Watchguard XTM 5 Series
-
Ok using PBIs is not the way to go. The old package system has been replaced with pkgng. See:
https://forum.pfsense.org/index.php?topic=77166.0
It's easy enough to install flashrom but it takes a long time in Nano while it updates the package list.[2.2-ALPHA][root@pfsense.localdomain]/root(3): pkg The package management tool is not yet installed on your system. Do you want to fetch and install it now? [y/N]: y Bootstrapping pkg from pkg+http://pkg.FreeBSD.org/freebsd:10:x86:32/latest, please wait... Verifying signature with trusted certificate pkg.freebsd.org.2013102301... done Installing pkg-1.2.7_2... done If you are upgrading from the old package format, first run: # pkg2ng Usage: pkg [-v] [-d] [-l] [-N] [-j <jail name="" or="" id="">|-c <chroot path="">] [-C <configuration file="">] [-R <repo config="" dir="">] <command></command> [<args>] Global options supported: -d Increment debug level -j Execute pkg(8) inside a jail(8) -c Execute pkg(8) inside a chroot(8) -C Use the specified configuration file -R Directory to search for individual repository configurations -l List available commands and exit -v Display pkg(8) version -N Test if pkg(8) is activated and avoid auto-activation Commands supported: add Registers a package and installs it on the system annotate Add, modify or delete tag-value style annotations on packages audit Reports vulnerable packages autoremove Removes orphan packages backup Backs-up and restores the local package database check Checks for missing dependencies and database consistency clean Cleans old packages from the cache config Display the value of the configuration options convert Convert database from/to pkgng create Creates software package distributions delete Deletes packages from the database and the system fetch Fetches packages from a remote repository help Displays help information info Displays information about installed packages install Installs packages from remote package repositories lock Locks package against modifications or deletion plugins Manages plugins and displays information about plugins query Queries information about installed packages register Registers a package into the local database remove Deletes packages from the database and the system repo Creates a package repository catalogue rquery Queries information in repository catalogues search Performs a search of package repository catalogues set Modifies information about packages in the local database ssh ssh packages to be used via ssh shell Opens a debug shell shlib Displays which packages link against a specific shared library stats Displays package database statistics unlock Unlocks a package, allowing modification or deletion update Updates package repository catalogues updating Displays UPDATING information for a package upgrade Performs upgrades of packaged software distributions version Displays the versions of installed packages which Displays which package installed a specific file Commands provided by plugins: For more information on the different commands see 'pkg help <command></command>'. [2.2-ALPHA][root@pfsense.localdomain]/root(4): pkg add flashrom pkg: flashrom: No such file or directory pkg: Was 'pkg install flashrom' meant? Failed to install the following 1 package(s): flashrom [2.2-ALPHA][root@pfsense.localdomain]/root(5): pkg install flashrom Updating repository catalogue digests.txz 100% 1070KB 1.0MB/s 1.0MB/s 00:01 packagesite.txz 100% 4908KB 2.4MB/s 1.4MB/s 00:02 Incremental update completed, 22923 packages processed: 0 packages updated, 0 removed and 22923 added. The following 5 packages will be installed: Installing dmidecode: 2.12 Installing pciids: 20140502 Installing libftdi: 0.20_1 Installing libpci: 3.2.1 Installing flashrom: 0.9.7_1 The installation will require 3 MB more space 612 KB to be downloaded Proceed with installing packages [y/N]: y dmidecode-2.12.txz 100% 60KB 59.9KB/s 59.9KB/s 00:00 pciids-20140502.txz 100% 180KB 180.1KB/s 180.1KB/s 00:00 libftdi-0.20_1.txz 100% 41KB 41.3KB/s 41.3KB/s 00:00 libpci-3.2.1.txz 100% 44KB 43.9KB/s 43.9KB/s 00:00 flashrom-0.9.7_1.txz 100% 287KB 286.9KB/s 286.9KB/s 00:00 Checking integrity... done [1/5] Installing dmidecode-2.12... done [2/5] Installing pciids-20140502... done [3/5] Installing libftdi-0.20_1... done [4/5] Installing libpci-3.2.1... done [5/5] Installing flashrom-0.9.7_1... done [2.2-ALPHA][root@pfsense.localdomain]/root(6): flashrom flashrom: Command not found. [2.2-ALPHA][root@pfsense.localdomain]/root(7): rehash [2.2-ALPHA][root@pfsense.localdomain]/root(8): flashrom flashrom v0.9.7-r1711 on FreeBSD 10.0-STABLE (i386) flashrom is free software, get the source code at http://www.flashrom.org Please select a programmer with the --programmer parameter. Previously this was not necessary because there was a default set. To choose the mainboard of this computer use 'internal'. Valid choices are: internal, dummy, nic3com, nicrealtek, gfxnvidia, drkaiser, satasii, ft2232_spi, serprog, rayer_spi, pony_spi, nicintel, nicintel_spi, ogp_spi, satamv, usbblaster_spi. [2.2-ALPHA][root@pfsense.localdomain]/root(9): flashrom -p internal flashrom v0.9.7-r1711 on FreeBSD 10.0-STABLE (i386) flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OK. Found chipset "Intel ICH7/ICH7R". Enabling flash write... OK. Found Micron/Numonyx/ST flash chip "M25P80" (1024 kB, SPI) at physical address 0xfff00000. No operations were specified.</args></repo></configuration></chroot></jail>John, did you try to access the BIOS rom before you changed the CPU? IT's about the only thing your system has different to anyone else's.
