| 
  • If you are citizen of an European Union member nation, you may not use this service unless you are at least 16 years old.

  • You already know Dokkio is an AI-powered assistant to organize & manage your digital files & messages. Very soon, Dokkio will support Outlook as well as One Drive. Check it out today!

View
 

MG35SerialConsole

Page history last edited by Vasile 14 years, 9 months ago


 

The wires

 

To use the MG35's console you need to connect your PC to the serial interface provided on the MG35's mainboard. Basically you need is some sort of cable to provide a 3.3 volt RS232 TTL serial interface on the MG35 end, and USB or serial signals on the PC end. At least RX, TX and GND have to be connected to the mainboard as described here.

 

Login

 

Start your favorite telnet emulator capable of using your cable. Open the port and press a key, space for instance, and KEEP IT PRESSED while you fire up the MG. You should get the following output:

 

Jasper Bootloader v1.0.0 (Oct 25 2007 14:54:35)
  Supports BootMenu Flash Network
This version of fips use micom with power control, version[3]

 

Followed by repeated characters of the key you are holding. Release the key and press enter. Enter the password as follows:

 

This version of fips use micom with power control, version[3]

MediaGate.

 

The password is case sensitive and it ends with a single dot, pressing enter will give some more information and the boot prompt:

 

0031.0033 mfr 0001 id 22c4 Bottom bootsector
Flash 0 at address 0x00000000
  ID : AMD/Fujitsu Standard
  Size : 4096 KB
  Regions : 4
    0 : 0x00000000 - 0x00008000 *  1
    1 : 0x00008000 - 0x00004000 *  2
    2 : 0x00010000 - 0x00010000 *  1
    3 : 0x00020000 - 0x00020000 * 31
Found DM9000 chipset at I/O address 3f0000
DM9000 open

Welcome to JASPER boot loader

boot> 

 

This MG does not have dhcp enabled, otherwise DM9000 (the network interface) will mention requesting an ip-address.

 

That's it, you are in the bootloader.

 

Commands

 

  help : show list of commands

  help [command] : help on command  

 

  boot [target] : boot kernel

    flash : boot from flash (0x00006000)

    kernel : boot kernel on RAM (0x01008000)

    image : boot image on RAM (0x01400000)

 

  [addr] : jump to specified address

  config <name> [options] : configure boot loader

      load : load configuration

      serial <baudrate> : UART configuration

        valid baud rates : 9600, 19200, 38400 (default), 57600, 115200

      net : network configuration

      file : download filename setting

 

  download [media] <target> : download image via various media

      [media] : serial / net (network)

      <target> : boot / romfs / kernel / [addr]

 

  dump [option] <addr> <len> : dump memory area

      [option] : -d (4 bytes), -w (2 bytes), -b (1 byte)

 

  flash [command] <options> : flash commands

      probe <addr> : probe flash

      list : show flash chip information

      erase [addr] <len> : erase one or more sectors of flash memory

      eraseall : erase all flash memory

      writeb [addr] [data] : write one byte of data into specified address

      writew [addr] [data] : write one word of data into specified even address

      write [to] [from] [len] : write block of data into specified address

      boot : write boot loader image on RAM into FLASH

      romfs : write ROMFS image on RAM into FLASH

 

  mem [op] <args> : read from or write to memory

      rb [addr] : read one byte of data

      rw [addr] : read two bytes of data

      rl [addr] : read four bytes of data

      wb [addr] [data] : write one byte of data

      ww [addr] [data] : write two bytes of data

      wl [addr] [data] : write four bytes of data

 

  memcmp [addr1] [addr2] <len> : compare memory region

 

  memcpy [to] [from] <len> : copy memory region

 

  net [command] <args> : network commands

      config : show current network configuration

      up : enable networking

      down : disable networking

      arp : show entire ARP table

      arp [IP addr] : get the hardware address of specfied host

      ping [IP addr] : send ICMP echo message to specified host

      dhcp : request DHCP

      tftp [loader/romfs/kernel] : download via TFTP from server

      tftp [IP addr] [filename] : download specified file from specified server

      eeprom [command] : manipulate EEPROM connected to Ethernet chipset

          dump : dump EEPROM contents

          ww [reg] [data] : update EEPROM contents

      dump : dump ethernet RX buffer contents

 

On the serial console we have commands to download kernel and cramfs filesystem, and even flash them.

 

pbarette: The bootloader saves the config settings, but I can't get it to save a new default serial baudrate. I usually connect at 38400 then issue "config serial 115200" and disconnect, change the baud on my comm port and reconnect. Since the serial interface is a 3-wire deal, the MG35 doesn't notice the dis/re-connect at all.

gardez: The bootloader doesn't save the serial speed because the serial port is initialized to show the banner before the config is loaded, and will work even if the config load fails.

