wiki:Lexmark2050

Version 1 (modified by admin, 4 years ago) (diff)

copy and paste from fgar wiki.

Busy Box Linux Lives inside the N2050

This tutorial will get you to read the output of the N2050 wifi card found in the Lexmark X6570 printer.

Skip to The Fun Stuff if you want to start programming.

You will need:

  • A computer running Linux and Bash
  • A Lexmark X6570
  • A 3.3v capable USB-UART bridge, like the Foca V2.1 or CP2102 ("Bridge")
  • Tools for soldering
  • Some wires

The "On Button"

The N2050 communicates with 3.3 volts. It receives its 30V positive power on the pin on the 22 pin connector CLOSEST to the capacitors. the 'ground' may either be connected to the sixth, through the nineth pin on the back of the board, OR the pin on the far right on the 6 pin connector toward the bottom of the board. In order to make life easier, we initially opted to power the card in situ. [[File:Insitu.JPG|thumb|center]]

Powering Via Printer Parts

To power the card using printer parts, carefully break down the Lexmark X6570. By carefully, I mean paying attention to how wires, ribbons, and sockets are connected and not shattering important bits. Keep the controller board, touch pad (silver panel in photo), power supply (black box on left), the N2050 (vertical card), wires connecting power supply to controller board, and the ribbon connecting the touch pad to the controller board.

I soldered the red and black wires onto the power supply. Don't reverse those little wires, or else you're burn your board. I would suspect putting the N2050 backwards into the socket on the controller board would cause a similar burn up.

You now have a clumsy 'on button' and steady power supply for the N2050.

Powering the board Directly

to power the board directly, apply the positive voltage from the lexmark's 31V power supply to the pin closest to the capacitors(far right) on the bottom edge connector, and wire the negative line to the pin on the far right of the 6 pin connector.

Hard Wiring the N2050 and USB/UART Bridge

Now, you need to provide the N2050 a USB interface.[[File:N2050stripped.JPG|thumb|center]]

Solder four wires into the line of four pin holes on the corner of the---in this case---88W8638 chip (look for the red circle in the pic). Your chip number may vary. I apologize for the poor quality of my picture. Let's call the side of the N2050 that plugs into the controller board down.

From top to bottom the pins are:

  • Ground
  • Transmit
  • Receive
  • 3.3v Power

Now, wire your N2050 to the USB/UART Bridge. Run Ground to Ground; Transmit to Receive; and Receive to Transmit. Here's a picture on how your wires should run:

[[File:Bridgen2050diagram.jpg|center]]

Make It Talk

Unplug your USB devices from your computer, including the Bridge.

In Bash (Terminal, as it's commonly called) type the following: "screen /dev/tty" and press tab twice.

You will now see a list of available tty devices.

Plug in the Bridge. Repeat the command "screen /dev/tty", and press tab twice.

If your Bridge is powered on and connected via USB, you might see a new addition called "ttyUSB0". Your results may vary. I've assumed "ttyUSB0" in our example.

Now, type "screen /dev/ttyUSB0 38400" (or "screen /dev/whatever 38400")

If Bash is talking to the Bridge, and if the Bridge is talking to the running N2050, you should see some human readable language.(Sjmoquin 00:10, 18 May 2012 (UTC))

Here is the screen out of our N2050: {| border="1" style="text-align:left;" | <pre> Booting... Usb Init Complete For 44Mhz...

_ _

//| //|

| |:| | |:|

_ _ | |:| | |:|

//\ / /\ ||:| | |:| \ \:\ / /:/ //::::\ //\_|:|

\ \:\ /:/ ~\\::::/ \ \:\/:::::/

\ \:\/:/ ||:| \ \::/

\ \::/ | |:| \ \:\

\\/ | |:| \ \:\

||/ \\/

U-Boot 1.1.1 (Apr 10 2007 - 16:09:11) Marvell version: 1.1.1.27 Radlan

U-Boot code: 00F00000 -> 00F1EFDC BSS: -> 00F23D10 RAM Configuration: Bank #0: 00000000 16 MB Performing flash auto-detection at 0xFFF00000 Found SPANSION_ID_S29GL032A Found bottom boot sector device Flash base auto-detected at 0xFFC00000 Flash: 4 MB No environment found on flash, using default.