Also it's not necessary to change the BIOS anyway. ;)Steve
-
I think I did, but I can't remember. I'll try putting the Celeron back in tomorrow.
-
It works fine with my Core2duo in there. Maybe the Quad core shifts some I/O resources or similar. :-\
Steve
-
It works fine with my Core2duo in there. Maybe the Quad core shifts some I/O resources or similar. :-\
Steve
Just tried again with the original CPU and RAM and still getting this:
[2.1.3-RELEASE][root@pfSense.gorgarath.net]/root(2): /etc/rc.conf_mount_rw [2.1.3-RELEASE][root@pfSense.gorgarath.net]/root(3): flashrom -r og-bios.rom flashrom v0.9.5.2-r1515 on FreeBSD 8.3-RELEASE-p16 (i386), built with libpci 3.1.9, GCC 4.2.1 20070719 [FreeBSD], little endian flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OK. Found chipset "Intel ICH7/ICH7R". Enabling flash write... OK. No EEPROM/flash device found. Note: flashrom can never write if the flash chip isn't found automatically.On bootup, the console shows this: "MB-7580 Ver.WC0 02/03/2010". Does that match what yours shows?
-
Yep:
AMIBIOS(C)2006 American Megatrends, Inc. MB-7580 Ver.WC0 02/03/2010 Unlocked V1.8 SW CPU : Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz Speed : 2.20 GHz Press DEL to run Setup (F4 on Remote Keyboard) Press n if you want to boot from the network Press F11 for BBS POPUP (F3 on Remote Keyboard) The MCH is operating with DDR2 800 DRAM Timing: Tcl:6/Tras:18/Trp:6/Trcd:6/Twr:6/Trfc:52/Twtr:3/Trrd:3/Trtp:3 Initializing USB Controllers .. Done.Except of course I have modified the boot message. ;)
Say for some reason the I/O addess of your chip has been shifted, that might mean that accessing it via the SPI header would work. Seems more likely it's a new IC variant that flashrom doesn't recognise though.
Steve
-
Say for some reason the I/O addess of your chip has been shifted, that might mean that accessing it via the SPI header would work. Seems more likely it's a new IC variant that flashrom doesn't recognise though.
Steve
So, any luck getting FreeDOS to boot on the XTM5? lol I know it is working fine without unlocking the BIOS, but not being able to is really annoying and I'd prefer having full access to the hardware.
-
Nope. Just tried several images on several CF cards. I'm sure it worked fine when I first tried it. Hmm… :-\
Steve
-
Nope. Just tried several images on several CF cards. I'm sure it worked fine when I first tried it. Hmm… :-\
Steve
I've never tried using DOS (FreeDOS or otherwise) over a serial console, so I'm not even sure where to start in trying to get it to work. My searches on Google aren't giving much insight either. This is pretty standard x86 hardware, so it should work just fine, at least for the purposes of flashing the BIOS in DOS, but I've not had luck either, though I'm not sure I'm doing it right. Maybe I should try with a hard drive instead of CF card and see if I have better luck. If I format the drive to boot FreeDOS, I should be able to copy the files from the image over and have it work just fine. Assuming the box will boot it.
