How to build IPQ4018 firmware

It's part of the install procedure. See Step 3.3:

3. Connect to the intermediate/temporary LEDE installation
[...]
  3 delete the "jffs2" ubi partition to make room for your new root partition

     # ubirmvol /dev/ubi0 --name=jffs2

It could that dullish put this into his install script.

I have installed lede manually using this command but have forgotten it completely. Shame on me and thank you again.

Hi everyone,
I want to compiile AR40XX_PHY as a loadable module instead of a builtin module.
I try run make kernel_menuconfig and said this symbol to M (module).
However, after boot the built firmware, I can not find ar40xx.ko file.
Please help me

@Oni - It is setup here https://github.com/LEDE-RT-AC58U/LEDE_RT-AC58U/blob/master/target/linux/ipq806x/config-4.9#L5
Kernel config in lede is combined from several files and additional kernel modules setup. You will also need to make a corresponding kernel module (lede style).

Thanks for your help.
When I power on the board and enter uboot interface.
When I set the bootcmd of U-boot to bootm and let it autoboot, the kernel panic happens.
I see that if I use auto boot, the PHY device still not be initialized at kernel boot time, this cause kernel panic on my board.
(I used mii info and it printed: Device not found!!!)
In another sense, when I interrupt the auto boot. Enter U-boot command line interface, then type bootm=>kernel work perfectly. (this time mii info prints: "PHY 0x00: OUI .....").
How can I make these PHY device be ready before starting kernel without interrupt Auto boot.
Could you help me

Actually, this is a well known problem... and has been for some time, I'm sure if you google around you can find more. Anyway, @riptidewave93 documented this in his thread about the Cisco Meraki MR33. IPQ40xx target & Single NIC devices

@blogic has a "shiny new ethernet driver".

But it has been MIA for a while now. (You have to ask john for details. It could be because it relies on netdev patches that are a pain to backport, so the new ethernet driver will have to wait for 4.14, which could be "soon" - but this is all speculation on my part.)

There is apparently also an undebugged issue with qca8k and PPPoE traffic, which make the driver crash at the moment.

From what I know, the AR40xx is not quite a AR8337/QCA8337. It's sort of split into two parts. One is integrated into the SoC (the ess-switch - aka as ethernet sub system), whereas the other part is in the QCA8072/8075 chip. So, I'm waiting what John has in store of the device.

I have a RT-acrh13 I just received...

I pulled in chunkeey's latest 'staging' branch into my lede tree, and built an image for the AC58U.
I tried following the directions at this link: https://github.com/chunkeey/LEDE-IPQ40XX/commit/3568d885d27ff6e373af429098e6cff032c63c37

But, after uploading the bin/targets/ipq806x/generic/lede-ipq806x-RT-AC58U-squashfs-flash-factory.trx (that I built), the router simply goes back into the stock firmware. Any idea what I might be doing wrong?

So, I soldered up a serial port, and tried using the option '2'. Seems it is quite unhappy:

  2: Load System code then write to Flash via TFTP.
 Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
 Please Input new ones /or Ctrl-C to discard
        Input device IP (192.168.1.1) ==:
        Input server IP (192.168.1.70) ==:
        Input Linux Kernel filename (RT-AC58U.trx) ==:lede-ipq806x-RT-AC58U-squashfs-flash-factory.trx
preferred nic: eth0
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 up Speed :1000 Full duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
switch prereq:0
Using eth0 device
TFTP from server 192.168.1.70; our IP address is 192.168.1.1
Filename 'lede-ipq806x-RT-AC58U-squashfs-flash-factory.trx'.
Load address: 0x84000000
Loading: Got ARP REPLY, set eth addr (80:ee:73:36:fd:10)
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ############
done
Bytes transferred = 12570688 (bfd040 hex)
NetBootFileXferSize= 00bfd040

0xbfd000 bytes written to volume linux

0xbfd000 bytes written to volume linux2
   No valid image found at 0x84000040
ERROR: can't get kernel image!
Read 0x40 bytes from volume [linux2] offset 0x0 to 84000000
   No valid 2nd firmware found at 0x030ae000
ERROR: can't get kernel image!
data abort
pc : [<87303834>]          lr : [<87301678>]
sp : 86edfd30  ip : a8a0f57d     fp : 00003055
r10: 8736ec94  r9 : 00000000     r8 : 86edff68
r7 : 873585b7  r6 : 000000c8     r5 : 00314067  r4 : 69666e6f
r3 : 00000083  r2 : 0a000021     r1 : 0000000a  r0 : 00000001
Flags: nzCv  IRQs off  FIQs off  Mode SVC_32
Resetting CPU ...

resetting ...