In: serial Out: serial Err: serial Net: eth0 [PRIME] Got here Hit any key to stop autoboot: 0 Data (writethrough) Cache is OFF Instruction Cache is OFF ### CRAMFS loading 'uImage' to 0x100000 ### CRAMFS load complete: 872416 bytes loaded to 0x100000 ## Booting image at 00100000 ...

Image Name: Linux-2.6.12.5-88w8xx8 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 872352 Bytes = 851.9 kB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK

OK

Starting kernel ...

Uncompressing Linux........................................................... done, booting the kernel.

Linux version 2.6.12.5-88w8xx8 (mls-bld@nevada) (gcc version 3.3.3 (DENX ELDK 3.1.1 3.3.3-9)) #1 Tue Apr 10 16:03:29 EDT 2007

CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ) CPU0: D VIVT write-back cache CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets CPU0: D cache: 32768 bytes, associativity 4, 32 byte lines, 256 sets Machine: MV88W8638 Using U-Boot passing parameters structure - U-Boot release 1.1.1.27 Memory policy: ECC disabled, Data cache writeback Built 1 zonelists Kernel command line: console=ttyS0,38400 flashsize=0x400000 bootv="Tue Apr 10 16:02:10 EDT 2007" root=/dev/mtdblock0 ro rootfstype=cramfs ip=50.1.1.10:50.1.1.2:::MANHATTAN:eth0:none boot Dynamic flash size: 0x400000 Calulated flash_base = 0xffc00000 PID hash table entries: 128 (order: 7, 2048 bytes) Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 16MB = 16MB total Memory: 14292KB available (1615K code, 176K data, 68K init) Mount-cache hash table entries: 512 CPU: Testing write buffer coherency: ok NET: Registered protocol family 16 MV88W8XX8 LSP release 33 for kernel 2.6.12.5 Marvell USB EHCI Host controller setting GPIO 10 for 1693 device power SCSI subsystem initialized usbcore: registered new driver usbfs usbcore: registered new driver hub JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc. Initializing Cryptographic API Serial: 8250/16550 driver $Revision: 1.90 $ 16 ports, IRQ sharing enabled ttyS0 at MMIO 0xf800c840 (irq = 11) is a 16550 ttyS1 at MMIO 0xf800c940 (irq = 11) is a 16550 io scheduler noop registered io scheduler anticipatory registered io scheduler deadline registered io scheduler cfq registered loop: loaded (max 8 devices) ################################### mv88w8xx8_flash_size = 0x400000 Number of erase regions: 2 Primary Vendor Command Set: 0002 (AMD/Fujitsu Standard) Primary Algorithm Table at 0040 Alternative Vendor Command Set: 0000 (None) No Alternate Algorithm Table Vcc Minimum: 2.7 V Vcc Maximum: 3.6 V No Vpp line Typical byte/word write timeout: 128 �s Maximum byte/word write timeout: 1024 �s Typical full buffer write timeout: 128 �s Maximum full buffer write timeout: 4096 �s Typical block erase timeout: 1024 ms Maximum block erase timeout: 16384 ms Chip erase not supported Device size: 0x400000 bytes (4 MiB) Flash Device Interface description: 0x0002

  • supports x8 and x16 via BYTE# with asynchronous interface

Max. bytes in buffer write: 0x20 Number of Erase Block Regions: 2

Erase Region #0: BlockSize? 0x2000 bytes, 8 blocks Erase Region #1: BlockSize? 0x10000 bytes, 63 blocks

mv88w8xx8 flash: Found 1 x16 devices at 0x0 in 16-bit bank

Amd/Fujitsu? Extended Query Table at 0x0040

number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. Creating 4 MTD partitions on "mv88w8xx8 flash": 0x00000000-0x00350000 : "LINUX_FS" 0x00360000-0x003c0000 : "LINUX_CFG" 0x00350000-0x00360000 : "HIST" 0x003c0000-0x00400000 : "UBOOT" ehci_platform ehci_platform.14362: EHCI Host Controller ehci_platform ehci_platform.14362: new USB bus registered, assigned bus number 1 ehci_start: pdev->id = 088f8008 ehci_platform ehci_platform.14362: park 0 ehci_platform ehci_platform.14362: USB 2.0 initialized, EHCI 1.00, driver 10 Dec 2004 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ehci_platform ehci_platform.14362: irq 8, io mem 0x00000000 ehci_start: pdev->id = 088f8008 ehci_platform ehci_platform.14362: park 0 ehci_platform ehci_platform.14362: USB 2.0 restarted, EHCI 1.00, driver 10 Dec 2004 NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) ip_conntrack version 2.1 (128 buckets, 1024 max) - 180 bytes per conntrack usb 1-1: new high speed USB device using ehci_platform and address 2 ip_tables: (C) 2000-2002 Netfilter core team NET: Registered protocol family 1 NET: Registered protocol family 17 VFS: Mounted root (cramfs filesystem) readonly. Freeing init memory: 68K

