Controlling LEDs through a 74x164 shift register

The eth[0,1] MACs are fine, it's just the WLAN ones:
root@OpenWrt:/# cat /sys/class/net/eth0/address
a0:40:a0:7b:b7:6f
root@OpenWrt:/# cat /sys/class/net/eth1/address
a0:40:a0:7b:b7:7f
root@OpenWrt:/# cat /sys/class/net/wlan0/address
00:03:7f:12:5d:5d
root@OpenWrt:/# cat /sys/class/net/wlan1/address
00:34:56:78:f7:f7

FWIW, I can't find any MAC addresses apart from eth[0,1] in the ART binary..

Tim

Hm, its weird that MAC address is not patched because eth0 is correct.
I use that same script in other architectures without an issue.

I think Netgear intended the wifi MAC offsets to be 2 and 3 like you said. I found these by grepping through the stock init scripts:
MANUFAC_MTD_CHAR=/dev/mtdblock7
MAC_OFFSET_4_WLAN0=2
MAC_OFFSET_4_WLAN1=3
MAC_OFFSET_4_ETH=0
MAC_OFFSET_4_ETH1=1
WIFI0_MAC=${BDDATARD} ${MANUFAC_MTD_CHAR} ${MAC_OFFSET_4_WLAN0}
WIFI1_MAC=${BDDATARD} ${MANUFAC_MTD_CHAR} ${MAC_OFFSET_4_WLAN1}

BDDATARD is a Netgear binary which appears to read an mtd partition..

/dev/mtd7 has eth0 MAC address in it and 2.4Ghz wifi address in it. It's here:
https://github.com/7604timo/netgear-wac510/blob/master/mtd7.dd

I'm still digging....

Tim

That makes sense

I can confirm the lan/wan LEDs both work after my hotplug addition.

I'm having trouble with the wifi MAC addresses though. I see that the hotplug script writes the MAC address to the pre-cal file, but that doesn't seem to be used for the interface. I can't set the MAC address manually in the firmware hotplug script because wlan[0,1] don't exist when it's run.

Would it be OK to add to the iface script an ifconfig line to set the MAC address when the wlan[0,1] interfaces come up, or would it be better if it happened sooner?

Also, from my testing yesterday, I noticed that the macaddr_add function in the 11-ath10k-caldata script doesn't work under the shell 'sh or ash', only bash. I managed to fix it at work, but the MAC address still isn't picked up after I fixed it. I can get my changes later and show you them..

Tim

Hm,nice catch.
Looks like it is ipq806x specific cause the same function is used in other architectures using ath10k driver

I added in an entry for the wac510 in your hotplug.d/ieee80211/10_fix_wifi_mac file and it seems to work, but I need to check it for sure by flashing OpenWrt onto this device permanently.

I tried the sysupgrade method and I've soft-bricked it. I can get into uboot, but it can't find anything to boot and just gets stuck in a reboot loop.

I know I need to tftpboot the kernel/rootfs into RAM and then copy it into flash, but I've no idea which memory locations to use.

