OpenWrt support for HP Prototype Access Point?

For Developers
1

Hi Everyone,

Admittedly, I have not used OpenWrt much in the past. I started out many years ago with DD-WRT and it worked for me. I've been playing a little more with OpenWrt lately, and I'm looking into maybe installing it on a device I have. The problem is, I'm not exactly sure what it is.

I got this at a ham fest a while back, and it seems that maybe a firmware upgrade went wrong on it at some point, so it's unusable at this point.

Here's what I can tell you about it.

The label on the outside says:

HP Apache Proto-1B (3)
Product: Apache (AP1)

A label on the inside says:

Rev 1b(3)

I ran a few commands from the help just to see what I could figure out, but I do not have much experience with this yet.

version:

U-Boot 96.1 (Apr 24 2012 - 08:38:10)

U-Boot pci command shows:

=> pci 0
Scanning PCI devices on bus 0
BusDevFun  VendorId   DeviceId   Device Class       Sub-Class
_____________________________________________________________
00.00.00   0x1957     0x0100     Processor               0x20
=> pci 1
Scanning PCI devices on bus 1
BusDevFun  VendorId   DeviceId   Device Class       Sub-Class
_____________________________________________________________
01.00.00   0x1957     0x0100     Processor               0x20
=> pci 2
Scanning PCI devices on bus 2
BusDevFun  VendorId   DeviceId   Device Class       Sub-Class
_____________________________________________________________
02.00.00   0x168c     0x0033     Network controller      0x80

The first two devices identify as a Freescale P1020E. The third one is an AR958x 802.11abgn Wireless Network Adapter

nand info:

Device 0: NAND 128MiB 1,8V 8-bit, sector size 128 KiB

bdinfo:

memstart    = 0x00000000
memsize     = 0x10000000
flashstart  = 0x00000000
flashsize   = 0x00000000
flashoffset = 0x00000000
sramstart   = 0x00000000
sramsize    = 0x00000000
> immr_base   = 0xFFE00000
bootflags   = 0x100F0000
intfreq     =    800 MHz
busfreq     =    400 MHz
ethaddr     = 08:2e:5f:ee:f0:f6
IP addr     = 192.168.1.1
baudrate    =      0 bps
defaultcfg  = 0x00000000
inforec     = 0x01001000
expansion sig= 0xBD0EADED
struct size = 0x00000880
inforec_bid = 0x1284FAB6
sys_clk_freq= 0x03F940AA

iminfo:

## Checking Image at 01000000 ...
Unknown image format!

nandbbx partinfo:

[partinfo]
Num StartBk BkCount Mtd Repl Skip Name
  0       0       6   4    0    1 boot
  1       6       2  -1    1    1 bid
  2       8      20   0    1    1 kernel
  3      28      20   1    1    1 nvinfo
  4      48     2e0   2    1    1 slash
  5     328      20  -1    1    0 pool
  6     348      b0   3    1    1 flash
  7     3f8       8  -1    0    0 bbt

printenv:

bootargs=ro
bootcmd=setenv bootargs root=/dev/$bdev rw rootdelay=30 console=$consoledev,$baudrate $othbootargs;usb start;ext2load usb 0:1 $loadaddr /boot/$bootfile;ext2load usb 0:1 $fdtaddr /boot/$fdtfile;bootm $loadaddr - $fdtaddr
ramboot=setenv bootargs root=/dev/ram rw console=$consoledev,$baudrate $othbootargs; tftp $ramdiskaddr $ramdiskfile;tftp $loadaddr $bootfile;tftp $fdtaddr $fdtfile;bootm $loadaddr $ramdiskaddr $fdtaddr
nfsboot=setenv bootargs root=/dev/nfs rw nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip:$gatewayip:$netmask:$hostname:$netdev:off console=$consoledev,$baudrate $othbootargs;tftp $loadaddr $bootfile;tftp $fdtaddr $fdtfile;bootm $loadaddr - $fdtaddr
bootdelay=3
baudrate=115200
loads_echo=1
ipaddr=192.168.1.1
serverip=192.168.1.111
rootpath=/opt/nfsroot
hostname=NANAIMO
bootfile=uImage
loadaddr=1000000
netdev=eth0
uboot=u-boot.bin
loadaddr=1000000
bootfile=uImage
tftpflash=tftpboot $loadaddr $uboot; protect off 0x01001000 +$filesize; erase 0x01001000 +$filesize; cp.b $loadaddr 0x01001000 $filesize; protect on 0x01001000 +$filesize; cmp.b $loadaddr 0x01001000 $filesize
consoledev=ttyS0
ramdiskaddr=2000000
ramdiskfile=rootfs.ext2.gz.uboot
fdtaddr=c00000
fdtfile=p2020rdb.dtb
bdev=sda1
jffs2nand=mtdblock9
nandbootaddr=200000
nandfdtaddr=100000
nandimgsize=400000
nandfdtsize=100000
usb_phy_type=ulpi
vscfw_addr=ef000000
othbootargs=ramdisk_size=700000 cache-sram-size=0x10000
nandboot=setenv bootargs root=/dev/$jffs2nand rw rootfstype=jffs2 console=$consoledev,$baudrate $othbootargs;nand read 2000000 $nandbootaddr $nandimgsize;nand read 3000000 $nandfdtaddr $nandfdtsize;bootm 2000000 - 3000000;
recreate_bbt=nandbbx scanbbt; nandbbx trashsb; reset
ethaddr=08:2e:5f:ee:f0:f6
ethact=eTSEC1

Environment size: 1733/131068 bytes

I tried searching around to see if there was a way I could maybe get a version of OpenWrt to run on this thing, but, again, I don't really know what I'm doing. Here's what I tried.

I looked at the device database and found a similar device just to see if I could get OpenWrt to run on it and found the Enterasys ws-ap3710i. So I downloaded that and ran the following commands.

=> tftpboot openwrt-21.02.1-mpc85xx-p1020-enterasys_ws-ap3710i-initramfs-kernel.bin
eTSEC1: Link up, full duplex, 100 Mbps
Using eTSEC1 device
TFTP from server 192.168.1.158; our IP address is 192.168.1.1
Filename 'openwrt-21.02.1-mpc85xx-p1020-enterasys_ws-ap3710i-initramfs-kernel.bin'.
Load address: 0x1000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########################
done
Bytes transferred = 6111612 (5d417c hex)
=> iminfo

## Checking Image at 01000000 ...
   FIT image found
   FIT description: POWERPC OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel@1)
     Description:  POWERPC OpenWrt Linux-5.4.154
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x010000ec
     Data Size:    6099144 Bytes =  5.8 MB
     Architecture: PowerPC
     OS:           Linux
     Load Address: 0x00000000
     Entry Point:  0x00000000
     Hash algo:    crc32
     Hash value:   b02c2ba1
     Hash algo:    sha1
     Hash value:   2c5e1e5b4aad33aa0ecd0c22fd268c3cf1df8ceb
    Image 1 (fdt@1)
     Description:  POWERPC OpenWrt enterasys_ws-ap3710i device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x015d12fc
     Data Size:    10570 Bytes = 10.3 kB
     Architecture: PowerPC
     Hash algo:    crc32
     Hash value:   0d1b157d
     Hash algo:    sha1
     Hash value:   a2c769d16b36dd610ac3304928f5949cc91745a6
    Default Configuration: 'config@1'
    Configuration 0 (config@1)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@1
## Checking hash(es) for FIT Image at 01000000 ...
   Hash(es) for Image 0 (kernel@1): crc32+ sha1+
   Hash(es) for Image 1 (fdt@1): crc32+ sha1+
=> bootm
read_vblock 6
Kernel arg: 'ro'
## Booting image at 01000000 ...
Boot: Invalid image header: bad magic

Again, I don't really know what I'm doing, or if I'm doing it right, but any help would be appreciated in finding out if this thing can actually run OpenWrt. It's a nice Outdoor POE powered ABGN access point if I can get it going.

