Adding OpenWrt support for Xirrus XR-2400 Target

n4gi0s · July 20, 2020, 5:16pm

Im working on implementing my Xirrus XR-2400 in to the Freifunk network.
As they are really cheap (around 20€ on ebay) this might be useful.
The first step is getting OpenWRT running.

Things I know so far:

# cat /proc/cpuinfo 
system type		: XARRAY (CN5220p2.0-500-CP)
machine			: Unknown
Memory			: 1024 MB, Unbuffered, Non-ECC
cpu MHZ			: 500
processor		: 0
cpu model		: Cavium Octeon+ V0.8
BogoMIPS		: 1000.00
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 64
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 2, address/irw mask: [0x0ffc, 0x0ffb]
isa			: mips1 mips2 mips3 mips4 mips5 mips64r2
ASEs implemented	:
shadow register sets	: 1
kscratch registers	: 0
core			: 0
VCED exceptions		: not available
VCEI exceptions		: not available

processor		: 1
cpu model		: Cavium Octeon+ V0.8
BogoMIPS		: 1000.00
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 64
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 2, address/irw mask: [0x0ffc, 0x0ffb]
isa			: mips1 mips2 mips3 mips4 mips5 mips64r2
ASEs implemented	:
shadow register sets	: 1
kscratch registers	: 0
core			: 1
VCED exceptions		: not available
VCEI exceptions		: not available

# cat /proc/xirrus_info 
scd_file=scd-4.03.bin
scd_date=2012/05
uboot_file=u-boot-7066.bin
uboot_signon=Xirrus Boot Loader 7.1.0 (Apr 06 2016), Build: 7066
compass=27

The factory image used:

# file XS-8.5.7-7694.bin 
XS-8.5.7-7694.bin: u-boot legacy uImage, XR-8.5.7-7694, Linux/MIPS, Multi-File Image (Not compressed), 85063534 bytes, Tue Jun  9 00:31:08 2020, Load Address: 0x00000000, Entry Point: 0x00000000, Header CRC: 0xEC12AC4C, Data CRC: 0x66A37D34

But the problem is that the target image supplied by OpenWRT looks like this:

# file openwrt-19.07.3-octeon-generic-initramfs-kernel.bin 
openwrt-19.07.3-octeon-generic-initramfs-kernel.bin: ELF 64-bit MSB executable, MIPS, MIPS64 rel2 version 1 (SYSV), statically linked, stripped

This is the message I'm getting when booting:

XBL>boot
[USB 0 ] File    : openwrt.bin
[USB 0 ] Address : 0x02020100
[USB 0 ] Loading : ############################################### done     
[USB 0 ] Complete: 864 ms, 16.3 MB/sec
[Boot  ] Address : 0x02020100 ... ### Wrong Image Format for boot Command ###

This is how it should look like:

XBL>boot                          
[USB 0 ] File    : X*.bin
[USB 0 ] Address : 0x20000000
[USB 0 ] Loading : ############################################### done     
[USB 0 ] Complete: 4.6 sec, 16.6 MB/sec
[Boot  ] Address : 0x20000000
[Image ] Name    : XR-7.6.2-6287
[Image ] Created : 2016-05-06   2:09:05 UTC
[Image ] Type    : MIPS Linux Multi-File Image (uncompressed)
[Image ] Size    : 78252515 Bytes =   74.6 MB
[Image ] Contents: File 0: 10819346 Bytes =   10.3 MB
[Image ] Contents: File 1: 54468819 Bytes =   51.9 MB
[Image ] Contents: File 2: 12964331 Bytes =   12.4 MB
[Boot  ] Image   : Verifying image ....... OK
[Boot  ] Loading : Multi-File Image .... OK
[Boot  ] Watchdog: Setting to 40 secs .... OK
[Boot  ] Execute : Transferring control to OS

Is there a way the build the octeon target as a "u-boot legacy uImage" file?
Thanks in advance.

n4gi0s · July 21, 2020, 12:07am

Update
I added following to target/linux/octeon/image/Makefile:

define Device/xirrus_xr2400
  DEVICE_VENDOR := Xirrus
  DEVICE_MODEL := XR-2400
  BOARD_NAME := xr
  KERNEL := kernel-bin | strip-kernel | patch-cmdline | uImage none
endef
TARGET_DEVICES += xirrus_xr2400

