Memory: 64MB = 64MB total Memory: 53568KB available (1405K code, 258K data, 84K init) XScale Cache/TLB Locking Copyright(c) 2001 MontaVista Software, Inc. XScale cache_lock_init called Calling consistent alloc low_level_page initialized low_level_page @ 0xc4800000 icache_lock_fn @ 0xc4800080 dcache_lock_fn @ 0xc48000a0 icache_unlock_fn @ 0xc4800098 dcache_unlock_fn @ 0xc48000f0 Initializing TLB locking TLB locking initialized Dentry-cache hash table entries: 8192 (order: 4, 65536 bytes) Inode-cache hash table entries: 4096 (order: 3, 32768 bytes) Mount-cache hash table entries: 1024 (order: 1, 8192 bytes) Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes) Page-cache hash table entries: 16384 (order: 4, 65536 bytes) POSIX conformance testing by UNIFIX coyote_pci_init setup BARs in controller PCI Autoconfig: Found Bus 0, Device 14, Function 0 PCI Autoconfig: BAR 0, Mem, size=0x10000, address=0x4bff0000 PCI Autoconfig: Found Bus 0, Device 15, Function 0 PCI Autoconfig: BAR 0, Mem, size=0x10000, address=0x4bfe0000 PCI: bus0: Fast back to back transfers enabled vendor:8086 device:8500 slot:0 pin:1vendor:8086 device:8500 slot:0 pin:1 ++++++IRQ:-1 vendor:168c device:1b slot:14 pin:1vendor:168c device:1b slot:2 pin:1 ++++++IRQ:7 vendor:168c device:13 slot:15 pin:1vendor:168c device:13 slot:3 pin:1 ++++++IRQ:6 Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 Initializing RT netlink socket Starting kswapd Disabling the Out Of Memory Killer devfs: v1.10 (20020120) Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 JFFS2 version 2.1. (C) 2001, 2002 Red Hat, Inc., designed by Axis Communications AB. pty: 256 Unix98 ptys configured Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled ttyS00 at 0xff001003 (irq = 13) is a XScale UART HDLC line discipline: version $Revision: 3.3 $, maxframe=4096 N_HDLC line discipline registered. block: 128 slots per queue, batch=32 RAMDISK driver initialized: 16 RAM disks of 32768K size 1024 blocksize Uniform Multi-Platform E-IDE driver Revision: 6.31 ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx loop: loaded (max 8 devices) Creating 6 MTD partitions on "IXP425 Residential Gateway Demo Platform Flash": 0x00000000-0x00040000 : "RedBoot" 0x00040000-0x00140000 : "kernel" 0x00100000-0x00920000 : "initrd" 0x00920000-0x00fc0000 : "unallocated space" 0x00fc0000-0x00fc1000 : "RedBoot config" mtd: partition "RedBoot config" doesn't end on an erase block -- force read-only 0x00fe0000-0x01000000 : "FIS directory" NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 4096 bind 8192) IP-Config: No network devices available. NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 cryptoapi: loaded cryptoapi: Registered aes-ecb (0) cryptoapi: Registered aes-cbc (65536) cryptoapi: Registered aes-cfb (262144) NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com RAMDISK: Compressed image found at block 0 Freeing initrd memory: 9216K VFS: Mounted root (ext2 filesystem). Mounted devfs on /dev Freeing init memory: 84K Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/ixp400.o Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/ixp425_eth.o ixp425_eth: Initializing IXP425 NPE Ethernet driver software v. 1.2 ixp425_eth: CPU clock speed (approx) = 527 MHz ixp425_eth: ixp0 is using NPEB and the PHY at address 2 ixp425_eth: ixp1 is using NPEC and the PHY at address 1 ixp425_eth: Use default MAC address 00:02:b3:01:01:01 for port 0 ixp425_eth: Use default MAC address 00:02:b3:02:02:02 for port 1 Using /lib/modules/2.4.18_mvl30-ixdp425/kernel/drivers/net/rt61ap.o insmod: init_module: rt61ap: No such device SIOCSIFADDR: No such device device ixp1 entered promiscuous mode interface ra0 does not exist! br0: port 1(ixp1) entering listening state
OpenWrt Firmware
