Good catch! I was trying to find your boot log, but looks like you're on the right track there.
A default build of OpenWrt will have dropbear installed for SSH and will listen on 192.168.1.1. You might have to poke around a bit if the network config isn't quite right (assign IP address or the like), but you should be able to do that over serial.
Seeing
Please press Enter to activate this console.
is light at the end of the tunnel.
Is the only port not configured as WAN? Serial is read-only for another few days... waiting on a properly working dongle, the one I have fails to transmit.
It's configured by some default right now.
target/linux/ath79/base-files/etc/board.d/02_network
and it will probably be
ucidef_set_interface_lan "eth0"
to get the only Ethernet port to be LAN and then, as a result, bridged and firewall-free for SSH.
Headed to sleep now here, great progress
1 Like
Tried (gpio:device) 0:0~c and 0~5:5 with no success... Is there a mode or script to automate PHY search or map existing devices on every GPIO? Or get wireless up and dump through it?
I played with I/O mapping for quite a bit and found that my problem was an extra virtual interface between the AR8035 and the SOC which was present in RE350K but not required in C-65... Got a better boot now.
Still need:
- Properly define 2nd flash chip
- Dump both flash chips while working only in RAM and get them via SCP (never used linux extensively, need a dummy guide)
- Probe GPIOs for LEDs
- Define LEDs with respective found GPIOs in .dts
1 Like
Today I tested GPIOs for LEDs using the guide in the old wiki... The device has 4 LEDs of which one can be Green or Orange (read: has 5 LEDs). I tested all (0-31) gpio values anaged to identified 3 out of 5.
my findings: 
Summary
0 - 1- Power Orange/0- "Power" OFF
1 - nothing 01
2 - 1- 2.4G Green/0- 2.4G OFF
3 - nothing 01
4 - not permitted
5 - persistent 1
6 - persistent 0
7 - persistent 0
8 - not permitted
9 - not permitted
10 - persistent 1
11 - nothing 01
12 - not permitted
13 - not permitted
14 - nothing 01
15 - 1- Ethernet OFF/ 0 Ethernet Green
16 - nothing 01
17 - not permitted
18 - nothing 01
19 - nothing 01
20 - nothing 01
21 - nothing 01
22 - not permitted
23 - nothing 01
24 - persistent 0
25 - persistent 0
26 - persistent 0
27 - persistent 0
28 - persistent 0
29 - persistent 1
30 - persistent 0
31 - persistent 0
I also dumped exiting partitions from within Luci.
I did try to mount and read them on the device but it returned an error related to zlib missing... tried to make a build with zlib selected through "make menuconfig" but it did not help...
root@OpenWrt:/# mount -t jffs2 /dev/mtdblock3 /tmp/rootfs[ 126.752357] random: crng init done
[ 126.755819] random: 1 urandom warning(s) missed due to ratelimiting
[ 133.842663] jffs2: notice: (1341) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
root@OpenWrt:/# [ 197.557858] jffs2: compression type 0x06 not available
[ 197.563103] jffs2: Error: jffs2_decompress returned -5
[ 133.842663] jffs2: notice: (1341) jffs2_build_xattr_subsystem
How to get zlib to work? What and how can I fetch from the stock Flash0 partitions? How to get the other LEDs to work? How to get the 2nd memory chip to detect?
Done for today...
Extract with binwalk on a desktop machine.
The other LEDs may be connected âdirectlyâ to the switch or wireless chips. They may also be connected to a GPIO youâve assigned already.
Second memory chip might as I outlined above, increase num-cs, define the CS lines, set reg for the second chip.
Jeff, thanks for pointing me in the right direction,
Not sure which values to use in flash1@ and respective reg<>...
