Lexmark N2050 Wifi Card Hack

From FGARWiki

Busy Box Linux Lives inside the N2050

This tutorial will get you to read the output of the N2050 wifi card found in the Lexmark X6570 printer.

Skip to "The Fun Stuff" if you want to start programming.


You will need:

  • A computer running Linux and Bash
  • A Lexmark X6570
  • A 3.3v capable USB-UART bridge, like the Foca V2.1 or CP2102 ("Bridge")
  • Tools for soldering
  • Some wires


The "On Button"

The N2050 communicates with 3.3 volts. It receives its 30V positive power on the pin on the 22 pin connector CLOSEST to the capacitors. the 'ground' may either be connected to the sixth, through the nineth pin on the back of the board, OR the pin on the far right on the 6 pin connector toward the bottom of the board. In order to make life easier, we initially opted to power the card in situ.

Insitu.JPG

Powering Via Printer Parts

To power the card using printer parts, carefully break down the Lexmark X6570. By carefully, I mean paying attention to how wires, ribbons, and sockets are connected and not shattering important bits. Keep the controller board, touch pad (silver panel in photo), power supply (black box on left), the N2050 (vertical card), wires connecting power supply to controller board, and the ribbon connecting the touch pad to the controller board.

I soldered the red and black wires onto the power supply. Don't reverse those little wires, or else you're burn your board. I would suspect putting the N2050 backwards into the socket on the controller board would cause a similar burn up.

You now have a clumsy 'on button' and steady power supply for the N2050.

Powering the board Directly

to power the board directly, apply the positive voltage from the lexmark's 31V power supply to the pin closest to the capacitors(far right) on the bottom edge connector, and wire the negative line to the pin on the far right of the 6 pin connector.

Hard Wiring the N2050 and USB/UART Bridge

Now, you need to provide the N2050 a USB interface.
N2050stripped.JPG

Solder four wires into the line of four pin holes on the corner of the---in this case---88W8638 chip (look for the red circle in the pic). Your chip number may vary. I apologize for the poor quality of my picture. Let's call the side of the N2050 that plugs into the controller board down.

From top to bottom the pins are:

  • Ground
  • Transmit
  • Receive
  • 3.3v Power

Now, wire your N2050 to the USB/UART Bridge. Run Ground to Ground; Transmit to Receive; and Receive to Transmit. Here's a picture on how your wires should run:

Error creating thumbnail: Unable to save thumbnail to destination

Make It Talk

Unplug your USB devices from your computer, including the Bridge.

In Bash (Terminal, as it's commonly called) type the following: "screen /dev/tty" and press tab twice.

You will now see a list of available tty devices.

Plug in the Bridge. Repeat the command "screen /dev/tty", and press tab twice.

If your Bridge is powered on and connected via USB, you might see a new addition called "ttyUSB0". Your results may vary. I've assumed "ttyUSB0" in our example.

Now, type "screen /dev/ttyUSB0 38400" (or "screen /dev/whatever 38400")

If Bash is talking to the Bridge, and if the Bridge is talking to the running N2050, you should see some human readable language.(Sjmoquin 00:10, 18 May 2012 (UTC))

Here is the screen out of our N2050:

Booting...
Usb Init Complete For 44Mhz...


                                       ___           ___
                                      /__/|         /__/|
                                     |  |:|        |  |:|
                     ___     ___     |  |:|        |  |:|
                    /__/\   /  /\  __|__|:|      __|  |:|
                    \  \:\ /  /:/ /__/::::\____ /__/\_|:|____
                     \  \:\  /:/     ~\~~\::::/ \  \:\/:::::/
                      \  \:\/:/       |~~|:|~~   \  \::/~~~~
                       \  \::/        |  |:|      \  \:\
                        \__\/         |  |:|       \  \:\
                                      |__|/         \__\/




U-Boot 1.1.1 (Apr 10 2007 - 16:09:11)
Marvell version: 1.1.1.27 Radlan

U-Boot code: 00F00000 -> 00F1EFDC  BSS: -> 00F23D10
RAM Configuration:
Bank #0: 00000000 16 MB
Performing flash auto-detection at 0xFFF00000
Found SPANSION_ID_S29GL032A
Found bottom boot sector device
Flash base auto-detected at 0xFFC00000
Flash:  4 MB
No environment found on flash, using default.

