And... finally some progress!
I've flashed U-boot_mod built for WDR4300 to the SPI flash, and used that to TFTP boot the initramfs. My initial initramfs build for ath79 target started, but swconfig didn't start, so I have switch set in passthrough mode.
When I fix that, I'll write the initramfs it to the NAND, then extract the dump for it for others to flash.
Getting the unit to boot required to put a 220-ohm resistor between SPI_CLK and VCC pins (i.e. pins 6 and 8 on the chip), to override 1k pulldown, which forced the unit to boot from NAND instead.
Edit: something is definitely off with NAND configuration.
Dump of nandloader at the beginning matches the SHA256 of one found on the interwebs, but both PCI and AHB radio fail to probe due to problem with loading calibration data off of raw NAND. And UBI straight up fails to attach.
Here is the boot log:
***************************************
* U-Boot 1.1.4-7a540a78-clean *
* Build: 2018-02-23 *
***************************************
** Warning: bad env CRC, using default,
use 'saveenv' to save it in FLASH
BOARD: TP-Link TL-WDR43x0 v1
SOC: AR9344 rev. 2
CPU: MIPS 74Kc
RAM: 128 MB DDR2 32-bit CL3-4-4-10
FLASH: 8 MB Winbond W25Q64
PCIe: 168C:FF1C
MAC: 88:15:44:CC:E5:C0
CLOCKS: CPU/RAM/AHB/SPI/REF
550/400/200/ 25/ 40 MHz
Hit any key to stop booting: 0
Booting image from 0x9F020000...
Image name: MIPS OpenWrt Linux-6.6.71
Build date: 2025-01-16 19:02:17 UTC
Architecture: MIPS
OS/image type: Linux Kernel
Compression: LZMA
Data size: 6 MB (6339329 bytes)
Load address: 0x80060000
Entry point: 0x80060000
Header CRC... OK!
Data CRC... skipped
Stopping network... OK!
Uncompressing Kernel... OK!
Starting kernel...
[ 0.000000] Linux version 6.6.71 (builder@buildbot) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r28599+3-dac8021297a5) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 Thu Jan 16 19:02:17 2025
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[ 0.000000] MIPS: machine is Cisco Meraki Z1
[ 0.000000] SoC: Atheros AR9344 rev 2
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 104680K/131072K available (7232K kernel code, 585K rwdata, 1560K rodata, 15448K init, 229K bss, 26392K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 51
[ 0.000000] CPU clock: 550.000 MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6950037990 ns
[ 0.000001] sched_clock: 32 bits at 275MHz, resolution 3ns, wraps every 7809031678ns
[ 0.008788] Calibrating delay loop... 274.02 BogoMIPS (lpj=1370112)
[ 0.085684] pid_max: default: 32768 minimum: 301
[ 0.104114] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.112312] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.132493] RCU Tasks Trace: Setting shift to 0 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=1.
