[OpenWrt-Devel] WNDR4500: OpenWRT freezing at "Starting program at 0x80001000"

[Rafał Miłecki]

I've compiled OpenWRT from git and generated image for my WNDR4500 with:
$(call Image/Build/Chk,$(1),wndr4500,U12H189T00_NETGEAR,1,$(patsubst
jffs2-%,jffs2,$(1)))

1) Official upgrades seem to work, I've successfully upgraded 1.0.0.58
to 1.0.0.103.

2) Installing openwrt-wndr4500-squashfs.chk using stock (official)
firmware GUI partially-failed with:
Writing 2756608 bytes to /dev/mtd15.
......................mtd ioctl MEMERASE error.
See 1.upgrade.txt for details.

3) I've tried re-installing same image using tftp. I've used CFE
bootloader, executed "tfptd" and then uploaded image from my notebook.
It looks it succeed:
Reading :: Done. 2756666 bytes read
Programming...done. 2756666 bytes written
Write len/chksum offset @ 0x00EFFFF8...done.
However I'm still getting the same boot freeze. See 2.tftp.txt for details.

Any tips on that?

[Rafał Miłecki]

Post by Rafał Miłecki
$(call Image/Build/Chk,$(1),wndr4500,U12H189T00_NETGEAR,1,$(patsubst
jffs2-%,jffs2,$(1)))

BasicXP on IRC suggested to build image using region 2 instead of 1.
I've tried this and uploaded new image using tftpd. It seems it
succeed, just like before just amount of bytes a little different and
checksum changed.

Unfortunately, still issue is the same.

I started looking at WARNINGs at compilation (make V=s). There are 2
types of them:
1) WARNING: skipping FOO -- package not selected
2) WARNING: Firmware file BAR not found in the mapping lists

There is one that I'm afraid can be causing this problem:
WARNING: skipping kmod-bcma -- package not selected

Is this possible I've compiled OpenWRT without bcma and because of
that, my Linux doesn't boot? I've chosen:
1) Target System: Broadcom BCM947xx/953xx
2) Target Profile: Broadcom BCM43xx WiFi (b43, default)

[Rafał Miłecki]

Post by Rafał Miłecki
$(call Image/Build/Chk,$(1),wndr4500,U12H189T00_NETGEAR,1,$(patsubst
jffs2-%,jffs2,$(1)))
1) Official upgrades seem to work, I've successfully upgraded 1.0.0.58
to 1.0.0.103.
2) Installing openwrt-wndr4500-squashfs.chk using stock (official)
Writing 2756608 bytes to /dev/mtd15.
......................mtd ioctl MEMERASE error.
See 1.upgrade.txt for details.
3) I've tried re-installing same image using tftp. I've used CFE
bootloader, executed "tfptd" and then uploaded image from my notebook.
Reading :: Done. 2756666 bytes read
Programming...done. 2756666 bytes written
However I'm still getting the same boot freeze. See 2.tftp.txt for details.
Any tips on that?

I've removed target/linux/brcm47xx/patches-3.3/116-MIPS-BCM47xx-Remove-CFE-console.patch
and dropped "depends on arm" from KERNEL_EARLY_PRINTK. Did "make
clean", reconfigured kernel, enabled EARLY and tried again. Still the
same problem, 0x80001000 is last thing I can see :(

[Florian Fainelli]

Post by Rafał Miłecki

Post by Rafał Miłecki
$(call Image/Build/Chk,$(1),wndr4500,U12H189T00_NETGEAR,1,$(patsubst
jffs2-%,jffs2,$(1)))
1) Official upgrades seem to work, I've successfully upgraded 1.0.0.58
to 1.0.0.103.
2) Installing openwrt-wndr4500-squashfs.chk using stock (official)
Writing 2756608 bytes to /dev/mtd15.
......................mtd ioctl MEMERASE error.
See 1.upgrade.txt for details.
3) I've tried re-installing same image using tftp. I've used CFE
bootloader, executed "tfptd" and then uploaded image from my notebook.
Reading :: Done. 2756666 bytes read
Programming...done. 2756666 bytes written
However I'm still getting the same boot freeze. See 2.tftp.txt for details.
Any tips on that?

I've removed target/linux/brcm47xx/patches-3.3/116-MIPS-BCM47xx-Remove-CFE-

console.patch

Post by Rafał Miłecki
and dropped "depends on arm" from KERNEL_EARLY_PRINTK. Did "make
clean", reconfigured kernel, enabled EARLY and tried again. Still the
same problem, 0x80001000 is last thing I can see :(

Did you make sure the kernel command-line also includes "earlyprintk"? If that
still does not work, then obviously something is not ok from the very
beginning of kernel boot.

Can you try to load just the ELF kernel from CFE? Hauke, do you have any idea
what could have gone wrong for Rafal's device?
--
Florian

[Rafał Miłecki]

Post by Rafał Miłecki

Post by Rafał Miłecki

Post by Rafał Miłecki
$(call Image/Build/Chk,$(1),wndr4500,U12H189T00_NETGEAR,1,$(patsubst
jffs2-%,jffs2,$(1)))
1) Official upgrades seem to work, I've successfully upgraded 1.0.0.58
to 1.0.0.103.
2) Installing openwrt-wndr4500-squashfs.chk using stock (official)
Writing 2756608 bytes to /dev/mtd15.
......................mtd ioctl MEMERASE error.
See 1.upgrade.txt for details.
3) I've tried re-installing same image using tftp. I've used CFE
bootloader, executed "tfptd" and then uploaded image from my notebook.
Reading :: Done. 2756666 bytes read
Programming...done. 2756666 bytes written
However I'm still getting the same boot freeze. See 2.tftp.txt for

details.