Binwalk does not give me too much:
osboxes@osboxes:~$ binwalk --dd='.*' /home/osboxes/Documents/flash0.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
116320 0x1C660 Certificate in DER format (x509 v3), header length: 4, sequence length: 64
136464 0x21510 U-Boot version string, "U-Boot 1.1.4--LSDK-10.2.85 (Sep 3 2014 - 16:45:27)"
136720 0x21610 CRC32 polynomial table, big endian
osboxes@osboxes:~$ binwalk --dd='.*' /home/osboxes/Documents/flash1.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
65536 0x10000 JFFS2 filesystem, big endian
osboxes@osboxes:~$ binwalk --dd='.*' /home/osboxes/Documents/flash2.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0xDFCA2A3B, created: 2019-04-17 07:00:31, image size: 1045318 bytes, Data Address: 0x80002000, Entry Point: 0x80223070, data CRC: 0x1D14749A, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
64 0x40 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3019264 bytes
1252524 0x131CAC Certificate in DER format (x509 v3), header length: 4, sequence length: 4
1757216 0x1AD020 Linux kernel version 2.6.31
1812192 0x1BA6E0 CRC32 polynomial table, little endian
2004496 0x1E9610 Unix path: /dev/vc/0
2081011 0x1FC0F3 Neighborly text, "neighbor %.2x%.2x.%.2x:%.2x:%.2x:%.2x:%.2x:%.2x lost on port %d(%s)(%s)"
osboxes@osboxes:~$ binwalk --dd='.*' /home/osboxes/Documents/flash3.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 JFFS2 filesystem, big endian
2783088 0x2A7770 JFFS2 filesystem, big endian
13411368 0xCCA428 JFFS2 filesystem, big endian
osboxes@osboxes:~$ binwalk --dd='.*' /home/osboxes/Documents/flash4.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
I do not know how to use it and man did not really help...
I (meanwhile) defined the LEDs and reset button.
Working on getting the 5G wireless to the build with ath10k...
My current .dts
I always have to look up the options, but I think something close to would be
binwalk -eM path/to/raw/image
Another tool is unsquashfs, but I think binwalk ends up calling it (so you probably need to install both).
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18 is a Macronix mx25l12805d -- https://elixir.bootlin.com/linux/v4.19.47/source/drivers/mtd/spi-nor/spi-nor.c#L1089
I'd try
&spi {
status = "okay";
num-cs = <2>;
cs-gpios = <0>, <0>;
flash@0 {
compatible = "macronix, mx25l12805d", "jedec,spi-nor";
reg = <0>;
spi-max-frequency = <25000000>;
partitions {
[...]
};
};
flash@1 {
compatible = "macronix,mx25l12805d", "jedec,spi-nor";
reg = <1>;
spi-max-frequency = <25000000>;
partitions {
[...]
};
};
};Tried that... it returns an error 
So far got both ath9 and ath10 loaded and both wifi chips are working, 5G LED connected directly as you mentioned.
Got some errors on the in the boot log from ath10k...
U-Boot 1.1.4--LSDK-10.2.85 (Sep 3 2014 - 16:45:27)
EAP1018A1-FLF-FW - Scorpion 1.0
DRAM: 128 MB
cpu_pll_cfg: 0x21480 cpu_pll_dither: 0x3c103f
CFG_PLL_FREQ: 0x2 CFG_HZ: 360000000
CPU Clock: 720MHz DDR Clock: 680MHz
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
flash-2 size 16MB, sector count = 256
Flash: 16 *2 MB
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0x1
Fetching MAC Address from 0x87fedb6c
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ----> 8035 PHY *
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:11:74:ed:20:3f
ATHR_AUTONEG_ADVERT:1DE1
ATHR_1000BASET_CONTROL:200
ATHR_PHY_CONTROL:3100
ATHRSF1_PHY: Port 5, Neg Success
ATHRSF1_PHY: unit 0 phy addr 5 eth0 up
eth0
Setting 0x18116290 to 0x1020214f
Hit any key to stop autoboot: 0
multiboot=1
Trying eth0
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'c65_atnboot.bin'.