[ 0.147418] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.158455] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.169611] pinctrl core: initialized pinctrl subsystem
[ 0.179514] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.189287] /ahb/apb: Fixed dependency cycle(s) with /ahb/apb/interrupt-controller@18060010
[ 0.214844] clocksource: Switched to clocksource MIPS
[ 0.234827] NET: Registered PF_INET protocol family
[ 0.240642] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.249816] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.259329] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.268000] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.276572] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.284476] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.292478] MPTCP token hash table entries: 512 (order: 0, 6144 bytes, linear)
[ 0.300928] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.308283] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.317068] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.323450] PCI: CLS 0 bytes, default 32
[ 0.365413] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[ 0.374553] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.381129] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.428605] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[ 0.436672] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.445163] printk: console [ttyS0] disabled
[ 0.450676] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 10, base_baud = 2500000) is a 16550A
[ 0.460492] printk: console [ttyS0] enabled
[ 0.460492] printk: console [ttyS0] enabled
[ 0.469421] printk: bootconsole [early0] disabled
[ 0.469421] printk: bootconsole [early0] disabled
[ 0.508891] nand: device found, Manufacturer ID: 0xad, Chip ID: 0xf1
[ 0.515415] nand: Hynix NAND 128MiB 3,3V 8-bit
[ 0.519933] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[ 0.545152] Scanning device for bad blocks
[ 0.785275] 6 fixed-partitions partitions found on MTD device ar934x-nand
[ 0.792204] Creating 6 MTD partitions on "ar934x-nand":
[ 0.797553] 0x000000000000-0x000000020000 : "loader1"
[ 0.804209] 0x000000020000-0x000000800000 : "kernel"
[ 0.813307] 0x000000800000-0x000000820000 : "loader2"
[ 0.821031] 0x000000820000-0x000001000000 : "recovery"
[ 0.828915] 0x000001000000-0x000007fe0000 : "ubi"
[ 0.836890] 0x000007fe0000-0x000008000000 : "origcaldata"
[ 0.851933] ag71xx-legacy 19000000.eth: invalid MAC address, using random address
[ 1.227664] switch0: Atheros AR8327 rev. 4 switch registered on mdio.0
[ 1.912790] ag71xx-legacy 19000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[ 1.923406] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii-id
[ 1.933710] NET: Registered PF_INET6 protocol family
[ 1.949688] Segment Routing with IPv6
[ 1.953520] In-situ OAM (IOAM) with IPv6
[ 1.957774] NET: Registered PF_PACKET protocol family
[ 1.962968] 8021q: 802.1Q VLAN Support v1.8
[ 2.015056] PCI host bridge to bus 0000:00
[ 2.019244] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[ 2.026273] pci_bus 0000:00: root bus resource [io 0x0000]
[ 2.031934] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 2.040041] pci 0000:00:00.0: [168c:ff1c] type 00 class 0x020000
[ 2.046197] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x0000ffff 64bit]
[ 2.053229] pci 0000:00:00.0: supports D1
[ 2.057322] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[ 2.064444] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[ 2.071244] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1000ffff 64bit]
[ 2.086214] UBI error: unable to read from mtd4
[ 2.091087] clk: Disabling unused clocks
[ 2.174339] Freeing unused kernel image (initmem) memory: 15448K
[ 2.180491] This architecture does not have kernel memory protection.
[ 2.187067] Run /init as init process
[ 2.837144] init: Console is alive
[ 2.841059] init: - watchdog -
[ 2.871019] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 2.898446] usbcore: registered new interface driver usbfs
[ 2.904157] usbcore: registered new interface driver hub
[ 2.909717] usbcore: registered new device driver usb
[ 2.926923] gpio_button_hotplug: loading out-of-tree module taints kernel.
[ 2.948550] ehci-platform 1b000000.usb: EHCI Host Controller
[ 2.954352] ehci-platform 1b000000.usb: new USB bus registered, assigned bus number 1
[ 2.962517] ehci-platform 1b000000.usb: irq 3, io mem 0x1b000000
[ 2.994866] ehci-platform 1b000000.usb: USB 2.0 started, EHCI 1.00
[ 3.003013] hub 1-0:1.0: USB hub found
[ 3.007630] hub 1-0:1.0: 1 port detected
[ 3.021560] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 3.039653] init: - preinit -
[ 5.274879] random: crng init done
Cannot parse config file '/etc/fw_env.config': No such file or directory
Failed to find NVMEM device
[ 7.379029] eth0: link up (1000Mbps/Full duplex)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 11.623854] eth0: link down
[ 11.654386] procd: - early -
[ 11.657852] procd: - watchdog -
[ 12.264908] procd: - watchdog -
[ 12.269662] procd: - ubus -
[ 12.331290] procd: - init -
Please press Enter to activate this console.
[ 13.426511] kmodloader: loading kernel modules from /etc/modules.d/*
[ 14.174300] jitterentropy: Initialization failed with host not compliant with requirements: 9
[ 14.591671] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
[ 14.599340] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[ 14.960138] PPP generic driver version 2.4.2
[ 14.976210] NET: Registered PF_PPPOX protocol family
[ 15.089197] ath: phy0: Unable to initialize hardware; initialization status: -5
[ 15.096722] ath9k 18100000.wmac: failed to initialize device
[ 15.102507] ath9k: probe of 18100000.wmac failed with error -5
[ 15.543846] jitterentropy: Initialization failed with host not compliant with requirements: 9
[ 15.979338] urngd: v1.0.2 started.