PCI GPIO 0.1.2.6 CF-IDE GPIO 12 configured. + PHY 100/Full/Auto configured. Ethernet eth0: MAC address 00:05:9e:44:00:a1 IP: 192.168.1.200/255.255.255.0, Gateway: 0.0.0.0 Default server: 192.168.1.101, DNS server IP: 0.0.0.0 RedBoot(tm) bootstrap and debug environment [ROM] ZinWell Release Version 1.0.0 - built 14:02:56, Mar 19 2007 Platform: Intel Generic Residential Gateway (XScale) RAM: 0x00000000-0x04000000, 0x0001f860-0x03fd1000 available FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each. == Executing boot script in 10.000 seconds - enter ^C to abort RedBoot> fis load zImage RedBoot> exec Using base address 0x00100000 and length 0x001480f0 Uncompressing Linux... done, booting the kernel. [ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 4.9.211 (buildbot@cb6d1095f6c4) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r7976-ca47026b7d) ) #0 Wed Jan 29 16:06:05 2020 [ 0.000000] CPU: XScale-IXP42x Family [690541c2] revision 2 (ARMv5TE), cr=000039ff [ 0.000000] CPU: VIVT data cache, VIVT instruction cache [ 0.000000] Machine: Titan Wireless TW-533-4 [ 0.000000] Memory policy: Data cache writeback [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Memory: 60932K/65536K available (3012K kernel code, 159K rwdata, 404K rodata, 160K init, 201K bss, 4604K reserved, 0K cma-reserved) [ 0.000000] Virtual kernel memory layout: [ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB) [ 0.000000] fixmap : 0xffc00000 - 0xfff00000 (3072 kB) [ 0.000000] vmalloc : 0xc4800000 - 0xff800000 ( 944 MB) [ 0.000000] lowmem : 0xc0000000 - 0xc4000000 ( 64 MB) [ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB) [ 0.000000] .text : 0xc0008000 - 0xc02f9250 (3013 kB) [ 0.000000] .init : 0xc0360000 - 0xc0388000 ( 160 kB) [ 0.000000] .data : 0xc0388000 - 0xc03afd40 ( 160 kB) [ 0.000000] .bss : 0xc03afd40 - 0xc03e2310 ( 202 kB) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:64 [ 0.000020] sched_clock: 32 bits at 66MHz, resolution 15ns, wraps every 32212576760ns [ 0.000070] clocksource: OSTS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 28669193401 ns [ 0.000176] Calibrating delay loop... 531.66 BogoMIPS (lpj=2658304) [ 0.050182] pid_max: default: 32768 minimum: 301 [ 0.050425] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.050450] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.051750] CPU: Testing write buffer coherency: ok [ 0.052675] Setting up static identity map for 0x81e0 - 0x8230 [ 0.055802] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.055849] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.057164] NET: Registered protocol family 16 [ 0.058862] DMA: preallocated 256 KiB pool for atomic coherent allocations [ 0.060663] IXP4xx: Using 16MiB expansion bus window size [ 0.061750] TW-533-4: Using MAC address 00:05:9e:44:00:a1 for port 0 [ 0.061786] TW-533-4: Using MAC address 00:05:9e:44:00:a2 for port 1 [ 0.062158] PCI: IXP4xx is host [ 0.062180] PCI: IXP4xx Using direct access for memory space [ 0.062432] PCI host bridge to bus 0000:00 [ 0.062480] pci_bus 0000:00: root bus resource [io 0x0000-0xffff] [ 0.062509] pci_bus 0000:00: root bus resource [mem 0x48000000-0x4bffffff] [ 0.062533] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 0.062628] PCI: bus0: Fast back to back transfers enabled [ 0.093156] clocksource: Switched to clocksource OSTS [ 0.095082] NET: Registered protocol family 2 [ 0.096673] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.096730] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 0.096769] TCP: Hash tables configured (established 1024 bind 1024) [ 0.097012] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.097050] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.097472] NET: Registered protocol family 1 [ 0.104274] IXP4xx Queue Manager initialized. [ 0.106387] Crashlog allocated RAM at address 0x3f00000 [ 0.108385] workingset: timestamp_bits=30 max_order=14 bucket_order=0 [ 0.129078] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.129111] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.152653] io scheduler noop registered [ 0.152685] io scheduler deadline registered (default) [ 0.224731] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled [ 0.230845] console [ttyS0] disabled [ 0.230968] serial8250.0: ttyS0 at MMIO 0xc8001000 (irq = 13, base_baud = 921600) is a XScale [ 0.738626] console [ttyS0] enabled [ 0.744665] IXP4XX-Flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000089 Chip ID 0x000018 [ 0.755033] Intel/Sharp Extended Query Table at 0x0031 [ 0.760214] Intel/Sharp Extended Query Table at 0x0031 [ 0.765416] Using buffer write method [ 0.769069] cfi_cmdset_0001: Erase suspend on write enabled [ 0.777150] Searching for RedBoot partition table in IXP4XX-Flash.0 at offset 0xfe0000 [ 0.900017] 5 RedBoot partitions found on MTD device IXP4XX-Flash.0 [ 0.906408] Creating 5 MTD partitions on "IXP4XX-Flash.0": [ 0.911912] 0x000000000000-0x000000040000 : "RedBoot" [ 0.920793] 0x000000040000-0x0000001a0000 : "zImage" [ 0.930017] 