Load address: 0x81000000
Loading: T #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
###########################
done
Bytes transferred = 4464123 (441dfb hex)
## Checking Image at 81000000 ...
Image Name: MIPS OpenWrt Linux-4.14.121
Created: 2019-05-31 19:01:33 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 4464059 Bytes = 4.3 MB
Load Address: 80060000
Entry Point: 80060000
Verifying Checksum ... OK
## Booting image at 81000000 ...
Image Name: MIPS OpenWrt Linux-4.14.121
Created: 2019-05-31 19:01:33 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 4464059 Bytes = 4.3 MB
Load Address: 80060000
Entry Point: 80060000
Verifying Checksum at 0x81000040 ...OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728
Starting kernel ...
[ 0.000000] Linux version 4.14.121 (osboxes@osboxes) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r10114-a1210f8888)) #0 Fri May 31 19:01:33 2019
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[ 0.000000] MIPS: machine is AirTight C-65
[ 0.000000] SoC: Qualcomm Atheros QCA9558 ver 1 rev 0
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] random: get_random_bytes called from start_kernel+0x90/0x478 with crng_init=0
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32512
[ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 114220K/131072K available (3792K kernel code, 151K rwdata, 912K rodata, 10176K init, 204K bss, 16852K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 51
[ 0.000000] CPU clock: 720.000 MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5309056796 ns
[ 0.000007] sched_clock: 32 bits at 360MHz, resolution 2ns, wraps every 5965232126ns
[ 0.008287] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[ 0.074976] pid_max: default: 32768 minimum: 301
[ 0.080050] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.087086] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.097895] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.108388] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.114926] pinctrl core: initialized pinctrl subsystem
[ 0.121190] NET: Registered protocol family 16
[ 0.131448] PCI host bridge /ahb/apb/pcie-controller@180c0000 ranges:
[ 0.138309] MEM 0x0000000010000000..0x0000000011ffffff
[ 0.143891] IO 0x0000000000000000..0x0000000000000000
[ 0.149744] PCI host bridge /ahb/apb/pcie-controller@18250000 ranges:
[ 0.156630] MEM 0x0000000012000000..0x0000000013ffffff
[ 0.162181] IO 0x0000000000000001..0x0000000000000001
[ 0.167742] ar724x-pci 18250000.pcie-controller: PCIe link is down
[ 0.186721] PCI host bridge to bus 0000:00
[ 0.191117] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[ 0.198426] pci_bus 0000:00: root bus resource [io 0x0000]
[ 0.204357] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 0.211573] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.220403] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[ 0.228197] pci 0000:00:00.0: BAR 6: assigned [mem 0x10200000-0x1020ffff pref]
[ 0.236027] PCI host bridge to bus 0000:01
[ 0.240387] pci_bus 0000:01: root bus resource [mem 0x12000000-0x13ffffff]
[ 0.247712] pci_bus 0000:01: root bus resource [io 0x0001]
[ 0.253631] pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0]
[ 0.260855] pci_bus 0000:01: No busn resource found for root bus, will use [bus 01-ff]
[ 0.271262] clocksource: Switched to clocksource MIPS
[ 0.277427] NET: Registered protocol family 2
[ 0.282676] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.290092] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.296893] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.303759] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.309980] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.316861] NET: Registered protocol family 1
[ 0.479955] Crashlog allocated RAM at address 0x3f00000
[ 0.486570] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[ 0.497238] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.503467] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.594899] io scheduler noop registered
[ 0.599070] io scheduler deadline registered (default)
[ 0.606301] pinctrl-single 1804002c.pinmux: 544 pins at pa b804002c size 68