Here's the output from sysupgrade and uboot:
root@OpenWrt:/tmp# sysupgrade -v openwrt-ipq806x-netgear_wac510-squashfs-nand-sy
supgrade.bin
Cannot save config while running from ramdisk.
Commencing upgrade. All shell sessions will be closed now.
Watchdog handover: fd=3
watchdog -
killall: telnetd: no process killed
Sending TERM to remaining processes ... dnsmasq netifd ubusd hostapd hostapd [ 795.393185] device wlan0 left promiscuous mode
[ 795.393542] br-lan: port 2(wlan0) entered disabled state
[ 795.413247] device wlan1 left promiscuous mode
[ 795.413574] br-lan: port 3(wlan1) entered disabled state
[ 795.444506] ath10k_ahb a000000.wifi: peer-unmap-event: unknown peer id 1
logd [ 795.469027] ath10k_ahb a800000.wifi: peer-unmap-event: unknown peer id 1
odhcpd ntpd
Sending KILL to remaining processes ...
Performing system upgrade...
[ 800.672550] ubi0: attaching mtd9
[ 805.712145] ubi0: scanning is finished
[ 805.778826] ubi0: attached mtd9 (name "rootfs", size 56 MiB)
[ 805.778865] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 805.783607] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 805.790246] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 805.797123] ubi0: good PEBs: 448, bad PEBs: 0, corrupted PEBs: 0
[ 805.803888] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[ 805.810126] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1011195579
[ 805.817179] ubi0: available PEBs: 194, total reserved PEBs: 254, PEBs reserved for bad PEB handling: 20
[ 805.826487] ubi0: background thread "ubi_bgt0d" started, PID 2373
UBI device number 0, total 448 LEBs (56885248 bytes, 54.2 MiB), available 194 LEBs (24633344 bytes, 23.5 MiB), LEB size 126976 bytes)
Volume ID 0, size 22 LEBs (2793472 bytes, 2.7 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
Volume ID 2, size 20 LEBs (2539520 bytes, 2.4 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 22982656
Volume ID 3, size 181 LEBs (22982656 bytes, 21.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
[ 813.133834] spi_qup 78b5000.spi: unexpected irq 00000000 00000000 00000d40
[ 824.210016] spi_qup 78b5000.spi: unexpected irq 00000000 00000000 00000d40
[ 824.257219] spi_qup 78b5000.spi: unexpected irq 00000000 00000000 00000d40
sysupgrade successful
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
umount: can't unmount /: Invalid argument
[
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1339 - bootable_media_detect_entry, Start
B - 1679 - bootable_media_detect_success, Start
B - 1693 - elf_loader_entry, Start
B - 5076 - auth_hash_seg_entry, Start
B - 7223 - auth_hash_seg_exit, Start
B - 573341 - elf_segs_hash_verify_entry, Start
B - 688998 - PBL, End
B - 689023 - SBL1, Start
B - 777397 - pm_device_init, Start
D - 6 - pm_device_init, Delta
B - 778910 - boot_flash_init, Start
D - 63410 - boot_flash_init, Delta
B - 846511 - boot_config_data_table_init, Start
D - 3846 - boot_config_data_table_init, Delta - (419 Bytes)
B - 853736 - clock_init, Start
D - 7562 - clock_init, Delta
B - 865819 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
B - 869307 - sbl1_ddr_set_params, Start
B - 874293 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 878785 - Pre_DDR_clock_init, Start
D - 4 - Pre_DDR_clock_init, Delta
D - 13146 - sbl1_ddr_set_params, Delta
B - 892485 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 962832 - sbl1_wait_for_ddr_training, Start
D - 29 - sbl1_wait_for_ddr_training, Delta
B - 978657 - Image Load, Start
D - 134954 - QSEE Image Loaded, Delta - (262104 Bytes)
B - 1114105 - Image Load, Start
D - 1443 - SEC Image Loaded, Delta - (2048 Bytes)
B - 1124469 - Image Load, Start
D - 213684 - APPSBL Image Loaded, Delta - (436880 Bytes)
B - 1338576 - QSEE Execution, Start
D - 58 - QSEE Execution, Delta
B - 1344753 - SBL1, End
D - 657840 - SBL1, Delta
S - Flash Throughput, 2004 KB/s (701451 Bytes, 349937 us)
S - DDR Frequency, 537 MHz
U-Boot 2012.07-V1.2.0.0 [local,local] (Oct 26 2016 - 02:39:01)
smem ram ptable found: ver: 1 len: 3
DRAM: 256 MiB
machid : 0x8010100
NAND: spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:aa:21
SF: Detected W25N01GV with page size 2 KiB, total 128 MiB
SF: Detected W25Q16 with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
130 MiB
MMC:
In: serial
Out: serial
Err: serial
Product ID: WAC510
machid: 8010100
flash_type: 0
Net: MAC0 addr:a0:40:a0:7b:b7:6f
PHY ID1: 0x4d
PHY ID2: 0xd0b2
ipq40xx_ess_sw_init done
eth0
Hit any key to stop autoboot: 0
Saving Environment to NAND...
Erasing Nand...
Erasing at 0xef000 -- 100% complete.
Writing to Nand... done
Boot count=1
Creating 1 MTD partitions on "nand1":
0x000000000000-0x000003800000 : "mtd=0"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI: attached mtd2 to ubi0
UBI: MTD device name: "mtd=0"
UBI: MTD device size: 56 MiB
UBI: number of good PEBs: 448
UBI: number of bad PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 4
UBI: available PEBs: 16
UBI: total number of reserved PEBs: 432
UBI: number of PEBs reserved for bad PEB handling: 4
UBI: max/mean erase counter: 2/0
Read 0 bytes from volume kernel to 84000000
No size specified -> Using max size (2793472)
Config not availabale