2

Not listed in the Table of Hardware.

3

Which is not to say that it is not capable of running it. I mean no offense, but your reply it not very helpful. I already stated that I was trying to find a similar device in the database just to see if it was capable. Now, obviously there are going to be some small differences, but it has the same processor and wireless as the device that I mentioned. So, in theory it is possible.

What I'm asking for is help in finding out if it is really possible. I'm not asking for help in searching through the database of devices that are already known to work with it. As OpenWrt is open source, and known to work on other similar devices, I'd prefer that someone with actual experience with writing firmware maybe chime in and tell me whether they think it can be done or not, and why or why not.

Again, I mean no offense, and I thank you for your reply, it is just not what I was looking for.

I know that it runs U-Boot. I know that U-Boot can load OpenWRT. I know that U-Boot recognizes the OpenWRT image, shown above in the iminfo command I ran after uploading it. And, I do have a small amount of programming experience. What I don't know is how to actually make the image boot. I've never built a router/switch/access point firmware and wouldn't know where to start, what to change, or why it says "Boot: Invalid image header: bad magic, or if I'm even going about the process of trying to upload the firmware correctly.

4

Possible? probably. Easy? Absolutely not.

Since your unit is not currently in the database of supported devices, it means there is no 'ready made' firmware image for you to download and install. Unlike some OS's, there is no "generic" installation for OpenWrt. You would need to build a custom image for your device.

To do this, you need to know (or probe to learn about) all of the key hardware (processor, ethernet and switch phy, wireless chipset, RAM, flash storage, flash layout including any calibration data for the wireless system, etc.) AND how they are all connected (usually down to the pin level). All of this can be done, of course, but it is not trivial. And obviously you have probed and gotten a lot of info, but then it needs to be added to the OpenWrt codebase, compiled, loaded and tested/debugged (and fixed when things don't work quite right).

If you are a developer, you probably can get OpenWrt running on this device with a bit of work. If not, you could request support is added for this device by the development team, but there is another set of wrinkles on that front: if your device is a prototype, it may be different than any similar production devices (if it ever went into mass production) and it is a big ask to support something bespoke; the developers wouldn't be able to get hands-on experience with the device for testing/debug, and it is likely already obsolete given that it is an a/b/g/n device and not even ac. Along with the limited wifi capabilities usually comes limited RAM and flash storage, so it may not even be able to run OpenWrt based on those limitations, too.

1 Like
5

I figured that. I just have no experience in doing so...yet.

Ok, this is a good starting point for me. I appreciate the information. The processor and wireless chip are already known. The next step I guess would be identifying the rest. Again not much experience with this stuff yet, but I don't know that there is a switch phy as it only has the one ethernet input port being an access point.

I totally understand this and expect to do most of the work myself, I just need to learn how. I have done some minimal work with building OpenWrt for an Onion Omega2+, but that was pretty much a pre-made envinronment ready to go and I was just modifying packages and adding my own scripts.

I'm pretty sure the flash is big enough, but not entirely sure how to check the ram size yet short of finding the chips and identifying them...which I'll need to anyway. Are there any ways to get any of this information any easier through U-Boot? Is it possible to dump what is on there and try to use it to get any information?

6

I'm not a developer, so I can't really answer any of the how-to's when it comes to adding support for a device.

That said, you can start by reading the developer guide and then post specific questions as they arise on the developer section of the forum. There is a certain amount of assumed knowledge when you're posting in that section, so be clear about what you do and don't know so that you can get the right help.

7

Usually one starts from a working OEM firmware, which can be analyzed to determine what needs to be done to port OpenWrt to the device - lacking this known-working setup won't make it any easier (nor that powerpc is rather underrepresented in terms of OpenWrt in the first place).

2 Likes
8

This ^^^^^

9

Does it look like a commerical case that it is in? A picture might help someone identify what it became if it is a near-release prototype of some kind.

