Topic: se551 & redboot

The content of this topic has been archived on 8 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Page 1 of 1

Post #1

crazy_imp

11 Jul 2007, 22:43

heyho,
i try to chainload redboot from ram on my se551 (see http://wiki.openwrt.org/OpenWrtDocs/Har … mens/SE551 for some infos about the device). the current bootloader allows me to place files on the router (ram or flash, but so far i'll not write to flash due the fact i killed the jtag solder pads , first i want to see redboot working on it before write it into the flash).
first i tried to play around with ap51.ram (took some time until malbon told me that it's not re-allocatable, thanks malbon ), uploaded the image to 0x80041000 according to:

LOAD off    0x00001000 vaddr 0x80041000 paddr 0x80041000 align 2**12

still no success... next hint from malbon, skip the elf header. so i used objdump to get the:

start address 0x800410bc

again, nothing happend, after a short look with hexedit into ap51.ram at 0xbc, i thought there might be a big problem with the address, there are only zeros following until 0x1000. but here the output from the bootloader:

Go to Memory Address: (default:0x80001000) : 0x800410bc                         
Are you sure, you have the valid code on 0x800410bc ? (Y/n) Yes                 
sysConsoleDump: type 0x00000200                                                 
      epc: 0xc60c0a84 bva: 0xc60c0a84 sr:  0x10400002 cse: 0x50808008           
  R0: r0:  0x00000000 at:  0xbfc00000 v0:  0x800410bc v1:  0x00000000           
  R4: a0:  0xb1100014 a1:  0x0000000d a2:  0x80530000 a3:  0x00000067           
  R8: t0:  0x00000008 t1:  0x8052c644 t2:  0x00ab0401 t3:  0x00020800           
 R12: t4:  0x00d80400 t5:  0x8052d83c t6:  0xefd56479 t7:  0x03d2e400           
 R16: s0:  0x80530000 s1:  0x00000000 s2:  0x80520000 s3:  0x0000cfa4           
 R20: s4:  0xd9fd0b6b s5:  0x5effd539 s6:  0xf7d7de8f s7:  0x7d8feaef           
 R24: t8:  0xffeaffb2 t9:  0xfbfd4feb k0:  0x00000000 k1:  0x00000000           
 R28: gp:  0x80534fa0 sp:  0x8053ed70 fp:  0x7b93f68c ra:  0x805242f0

there are two different kinds of the sysConsoleDump lines so far (ok, the rest of the messages is also different, but i think this line is something like an error code), the following came up after i pointed the loader to the wrong address:

sysConsoleDump: type 0x00000380

next step: use a .bin created with objcopy from the the ap51.ram. placed it again at 0x80041000 and tried to load it from there (is there also an entry point i have to use?), interesting now the bootloader asks to load it right after i transfered it:

[WG4005E Boot]:m                                                                
                                                                                
RAM upload destination: (default:0x80001000) : 0x80041000                       
Starting XModem download to 80041000...(press Enter to abort)                   
Cuploaded code? (Y/n) sysConsoleDump: type 0x00000200                           
      epc: 0x1a0ae15c bva: 0x1a0ae15c sr:  0x10400002 cse: 0x50808008           
  R0: r0:  0x00000000 at:  0xbfc00000 v0:  0x80041000 v1:  0x00000059           
  R4: a0:  0x00000059 a1:  0x00000020 a2:  0x80530000 a3:  0x00007942           
  R8: t0:  0x8053e530 t1:  0x8052c644 t2:  0x00ab0401 t3:  0x00020800           
 R12: t4:  0x00d80400 t5:  0x8052d83c t6:  0xefd56479 t7:  0x03d2e400           
 R16: s0:  0x80530000 s1:  0x00000000 s2:  0x80520000 s3:  0x0000cfa4           
 R20: s4:  0xd9fd0b6b s5:  0x5effd539 s6:  0xf7d7de8f s7:  0x7d8feaef           
 R24: t8:  0xffeaffb2 t9:  0xfbfd4feb k0:  0x00000000 k1:  0x00000000           
 R28: gp:  0x80534fa0 sp:  0x8053ed70 fp:  0x7b93f68c ra:  0x80524398

ok, it trashed the output a little bit, but like all the times before, it rebooted right after printing those lines .

any ideas? some final thoughts/questions:
- malbon confirmed the redboot image as working (but he tested on another router) - could it be the reason why redboot doesn't start?
- in the README from the redboot sources (got the on the ecos site iirc) ap51 is listed as: "ap51: 16MB DRAM, 2MB Flash, 184MHz CPU Clock, IC+ Phy", the Phy shouldn't matter, at least i should start i think, but the cpu speed, the se551 runs at 240MHz (maybe malbon can provide some infos about the build options he used).
- like mentioned above, is there an offset if i use the .bin i generated with "objcopy -O binary ap51.ram redboot.bin"?
- does somebody know how to interpret those sysConsoleDump lines?