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1338 - bootable_media_detect_entry, Start
B -      1678 - bootable_media_detect_success, Start
B -      1692 - elf_loader_entry, Start
B -      5068 - auth_hash_seg_entry, Start
B -      7210 - auth_hash_seg_exit, Start
B -    572127 - elf_segs_hash_verify_entry, Start
B -    687050 - PBL, End
B -    687075 - SBL1, Start
B -    775408 - pm_device_init, Start
D -         6 - pm_device_init, Delta
B -    776918 - boot_flash_init, Start
D -     54264 - boot_flash_init, Delta
B -    835369 - boot_config_data_table_init, Start
D -      3845 - boot_config_data_table_init, Delta - (419 Bytes)
B -    842590 - clock_init, Start
D -      7564 - clock_init, Delta
B -    854675 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
B -    858164 - sbl1_ddr_set_params, Start
B -    863150 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    867642 - Pre_DDR_clock_init, Start
D -         4 - Pre_DDR_clock_init, Delta
D -     13146 - sbl1_ddr_set_params, Delta
B -    881342 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    951667 - sbl1_wait_for_ddr_training, Start
D -        29 - sbl1_wait_for_ddr_training, Delta
B -    966963 - Image Load, Start
D -    134908 - QSEE Image Loaded, Delta - (262104 Bytes)
B -   1102367 - Image Load, Start
D -      1443 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1112734 - Image Load, Start
D -    223363 - APPSBL Image Loaded, Delta - (457299 Bytes)
B -   1336519 - QSEE Execution, Start
D -        59 - QSEE Execution, Delta
B -   1342781 - SBL1, End
D -    657709 - SBL1, Delta
S - Flash Throughput, 2007 KB/s  (721870 Bytes,  359581 us)
S - DDR Frequency, 537 MHz


U-Boot 2012.07-05763-g80e4eb4 [local,local] (Jul 06 2016 - 11:01:57)
RT-AC58U bootloader version: 1.0.0.3

smem ram ptable found: ver: 1 len: 3
ASUS RT-AC58U gpio init : wps / reset pin
DRAM:  128 MiB
machid : 0x8010100
Maximum malloc length: 4096 KBytes
mem_malloc_start/brk/end: 0x86ef0000/86ef0000/87300000
Relocation offset: 0
NAND:  spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:aa:21
SF: Detected W25N01GV with page size 2 KiB, total 128 MiB
SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
130 MiB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
name         : offset   size    
0:SBL1       : 00000000 00040000
0:MIBIB      : 00040000 00020000
0:QSEE       : 00060000 00060000
0:CDT        : 000c0000 00010000
0:DDRPARAMS  : 000d0000 00010000
0:APPSBLENV  : 000e0000 00010000
0:APPSBL     : 000f0000 00080000
0:ART        : 00170000 00010000
machid: 8010100
Net:   MAC0 addr:0:3:7f:ba:db:ad
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Creating 1 MTD partitions on "nand1":
0x00000000-0x08000000 : "mtd=0"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: max. sequence number:       904
UBI: attached mtd2 to ubi0
UBI: MTD device name:            "mtd=0"
UBI: MTD device size:            128 MiB
UBI: number of good PEBs:        1024
UBI: number of bad PEBs:         0
UBI: number of corrupted PEBs:   0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     6
UBI: available PEBs:             30
UBI: total number of reserved PEBs: 994
UBI: number of PEBs reserved for bad PEB handling: 10
UBI: max/mean erase counter: 25/1
UBI: image sequence number:  1117443911
UBI:   vol_id  reserved_pebs  alignment  data_pad  vol_type  usable_leb_size  used_ebs  used_bytes  last_eb_bytes  corruptede
UBI:        0              3          1         0   dynamic            1f000         3       5d000          1f000          0m
UBI:        1              1          1         0   dynamic            1f000         1       1f000          1f000          0y
UBI:        2              1          1         0   dynamic            1f000         1       1f000          1f000          02
UBI:        3            18d          1         0   dynamic            1f000       18d     3013000          1f000          0x
UBI:        4            18d          1         0   dynamic            1f000       18d     3013000          1f000          02
UBI:        5             b5          1         0   dynamic            1f000        b5     15eb000          1f000          02
UBI: 7fffefff              2          1         0   dynamic            1f000         2       3e000              2          0e
Read 0x1f000 bytes from volume [Factory] offset 0x0 to 86ec0ce8
EEPROM set 0: OK (version 21)
Read 0x1f000 bytes from volume [Factory2] offset 0x0 to 86ec0ce8
EEPROM set 1: OK (version 21)
Read 0x1f000 bytes from volume [Factory] offset 0x0 to 86ef3480
Select EEPROM set 0 at offset 0x0.