Other than that I'd probably throw every image I could find of the right platform at it to see if it gets past that Boot: Invalid image header: bad magic error. Once you know what is needed there you can get help to patch the most likely looking images (maybe the one you already tried) to be bootable.

10

Are there any PPC variants supported? Nothing in target/linux looks obviously PPC to me, although one of those could be the name for a PowerPC subvariant.

11

There's a few other threads that might help you nudge forwards if you search the forums for just "P1020E", for example:Adding OpenWrt support for ws-ap3825i.

12

Trying to search for something similar online, the closest I can come up with is this.

Except that it only has two antenna connectors on that side (bottom when mounted upright) labeled "wlan chain 0" and "wlan chain 1" with the extra hole open (serial cable was run through it) and the top side has two antenna connectors labeled "wlan chain 2 default" and "wlan chain 2 alternate" as well as a GPS antenna. I will try to upload some pictures soon.

I've been unable to find a copy of the firmware for the msm466-r available for download. HP wants you to sign up to be a partner, and all the web sites I've found with links either point to HP or are no longer valid.

I did make some small progress (I think) on identifying a chip. Playing around with the i2c command in U-Boot last night, I found that there is one device on address 0x56.

Looking up devices that use that address I found these results.

0x56 PCA9685 MB85RC

I'm guessing (and could be wrong) that it's more likely to be the MB85RC than the PCA9685. I mean, would a 16 channel PWM driver be needed in an AP? Though I have not actually looked at the chips yet to identify them.

13

Just for reference, this is what I get from the serial when I try to boot it with whatever is on there.

^^GO:fe50008
NAND:  0 nand_init ffa00000
fsl_elbc_nand using SW ECC with HW layout
NAND device: Manufacturer ID: 0x2c, Chip ID: 0xa1 (Micron NAND 128MiB 1,8V 8-bit)
nand_unlock: start: ffa00000, length: 134217728!
Nandflash_init BOOT
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
nandbbx: searching partblock from 3fd to 3e9, bbt_td 3ff, bbt_md 3fe
block_read 3fb
block_read 3fa
nandbbx: partblock found 3fb and 3fa
Partitions:
Num StartBk BkCount Mtd Repl Skip Name
  0       0       6   4    0    1 boot
  1       6       2  -1    1    1 bid
  2       8      20   0    1    1 kernel
  3      28      20   1    1    1 nvinfo
  4      48     2e0   2    1    1 slash
  5     328      20  -1    1    0 pool
  6     348      b0   3    1    1 flash
  7     3f8       8  -1    0    0 bbt
block_read 347
block_read 346
nandbbx: superblock found 347 and 346
nandbbx: bid found at blk 6 and 7
nandbbx: started; map from: 6, pool: used 328-327 (6%), free 328-345
128 MiB
read_vblock 6


U-Boot 96.1 (Apr 24 2012 - 08:38:10)

Using default environment

read_vblock 6
    eTSEC2 is in sgmii mode.

    PCIE2 connected to Slot 1 as Root Complex (base addr ffe09000)
Outbound memory range: a0000000:c0000000
PCICSRBAR @ 0xfff00000
R0 bus_start: 0 phys_start: 0 size: 10000000
PCI reg:0 00000000a0000000:00000000a0000000 0000000020000000 00000000
PCI reg:1 00000000ffc20000:0000000000000000 0000000000010000 00000001
PCI reg:2 00000000ffe00000:00000000fff00000 0000000000100000 00000100
PCI reg:3 0000000000000000:0000000000000000 0000000010000000 00000108
PCI Autoconfig: Bus Memory region: [0xa0000000-0xbfffffff],
                Physical Memory [a0000000-bfffffffx]
PCI Autoconfig: Bus I/O region: [0x0-0xffff],
                Physical Memory: [ffc20000-ffc2ffff]
....PCIe link error. LTSSM=0x01.  Asserting PCIe reset @ffe09f00 = 88400000
....PCIE link error.  Skipping scan.LTSSM=0x01
    PCIE2 on bus 00 - 00