finally some output from the current bootloader (i can provide more if you like, but rest is stuff from the current fw, vxworks, uninteresting i think):

ar531xPlus rev 0x00000087 boot loader startup...
Flash initialized
SDRAM initialized
Cache initialized

Copy program from 0xbfc00000 to 0x80520000, length 0x0000cfa4 bytes ... done
Jump to SDRAM 0x80520cb4 [0x10000008, 0x00000000, 0x00000000]
Clear BSS section ... done
Stack: 0x8053edc0
Heap: 0x8053edd0



==================================================================
 Wireless Gateway WG4005E Loader V0.06 build Jul 20 2005 18:02:12
                  Arcadyan Technology Corporation
==================================================================

Copying boot params.....DONE
cpuFreq=240000000 sysFreq=60000000 cntFreq=120000000

Press any key to enter command mode ...
Checking Valid Image in Flash...
 Passed.
Unzipping from bfc40000 to 80e00000 ... done
Uncompressed size = 1797316

looking forwards to your posts

crazy_imp

Post #2

lumpic

13 Jul 2007, 12:49

Hello!!

I built a kernel with atheros configuration and i changed the kernel_start to 0x80001000, because otherwise i got the same output as you!!
So try to change the start_address of you bootloader to 0x80001000 and it should work!!

But my harddisk crashed so i do not have the files anymore....

Further i bricked my SE551 so i can't test anymore ....
Do you have the jtag-pinout, the jtag-cable...

can you give me the jtag pinnout ???

thx

Post #3

crazy_imp

13 Jul 2007, 19:17

hi lumpic,
i don't have a pinout for jtag, but i made some pics where the solderpads are, take a look on this image (in the upper corner of the "shield-frame", there are golden pads, TRST, TDO, TDI, COLD_RST. TMS and TCLK on the backside of the board). they are not clearly labeled and very small (~0.6mm), i soldered them with soldering flux at 400°C, due this, i think i boiled them up from the board itself so be careful.
think i figured out how to change the kernel_start address, but it doesn't work, maybe i did something wrong?

[mj@mr_pump(526): /hoki/ar/trunk/build_mips/linux-2.6-atheros/linux-2.6.21.5]$ ../../../toolchain_build_mips/binutils-2.17/binutils/objcopy --set-start 0x80001000 vmlinux vmlinux.shifted
[mj@mr_pump(527): /hoki/ar/trunk/build_mips/linux-2.6-atheros/linux-2.6.21.5]$ objdump -x vmlinux.shifted| grep start               
start address 0x80001000
[mj@mr_pump(528): /hoki/ar/trunk/build_mips/linux-2.6-atheros/linux-2.6.21.5]$ objdump -x vmlinux.shifted| grep LOAD
    LOAD off    0x00001000 vaddr 0x80041000 paddr 0x80041000 align 2**12

if i point the loader on 0x80041000 it still reboots....

Go to Memory Address: (default:0x80001000) : 0x80041000                         
Are you sure, you have the valid code on 0x80041000 ? (Y/n) Yes                 
sysConsoleDump: type 0x00000380                                                 
      epc: 0x800fdffc bva: 0x0000cfb0 sr:  0x10400002 cse: 0x50808008           
  R0: r0:  0x00000000 at:  0x8d750000 v0:  0x7d000000 v1:  0x6cebbb4b           
  R4: a0:  0x00000000 a1:  0x7d000000 a2:  0x00000000 a3:  0x802a0000           
  R8: t0:  0x0d230000 t1:  0x0001869f t2:  0x00ab0401 t3:  0x008247d7           
 R12: t4:  0x00803fd7 t5:  0x8052d83c t6:  0xffd52439 t7:  0x03d6e088           
 R16: s0:  0x80530000 s1:  0x00000000 s2:  0x00000000 s3:  0x0000cfa4           
 R20: s4:  0x00000000 s5:  0x00400000 s6:  0x00000000 s7:  0x00000001           
 R24: t8:  0xffebdfb3 t9:  0xfbfd4feb k0:  0x00000000 k1:  0x00000000           
 R28: gp:  0x80534fa0 sp:  0x8053ed70 fp:  0x00000000 ra:  0x805242f0           
                                                                                
ar531xPlus rev 0x00000087 boot loader startup...