Tue Apr 4 02:20:00 UTC 2006 Linux (none) 2.6.12.5-88w8xx8 #1 Tue Apr 10 16:03:29 EDT 2007

history: module license 'Proprietary' taints kernel. mtd=c0311600

typ=3 flags=5 size=10000 name=HIST index=2

Read 65536 bytes rc=0 ABS = 0 Installing USB Host drivers hotplug INFO: port0/lp -> lp0 /m/open/mh/next/builds/release/KernelA/OPEN.MH.K204/linux-2.6.12.5/drivers/usb/class/usblp.c: usblp0: USB Bidirectional printer dev 2 if 1 alt 0 proto 2 vid 0x043D pid 0x010F usbcore: registered new driver usblp /m/open/mh/next/builds/release/KernelA/OPEN.MH.K204/linux-2.6.12.5/drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver /m/open/mh/next/builds/release/KernelA/OPEN.MH.K204/linux-2.6.12.5/drivers/usb/class/usblp.c: $Id: usblp.c 12222 2006-03-17 16:08:31Z carlsonj $ usbcore: registered new driver hiddev hotplug INFO: port0/hiddev -> hiddev0 hiddev96: USB HID v1.00 Device [Lexmark 6500 Series] on usb-ehci_platform.14362-1 usbcore: registered new driver usbhid /m/open/mh/next/builds/release/KernelA/OPEN.MH.K204/linux-2.6.12.5/drivers/usb/input/hid-core.c: v2.01:USB HID core driver hotplug INFO: port0/cpdmedia -> cpdmedia0 hotplug INFO: port0/scanner -> scanner0 usbcore: registered new driver usbscanner Initializing USB Mass Storage driver... scsi0 : SCSI emulation for USB Mass Storage devices usbcore: registered new driver usb-storage USB Mass Storage support registered. mkdir: Cannot create directory `/var/dev/usb': File exists Apr 4 02:20:06 (none) syslog.info syslogd started: BusyBox? v1.01 (2007.04.10-20:07+0000) Marvell MV88W8xx8 Wireless Device Module[VERSION: WB31-V3.0.2.8L] Wireless LAN module Setup Configuration file: /pkg-netapps/etc/mvwcd.conf <7>mvWLAN: Registered netdevice wlan0 Restart BSS Apr 4 02:20:07 (none) user.info mvwcd: ===> LINK LOSS (mode 2)<=== SIOCGIFFLAGS: No such device Apr 4 02:20:08 (none) user.warn lexdebug: ErrExit?: sendto failed. Requestor is dead (errno 2 - No such file or directory) /pkg-netapps/etc/rc_net_postPage4: 8: /pkg-netapps/etc/rc.xsupplicant: not found /pkg-netapps/etc/rc_net_postPage4: 55: generate_random: not found

Starting INA ErrorExit? Service...

Apr 4 02:20:08 (none) daemon.info ErrorExit?[485]: Daemonizing Complete...

Starting StringsServer?

Apr 4 02:20:08 (none) user.info StringsServer?: TXRegister(), rc = TX_SUCCESS

Starting VacuumServer?

Apr 4 02:20:09 (none) daemon.info VacuumServer?[496]: Daemonizing Complete.... Apr 4 02:20:09 (none) daemon.info VacuumServer?[496]: get_active_interface returning slot bitmask 0x1 Apr 4 02:20:09 (none) daemon.info VacuumServer?[496]: find interface succeeded - ifname = wlan0, slot = 0 Apr 4 02:20:09 (none) daemon.info VacuumServer?[498]: picked filesystem manblock backend Got interface name wlan0 from Vacuum

Starting StatusServer?