In:    serial
Out:   serial
Err:   serial
Net:   eth0 [PRIME]
Got here
Hit any key to stop autoboot:  0
Data (writethrough) Cache is OFF
Instruction Cache is OFF
### CRAMFS loading 'uImage' to 0x100000
### CRAMFS load complete: 872416 bytes loaded to 0x100000
## Booting image at 00100000 ...
   Image Name:   Linux-2.6.12.5-88w8xx8
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    872352 Bytes = 851.9 kB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK

Starting kernel ...

Uncompressing Linux........................................................... done, booting the kernel.
    Linux version 2.6.12.5-88w8xx8 (mls-bld@nevada) (gcc version 3.3.3 (DENX ELDK 3.1.1 3.3.3-9)) #1 Tue Apr 10 16:03:29 EDT 2007
CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ)
CPU0: D VIVT write-back cache
CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
CPU0: D cache: 32768 bytes, associativity 4, 32 byte lines, 256 sets
Machine: MV88W8638
Using U-Boot passing parameters structure - U-Boot release 1.1.1.27
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists
Kernel command line: console=ttyS0,38400 flashsize=0x400000 bootv="Tue Apr 10 16:02:10 EDT 2007" root=/dev/mtdblock0 ro rootfstype=cramfs ip=50.1.1.10:50.1.1.2:::MANHATTAN:eth0:none boot
Dynamic flash size: 0x400000
Calulated flash_base = 0xffc00000
PID hash table entries: 128 (order: 7, 2048 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 16MB = 16MB total
Memory: 14292KB available (1615K code, 176K data, 68K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
MV88W8XX8 LSP release 33 for kernel 2.6.12.5
Marvell USB EHCI Host controller
setting GPIO 10 for 1693 device power
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
Initializing Cryptographic API
Serial: 8250/16550 driver $Revision: 1.90 $ 16 ports, IRQ sharing enabled
ttyS0 at MMIO 0xf800c840 (irq = 11) is a 16550
ttyS1 at MMIO 0xf800c940 (irq = 11) is a 16550
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered
loop: loaded (max 8 devices)
###################################
mv88w8xx8_flash_size = 0x400000
Number of erase regions: 2
Primary Vendor Command Set: 0002 (AMD/Fujitsu Standard)
Primary Algorithm Table at 0040
Alternative Vendor Command Set: 0000 (None)
No Alternate Algorithm Table
Vcc Minimum:  2.7 V
Vcc Maximum:  3.6 V
No Vpp line
Typical byte/word write timeout: 128 �s
Maximum byte/word write timeout: 1024 �s
Typical full buffer write timeout: 128 �s
Maximum full buffer write timeout: 4096 �s
Typical block erase timeout: 1024 ms
Maximum block erase timeout: 16384 ms
Chip erase not supported
Device size: 0x400000 bytes (4 MiB)
Flash Device Interface description: 0x0002
  - supports x8 and x16 via BYTE# with asynchronous interface
Max. bytes in buffer write: 0x20
Number of Erase Block Regions: 2
  Erase Region #0: BlockSize 0x2000 bytes, 8 blocks
  Erase Region #1: BlockSize 0x10000 bytes, 63 blocks
mv88w8xx8 flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 4 MTD partitions on "mv88w8xx8 flash":
0x00000000-0x00350000 : "LINUX_FS"
0x00360000-0x003c0000 : "LINUX_CFG"
0x00350000-0x00360000 : "HIST"
0x003c0000-0x00400000 : "UBOOT"
ehci_platform ehci_platform.14362: EHCI Host Controller
ehci_platform ehci_platform.14362: new USB bus registered, assigned bus number 1
ehci_start: pdev->id = 088f8008
ehci_platform ehci_platform.14362: park 0
ehci_platform ehci_platform.14362: USB 2.0 initialized, EHCI 1.00, driver 10 Dec 2004
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ehci_platform ehci_platform.14362: irq 8, io mem 0x00000000
ehci_start: pdev->id = 088f8008
ehci_platform ehci_platform.14362: park 0
ehci_platform ehci_platform.14362: USB 2.0 restarted, EHCI 1.00, driver 10 Dec 2004
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
ip_conntrack version 2.1 (128 buckets, 1024 max) - 180 bytes per conntrack
usb 1-1: new high speed USB device using ehci_platform and address 2
ip_tables: (C) 2000-2002 Netfilter core team
NET: Registered protocol family 1
NET: Registered protocol family 17
VFS: Mounted root (cramfs filesystem) readonly.
Freeing init memory: 68K