Post by Rafał Miłecki

Post by Rafał Miłecki
Any tips on that?

I've removed target/linux/brcm47xx/patches-3.3/116-MIPS-BCM47xx-Remove-CFE-

console.patch

Post by Rafał Miłecki
and dropped "depends on arm" from KERNEL_EARLY_PRINTK. Did "make
clean", reconfigured kernel, enabled EARLY and tried again. Still the
same problem, 0x80001000 is last thing I can see :(

Did you make sure the kernel command-line also includes "earlyprintk"? If that
still does not work, then obviously something is not ok from the very
beginning of kernel boot.

I didn't know it's required. I've modified
target/linux/brcm47xx/config-3.3 and now after using "make", my
build_dir/linux-brcm47xx/linux-3.3.8/.config looks like this:
# CONFIG_TEST_KSTRTOX is not set
CONFIG_EARLY_PRINTK=y
CONFIG_CMDLINE_BOOL=y
CONFIG_CMDLINE="root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd
console=ttyS0,115200 earlyprintk"
# CONFIG_CMDLINE_OVERRIDE is not set

Unfortunately, I still don't get anything after "Starting program at
0x80001000".

Post by Rafał Miłecki
Can you try to load just the ELF kernel from CFE? Hauke, do you have any idea
what could have gone wrong for Rafal's device?

Sure, if I just find howto on that. Just give me some time for this :)


Yesterday I've used tftpd to install official firmware after I
soft-bricked my routed with OpenWRT build. It has worked just fine,
official firmware was installed correctly, so the hardware seems to be
alright, not hard-bricked or anyhow damaged.

[Rafał Miłecki]

Post by Rafał Miłecki

Post by Rafał Miłecki
I've removed target/linux/brcm47xx/patches-3.3/116-MIPS-BCM47xx-Remove-CFE-

console.patch

Post by Rafał Miłecki
and dropped "depends on arm" from KERNEL_EARLY_PRINTK. Did "make
clean", reconfigured kernel, enabled EARLY and tried again. Still the
same problem, 0x80001000 is last thing I can see :(

Can you try to load just the ELF kernel from CFE? Hauke, do you have any idea
what could have gone wrong for Rafal's device?

I've no idea how Netgear did this, but they installed some prehistoric
version of CFE on this device. It's "CFE for WNDR4500 version:
v1.0.3", it doesn't have basic commands like "help" or "printenv"
included :|

I'm going to try following:
CFE> boot -elf 192.168.1.2:build_dir/linux-brcm47xx/vmlinux.elf
is this what you expected me to?

[Florian Fainelli]

Post by Rafał Miłecki

Post by Rafał Miłecki

Post by Rafał Miłecki
I've removed target/linux/brcm47xx/patches-3.3/116-MIPS-BCM47xx-Remove-

CFE-

Post by Rafał Miłecki

Post by Rafał Miłecki
console.patch

Post by Rafał Miłecki
and dropped "depends on arm" from KERNEL_EARLY_PRINTK. Did "make
clean", reconfigured kernel, enabled EARLY and tried again. Still the
same problem, 0x80001000 is last thing I can see :(

Can you try to load just the ELF kernel from CFE? Hauke, do you have any idea
what could have gone wrong for Rafal's device?

I've no idea how Netgear did this, but they installed some prehistoric
v1.0.3", it doesn't have basic commands like "help" or "printenv"
included :|
CFE> boot -elf 192.168.1.2:build_dir/linux-brcm47xx/vmlinux.elf
is this what you expected me to?

Yes something like this should be fine.
--
Florian

[Hauke Mehrtens]

Post by Florian Fainelli

Post by Rafał Miłecki

Post by Rafał Miłecki

Post by Rafał Miłecki
I've removed target/linux/brcm47xx/patches-3.3/116-MIPS-BCM47xx-Remove-

CFE-

Post by Rafał Miłecki

Post by Rafał Miłecki
console.patch

Post by Rafał Miłecki
and dropped "depends on arm" from KERNEL_EARLY_PRINTK. Did "make
clean", reconfigured kernel, enabled EARLY and tried again. Still the
same problem, 0x80001000 is last thing I can see :(

Can you try to load just the ELF kernel from CFE? Hauke, do you have any

idea

Post by Rafał Miłecki

Post by Rafał Miłecki
what could have gone wrong for Rafal's device?

I've no idea how Netgear did this, but they installed some prehistoric
v1.0.3", it doesn't have basic commands like "help" or "printenv"
included :|
CFE> boot -elf 192.168.1.2:build_dir/linux-brcm47xx/vmlinux.elf
is this what you expected me to?

Yes something like this should be fine.

Hi Rafał,

nice to see you working on the WNDR4500. I didn't had time the last
days, that's because I haven't answered earlier.

Hmm strange behavior. On most of my devices early printk is working
after removing this patch and selecting CONFIG_EARLY_PRINTK in
target/linux/brcm47xx/config-3.3, so that looks correct. It could be
that this device is on of the device where early printk does not work.
That would be bad, but I haven't investigated why it does not work on
some devices.