[ 0.614563] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.621912] console [ttyS0] disabled
[ 0.625745] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A
[ 0.634946] console [ttyS0] enabled
[ 0.634946] console [ttyS0] enabled
[ 0.642367] bootconsole [early0] disabled
[ 0.642367] bootconsole [early0] disabled
[ 0.654468] ath79-spi 1f000000.spi: cs64 >= max 2
[ 0.659250] spi_master spi0: spi_device register error /ahb/spi@1f000000/flash@1000000
[ 0.667323] spi_master spi0: Failed to create SPI device for /ahb/spi@1f000000/flash@1000000
[ 0.677395] m25p80 spi0.0: mx25l12805d (16384 Kbytes)
[ 0.682592] 5 fixed-partitions partitions found on MTD device spi0.0
[ 0.689031] Creating 5 MTD partitions on "spi0.0":
[ 0.693910] 0x000000000000-0x000000040000 : "u-boot"
[ 0.699578] 0x000000040000-0x000000060000 : "uboot-env"
[ 0.705507] 0x000000060000-0x000000260000 : "kernel"
[ 0.711132] 0x000000260000-0x000000ff0000 : "rootfs"
[ 0.716772] mtd: device 3 (rootfs) set to be root filesystem
[ 0.722594] mtdsplit: no squashfs found in "rootfs"
[ 0.727563] 0x000000ff0000-0x000001000000 : "art"
[ 0.733788] libphy: Fixed MDIO Bus: probed
[ 0.739821] ag71xx 19000000.eth: invalid MAC address, using random address
[ 1.082939] libphy: ag71xx_mdio: probed
[ 1.211993] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:05 [uid=004dd072, driver=Atheros 8035 ethernet]
[ 1.222745] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii-id
[ 1.230885] NET: Registered protocol family 10
[ 1.238473] Segment Routing with IPv6
[ 1.242310] NET: Registered protocol family 17
[ 1.246853] 8021q: 802.1Q VLAN Support v1.8
[ 1.283288] Freeing unused kernel memory: 10176K
[ 1.287977] This architecture does not have kernel memory protection.
[ 1.304930] init: Console is alive
[ 1.308533] init: - watchdog -
[ 1.336687] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 1.345445] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 1.353961] init: - preinit -
[ 1.517182] random: jshn: uninitialized urandom read (4 bytes read)
[ 1.565807] random: jshn: uninitialized urandom read (4 bytes read)
[ 1.587445] random: jshn: uninitialized urandom read (4 bytes read)
[ 1.700860] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 3.631260] random: fast init done
[ 4.820798] procd: - early -
[ 4.824325] procd: - watchdog -
[ 5.362965] procd: - watchdog -
[ 5.366348] procd: - ubus -
[ 5.374402] urandom_read: 4 callbacks suppressed
[ 5.374408] random: ubusd: uninitialized urandom read (4 bytes read)
[ 5.419407] random: ubusd: uninitialized urandom read (4 bytes read)
[ 5.426241] random: ubusd: uninitialized urandom read (4 bytes read)
[ 5.433503] procd: - init -
Please press Enter to activate this console.
[ 5.593662] kmodloader: loading kernel modules from /etc/modules.d/*
[ 5.603491] l2tp_core: L2TP core driver, V2.0
[ 5.609276] l2tp_netlink: L2TP netlink interface
[ 5.619027] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 5.629969] Netfilter messages via NETLINK v0.30.
[ 5.636878] ip_set: protocol 6
[ 5.666671] Loading modules backported from Linux version v4.19.32-0-g3a2156c839c7
[ 5.674382] Backport generated by backports.git v4.19.32-1-0-g1c4f7569
[ 5.685175] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 5.699974] nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
[ 5.779128] xt_time: kernel timezone is -0000
[ 5.831603] PPP generic driver version 2.4.2
[ 5.838016] NET: Registered protocol family 24
[ 5.865081] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[ 5.870980] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[ 6.144416] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/pre-cal-pci-0000:00:00.0.bin failed with error -2
[ 6.155291] ath10k_pci 0000:00:00.0: Falling back to user helper
[ 6.249935] firmware ath10k!pre-cal-pci-0000:00:00.0.bin: firmware_loading_store: map pages failed
[ 6.259262] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/cal-pci-0000:00:00.0.bin failed with error -2
[ 6.269782] ath10k_pci 0000:00:00.0: Falling back to user helper
[ 6.487314] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware-6.bin failed with error -2
[ 6.498197] ath10k_pci 0000:00:00.0: Falling back to user helper