Tue Apr  4 02:20:00 UTC 2006
Linux (none) 2.6.12.5-88w8xx8 #1 Tue Apr 10 16:03:29 EDT 2007

history: module license 'Proprietary' taints kernel.
mtd=c0311600
 typ=3 flags=5 size=10000
 name=HIST index=2
Read 65536 bytes  rc=0
ABS = 0
Installing USB Host drivers
hotplug INFO: port0/lp -> lp0
/m/open/mh/next/builds/release/KernelA/OPEN.MH.K204/linux-2.6.12.5/drivers/usb/class/usblp.c: usblp0: USB Bidirectional printer dev 2 if 1 alt 0 proto 2 vid 0x043D pid 0x010F
usbcore: registered new driver usblp
/m/open/mh/next/builds/release/KernelA/OPEN.MH.K204/linux-2.6.12.5/drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
/m/open/mh/next/builds/release/KernelA/OPEN.MH.K204/linux-2.6.12.5/drivers/usb/class/usblp.c: $Id: usblp.c 12222 2006-03-17 16:08:31Z carlsonj $
usbcore: registered new driver hiddev
hotplug INFO: port0/hiddev -> hiddev0
hiddev96: USB HID v1.00 Device [Lexmark  6500 Series] on usb-ehci_platform.14362-1
usbcore: registered new driver usbhid
/m/open/mh/next/builds/release/KernelA/OPEN.MH.K204/linux-2.6.12.5/drivers/usb/input/hid-core.c: v2.01:USB HID core driver
hotplug INFO: port0/cpdmedia -> cpdmedia0
hotplug INFO: port0/scanner -> scanner0
usbcore: registered new driver usbscanner
Initializing USB Mass Storage driver...
scsi0 : SCSI emulation for USB Mass Storage devices
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
mkdir: Cannot create directory `/var/dev/usb': File exists
Apr  4 02:20:06 (none) syslog.info syslogd started: BusyBox v1.01 (2007.04.10-20:07+0000)
Marvell MV88W8xx8 Wireless Device Module[VERSION: WB31-V3.0.2.8L]
Wireless LAN module Setup
Configuration file: /pkg-netapps/etc/mvwcd.conf
<7>mvWLAN: Registered netdevice wlan0
Restart BSS
Apr  4 02:20:07 (none) user.info mvwcd:  ===> LINK LOSS (mode 2)<===
SIOCGIFFLAGS: No such device
Apr  4 02:20:08 (none) user.warn lexdebug: ErrExit: sendto failed.  Requestor is dead (errno 2 - No such file or directory)
/pkg-netapps/etc/rc_net_postPage4: 8: /pkg-netapps/etc/rc.xsupplicant: not found
/pkg-netapps/etc/rc_net_postPage4: 55: generate_random: not found
  Starting INA ErrorExit Service...
Apr  4 02:20:08 (none) daemon.info ErrorExit[485]: Daemonizing Complete...
  Starting StringsServer
Apr  4 02:20:08 (none) user.info StringsServer: TXRegister(), rc = TX_SUCCESS
  Starting VacuumServer
Apr  4 02:20:09 (none) daemon.info VacuumServer[496]: Daemonizing Complete....
Apr  4 02:20:09 (none) daemon.info VacuumServer[496]: get_active_interface returning slot bitmask 0x1
Apr  4 02:20:09 (none) daemon.info VacuumServer[496]: find interface succeeded - ifname = wlan0, slot = 0
Apr  4 02:20:09 (none) daemon.info VacuumServer[498]: picked filesystem manblock backend
Got interface name wlan0 from Vacuum
  Starting StatusServer
Apr  4 02:20:10 (none) daemon.info StatusServer[508]: Daemonizing complete...
Apr  4 02:20:10 (none) daemon.info StatusServer[508]: picked filesystem manblock backend
  Starting NPAP_Server
Apr  4 02:20:10 (none) daemon.info NPAP_Server[517]: Daemonizing complete...
  Starting flashsrv
  Starting PrinterHandler
Apr  4 02:20:10 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0)
Apr  4 02:20:10 (none) daemon.info PrinterHandler[534]: Daemonizing complete...