You could try top boot a ramdisk from a tftp server from within CFE:
boot -tftp -elf 192.168.1.220:/brcm47xx/openwrt-brcm47xx-vmlinux.elf
here 192.168.1.220 is the IP address where the tftp server is running
and brcm47xx/openwrt-brcm47xx-vmlinux.elf is the patch on the tftp
server where the image can be found. To generate a ramdisk image select
"Target Images" --> "ramdisk" and in ramdisk menu "Compression" to lzma.

The BCM4706 is not fully supported and was never tested.

There is some part missing in drivers/bcma/driver_chipcommon_pmu.c
bcma_pmu_get_clockcpu() which is probably needed for this device.

OpenWrt does not support the NAND flash controller found in this device
there is just support for an older version, but I have never tested that
as I do not have a device with NAND flash.

By the way, the GPL tar provided by Asus for their RT-AC66U contains the
source code for the Ethernet driver licensed under a permissive license.

Hauke

[Rafał Miłecki]

Post by Hauke Mehrtens
boot -tftp -elf 192.168.1.220:/brcm47xx/openwrt-brcm47xx-vmlinux.elf
here 192.168.1.220 is the IP address where the tftp server is running
and brcm47xx/openwrt-brcm47xx-vmlinux.elf is the patch on the tftp
server where the image can be found. To generate a ramdisk image select
"Target Images" --> "ramdisk" and in ramdisk menu "Compression" to lzma.

YOU'RE GREAT GUYS

boot -tftp -elf 192.168.1.2" :/openwrt-brcm47xx-vmlinux.elf
Loader:elf Filesys:tftp Dev:eth0
File:192.168.1.2:/openwrt-brcm47xx-vmlinux.elf Options:(null)
Loading: 0x80001000/4400228 0x80433464/118060 Entry at 0x80247370
Closing network.
Starting program at 0x80247370
[ 0.000000] Linux version 3.3.8 (***@linux-bxwm.site) (gcc
version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #5 Thu
Jun 21 12:00:17 CEST 2012
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 00019749 (MIPS 74Kc)
[ 0.000000] bcm47xx: using bcma bus
[ 0.000000] bcma: Found chip with id 0x5300, rev 0x01 and package 0x00
[ 0.000000] bcma: Failed to scan for common core: -29
[ 0.000000] Kernel panic - not syncing: Failed to initialize BCMA
bus (err -1)

Now the rest sounds trivial to fix! :)


Why booting elf from tftp allowed to me finally see anything? Any
explanation to that maybe?

[Hauke Mehrtens]

Post by Rafał Miłecki

Post by Hauke Mehrtens
boot -tftp -elf 192.168.1.220:/brcm47xx/openwrt-brcm47xx-vmlinux.elf
here 192.168.1.220 is the IP address where the tftp server is running
and brcm47xx/openwrt-brcm47xx-vmlinux.elf is the patch on the tftp
server where the image can be found. To generate a ramdisk image select
"Target Images" --> "ramdisk" and in ramdisk menu "Compression" to lzma.

YOU'RE GREAT GUYS
boot -tftp -elf 192.168.1.2" :/openwrt-brcm47xx-vmlinux.elf
Loader:elf Filesys:tftp Dev:eth0
File:192.168.1.2:/openwrt-brcm47xx-vmlinux.elf Options:(null)
Loading: 0x80001000/4400228 0x80433464/118060 Entry at 0x80247370
Closing network.
Starting program at 0x80247370
version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #5 Thu
Jun 21 12:00:17 CEST 2012
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 00019749 (MIPS 74Kc)
[ 0.000000] bcm47xx: using bcma bus
[ 0.000000] bcma: Found chip with id 0x5300, rev 0x01 and package 0x00
[ 0.000000] bcma: Failed to scan for common core: -29
[ 0.000000] Kernel panic - not syncing: Failed to initialize BCMA
bus (err -1)
Now the rest sounds trivial to fix! :)

The core ids for some cores on this SoC are different from the ids used
on all other chips, see include/hndsoc.h.

#define CC_4706_CORE_ID 0x500 /* chipcommon core */
#define SOCRAM_4706_CORE_ID 0x50e /* internal memory core */
#define GMAC_COMMON_4706_CORE_ID 0x5dc /* Gigabit MAC core */
#define GMAC_4706_CORE_ID 0x52d /* Gigabit MAC core */

Post by Rafał Miłecki
Why booting elf from tftp allowed to me finally see anything? Any
explanation to that maybe?

I do not know, it could be that it boots the system somehow different or
you did something wrong while flashing.

Hauke

[Rafał Miłecki]

Post by Rafał Miłecki
YOU'RE GREAT GUYS
boot -tftp -elf 192.168.1.2" :/openwrt-brcm47xx-vmlinux.elf
 Loader:elf Filesys:tftp Dev:eth0
File:192.168.1.2:/openwrt-brcm47xx-vmlinux.elf Options:(null)
 Loading: 0x80001000/4400228 0x80433464/118060 Entry at 0x80247370
 Closing network.
 Starting program at 0x80247370
version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #5 Thu
Jun 21 12:00:17 CEST 2012
 [    0.000000] bootconsole [early0] enabled
 [    0.000000] CPU revision is: 00019749 (MIPS 74Kc)
 [    0.000000] bcm47xx: using bcma bus
 [    0.000000] bcma: Found chip with id 0x5300, rev 0x01 and package 0x00
 [    0.000000] bcma: Failed to scan for common core: -29
 [    0.000000] Kernel panic - not syncing: Failed to initialize BCMA
bus (err -1)
Now the rest sounds trivial to fix! :)
Why booting elf from tftp allowed to me finally see anything? Any
explanation to that maybe?

