Pfsense Install on Nokia IP390
-
The file 'VERSION' in the root directory of the IPSO image shows the other models that the image can be used on:```
os IPSO
number 1
time 225515
date 04.14.2010
user releng
host bsd61.nes.checkpoint.com
type tagged
release 6.2
subrelease GA039
products IP150 IP282 IP290 IP390 IP560 IP690 IP1280 IP2450I think you are right about the Alterra chip driving the diagnostic 2-digit LED chip during the boot process. You are also right about the cardbus controller; it seems to be the TI PCI-1520 chip. The two small chips, U22 and U21 near the 9-pin headers, are UARTs I believe. The chips on the daughter card are simply drivers for the LEDs (transistors Q1-Q7 and hex driver 7407). I'm not sure what are the two similar sized chips between PMC Slot 2 and the ribbon cable, U69 and U23. What is the chip under the ribbon cable, sitting between U23 and the PCI-1520 chip? In any case, I agree it's looking like the LEDs are driven by the ICH. -
Yep, nothing of note on the bottom of the board.
So toggling the the GPIO pins of the ICH is simply a matter of writing a 1 or 0 to the correct register. The registers are mapped to I/O space so it's really a matter of finding where to write 1. ;)
The ICH has a number of GPIO pins I forget exactly I have the data sheet but it's, say, 32. Most of those are dual purpose pins, they can be used as something else, and to use them as GPIO they need to be configured as such. That is done in another register so by reading that we can see which pins are configured as GPIO thus eliminating any that aren't. This assumes the bios has correctly configured the ICH registers initially. We can rule out further pins because they also need to configured as either IN or OUT via another register. We are only interested in pins configured as GPIO and as OUT. In the Watchguard boxes that left around 8 possibilities so easy enough to check.
The various registers addresses are known, given in the datasheet, but they are referenced to the GPIO base address. This is has a common address but can be changed and was in one Watchguard box.My home box here has the same ICH chip is yours so:
[2.1.5-RELEASE][root@pfsense.fire.box]/conf(12): pciconf -l | grep isa isab0@pci0:0:31:0: class=0x060100 card=0x00000000 chip=0x25a18086 rev=0x02 hdr=0x00If your result is the same then you can find the GPIO base address by reading the PCI device config for it:
[2.1.5-RELEASE][root@pfsense.fire.box]/conf(14): pciconf -r pci0:0:31:0: 0x58 00000481The data sheet dictates where in the PCI config data the GPIO address is found, 0x58, and that the final bit in the sequence is hardwired as 1 so the actual base address here is 0x0480.
Steve
-
Hmm
U23 is a Texas Instruments MAX211C RS232 tranceiver. U26 is a Texas Instruments TPS2226A, a PCMCIA Power protection, distribution and monitoring chip.The one under the ribbon cable, U24 is another MAX211C.
Alright, I ran those commands, here's the output:
Appears to be exactly identical to your chip Steve, which I can imagine is quite useful! So the GPIO address for this chip is 0x0480, and how do we proceed?
-
Yep, useful. :)
Ok so the 6300ESB has 32 GPIO pins but it also has some additional outputs which are specially for driving LEDs, they have higher current capability. In the Watchguard X6000 I have here it is these that drive the front LED. However since the IP390 has transistors to drive the LEDs separately it's probably using the standard GPIOs.
So we need to read the ICH registers to determine how the GPIO pins are configured. Download the readio program from here:
https://sites.google.com/site/pfsensefirebox/home/readio
I'm still pretty sure there's a built in utility that does this but I haven't found it. ::)
Change the permissions on the file to 755 so it can be run.The actual values we are looking for are single bits but they're read from the ICH registers as 8bits and given in hex. The first group of registers to look at show which pins are configured as GPIO. They are at addreses 0x480 to 0x483. So:
[2.1.5-RELEASE][root@pfsense.fire.box]/conf(15): ./readio 0x480 Reading 480 :0 [2.1.5-RELEASE][root@pfsense.fire.box]/conf(16): ./readio 0x481 Reading 481 :31 [2.1.5-RELEASE][root@pfsense.fire.box]/conf(17): ./readio 0x482 Reading 482 :a0 [2.1.5-RELEASE][root@pfsense.fire.box]/conf(18): ./readio 0x483 Reading 483 :1b0x480 is the least significant bit so the registers for my box read:
1ba03100
Now convert that to binary to see the individual bits/pins:
0001 1011 1010 0000 0011 0001 0000 0000Now do the same thing for addresses 0x484-0x487 to see which GPIOs are set to out (0).
Also get the datasheet so you can check what I'm telling you isn't completely wrong!
http://www.intel.co.uk/content/dam/doc/datasheet/6300esb-io-controller-hub-datasheet.pdf
Edit: Page 425. ;)Steve
-
Alright, thanks.