  Starting HIDHandler
Apr  4 02:20:11 (none) user.info HIDHandler: Starting HIDHandler!
  Starting Wireless LinkMonitor and Variables...
Apr  4 02:20:11 (none) daemon.info PrinterHandler[549]: Starting_Backend_Service 696: Port 0 Lexmark CPD BackEnd Selected!
  Vendor: Lexmark   Model: USB Mass Storage  Rev:  200
  Type:   Direct-Access                      ANSI SCSI revision: 00
Attached scsi removable disk sda at scsi0, channel 0, id 0, lun 0
Apr  4 02:20:12 (none) user.info mvwcd:  ===> SCAN DONE (mode 2)<===
Apr  4 02:20:13 (none) user.info HIDHandler[538]: ###Using Scan Interface /var/dev/port0/scanner
Apr  4 02:20:13 (none) user.info HIDHandler[538]: ###Using CPD Media Interface /var/dev/port0/cpdmedia
Apr  4 02:20:13 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0)
Apr  4 02:20:13 (none) lpr.err vacWLAN[591]: error setting VSEC_8021X_ENABLED based on security mode
Apr  4 02:20:13 (none) user.info mvwcd: Configured ssid=mfg test mode (len=13)
Apr  4 02:20:13 (none) user.info mvwcd: No result from scan
mount: Mounting /var/dev/usb/sda on /var/fs/usbdrive_port0 failed: No medium found
Apr  4 02:20:14 (none) lpr.err vacWLAN[617]: error setting VSEC_8021X_ENABLED based on security mode
Apr  4 02:20:15 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0)
Apr  4 02:20:17 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0)
Apr  4 02:20:18 (none) user.info mvwcd:  ===> SCAN DONE (mode 2)<===
Apr  4 02:20:19 (none) user.info mvwcd: Configured ssid=mfg test mode (len=13)
Apr  4 02:20:19 (none) user.info mvwcd: No result from scan
Apr  4 02:20:20 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0)
Apr  4 02:20:22 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0)
Apr  4 02:20:23 (none) user.info mvwcd:  ===> SCAN DONE (mode 2)<===
Apr  4 02:20:24 (none) user.info mvwcd: Configured ssid=mfg test mode (len=13)
Apr  4 02:20:24 (none) user.info mvwcd: No result from scan
Apr  4 02:20:24 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0)
Apr  4 02:20:26 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0)
Apr  4 02:20:28 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0)
Apr  4 02:20:28 (none) user.info mvwcd:  ===> SCAN DONE (mode 2)<===
Apr  4 02:20:30 (none) user.info mvwcd: Configured ssid=mfg test mode (len=13)
Apr  4 02:20:30 (none) user.info mvwcd: No result from scan
Apr  4 02:20:30 (none) daemon.err NPAP_Server[517]: NPA_RegisterForChangeAlerts: Vac_Register_Var_For_Alerts() returned 0xfffffff4 for key 0x10a00 (0)
vacWLAN: vacuum variables present!
  Starting /Registering IPv4 Vacuum Variables
Apr  4 02:20:31 (none) lpr.debug vacip[633]: IP_SNMPV3_DISABLED
Apr  4 02:20:31 (none) lpr.debug vacip[633]: IP_RARP_DISABLED
Apr  4 02:20:31 (none) lpr.debug vacip[633]: IP_BOOTP_DISABLED
Apr  4 02:20:31 (none) lpr.debug vacip[633]: IP_HTTP_HIDDEN
Apr  4 02:20:31 (none) lpr.debug vacip[633]: IP_MDNS_HIDDEN
Apr  4 02:20:31 (none) lpr.debug vacip[633]: IP_AUTOIP_HIDDEN
Apr  4 02:20:31 (none) lpr.debug vacip[636]: send_FWCONF 200 Failed No such file or directory (rc -1, sockfd 7)
Apr  3 22:20:32 (none) lpr.debug vacip[636]: send_FWCONF 200 Failed No such file or directory (rc -1, sockfd 7)
  Starting network interface...
