HP MSM Support

For Developers
22

Hi alex,

How could you get the uImage.img file?

23

I have been playing with a HP 560 AP and I have got it to throw out some messages. Here are the steps that I took

  1. dump bidio
  2. edit bidio (with a hex editor) and search for "11 02 72 6F" and change that to "11 17 72 6F" and append after that " console=ttyS0,115200", after that you need to remove 21 bytes from the first part of the bid (Colubris_BID_$$$ should start at 0x0, 0x200, 0x400, 0x600) (I have no clue why it's there 4 times, but I think it's just the first one that's important)
  3. (you need to do this because uboot ignores bootcmd and sets it from here, appending root=/dev/...)
  4. build the image (or you can get it here )
    4a. I did chage the file displayed above removing the uboot header and generating another one with
mkimage -A ppc -O linux -T kernel -C none -a 0x01000000 -e 0x01000000 -n "6.6.9.1-23594" -d x1.noheader  uImage
  1. run the commands to boot it as shown below

Dump from my attempt:

=> tftp 0x1000000 uImage
eTSEC1: Link up, full duplex, 100 Mbps
Using eTSEC1 device
TFTP from server 192.168.1.111; our IP address is 192.168.1.1
Filename 'uImage'.
Load address: 0x1000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################
done
Bytes transferred = 12156584 (b97ea8 hex)
=> tftp 0xc00000 x.dtb
Using eTSEC1 device
TFTP from server 192.168.1.111; our IP address is 192.168.1.1
Filename 'x.dtb'.
Load address: 0xc00000
Loading: #
done
Bytes transferred = 8062 (1f7e hex)
=> bootm 0x1000000 - 0xc00000
read_vblock 6
read_vblock 3f7
Kernel arg: 'ro console=ttyS0,115200 root=/dev/mtdblock2'
## Booting image at 01000000 ...
   Image Name:   6.6.9.1-23594
   Image Type:   PowerPC Linux Kernel Image (uncompressed)
   Data Size:    12156520 Bytes = 11.6 MB
   Load Address: 01000000
   Entry Point:  01000000
   Verifying Checksum ... OK
   XIP Kernel Image ... OK
## Booting image2 at 01000000 ...
read_vblock 6
bid at fed0610 and ffee80
Uncompressed kernel size 9c43d02b, ram limit fe00000
## Loading RAMDisk Image at 9d43d02b ...
   Loading Ramdisk: ab6a5000..fdffe3d
Bad trap at PC: ff741dc, SR: 21200, vector=d00
NIP: 0FF741DC XER: 00000000 LR: 0FF8C880 REGS: 0fe4f0f8 TRAP: 0d00 DAR: FFFFEFFF
MSR: 00021200 EE: 0 PR: 0 FP: 0 ME: 1 IR/DR: 00

GPR00: 00000001 0FE4F1E8 0FE4F738 AB6A5000 FFFFF007 6475AE3C 0E266F9C 00606340
GPR08: 007C70FB 0FFCC6AC 00000020 0FE4EEE8 24002048 08A04029 0FFCF500 0EF6F000
GPR16: 9D006A00 0FE4F780 0FF877C4 00000008 00000000 0FE4F2E8 00FFFF0E AB6A5000
GPR24: 01000000 0FFF514C 00FFFF00 00FFF680 9C43D02B 9C43D02B 0FFD0214 0FDFFE3D
Call backtrace:
0FF8C860 0FF8D63C 0FFA209C 0FFA2580 0FF74628 0FF71630
Exception in kernel pc ff741dc signal 0
### ERROR ### Please RESET the board ###

Does anyone have any idea why this fails?

PS: if I use a image with load address and entry address set to 0 it always hangs after "Verifying Checksum ... OK"

24

I know @blocktrron was experimenting with the MSM560, and only abandoned it because of the low current supply on the mPCIe port.

I can't speak for how he got OpenWrt booting ... assuming he does not weigh in, let's start with your messages:

Bad trap at PC: ff741dc, SR: 21200, vector=d00
NIP: 0FF741DC XER: 00000000 LR: 0FF8C880 REGS: 0fe4f0f8 TRAP: 0d00 DAR: FFFFEFFF
MSR: 00021200 EE: 0 PR: 0 FP: 0 ME: 1 IR/DR: 00
:
Call backtrace:
0FF8C860 0FF8D63C 0FFA209C 0FFA2580 0FF74628 0FF71630
Exception in kernel pc ff741dc signal 0

So $PC=0xff741dc -- that's not the kernel, that's still u-boot. It's during the RAMdisk loading stage that things fail:

ab6a5000..fdffe3d

That's not a forward range :^)

Try building a dummy ramdisk and feeding it to bootm as the second argument instead of -. Seems like it insists it still needs one.

25

You said it ignores your bootcmd -- does it actually do that when autobooting, or does it just ignore the arguments to bootm? If so, we can try go and try to come up with a custom loader.

26

It actually reads whatever is in bidio at location 0x11 (not address 0x11) and it appends "root=/dev/mtdblock2" to it.
By default bidio is "0x11 0x02 ro". I have changed mine to be "0x11 0x17 ro console=ttyS0,115200" (and have removed the extra bits from the end to still match 0x200 to be the Colubrid thing
The thing is that if I try to boot a image 3 times it appends "root=/dev/mtdblock2" 3 times
so everything in bootarg is ignored completely,
I have also tried building a FIT image but for some reason it throws a "bad magic" error but if I do a iminfo it actually sees it and describes it correctly.
I will try to build a kernel and initrd separately and see if that works

27

Ah, I see.

I've reached out to @blocktrron as to how he's done this.