Apr 4 02:20:10 (none) daemon.info StatusServer?[508]: Daemonizing complete... Apr 4 02:20:10 (none) daemon.info StatusServer?[508]: picked filesystem manblock backend

Starting NPAP_Server

Apr 4 02:20:10 (none) daemon.info NPAP_Server[517]: Daemonizing complete...

Starting flashsrv Starting PrinterHandler?

Apr 4 02:20:10 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0) Apr 4 02:20:10 (none) daemon.info PrinterHandler?[534]: Daemonizing complete...

Starting HIDHandler

Apr 4 02:20:11 (none) user.info HIDHandler: Starting HIDHandler!

Starting Wireless LinkMonitor? and Variables...

Apr 4 02:20:11 (none) daemon.info PrinterHandler?[549]: Starting_Backend_Service 696: Port 0 Lexmark CPD BackEnd? Selected!

Vendor: Lexmark Model: USB Mass Storage Rev: 200 Type: Direct-Access ANSI SCSI revision: 00

Attached scsi removable disk sda at scsi0, channel 0, id 0, lun 0 Apr 4 02:20:12 (none) user.info mvwcd: ===> SCAN DONE (mode 2)<=== Apr 4 02:20:13 (none) user.info HIDHandler[538]: ###Using Scan Interface /var/dev/port0/scanner Apr 4 02:20:13 (none) user.info HIDHandler[538]: ###Using CPD Media Interface /var/dev/port0/cpdmedia Apr 4 02:20:13 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0) Apr 4 02:20:13 (none) lpr.err vacWLAN[591]: error setting VSEC_8021X_ENABLED based on security mode Apr 4 02:20:13 (none) user.info mvwcd: Configured ssid=mfg test mode (len=13) Apr 4 02:20:13 (none) user.info mvwcd: No result from scan mount: Mounting /var/dev/usb/sda on /var/fs/usbdrive_port0 failed: No medium found Apr 4 02:20:14 (none) lpr.err vacWLAN[617]: error setting VSEC_8021X_ENABLED based on security mode Apr 4 02:20:15 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0) Apr 4 02:20:17 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0) Apr 4 02:20:18 (none) user.info mvwcd: ===> SCAN DONE (mode 2)<=== Apr 4 02:20:19 (none) user.info mvwcd: Configured ssid=mfg test mode (len=13) Apr 4 02:20:19 (none) user.info mvwcd: No result from scan Apr 4 02:20:20 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0) Apr 4 02:20:22 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0) Apr 4 02:20:23 (none) user.info mvwcd: ===> SCAN DONE (mode 2)<=== Apr 4 02:20:24 (none) user.info mvwcd: Configured ssid=mfg test mode (len=13) Apr 4 02:20:24 (none) user.info mvwcd: No result from scan Apr 4 02:20:24 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0) Apr 4 02:20:26 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0) Apr 4 02:20:28 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0) Apr 4 02:20:28 (none) user.info mvwcd: ===> SCAN DONE (mode 2)<=== Apr 4 02:20:30 (none) user.info mvwcd: Configured ssid=mfg test mode (len=13) Apr 4 02:20:30 (none) user.info mvwcd: No result from scan Apr 4 02:20:30 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0) vacWLAN: vacuum variables present!

Starting /Registering IPv4 Vacuum Variables

Apr 4 02:20:31 (none) lpr.debug vacip[633]: IP_SNMPV3_DISABLED Apr 4 02:20:31 (none) lpr.debug vacip[633]: IP_RARP_DISABLED Apr 4 02:20:31 (none) lpr.debug vacip[633]: IP_BOOTP_DISABLED Apr 4 02:20:31 (none) lpr.debug vacip[633]: IP_HTTP_HIDDEN Apr 4 02:20:31 (none) lpr.debug vacip[633]: IP_MDNS_HIDDEN Apr 4 02:20:31 (none) lpr.debug vacip[633]: IP_AUTOIP_HIDDEN Apr 4 02:20:31 (none) lpr.debug vacip[636]: send_FWCONF 200 Failed No such file or directory (rc -1, sockfd 7) Apr 3 22:20:32 (none) lpr.debug vacip[636]: send_FWCONF 200 Failed No such file or directory (rc -1, sockfd 7)

Starting network interface...

...mac_prep...