        ...mac_prep...
Lexmark MAC address IOCTL failed, trying Linux standard... 14
Apr  4 02:20:32 (none) user.info mvwcd:  ===> LINK LOSS (mode 2)<===
        ...ifconfig...
  Registering Firewall App...
  Starting firewall_app
Apr  3 22:20:33 (none) lpr.debug vacip[636]: send_FWCONF 200 Failed No such file or directory (rc -1, sockfd 7)
  Starting vacSEC
Apr  4 02:20:34 (none) daemon.info firewall_app[673]: Firewall App Daemonizing complete...
Apr  4 02:20:34 (none) user.notice Bad argument `80'
Apr  4 02:20:34 (none) user.notice Bad argument `80'
Apr  4 02:20:34 (none) daemon.info vacSEC[697]: Daemonizing complete...
Apr  4 02:20:35 (none) lpr.debug vacWLAN[620]: iwpriv wlan0 rsnmode off
  Object Store is not enabled...
sh: /pkg-netapps/etc/rc.xsupplicant: not found
Apr  4 02:20:35 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 key off
Apr  4 02:20:35 (none) user.info mvwcd:  ===> LINK LOSS (mode 2)<===
Apr  4 02:20:35 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 mode managed
Apr  4 02:20:35 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 essid any
  Openssl enabled..Starting all new Web Server on port 80/631/8000...
Apr  4 02:20:35 (none) lpr.debug vacWLAN[620]: iwpriv wlan0 hexpsk off
Apr  4 02:20:36 (none) lpr.debug vacWLAN[620]: iwpriv wlan0 default
Apr  4 02:20:36 (none) lpr.debug vacWLAN[620]: iwpriv wlan0 country FCC
Apr  4 02:20:36 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 channel 11
Apr  4 02:20:36 (none) daemon.crit thttpd[738]: socket :: - Address family not supported by protocol
Apr  4 02:20:36 (none) daemon.crit thttpd[738]: socket :: - Address family not supported by protocol
Apr  4 02:20:36 (none) daemon.crit thttpd[738]: socket :: - Address family not supported by protocol
Apr  4 02:20:36 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 mode ad-hoc
Apr  4 02:20:36 (none) user.info mvwcd:  ===> LINK LOSS (mode 2)<===
Apr  4 02:20:36 (none) daemon.warn thttpd[738]: started as root without requesting chroot(), warning only
Apr  4 02:20:36 (none) lpr.debug vacWLAN[620]: iwpriv wlan0 basicrate 0,1,2,3
Apr  4 02:20:36 (none) lpr.debug vacWLAN[620]: iwpriv wlan0 preamble 1
  Starting Hbn3
Apr  4 02:20:36 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 key off
Apr  4 02:20:36 (none) daemon.info Hbn3[763]: Daemonizing complete...
  Starting HostListApp
Apr  4 02:20:37 (none) lpr.debug vacWLAN[620]: iwconfig wlan0 commit
 WirelessLinkMonitor:  Link down
Apr  4 02:20:37 (none) daemon.info HostListApp[772]: Daemonizing complete...
Apr  4 02:20:37 (none) daemon.warn HostListApp[772]: Starting HostListApp
Apr  4 02:20:37 (none) user.info mvwcd:  ===> LINK LOSS (mode 1)<===
  Starting SNMPv3 Server
kill: 1: Usage: kill [-s sigspec | -signum | -sigspec] [pid | job]... or
kill -l [exitstatus]
Apr  4 02:20:38 (none) daemon.info vacSNMP[803]: Daemonizing complete...
Apr  4 02:20:38 (none) user.info mvwcd:  ===> LINK LOSS (mode 1)<===
process `net-snmpd' is using obsolete setsockopt SO_BSDCOMPAT
  Starting Mulitcast DNS process
  Starting WaitForNetworkLink
Apr  4 02:20:39 (none) daemon.info mdns[831]: Daemonizing complete...
Apr  4 02:20:40 (none) user.info mvwcd:  ===> SCAN DONE (mode 1)<===