OK, I've fixed booting to reach some sane state. I've been working
using tftp and elf all the time. Finally my boot log (using tftp +
elf) looks like you can see in attached log.

So after reaching this stage I've switched from generating ramdisk to
generating squashfs. Installed my openwrt-wndr4500-squashfs.chk and...
again, nothing. I can't see anything after "Starting program at
0x80001000".

I'm quite sure I install chk in the correct way. Just doing

ROUTER:
CFE> tftpd

NOTEBOOK:
tftp 192.168.1.1
mode binary
put openwrt-wndr4500-squashfs.chk

Doing the same with original firmware (put
WNDR4500-V1.0.0.58_1.0.13.chk) installs firmware correctly.


P.S.
I've noticed there is also ttyS1 in logs. So I've modified CMDLINE to
use ttyS1 instead of ttyS0, but it didn't help. The only difference is

[Rafał Miłecki]

Post by Rafał Miłecki

Post by Rafał Miłecki
YOU'RE GREAT GUYS
boot -tftp -elf 192.168.1.2" :/openwrt-brcm47xx-vmlinux.elf
 Loader:elf Filesys:tftp Dev:eth0
File:192.168.1.2:/openwrt-brcm47xx-vmlinux.elf Options:(null)
 Loading: 0x80001000/4400228 0x80433464/118060 Entry at 0x80247370
 Closing network.
 Starting program at 0x80247370
version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #5 Thu
Jun 21 12:00:17 CEST 2012
 [    0.000000] bootconsole [early0] enabled
 [    0.000000] CPU revision is: 00019749 (MIPS 74Kc)
 [    0.000000] bcm47xx: using bcma bus
 [    0.000000] bcma: Found chip with id 0x5300, rev 0x01 and package 0x00
 [    0.000000] bcma: Failed to scan for common core: -29
 [    0.000000] Kernel panic - not syncing: Failed to initialize BCMA
bus (err -1)
Now the rest sounds trivial to fix! :)
Why booting elf from tftp allowed to me finally see anything? Any
explanation to that maybe?

OK, I've fixed booting to reach some sane state. I've been working
using tftp and elf all the time. Finally my boot log (using tftp +
elf) looks like you can see  in attached log.
So after reaching this stage I've switched from generating ramdisk to
generating squashfs. Installed my openwrt-wndr4500-squashfs.chk and...
again, nothing. I can't see anything after "Starting program at
0x80001000".

Hauke: does serial console logging works for you on any BCMA board?

In brcm47xx/setup.c I can see some serial related code in
bcm47xx_register_ssb. We don't have anything like that in
bcm47xx_register_bcma. Can this cause a problem for me?

[Hauke Mehrtens]

Post by Rafał Miłecki

Post by Rafał Miłecki

Post by Rafał Miłecki
YOU'RE GREAT GUYS
boot -tftp -elf 192.168.1.2" :/openwrt-brcm47xx-vmlinux.elf
Loader:elf Filesys:tftp Dev:eth0
File:192.168.1.2:/openwrt-brcm47xx-vmlinux.elf Options:(null)
Loading: 0x80001000/4400228 0x80433464/118060 Entry at 0x80247370
Closing network.
Starting program at 0x80247370
version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #5 Thu
Jun 21 12:00:17 CEST 2012
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 00019749 (MIPS 74Kc)
[ 0.000000] bcm47xx: using bcma bus
[ 0.000000] bcma: Found chip with id 0x5300, rev 0x01 and package 0x00
[ 0.000000] bcma: Failed to scan for common core: -29
[ 0.000000] Kernel panic - not syncing: Failed to initialize BCMA
bus (err -1)
Now the rest sounds trivial to fix! :)
Why booting elf from tftp allowed to me finally see anything? Any
explanation to that maybe?

OK, I've fixed booting to reach some sane state. I've been working
using tftp and elf all the time. Finally my boot log (using tftp +
elf) looks like you can see in attached log.
So after reaching this stage I've switched from generating ramdisk to
generating squashfs. Installed my openwrt-wndr4500-squashfs.chk and...
again, nothing. I can't see anything after "Starting program at
0x80001000".

Hauke: does serial console logging works for you on any BCMA board?
In brcm47xx/setup.c I can see some serial related code in
bcm47xx_register_ssb. We don't have anything like that in
bcm47xx_register_bcma. Can this cause a problem for me?

This code is used if the default serial port is on a different tty and
it is used for some old devices or just one.

I had never problems with serial console on my bcma based devices
(bcm4716 and BCM5357). I think you stored the image on the wrong flash
chip.

[Rafał Miłecki]

Post by Hauke Mehrtens

Post by Rafał Miłecki

Post by Rafał Miłecki

Post by Rafał Miłecki
YOU'RE GREAT GUYS
boot -tftp -elf 192.168.1.2" :/openwrt-brcm47xx-vmlinux.elf
 Loader:elf Filesys:tftp Dev:eth0
File:192.168.1.2:/openwrt-brcm47xx-vmlinux.elf Options:(null)
 Loading: 0x80001000/4400228 0x80433464/118060 Entry at 0x80247370
 Closing network.
 Starting program at 0x80247370
version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #5 Thu
Jun 21 12:00:17 CEST 2012
 [    0.000000] bootconsole [early0] enabled
 [    0.000000] CPU revision is: 00019749 (MIPS 74Kc)
 [    0.000000] bcm47xx: using bcma bus
 [    0.000000] bcma: Found chip with id 0x5300, rev 0x01 and package 0x00
 [    0.000000] bcma: Failed to scan for common core: -29
 [    0.000000] Kernel panic - not syncing: Failed to initialize BCMA
bus (err -1)
Now the rest sounds trivial to fix! :)
Why booting elf from tftp allowed to me finally see anything? Any
explanation to that maybe?

