The Lab

Retrocomputing, tinkering and some other stuff that steals my time.

Amtec (ElsagDatamag) Argo 55/95 – Take 2: Serial access —

In the previous post, we saw that the board sports three interesting headers (in red):

Argo 95 headers

Argo 95 headers (Click to enlarge)

But what are they for? Well, this is what I found using a logic probe:

1. UART
Vcc   NC    GND   RxD   TxD
o     o     o     o     o
+3,3   0     0    +2,9  +3,2

2. JTAG
Vcc
o     o     o     o     o     o     o

o     o     o     o     o     o     o
Vcc         GND   GND   GND   GND   GND
(Probable pinout: http://www.jtagtest.com/pinouts/ejtag)

3. ?
+3,3   0    +2,9  +3,2  +3,2   0
o     o     o     o     o     o
Vcc   GND               TxD?

I have absolutely no idea of what the port 3 is: there is activity on pin 5, but it isn’t a serial port. Port 1 is what we were looking for: we can connect using a RS232 – TTL adapter and a terminal emulator (115000 baud, 8 bits, no parity, 1 stop bit), and… voilà! The bootlog!

Reading the bootlog, we  learn some useful things: the box runs OpenRG, and the bootloader is U-Boot – and is freely accessible!

These are the available commands:

=> help
? – alias for ‘help’
askenv – get environment variables from stdin
autoscr – run script from memory
base – print or set address offset
bdinfo – print Board Info structure
boot – boot default, i.e., run ‘bootcmd’
boot_openrg – boot Openrg active image
bootd – boot default, i.e., run ‘bootcmd’
bootm – boot application image from memory
bootp – boot image via network using BOOTP/TFTP protocol
cmp – memory compare
coninfo – print console devices and information
cp – memory copy
crc32 – checksum calculation
dhcp – boot image via network using DHCP/TFTP protocol
echo – echo args to console
erase – erase FLASH memory
flayout – print FLASH layout and sections
flinfo – print FLASH memory information
get_openrg_active – print info about Openrg images in flash and indicate what is
the active
go – start application at address ‘addr’
gpio – GPIO management commands
help – print online help
iminfo – print header information for application image
imls – list all images found in flash
imxtract- extract a part of a multi-image
itest – return true/false on integer compare
led – LED management commands
loadb – load binary file over serial line (kermit mode)
loads – load S-Record file over serial line
loady – load binary file over serial line (ymodem mode)
loop – infinite loop on address range
md – memory display
mii – MII utility commands
mm – memory modify (auto-incrementing)
mtest – simple RAM test
mw – memory write (fill)
nfs – boot image via network using NFS protocol
nm – memory modify (constant address)
pci – list and access PCI Configuration Space
ping – send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect – enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset – Perform RESET of the CPU
run – run commands in an environment variable
saveenv – save environment variables to persistent storage
setenv – set environment variables
sleep – delay execution for some time
tftpboot- boot image via network using TFTP protocol
update_openrg – update openrg writing inactive image section
update_openrg_factory – update openrg factory settings
version – print monitor version

Wow, seems a lot of fun, right? :)

 


Categorised as: Hacking


22 Comments

  1. sERASEr says:

    Hi.

    Great work, thank you.

    Were are working to port Open-wrt on Lbv2 and Argo u-boot is perfect for us, Sagem u-boot is not usefull.

    But we need some registers, cand you provide us, we have ethernet but only RX no TX.

    Can you share this commands?

    gpio dump

    mii dump (all mii dumps please)

    http://foro.seguridadwireless.net/livebox-2/u-boot-argo-funcionando-en-lbv2/

    • bano says:

      Oh… OpenWRT working on these platforms would be great! I’ll follow your work :)
      Here are the dumps:
      gpio dump
      mii dump 0 [0-5]
      mii dump 1 [0-5]
      mii dump 2 [0-5]
      mii dump 3 [0-5]
      mii dump 4 [0-5]
      mii dump 5 [0-5]

      Hope you’ll find these useful. Let me know if you need something else.

      • sERASEr says:

        Hi bano, thank you for those registers.

        But we need a little more, we need all registers because ethernet with those registers is not avalaible.

        Yo can see all your PHY directions with this command:

        http://pastebin.com/spf1mbYj

        And then you can read all PHY registers together with only one line command, look at this:

        http://pastebin.com/sBeakkMN

        Thank you very much bano, your help is very apreciated.

        • bano says:

          I hope I’ve understood correctly what you need :)
          mii info
          mii read 0x0-0x1f 0x0-0x5

          Let me know if you need some other register than 0-5.

          • daniel says:

            mii info doesn’t make much sense

            PHY 0x10: OUI = 0x010E, Model = 0x02, Rev = 0x00, 100baseT, FDX, Up

            At which port did you connected the ethernet cable when you made “mii info” ?

          • bano says:

            The command has been run via serial port, of course. I’ve to check, but I’m pretty sure that there were two ports connected, both on vboxEmac1 (the switch).
            Also the fiber cable was connected – but that’s connected to another phy, I suppose.
            Can you please elaborate on what’s wrong with that output?

          • daniel says:

            Hi bano, when you issue the command “mii info” the returned phys marked as Up means they are connected to external hardware either via ethernet cable or in your case fiber cable. I suppose you had 2 ethernet cables connected but the external hardware is down, if this isn’t the case you won’t able to ping the router or from inside the router to the external hardware, do you?.

            The first 5 PHYs detected are supposed to be ethernet (0x5043). BTW they seem to be down but internally by the switch itself.

          • bano says:

            As you wrote, was the switch itself down, or better, was the interface marked voxEmac1 (from what I saw, only the interface voxEmac0 is up during uboot, by default).
            I can try to put all the interfaces up an reissue the command, if you need it… But I think I haven’t understood yet what’s wrong with the output of mii info :)

  2. paolone919191 says:

    Hi,

    I want to unlock my argo95 but I don’t have the db9 port on my pc; I found some serial to ttl adapters and usb to ttl adapters, but I want to try to connect my pc to the HAG using one of this:

    http://www.ebay.it/itm/Wireless-Bluetooth-Ricevitore-Modulo-RS232-TTL-Antenna-/310402788795?pt=Wireless_Networking_WiFi&hash=item484572adbb#ht_2859wt_1396

    Do you think it could be possible? It could be really good because in this case if something goes wrong during the use of the router, you can restore it without open it all the times…

    • bano says:

      Uhm… I suppose it could be handy. Actually, it should work (even if I’m not able to see where are the solder pads for the ttl signals…).
      But honestly, I’d try to find more details about the items (eg. a manual), prior to buy it.

  3. […] Amtec (ElsagDatamag) Argo 55/95 – Take 2: Serial access – The LabJan 16, 2012 … Argo 95 headers (Click to enlarge). But what are they for? … o o o o o +3,3 0 0 +2, 9 +3,2. 2. JTAG Vcc o o o o o o o. o o o o o o o. Vcc GND GND … […]

  4. free sex says:

    free sex…

    Keep up the excellent piece of work, I read few posts on this web site and I conceive that your weblog is really interesting and has sets of excellent information….

  5. nglpx1 says:

    Please, someone could put a link to the RS232 ttl adapter to buy for the connection to the modem?

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.