hmmm, we are drifting away from the topic , my main concern is still, running redboot on it, due the fact the current flash-layout is crap (like the rest of the bootloader imho) .

crazy_imp

Post #4

crazy_imp

13 Jul 2007, 23:36

good news about loading the kernel . lumpic told me to change the following:

--- linux-2.6.21.5.old/arch/mips/Makefile       2007-07-13 20:36:42.000000000 +0200
+++ linux-2.6.21.5/arch/mips/Makefile   2007-07-13 20:37:55.000000000 +0200
@@ -271,7 +271,7 @@
 #
 core-$(CONFIG_ATHEROS)         += arch/mips/atheros/
 cflags-$(CONFIG_ATHEROS)       += -Iinclude/asm-mips/mach-atheros
-load-$(CONFIG_ATHEROS)         += 0xffffffff80041000
+load-$(CONFIG_ATHEROS)         += 0xffffffff80001000

 #
 # Cobalt Server

(place this patch in target/linux/atheros-2.6/patches)
after loading build_mips/linux-2.6-atheros/vmlinux via serial (you could also use the mini-loader from vxworks which is much faster compared to xmodem, just boot the router complete and press "g", you'll be able to tell the router to take an .zip (yes, it really has to be zipped, not only named .zip) file from a tftp server), it printed nothing . checked the serial configuration of the image -> console=ttyS0,9600 which was wrong because we are runnig the serial at 115200 for the bootloader/default firmware. so here is another patch you can apply inside the trunk dir:

--- target.orig/linux/atheros-2.6/config/default        2007-07-14 00:19:54.000000000 +0200
+++ target/linux/atheros-2.6/config/default     2007-07-13 23:42:45.000000000 +0200
@@ -11,7 +11,7 @@
 CONFIG_BASE_SMALL=0
 CONFIG_BITREVERSE=y
 # CONFIG_BT is not set
-CONFIG_CMDLINE="console=ttyS0,9600 rootfstype=squashfs,jffs2 init=/etc/preinit"
+CONFIG_CMDLINE="console=ttyS0,115200 rootfstype=squashfs,jffs2 init=/etc/preinit"
 CONFIG_CPU_BIG_ENDIAN=y
 CONFIG_CPU_HAS_LLSC=y
 CONFIG_CPU_HAS_PREFETCH=y

(alternatively you can run "make kernel_menuconfig an change it there).

after the router unzipped the image (it really takes some time, just be patient) - you can see it crashing (well, i'm happy to see it, really )

firmware startup...
Stack: 0x807ff7f0
Heap: 0x807ff800

Mini-loader: Unzipping image at 80E00000 ... done
Linux version 2.6.21.5 (mj@mr_pump) (gcc version 4.1.2) #2 Fri Jul 13 23:44:10 7
CPU revision is: 00019064
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists.  Total pages: 4064
Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2 init=/etc/pt
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB, 4-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 64 (order: 6, 256 bytes)
Using 92.000 MHz high precision timer.
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13760k/16384k available (1955k kernel code, 2624k reserved, 292k data, )
Mount-cache hash table entries: 512
NET: Registered protocol family 16
WARNING: No board configuration data found!
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
CPU 0 Unable to handle kernel paging request at virtual address 00000050, epc =4
Oops[#1]:
Cpu 0
$ 0   : 00000000 10008400 80250000 00000000
$ 4   : ffff8afe 80297400 00000000 00000086
$ 8   : 00000000 00000002 00000000 000000a2
$12   : 00000019 0000007e 80250000 000001e0
$16   : 80250000 8024efd8 00000000 00000000
$20   : 00000000 00000000 00000000 00000000
$24   : 00000020 00000020                  
$28   : 802ac000 802adf60 00000000 80234664
Hi    : 00000000
Lo    : 00000000
epc   : 802381dc     Not tainted
ra    : 80234664 Status: 10008403    KERNEL EXL IE 
Cause : 30801008
BadVA : 00000050
PrId  : 00019064
Modules linked in:
Process swapper (pid: 1, threadinfo=802ac000, task=802abbe8)
Stack : 00000000 00000000 00000000 00000000 80250000 8024efd4 80234664 80234664
        00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
        00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
        00000000 80004ff8 10008403 00000000 00000000 00000000 00000000 80004fe8
        63000000 52656173 6f6e3a20 25733c50 3e256300 34303320 466f7262 69646465
Call Trace:[<80234664>][<80234664>][<80004ff8>][<80004fe8>]

Code: 8c4314a0  3c028025  ac4414b4 <94640050> 3c058000  3c078020  24840030  24a 
Kernel panic - not syncing: Attempted to kill init!

think it only likes files where file says (at least that's what i've spotted so far):