Is my Cisco console cable going to work for this or will I need some sort of other null modem cable? Your image IIRC beeps when it finishes booting to the command prompt, so at the least, I should be able to get to that. If I can, I can probably script the autoexec to launch the utility to backup the BIOS and then reprogram the BIOS without having to actually have a working console. A bit risky doing low level stuff like that without any visual confirmation of what's going on, especially since it seems mine is different in that it won't flash from flashrom. Maybe I'll just have it backup the BIOS and then take a look at that BIOS file to see if it's different in any other ways. If I can get a backup of my BIOS, would you be willing to take a look at the resulting file? From what it looks like, it should be identical, but better safe than sorry. Or if you could point me to where to get the files for modifying it myself, I could take a look myself. Been a long time since I've tinkered with something like this. Was able to hot flash a BIOS chip last time I messed around with a BIOS so if I got it wrong, I could easily reprogram the BIOS back to default using another BIOS chip to boot it up. Wish I had the option on this board, would be a bit more comfortable.
-
So the thing to know about the FreeDOS serial console is that it can only use hardware flow-control, it needs the additional wiring in the serial cable to work. In the X-e firebox that was true of the BIOS serial re-direct code but that was an older Award BIOS.
https://doc.pfsense.org/index.php/PfSense_on_Watchguard_Firebox#Not_All_Null_Modem_Cables_are_Created_Equal.21
It's possible the RJ45 console cable doesn't support hardware flow control which would explain why we aren't seeing anything. One possibility in that case would be to use the internal serial header for com2 with 9-pin socket and known cable.Running it blind is a possibility. A user in the X-e thread did that when they could find a cable that worked. I think they edited the autoexec.bat file to put in more beeps to know what stage it's at.
Steve
-
So the thing to know about the FreeDOS serial console is that it can only use hardware flow-control, it needs the additional wiring in the serial cable to work. In the X-e firebox that was true of the BIOS serial re-direct code but that was an older Award BIOS.
https://doc.pfsense.org/index.php/PfSense_on_Watchguard_Firebox#Not_All_Null_Modem_Cables_are_Created_Equal.21
It's possible the RJ45 console cable doesn't support hardware flow control which would explain why we aren't seeing anything. One possibility in that case would be to use the internal serial header for com2 with 9-pin socket and known cable.Running it blind is a possibility. A user in the X-e thread did that when they could find a cable that worked. I think they edited the autoexec.bat file to put in more beeps to know what stage it's at.
Steve
I got a little further with this. While I was unable to get it to boot off the CF card, with the hard drive, I get to the point where the Watchguard will beep when it switches to the console. However, it doesn't get any further than that. I'm messing around with some RJ45 to serial adaptors, but I think I'm going to need to wire a special Cat5 connector for it to work. I forgot about the internal COM2 port… I think I might try that instead as I should have a serial port connected to a pin block laying around here somewhere. Think it would be easier than trying to figure out how the RJ45 port is wired to figure out what to connect to it.
EDIT>>
What settings in PuTTY are the required settings for hardware flow control? I can hook it up to an XP machine if needed and use hyperterm with it's hardware setting, but I prefer PuTTY/KiTTY over hyperterm if possible. XON/XOFF, RTS/CTS, and DSR/DTR are the flow control options, and XON/XOFF I believe is software and not hardware, so RTS/CTS or DSR/DTR are my options and I can try with both, but if you can let me know which is correct, it'll speed up the process. :)EDIT2>>
OK, I'm assuming J13 is the serial port, however, for whatever reason, HP used 16 pin header blocks for their serial port B on the desktops I have in storage, so that's obviously not going to fit the 10 pin header block on this board. Unless that's USB and I might be able to get some sort of USB->serial adapter working in FreeDOS. (I do have USB ports on PCB designed to be used straight off of headers for internal USB connections.) Or if any of the pins not in blocks are for serial, I could try this as only 9 of these pins are actually connected, hopefully all in a row. (I tried looking for a manual or diagram for this motherboard and wasn't able to find one, so I'm not sure what any of the pinouts are for.) -
That's a good question. I'm using Putty in Xubuntu but when I was first investigating the XTM5 I was using WinXP. The Linux version doesn't appear to offer DSR/DTR so maybe I used that. :-\
The manual for the FW-7581 also lists the com2 header J13, see pic.
Steve
-
That's a good question. I'm using Putty in Xubuntu but when I was first investigating the XTM5 I was using WinXP. The Linux version doesn't appear to offer DSR/DTR so maybe I used that. :-\
The manual for the FW-7581 also lists the com2 header J13, see pic.
Steve
Where are you finding the manual at? I tried searching their site but was only finding brochures and a data sheet that didn't include motherboard layout or anything.
I'm going to dig through my stuff in the basement for a serial port with cable. Maybe take the one off my PIX hack job running pfSense on an upgraded P4, but I think that motherboard was from one of those HP machines as well. I have a feeling though, that if I have one still, which I most likely don't anymore, it'll be at my parents' house. Most of my old stuff that I had at their house has been tossed over time though.