[ 6.634055] firmware ath10k!QCA988X!hw2.0!firmware-6.bin: firmware_loading_store: map pages failed
[ 6.645146] ath10k_pci 0000:00:00.0: qca988x hw2.0 target 0x4100016c chip_id 0x043222ff sub 0000:0000
[ 6.654540] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 1
[ 6.667543] ath10k_pci 0000:00:00.0: firmware ver 10.2.4-1.0-00043 api 5 features no-p2p,raw-mode,mfp,allows-mesh-bcast crc32 ed0aafd8
[ 6.761431] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/board-2.bin failed with error -2
[ 6.772042] ath10k_pci 0000:00:00.0: Falling back to user helper
[ 6.892307] firmware ath10k!QCA988X!hw2.0!board-2.bin: firmware_loading_store: map pages failed
[ 6.901484] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08
[ 8.015587] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 5 htt-op 2 cal file max-sta 128 raw 0 hwcrypto 1
[ 8.191895] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 8.250337] ieee80211 phy1: Atheros AR9550 Rev:0 mem=0xb8100000, irq=14
[ 8.298108] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 27.944093] eth0: link up (1000Mbps/Full duplex)
[ 27.951643] br-lan: port 1(eth0) entered blocking state
[ 27.956951] br-lan: port 1(eth0) entered disabled state
[ 27.962518] device eth0 entered promiscuous mode
[ 27.996135] br-lan: port 1(eth0) entered blocking state
[ 28.001477] br-lan: port 1(eth0) entered forwarding state
[ 28.007076] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[ 29.001333] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[ 115.666585] IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
[ 115.722293] br-lan: port 2(wlan1) entered blocking state
[ 115.727690] br-lan: port 2(wlan1) entered disabled state
[ 115.733357] device wlan1 entered promiscuous mode
[ 120.701329] random: crng init done
[ 123.942276] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 123.948919] br-lan: port 2(wlan1) entered blocking state
[ 123.954360] br-lan: port 2(wlan1) entered forwarding state
[ 153.144153] device wlan1 left promiscuous mode
[ 153.148736] br-lan: port 2(wlan1) entered disabled state
[ 153.993883] IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
[ 154.047648] br-lan: port 2(wlan1) entered blocking state
[ 154.053154] br-lan: port 2(wlan1) entered disabled state
[ 154.058774] device wlan1 entered promiscuous mode
[ 154.063710] br-lan: port 2(wlan1) entered blocking state
[ 154.069104] br-lan: port 2(wlan1) entered forwarding state
[ 154.461294] br-lan: port 2(wlan1) entered disabled state
[ 162.282354] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 162.288932] br-lan: port 2(wlan1) entered blocking state
[ 162.294364] br-lan: port 2(wlan1) entered forwarding state
[ 209.167381] ath10k_pci 0000:00:00.0: pdev param 0 not supported by firmware
[ 209.190052] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 209.200188] br-lan: port 3(wlan0) entered blocking state
[ 209.205627] br-lan: port 3(wlan0) entered disabled state
[ 209.211295] device wlan0 entered promiscuous mode
[ 289.803897] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 289.810531] br-lan: port 3(wlan0) entered blocking state
[ 289.815957] br-lan: port 3(wlan0) entered forwarding state
[ 571.618531] device wlan1 left promiscuous mode
[ 571.623184] br-lan: port 2(wlan1) entered disabled state
[ 572.708454] IPv6: ADDRCONF(NETDEV_UP): wlan1-1: link is not ready
[ 572.766365] br-lan: port 2(wlan1-1) entered blocking state
[ 572.772032] br-lan: port 2(wlan1-1) entered disabled state
[ 572.777949] device wlan1-1 entered promiscuous mode
[ 572.879578] IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
[ 574.266826] wlan1: authenticate with bc:ae:c5:eb:0b:af
[ 574.297272] wlan1: send auth to bc:ae:c5:eb:0b:af (try 1/3)
[ 574.305182] wlan1: authenticated
[ 574.311398] wlan1: associate with bc:ae:c5:eb:0b:af (try 1/3)
[ 574.319643] wlan1: RX AssocResp from bc:ae:c5:eb:0b:af (capab=0xc11 status=0 aid=5)
[ 574.327592] wlan1: associated
[ 574.679364] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 574.689075] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1-1: link becomes ready
[ 574.695869] br-lan: port 2(wlan1-1) entered blocking state
[ 574.701453] br-lan: port 2(wlan1-1) entered forwarding state
Headed to rest.
