Installing OpenWRT on Watchguard T40W

For Developers
21

Yeah, here you go.

T40:

U-Boot 2018.09 (Dec 05 2019 - 10:13:47 -0800)

SoC:  LS1043AE Rev1.1 (0x87920011)
Clock Configuration:
       CPU0(A53):1000 MHz  CPU1(A53):1000 MHz  CPU2(A53):1000 MHz  
       CPU3(A53):1000 MHz  
       Bus:      300  MHz  DDR:      1600 MT/s  FMAN:     500  MHz
Reset Configuration Word (RCW):
       00000000: 0610000a 0a000000 00000000 00000000
       00000010: 45580002 00000012 40044000 c1002000
       00000020: 00000000 00000000 00000000 0003fffe
       00000030: 20004504 0418320a 00000096 00000001
Model: LS1043A QDS Board - T40/T20
Board: LS1043AQDS, boot from vBank: 0
I2C:   ready
DRAM:  Initializing DDR...
Detected UDIMM Fixed DDR4 on board
3.9 GiB (DDR4, 32-bit, CL=11, ECC off)
Using SERDES1 Protocol: 17752 (0x4558)
SEC Firmware: Bad firmware image (not a FIT image)
Waking secondary cores to start from fbd35000
All (4) cores are up.
MMC:   FSL_SDHC: 0
Loading Environment from SPI Flash... SF: Detected mx25u3235f with page size 256 Bytes, erase size 64 KiB, total 4 MiB
*** Warning - bad CRC, using default environment
In:    serial
Out:   serial
Err:   serial
Net:   SF: Detected mx25u3235f with page size 256 Bytes, erase size 64 KiB, total 4 MiB
Fman1: Uploading microcode version 108.4.9
PCIe0: pcie@3400000 Root Complex: no link
PCIe1: pcie@3500000 Root Complex: x1 gen1
PCIe2: pcie@3600000 disabled
FM1@DTSEC1 [PRIME], FM1@DTSEC2, FM1@DTSEC3, FM1@DTSEC5, FM1@DTSEC6
### main_loop entered: bootdelay=3

### main_loop: bootcmd="run wgBootSysA"
=> sf probe
SF: Detected mx25u3235f with page size 256 Bytes, erase size 64 KiB, total 4 MiB
=> sf read 0x80080000 0x0 0xff
device 0 offset 0x0, size 0xff
SF: 255 bytes @ 0x0 Read: OK
=> md 0x80080000 0xff
80080000: 01ee0100 aa55aa55 0a000000 0610000a    ....U.U.........
80080010: 00000000 00000000 00000012 45580002    ..............XE
80080020: c1002000 40044000 00000000 00000000    . ...@.@........
80080030: 0003fffe 00000000 0418320a 20004504    .........2...E. 
80080040: 00000001 00000096 40100000 0957015c    ...........@\.W.
80080050: 00000000 09570600 40100000 09570604    ......W....@..W.
80080060: 00502880 09ea08dc 0000e010 09570178    .(P.........x.W.
80080070: 00000008 09180000 0000009e 09570418    ..............W.
80080080: 0000009e 0957041c 0000009e 09570420    ......W..... .W.
80080090: 00004400 09ee00c0 00002200 09570158    .D......."..X.W.
800800a0: 00000001 89008040 00502880 09ea08dc    ....@....(P.....
800800b0: 00000300 09570158 01000100 89400890    ....X.W.......@.
800800c0: 01000100 89500890 01000100 89600890    ......P.......`.
800800d0: 000f400c 09550000 40006108 a905de06    .@....U..a.@....
800800e0: 00000000 00000000 00000000 00000000    ................
800800f0: 00000000 00000000 00000000 de000000    ................
80080100: deadbeef deadbeef deadbeef deadbeef    ................
80080110: deadbeef deadbeef deadbeef deadbeef    ................
(repeats)
=> mdio list
FSL_MDIO0:
4 - Generic PHY <--> FM1@DTSEC1
5 - Generic PHY <--> FM1@DTSEC2
6 - Generic PHY <--> FM1@DTSEC5
7 - Generic PHY <--> FM1@DTSEC6
FM_TGEC_MDIO:
1 - AR8035 <--> FM1@DTSEC3

T45:

U-Boot 2018.09 (Jul 20 2022 - 02:38:54 -0700)