OK, I've fixed booting to reach some sane state. I've been working
using tftp and elf all the time. Finally my boot log (using tftp +
elf) looks like you can see  in attached log.
So after reaching this stage I've switched from generating ramdisk to
generating squashfs. Installed my openwrt-wndr4500-squashfs.chk and...
again, nothing. I can't see anything after "Starting program at
0x80001000".

Hauke: does serial console logging works for you on any BCMA board?
In brcm47xx/setup.c I can see some serial related code in
bcm47xx_register_ssb. We don't have anything like that in
bcm47xx_register_bcma. Can this cause a problem for me?

This code is used if the default serial port is on a different tty and
it is used for some old devices or just one.
I had never problems with serial console on my bcma based devices
(bcm4716 and BCM5357). I think you stored the image on the wrong flash

[Rafał Miłecki]

Post by Hauke Mehrtens
I had never problems with serial console on my bcma based devices
(bcm4716 and BCM5357). I think you stored the image on the wrong flash
chip.

[Rafał Miłecki]

GOOD NEWS guys! :)

1) First of all, WNDR4500's CFE can run lzma compressed vmlinux. You
can know that for example from earlier-attached official.analyze.txt.
My analyze of trx header has shown there are only 2 images. offset0 is
0x1C, offset1 is 0x141a78 and offset2 is ZERO (yes!). And as explained
earlier, at 0x1C we have hexes: 5D 00 00 01 which are early bytes
of lzma-compressed vmlinux.

So I've stared generating images skipping "loader" (small decompressor
of lzma). Unfortunately it didn't result in any success directly.

Then I've started hacking Netgear's vmlinuz-lzma. I've decompressed it
and compressed again using my system's lzma. Guess what? My CFE
started panicking with chk containing such a recompressed vmlinux:
Checking crc...Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: PANIC: out of memory!
raw_fileop_uninit: warning: refcnt not zero
Entry at 0x00000000

So it gave me a tip, lzma compression is very sensitive!

2) I've decided to ignore OpenWRT auto-generated vmlinux.lzma
(build_dir/linux-brcm47xx/vmlinux.lzma). I've compressed vmlinux by
myself using "lzma" from WNDR4500 official firmware source:
~/WNDR4500-V1.0.0.58_1.0.13_src/tools/lzma e vmlinux vmlinuz-repacked

And generated trx and chk again... It worked! I've uploaded my chk
image using tftp and CFE booted it successfully! :)

[Florian Fainelli]

Hello Rafal,

Post by Rafał Miłecki
GOOD NEWS guys! :)
1) First of all, WNDR4500's CFE can run lzma compressed vmlinux. You
can know that for example from earlier-attached official.analyze.txt.
My analyze of trx header has shown there are only 2 images. offset0 is
0x1C, offset1 is 0x141a78 and offset2 is ZERO (yes!). And as explained
earlier, at 0x1C we have hexes: 5D 00 00 01 which are early bytes
of lzma-compressed vmlinux.
So I've stared generating images skipping "loader" (small decompressor
of lzma). Unfortunately it didn't result in any success directly.
Then I've started hacking Netgear's vmlinuz-lzma. I've decompressed it
and compressed again using my system's lzma. Guess what? My CFE
Checking crc...Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: PANIC: out of memory!
raw_fileop_uninit: warning: refcnt not zero
Entry at 0x00000000
So it gave me a tip, lzma compression is very sensitive!

Yes it is, we have had some similar issues with bcm63xx images in order to find
the right LZMA parameters, since both platforms use CFE, I suggest you give
them a try and see if that fixes anything for you:
https://dev.openwrt.org/browser/trunk/target/linux/brcm63xx/image/Makefile#L117

Post by Rafał Miłecki
2) I've decided to ignore OpenWRT auto-generated vmlinux.lzma
(build_dir/linux-brcm47xx/vmlinux.lzma). I've compressed vmlinux by
~/WNDR4500-V1.0.0.58_1.0.13_src/tools/lzma e vmlinux vmlinuz-repacked
And generated trx and chk again... It worked! I've uploaded my chk
image using tftp and CFE booted it successfully! :)

Congrats! Thanks for working on this!
--
Florian

[Hauke Mehrtens]

Post by Florian Fainelli
Hello Rafal,

Post by Rafał Miłecki
GOOD NEWS guys! :)
1) First of all, WNDR4500's CFE can run lzma compressed vmlinux. You
can know that for example from earlier-attached official.analyze.txt.
My analyze of trx header has shown there are only 2 images. offset0 is
0x1C, offset1 is 0x141a78 and offset2 is ZERO (yes!). And as explained
earlier, at 0x1C we have hexes: 5D 00 00 01 which are early bytes
of lzma-compressed vmlinux.
So I've stared generating images skipping "loader" (small decompressor
of lzma). Unfortunately it didn't result in any success directly.
Then I've started hacking Netgear's vmlinuz-lzma. I've decompressed it
and compressed again using my system's lzma. Guess what? My CFE
Checking crc...Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: PANIC: out of memory!
raw_fileop_uninit: warning: refcnt not zero
Entry at 0x00000000
So it gave me a tip, lzma compression is very sensitive!