[mj@mr_pump(585): /hoki/ar/trunk]$ file build_mips/linux-2.6-atheros/vmlinux
build_mips/linux-2.6-atheros/vmlinux: Applesoft BASIC program data

(there is also a part in the .bin of the default firmware where file says the same).

crazy_imp

Post #5

obiwan

17 Jul 2007, 00:46

hi,
from what i can see, your kernel detects 16Mb of ram, but i think device only has 8Mb.
Now the bad news,
I have been able to make a kernel booting with a similar device (webt-g), mount a squashfs, but then the hal of madwifi needs to find the parameters in the flash "power, calibration, channels, etc...", that are in the last 64K of it. The bad thing is that arcadyan modified the position of the parameters in the flash, so the hal will refuse to configure the network cards.
Best regards,
Obiwan

Post #6

crazy_imp

17 Jul 2007, 10:57

Hi Obiwan,

obiwan wrote:

from what i can see, your kernel detects 16Mb of ram, but i think device only has 8Mb.

the ram chip is 128MBit = 16MByte, the name of the chip is "IC42S16800-7T" .
about the partition with the config for hal/madwifi, think i'll repartition the flash if i get redboot running, the current layout doesn't make sense.

obiwan wrote:

The bad thing is that arcadyan modified the position of the parameters in the flash, so the hal will refuse to configure the network cards.

maybe you can change the position in the madwifi sources?

have a nice day,

crazy_imp

(Last edited by crazy_imp on 17 Jul 2007, 11:03)

Post #7

obiwan

17 Jul 2007, 12:12

Hi,
Im sorry, my device only have 8Mb of ram, and ses has 16Mb, you are right.
But, why do you need to put a new bootloader?
The bootloader from arcadyan work, and you can force in mtd the partitions you want.
Since this chip is atheros, i have made some comparisions with the fonera.
Atheros kernel looks for a magic key in the last 64K or 32K, im not sure now, but i have dump the last 64K of fon and it exists.
In the arcadyan, i have dump to the last 64K, and theres no magic key.
You can see in your kernel booting this message: "WARNING: No board configuration data found!"
I have forced the kernel not to look for a magic key, but to start from the same position has fon starts, and create my partitions.
I would like to help with this.
If you want, i could send you the mods i have used in the kernel.
Best regards
Obiwan

Post #8

crazy_imp

17 Jul 2007, 12:28

sure, i would like to see your modifications , put them in here or send them via pm.
thanks,

crazy_imp

Post #9

obiwan

18 Jul 2007, 17:36

Hi, this is the patch i use to create the partition layout.

--- spiflash.c.original 2007-07-18 15:21:55.000000000 +0100
+++ spiflash.c 2007-07-18 18:21:16.000000000 +0100
@@ -428,6 +428,38 @@
static const char *part_probe_types[] = { "cmdlinepart", "RedBoot", NULL };
#endif

+static struct mtd_partition webt_partinfo[] = {
+ {
+ name: "Boot",
+ offset: 0,
+ size: 0x20000,
+ mask_flags: MTD_WRITEABLE,
+ },
+ {
+ name: "Configuration",
+ offset: MTDPART_OFS_APPEND,
+ size: 0x20000,
+ mask_flags: 0,
+ },
+ {
+ name: "rootfs",
+ offset: MTDPART_OFS_APPEND,
+ size: 0x120000,
+ mask_flags: 0,
+ },
+ {
+ name: "kernel",
+ offset: MTDPART_OFS_APPEND,
+ size: 0x90000,
+ mask_flags: 0,
+ },
+ {
+ name: "Boot Params",
+ offset: MTDPART_OFS_APPEND,
+ size: 0x10000,
+ mask_flags: 0,
+ },
+};

static int spiflash_probe(struct platform_device *pdev)
{
@@ -476,7 +508,13 @@
mtd->write = spiflash_write;
mtd->owner = THIS_MODULE;

- /* parse redboot partitions */
+ printk("Im going to add partitions\n");
+ result = add_mtd_partitions(mtd, webt_partinfo, 5);
+ spidata->mtd = mtd;
+ return (result);
+
+
+ /* parse redboot partitions */
num_parts = parse_mtd_partitions(mtd, part_probe_types, &spidata->parsed_parts, 0);
if (!num_parts)
goto error;

Best Regards,
Obiwan

Post #10

daleb

21 Feb 2008, 15:00

Hi Guys, since July of 2007, has anyone succeeded in getting openwrt to run on a Siemens SE551 ?

I've got 2 of these little beauties...but I would love to get them running like a real router should !

Cheers...

The discussion might have continued from here.

Page 1 of 1