[ 16.105248] kmodloader: 1 module could not be probed
[ 16.110644] kmodloader: - jitterentropy_rng - 0
[ 45.130424] eth0: link up (1000Mbps/Full duplex)
[ 45.150491] br-lan: port 1(eth0.1) entered blocking state
[ 45.156058] br-lan: port 1(eth0.1) entered disabled state
[ 45.161584] eth0.1: entered allmulticast mode
[ 45.166072] ag71xx-legacy 19000000.eth eth0: entered allmulticast mode
[ 45.173025] eth0.1: entered promiscuous mode
[ 45.177432] ag71xx-legacy 19000000.eth eth0: entered promiscuous mode
[ 45.244185] br-lan: port 1(eth0.1) entered blocking state
[ 45.249755] br-lan: port 1(eth0.1) entered forwarding state
One good thing is, that I can have u-boot_mod and the initramfs in the same NOR image, so u-boot_mod can load it directly, which will help installation. I had to disable OWL loader for PCI radio, because it would loop endlessly trying to load calibration data.
Another edit:
+ nand-ecc-mode = "soft";
+ nand-ecc-algo = "bch";
+ nand-is-boot-medium;
+
Above got UBI to attach and PCIe-based Wi-Fi to probe. AHB one needed qca,no-eeprom.
That was quick. It seems the support is almost ready.
I finally tried loading the initramfs image onto NAND and booting it, but got greeted by a CRC error:
find_hif: bootstrap = 0xaf055a
WASP BootROM Ver. 1.1
Nand Flash init
Table[5]: Control setting = 0xb44
hdr: [0xbd001000 : 0xbd001000 : 0x6104 : 0xb8a746df]
nand_load_fw: read 12 pages
nand_load_fw: 0x10000 0x800 0xbd0017f0
nand_load_fw: 0x20000 0x800 0xbd001ff0
nand_load_fw: 0x30000 0x800 0xbd0027f0
nand_load_fw: 0x40000 0x800 0xbd002ff0
nand_load_fw: 0x50000 0x800 0xbd0037f0
nand_load_fw: 0x60000 0x800 0xbd003ff0
nand_load_fw: 0x70000 0x800 0xbd0047f0
Table[5]: Control setting = 0xb44
retrynand_load_fw: 0x80000 0x800 0xbd004ff0
nand_load_fw: 0x90000 0x800 0xbd0057f0
nand_load_fw: 0xa0000 0x800 0xbd005ff0
Table[5]: Control setting = 0xb44
retrynand_load_fw: 0xb0000 0x800 0xbd0067f0
nand_load_fw: 0xc0000 0x800 0xbd006ff0
f/w 0 read complete, jumping to 0xbd001000
Meraki Atheros LinuxLoader built Jul 23 2012 15:31:10
init_ddr ok
test_memory ok
D-cache size: 64K
I-cache size: 32K
init_dram_uncached ok
init_icache ok
init_dcache ok
enable_caches ok
test_memory ok
init_usb_phy ok
init_pcie_plls ok
nand_flash_init ok
loading fw at 64
hdr: [0x4d495053 : 0x80060000 : 0x60d585 : 0x80060000, : 0xaae0e655]
................................................
crc mismatch! expect: aae0e655, got 5959293b
bootkernel 1 failed!
loading fw at 4160
hdr: [0x4d495053 : 0x80060000 : 0x60d585 : 0x80060000, : 0xaae0e655]
................................................
crc mismatch! expect: aae0e655, got 5959293b
bootkernel 2 failed!
error booting
...and the culprit is here: https://github.com/openwrt/firmware-utils/commit/1487e970bd7e6e9108398b2768b0af869a9c12bb
When reverted, I got the board to boot off of NAND. So finally, I can prepare a raw NAND dump to overwrite kernel images. Enough for today!