0x000000200000-0x000000fc0000 : "rootfs" [ 0.938428] mtd: device 2 (rootfs) set to be root filesystem [ 0.944294] 1 squashfs-split partitions found on MTD device rootfs [ 0.950492] 0x000000420000-0x000000fc0000 : "rootfs_data" [ 0.960336] 0x000000fc0000-0x000000fc1000 : "RedBoot config" [ 0.970313] 0x000000fe0000-0x000001000000 : "FIS directory" [ 0.988568] libphy: IXP4xx MII Bus: probed [ 0.994675] eth0: MII PHY 0 on NPE-B [ 1.000158] eth1: MII PHY 1 on NPE-C [ 1.004565] i2c /dev entries driver [ 1.008596] ixp4xx_wdt: timer heartbeat 60 sec [ 1.015473] NET: Registered protocol family 10 [ 1.030379] NET: Registered protocol family 17 [ 1.035077] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this. [ 1.048097] 8021q: 802.1Q VLAN Support v1.8 [ 1.052486] XScale DSP coprocessor detected. [ 1.059290] hctosys: unable to open rtc device (rtc0) [ 1.073957] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 1.081829] Freeing unused kernel memory: 160K [ 1.086351] This architecture does not have kernel memory protection. [ 2.073955] init: Console is alive [ 2.077810] init: - watchdog - [ 2.525729] random: fast init done [ 3.049816] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 3.057890] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 3.076081] init: - preinit - [ 4.623645] random: jshn: uninitialized urandom read (4 bytes read) [ 4.672558] random: jshn: uninitialized urandom read (4 bytes read) [ 4.803123] NPE-B: firmware's license can be found in /usr/share/doc/LICENSE.IPL [ 4.810610] NPE-B: firmware functionality 0x2, revision 0x2:1 [ 4.818656] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 6.883373] eth0: link up, speed 100 Mb/s, full duplex [ 6.888568] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 30.278321] jffs2: notice: (872) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 30.296268] mount_root: switching to jffs2 overlay [ 30.335772] urandom-seed: Seeding with /etc/urandom.seed [ 30.551700] procd: - early - [ 30.554943] procd: - watchdog - [ 30.803347] eth0: link up, speed 100 Mb/s, full duplex [ 32.053399] procd: - watchdog - [ 32.057117] procd: - ubus - [ 32.136832] random: ubusd: uninitialized urandom read (4 bytes read) [ 32.145588] random: ubusd: uninitialized urandom read (4 bytes read) [ 32.152938] random: ubusd: uninitialized urandom read (4 bytes read) [ 32.163867] procd: - init - Please press Enter to activate this console. [ 32.700841] kmodloader: loading kernel modules from /etc/modules.d/* [ 32.714893] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 32.740632] Loading modules backported from Linux version wt-2017-11-01-0-gfe248fc2c180 [ 32.748769] Backport generated by backports.git v4.14-rc2-1-31-g86cf0e5d [ 32.760687] ip_tables: (C) 2000-2006 Netfilter Core Team [ 32.780043] nf_conntrack version 0.5.0 (1024 buckets, 4096 max) [ 32.875685] xt_time: kernel timezone is -0000 [ 32.964708] PPP generic driver version 2.4.2 [ 32.973414] NET: Registered protocol family 24 [ 33.005948] kmodloader: done loading kernel modules from /etc/modules.d/* [ 47.164761] br-lan: port 1(eth0) entered blocking state [ 47.170010] br-lan: port 1(eth0) entered disabled state [ 47.176151] device eth0 entered promiscuous mode [ 47.213469] br-lan: port 1(eth0) entered blocking state [ 47.218725] br-lan: port 1(eth0) entered forwarding state [ 47.224586] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 47.747737] NPE-C: firmware's license can be found in /usr/share/doc/LICENSE.IPL [ 47.755267] NPE-C: firmware functionality 0x5, revision 0x2:1 [ 47.763373] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready [ 48.163240] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready [ 49.203513] eth0: link up, speed 100 Mb/s, full duplex [ 49.843515] eth1: link up, speed 100 Mb/s, full duplex [ 49.848715] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
Flash layout
RedBoot> fis list Name FLASH addr Mem addr Length Entry point RedBoot 0x50000000 0x50000000 0x00040000 0x00000000 RedBoot config 0x50FC0000 0x50FC0000 0x00001000 0x00000000 FIS directory 0x50FE0000 0x50FE0000 0x00020000 0x00000000 zImage 0x50040000 0x00100000 0x00100000 0x00100000 initrd.bin 0x50140000 0x00200000 0x00900000 0x00200000 RedBoot>
Telnet into RedBoot
You can change the RedBoot configuration, so you can later telnet into this bootloader in order to reflash this device from there, without having serial access.
