User Tools

Site Tools


inbox:cisco:cisco_on-100_k9_v01

Cisco ON-100 k9_v01

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

The Cisco ON100 was a device sold for a now discontinued cloud monitoring service, think of it as a hardware version of Nmap wrapped with a silly UI. The cloud service has since been discontinued, but these could be easily repurposed for a neat 2-port router.

Generic Router

OpenWrt support

Not supported.

Experimental firmware

See the notes section below for details of how to compile an experimental firmware image for this device.

Hardware highlights

CPU Ram Flash Network WLAN USB Serial JTag
Marvell 88F6282 512 MiB 512 MiB 2x 1000 none 1x 2.0 Yes Yes

Hardware

Info

Architecture: ARMv5
Vendor: Marvell
Bootloader: U-Boot
System-On-Chip: Marvell 88F6282
CPU/Speed 1600 MHz
Flash-Chip: Hynix HY27UF084G2B
Flash size: 512 MiB
RAM: 512 MiB
Wireless: None
Ethernet: 2x 1 Gbit/s w/ vlan support
USB: 1x 2.0
Serial: Yes
JTAG: Yes

Flash Layout

root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00200000 00020000 "u-boot"
mtd1: 00500000 00020000 "uImage"
mtd2: 1f900000 00020000 "ubi"

dmesg | grep x
[    0.865586] 0x000000000000-0x000000200000 : "u-boot"
[    0.871897] 0x000000200000-0x000000700000 : "uImage"
[    0.877785] 0x000000700000-0x000020000000 : "ubi"

Layer0 Hynix HY27UF084G2B raw 512 MiB NAND Flash
Layer1 mtd0
u-boot
256 KiB
mtd1
uImage
54 KiB
mtd2
ubi/rootfs
64 MiB

Photos

Front Casing

Back Casing

Backside Label

PCB

Opening the case

Opening the case for this device is pretty simple - you have four rubber feet on the bottom fixed in place with adhesive, remove these with a flat bladed screwdriver. Behind each of the four rubber feet is a cross head screw. Remove these screws. You will then likely want to use a spudger to unclip four clips on the case - there are two on each side, approximately an inch from each corner. There are no clips on the front or back, only two on each side.

Serial

port.serial JP1 on board, by front LEDs - J6, another 4-pin connector is immediately above this. You want the bottom one. Facing the LEDs, the pinouts are GND, TXD, RXD, NC. You can verify this if you want by checking GND to some other groundlike object on the board.

How to connect to the Serial Port of this specific device:

Serial connection parameters
for Cisco ON-100 k9_v01
115200, 8N1

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

Bootlogs

OEM bootlog

COPY HERE THE BOOTLOG WITH THE ORIGINAL FIRMWARE


OpenWrt bootlog

__ __ _ _ | \/ | __ _ _ ____ _____| | | | |\/| |/ _` | '__\ \ / / _ \ | | | | | | (_| | | \ V / __/ | | |_| |_|\__,_|_| \_/ \___|_|_| _ _ ____ _ | | | | | __ ) ___ ___ | |_ | | | |___| _ \ / _ \ / _ \| __| | |_| |___| |_) | (_) | (_) | |_ \___/ |____/ \___/ \___/ \__| ** MARVELL BOARD: DB-88F6282A-BP LE U-Boot 1.1.4 (Feb 22 2011 - 14:06:09) Marvell version: 3.5.9 - Cisco Plasma U-Boot code: 00600000 -> 0067FFF0 BSS: -> 006D2340 Soc: 88F6282 A1CPU running @ 1600Mhz L2 running @ 533Mhz SysClock = 400Mhz , TClock = 200Mhz DRAM (DDR3) CAS Latency = 6 tRP = 6 tRAS = 15 tRCD=6 DRAM CS[0] base 0x00000000 size 256MB DRAM CS[1] base 0x10000000 size 256MB DRAM Total size 512MB 16bit width Addresses 8M - 0M are saved for the U-Boot usage. Mem malloc Initialization (8M - 7M): Done NAND:512 MB Flash: 0 kB CPU : Marvell Feroceon (Rev 1) Streaming disabled Write allocate disabled Module 0 is RGMII USB 0: host mode PEX 0: interface detected no Link. PEX 1: interface detected no Link. Net: egiga0 [PRIME], egiga1 Hit any key to stop autoboot: 0 Plasma>> boot NAND read: device 0 offset 0x200000, size 0x200000 Reading data from 0x3ff800 -- 100% complete. 2097152 bytes read: OK ## Booting image at 02000000 ... Image Name: ARM OpenWrt Linux-4.4.14 Created: 2017-02-05 12:06:41 UTC Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1865550 Bytes = 1.8 MB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK OK Starting kernel ... [ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 4.4.14 ([removed]@[removed].ec.aa.net.uk) (gcc version 5.3.0 (OpenWrt GCC 5.3.0 50104) ) #2 Sun May 21 13:00:23 UTC 2017 [ 0.000000] CPU: Feroceon 88FR131 [56251311] revision 1 (ARMv5TE), cr=0005397f [ 0.000000] CPU: VIVT data cache, VIVT instruction cache [ 0.000000] Machine model: Cisco Systems ON-100 [ 0.000000] Memory policy: Data cache writeback [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 130048 [ 0.000000] Kernel command line: console=ttyS0,115200 max_loop=64 mtdparts=nand_mtd:0x200000@0x0(u-boot),0x400000@0x200000(uImage),-@0x700000(data) ubi.mtd=2 root=/dev/mtdblock2 rootfstype=jffs2 rw [ 0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes) [ 0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes) [ 0.000000] Memory: 513968K/524288K available (3810K kernel code, 130K rwdata, 1408K rodata, 164K init, 192K bss, 10320K reserved, 0K cma-reserved) [ 0.000000] Virtual kernel memory layout: [ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB) [ 0.000000] fixmap : 0xffc00000 - 0xfff00000 (3072 kB) [ 0.000000] vmalloc : 0xe0800000 - 0xff800000 ( 496 MB) [ 0.000000] lowmem : 0xc0000000 - 0xe0000000 ( 512 MB) [ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB) [ 0.000000] .text : 0xc0008000 - 0xc0520dc4 (5220 kB) [ 0.000000] .init : 0xc0521000 - 0xc054a000 ( 164 kB) [ 0.000000] .data : 0xc054a000 - 0xc056aba0 ( 131 kB) [ 0.000000] .bss : 0xc056aba0 - 0xc059ae04 ( 193 kB) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:16 nr_irqs:16 16 [ 0.000000] clocksource: orion_clocksource: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns [ 0.000007] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns [ 0.000070] Calibrating delay loop... 1594.16 BogoMIPS (lpj=7970816) [ 0.040060] pid_max: default: 32768 minimum: 301 [ 0.040155] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.040171] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.040627] CPU: Testing write buffer coherency: ok [ 0.040926] Setting up static identity map for 0x81e0 - 0x821c [ 0.041159] mvebu-soc-id: MVEBU SoC ID=0x6282, Rev=0x1 [ 0.044743] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.044864] pinctrl core: initialized pinctrl subsystem [ 