After cleanup I will also need to figure out how to make a flashable image and flash it 
The ath10k âerror -2â lines are normal. It has a list of places to look for each of several files it needs and -2 is file not found for that option as it checks all the possible places. Unfortunately it doesnât report success!!
Stuck on creating a firmware that will be able to flash itself onto the router... or, better, will set uboot variables and also flash itself (aka oem to openwrt)
My progress so far:
- Backed up all partitions using luci while running from ramdisk.
- The uboot was trying to move around some files if booting from flash (it was part of the scripts in u-boot configuration) so I removed that part from uboot env
- I changed the partition layout in the image to unite âkernelâ and ârootfsâ in one called âfirmwareâ
- I flashed the openwrt image with uboot directly to flash memory at the firmware partition start address
- Tried to boot - kernel panic :-/
[ 1.012838] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[ 1.020433] Please append a correct "root=" boot option; here are the available partitions:
[ 1.028942] 1f00 256 mtdblock0
[ 1.028946] (driver?)
[ 1.035582] 1f01 128 mtdblock1
[ 1.035586] (driver?)
[ 1.042227] 1f02 13952 mtdblock2
[ 1.042230] (driver?)
[ 1.048861] 1f03 64 mtdblock3
[ 1.048864] (driver?)
[ 1.055494] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 1.064615] Rebooting in 1 seconds..
post the kernel cmdline dmesg output from the above boot sequence .... usually this error is due to an incorrect cmdline ...
1 Like
All I have:
U-Boot 1.1.4--LSDK-10.2.85 (Sep 3 2014 - 16:45:27)
EAP1018A1-FLF-FW - Scorpion 1.0
DRAM: 128 MB
cpu_pll_cfg: 0x21480 cpu_pll_dither: 0x3c103f
CFG_PLL_FREQ: 0x2 CFG_HZ: 360000000
CPU Clock: 720MHz DDR Clock: 680MHz
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
flash-2 size 16MB, sector count = 256
Flash: 16 *2 MB
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0x1
Fetching MAC Address from 0x87fedb6c
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ----> 8035 PHY *
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:11:74:ed:20:3f
ATHR_AUTONEG_ADVERT:1DE1
ATHR_1000BASET_CONTROL:200
ATHR_PHY_CONTROL:3100
ATHRSF1_PHY: Port 5, Neg Success
ATHRSF1_PHY: unit 0 phy addr 5 eth0 up
eth0
Setting 0x18116290 to 0x1020214f
Hit any key to stop autoboot: 0
multiboot=1
Trying eth0
eth0 link down
FAIL
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'c65_atnboot.bin'.
Load address: 0x81000000
Loading: Tx Timed out
T Tx Timed out
Retry count exceeded; starting again
## Booting image at 9f060000 ...
Image Name: MIPS OpenWrt Linux-4.14.121
Created: 2019-05-31 19:01:33 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1618878 Bytes = 1.5 MB
Load Address: 80060000
Entry Point: 80060000
Verifying Checksum at 0x9f060040 ...OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728
Starting kernel ...