The Fun Stuff

dabyd64 did some excellent work, and I feel the community is greatly benefited by his findings. The following is his write-up on USB connectivity, and uploading whatever one wishes to the N2050.

################################
SOURCE CODE, TOOLCHAIN, ETC
################################
The original source code is gone.
Lexmark made it available only for a couple of months, and then removed everything.
But, searching, i found the "Musicpal" device, which has a similar processor (mv88w8618)
Even inside the source there are mentions to our processor! (mv88w8638)

So, maybe we can do something with this...

source code:
http://www.musicpal.info/gpl/get.php?f=alinux-1.68-gpl.tar.bz2

Toolchain
http://www.musicpal.info/gpl/get.php?f=arm-2005-03-06.zip

Support Package
http://www.musicpal.info/gpl/get.php?f=bsp_adma_1-1.68-gpl.tar.bz2


################################
UNLOCKING THE FIRMWARE (ENABLE WRITING ON THE CONSOLE)
################################
The original firmware runs a script that runs a debug program forever, showing lexmark stuff.
Then we can't write on the console.
To fix that, I edited the firmware and removed the call of the debug program.
Also, if you make a script file called "init.sh" and save it in the root of a FAT32 USB drive,
and you connect it to the board before powering on, it will be loaded automatically.

To download the firmware:
http://www.mediafire.com/?hkaottt5ddf59mj

Flash to "LINUX_FS".


####################
# BOOTLOADER STUFF #
####################

What you need:

     Teraterm Free, (http://logmett.com/index.php?/products/teraterm.html)
     USB Serial cable (a RS232-TTL cable will work too, but will be limited to 115200...slow)
     Some free time



###################
FLASH ADDRESSES
###################

The bootloader shows this:
	flash base address is 0xFFC00000

But kernel shows this partitions:

	0x00000000-0x00350000 : "LINUX_FS"
	0x00360000-0x003c0000 : "LINUX_CFG"
	0x00350000-0x00360000 : "HIST"
	0x003c0000-0x00400000 : "UBOOT"

So, The kernel addresses are relative, the real addresses are this:
(bootloader base address + kernel reported address)

	0xFFC00000-0xFFF4FFFF : "LINUX_FS"
	0xFFF50000-0xFFF5FFFF : "HIST"
	0xFFF60000-0xFFFBFFFF : "LINUX_CFG"
	0xFFFC0000-0xFFFFFFFF : "UBOOT"


###################
TRANSFERRING DATA
###################

IF YOU USE A RS232-TTL CABLE INSTEAD A USB-SERIAL, THEN USE 115200 NOT 921600!!

SPEED TESTS FOR FULL FLASH TRANSFER (4MByte):
	921.600 BAUDS: 3MIN 40SECS
	115.200 BAUDS: 10 MINUTES


Now let's load a binary file to the device's ram, through the serial port:
As 38400 bauds is very slow, let's switch the transfer speed to something higher, like 921600:
Type:
	loadb 0x00100000 921600

You will see this:

	## Switch baudrate to 921600 bps and press ENTER ...

Do that. Switch your serial port to 921600 and press enter.
You will see:
	## Ready for binary (kermit) download to 0x00100000 at 921600 bps...
	
Now, in TeraTerm, go to "File", "Transfer", "Kermit", "Send..." and select the file you want to upload.

It will take a while, depending on the baudrate speed.

When completed, you will see something like this:

	## Total Size      = 0x00010000 = 65536 Bytes
	## Start Addr      = 0x00100000
	## Switch baudrate to 38400 bps and press ESC ...

(This is an example for a 64KB transfer)

Switch your serial port back to 38400 and press ESC.
You will see the shell again.

Write down the values of "Total Size" and "Start Addr".

In this case they are 0x00010000 and 0x00100000.



###################
ERASING THE FLASH
###################

Now, we have to erase the flash before we copy the new data.
Depending on where you want to flash the data, you have to erase different regions:

for LINUX_FS:
	erase 0xFFC00000 0xFFF4FFFF

for HIST:
	erase 0xFFF50000 0xFFF5FFFF

for LINUX_CFG:
	erase 0xFFF60000 0xFFFBFFFF

for UBOOT: (NEVER TOUCH UBOOT UNLESS YOU KNOW WHAT YOU'RE DOING!!)
	erase 0xFFFC0000 0xFFFFFFFF


It will output something like this:

	. done
	Erased nn sectors



###################
FLASHING THE DATA
###################

Now, the last step. Copy the data to the flash.
Remember the "Total Size" and "Start Addr" ? Now we will need them.