… However, I don't know how to get the program into the system! I've downloaded it here on my windows machine, but, alas, Windows doesn't even have a clue about the FFS filesystem.
How can I get the raw file I have here into pfSense?
-
Do it directly on the pfSense box:
[2.1.5-RELEASE][root@pfsense.fire.box]/conf(19): cd /tmp [2.1.5-RELEASE][root@pfsense.fire.box]/tmp(20): fetch https://sites.google.com/site/pfsensefirebox/home/readio readio 100% of 6207 B 4138 kBps [2.1.5-RELEASE][root@pfsense.fire.box]/tmp(21): chmod 0755 readio [2.1.5-RELEASE][root@pfsense.fire.box]/tmp(22): ./readio 0x480 Reading 480 :0/tmp is always read-write even in nano so that's easier but does get wiped at reboot.
Since it's such a small program I put it in /conf but that means mounting the filesystem RW first:
https://doc.pfsense.org/index.php/Remount_embedded_filesystem_as_read-write
There's also an option in Diagnostics: NanoBSD: to do it.You can also upload (or download) stuff to the pfSense box using WinSCP from Windows.
Steve
-
Alright, I ran readio from 0x480 to 0x487, here's the results:
As we can see, 0x486 is set to 0. What next?
-
Ok so we have selected GPIOs:
1bbc3180
0001 1011 1011 1100 0011 0001 1000 0000Selected as output:
1000ffff
0001 0000 0000 0000 1111 1111 1111 1111So things we are intersted in are:
–-- x-xx x-xx xx-- ---- ---- ---- ----Something to note though is that the default values for the GPIO select registers are 1b003100 thus there are 5 pins that have been set as GPIO when by default they are not. ;)
So lets read what the current values are at addresses 0x48e and 0x48f which correspond to the pins set as output.Steve
-
Alright, here's the results for 0x48e and 0x48f.
-
Ok, so:
1b3f
0001 1011 0011 1111
Comparing with bits that might be what we're looking for:
0000 1011 1011 1100That still leaves us with 7 possible bits/GPIOs. My money is on bit 21 since that is changes both select type and value from defaults.
So lets try changing it. Download and change the permissions on writeio from the same location.
We want to change 0x48e from 0011 1111 to 0001 1111 so:./writeio 0x48e 0x1fBare in mind that if this isn't the LED it may do something unexpected, like reboot the box if it happens to be connected to the reset button! On all 4 Watchguard boxes I played with nothing unexpected happened. Mostly just nothing happened! ;)
If nothing happens change 0x48e back to 0x3f and try one of the other bits.
Steve
-
Alright, so I tried writeio on 0x48e from 0x1f through 0x9f – Nothing happened, none of the LEDs turned on or off. All part of trial and error I guess!
Anyway, what next?
-
Try reading back the register you set to make sure it's actually setting correctly.
If you tried 1f-9f then that will have tried all 3 bits on that register. There are two bits on the lower half of the byte. You can try both at once by doing:
./writeio 0x48e 0x33If that does nothing then we can look at the bits in 0x48f.
Steve
-
Alright, I did a readio to confirm values are being written – Everything appears to have set correctly.
I also tried setting 0x48e to 0x33 , no change unfortunately.
So, on to 0x48f I guess! :P
-
Indeed. Set 0x48e back to 3f.
0x48f has 3 bit's we're interested in all in the lower half. So try setting it to:
0x13
0x19
0x1aSteve
-
Alright, I've tried those values on 0x48f, none of them appeared to change any of the LEDs.
What next?
-
Ok. The 6300ESB has a second set of GPIOs which include the 4 LED specific pins. The base address for these is 0x4b0 so please read all the registers between 0x4b0 and 0x4bb.
Steve
-
Alright, I ran those values. There's a few zeroes in here!
-
Ok so we have:
GPIO2 Use select register (default 03000000):
03000800
0000 0011 0000 0000 0000 1000 0000 0000GPIO2 IN/OUT register (default 00000000):
00000307
0000 0000 0000 0000 0000 0011 0000 0111GPIO2 level register (default 00000fff):
00000fff
0000 0000 0000 0000 0000 1111 1111 1111Ok so the level register is at the default values but there is one pin that has been enabled other than the default.
Interestingly this is where I found the LED in the X-Peak box. GPIO pins 40-43 are those capable of driving an LED directly which corresponds to the lower byte half of 0x4b9. Try./writeio 0x4b9 0x07Steve
-
Alright, I tried that writeio, no changes on any of the LEDs unfortunately. Charliew mentioned that the LEDs had drivers on the daughter board, so they may not be on the dedicated LED pins, although that doesn't really make sense if there is dedicated outputs for LEDs :s
What next? -
There is the possibility that a 1 at the GPIO register actually turns the LED off. So you could try the other pins that are GPIO enabled and set as output.
./writeio 0x4bb 0x03Steve