SoC:  LS1043AE Rev1.1 (0x87920011)
Clock Configuration:
       CPU0(A53):1600 MHz  CPU1(A53):1600 MHz  CPU2(A53):1600 MHz  
       CPU3(A53):1600 MHz  
       Bus:      300  MHz  DDR:      1600 MT/s  FMAN:     500  MHz
Reset Configuration Word (RCW):
       00000000: 06100010 0a000000 00000000 00000000
       00000010: 45580002 00000012 40044000 c1002000
       00000020: 00000000 00000000 00000000 00036ffd
       00000030: 20044104 04183208 00000096 00000001
Model: LS1043A QDS Board - T40/T20
Board: LS1043AQDS, boot from vBank: 0
I2C:   ready
DRAM:  Initializing DDR...(ddr_raw_timing.tckmax_ps = 1500, ddr_raw_timing.tccdl_ps = 6250)
Detected UDIMM Fixed DDR4 on board
3.9 GiB (DDR4, 32-bit, CL=11, ECC off)
Using SERDES1 Protocol: 17752 (0x4558)
SEC Firmware: Bad firmware image (not a FIT image)
AW-XM458MA-PUR: Reset AW-XM458MA-PUR to fix wifi crash when soft reboot
SF: Detected mx25u3232f with page size 256 Bytes, erase size 64 KiB, total 4 MiB
device 0 offset 0x280018, size 0xd
SF: 13 bytes @ 0x280018 Read: OK
Waking secondary cores to start from fbd36000
All (4) cores are up.
MMC:   FSL_SDHC: 0
Loading Environment from SPI Flash... OK
In:    serial
Out:   serial
Err:   serial
Net:   SF: Detected mx25u3232f with page size 256 Bytes, erase size 64 KiB, total 4 MiB
Fman1: Uploading microcode version 108.4.9
PCIe0: pcie@3400000 Root Complex: no link
PCIe1: pcie@3500000 Root Complex: no link
PCIe2: pcie@3600000 disabled
FM1@DTSEC1 [PRIME], FM1@DTSEC2, FM1@DTSEC3, FM1@DTSEC5, FM1@DTSEC6
### main_loop entered: bootdelay=3

### main_loop: bootcmd="run wgBootSysA"
=> sf probe
SF: Detected mx25u3232f with page size 256 Bytes, erase size 64 KiB, total 4 MiB
=> sf read 0x80080000 0x0 0xff
device 0 offset 0x0, size 0xff
SF: 255 bytes @ 0x0 Read: OK
=> md 0x80080000 0xff
80080000: 01ee0100 aa55aa55 0a000000 06100010    ....U.U.........
80080010: 00000000 00000000 00000012 45580002    ..............XE
80080020: c1002000 40044000 00000000 00000000    . ...@.@........
80080030: 00036ffd 00000000 04183208 20044104    .o.......2...A. 
80080040: 00000001 00000096 40100000 0957015c    ...........@\.W.
80080050: 00000000 09570600 40100000 09570604    ......W....@..W.
80080060: 00502880 09ea08dc 0000e010 09570178    .(P.........x.W.
80080070: 00000008 09180000 0000009e 09570418    ..............W.
80080080: 0000009e 0957041c 0000009e 09570420    ......W..... .W.
80080090: 00004400 09ee00c0 00002200 09570158    .D......."..X.W.
800800a0: 00000001 89008040 00502880 09ea08dc    ....@....(P.....
800800b0: 00000300 09570158 01000100 89400890    ....X.W.......@.
800800c0: 01000100 89500890 01000100 89600890    ......P.......`.
800800d0: 000f400c 09550000 40006108 f5f2aa67    .@....U..a.@g...
800800e0: 00000000 00000000 00000000 00000000    ................
800800f0: 00000000 00000000 00000000 de000000    ................
80080100: deadbeef deadbeef deadbeef deadbeef    ................
80080110: deadbeef deadbeef deadbeef deadbeef    ................
(repeats)
=> mdio list
FSL_MDIO0:
4 - Generic PHY <--> FM1@DTSEC1
5 - Generic PHY <--> FM1@DTSEC2
6 - Generic PHY <--> FM1@DTSEC5
7 - Generic PHY <--> FM1@DTSEC6
FM_TGEC_MDIO:
1 - RealTek RTL8211F <--> FM1@DTSEC3

Forgot to mention I also have the GPL archive from WatchGuard for the T45, which should also include the T40. Iā€™m happy to share that with you, just drop me a DM with your email address.

22

Ayyy, 0x83000000 did it!

