zrouter

h1. DFL-200

h2. %{color:red}This page is a work in progress and changes as the hardware is mapped out.%

Parts:
|SoC|266MHz|Intel IXP422BB|
|RAM|64M|Hynix HY57V281620ETP-H|
|Flash|4M|Intel JS28F320|
|Ethernet controller|1|Realtek RTL8100B|
||2|IXP422 Built-in MAC|
|Switch|1|Realtek RTL8305SB|
|IDE controller|1|Promise PDC20275|
|RTC||Ricoh |RTC|Ricoh RS5C372A|

Features:
|10/100 Eth|6|1 on the RTL8100B (WAN)
1 on NPE-C connected to the switch (DMZ)
4 on NPE-B connected to the switch, PHY 32(LAN)|
|LEDs|1|GPIO-controlled Status LED (LED20)
(plus Ethernet port LEDs controlled by the switch)|
|BTNs|1|GPIO, Reset button on the rear panel (RSW1), active low|
|GPIO|4|On GPIOA1; 2 of these are the IIC bus|
|CF|1|On the IDE controller|
|RTC|1|With battery backup; on the IIC bus|
|JTAG|2|1 standard 20-pin ARM JTAG (JB1)
1 unknown (DEBUG2), possibly the DSP engine|
|Serial|1|RS-232 on the rear panel|

The board has unpopulated space for two more SDRAMs and a Mini-PCI Type III connector (some supporting parts may be missing).

The board comes with RedBoot custom-tailored to run Clavister's second-stage loader and OS from the CF card.

RedBoot is scattered over a total of 512K of the 4M flash.

h2. GPIO setup

|*GPIO*|*Function*|*Note*|
|0|||
|1|||
|2|||
|3|||
|4|||
|5|GPIO5|On GPIOA1|
|6|IIC SCL|Also on GPIOA1|
|7|IIC SDA|Also on GPIOA1|
|8|||
|9|PCI INTA|PDC20275 _%{color:red}verify me!%_|
|10|PCI INTB|RTL8100B _%{color:red}verify me!%_|
|11||
|12|Rear-panel Reset button (RSW1)|Active low|
|13|IO reset|probably;
connected to switch #RESET pin
also resets the PCI bus|
|14|GPIO14|On GPIOA1|
|15|Status LED (LED20)|(probably? Supposed to be the PCI clock?)|

h2. GPIOA1 header

|*Pin*|*Function*|
|1|GPIO14|
|3|IIC SDA|
|5|IIC SCL|
|7|GPIO5|
|2, 4, 6, 8|GND|

h2. EJC1 header

Apparently a simplified JTAG header. _%{color:red}verify me!%_

|*Pin*|*Function*|
|2|TCK|
|4|TMS|
|6|TDI|
|8|TDO|
|1, 3, 5, 7|GND|

h2. PS4S1 4-pin Berg- (Mini-Molex-) type power supply connector

|*Pin*|*Function*|
|1|+5V|
|2|GND|
|3|GND|
|4|N/C|

Of note, there is no +12V.

h2. RedBoot

Console is 9600,8N1.

Flash layout:

|*Name*|*FLASH addr*|*Mem addr*|*Length*|*Entry point*|
|RedBoot|0x50000000|0x50000000|0x00040000|0x00000000|
|mac|0x50040000|0x10000000|0x00020000|0x10000000|
|FIS directory|0x503E0000|0x503E0000|0x0001F000|0x00000000|
|RedBoot config|0x503FF000|0x503FF000|0x00001000|0x00000000|

RedBoot comes up with a default menu that allows selecting between booting the Clavister OS (this is done automatically after a timeout) or enter the RedBoot command line.

Although RedBoot is able to write configuration to flash memory, it ignores (at least some of the) settings contained there (console_baud_rate). The flash config doesn't contain the NPE MAC addresses either. *Make note of your MAC addresses from the original OS*. They may also be printed on stickers on the Ethernet jacks.

h3. Automatic booting

Booting the Clavister OS is done by the following command sequence:

<pre>
load -m disk -b 0x100000 hda1:FWLOADER.CFX
go -c 0x101028
</pre>

This will load FWLOADER.CFX from the first CF partition, which must be either FAT (16?) or ext2fs. Any file named FWLOADER.CFX can be loaded as long as it satisfies the following (known) constraints:

* Begins with a 4136-byte long DOS/PE stub (it _must_ be a proper DOS/PE stub, at least to some as-of-yet-unknown extent)
* The payload after the stub _must_ be a tagged image (ie. ELF)

h2. Miscellaneous notes

If GPIO5 is grounded when power is applied, the board enters some sort of a simple self-test routine.

JP2 supplies Vref to the ARM JTAG.

RSW2 is the system reset button (apparently the same as the nSRST JTAG signal).