Lexmark MAC address IOCTL failed, trying Linux standard... 14 Apr 4 02:20:32 (none) user.info mvwcd: ===> LINK LOSS (mode 2)<===

...ifconfig...

Registering Firewall App... Starting firewall_app

Apr 3 22:20:33 (none) lpr.debug vacip[636]: send_FWCONF 200 Failed No such file or directory (rc -1, sockfd 7)

Starting vacSEC

Apr 4 02:20:34 (none) daemon.info firewall_app[673]: Firewall App Daemonizing complete... Apr 4 02:20:34 (none) user.notice Bad argument `80' Apr 4 02:20:34 (none) user.notice Bad argument `80' Apr 4 02:20:34 (none) daemon.info vacSEC[697]: Daemonizing complete... Apr 4 02:20:35 (none) lpr.debug vacWLAN[620]: iwpriv wlan0 rsnmode off

Object Store is not enabled...

sh: /pkg-netapps/etc/rc.xsupplicant: not found Apr 4 02:20:35 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 key off Apr 4 02:20:35 (none) user.info mvwcd: ===> LINK LOSS (mode 2)<=== Apr 4 02:20:35 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 mode managed Apr 4 02:20:35 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 essid any

Openssl enabled..Starting all new Web Server on port 80/631/8000...

Apr 4 02:20:35 (none) lpr.debug vacWLAN[620]: iwpriv wlan0 hexpsk off Apr 4 02:20:36 (none) lpr.debug vacWLAN[620]: iwpriv wlan0 default Apr 4 02:20:36 (none) lpr.debug vacWLAN[620]: iwpriv wlan0 country FCC Apr 4 02:20:36 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 channel 11 Apr 4 02:20:36 (none) daemon.crit thttpd[738]: socket :: - Address family not supported by protocol Apr 4 02:20:36 (none) daemon.crit thttpd[738]: socket :: - Address family not supported by protocol Apr 4 02:20:36 (none) daemon.crit thttpd[738]: socket :: - Address family not supported by protocol Apr 4 02:20:36 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 mode ad-hoc Apr 4 02:20:36 (none) user.info mvwcd: ===> LINK LOSS (mode 2)<=== Apr 4 02:20:36 (none) daemon.warn thttpd[738]: started as root without requesting chroot(), warning only Apr 4 02:20:36 (none) lpr.debug vacWLAN[620]: iwpriv wlan0 basicrate 0,1,2,3 Apr 4 02:20:36 (none) lpr.debug vacWLAN[620]: iwpriv wlan0 preamble 1

Starting Hbn3

Apr 4 02:20:36 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 key off Apr 4 02:20:36 (none) daemon.info Hbn3[763]: Daemonizing complete...

Starting HostListApp?

Apr 4 02:20:37 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 commit

WirelessLinkMonitor?: Link down

Apr 4 02:20:37 (none) daemon.info HostListApp?[772]: Daemonizing complete... Apr 4 02:20:37 (none) daemon.warn HostListApp?[772]: Starting HostListApp? Apr 4 02:20:37 (none) user.info mvwcd: ===> LINK LOSS (mode 1)<===

Starting SNMPv3 Server

kill: 1: Usage: kill [-s sigspec | -signum | -sigspec] [pid | job]... or kill -l [exitstatus] Apr 4 02:20:38 (none) daemon.info vacSNMP[803]: Daemonizing complete... Apr 4 02:20:38 (none) user.info mvwcd: ===> LINK LOSS (mode 1)<=== process `net-snmpd' is using obsolete setsockopt SO_BSDCOMPAT

Starting Mulitcast DNS process Starting WaitForNetworkLink?

Apr 4 02:20:39 (none) daemon.info mdns[831]: Daemonizing complete... Apr 4 02:20:40 (none) user.info mvwcd: ===> SCAN DONE (mode 1)<=== </pre> |}

The Fun Stuff

dabyd64 did some excellent work, and I feel the community is greatly benefited by his findings. The following is his write-up on USB connectivity, and uploading whatever one wishes to the N2050.