=> bootm 0x82000000#ls1043rdb
## Loading kernel from FIT Image at 82000000 ...
   Using 'ls1043rdb' configuration
   Trying 'kernel@0' kernel subimage
     Description:  Linux Kernel
     Created:      2025-10-08   5:51:55 UTC
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x820000d4
     Data Size:    8220210 Bytes = 7.8 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x83000000
     Entry Point:  0x83000000
     Hash algo:    sha1
     Hash value:   677fd2d6dc70b947438874fc02ca04f2fb28d9b1
   Verifying Hash Integrity ... sha1+ OK
## Loading fdt from FIT Image at 82000000 ...
   Using 'ls1043rdb' configuration
   Trying 'fdt@0' fdt subimage
     Description:  Flattened Device Tree blob LS1043RDB
     Created:      2025-10-08   5:51:55 UTC
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x827d700c
     Data Size:    28687 Bytes = 28 KiB
     Architecture: AArch64
     Load Address: 0x90000000
     Hash algo:    sha1
     Hash value:   38a5798e96060ebf88e88351e8a8c16865821858
   Verifying Hash Integrity ... sha1+ OK
   Loading fdt from 0x827d700c to 0x90000000
   Booting using the fdt blob at 0x90000000
   Uncompressing Kernel Image ... OK
   Using Device Tree in place at 0000000090000000, end 000000009001a00e
WARNING: SEC firmware not running, no kaslr-seed
WARNING failed to get smmu node: FDT_ERR_NOTFOUND
WARNING failed to get smmu node: FDT_ERR_NOTFOUND

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.6.103 (hmartin@renoir) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r30926-a8e3bff523) 14.3.0, GNU ld (GNU Binutils5
[    0.000000] Machine model: LS1043A RDB Board
[    0.000000] earlycon: uart8250 at MMIO 0x00000000021c0500 (options '')
[    0.000000] printk: bootconsole [uart8250] enabled
[    0.000000] efi: UEFI not found.
[    0.000000] Reserved memory: created DMA memory pool at 0x00000008ff000000, size 16 MiB
[    0.000000] OF: reserved mem: initialized node bman-fbpr, compatible id shared-dma-pool
[    0.000000] OF: reserved mem: 0x00000008ff000000..0x00000008ffffffff (16384 KiB) nomap non-reusable bman-fbpr
[    0.000000] Reserved memory: created DMA memory pool at 0x00000008fec00000, size 4 MiB
[    0.000000] OF: reserved mem: initialized node qman-fqd, compatible id shared-dma-pool
[    0.000000] OF: reserved mem: 0x00000008fec00000..0x00000008feffffff (4096 KiB) nomap non-reusable qman-fqd
[    0.000000] Reserved memory: created DMA memory pool at 0x00000008fc000000, size 32 MiB
[    0.000000] OF: reserved mem: initialized node qman-pfdr, compatible id shared-dma-pool
[    0.000000] OF: reserved mem: 0x00000008fc000000..0x00000008fdffffff (32768 KiB) nomap non-reusable qman-pfdr
[    0.000000] NUMA: No NUMA configuration found
[    0.000000] NUMA: Faking a node at [mem 0x0000000080000000-0x00000008ffffffff]
[    0.000000] NUMA: NODE_DATA [mem 0x8fe408a80-0x8fe40afff]
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000080000000-0x00000000ffffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   [mem 0x0000000100000000-0x00000008ffffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000080000000-0x00000000fbdfffff]
[    0.000000]   node   0: [mem 0x0000000880000000-0x00000008fbffffff]
[    0.000000]   node   0: [mem 0x00000008fc000000-0x00000008fdffffff]
[    0.000000]   node   0: [mem 0x00000008fe000000-0x00000008febfffff]
[    0.000000]   node   0: [mem 0x00000008fec00000-0x00000008ffffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000080000000-0x00000008ffffffff]
[    0.000000] On node 0, zone Normal: 16896 pages in unavailable ranges
[    0.000000] cma: Reserved 16 MiB at 0x00000000fac00000 on node -1
[    0.000000] percpu: Embedded 20 pages/cpu s44008 r8192 d29720 u81920
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: root=/dev/sda3 rw console=ttyS0,115200 earlycon=uart8250,mmio,0x21c0500
(snip)
[    2.181260] physmap-flash 60000000.nor: physmap platform flash device: [mem 0x60000000-0x67ffffff]
[    2.190287] SError Interrupt on CPU2, code 0x00000000bf000002 -- SError
[    2.190289] fsl-ifc 1530000.memory-controller: transaction sent to IFC is not mapped to any memory bank 0x80000000
[    2.190296] CPU: 2 PID: 1 Comm: swapper/0 Tainted: G   M               6.6.103 #0
[    2.190305] Hardware name: LS1043A RDB Board (DT)

Of course it kernel panics later on, but this is progress!

2 Likes