[ 0.000000] Linux version 4.14.121 (osboxes@osboxes) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r10114-a1210f8888)) #0 Fri May 31 19:01:33 2019
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[ 0.000000] MIPS: machine is AirTight C-65
[ 0.000000] SoC: Qualcomm Atheros QCA9558 ver 1 rev 0
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] random: get_random_bytes called from start_kernel+0x90/0x478 with crng_init=0
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32512
[ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 123180K/131072K available (3792K kernel code, 151K rwdata, 912K rodata, 1216K init, 204K bss, 7892K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 51
[ 0.000000] CPU clock: 720.000 MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5309056796 ns
[ 0.000007] sched_clock: 32 bits at 360MHz, resolution 2ns, wraps every 5965232126ns
[ 0.008287] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[ 0.074976] pid_max: default: 32768 minimum: 301
[ 0.080050] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.087086] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.097868] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.108363] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.114901] pinctrl core: initialized pinctrl subsystem
[ 0.121159] NET: Registered protocol family 16
[ 0.131415] PCI host bridge /ahb/apb/pcie-controller@180c0000 ranges:
[ 0.138276] MEM 0x0000000010000000..0x0000000011ffffff
[ 0.143858] IO 0x0000000000000000..0x0000000000000000
[ 0.149713] PCI host bridge /ahb/apb/pcie-controller@18250000 ranges:
[ 0.156596] MEM 0x0000000012000000..0x0000000013ffffff
[ 0.162147] IO 0x0000000000000001..0x0000000000000001
[ 0.167708] ar724x-pci 18250000.pcie-controller: PCIe link is down
[ 0.186656] PCI host bridge to bus 0000:00
[ 0.191057] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[ 0.198367] pci_bus 0000:00: root bus resource [io 0x0000]
[ 0.204297] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 0.211514] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.220346] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[ 0.228138] pci 0000:00:00.0: BAR 6: assigned [mem 0x10200000-0x1020ffff pref]
[ 0.235958] PCI host bridge to bus 0000:01
[ 0.240319] pci_bus 0000:01: root bus resource [mem 0x12000000-0x13ffffff]
[ 0.247645] pci_bus 0000:01: root bus resource [io 0x0001]
[ 0.253572] pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0]
[ 0.260796] pci_bus 0000:01: No busn resource found for root bus, will use [bus 01-ff]
[ 0.271212] clocksource: Switched to clocksource MIPS
[ 0.277371] NET: Registered protocol family 2
[ 0.282626] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.290041] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.296842] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.303703] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.309918] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.316812] NET: Registered protocol family 1
[ 0.323580] Crashlog allocated RAM at address 0x3f00000
[ 0.330030] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[ 0.340702] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.346934] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.363618] io scheduler noop registered
[ 0.367792] io scheduler deadline registered (default)
[ 0.375017] pinctrl-single 1804002c.pinmux: 544 pins at pa b804002c size 68
[ 0.383285] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.390586] console [ttyS0] disabled
[ 0.394452] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A
[ 0.403640] console [ttyS0] enabled
[ 0.403640] console [ttyS0] enabled
[ 0.411044] bootconsole [early0] disabled
[ 0.411044] bootconsole [early0] disabled
[ 0.424410] m25p80 spi0.0: mx25l12805d (16384 Kbytes)
[ 0.429566] 4 fixed-partitions partitions found on MTD device spi0.0
[ 0.436039] Creating 4 MTD partitions on "spi0.0":
[ 0.440904] 0x000000000000-0x000000040000 : "u-boot"
[ 0.446595] 0x000000040000-0x000000060000 : "uboot-env"
[ 0.452527] 0x000000260000-0x0000011f0000 : "firmware"
[ 0.457740] mtd: partition "firmware" extends beyond the end of device "spi0.0" -- size truncated to 0xda0000
[ 0.506059] 0x000000ff0000-0x000001000000 : "art"
[ 0.511932] m25p80 spi0.1: unrecognized JEDEC id bytes: 00, 00, 00
[ 0.518222] m25p80: probe of spi0.1 failed with error -2
[ 0.524487] libphy: Fixed MDIO Bus: probed
[ 0.530496] ag71xx 19000000.eth: invalid MAC address, using random address
[ 0.872888] libphy: ag71xx_mdio: probed
[ 0.971943] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:05 [uid=004dd072, driver=Atheros 8035 ethernet]
[ 0.982696] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii-id
[ 0.990855] NET: Registered protocol family 10
[ 0.998414] Segment Routing with IPv6
[ 1.002249] NET: Registered protocol family 17
[ 1.006794] 8021q: 802.1Q VLAN Support v1.8
[ 1.012939] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[ 1.020524] Please append a correct "root=" boot option; here are the available partitions:
[ 1.029034] 1f00 256 mtdblock0
[ 1.029038] (driver?)
[ 1.035674] 1f01 128 mtdblock1
[ 1.035677] (driver?)
[ 1.042318] 1f02 13952 mtdblock2
[ 1.042321] (driver?)