<pre> ################################ SOURCE CODE, TOOLCHAIN, ETC ################################ The original source code is gone. Lexmark made it available only for a couple of months, and then removed everything. But, searching, i found the "Musicpal" device, which has a similar processor (mv88w8618) Even inside the source there are mentions to our processor! (mv88w8638)

So, maybe we can do something with this...

source code: http://www.musicpal.info/gpl/get.php?f=alinux-1.68-gpl.tar.bz2

Toolchain http://www.musicpal.info/gpl/get.php?f=arm-2005-03-06.zip

Support Package http://www.musicpal.info/gpl/get.php?f=bsp_adma_1-1.68-gpl.tar.bz2

################################ UNLOCKING THE FIRMWARE (ENABLE WRITING ON THE CONSOLE) ################################ The original firmware runs a script that runs a debug program forever, showing lexmark stuff. Then we can't write on the console. To fix that, I edited the firmware and removed the call of the debug program. Also, if you make a script file called "init.sh" and save it in the root of a FAT32 USB drive, and you connect it to the board before powering on, it will be loaded automatically.

To download the firmware: http://www.mediafire.com/?hkaottt5ddf59mj

Flash to "LINUX_FS".

#################### # BOOTLOADER STUFF # ####################

What you need:

Teraterm Free, (http://logmett.com/index.php?/products/teraterm.html) USB Serial cable (a RS232-TTL cable will work too, but will be limited to 115200...slow) Some free time

################### FLASH ADDRESSES ###################

The bootloader shows this:

flash base address is 0xFFC00000

But kernel shows this partitions:

0x00000000-0x00350000 : "LINUX_FS" 0x00360000-0x003c0000 : "LINUX_CFG" 0x00350000-0x00360000 : "HIST" 0x003c0000-0x00400000 : "UBOOT"

So, The kernel addresses are relative, the real addresses are this: (bootloader base address + kernel reported address)

0xFFC00000-0xFFF4FFFF : "LINUX_FS" 0xFFF50000-0xFFF5FFFF : "HIST" 0xFFF60000-0xFFFBFFFF : "LINUX_CFG" 0xFFFC0000-0xFFFFFFFF : "UBOOT"

################### TRANSFERRING DATA ###################

IF YOU USE A RS232-TTL CABLE INSTEAD A USB-SERIAL, THEN USE 115200 NOT 921600!!

SPEED TESTS FOR FULL FLASH TRANSFER (4MByte):

921.600 BAUDS: 3MIN 40SECS 115.200 BAUDS: 10 MINUTES

Now let's load a binary file to the device's ram, through the serial port: As 38400 bauds is very slow, let's switch the transfer speed to something higher, like 921600: Type:

loadb 0x00100000 921600

You will see this:

## Switch baudrate to 921600 bps and press ENTER ...

Do that. Switch your serial port to 921600 and press enter. You will see:

## Ready for binary (kermit) download to 0x00100000 at 921600 bps...

Now, in TeraTerm?, go to "File", "Transfer", "Kermit", "Send..." and select the file you want to upload.

It will take a while, depending on the baudrate speed.

When completed, you will see something like this:

## Total Size = 0x00010000 = 65536 Bytes ## Start Addr = 0x00100000 ## Switch baudrate to 38400 bps and press ESC ...

(This is an example for a 64KB transfer)

Switch your serial port back to 38400 and press ESC. You will see the shell again.

Write down the values of "Total Size" and "Start Addr".

In this case they are 0x00010000 and 0x00100000.

################### ERASING THE FLASH ###################

Now, we have to erase the flash before we copy the new data. Depending on where you want to flash the data, you have to erase different regions:

for LINUX_FS:

erase 0xFFC00000 0xFFF4FFFF

for HIST:

erase 0xFFF50000 0xFFF5FFFF

for LINUX_CFG:

erase 0xFFF60000 0xFFFBFFFF

for UBOOT: (NEVER TOUCH UBOOT UNLESS YOU KNOW WHAT YOU'RE DOING!!)

erase 0xFFFC0000 0xFFFFFFFF

It will output something like this:

. done Erased nn sectors

################### FLASHING THE DATA ###################

Now, the last step. Copy the data to the flash. Remember the "Total Size" and "Start Addr" ? Now we will need them.