Resulting in this new boot error:

XBL>boot
[USB 0 ] File    : openwrt.bin
[USB 0 ] Address : 0x20000000
[USB 0 ] Loading : ############################################### done     
[USB 0 ] Complete: 865 ms, 16.1 MB/sec
[Boot  ] Address : 0x20000000
[Image ] Name    : MIPS OpenWrt Linux-5.4.52
[Image ] Created : 2020-07-20  15:16:47 UTC
[Image ] Type    : MIPS Linux Kernel Image (uncompressed)
[Image ] Size    : 14500152 Bytes =   13.8 MB
[Boot  ] Image   : Verifying image ....... OK
[Boot  ] Loading : Kernel Image .... OK
[Boot  ] Watchdog: Setting to 40 secs .... OK
Error allocating memory for initrd!
[RESET ]

n4gi0s · August 26, 2020, 12:33pm

Successfully bootet OpenWRT!!

Patches to target/linux/octeon/image/Makefile:

define Build/xapimg
	cp $@ $@-rootfs.bin
	mkimage -A mips -O Linux -T multi -C none -n '$(VERSION_DIST) Linux-$(LINUX_VERSION)' -e 0 -a 0 -d $(KDIR)/vmlinux-initramfs.elf:$<:$@-rootfs.bin $@
endef

define Device/xirrus_xr2400
  IMAGES := factory.bin
  IMAGE/factory.bin := append-rootfs | pad-rootfs | pad-to 128k | xapimg
  DEVICE_TITLE := Xirrus XR2400
endef
TARGET_DEVICES += xirrus_xr2400

Bootlog:

Xirrus Boot Loader 7.1.0-7066 (Apr 06 2016 - 16:34:06)

Board       | Xirrus CN5220-CP CPU Board
Clocks      | CPU :  500 MHz   DDR : 800 MHz
I2C Bus     | 384 KHz, sampling at 19 MHz
Reset       | Power on
Watchdog    | Enabled (5 secs)
System DDR  |   1 GB, DDR2 Unbuffered non-ECC
FLASH       |   8 MB, CRC: OK
RTC         | Fri 2016-May-06  0:02:37 GMT
DTT         | Ambient: 14C, Junction: 37C
Compass     | 298 degrees
CPU BIST    | Pass
PCIe        | link up, 2 lanes, gen1 speed, first bus= 0, last bus= 5
Radios      |  - - - -
Network     | eth0
USB         | 2 Storage Devices found
Certs       | Not programmed
Environment | Initialized

In:    ser_xc
Out:   ser_xc
Err:   ser_xc

Press space bar to exit to bootloader:  0

[USB 0 ] File    : X*.bin
[USB 0 ] Address : 0x20000000
[USB 0 ] Loading : ############################################### done
[USB 0 ] Complete: 15.8 sec, 17.4 MB/sec
[USB 0 ] Bytes   : 288821616 (11371170 hex)
[Boot  ] Address : 0x20000000
[Image ] Name    : OpenWrt Linux-4.14.193
[Image ] Created : 2020-08-24  17:56:10 UTC
[Image ] Type    : MIPS Linux Multi-File Image (uncompressed)
[Image ] Size    : 288821552 Bytes =  275.4 MB
[Image ] Contents: File 0: 13123728 Bytes =   12.5 MB
[Image ] Contents: File 1:  7131280 Bytes =    6.8 MB
[Image ] Contents: File 2: 268566528 Bytes =  256.1 MB
[Boot  ] Image   : Verifying image ....... OK
[Boot  ] Loading : Multi-File Image .... OK
[Boot  ] Watchdog: Setting to 40 secs .... OK
[Boot  ] Execute : Transferring control to OS

[    0.000000] Linux version 4.14.193 (root@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11192-8b0278a17e)) #0 SMP Mon Aug 24 17:56:10 2020
[    0.000000] CVMSEG size: 2 cache lines (256 bytes)
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 000d0708 (Cavium Octeon+)
[    0.000000] Checking for the multiply/shift bug... no.
[    0.000000] Checking for the daddiu bug... no.
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 0000000001000000 @ 0000000002f00000 (usable)
[    0.000000]  memory: 000000000b400000 @ 0000000004800000 (usable)
[    0.000000]  memory: 0000000010000000 @ 0000000020000000 (usable)
[    0.000000]  memory: 0000000001dd6e60 @ 0000000001100000 (usable)
[    2.494652] Initramfs unpacking failed: junk in compressed archive
[    2.527132] of-flash 1f400000.nor: Can't get bank width from device tree
[    2.566521] Failed to register MTD device for flash
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level