Please choose the operation: 
   1: Load System code to SDRAM via TFTP.
   2: Load System code then write to Flash via TFTP.
   3: Boot System code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
 0 
   3: Boot System code via Flash (default).

RT-AC58U bootloader version: 1.0.0.3
MAC Address: 88:D7:F6:A9:48:B0
Read 0x40 bytes from volume [linux] offset 0x0 to 84000000
   No valid 1st firmware found at 0x0009b000
ERROR: can't get kernel image!
Read 0x40 bytes from volume [linux2] offset 0x0 to 84000000
   No valid 2nd firmware found at 0x030ae000
ERROR: can't get kernel image!
 
Hello!! Enter Recuse Mode: (Check error)

preferred nic: eth0
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 up Speed :1000 Full duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
switch prereq:0
tftpd start

Our IP address is:(192.168.1.1)
Wait for TFTP request...
tftpd open
D D D D D D D D D D D D D D D D D D D D 
CTRL-A Z for help | 115200 8N1 | NOR | Minicom 2.7

@greearb

  1. when you run make with multiple jobs/threads (-jN) some firmware files may be build incorrectly. I have added https://github.com/LEDE-RT-AC58U/LEDE_RT-AC58U/blob/master/target/linux/ipq806x/image/Makefile#L298 this directive to fix it.
  2. You need 2 stage firmware installation procedure, as @chunkeey described. I suggest you to
    a) upload itb firmware using uart and selecting (2)
    b) remove ubi volume by ubirmvol /dev/ubi0 -N jffs2
    c) upload trx lede firmware with scp & syspgrade command. If your firmware has luci, you can use luci to flash final firmware.

PS You can use my project https://github.com/LEDE-RT-AC58U/LEDE_RT-AC58U to build firmware. It produces working firmwares with about 30 downloads every week without any complains.

PS I think it is preferable to use pastebin for long listings here....

I noticed that the image I built myself was around 12MB, but the one that worked (from: http://lede-ac58u.zyxmon.org/firmware/) was only about 6MB. So, I guess whatever I built was incorrect. I did build with -j8.

Do you have selected additional packages (packages that are not part of the default config?).

Anyway, I just set CONFIG_TARGET_INITRAMFS_COMPRESSION_LZMA to be enabled by default for the ipq806x target. This can help to shrink the initramfs image quite a bit. (Just enable the option and regenerate a image.)

The problem is not with the firmware size. The problem is - firmware is not (always) correct when parallel jobs are run. AFAIR one can just run make .... once more and this fixes firmware.Another option is to add .NOTPARALLEL target to Image Makefile.

I did not add any extra packages. But, maybe you could link a known-good .config file for this platform?

So, I removed the images in the bin/targets/ipq806x/generic/ directory, and re-built with 'make'. (no -j 8), and now the image sizes are all around 4MB, including the .trx which was 12MB last time. So, I think the -j8 bug is very likely the cause of at least much of my problems.

Do you have a way to compare the old and the new image? It would be great to know what got duplicated. (Or upload them somewhere)

Here is a tarball that contains the two images. This is easily reproducible for me, for whatever reason. I just compile with 'make' or 'make -j8' The image made with -j8 is a lot bigger.

http://www.candelatech.com/downloads/rtx-make-compare.tgz

Another question on this platform...did you have to do something special to get the module dependencies to work properly? While trying to get my ath10k-ct driver to work, I notice that the mac80211 and 'ath' modules are not loaded automatically, and so then the ath10k_pci cannot load either. Manually loading the modules one at a time works.

Ok, it's the uncompressed initramfs getting added. There isn't any duplication going on.
And this is and was true in the past as well. The image production rules does not have the initramfs-image as a dependency. So, from make's perspective they can run independently/in parallel.

Now, adding a conditional dependency here >could< look sth like this "untested beauty":

  $(KDIR)/tmp/$(call IMAGE_NAME,$(1),$(2)): $$(KDIR_KERNEL_IMAGE) $$(ROOTFS/$(1)/$(3)) $$(if $$(CONFIG_TARGET_ROOTFS_INITRAMFS),$(KDIR)/tmp/$$(KERNEL_INITRAMFS_IMAGE))

But if the recent regressions due to changes to append-dtb have taught anything, then it's this is probably more complicated than this.

Again, the factory.trx image based on initramfs is and always was a wonky hack.

Not that I know, ath10k needed ATH10K_AHB and a patch to lower the memory consumption. Otherwise iperf3 would just cause crashes.