0.045784] NET: Registered protocol family 16 [ 0.046134] DMA: preallocated 256 KiB pool for atomic coherent allocations [ 0.046838] cpuidle: using governor ladder [ 0.047137] Feroceon L2: Enabling L2 [ 0.047173] Feroceon L2: Cache support initialised. [ 0.047387] [Firmware Info]: /ocp@f1000000/ethernet-controller@72000/ethernet0-port@0: local-mac-address is not set [ 0.047463] [Firmware Info]: /ocp@f1000000/ethernet-controller@76000/ethernet1-port@0: local-mac-address is not set [ 0.060195] SCSI subsystem initialized [ 0.060459] usbcore: registered new interface driver usbfs [ 0.060518] usbcore: registered new interface driver hub [ 0.060566] usbcore: registered new device driver usb [ 0.061315] clocksource: Switched to clocksource orion_clocksource [ 0.062089] NET: Registered protocol family 2 [ 0.062525] TCP established hash table entries: 4096 (order: 2, 16384 bytes) [ 0.062588] TCP bind hash table entries: 4096 (order: 2, 16384 bytes) [ 0.062647] TCP: Hash tables configured (established 4096 bind 4096) [ 0.062696] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.062718] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.062847] NET: Registered protocol family 1 [ 0.063512] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.074825] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.074842] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.076847] io scheduler noop registered [ 0.076862] io scheduler deadline registered (default) [ 0.077737] kirkwood-pinctrl f1010000.pin-controller: registered pinctrl driver [ 0.078185] irq: Cannot allocate irq_descs @ IRQ34, assuming pre-allocated [ 0.078461] irq: Cannot allocate irq_descs @ IRQ66, assuming pre-allocated [ 0.103000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled [ 0.103807] console [ttyS0] disabled [ 0.103861] f1012000.serial: ttyS0 at MMIO 0xf1012000 (irq = 25, base_baud = 12500000) is a 16550A [ 0.556535] console [ttyS0] enabled [ 0.561218] nand: Could not find valid ONFI parameter page; aborting [ 0.567660] nand: device found, Manufacturer ID: 0xad, Chip ID: 0xdc [ 0.574050] nand: Hynix NAND 512MiB 3,3V 8-bit [ 0.578515] nand: 512 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 [ 0.586126] Scanning device for bad blocks [ 0.642384] Bad eraseblock 869 at 0x000006ca0000 [ 0.710247] Bad eraseblock 1924 at 0x00000f080000 [ 0.754810] Bad eraseblock 2589 at 0x0000143a0000 [ 0.849850] 3 ofpart partitions found on MTD device orion_nand [ 0.855717] Creating 3 MTD partitions on "orion_nand": [ 0.860880] 0x000000000000-0x000000200000 : "u-boot" [ 0.867169] 0x000000200000-0x000000700000 : "uImage" [ 0.873080] 0x000000700000-0x000020000000 : "ubi" [ 0.879789] libphy: orion_mdio_bus: probed [ 0.884766] mv643xx_eth: MV-643xx 10/100/1000 ethernet driver version 1.4 [ 0.893175] mv643xx_eth_port mv643xx_eth_port.0 eth0: port 0 with MAC address 64:00:f1:21:1f:2a [ 0.902766] mv643xx_eth_port mv643xx_eth_port.1 eth1: port 0 with MAC address 64:00:f1:21:1f:2b [ 0.911571] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 0.918126] ehci-pci: EHCI PCI platform driver [ 0.922659] ehci-platform: EHCI generic platform driver [ 0.928019] ehci-orion: EHCI orion driver [ 0.932177] orion-ehci f1050000.ehci: EHCI Host Controller [ 0.937702] orion-ehci f1050000.ehci: new USB bus registered, assigned bus number 1 [ 0.945507] orion-ehci f1050000.ehci: irq 29, io mem 0xf1050000 [ 0.971329] orion-ehci f1050000.ehci: USB 2.0 started, EHCI 1.00 [ 0.977878] hub 1-0:1.0: USB hub found [ 0.981804] hub 1-0:1.0: 1 port detected [ 0.986073] usbcore: registered new interface driver usb-storage [ 1.032748] NET: Registered protocol family 10 [ 1.042217] NET: Registered protocol family 17 [ 1.046722] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this. [ 1.059407] 8021q: 802.1Q VLAN Support v1.8 [ 1.065159] ubi0: attaching mtd2 [ 1.260317] ubi0: scanning is finished [ 