[    6.021885] BUG: Bad page state in process udevtrigger  pfn:2fcdb
[    6.027992] page:8000000003dfffe8 count:0 mapcount:-1578180946 mapping:          (null) index:0x0
[    6.036866] flags: 0x200000000000()
[    6.040367] raw: 0000200000000000 0000000000000000 0000000000000000 a1eedead00000000
[    6.048114] raw: 8000000003e00008 8000000003e00008 0000000000000000
[    6.054381] page dumped because: nonzero mapcount
Please press Enter to activate this console.



BusyBox v1.30.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 19.07-SNAPSHOT, r11192-8b0278a17e
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#

Watchdog is still shutting down the OS after a few seconds.
Working on that...

n4gi0s · August 29, 2020, 8:10pm

Found an ATmega16A-AU Chip on the Backside, maybe that's the watchdog?

n4gi0s · September 4, 2020, 9:37pm

root@buildhost:~/openwrt# ./scripts/diffconfig.sh

CONFIG_TARGET_octeon=y
CONFIG_TARGET_octeon_DEVICE_xirrus=y
CONFIG_TARGET_BOARD="octeon"
CONFIG_PACKAGE_i2c-tools=m
CONFIG_PACKAGE_kmod-i2c-core=m
CONFIG_PACKAGE_libi2c=m

Replace the content of your .config file with this to enable I2C support.
After that run this

make defconfig

n4gi0s · September 10, 2020, 5:58pm

Watchdog I2C Commands:

bootloader hello:
i2ctransfer -a -v -y 0 w3@48 8 244 1

system hello:
i2ctransfer -a -v -y 0 w3@48 8 184 11

disable watchdog:
i2ctransfer -a -v -y 0 w2@48 2 80

enable watchdog:
i2ctransfer -a -v -y 0 w2@48 2 64

is watchdog enabled?

i2ctransfer -a -v -y 0 w1@48 2
i2ctransfer -a -v -y 0 r1@48

=> (Hex) 50 = watchdog disabled, 40 = watchdog enabled

Thanks @Howaner

n4gi0s · September 10, 2020, 5:59pm

New Problem:
instant kernel panic when plugging in the PCIe wifi-cards >.>

jamesyoung · September 20, 2020, 8:07am

Hey mate!
What file do I use? initramfs-kernel or squashfs-factory?
Also how did you boot it?

n4gi0s · September 20, 2020, 6:57pm

I am able to load the factory image from this post.
But only when I remove all the PCIe radios from the device.
It should be bootable on all Xirrus access points.
You have to load it via SFTP or directly via the internal USB-drive onto the device.

jamesyoung · September 20, 2020, 7:18pm

Thanks. I will solder on a smd mounted usb port today, copy and then boot it.
Did you use Xircon to get to the bootloader?

n4gi0s · September 20, 2020, 7:55pm

My device has an serial console port, but xircon should work as well for the bootloader part.

jamesyoung · September 20, 2020, 8:14pm

What is the pinout? I have 4 pins, cant work out what each is.
Also would I be correct in assuming 115200 baud for serial?

n4gi0s · September 26, 2020, 10:28am

The serial baud rate is 115200 that's correct.
Just do this https://www.reddit.com/r/sysadmin/comments/65yz6x/one_of_our_network_vendors_included_a_door_in/
and load the file onto the internal flash that way.

jamesyoung · September 26, 2020, 9:34pm

Yep, loaded but I am unsure on how to get to the serial console. My AP has a 4x1 header and I cannot figure out the pinout. One pin is ground for sure and the other 3 are all at 3.3v constantly.

n4gi0s · October 22, 2020, 6:07pm

n4gi0s · October 23, 2020, 6:40pm

This is working fine without any PCIe cards.
Missing support for USB & network.

