RedBoot makes it easy to replace the currently deployed heavily customized Linux distribution with a more commonly used Linux distribution for wireless devices, like DD-WRT or OpenWrt.
During booting, the FON 2202, waits at IP address 192.168.1.1 on port 9000, for about 2 seconds, to receive an interrupting Control C. Meaning, if a host computer with an assigned IP of something like 192.168.1.2 is connected to the Fonara, issues this command:
echo -e "\0377\0364\0377\0375\0006" >break.bin; sudo nc -vvv 192.168.1.1 9000 < break.bin; telnet 192.168.1.1 9000and the Fonera gets rebooted, RedBoot will pause the boot process and show the
RedBoot> prompt.Depending on the host's OS, this can also be done, by simply launching
telnet 192.168.1.1 9000 and pressing Control C. However, it may be necessary to re-configure telnet a little, for instance by putting this .telnetrc file in the user's home directory.
# ~/.telnetrc
# Fonera 2100 Hacking
192.168.1.254 9000
mode line
# Fonera 220x Hacking
192.168.1.1
mode line
The boot process can also be interrupted, using the Fonera's serial port (TTL, 9600, 8N1), accessible only after opening the Fonera's enclosure. The Keyspan USA-19HS USB to Serial Adapter and a RS232 Level Shifter Adapter may be necessary accessories to access the Fonera through the serial port.
RedBoot Prompt
No matter if accessed through ethernet or serial port, entering Control C during the initial phase of the boot process will provide access to the bootloader prompt.Entering the version command reveals that the bootloader operates in ROMRAM mode, where RedBoot resides in flash memory, but is copied to RAM memory before it starts executing. The RAM footprint is larger than for ROM mode, but it normally runs faster and it is able to update itself, i.e. the flash region where its image resides.
RedBoot> version
RedBoot(tm) bootstrap and debug environment [ROMRAM]
OpenWrt certified release, version 1.1 - built 12:40:38, Sep 3 2007
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.
Board: FON 2202
RAM: 0x8000 0000-0x82000000, [0x80040290-0x80fe1000] available
FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.
RedBoot>
Persistent State Flash-based Configuration and Control
Executing the fconfig -l command will list the configuration that is kept in FLASH memory. More details about the fconfig command options can be found here: http://ecos.sourceware.org/docs-latest/redboot/configuring-the-redboot-environment.html.
RedBoot> fconfig -l
Run script at boot: true
Boot script:
.. fis load -l kernel
.. exec
Boot script timeout (1000ms resolution): 2
Use BOOTP for network configuration: false
Gateway IP address: 0.0.0.0
Local IP address: 192.168.1.1
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.254
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
RedBoot>
Executing the fconfig -i command will interactively change and then persist the configuration. Important configuration information like the Serial Port's communication speed (default is 9600 kbps), the TFTP server's IP Address, or the file name of the Linux Kernel can be changed here.
RedBoot> fconfig -i
Initialize non-volatile configuration - continue (y/n)? y
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis load kernel
>> exec
>>
Boot script timeout (1000ms resolution): 5
Use BOOTP for network configuration: false
Gateway IP address:
Local IP address: 192.168.1.50
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.2
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
http://ecos.sourceware.org/docs-latest/redboot/fis-load-command.html
Flash Image System (FIS)
The Fonera's Flash Image System can be accessed and modified using the fis.- fis init -- Initialize Flash Image System
- fis list -- List Flash Image System directory
- fis free -- Free flash image
- fis create -- Create flash image
- fis load -- Load flash image
- fis delete -- Delete flash image
- fis lock -- Lock flash area
- fis unlock -- Unlock flash area
- fis erase -- Erase flash area
- fis write -- Write flash area
fis list
More details about fis list can be found can be found here: http://ecos.sourceware.org/docs-latest/redboot/fis-list-command.htmllist lists the images currently available in the FIS.
- RedBoot - the bootloader itself, occupying about 192 KByte
- FIS directory - a Partition Table, about 60 KByte, without it, RedBoot wouldn't know what to load and boot.
- RedBoot config - 4 Kbyte, contains the configuration for the bootloader.
Here, the fis init command is executed followed by a fis list and a fis free
Running reset shows that the OS has been removed and the Fonera now boots into the bootloader prompt.
Running
telnet 192.168.1.50 9000 will also immediately show the RedBoot prompt now:
wpbook:~ wolf$ telnet 192.168.1.50 9000
Trying 192.168.1.50...
Connected to 192.168.1.50.
Escape character is '^]'.
RedBoot>
OpenWrt
Running the fis init command on the Fonera removes the OS and the only software available on the device now is the bootloader, i.e., we now need a new Linux distribution for this embedded device to bring it back to life. OpenWrt is one of the options and freely available via subversion.
cd ~/Work/Embedded/OpenWrt/branches/8.09.1
svn co svn://svn.openwrt.org/openwrt/tags/8.09.1 8.09.1
Generally, the following tools need to be pre-installed and if building on OS X, MacPorts and Porticus are recommended to simplify their installation.