Again, depending on were we want to write the data, choose the right one:

for LINUX_FS:

cp.b "Start Addr" 0xFFC00000 "Total Size"

for HIST:

cp.b "Start Addr" 0xFFF50000 "Total Size"

for LINUX_CFG:

cp.b "Start Addr" 0xFFF60000 "Total Size"

for UBOOT: (NEVER TOUCH UBOOT UNLESS YOU KNOW WHAT YOU'RE DOING!!)

cp.b "Start Addr" 0xFFFC0000 "Total Size"

For flashing my previous 64KB data to "HIST", it would be:

cp.b 0x00100000 0xFFF50000 0x00010000

It will output:

Copy to Flash... done

Done! Flush power and check if it works. As long as you don't flash over the UBOOT, you will able to recover through the bootloader.

################### BOOTLOADER FLASHING ###################

If you tried erasing or flashing the bootloader, you will see that the its flash region is write-protected. And it is a very clever idea! any wrong operation could damage it and bricking the device PERMANENTLY!

To remove the flash protection, type:

protect off all

To enable (RECOMMENDED!!)

protect on 0xFFFC0000 0xFFFFFFFF

################### RESTORING THE FULL FLASH ###################

If you can't make it work and want to restore everything, follow this steps:

Download this: http://www.mediafire.com/?1s07wfzxljcjj1s

In the console:

loadb 0x00100000 921600 (or 115200 if you don't use a USB serial converter) Select the "full_flash file" you downloaded in the kermit trasfer (Send) and wait for it to finish.

protect off all

erase 0xFFC00000 0xFFFFFFFF (After this command, a power loss will cause a permament bricked device)

cp.b 0x00100000 0xFFC00000 0x400000

protect on 0xFFFC0000 0xFFFFFFFF

Done!

</pre>

Reference

Here is source code for the same processor in the N2050, but in a different device.

Included are the U-Boot commands already installed on the N2050:

{| <pre> base - print or set address offset bdinfo - print Board Info structure boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootelf - Boot from an ELF image in memory bootm - boot application image from memory bootp - boot image via network using BootP/TFTP protocol bootvx - Boot vxWorks from an ELF image bubt - Burn an image on the Boot Flash. cfgburn - Burn config file into the flash config partition. cfgls - list files in the linux cfg directory (default /) chpart - change active partition cmp - memory compare cmpm - Compare Memory coninfo - print console devices and informations cp - memory copy crc32 - checksum calculation dcache - enable or disable data cache echo - echo args to console erase - erase FLASH memory flinfo - print FLASH memory information fsinfo - print information about filesystems fsload - load binary file from a filesystem image g - start application at cached address 'addr'(default addr 0x40000) go - start application at address 'addr' help - print online help icache - enable or disable instruction cache iminfo - print header information for application image imls - list all images found in flash itest - return true/false on integer compare loadb - load binary file over serial line (kermit mode) loads - load S-Record file over serial line loop - infinite loop on address range ls - list files in a directory (default /) md - memory display mm - memory modify (auto-incrementing) mtdburn - Burn a JFFS2 mtd image on the flash. mtest - simple RAM test mw - memory write (fill) nfs - boot image via network using NFS protocol nm - memory modify (constant address) ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables protect - enable or disable FLASH write protection rarpboot- boot image via network using RARP/TFTP protocol reset - Perform RESET of the CPU run - run commands in an environment variable saveenv - save environment variables to persistent storage setenv - set environment variables sleep - delay execution for some time tftpboot- boot image via network using TFTP protocol version - print monitor version xmodem - load boot file over serial line and burn it to flash </pre> |}

The following is a few commands and their readout that provide us a good idea of the environment, directories, memory allocation, and various variables.

{| <pre> LXK>> printenv bootargs=console=ttyS0,38400 bootcmd=dcache off; icache off; run standalone_cramfs bootdelay=0 baudrate=38400 ipaddr=50.1.1.10 serverip=50.1.1.2 rootpath=/tftpboot/rootfs_arm stdin=serial stdout=serial stderr=serial ethprime=eth0 usbMode=host default_load_addr=0x00100000 bootargs_root=root=/dev/nfs rw init=/linuxrc bootargs_end=:::MANHATTAN:eth0:none image_name=uImage bootfile=uImage initrd_name=ramdisk.image.gz initrd_load_addr=800000 initrd_size=400000 standalone_jffs2=fsload $(default_load_addr) $(image_name);setenv bootargs $(bootargs) $(FlashSizeEnv?) $(ubootversion) root=/dev/mtdblock0 rw rootfstype=jffs2 ip=$(ipaddr):$(serverip)$(bootargs_end);bootm $(default_load_addr); ubootversion=bootv="Tue Apr 10 16:02:10 EDT 2007" standalone_cramfs=fsload $(default_load_addr) $(image_name);setenv bootargs $(bootargs) $(FlashSizeEnv?) $(ubootversion) root=/dev/mtdblock0 ro rootfstype=cramfs ip=$(ipaddr):$(serverip)$(bootargs_end) boot;bootm $(default_load_addr); standalone_initrd=fsload $(default_load_addr) $(image_name);fsload $(initrd_load_addr) $(initrd_name);setenv bootargs $(bootargs) root=/dev/ram0 rw initrd=0x$(initrd_load_addr),0x$(initrd_size) ip=$(ipaddr):$(serverip)$(bootargs_end); bootm $(default_load_addr); ethaddr=00:00:00:88:86:38 FlashSizeEnv?=flashsize=0x400000 ethact=eth0