The default form of the fconfig command will force you to enter the data, change and confirm every initialized variable. To avoid reentering the Boot script data and harming unnecessary variables, run the “fconfig list” command first to look at variable names and values:
RedBoot> fconfig -l -n boot_script: true boot_script_data: .. fis load initrd.bin .. fis load zImage .. exec -c boot_script_timeout: 1 bootp: false bootp_my_gateway_ip: 0.0.0.0 bootp_my_ip: 0.0.0.0 bootp_my_ip_mask: 0.0.0.0 bootp_server_ip: 0.0.0.0 console_baud_rate: 115200 dns_ip: 0.0.0.0 gdb_port: 9000 info_console_force: false net_debug: false net_device: i82559_eth0 npe_eth0_esa: 0x00:0x05:0x9E:0x44:0x00:0xA1 npe_eth1_esa: 0x00:0x05:0x9E:0x44:0x00:0xA2 RedBoot>
Next change only necessary variables (using their names from the previous listing) and update the RedBoot non-volatile configuration after the last change:
RedBoot> fconfig boot_script_timeout 10 boot_script_timeout: Setting to 10 Update RedBoot non-volatile configuration - continue (y/n)? n RedBoot> fconfig bootp_my_gateway_ip 192.168.1.254 bootp_my_gateway_ip: Setting to 192.168.1.254 Update RedBoot non-volatile configuration - continue (y/n)? n RedBoot> fconfig bootp_my_ip 192.168.1.11 bootp_my_ip: Setting to 192.168.1.11 Update RedBoot non-volatile configuration - continue (y/n)? n RedBoot> fconfig bootp_server_ip 192.168.1.254 bootp_server_ip: Setting to 192.168.1.254 Update RedBoot non-volatile configuration - continue (y/n)? n RedBoot> fconfig dns_ip 192.168.1.254 dns_ip: Setting to 192.168.1.254 Update RedBoot non-volatile configuration - continue (y/n)? n RedBoot> fconfig bootp_my_ip_mask 255.255.255.0 bootp_my_ip_mask: Setting to 255.255.255.0 Update RedBoot non-volatile configuration - continue (y/n)? y ... Unlock from 0x50fc0000-0x50fc1000: . ... Erase from 0x50fc0000-0x50fc1000: . ... Program from 0x03fd2000-0x03fd3000 at 0x50fc0000: . ... Lock from 0x50fc0000-0x50fc1000: . RedBoot>
Note: The configuration is only in the RAM until you update the RedBoot non-volatile configuration. If you reset the device without updating, the configuration will not be changed. You can use changes without the update for temporary settings.
Verify the configuration by listing the aliases this time:
RedBoot> fconfig -l Run script at boot: true Boot script: .. fis load initrd.bin .. fis load zImage .. exec -c Boot script timeout (1000ms resolution): 10 Use BOOTP for network configuration: false Gateway IP address: 192.168.1.254 Local IP address: 192.168.1.11 Local IP address mask: 255.255.255.0 Default server IP address: 192.168.1.254 Console baud rate: 115200 DNS server IP address: 192.168.1.254 GDB connection port: 9000 Force console for special debug messages: false Network debug at boot time: false Default network device: i82559_eth0 Network hardware address [MAC] for NPE eth0: 0x00:0x05:0x9E:0x44:0x00:0xA1 Network hardware address [MAC] for NPE eth1: 0x00:0x05:0x9E:0x44:0x00:0xA2 RedBoot>
I specified a 10 second timeout here, so I have this 10 second time frame to telnet into RedBoot. If you are not able to hit the enter-key within 10 seconds after powering up, go for a larger time frame.
$ arping -qf 192.168.1.11 ; telnet 192.168.1.11 9000 WARNING: interface is ignored: Operation not permitted Trying 192.168.1.11... ?Invalid command Connected to 192.168.1.11. Escape character is '^]'. == Executing boot script in 9.940 seconds - enter ^C to abort ^C RedBoot>
Dead link --- 