DFL-200¶

This page is a work in progress and changes as the hardware is mapped out.¶

Parts:

SoC	266MHz	Intel IXP422BB
RAM	64M	Hynix HY57V281620ETP-H
Flash	4M	Intel JS28F320
Ethernet controller	1	Realtek RTL8100B
	2	IXP422 Built-in MAC
Switch	1	Realtek RTL8305SB
IDE controller	1	Promise PDC20275
RTC		Ricoh RS5C372A

Features:

10/100 Eth	6	1 on the RTL8100B (WAN) 1 on NPE-C connected to the switch (DMZ) 4 on NPE-B connected to the switch, PHY 32 (LAN)
LEDs	1	GPIO-controlled Status LED (LED20) (plus Ethernet port LEDs controlled by the switch)
Buttons	2	GPIO, Reset button on the rear panel (RSW1), active low Hardware reset button (RSW2) inside the case
GPIO	4	On GPIOA1; 2 of these are the IIC bus
CF	1	On the IDE controller
RTC	1	With battery backup; on the IIC bus
JTAG	3	1 standard 20-pin ARM JTAG (JB1) 1 that appears to be a minimal version of a standard JTAG (JC1) 1 unknown (DEBUG2), possibly the DSP engine
Serial	1	RS-232 on the rear panel

The board has unpopulated space for two more SDRAMs and a Mini-PCI Type III connector (some supporting parts may be missing).

The board comes with RedBoot custom-tailored to run Clavister's second-stage loader and OS from the CF card.

RedBoot is scattered over a total of 512K of the 4M flash.

GPIO setup¶

GPIO	Function	Note
0
1
2
3
4
5	GPIO5	On GPIOA1
6	IIC SCL	Also on GPIOA1
7	IIC SDA	Also on GPIOA1
8
9	PCI INTA	PDC20275 verify me!
10	PCI INTB	RTL8100B verify me!
11
12	Rear-panel Reset button (RSW1)	Active low
13	IO reset	probably; connected to switch #RESET pin also resets the PCI bus
14	GPIO14	On GPIOA1
15	Status LED (LED20)	(probably? Supposed to be the PCI clock?)

Headers and connectors¶

GPIOA1 header¶

Pin	Function
1	GPIO14
3	IIC SDA
5	IIC SCL
7	GPIO5
2, 4, 6, 8	GND

JC1 header¶

Apparently a simplified JTAG header. verify me!

Pin	Function
2	TCK
4	TMS
6	TDI
8	TDO
1, 3, 5, 7	GND

PS4S1 4-pin Berg- (Mini-Molex-) type power supply connector¶

Pin	Function
1	+5V
2	GND
3	GND
4	N/C

Of note, there is no +12V.

RedBoot¶

Console is 9600,8N1.

Flash layout:

Name	FLASH addr	Mem addr	Length	Entry point
RedBoot	0x50000000	0x50000000	0x00040000	0x00000000
mac	0x50040000	0x10000000	0x00020000	0x10000000
FIS directory	0x503E0000	0x503E0000	0x0001F000	0x00000000
RedBoot config	0x503FF000	0x503FF000	0x00001000	0x00000000

RedBoot comes up with a default menu that allows selecting between booting the Clavister OS (this is done automatically after a timeout) or enter the RedBoot command line.

Although RedBoot is able to write configuration to flash memory, it ignores (at least some of the) settings contained there (console_baud_rate). The flash config doesn't contain the NPE MAC addresses either. Make note of your MAC addresses from the original OS. They may also be printed on stickers on the Ethernet jacks. The bottom sticker also has the MAC address of the WAN port -- add 0x01 for the DMZ MAC, another 0x01 for the LAN MAC.

Automatic booting¶

Booting the Clavister OS is done by the following command sequence:

load -m disk -b 0x100000 hda1:FWLOADER.CFX
go -c 0x101028

This will load FWLOADER.CFX from the first CF partition, which must be either FAT (16?) or ext2fs. Any file named FWLOADER.CFX can be loaded as long as it satisfies the following (known) constraints:

• Begins with a 4136-byte long DOS/PE stub (it must be a proper DOS/PE stub, at least to some as-of-yet-unknown extent)
• The payload after the stub must be a tagged image (ie. ELF)

Miscellaneous notes¶

If GPIO5 is grounded when power is applied, the board enters some sort of a simple self-test routine.

RTCK (pin 11) on JB1 (JTAG) is pulled to ground.

There are abundant supplies of ground pins on GPOIOA1 and JC1; no need to wrestle with (de-)soldering JB1 if you have troubles with that.

Annotated board image¶