Amtec (ElsagDatamag) Argo 55/95 – Take 2: Serial access —
In the previous post, we saw that the board sports three interesting headers (in red):
But what are they for? Well, this is what I found using a logic probe:
1. UART
Vcc NC GND RxD TxD
o o o o o
+3,3 0 0 +2,9 +3,2
2. JTAG
Vcc
o o o o o o o
o o o o o o o
Vcc GND GND GND GND GND
(Probable pinout: http://www.jtagtest.com/pinouts/ejtag)
3. ?
+3,3 0 +2,9 +3,2 +3,2 0
o o o o o o
Vcc GND TxD?
I have absolutely no idea of what the port 3 is: there is activity on pin 5, but it isn’t a serial port. Port 1 is what we were looking for: we can connect using a RS232 – TTL adapter and a terminal emulator (115000 baud, 8 bits, no parity, 1 stop bit), and… voilà! The bootlog!
Reading the bootlog, we learn some useful things: the box runs OpenRG, and the bootloader is U-Boot – and is freely accessible!
These are the available commands:
=> help
? – alias for ‘help’
askenv – get environment variables from stdin
autoscr – run script from memory
base – print or set address offset
bdinfo – print Board Info structure
boot – boot default, i.e., run ‘bootcmd’
boot_openrg – boot Openrg active image
bootd – boot default, i.e., run ‘bootcmd’
bootm – boot application image from memory
bootp – boot image via network using BOOTP/TFTP protocol
cmp – memory compare
coninfo – print console devices and information
cp – memory copy
crc32 – checksum calculation
dhcp – boot image via network using DHCP/TFTP protocol
echo – echo args to console
erase – erase FLASH memory
flayout – print FLASH layout and sections
flinfo – print FLASH memory information
get_openrg_active – print info about Openrg images in flash and indicate what is
the active
go – start application at address ‘addr’
gpio – GPIO management commands
help – print online help
iminfo – print header information for application image
imls – list all images found in flash
imxtract- extract a part of a multi-image
itest – return true/false on integer compare
led – LED management commands
loadb – load binary file over serial line (kermit mode)
loads – load S-Record file over serial line
loady – load binary file over serial line (ymodem mode)
loop – infinite loop on address range
md – memory display
mii – MII utility commands
mm – memory modify (auto-incrementing)
mtest – simple RAM test
mw – memory write (fill)
nfs – boot image via network using NFS protocol
nm – memory modify (constant address)
pci – list and access PCI Configuration Space
ping – send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect – enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset – Perform RESET of the CPU
run – run commands in an environment variable
saveenv – save environment variables to persistent storage
setenv – set environment variables
sleep – delay execution for some time
tftpboot- boot image via network using TFTP protocol
update_openrg – update openrg writing inactive image section
update_openrg_factory – update openrg factory settings
version – print monitor version
Wow, seems a lot of fun, right? :)
Categorised as: Hacking
[…] A serial port connection to the Argo – A tftp server (i.e. tftp32) – openrg_1_n.img and […]
Hi.
Great work, thank you.
Were are working to port Open-wrt on Lbv2 and Argo u-boot is perfect for us, Sagem u-boot is not usefull.
But we need some registers, cand you provide us, we have ethernet but only RX no TX.
Can you share this commands?
gpio dump
mii dump (all mii dumps please)
http://foro.seguridadwireless.net/livebox-2/u-boot-argo-funcionando-en-lbv2/
Oh… OpenWRT working on these platforms would be great! I’ll follow your work :)
Here are the dumps:
gpio dump
mii dump 0 [0-5]
mii dump 1 [0-5]
mii dump 2 [0-5]
mii dump 3 [0-5]
mii dump 4 [0-5]
mii dump 5 [0-5]
Hope you’ll find these useful. Let me know if you need something else.
Hi bano, thank you for those registers.
But we need a little more, we need all registers because ethernet with those registers is not avalaible.
Yo can see all your PHY directions with this command:
http://pastebin.com/spf1mbYj
And then you can read all PHY registers together with only one line command, look at this:
http://pastebin.com/sBeakkMN
Thank you very much bano, your help is very apreciated.
I hope I’ve understood correctly what you need :)
mii info
mii read 0x0-0x1f 0x0-0x5
Let me know if you need some other register than 0-5.
mii info doesn’t make much sense
PHY 0x10: OUI = 0x010E, Model = 0x02, Rev = 0x00, 100baseT, FDX, Up
At which port did you connected the ethernet cable when you made “mii info” ?
The command has been run via serial port, of course. I’ve to check, but I’m pretty sure that there were two ports connected, both on vboxEmac1 (the switch).
Also the fiber cable was connected – but that’s connected to another phy, I suppose.
Can you please elaborate on what’s wrong with that output?
Hi bano, when you issue the command “mii info” the returned phys marked as Up means they are connected to external hardware either via ethernet cable or in your case fiber cable. I suppose you had 2 ethernet cables connected but the external hardware is down, if this isn’t the case you won’t able to ping the router or from inside the router to the external hardware, do you?.
The first 5 PHYs detected are supposed to be ethernet (0x5043). BTW they seem to be down but internally by the switch itself.
As you wrote, was the switch itself down, or better, was the interface marked voxEmac1 (from what I saw, only the interface voxEmac0 is up during uboot, by default).
I can try to put all the interfaces up an reissue the command, if you need it… But I think I haven’t understood yet what’s wrong with the output of mii info :)
Hi,
I want to unlock my argo95 but I don’t have the db9 port on my pc; I found some serial to ttl adapters and usb to ttl adapters, but I want to try to connect my pc to the HAG using one of this:
http://www.ebay.it/itm/Wireless-Bluetooth-Ricevitore-Modulo-RS232-TTL-Antenna-/310402788795?pt=Wireless_Networking_WiFi&hash=item484572adbb#ht_2859wt_1396
Do you think it could be possible? It could be really good because in this case if something goes wrong during the use of the router, you can restore it without open it all the times…
Uhm… I suppose it could be handy. Actually, it should work (even if I’m not able to see where are the solder pads for the ttl signals…).
But honestly, I’d try to find more details about the items (eg. a manual), prior to buy it.
ok, I built a serial cable using a CA-42 from nokia :) it works!
[…] Amtec (ElsagDatamag) Argo 55/95 – Take 2: Serial access – The LabJan 16, 2012 … Argo 95 headers (Click to enlarge). But what are they for? … o o o o o +3,3 0 0 +2, 9 +3,2. 2. JTAG Vcc o o o o o o o. o o o o o o o. Vcc GND GND … […]
free sex…
Keep up the excellent piece of work, I read few posts on this web site and I conceive that your weblog is really interesting and has sets of excellent information….
Please, someone could put a link to the RS232 ttl adapter to buy for the connection to the modem?
Hi!
Someting like this should be fine.
I have bought this:
http://www.amazon.it/gp/product/B00K67X3KG?psc=1&redirect=true&ref_=oh_aui_detailpage_o00_s00
is it ok?
Yep, that should be fine.
thx, can I use putty from Linux to access the modem?
Sure: you can use whatever serial terminal emulation software you like.
Personally I use minicom.
Is it possible to install OpenWrt in this modem?
No porting has been done, as far as I know, so you’re on your own.
There was somehone here stating that a porting was under working, IIRC, but I never found any further information about it.