Again, depending on were we want to write the data, choose the right one:

for LINUX_FS:
	cp.b "Start Addr" 0xFFC00000 "Total Size"

for HIST:
	cp.b "Start Addr" 0xFFF50000 "Total Size"

for LINUX_CFG:
	cp.b "Start Addr" 0xFFF60000 "Total Size"

for UBOOT: (NEVER TOUCH UBOOT UNLESS YOU KNOW WHAT YOU'RE DOING!!)
	cp.b "Start Addr" 0xFFFC0000 "Total Size"

For flashing my previous 64KB data to "HIST", it would be:
	cp.b 0x00100000 0xFFF50000 0x00010000

It will output:

	Copy to Flash... done

Done! Flush power and check if it works.
As long as you don't flash over the UBOOT, you will able to recover through the bootloader.




###################
BOOTLOADER FLASHING
###################

If you tried erasing or flashing the bootloader, you will see that the its flash region is write-protected.
And it is a very clever idea! any wrong operation could damage it and bricking the device PERMANENTLY!


To remove the flash protection, type:
	protect off all

To enable (RECOMMENDED!!)
	protect on 0xFFFC0000 0xFFFFFFFF

###################
RESTORING THE FULL FLASH
###################

If you can't make it work and want to restore everything, follow this steps:

Download this:
http://www.mediafire.com/?1s07wfzxljcjj1s

In the console:

	loadb 0x00100000 921600 (or 115200 if you don't use a USB serial converter)
	Select the "full_flash file" you downloaded in the kermit trasfer (Send) and
	wait for it to finish.
	
	protect off all

	erase 0xFFC00000 0xFFFFFFFF 
	(After this command, a power loss will cause a permament bricked device)

	cp.b  0x00100000 0xFFC00000 0x400000

	protect on 0xFFFC0000 0xFFFFFFFF

Done!


Reference

Here is source code for the same processor in the N2050, but in a different device.

Included are the U-Boot commands already installed on the N2050:

base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
bootvx  - Boot vxWorks from an ELF image
bubt    - Burn an image on the Boot Flash.
cfgburn - Burn config file into the flash config partition.
cfgls   - list files in the linux cfg directory (default /)
chpart  - change active partition
cmp     - memory compare
cmpm    - Compare Memory
coninfo - print console devices and informations
cp      - memory copy
crc32   - checksum calculation
dcache  - enable or disable data cache
echo    - echo args to console
erase   - erase FLASH memory
flinfo  - print FLASH memory information
fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
g       - start application at cached address 'addr'(default addr 0x40000)
go      - start application at address 'addr'
help    - print online help
icache  - enable or disable instruction cache
iminfo  - print header information for application image
imls    - list all images found in flash
itest    - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loop    - infinite loop on address range
ls      - list files in a directory (default /)
md      - memory display
mm      - memory modify (auto-incrementing)
mtdburn - Burn a JFFS2 mtd image on the flash.
mtest   - simple RAM test
mw      - memory write (fill)
nfs    - boot image via network using NFS protocol
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
tftpboot- boot image via network using TFTP protocol
version - print monitor version
xmodem   - load boot file over serial line and burn it to flash

The following is a few commands and their readout that provide us a good idea of the environment, directories, memory allocation, and various variables.

LXK>> printenv                            
bootargs=console=ttyS0,38400
bootcmd=dcache off; icache off; run standalone_cramfs
bootdelay=0
baudrate=38400
ipaddr=50.1.1.10
serverip=50.1.1.2
rootpath=/tftpboot/rootfs_arm
stdin=serial
stdout=serial
stderr=serial
ethprime=eth0
usbMode=host
default_load_addr=0x00100000
bootargs_root=root=/dev/nfs rw init=/linuxrc
bootargs_end=:::MANHATTAN:eth0:none
image_name=uImage
bootfile=uImage
initrd_name=ramdisk.image.gz
initrd_load_addr=800000
initrd_size=400000
standalone_jffs2=fsload $(default_load_addr) $(image_name);setenv bootargs $(bootargs) $(FlashSizeEnv) $(ubootversion) root=/dev/mtdblock0 rw rootfstype=jffs2 ip=$(ipaddr):$(serverip)$(bootargs_end);bootm $(default_load_addr);
ubootversion=bootv="Tue Apr 10 16:02:10 EDT 2007"
standalone_cramfs=fsload $(default_load_addr) $(image_name);setenv bootargs $(bootargs) $(FlashSizeEnv) $(ubootversion) root=/dev/mtdblock0 ro rootfstype=cramfs ip=$(ipaddr):$(serverip)$(bootargs_end) boot;bootm $(default_load_addr);
standalone_initrd=fsload $(default_load_addr) $(image_name);fsload $(initrd_load_addr) $(initrd_name);setenv bootargs $(bootargs) root=/dev/ram0 rw initrd=0x$(initrd_load_addr),0x$(initrd_size) ip=$(ipaddr):$(serverip)$(bootargs_end); bootm $(default_load_addr);
ethaddr=00:00:00:88:86:38
FlashSizeEnv=flashsize=0x400000
ethact=eth0