Yes it is, we have had some similar issues with bcm63xx images in order to find
the right LZMA parameters, since both platforms use CFE, I suggest you give
https://dev.openwrt.org/browser/trunk/target/linux/brcm63xx/image/Makefile#L117

The Asus RT-ac66u also has NAND flash, a BCM4706 and there all the lzma
stuff seams to be available in source code.

Post by Florian Fainelli

Post by Rafał Miłecki
2) I've decided to ignore OpenWRT auto-generated vmlinux.lzma
(build_dir/linux-brcm47xx/vmlinux.lzma). I've compressed vmlinux by
~/WNDR4500-V1.0.0.58_1.0.13_src/tools/lzma e vmlinux vmlinuz-repacked
And generated trx and chk again... It worked! I've uploaded my chk
image using tftp and CFE booted it successfully! :)

Congrats! Thanks for working on this!

Congrats, also from me. Really good work.

I will try to find some time today to work on the code reading out the
clocks of the SoC.

Hauke

[Rafał Miłecki]

Post by Hauke Mehrtens
I will try to find some time today to work on the code reading out the
clocks of the SoC.

Thanks. Let me try to summarize WNDR4500 support-lacking things:

1) Image generator
The current one isn't working. I believe I can fix that.
Workaround: use "lzma" from WNDR4500-V1.0.0.58_1.0.13_src/tools

2) bcma initialization
Not fully working yet, I can fix that excluding getting clock.
Workaround: hardcode clock on 0x5300 to 600MHz

3) NAND flash controller

Post by Hauke Mehrtens
VFS : Cannot open root device "mtdblock2" or unknown-block(0,0)
1f00 2048 mtdblock0 (driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

am I right?
Is there any open driver available for this controller? GPL license?
Or some different?

4) Driver for GBit MAC
We don't have GPL one yet. I can fix that with a proper amount of time.

5) Driver for BCM4331
The biggest problem. We don't have specs for HT-PHY. No idea for this one yet.

[Hauke Mehrtens]

Post by Rafał Miłecki

Post by Hauke Mehrtens
I will try to find some time today to work on the code reading out the
clocks of the SoC.

1) Image generator
The current one isn't working. I believe I can fix that.
Workaround: use "lzma" from WNDR4500-V1.0.0.58_1.0.13_src/tools

It would be nice if you could look into this.

Post by Rafał Miłecki
2) bcma initialization
Not fully working yet, I can fix that excluding getting clock.
Workaround: hardcode clock on 0x5300 to 600MHz

I will write the code for this, it is just some lines of code.

Post by Rafał Miłecki
3) NAND flash controller

Post by Hauke Mehrtens
VFS : Cannot open root device "mtdblock2" or unknown-block(0,0)
1f00 2048 mtdblock0 (driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

am I right?
Is there any open driver available for this controller? GPL license?
Or some different?

We have support for the older NAND flash controller, but this one is
different. I could try to write the driver but for now the Ethernet
driver has a higher priority for me. The Broadcom SDK contains code for
the NAND flash controller licensed under a GPL compatible license.

Post by Rafał Miłecki
4) Driver for GBit MAC
We don't have GPL one yet. I can fix that with a proper amount of time.

A permissive licensed version of this driver is included in the GPL
source tar of the Asus RT-AC66U.

Post by Rafał Miłecki
5) Driver for BCM4331
The biggest problem. We don't have specs for HT-PHY. No idea for this one yet.

I hope Broadcom will add support for this chip into brcmsmac, but now it
doesn't look like that. They are just in bug fixing mode for brcmsmac
sine the release of brcmsmac.

Mostly all of the source code running in kernel mode on the WNDR4500
except for the wireless driver is available in some GPL source packages
of the router manufactures under a GPL compatible license.

The package for the Asus RT-AC66U [0] contains the most recent version
of the SDK I know of and Asus haven't removed many parts of the kernel
code contrary to most of the other manufactures. Netgear also released a
GPL source package for the WNDR4500, but I would recommend using the
Asus one as it contains more code and it is of a more recent version and
some licenses are changed to be GPL compatible.

Hauke

[0]: http://support.asus.com/Download.aspx?SLanguage=en&m=RT-AC66U&p=11&os=8
[1]:
http://kb.netgear.com/app/answers/detail/a_id/2649/~/gpl-open-source-code-for-programmers

[Rafał Miłecki]

Post by Hauke Mehrtens

Post by Rafał Miłecki
Is there any open driver available for this controller? GPL license?
Or some different?

We have support for the older NAND flash controller, but this one is
different. I could try to write the driver but for now the Ethernet
driver has a higher priority for me. The Broadcom SDK contains code for
the NAND flash controller licensed under a GPL compatible license.

For me hacking ethernet is impossible until I get bootable router. I
can't get that without NAND driver :/

Post by Hauke Mehrtens

Post by Rafał Miłecki
4) Driver for GBit MAC
We don't have GPL one yet. I can fix that with a proper amount of time.

A permissive licensed version of this driver is included in the GPL
source tar of the Asus RT-AC66U.

Does this license allow modifying the driver and putting it in kernel?