- gcc
- binutils
- patch
- bzip2
- flex
- bison
- make
- gettext
- pkg-config
- unzip
- libz-dev
- libc headers
- autoconf
- bison
- ccache
- flex
- gawk
- libncurses-dev.
- svn
- ccache
make menuconfig will bring show the OpenWrt Configuration Menu where the Atheros 231x/5312 [2.6] target needs to be selected. To keep the initial image small, the following unessential tools can be deselected:- Base System: bridge, firewall, iptables, opkg, uci, uclibc
- Network: ppp
Executing
make after saving the configuration, results in deployable kernel image and root file system, both of which can be found here: ~/Work/Embedded/OpenWrt/barnches/8.09.1/bin/. Look for
- openwrt-atheros-vmlinux.lzma - (kernel) about 700 KB
- openwrt-atheros-root.squashfs - (root fs) about 900 KB
Load the Kernel Image
.. back on the device in RedBoot ..ip_address
More details about ip_address here: http://ecos.sourceware.org/docs-latest/redboot/ip-address-command.htmlip_address sets the IP address of the default server. Use of this address is implied by other commands, such as load.
RedBoot> ip_address -h 192.168.1.2
IP: 192.168.1.50/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2
RedBoot>
load
More details about load can be found can be found here: http://ecos.sourceware.org/docs-latest/redboot/download-command.htmlload downloads programs or data to the RedBoot platform. By default RedBoot loads images into some free RAM area which can be addressed later using the variable %{FREEMEMLO}.
-r specifies raw (or binary) data, which also implies that -b or -f must be used.
-b address in memory to load the data. Formatted data streams will have an implied load address, which this option may override.
-f address in flash to load the data. Formatted data streams will have an implied load address, which this option may override.
RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma
Using default protocol (TFTP)
Raw file loaded 0x80040400-0x801203ff, assumed entry at 0x80040400
RedBoot>
fis create
More details about fis create here: http://ecos.sourceware.org/docs-latest/redboot/fis-create-command.html.This command creates an image in the FIS directory and obviously, the data for the image must exist in RAM memory before it can be copied. By default, fis create takes the data loaded by the last load command as input for a partition starting at the first free block of the flash space. Important are the values for the RAM address (-r) and entry point (-e), which are linux specific and need to have exactly these values. The partition name 'kernel' is configured within RedBoot (see above) as the default boot partition's name and is of course changeable.
RedBoot> fis create -e 0x80041000 -r 0x80041000 kernel
... Erase from 0xa8030000-0xa8110000: ..............
... Program from 0x80040400-0x80120400 at 0xa8030000: ..............
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>
Load the Rootfs Image
Before loading the root filesystem, we issue fis list and fis free once again:
RedBoot> fis list
Name FLASH addr Mem addr Length Entry point
RedBoot 0xA8000000 0xA8000000 0x00030000 0x00000000
kernel 0xA8030000 0x80041000 0x000E0000 0x80041000
FIS directory 0xA87E0000 0xA87E0000 0x0000F000 0x00000000
RedBoot config 0xA87EF000 0xA87EF000 0x00001000 0x00000000
RedBoot> fis free
0xA8110000 .. 0xA87E0000
RedBoot> load -r -b %{FREEMEMLO} openwrt-atheros-root.squashfs
Using default protocol (TFTP)
Raw file loaded 0x80040400-0x801a03ff, assumed entry at 0x80040400
The information provided by fis free is now used like this:
0xA87E0000 minus 0xA8110000 = 0x6D0000, which is used to create the Root-Filesystem rootfs:
RedBoot> fis create -l 0x6D0000 rootfs
... Erase from 0xa8110000-0xa87e0000: ..........................................
... Program from 0x80040400-0x801a0400 at 0xa8110000: ......................
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>
Reset
This time, running reset will boot the Fonera into OpenWrt 8.09.1 ...RedBoot> resetFonera FON related posts at wolfpaulus.com
- La Fonera Hacking
Does the FON have all the attributes required to be added to the digital playground? - La Fonera (FON2100) Hardware Details
A detailed look at the La Fonera (FON 2100) hardware. - La Fonera 2.0 FON 2100a/b/c
RedBoot details and booting into OpenWrt 8.09.1 Kamikaze - La Fonera 2.0 FON 2202g
RedBoot details and booting into OpenWrt 8.09.1 Kamikaze - La Fonera 2.0 (FON2202) Hardware Details
A detailed look at the La Fonera 2.0 hardware. - La Fonera 2.0 Preview
Putting the original (or newer) firmware back on a Fonera FON 2.0, and some 2.0 screen shots. - La Fonera 2.0 (FON2202) Hacking, Cleaning House
Preparing the FON 2202 for reflashing with OpenWrt or DD-WRT - OpenWrt, Post Kernel System Initialization
A closer look at what happens when OpenWrt boots on the Fonera FON Router. - PhoneME, a JavaVM for the Fonera FON Router
A closer look at how a JavaVM could be built, packaged, and deployed into an embedded system, running the OpenWrt firmware.
Fonera Photos
- Fonera 2.0 a/b/c (FON 2100)
- Fonera 2.0 a/b/c and 2.0 g (FON 2202)
- Fonera 2.0 n (FON ....)