Environment size: 1303/65532 bytes

LXK>> fsinfo                                  
### filesystem type is CRAMFS
size: 0x31b000 (3256320)
flags:
        FSID version 2
        sorted dirs
fsid:
        crc: 0x399621a
        edition: 0x0
name:       Compressed
LXK>> bdinfo
arch_number = 0x0000020D
env_t       = 0x00000000
boot_params = 0x00000100
DRAM bank   = 0x00000000
-> start    = 0x00000000
-> size     = 0x01000000
ethaddr     = 00:00:00:88:86:38
ip_addr     = 50.1.1.10
baudrate    = 38400 bps

LXK>> cfgls                             
Scanning JFFS2 FS: . done.
 drwxr-xr-x        0 Tue Apr 04 02:20:13 2006 mblock
 drwxr-xr-x        0 Tue Apr 04 02:20:22 2006 security
 -r--r--r--     1024 Tue Apr 04 02:21:15 2006 mfg_data_p
 drwxr-xr-x        0 Tue Apr 04 02:20:22 2006 nvsettings
 drwxr-xr-x        0 Tue Apr 04 02:20:14 2006 usbdrive_port0
LXK>> coninfo
List of available devices:
serial   80000003 SIO stdin stdout stderr
LXK>> flinfo

Bank # 1: info->size = 0x400000
SPANSION S29GL032A -   Size: 4 MB in 71 Sectors
  Sector Start Addresses:
    FFC00000      FFC02000      FFC04000      FFC06000      FFC08000
    FFC0A000      FFC0C000      FFC0E000      FFC10000      FFC20000
    FFC30000      FFC40000      FFC50000      FFC60000      FFC70000
    FFC80000      FFC90000      FFCA0000      FFCB0000      FFCC0000
    FFCD0000      FFCE0000      FFCF0000      FFD00000      FFD10000
    FFD20000      FFD30000      FFD40000      FFD50000      FFD60000
    FFD70000      FFD80000      FFD90000      FFDA0000      FFDB0000
    FFDC0000      FFDD0000      FFDE0000      FFDF0000      FFE00000
    FFE10000      FFE20000      FFE30000      FFE40000      FFE50000
    FFE60000      FFE70000      FFE80000      FFE90000      FFEA0000
    FFEB0000      FFEC0000      FFED0000      FFEE0000      FFEF0000
    FFF00000      FFF10000      FFF20000      FFF30000      FFF40000
    FFF50000      FFF60000      FFF70000      FFF80000      FFF90000
    FFFA0000      FFFB0000      FFFC0000 (RO) FFFD0000 (RO) FFFE0000 (RO)
    FFFF0000 (RO)
LXK>> ls
 lrwxrwxrwx       23 Build.Info -> /pkg-netapps/Build.Info
 drwxr-sr-x     1632 bin
 drwxr-sr-x      788 dev
 drwxr-sr-x      312 etc
 drwxr-sr-x      652 lib
 lrwxrwxrwx       12 linuxrc -> /bin/busybox
 drwxr-sr-x       20 mnt
 drwxr-sr-x      108 pkg-netapps
 drwxr-sr-x        0 proc
 drwxr-sr-x        0 root
 drwxr-sr-x      368 sbin
 drwxr-sr-x        0 sys
 drwxr-sr-x        0 tmp
 -r--r-----   872416 uImage
 drwxr-sr-x       32 usr
 drwxr-sr-x        0 var
LXK>> version

U-Boot 1.1.1 (Apr 10 2007 - 16:09:11)
Marvell version: 1.1.1.27 Radlan
LXK>>

23:35, 9 June 2012 (UTC)


Contributors

--Sjmoquin 20:40, 10 June 2012 (UTC) Julia Longtin Ken Knapp dabyd64