DFL-200 » History » Version 61

« Previous - Version 61/69 (diff) - Next » - Current version
Gordon Shumway, 09/18/2012 08:42 PM


This page is a work in progress and changes as the hardware is mapped out.


SoC 266MHz Intel IXP422BB
RAM 64M Hynix HY57V281620ETP-H
Flash 4M Intel JS28F320
Ethernet controller 1 Realtek RTL8100B
2 IXP422 Built-in MAC
Switch 1 Realtek RTL8305SB
IDE controller 1 Promise PDC20275
RTC Ricoh RS5C372A


10/100 Eth 6 1 on the RTL8100B (WAN)
1 on NPE-C connected to the switch (DMZ)
4 on NPE-B connected to the switch, PHY 32 (LAN)
LEDs 1 GPIO-controlled Status LED (LED20)
(plus Ethernet port LEDs controlled by the switch)
Buttons 2 GPIO, Reset button on the rear panel (RSW1), active low
Hardware reset button (RSW2) inside the case
GPIO 4 On GPIOA1; 2 of these are the IIC bus
Comact Flash 1 On the IDE controller
RTC 1 With battery backup; on the IIC bus
JTAG 3 1 standard 20-pin ARM JTAG (JB1)
1 that appears to be a minimal version of a standard JTAG (JC1)
1 unknown (DEBUG2), possibly the DSP engine
Serial 1 RS-232 on the rear panel

The board has unpopulated space for two more SDRAMs and a Mini-PCI Type III connector (some supporting parts may be missing).

The board comes with RedBoot custom-tailored to run Clavister's second-stage loader and OS from the CF card.

RedBoot is scattered over a total of 512K of the 4M flash.

GPIO setup

GPIO Function Note
6 IIC SCL Also on GPIOA1
7 IIC SDA Also on GPIOA1
12 Rear-panel Reset button (RSW1) Active low
13 IO reset probably;
connected to switch #RESET pin
also resets the PCI bus
15 Status LED (LED20) (probably? Supposed to be the PCI clock?)

Headers and connectors

GPIOA1 header

Pin Function Pin Function
1 GPIO14 2 GND
7 GPIO5 8

JB1 header

Standard 20-pin ARM JTAG.

Pin Function Pin Function
1 Vref 2 Vsupply
5 TDI 6
7 TMS 8
9 TCK 10
11 RTCK 12
13 TDO 14
15 nSRST 16
17 DBGRQ 18
19 DBGACK 20

JC1 header

A simplified JTAG header.

Pin Function Pin Function
2 4 TMS
3 6 TDI
4 8 TDO

PS4S1 4-pin Berg- (Mini-Molex-) type power supply connector

Pin Function
1 +5V
4 N/C

Of note, there is no +12V.


Console is 9600,8N1.

Flash layout:

Name FLASH addr Mem addr Length Entry point
RedBoot 0x50000000 0x50000000 0x00040000 0x00000000
mac 0x50040000 0x10000000 0x00020000 0x10000000
FIS directory 0x503E0000 0x503E0000 0x0001F000 0x00000000
RedBoot config 0x503FF000 0x503FF000 0x00001000 0x00000000

RedBoot comes up with a default menu that allows selecting between booting the Clavister OS (this is done automatically after a timeout) or enter the RedBoot command line.

Although RedBoot is able to write configuration to flash memory, it ignores (at least some of the) settings contained there (console_baud_rate). The flash config doesn't contain the NPE MAC addresses either. Make note of your MAC addresses from the original OS. They may also be printed on stickers on the Ethernet jacks. The bottom sticker also has the MAC address of the WAN port -- add 0x01 for the DMZ MAC, another 0x01 for the LAN MAC.

Automatic booting

Booting the Clavister OS is done by the following command sequence:

load -m disk -b 0x100000 hda1:FWLOADER.CFX
go -c 0x101028

This will load FWLOADER.CFX from the first CF partition, which must be either FAT (16?) or ext2fs. Any file named FWLOADER.CFX can be loaded as long as it satisfies the following (known) constraints:

  • Begins with a 4136-byte long DOS/PE stub (it must be a proper DOS/PE stub, at least to some as-of-yet-unknown extent)
  • The payload after the stub must be a tagged image (ie. ELF)

Automatic booting of a custom kernel

By default, RedBoot starts up with a menu:

Found EXT2 file system
Ethernet eth0: MAC address 22:11:44:33:66:55
IP:, Gateway:
Default server:

EM-436 Ver.AB 2004-08-31

Booting Menu: Default Start D-Link firewall
1. Start D-Link firewall
2. Redboot command line
Please select:

If no interaction is made, (1) will be executed with the above-mentioned boot sequence.

Booting any custom image involves selecting (2) and issuing the necessary RedBoot commands. Automating this selection is done by a boot script that has a bare 2 as its first line, then the commands necessary to load and boot the custom image.

RedBoot> fconfig
Run script at boot: true
Boot script: 
Enter script, terminate with empty line
>> 2
>> load -r -b 0x01600000 -m disk hda1:/boot/openwrt-dfl200-zImage
>> go -n 0x01600000
Boot script timeout (1000ms resolution): 5 
Use BOOTP for network configuration: false
Gateway IP address:
Local IP address:
Local IP address mask:
Default server IP address:
console_baud_rate: 9600
GDB connection port: 0
Force console for special debug messages: false
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y
... Unlock from 0x503e0000-0x50400000: .
... Erase from 0x503e0000-0x50400000: .
... Program from 0x0ffe0000-0x10000000 at 0x503e0000: .
... Lock from 0x503e0000-0x50400000: .

This will automatically load and boot /boot/openwrt-dfl200-zImage from the first partition on the Compact Flash card (which must still be FAT or ext2 for RedBoot to be able to handle it).

Found EXT2 file system
Ethernet eth0: MAC address 22:11:44:33:66:55
IP:, Gateway:
Default server:

EM-436 Ver.AB 2004-08-31

Booting Menu: Default Start D-Link firewall
1. Start D-Link firewall
2. Redboot command line
Please select:2

== Executing boot script in 5.000 seconds - enter ^C to abort
RedBoot> load -r -b 0x01600000 -m disk hda1:/boot/openwrt-dfl200-zImage
Raw file loaded 0x01600000-0x016ee4f7, assumed entry at 0x01600000
RedBoot> go -n 0x01600000
Uncompressing Linux... done, booting the kernel.
[    0.000000] Booting Linux on physical CPU 0

Miscellaneous notes

If GPIO5 is grounded when power is applied, the board enters some sort of a simple self-test routine.

RTCK (pin 11) on JB1 (JTAG) is pulled to ground.

There are abundant supplies of ground pins on GPIOA1 and JC1; no need to wrestle with (de-)soldering this pin on JB1 if you have troubles with that.

Board revisions

Two known, EM-436A V1.1 and EM-436A V2.0. The only observable differences between the two are slightly different component use (flash, SDRAMs) and minor differences in the PCB silk.

Annotated board image

1 PS4S1 power connector 11 RTL8100B Ethernet controller
2 JP2 Mystery jumper No. 1 12 RTL8305SB Ethernet switch
3 JC1 mini-JTAG 13 RS5C372A RTC
4 JB1 ARM JTAG 14 SDRAM banks
5 GPIOA1 header 15 Mini-PCI Type III connector
6 DEBUG2 header 16 IXP422BB SoC
7 LED20 Status LED 17 JS28F320 flash
8 IMP1 Mystery connector No. 2 18 Compact Flash card
9 MAC address stickers 19 RSW1 software reset button
10 PDC20275 IDE controller 20 RSW2 hardware reset button