    PCIE1 connected to Slot 2 as Root Complex (base addr ffe0a000)
Outbound memory range: c0000000:e0000000
PCICSRBAR @ 0xfff00000
R0 bus_start: 0 phys_start: 0 size: 10000000
PCI reg:0 00000000c0000000:00000000c0000000 0000000020000000 00000000
PCI reg:1 00000000ffc30000:0000000000000000 0000000000010000 00000001
PCI reg:2 00000000ffe00000:00000000fff00000 0000000000100000 00000100
PCI reg:3 0000000000000000:0000000000000000 0000000010000000 00000108
PCI Autoconfig: Bus Memory region: [0xc0000000-0xdfffffff],
                Physical Memory [c0000000-dfffffffx]
PCI Autoconfig: Bus I/O region: [0x0-0xffff],
                Physical Memory: [ffc30000-ffc3ffff]
...PCIE LTSSM=0x16, Negotiated link width=1
               Scanning PCI bus 02
PCI Scan: Found Bus 2, Device 0, Function 0
PCI Autoconfig: BAR 0, Mem, size=0x20000, address=0xc0000000 bus_lower=0xc0020000
        02  00  168c  0033  0280  ff
    PCIE1 on bus 01 - 02

In:    serial
Out:   serial
Err:   serial
Net:   eTSEC1
hw_flag=80000000, bss=fff0000 (27288 bytes), code=ff70000 (340992 bytes)
sys_clk=66666666

  Protocol Supported: ARP, ICMP, IP, TCP, UDP, TFTP, DHCP
  Server Ready
checking for reset/clear button... : not pressed
watchDogSetup: enabled  HW_FLAG  80000000
Hit any key to stop autoboot:  0
Waiting for PHY auto negotiation to complete...... TIMEOUT !
eTSEC1: Link down, half duplex, 1000 Mbps
read_vblock 6
Kernel arg: 'ro'
## Trying to boot Linux kernel from flash block 0...
read_vblock 8
## Booting image at 00200000 ...
   Image Name:   root_Voyager26_
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    2165670 Bytes =  2.1 MB
   Load Address: 01000000
   Entry Point:  01000000
read_vblock 9
read_vblock a
read_vblock b
read_vblock c
read_vblock d
read_vblock e
read_vblock f
read_vblock 10
read_vblock 11
read_vblock 12
read_vblock 13
read_vblock 14
read_vblock 15
read_vblock 16
read_vblock 17
read_vblock 18
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
## Booting image2 at 00200000 ...
read_vblock 6
bid at fec5270 and ffee80
## Transferring control to Linux (at address 01000000) ...
## Loading Linux (at address 01000000) ...
Nanaimo platform_init▒▒Memory <- <0x0 0x0 0x0 0x10000000> (256MB)
ENET0: local-mac-address <- 08:2e:5f:ee:f0:f6
CPU clock-frequency <- 0x2faf07f8 (800MHz)
CPU timebase-frequency <- 0x2faf080 (50MHz)
CPU bus-frequency <- 0x17d783fc (400MHz)

zImage starting: loaded at 0x01000000 (sp: 0x0121a7f8)
Allocating 0x4621d0 bytes for kernel ...
gunzipping (0x00000000 <- 0x0100cff4:0x012183bd)...done 0x43c6a4 bytes