bootipq failed!!
resetting ...

Tim

It looks like they use different FIT config partition than default in OpenWRT.
Thats why after not finding it,it just resets.

You can usually find out memory location for TFTP-ing by looking at u-boot environment variables,manufacturers usually write one with the location

My uboot environment variables are:
(IPQ40xx) # printenv
baudrate=115200
boot_cnt=2
bootcmd=bootipq
bootdelay=2
bootparm=init=/bin/sh
bootparms=init=/bin/sh
delenv=sf probe && sf erase 0x000e0000 +0x10000
ethact=eth0
fdt_high=0x87000000
flash_type=0
fw_upgrade=0
install_cal_to_end_of_nor=sf probe && sf read 0x84000000 0x170000 0x10000 && sf erase 0x1f0000 +0x10000 && sf write 0x84000000 0x1f00
ipaddr=192.168.1.11
machid=8010100
primary=0
proceed_upgrade=0
product_id=WAC510
secondary=3800000
show_cal_at_end_of_nor=sf probe && sf read 0x84000000 0x1f0000 0x10000 && md.b 0x84001000 0x40
stderr=serial
stdin=serial
stdout=serial
Environment size: 630/65532 bytes

But last time I tried tftp'ing to 0x3800000 (the 'secondary' partition, or so I thought), I ended up with a hard brick with no uboot or anything.

I can still tftpboot my initramfs image, so am I right in thinking I need to tftpboot the openwrt-ipq806x-netgear_wac510-fit-uImage.itb file into the 'kernel' partition?

Tim

No,most likely adress is 0x84000000.
You need to do this safelly,that means that you build initramfs image.
Than you simply load that image using tftpboot to 0x84000000 and then use bootm 0x84000000
Then from it you sysupgrade

That's exactly what I have been doing to test new initramfs images:
Hit any key to stop autoboot: 0
(IPQ40xx) # setenv serverip 192.168.1.10
(IPQ40xx) # tftpboot 0x84000000 openwrt-ipq806x-netgear_wac510-initramfs-fit-uImage.itb
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 up Speed :1000 Full duplex
Using eth0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.11
Filename 'openwrt-ipq806x-netgear_wac510-initramfs-fit-uImage.itb'.
Load address: 0x84000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################
done
Bytes transferred = 5963180 (5afdac hex)
(IPQ40xx) # bootm
######Booting kernel from FIT Image at 84000000 ...
Using 'config@1' configuration
Trying 'kernel@1' kernel subimage
Description: ARM OpenWrt Linux-4.9.82
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x840000e4
Data Size: 5927867 Bytes = 5.7 MiB
Architecture: ARM
OS: Linux
Load Address: 0x80208000
Entry Point: 0x80208000
Hash algo: crc32
Hash value: e8dda56d
Hash algo: sha1
Hash value: 644351d3d008e487d113cfa5db891f9d14010970
Verifying Hash Integrity ... crc32+ sha1+ OK
##Flattened Device Tree from FIT Image at 84000000
Using 'config@1' configuration
Trying 'fdt@1' FDT blob subimage
Description: ARM OpenWrt netgear_wac510 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x845a75d8
Data Size: 33966 Bytes = 33.2 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 8a52132f
Hash algo: sha1
Hash value: 02c3c7f38cfe36e421b0cc448739b537513cc734
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x845a75d8
Uncompressing Kernel Image ... OK
Loading Device Tree to 86ff4000, end 86fff4ad ... OK
Using machid 0x8010100 from environment

Starting kernel ...