I'll let you know what I find, though I'm wondering if it would just be easier to automatically do it via the autoexec.
-
Is my Cisco console cable going to work for this?
I used mine without issue. And pretty much left Putty as is with the exception that I set it for 115200 for the baud rate.
-
-
For a short time Lanner had a forum up that was frequented by staff with access to all manner of useful stuff. You could ask them and, mostly, they would put it up for you. I got a few manuals and bios updates that way. It's gone now. :'(
I thought I had the proper FW-7580 manual but I can't find it now. The problem with working at several computers! ::)
I'll put it up somewhere an send you a link.Steve
-
Hey guys,
I have some exciting news! After some research, I tried an experiment.
I have successfully achieved a Watchguard XTM 505 running a Quad Core Xeon L5420 CPU on pfSense!
The LGA 771 to 775 pin mod works! See: http://www.delidded.com/lga-771-to-775-adapter/
I bought this: http://www.ebay.com/itm/291073902038
You need to be very careful putting the sticker onto the CPU, and then ultra careful cutting the tabs off the motherboard. I did this with a Stanley knife.
Cheers,
Scott McNaught
http://www.synergy8.com/ -
Ooo, ambitious! :D
Nice work. 50W TDP, do you have any actaul power consumption figues?Steve
-
For a short time Lanner had a forum up that was frequented by staff with access to all manner of useful stuff. You could ask them and, mostly, they would put it up for you. I got a few manuals and bios updates that way. It's gone now. :'(
I thought I had the proper FW-7580 manual but I can't find it now. The problem with working at several computers! ::)
I'll put it up somewhere an send you a link.Steve
That would be handy. Now you can't even find anything about the FW-7580 at all other than it's a discontinued product. I wonder if contacting them directly might get you a copy of the FW-7580 manual.
In other news, I had a major find today. Decided to check an old storage room that used to be for the computer club, which was disbanded years before I started working here, but we used it for storage of old junk for a long while until we were asked to clean it out so they could store some tables and desks and books in there. I was certain we cleaned it all out, but on the shelf was a couple of boxes, mostly random junk like some ISA video cards, some PCI ethernet cards, a bunch of ribbon cables, some hard drive mounting brackets for who knows what model of PC and other odds and ends. And the big score of the bunch, a serial port on a ribbon cable to a proper 10 pin header. I'm tempted to cut out a hole in the back of the XTM and permanently mount it there, but I see no real need to do that as this will probably be the only time I'll need to use it. I also found a slot cover with a DB9 and a DB25 connectors on ribbon cables which I'm stashing in my desk drawer for a rainy day. (Which today is, but I'll stash it for a different rainy day. lol) And I also grabbed a slot cover with a LPT and PS2 port with cables and headers, though I'll probably never use that one.
And while setting up a laptop on our backup internet connection, I came across a null modem cable coiled up in the bottom of the cabinet, so I don't even need to mess around with the Cat5 to serial adapters to figure out how to make a Cat5 cable to get it to act as a null modem cable.
So I'm now in FreeDOS on COM2.
C:\BIOS>biosid ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ BIOSID v1.1 - BIOS Identification Utility ³ ³ Copyright (c) 1998 Unicore Software, Inc. ³ ³ Tel : 1-800-800-BIOS ³ ³ http: //www.unicore.com/ ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ BIOS DATE : 02/03/10BIOS TYPE : American Megatrends, IncBIOS ID : 64-0100-0 09999-00101111-020310CHIPSET ID : Eaglelake Press Any key to exit!Unfortunately, I didn't add the AMI utilities to the hard drive yet, so that's as far as I've gotten, but now I know I'm good to get into this. Just need to pull a copy of the old BIOS off and verify it matches your original so I know I can flash your modified one without having to tinker around with my image myself, though I do love some good tinkering and I probably will get around to it at some point just because. I think you posted earlier in this thread which version of the utilities to use to modify without corrupting the BIOS.