Linux/PowerPC load: root=/dev/mtdblock2 ro bd_p=1219064
Finalizing device tree... flat tree at 0x1227300
Using P1020 RDB machine description
Memory CAM mapping: 256 Mb, residual: 0Mb
Linux version 2.6.34.1-colubris (root@paradise-One) (gcc version 3.4.4) #1 Tue Jan 8 23:50:48 EST 2013
bd recovered from c1219064
bootconsole [udbg0] enabled
setup_arch: bootmem
mpc85xx_rdb_setup_arch()
Found FSL PCI host bridge at 0x00000000ffe09000. Firmware bus number: 0->255
PCI host bridge /pcie@ffe09000  ranges:
 MEM 0x00000000a0000000..0x00000000bfffffff -> 0x00000000a0000000
  IO 0x00000000ffc30000..0x00000000ffc3ffff -> 0x0000000000000000
/pcie@ffe09000: PCICSRBAR @ 0xfff00000
Found FSL PCI host bridge at 0x00000000ffe0a000. Firmware bus number: 0->255
PCI host bridge /pcie@ffe0a000  ranges:
 MEM 0x00000000c0000000..0x00000000dfffffff -> 0x00000000c0000000
  IO 0x00000000ffc20000..0x00000000ffc2ffff -> 0x0000000000000000
/pcie@ffe0a000: PCICSRBAR @ 0xfff00000
MPC85xx RDB board from Freescale Semiconductor
arch: exit
Zone PFN ranges:
  DMA      0x00000000 -> 0x00010000
  Normal   empty
  HighMem  empty
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00010000
MMU: Allocated 1088 bytes of context maps for 255 contexts
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
Kernel command line: root=/dev/mtdblock2 ro bd_p=1219064
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 255340k/262144k available (4188k kernel code, 6804k reserved, 152k data, 148k bss, 164k init)
Kernel virtual memory layout:
  * 0xfffd0000..0xfffff000  : fixmap
  * 0xff800000..0xffc00000  : highmem PTEs
  * 0xff7d8000..0xff800000  : early ioremap
  * 0xd1000000..0xff7d8000  : vmalloc & ioremap
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
RCU-based detection of stalled CPUs is enabled.
NR_IRQS:512 nr_irqs:512
mpic: Setting up MPIC " OpenPIC  " version 1.2 at ffe40000, max 2 CPUs
mpic: ISU size: 256, shift: 8, mask: ff
mpic: Initializing for 256 sources
clocksource: timebase mult[5000000] shift[22] registered
Console: colour dummy device 80x25
Mount-cache hash table entries: 512
NET: Registered protocol family 16