[ 0.000000] Booting Linux on physical CPU 0x0

Then when I ran sysupgrade it all went wrong :frowning:

Tim

I appreciate this is worthy of a new topic now, so I'll start one..

Tim

Can you try sysupgrading from that?
Since I can see that generic FIT gets accepted

That's exactly what I have been doing:
tftpboot 0x84000000 openwrt-ipq806x-netgear_wac510-initramfs-fit-uImage.itb
bootm
..board boots..
copy over sysupgrade.bin to /tmp
cd /tmp
sysupgrade -v openwrt-ipq806x-netgear_wac510-squashfs-nand-sy
supgrade.bin

I'm googling around before I start a new topic, but I'm not getting anywhere.. I think the kernel+rootfs are in the new flash partitions, but I don't see how to get uboot to detect that.

I've added some more (hopefully helpful) logs:
Stock uboot bootlog:

OpenWrt bootlog after sysupgrade:

Tim

Interesting if I do bootipq debug:
(IPQ40xx) # bootipq debug
Saving Environment to NAND...
Erasing Nand...
Erasing at 0xef000 -- 100% complete.
Writing to Nand... done
bootargs=WAC510 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs mtdparts=spi0.1:56m(rootfs),56m(rootfs_1),15m(var_config),768t
Booting from flash
Boot count=4
Creating 1 MTD partitions on "nand1":
0x000000000000-0x000003800000 : "mtd=0"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI: attached mtd2 to ubi0
UBI: MTD device name: "mtd=0"
UBI: MTD device size: 56 MiB
UBI: number of good PEBs: 448
UBI: number of bad PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 4
UBI: available PEBs: 16
UBI: total number of reserved PEBs: 432
UBI: number of PEBs reserved for bad PEB handling: 4
UBI: max/mean erase counter: 2/0
Read 0 bytes from volume kernel to 84000000
No size specified -> Using max size (2793472)
Config not availabale
bootipq failed!!
resetting ...

It seems to read that 'bootargs' variable for what partitions to boot.

Just need to figure out what the new partitions are called..

Tim

I have rebased the branch on master.
This has brought a lot of changes including using GCC7 as default and binutils 1.3
So you will need to delete the folder and do the build from scratch after cloning.
Can you make a PR including MAC fix?

Finally got OpenWrt booting off the flash! Thanks to @musashino

I modified the stock uboot bootcmd variable to do the UBI stuff, tried rebooting it again and it booted straight into OpenWrt. Modified a file, and it stayed modified after another reboot.

Full bootlog here:

Going through the Netgear init scripts, it seems there is some association of wifi IRQs with different CPU cores. I guess we need to do that too?

I'll replace one of my existing APs with this WAC510 at work tomorrow, to see how it performs.

Tim

After testing it at work with multiple VLANs and I can see that VLANs are not working. I tried reverting back to the default SSIDs that route directly to the lan interface and it all works perfectly and I get good throughput.

Given that this device has two network ports, is it possible it has a switch in it that is somehow blocking the VLANs?

Tim

yes, there's an internal-switch and it has problems with port-mapping (the pseudo portmapping stuff is implemented as a fixed vlan - that you can't edit). Sven had patches to resolve the issue for 2-Port device. From what I remember it's because the CPU-Port isn't setup properly. However, John is working on a rewrite of the whole network subsystem. so yeah nobody can really help much with this.

Thank you for letting me know - I spent today fiddling with VLAN settings and tcpdump and came to the conclusion I was out of my depth.

I'll wait for John to work his magic...

Tim