[ 1.048952] 1f03 64 mtdblock3
[ 1.048954] (driver?)
[ 1.055586] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 1.064706] Rebooting in 1 seconds..
one way to go might be to enable cmdline bootargs ( if needed in make kernel_menuconfig )
then muck about with manually feeding the partlayout while your in the testing phase.....
( example from one of jeffs posts ... not sure how relevant to what you have now but a starting point )
console=ttyS0,115200 root=31:03 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:256k(u-boot),128k(uboot-env),2048k(kernel),13888k(rootfs),64k(ART);ath-nor1:16M(opt) mem=128M
Don't save your ubootvars... just setenv over serial each boot while your testing.....
That's what i'd try anyway...... otherwise you have to go the long way ( i.e. non relevant sample CF-E110NV2 flashing issue ) or similar..... my uboot will take a dts option.... so that can speed things that way a tad ( load from tftp ) .... setenv is the fastest....
Last step, in my book. Sometimes the most annoying. I spent days of nights looking through the assembly and low-level C code for the early init process trying to figure out how to get the EA8300 to boot an OpenWrt image without any serial access as its boot loader was sending the "wrong" command line. That's a nicety, but not a requirement.
There's some major "black magic" in the way that OpenWrt patches early init for various platforms. Some completely ignore the passed command-line args, others "munge" it in subtle or brutal ways. Unfortunately for someone working with a single board, the same kernel is used for all boards on a given target/subtarget, so you can't really tweak it on a board-by-board basis.
At least fgrep -ri cmd target/linux/ath79/patches-4.14/ didn't raise any red flags.
For development/test purposes, poking at what U-Boot is sending through setenv as wulfy23 suggests to (a) see if you can change at all, and (b) change to something "useful"
[ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
Now, put all that knowledge aside for a minute and look at
[ 0.452527] 0x000000260000-0x0000011f0000 : "firmware"
[ 0.457740] mtd: partition "firmware" extends beyond the end of device "spi0.0" -- size truncated to 0xda0000
Thanks wulfy23
I did play with it for a bit until jeff posted his comment...
Fixed a typo in .dts, building... I can change environment variables in uboot, don't know if it is passed over to kernel though...
1 Like
Well, bricked it until I get a flasher... it self-destructed due to incorrect addressing from the typo in dts. Cant access the second chip at all for some reason but it is a mirror of the first one and I can read it, besides I do have partition images saved from luci.
.....
[ 12.041530] jffs2: You cannot use older JFFS2 filesystems with newer kernels
[ 12.081250] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x004d0000: 0x1357 instead
[ 12.090867] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x004d0004: 0x481a instead
[ 12.100485] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x004d0008: 0xbc1e instead
[ 12.110102] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x004d000c: 0xee95 instead
[ 12.119721] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x004d0010: 0xcdd7 instead
[ 12.129339] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x004d0014: 0x780e instead
[ 12.138958] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x004d0018: 0xeb78 instead
[ 12.148576] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x004d001c: 0xe5ec instead
[ 12.158194] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x004d0020: 0xca1f instead
[ 12.167812] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x004d0024: 0xa11b instead
[ 12.177429] jffs2: Further such events for this erase block will not be printed
[ 12.225445] jffs2_scan_eraseblock(): End of filesystem marker found at 0x4e0000
[ 12.232900] jffs2_build_filesystem(): unlocking the mtd device...
[ 12.232905] done.
[ 12.241115] jffs2_build_filesystem(): erasing all blocks after the end marker...
[ 117.083656] done.
[ 117.093243] jffs2: notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 117.109272] VFS: Mounted root (jffs2 filesystem) readonly on device 31:2.
[ 117.119778] Freeing unused kernel memory: 1216K
[ 117.124390] This architecture does not have kernel memory protection.
[ 117.131125] Kernel panic - not syncing: Requested init /sbin/init failed (error -2).
[ 117.143649] Rebooting in 1 seconds..
Do you still have U-Boot running?
If so, it should all be recoverable, either with an initramfs image, or using U-Boot TFTP and U-Boot commands to write to flash.