1.271888] ubi0: attached mtd2 (name "ubi", size 505 MiB) [ 1.277406] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytes [ 1.284334] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 512 [ 1.291060] ubi0: VID header offset: 512 (aligned 512), data offset: 2048 [ 1.297881] ubi0: good PEBs: 4037, bad PEBs: 3, corrupted PEBs: 0 [ 1.304011] ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128 [ 1.311265] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1070480583 [ 1.320439] ubi0: available PEBs: 0, total reserved PEBs: 4037, PEBs reserved for bad PEB handling: 77 [ 1.330034] hctosys: unable to open rtc device (rtc0) [ 1.336203] ubi0: background thread "ubi_bgt0d" started, PID 834 [ 1.411356] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, PID 837 [ 1.462216] UBIFS (ubi0:0): start fixing up free space [ 1.537110] UBIFS (ubi0:0): free space fixup complete [ 1.572040] UBIFS (ubi0:0): UBIFS: mounted UBI device 0, volume 0, name "rootfs" [ 1.579476] UBIFS (ubi0:0): LEB size: 129024 bytes (126 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 1.589461] UBIFS (ubi0:0): FS size: 508999680 bytes (485 MiB, 3945 LEBs), journal size 9033728 bytes (8 MiB, 71 LEBs) [ 1.600213] UBIFS (ubi0:0): reserved for root: 0 bytes (0 KiB) [ 1.606084] UBIFS (ubi0:0): media format: w4/r0 (latest is w4/r0), UUID 7FCB5CC6-3D5F-4048-83F6-9AD59868BF28, small LPT model [ 1.662736] VFS: Mounted root (ubifs filesystem) on device 0:11. [ 1.669336] Freeing unused kernel memory: 164K (c0521000 - c054a000) [ 1.842725] init: Console is alive [ 2.035382] sata_mv f1080000.sata: slots 32 ports 1 [ 2.051639] scsi host0: sata_mv [ 2.055019] ata1: SATA max UDMA/133 irq 32 [ 2.401338] ata1: SATA link down (SStatus 0 SControl F300) [ 2.418614] init: - preinit - Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 5.647803] mount_root: mounting /dev/root [ 5.669408] procd: - early - [ 6.546420] procd: - ubus - [ 6.600536] random: ubusd urandom read with 12 bits of entropy available [ 6.623532] procd: - init - Please press Enter to activate this console. [ 7.634721] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 7.656304] i2c /dev entries driver [ 7.673357] Loading modules backported from Linux version wt-2016-05-12-0-g7a54796 [ 7.680962] Backport generated by backports.git backports-20160216-0-ge3c56e4 [ 7.713066] ip_tables: (C) 2000-2006 Netfilter Core Team [ 7.733669] lib80211: common routines for IEEE802.11 drivers [ 7.751056] nf_conntrack version 0.5.0 (8033 buckets, 32132 max) BusyBox v1.24.2 () built-in shell (ash) _______ ________ __[ 7.812527] xt_time: kernel timezone is -0000 | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- DESIGNATED DRIVER (Bleeding Edge, 50104) ----------------------------------------------------- * 2 oz. Orange Juice Combine all juices in a * 2 oz. Pineapple Juice tall glass filled with * 2 oz. Grapefruit Juice ice, stir well. * 2 oz. Cranberry Juice ----------------------------------------------------- root@(none):/# [ 7.923759] libertas_sdio: Libertas SDIO driver [ 7.928313] libertas_sdio: Copyright Pierre Ossman [ 7.956619] PPP generic driver version 2.4.2 [ 7.972109] NET: Registered protocol family 24 [ 11.422325] mv643xx_eth_port mv643xx_eth_port.0 eth0: link up, 1000 Mb/s, full duplex, flow control disabled [ 11.432232] mv643xx_eth_port mv643xx_eth_port.0 eth0: link down [ 11.472807] device eth0 entered promiscuous mode [ 11.482013] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 14.542372] mv643xx_eth_port mv643xx_eth_port.0 eth0: link up, 1000 Mb/s, full duplex, flow control disabled [ 14.552813] br-lan: port 1(eth0) entered forwarding state [ 14.558262] br-lan: port 1(eth0) entered forwarding state [ 14.581341] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready [ 16.551325] br-lan: port 1(eth0) entered forwarding state [ 73.121340] random: nonblocking pool is initialized