diff --git a/target/linux/octeon/config-4.14 b/target/linux/octeon/config-4.14
index e2b926f8fc..fda9a980fd 100644
--- a/target/linux/octeon/config-4.14
+++ b/target/linux/octeon/config-4.14
@@ -161,6 +161,10 @@ CONFIG_HZ=250
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 CONFIG_HZ_PERIODIC=y
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_OCTEON=y
 CONFIG_IMAGE_CMDLINE_HACK=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_IOMMU_HELPER=y
@@ -236,6 +240,7 @@ CONFIG_PADATA=y
 # CONFIG_PARTITION_ADVANCED is not set
 CONFIG_PCI=y
 CONFIG_PCI_BUS_ADDR_T_64BIT=y
+CONFIG_PCI_DEBUG=y
 CONFIG_PCI_DOMAINS=y
 CONFIG_PCI_DRIVERS_LEGACY=y
 CONFIG_PERF_USE_VMALLOC=y
@@ -248,6 +253,8 @@ CONFIG_QUEUED_RWLOCKS=y
 CONFIG_QUEUED_SPINLOCKS=y
 CONFIG_RCU_NEED_SEGCBLIST=y
 CONFIG_RCU_STALL_COMMON=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
 CONFIG_RELAY=y
 CONFIG_RFS_ACCEL=y
 CONFIG_RPS=y
@@ -287,13 +294,26 @@ CONFIG_USB_COMMON=y
 CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_EHCI_PCI=y
+CONFIG_USB_HSIC_USB3503=y
+CONFIG_USB_HSIC_USB4604=y
+CONFIG_USB_HUB_USB251XB=y
 CONFIG_USB_OCTEON_EHCI=y
 CONFIG_USB_OCTEON_OHCI=y
 CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_OHCI_HCD_PLATFORM=y
+CONFIG_USB_PCI=y
 CONFIG_USB_STORAGE=y
+CONFIG_USB_STORAGE_DEBUG=y
+CONFIG_USB_STORAGE_FREECOM=y
+CONFIG_USB_STORAGE_ISD200=y
+CONFIG_USB_STORAGE_JUMPSHOT=y
+CONFIG_USB_STORAGE_SDDR09=y
+CONFIG_USB_STORAGE_SDDR55=y
+CONFIG_USB_STORAGE_USBAT=y
 CONFIG_USB_SUPPORT=y
+# CONFIG_USB_UHCI_HCD is not set
 CONFIG_USE_OF=y
 CONFIG_VFAT_FS=y
 CONFIG_VM_EVENT_COUNTERS=y
diff --git a/target/linux/octeon/image/Makefile b/target/linux/octeon/image/Makefile
index 299e9ba396..67dd8a4813 100644
--- a/target/linux/octeon/image/Makefile
+++ b/target/linux/octeon/image/Makefile
@@ -42,4 +42,18 @@ define Device/erlite
 endef
 TARGET_DEVICES += erlite
 
+define Build/xapimg
+       cp $@ $@-rootfs.bin
+       mkimage -A mips -O Linux -T multi -C none -n '$(VERSION_DIST) Linux-$(LINUX_VERSION)' -e 0 -a 0 -d $(KDIR)/vmlinux-initramfs.elf:$<:$@-rootfs.bin $@
+endef
+
+define Device/xirrus_xr2400
+  IMAGES := factory.bin
+  IMAGE/factory.bin := append-rootfs | pad-rootfs | pad-to 128k | xapimg
+  DEVICE_TITLE := Xirrus XR2400
+  BOARD_NAME := xirrus_xr2400
+endef
+TARGET_DEVICES += xirrus_xr2400
+
+
 $(eval $(call BuildImage))

n4gi0s · October 24, 2020, 11:05am

I'm stuck at

[    0.756898] CPU1 revision is: 000d0708 (Cavium Octeon+)
[    0.757069] smp: Brought up 1 node, 2 CPUs
[    0.770279] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.779889] futex hash table entries: 512 (order: 4, 65536 bytes)
[    0.786411] NET: Registered protocol family 16
[    0.800207] PCIe: Initializing port 0
[    0.830253] PCIe: Port 0 aligning TLP counters as workaround to maintain ordering

physx · July 30, 2021, 8:21pm

I'm just wondering if this thread is still alive, I've got a Xirrus XH2-120 that I'd like to install openwrt on. I have serial access and am considering replacing uboot, but the problem is that it uses a parallel eeprom chip, which I can't easily backup/restore like an 8-pin serial chip. I can reflash it using the built-in linux OS, but if something goes wrong, it's probably bricked for good.