Anyway, I've got some work to do. :)
EDIT>>
C:\BIOS>afudos og-bios.rom /o +---------------------------------------------------------------------------+ | AMI Firmware Update Utility v4.40 | | Copyright (C)2011 American Megatrends Inc. All Rights Reserved. | +---------------------------------------------------------------------------+ - Saving current BIOS into file: og-bios.rom - Reading flash ......... done - Program ended normally. C:\BIOS>dir Volume in drive C has no label Volume Serial Number is 294C-120C Directory of C:\BIOS . <dir> 05-20-14 10:47a .. <dir> 05-20-14 10:47a AFUDOS EXE 154,432 07-17-12 10:44a BIOSID COM 1,080 04-29-98 11:14a BIOSID TXT 661 05-04-98 4:30p BIOSID2 TXT 645 12-08-10 3:10p BIOSID3 TXT 637 12-08-10 7:49a OG-BIOS ROM 1,048,576 05-21-14 11:26a XTM5_83 ROM 1,048,576 05-14-14 4:11p C:\BIOS>afudos og-bios.rom /d +---------------------------------------------------------------------------+ | AMI Firmware Update Utility v4.40 | | Copyright (C)2011 American Megatrends Inc. All Rights Reserved. | +---------------------------------------------------------------------------+ - Bootblock checksum .... ok - Module checksums ...... ok - ROM File Size checking ........ ok - ROM ID checking ............... ok - ROM File verification status .. ok - Program ended normally. EDIT2>> Here's the [OG-BIOS.ROM](http://www.gorgarath.com/random/OG-BIOS.ROM) file. Can you verify that it matches your original BIOS so I know if I can just flash the modified BIOS you've provided? EDIT3>> I didn't find version 3.5.1, but did find 3.4.6 of the program who's name is escaping me at the moment as I'm on my phone now, and opened up your modified BIOS image and the image I pulled off the XTM and looked through the generated reports for each. While I don't know what to look for specifically, everything seemed pretty much the same, so I went ahead and flashed your modified BIOS and am able to access everything in the BIOS now. I haven't had a chance to see if flashrom will access the BIOS now or not as I haven't had a chance to turn it on after putting it all back together. I'll probably get to that later tonight.</dir> </dir> -
Ah, that's cool. :) Sorry for the delay replying.
You must use 3.51.
3.46 might corrupt the bios and there is no way to tell until the box doesn't boot.The bios you backed up up is not the same as my original backup:
steve@steve-Satellite-Pro-A300:~/Desktop$ md5sum OG-BIOS.ROM 6ce4e0811a16a61f98e051caee7d3bbb OG-BIOS.ROM steve@steve-Satellite-Pro-A300:~/Desktop$ md5sum xtm5.rom 6fd0df1ef90335d5a4af2e9bea1a6958 xtm5.romHowever I don't think that's necessarily a problem. When I have backed up the BIOS rom before and compared it they have always been different. I believe that the downloaded ROM file must contain some dynamic data which changes every time making comparison like that impossible.
Steve
Edit: typos
-
Ah, that's cool. :) Sorry for the delay replying.
No worries. :)
You must use 3.51.
3.46 might corrupt the bios and there is no way to tell until the box doesn't boot.I used backup copies of the files and only read the files and didn't do any modifications or re-save. Would you happen to know where a copy of 3.51 could be acquired from? I've had no luck finding anything newer than 3.46 and older than something like 7 or something.
The bios you backup up is not the same as my original backup:
steve@steve-Satellite-Pro-A300:~/Desktop$ md5sum OG-BIOS.ROM 6ce4e0811a16a61f98e051caee7d3bbb OG-BIOS.ROM steve@steve-Satellite-Pro-A300:~/Desktop$ md5sum xtm5.rom 6fd0df1ef90335d5a4af2e9bea1a6958 xtm5.romHowever I don't think that's necessarily a problem. When I have backuo the BIOS rom before and compared it they have always been different. I believe that the downloaded ROM file must contain some dynamic data which changes every time making comparison like that impossible.
I believe you're right in the dynamic data. IIRC, when I was comparing the reports, there was some stuff in there like date and time. In any case, your modified BIOS installed with no issues (and since I was using the DOS utility, I didn't have any issues with having to remove the battery or anything since I just used the clear CMOS option when flashing) and was able to get back into the BIOS and boot the FreeDOS image on the hard drive. I've been slacking and haven't yet tried the pfSense install on the CF card yet, but I don't see any problems with that.
I'd like to do a few extra modifications to the BIOS from what I could see in the 3.46 available settings, plus re-order that menu system so save and exit is on the end… I'm a bit OCD like that I suppose. (Actually, I know I have a lot of issues, but that's a whole other 30 volume encyclopedia set, maybe more by now... lol)
On a side note, have you had any luck with recompiling WGXepc on 64bit yet? Not demanding or anything, just idly curious. I'll try and remember which board I saw you posting questions about doing so and check that thread for an update, but just thought I'd inquire here while I'm here.
Thanks for all your help so far. And all your time spent with your seemingly 8 million different watchguard devices. :)