<h1>notes</h1>
<h2>Flash layout</h2>
<pre>
Creating 9 MTD partitions on "brcmnand.0":
0x000000020000-0x000003c00000 : "rootfs"
0x000003c00000-0x0000077e0000 : "rootfs_update"
0x000007900000-0x000007d00000 : "data"
0x000007800000-0x000007900000 : "romfile"
0x000007d00000-0x000007e00000 : "rom-d"
0x000007e00000-0x000007f00000 : "wwan"
0x000000000000-0x000000020000 : "nvram"
0x000000020000-0x000003c00000 : "image"
0x000003c00000-0x0000077e0000 : "image_update"
</pre>
<p>Note CFE is at 0 to 0x19999, no partition is made for CFE.</p>

<h2>Pinouts</h2>
<h3>console</h3>
<pre>
TTL-level serial at 115200 baud
-------
|123X5|
-------
1 probably voltage
2 TX
3 RX
x Not populated
5 Ground
</pre>
<h3>JTAG</h3>
<p>Unknown at this stage</p>
<pre>
14 pin jtag
---------
|2468ACE|
|13579BD|
---------
1 ?
2 GND
3 ?
4 ?
5 ?
6 GND
7 ?
8 GND
9 ?
A GND
B Power?
C ?
D Power?
E Power?
</pre>

<h2>Bootloader commands</h2>
<p>Smells like Broadcom's CFE with modifications to use daft command names.</p>
<pre>
CFE> ATHE
Available commands:

ATMB                Use for multiboot.
ATSH                dump manufacturer related data from NVRAM
ATGO                Run program from flash image or from host depend on 
                    [f/h] flag.
ATSE                show the seed of password generator
ATEN                set BootExtension Debug Flag
ATPH                Set/Get PHY`s registers.
ATBL                Print boot line and board parameter info
ATSR                System reboot
ATUR                Upload router firmware to flash from TFTP
ATHE                print help

For more information about a command, enter 'help command-name'
*** command status = 0
CFE> 
</pre>
<p>Board has an IP stack, uses 192.168.1.1/24 by default, expects TFTP host at 192.168.1.33.</p>
<h3>Doing TFTP load</h3>
<pre>
CFE> ATGO ras.bin
Retry loading it as a compressed image.
Loading 192.168.1.33:ras.bin ...
Finished loading 24904704 bytes
*** command status = 24904704
CFE> ATGO
Booting from latest image (address 0xb8020000, flash offset 0x00020000) ...
[linux boot logs start hereish]
</pre>
<p>You may want to symlink /srv/tftp/ras.bin to your $build-dir/bin/brcm963xx/zyxel/ras.bin if running tftp server from the build VM for convenience.</p>