[Hauke Mehrtens]

Post by Rafał Miłecki

Post by Hauke Mehrtens

Post by Rafał Miłecki
Is there any open driver available for this controller? GPL license?
Or some different?

We have support for the older NAND flash controller, but this one is
different. I could try to write the driver but for now the Ethernet
driver has a higher priority for me. The Broadcom SDK contains code for
the NAND flash controller licensed under a GPL compatible license.

For me hacking ethernet is impossible until I get bootable router. I
can't get that without NAND driver :/

This code is also licensed under the ISC license.

Post by Rafał Miłecki

Post by Hauke Mehrtens

Post by Rafał Miłecki
4) Driver for GBit MAC
We don't have GPL one yet. I can fix that with a proper amount of time.

A permissive licensed version of this driver is included in the GPL
source tar of the Asus RT-AC66U.

Does this license allow modifying the driver and putting it in kernel?

This is the ISC license [0], it is also used by Atheros in ath9k.

Attached is a patch to read out the clock rates. This patch is not even
compile tested, Rafał could you test it and report back.

Hauke

[0]: https://en.wikipedia.org/wiki/ISC_license

[Rafał Miłecki]

Post by Hauke Mehrtens

Post by Rafał Miłecki

Post by Hauke Mehrtens

Post by Rafał Miłecki
Is there any open driver available for this controller? GPL license?
Or some different?

We have support for the older NAND flash controller, but this one is
different. I could try to write the driver but for now the Ethernet
driver has a higher priority for me. The Broadcom SDK contains code for
the NAND flash controller licensed under a GPL compatible license.

For me hacking ethernet is impossible until I get bootable router. I
can't get that without NAND driver :/

This code is also licensed under the ISC license.

Post by Rafał Miłecki

Post by Hauke Mehrtens

Post by Rafał Miłecki
4) Driver for GBit MAC
We don't have GPL one yet. I can fix that with a proper amount of time.

A permissive licensed version of this driver is included in the GPL
source tar of the Asus RT-AC66U.

Does this license allow modifying the driver and putting it in kernel?

This is the ISC license [0], it is also used by Atheros in ath9k.
Attached is a patch to read out the clock rates. This patch is not even
compile tested, Rafał could you test it and report back.

I've no idea how to apply that. It doesn't apply on OpenWRT-patched
3.3.8. Do you have some patch moving OpenWRT to more recent kernel?

But even in wireless-testing I can't see defines for chip ids.

[Rafał Miłecki]

Post by Rafał Miłecki

Post by Hauke Mehrtens

Post by Rafał Miłecki

Post by Hauke Mehrtens

Post by Rafał Miłecki
Is there any open driver available for this controller? GPL license?
Or some different?

We have support for the older NAND flash controller, but this one is
different. I could try to write the driver but for now the Ethernet
driver has a higher priority for me. The Broadcom SDK contains code for
the NAND flash controller licensed under a GPL compatible license.

For me hacking ethernet is impossible until I get bootable router. I
can't get that without NAND driver :/

This code is also licensed under the ISC license.

Post by Rafał Miłecki

Post by Hauke Mehrtens

Post by Rafał Miłecki
4) Driver for GBit MAC
We don't have GPL one yet. I can fix that with a proper amount of time.

A permissive licensed version of this driver is included in the GPL
source tar of the Asus RT-AC66U.

Does this license allow modifying the driver and putting it in kernel?

This is the ISC license [0], it is also used by Atheros in ath9k.
Attached is a patch to read out the clock rates. This patch is not even
compile tested, Rafał could you test it and report back.

I've no idea how to apply that. It doesn't apply on OpenWRT-patched
3.3.8. Do you have some patch moving OpenWRT to more recent kernel?
But even in wireless-testing I can't see defines for chip ids.

OK, I've found that patch posted on linux-wireless. Still, some trick
to move OpenWRT to more recent kernel?

P.S.
Is there some hack to make build_dir/linux-brcm47xx/linux-X.Y.Z a git
repository? So I can modify kernel source in that directory and use
"git diff", "git commit" etc?

[Hauke Mehrtens]

Post by Rafał Miłecki

Post by Rafał Miłecki

Post by Hauke Mehrtens

Post by Rafał Miłecki

Post by Hauke Mehrtens

Post by Rafał Miłecki
Is there any open driver available for this controller? GPL license?
Or some different?

We have support for the older NAND flash controller, but this one is
different. I could try to write the driver but for now the Ethernet
driver has a higher priority for me. The Broadcom SDK contains code for
the NAND flash controller licensed under a GPL compatible license.

For me hacking ethernet is impossible until I get bootable router. I
can't get that without NAND driver :/

This code is also licensed under the ISC license.

Post by Rafał Miłecki

Post by Hauke Mehrtens

Post by Rafał Miłecki
4) Driver for GBit MAC
We don't have GPL one yet. I can fix that with a proper amount of time.

A permissive licensed version of this driver is included in the GPL
source tar of the Asus RT-AC66U.

Does this license allow modifying the driver and putting it in kernel?

This is the ISC license [0], it is also used by Atheros in ath9k.
Attached is a patch to read out the clock rates. This patch is not even
compile tested, Rafał could you test it and report back.

I've no idea how to apply that. It doesn't apply on OpenWRT-patched
3.3.8. Do you have some patch moving OpenWRT to more recent kernel?

Currently we have kernel version freeze, because we are planing a new
release. The backport patches for bcma and ssb are containing most of
the code currently in wireless testing.