Notes

It appears to be possible to boot OpenWrt on the Cisco ON-100. A modified device profile is available on GitHub which enables an image to be quickly built for this device.

GPIO Mappings

GPIO on this thing seems very sulky, still figuring this out. Touching the wrong GPIO seems to cause it to hang execution.

GPIO Function Direction Polarity
3 Sets flash chip readonly Any Active High
9 Stops CPU execution… Any Active High
10 Stops CPU execution… Any Active High
11 Stops CPU execution… Any Active High
41 Reset button Input Active High
44 Status LED 1 - Green Output Active Low
45 Status LED 1 - Red Output Active Low
46 Status LED 2 - Green Output Active Low
47 Status LED 2 - Red Output Active Low

Building Cisco ON100 image

A pull request has been submitted to GitHub, it's not in trunk yet but you can get the source to build an image for this device as follows.

mkdir openwrt-ciscoon100; cd openwrt-ciscoon100; git init
git remote add origin https://github.com/openwrt/openwrt.git
git fetch --no-tags origin +refs/pull/476/merge:
git checkout -qf FETCH_HEAD
export FORCE_UNSAFE_CONFIGURE=1
make defconfig

You can now proceed to make menuconfig, select the Cisco Systems ON100 target, and once saved, issue make to make your images. You final images will be in /bin/kirkwood/, and you will want the openwrt-kirkwood-ciscoon100-uImage and openwrt-kirkwood-ciscoon100-rootfs.ubi images to put on your tftp server for flashing.

U-Boot installation

This step is optional - the units already ship with U-Boot. Power on the unit, and wait for the boot interrupt prompt - hit any key here and you should be into the U-Boot bootloader.

tftpboot ${loadaddr} u-boot-db88f6282bp_400ddr3db_nand.bin ; nand erase 0x000000 0xa0000 ; nand write ${loadaddr} 0x00000 0xa0000

If u-boot has been replaced or the environment variables cleared somehow, you will need to write your MAC addresses back with the following (use your MACs as per the label on your device, instead of the example)

setenv ethaddr 64:00:F1:00:00:00
setenv eth1addr 64:00:F1:00:00:01
saveenv

Get Networking in U-Boot

I guess this bit is kind of important. I had a DHCP server on my network, advertising DHCP Options 66 and 150 to point at a TFTP server's IP address. This was where I then uploaded my images. The port marked LAN is your first ethernet port, I used this during installation. The port marked MON is your second interface. To get DHCP IP and TFTP from network, in U-Boot prompt, enter:

dhcp

You should see output similar (but not the same) as below:

Plasma>> dhcp
BOOTP broadcast 1
DHCP client bound to address 10.100.100.151

You can also try issuing the tftp command - this will fail as the file will not be there, but this can verify you are talking to TFTP:

Plasma>> tftp
*** Warning: no boot file name; using '0A646497.img'
Using egiga0 device
TFTP from server 10.73.1.1; our IP address is 10.100.100.151
Filename '0A646497.img'.
Load address: 0x2000000
Loading: *
TFTP error: 'File not found' (1)
Starting again

Plasma>>

Program OpenWrt to flash

In U-Boot prompt, enter:

tftpboot ${loadaddr} openwrt-kirkwood-ciscoon100-uImage ; nand erase 0x200000 0x600000 ; nand write ${loadaddr} 0x200000 0x600000
nand erase 0x700000 0x1f900000
tftpboot ${loadaddr} openwrt-kirkwood-ciscoon100-rootfs.ubi ; nand erase 0x700000 ${filesize} ; nand write ${loadaddr} 0x700000 ${filesize}

Setup U-Boot variables

Still in your U-Boot prompt, enter

setenv owrt_bootargs_root ubi.mtd=2 root=/dev/mtdblock2 rootfstype=jffs2 rw
setenv owrt_mtdparts mtdparts=nand_mtd:0x200000@0x0(u-boot),0x400000@0x200000(uImage),-@0x700000(data)
setenv owrt_boot nand read.e \${loadaddr} 0x200000 0x200000 \; setenv bootargs \$(console) \$(owrt_mtdparts) \${owrt_bootargs_root} \; bootm \${loadaddr}
setenv bootcmd run owrt_boot
saveenv

When you're ready, enter boot, and your image will boot.

Tags

inbox/cisco/cisco_on-100_k9_v01.txt · Last modified: 2017/06/18 11:23 by tmomas