 

gadgetmind:

What "boot image" expects is a full rom image at 0x1400000

 

So -

boot> memcpy 0x1400000 0 0x400000 (4MBytes of rom to 0x1400000)

boot> boot image

 

Results in a successful inflate of the kernel and the box booting. However, it's currently hard to tell if it's using the new kernel and/or cramFS.

 

I guess I'd also need -

mem wl 0x1440000 0x014e2809

to tell it to use the new cramFS

 

Also note that there's an unlisted "config save" command, but that doesn't seem to change the default baudrate either.

 

"config file" - This lets you set the file names of the loader, linux, romfs and image. The most useful is probably setting the romfs to somewhere in /tftpboot so you can use tftp to download new romfs without needing heavy tftp server reconfiguration. Quite what the names of the loader and linux are for isn't known - there are no path names on the default version.

 

Danny:

 

While testing newer versions created by JD we've found a various interesting things.

 

Downloading from tftp server

 

Downloading doesn't work when DHCP is enabled, if you have DHCP enabled you can change it to static from the bootloader prompt:

 

(192.168.1.10 is my local server)

 

boot> config net
  Protocol    : (0) None (1) Static IP (2) BOOTP (3) DHCP : (3) 1
  MAC Address : (FF:FF:FF:FF:FF:FF)
  IP Address  : (192.168.1.6)
  Netmask     : (255.255.255.0)
  Gateway     : (192.168.1.1)
  DNS         : (192.168.1.10)
  Server      : (192.168.1.10)
Writing : 0x00025250
.
boot>

 

The first five lines can be modified to suite your setup. After you have changed the setup you'll need to reboot.

 

Next, the network connection always needs to be initialized. I found these steps work:

 

Welcome to JASPER boot loader

boot> net arp
192.168.1.6          FF:FF:FF:FF:FF:FF
boot> net arp 192.168.1.10
192.168.1.10         FF:FF:FF:FF:FF:FF
boot> download net romfs
Connecting...
Receiving : ....................................
Received 3221327 (0x31274f) bytes at address 01400000
boot>

 

The above command will retrieve a file named "/home/tftp/bigmo/romfs.m35" if you wish to use another filename you can use the command "config file" to change it. Path names entered here are always relative to the tftp root path! So if the tftp root path is /tftproot the romfs.m35 file should be located in /tftproot/home/tftp/bigmo/.

 

One can also download the kernel. This is useful when testing new kernels. Please note that it is important to set right Server in the network configuration ("config net", above). Otherwise

 

download net kernel

 

will report connection timeout, while

 

net tftp 192.168.178.3 kernel

will be successful.

 

Debricking

 

Now if all you wish to do is debrick and boot your box enter the command "flash romfs" and "boot flash". This should give the following output:

 

boot> flash romfs
This will write data on RAM 0x01400000 into flash 0x00040000
  0x00040000 - 0x0035ffff will be erased
  0x00040000 - 0x0035274e will be written
Erasing : ........................................................................................
Writing : ................................................................
          ................................................................
          ................................................................
          ................................................................
          ................................................................
          ................................................................
          ..........
boot> boot flash

Inptr=
00000014
Inflating....

Final Inptr=00090743
Original LEN =001287ECOutCnt = 001287EC
Original CRC =AEF8FCA7
Computed CRC =AEF8FCA7
01008000

 

Other goodies

 

As shown in the command list the box is able to download more than just romfs, other options are boot and kernel. This is where the fun part starts, since the boot command is able to start these downloaded files! This way it's possible to test modified kernels and bootloaders without flashing your box! below is the incomplete output of a kernel which is configured to output to the console:

 

boot> boot kernel
01008000Linux version 2.4.17-uc0 (adam@adam-desktop) (gcc version 2.95.3 20010315 (release)(ColdFire patches - 20010318 from http://fidd8
Processor: ARM pt110 revision 0
Architecture: JASPER
Jasper2 rev.A CPU 99 Mhz
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/cdroms/cdrom0
setup_timer: Timer value = 30937
serial_jasper: setup_console @ 38400
jasperuart change speed 80
Calibrating delay loop... 49.25 BogoMIPS
Memory: 16MB = 16MB total
Memory: 14708KB available (1112K code, 218K data, 44K init)
Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode-cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
sk_init: wmem_max 32767 default 32767, rmem_max 32767 default 32767
Initializing RT netlink socket
Starting kswapd
devfs: v1.7 (20011216) Richard Gooch (rgooch@atnf.csiro.au)

 

Comments (0)

You don't have permission to comment on this page.