Post by Rafał Miłecki

Post by Rafał Miłecki
But even in wireless-testing I can't see defines for chip ids.

OK, I've found that patch posted on linux-wireless. Still, some trick
to move OpenWRT to more recent kernel?

Yes, I based it on my other bcma patches.

Post by Rafał Miłecki
P.S.
Is there some hack to make build_dir/linux-brcm47xx/linux-X.Y.Z a git
repository? So I can modify kernel source in that directory and use
"git diff", "git commit" etc?

Yes that is possible see "Advanced configuration options (for
developers)" and "Use external kernel tree" or the other two options
under that.

Hauke

[Rafał Miłecki]

Post by Florian Fainelli
Hello Rafal,

Post by Rafał Miłecki
GOOD NEWS guys! :)
1) First of all, WNDR4500's CFE can run lzma compressed vmlinux. You
can know that for example from earlier-attached official.analyze.txt.
My analyze of trx header has shown there are only 2 images. offset0 is
0x1C, offset1 is 0x141a78 and offset2 is ZERO (yes!). And as explained
earlier, at 0x1C we have hexes: 5D  00  00  01 which are early bytes
of lzma-compressed vmlinux.
So I've stared generating images skipping "loader" (small decompressor
of lzma). Unfortunately it didn't result in any success directly.
Then I've started hacking Netgear's vmlinuz-lzma. I've decompressed it
and compressed again using my system's lzma. Guess what? My CFE
Checking crc...Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: PANIC: out of memory!
raw_fileop_uninit: warning: refcnt not zero
Entry at 0x00000000
So it gave me a tip, lzma compression is very sensitive!

Yes it is, we have had some similar issues with bcm63xx images in order to find
the right LZMA parameters, since both platforms use CFE, I suggest you give
https://dev.openwrt.org/browser/trunk/target/linux/brcm63xx/image/Makefile#L117

I can see you had to remove some parts of lzma file for bcm63xx. Really ugly.

Fortunately it's a little nicer with my brcm47xx WNDR4500. After
multiple test I've discovered my CFE doesn't like two things:
1) Dictionary
2) End Of Stream marker

So using some low -dVALUE and *not* using -eos results in a working
image. I've tried few random lc/lp/pb values but CFE seems to support
all variations.

[Rafał Miłecki]

Post by Hauke Mehrtens
There is some part missing in drivers/bcma/driver_chipcommon_pmu.c
bcma_pmu_get_clockcpu() which is probably needed for this device.

Yeah. Currently trace is:
bcma_pmu_get_clockcpu
bcma_pmu_get_clockcontrol
bcma_pmu_clock(cc, 12, 1)
bcma_chipco_pll_read(cc, 12 + 0)
bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA)

The last one crashes my WNDR4500.

Hauke: are you able to provide si_4706_pmu_clock? I can see you added
TODO for now:
/* TODO: if (bus->chipinfo.id == 0x5300)
return si_4706_pmu_clock(sih, osh, cc, PMU4706_MAINPLL_PLL0,
PMU5_MAINPLL_CPU); */

For now I'm just hardcoding my CPU to 600MHz

[Hauke Mehrtens]

Post by Hauke Mehrtens

Post by Hauke Mehrtens
There is some part missing in drivers/bcma/driver_chipcommon_pmu.c
bcma_pmu_get_clockcpu() which is probably needed for this device.

bcma_pmu_get_clockcpu
bcma_pmu_get_clockcontrol
bcma_pmu_clock(cc, 12, 1)
bcma_chipco_pll_read(cc, 12 + 0)
bcma_cc_read32(cc, BCMA_CC_PLLCTL_DATA)
The last one crashes my WNDR4500.
Hauke: are you able to provide si_4706_pmu_clock? I can see you added
/* TODO: if (bus->chipinfo.id == 0x5300)
return si_4706_pmu_clock(sih, osh, cc, PMU4706_MAINPLL_PLL0,
PMU5_MAINPLL_CPU); */
For now I'm just hardcoding my CPU to 600MHz

Hi Rafał,

bcma_pmu_get_clockcontrol() and bcma_pmu_get_clockcpu() are returning
wrong values on a bcm4706 and are reading wrong registers, I will try to
fix that tomorrow.

Hauke

[g***@free.fr]

----- Mail original -----

Envoyé: Mercredi 27 Juin 2012 09:56:32
Objet: Re: [OpenWrt-Devel] WNDR4500: OpenWRT freezing at "Starting program at 0x80001000"
GOOD NEWS guys! :)
1) First of all, WNDR4500's CFE can run lzma compressed vmlinux. You
can know that for example from earlier-attached official.analyze.txt.
My analyze of trx header has shown there are only 2 images. offset0 is
0x1C, offset1 is 0x141a78 and offset2 is ZERO (yes!). And as explained
earlier, at 0x1C we have hexes: 5D 00 00 01 which are early bytes
of lzma-compressed vmlinux.
So I've stared generating images skipping "loader" (small decompressor
of lzma). Unfortunately it didn't result in any success directly.
Then I've started hacking Netgear's vmlinuz-lzma. I've decompressed it
and compressed again using my system's lzma. Guess what? My CFE
Checking crc...Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: PANIC: out of memory!
raw_fileop_uninit: warning: refcnt not zero
Entry at 0x00000000
So it gave me a tip, lzma compression is very sensitive!

lzma compressed kernel is a hacked lzma file with size added at the beginning to match what gzip does.
Look at kernel scripts/makefile.lib for the details.

Gilles