1 Like
28

So I have tried to add an initrd but for some reason it tries to boot image2 from the same location as image

=> bootm 0x1000000 0x2000000 0xc00000
read_vblock 6
read_vblock 3f7
Kernel arg: 'ro console=ttyS0,115200 root=/dev/mtdblock2'
## Booting image at 01000000 ...
   Image Name:   6.6.9.1-23594
   Image Type:   PowerPC Linux Kernel Image (uncompressed)
   Data Size:    3234068 Bytes =  3.1 MB
   Load Address: 01000000
   Entry Point:  01000000
   Verifying Checksum ... OK
   XIP Kernel Image ... OK
## Booting image2 at 01000000 ...
read_vblock 6
bid at fed0610 and ffee80
Uncompressed kernel size 9bba25f5, ram limit fe00000
## Loading RAMDisk Image at 9cba25f5 ...
   Loading Ramdisk: ab68c000..fdff31f
Bad trap at PC: ff741d8, SR: 21200, vector=d00
NIP: 0FF741D8 XER: 00000000 LR: 0FF8C880 REGS: 0fe4f0f8 TRAP: 0d00 DAR: FFFFEFFD
MSR: 00021200 EE: 0 PR: 0 FP: 0 ME: 1 IR/DR: 00

GPR00: 00000003 0FE4F1E8 0FE4F738 AB68C000 FFFFF001 6477331C 0EAE89CC 6340007C
GPR08: 60800060 0FFCC6AC 00000020 0FE4EEE8 24002048 00A04129 0FFCF500 0EF6F000
GPR16: 9D006A00 0FE4F780 0FF877C4 00000008 00000000 0FE4F2E8 00FFFF0E AB68C000
GPR24: 01000000 0FFF514C 00FFFF00 00FFF680 9BBA25F5 9BBA25F5 0FFD0214 0FDFF31F
Call backtrace:
0FF8C860 0FF8D63C 0FFA209C 0FFA2580 0FF74628 0FF71630
Exception in kernel pc ff741d8 signal 0
### ERROR ### Please RESET the board ###

=> bootm 0x200000
read_vblock 6
read_vblock 3f7
Kernel arg: 'ro console=ttyS0,115200 root=/dev/mtdblock2'
## Booting image at 00200000 ...
   Image Name:   6.6.9.1-23594
   Image Type:   PowerPC Linux Kernel Image (uncompressed)
   Data Size:    3234068 Bytes =  3.1 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
OK
## Booting image2 at 00200000 ...
read_vblock 6
bid at fed0610 and ffee80
Uncompressed kernel size fe4f448, ram limit fe00000
## Loading RAMDisk Image at 9bda1ace ...
Kernel and ram disk do not fit together
### ERROR ### Please RESET the board ###

now what image2 is I have no clue

29

So, Blocktrron replaced U-boot entirely: https://github.com/blocktrron/u-boot-msm

30

I'll drop him a message to ask about a .config and how he got the addresses. Thanks

31

Hi Alex,

Any update on this, I have some MSM460 and I can help to test

32

Blocktrron has a new commit for msm460 https://git.openwrt.org/?p=openwrt/staging/blocktrron.git;a=log;h=refs/heads/msm460-2024

33

For other readers, see OpenWrt support for HP Prototype Access Point? - #47 by hurricos

34

Blocktrron release the installation manual

2 Likes
35

and there are now snapshot builds available. have fun testing. https://github.com/openwrt/openwrt/commit/af329ec38980e2f706411a11b9f344a62eb0dd8f

1 Like
36

Hi All.

Bumping this thread yet again to let you all know MSM466 boots on MSM460 instructions per the other thread I created.

1 Like
37

Works on HPE 560 Access Point as well. It can be installed using the same commands via serial console.
After the installation the AC board is not recognized so one needs to install the ath10k kernel module and firmware (ath10k-firmware-qca988x and kmod-ath10k)

Update: One of the devices failed to start in AP mode so I am investigating that now. When AP mode is selected the leds do not come up and when doing a scan (on both radios) it returns no data

1 Like
38

Cool. I guess if I get indoor AP's I'll prefer HPE 560 vs getting some MSM460's. Plus perhaps to change out the radios in my MSM466's to test.

How did you go with transmit power and the default region settings?

Mine is a WW model but the radios are set to US in their registers or whatever. The max power dropped compared to factory.

39

Atheros AR9390 802.11a/b/g/n can go up to 22db in 2.4 and 30db in 5G
Qualcomm Atheros QCA9880 802.11ac/n can go up to 30db

One thing... AR9390 is radio2 and QCA9880 is radio1

I have tested both the 1.5V and 3.3V power supply to the boards and it does not drop when starting the card at all. Also I have tested with both cards removed (one at a time) removed and none of the wifi modules work... it can scan the wifi but once I start a AP or set one in client mode, the wifi dies and I need to reboot the router (after it dies it does not return anything in scanning, anymore)

1 Like
40

Hmm. Good point regarding checking whether the rails dropped. Transient behaviour is difficult and i don't know enough about how radios react to low power. Only thing I can think of is whether you have an 802.3af or 802.3at supply? Datasheet says can only handle 2x2:2 on the ar9390 if you want to stay under 14W.

Thanks for describing the transmit power. That transmit power seems to track what it should be from factory from reading the datasheet.

41

I have tried with ath9, ath10, 2x iwlwifi, and b43 cards and none of them want to start the ap or connect to an existing ap, my best guess now it's that there has to be something in uboot since with that many cards tested it is impossible to blame openwrt for this. any help/direction at this point would be highly appreciated