Environment size: 1303/65532 bytes

LXK>> fsinfo ### filesystem type is CRAMFS size: 0x31b000 (3256320) flags:

FSID version 2 sorted dirs

fsid:

crc: 0x399621a edition: 0x0

name: Compressed LXK>> bdinfo arch_number = 0x0000020D env_t = 0x00000000 boot_params = 0x00000100 DRAM bank = 0x00000000 -> start = 0x00000000 -> size = 0x01000000 ethaddr = 00:00:00:88:86:38 ip_addr = 50.1.1.10 baudrate = 38400 bps

LXK>> cfgls Scanning JFFS2 FS: . done.

drwxr-xr-x 0 Tue Apr 04 02:20:13 2006 mblock drwxr-xr-x 0 Tue Apr 04 02:20:22 2006 security -r--r--r-- 1024 Tue Apr 04 02:21:15 2006 mfg_data_p drwxr-xr-x 0 Tue Apr 04 02:20:22 2006 nvsettings drwxr-xr-x 0 Tue Apr 04 02:20:14 2006 usbdrive_port0

LXK>> coninfo List of available devices: serial 80000003 SIO stdin stdout stderr LXK>> flinfo

Bank # 1: info->size = 0x400000 SPANSION S29GL032A - Size: 4 MB in 71 Sectors

Sector Start Addresses:

FFC00000 FFC02000 FFC04000 FFC06000 FFC08000 FFC0A000 FFC0C000 FFC0E000 FFC10000 FFC20000 FFC30000 FFC40000 FFC50000 FFC60000 FFC70000 FFC80000 FFC90000 FFCA0000 FFCB0000 FFCC0000 FFCD0000 FFCE0000 FFCF0000 FFD00000 FFD10000 FFD20000 FFD30000 FFD40000 FFD50000 FFD60000 FFD70000 FFD80000 FFD90000 FFDA0000 FFDB0000 FFDC0000 FFDD0000 FFDE0000 FFDF0000 FFE00000 FFE10000 FFE20000 FFE30000 FFE40000 FFE50000 FFE60000 FFE70000 FFE80000 FFE90000 FFEA0000 FFEB0000 FFEC0000 FFED0000 FFEE0000 FFEF0000 FFF00000 FFF10000 FFF20000 FFF30000 FFF40000 FFF50000 FFF60000 FFF70000 FFF80000 FFF90000 FFFA0000 FFFB0000 FFFC0000 (RO) FFFD0000 (RO) FFFE0000 (RO) FFFF0000 (RO)

LXK>> ls

lrwxrwxrwx 23 Build.Info -> /pkg-netapps/Build.Info drwxr-sr-x 1632 bin drwxr-sr-x 788 dev drwxr-sr-x 312 etc drwxr-sr-x 652 lib lrwxrwxrwx 12 linuxrc -> /bin/busybox drwxr-sr-x 20 mnt drwxr-sr-x 108 pkg-netapps drwxr-sr-x 0 proc drwxr-sr-x 0 root drwxr-sr-x 368 sbin drwxr-sr-x 0 sys drwxr-sr-x 0 tmp -r--r----- 872416 uImage drwxr-sr-x 32 usr drwxr-sr-x 0 var

LXK>> version

U-Boot 1.1.1 (Apr 10 2007 - 16:09:11) Marvell version: 1.1.1.27 Radlan LXK>> </pre> |}

23:35, 9 June 2012 (UTC)