Nanaimo init
^^
PowerPC Book-E Watchdog Timer Enabled
PCI: Probing PCI hardware
pci 0000:00:00.0: ignoring class b20 (doesn't match header type 01)
pci 0000:00:00.0: PCI bridge to [bus 01-ff]
pci 0001:02:00.0: ignoring class b20 (doesn't match header type 01)
pci 0001:02:00.0: PCI bridge to [bus 03-ff]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0:   bridge window [io  0xff7ec000-0xff7fbfff]
pci 0000:00:00.0:   bridge window [mem 0xa0000000-0xbfffffff]
pci 0000:00:00.0:   bridge window [mem pref disabled]
pci 0000:00:00.0: enabling device (0106 -> 0107)
pci 0001:02:00.0: BAR 9: can't assign mem pref (size 0x100000)
pci 0001:03:00.0: BAR 6: assigned [mem 0xc0020000-0xc002ffff pref]
pci 0001:02:00.0: PCI bridge to [bus 03-03]
pci 0001:02:00.0:   bridge window [io  0xff7d9000-0xff7e8fff]
pci 0001:02:00.0:   bridge window [mem 0xc0000000-0xdfffffff]
pci 0001:02:00.0:   bridge window [mem pref disabled]
pci 0001:02:00.0: enabling device (0106 -> 0107)
bio: create slab <bio-0> at 0
vgaarb: loaded
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Freescale Elo / Elo Plus DMA driver
Switching to clocksource timebase
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
fsl-elo-dma ffe21300.dma: #0 (fsl,eloplus-dma-channel), irq 20
fsl-elo-dma ffe21300.dma: #1 (fsl,eloplus-dma-channel), irq 21
fsl-elo-dma ffe21300.dma: #2 (fsl,eloplus-dma-channel), irq 22
fsl-elo-dma ffe21300.dma: #3 (fsl,eloplus-dma-channel), irq 23
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NTFS driver 2.1.29 [Flags: R/O].
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
SGI XFS with security attributes, no debug enabled
msgmni has been set to 498
Crypto engine S/W registered as #4
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Generic non-volatile memory driver v1.1
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250.0: ttyS0 at MMIO 0xffe04500 (irq = 42) is a 16550A
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Loaded Module sc16is850l
brd: module loaded
loop: module loaded
nbd: registered device at major 43
Hello, hp math
Testing multiplication, multiply 74215543 by 2 = 148431086
Testing division, divide 74215543 by 2 = 37107771
********* SINE CALCULATION TESTING *********
*************************,0
**********************************,22
******************************************,44
************************************************,67
**************************************************,89
************************************************,112
******************************************,134
**********************************,157
*************************,179
****************,202
********,224
**,247
,269
**,292
********,314
****************,337
*************************,359
********* COSINE CALCULATION TESTING *********
**************************************************,0
************************************************,22
******************************************,44
**********************************,67
*************************,89
****************,112
********,134
**,157
,179
**,202
********,224
****************,247
*************************,269
**********************************,292
******************************************,314
************************************************,337
**************************************************,359
********* TESTING GPS DISTANCE *********
position1: lat=74215543, lon=-124819895, alt=70000
position2: lat=74216045, lon=-124819232, alt=72000
getEarthRadius(), earth radius (m): 6553500
GPS distance = 45
Testing square root
theta: 0, sqroot: 0
theta: 19634954, sqroot: 4431
theta: 39269908, sqroot: 6266
theta: 58904862, sqroot: 7674
theta: 78539816, sqroot: 8862
theta: 98174770, sqroot: 9908
theta: 117809724, sqroot: 10854
theta: 137444678, sqroot: 11723
theta: 157079632, sqroot: 12533
theta: 176714586, sqroot: 13293
theta: 196349540, sqroot: 14012
theta: 215984494, sqroot: 14696
theta: 235619448, sqroot: 15349
theta: 255254402, sqroot: 15976
theta: 274889356, sqroot: 16579
theta: 294524310, sqroot: 17161
theta: 314159264, sqroot: 17724
theta: 333794218, sqroot: 18270
theta: 353429172, sqroot: 18799
theta: 373064126, sqroot: 19314
theta: 392699080, sqroot: 19816
theta: 412334034, sqroot: 20306
theta: 431968988, sqroot: 20783
theta: 451603942, sqroot: 21250
theta: 471238896, sqroot: 21708
theta: 490873850, sqroot: 22155
theta: 510508804, sqroot: 22594
theta: 530143758, sqroot: 23024
theta: 549778712, sqroot: 23447
theta: 569413666, sqroot: 23862
theta: 589048620, sqroot: 24270
theta: 608683574, sqroot: 24671
theta: 628318528, sqroot: 25066

MyNeville testing, given:
i=0, x=2, f=500000
i=1, x=4, f=250000
i=2, x=5, f=200000
Here are approximation for other values of x
x=1, f=700000
x=2, f=500000
x=3, f=350000
x=4, f=250000
x=5, f=200000
x=6, f=200000
x=7, f=250000
x=8, f=350000
x=9, f=500000
Test degreesToRadians()
degress: 4257961740, radians: 74315451
Testing AL1 cell radius
getEarthRadius(), earth radius (m): 6553500
isWithinCellRadius(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is NOT within 30m of location(74215543,-124819895,70000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRadius(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is within 50m of location(74215543,-124819895,70000)
Testing AL1 cell rectangle
isWithinCellRectangle(), Rectangle cell, width: 100, height: 80, direction: 0
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -5000000000, ULy: 4000000000, LRx: 5000000000, LRy: -4000000000
original (x,y) = (32, 32), rotated (x,y) =(3200000000, 3200000000)
isWithinCellRectangle, Rotated corner points: (-5000000000, 4000000000),(5000000000, 4000000000),(5000000000, -4000000000),(-5000000000, -4000000000)
isWithinCellRectangle, Rotated points: (3200000000, 3200000000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is within rectangle (width=100,height=80) at location(74215543,-124819895,70000) rotated by 0 degree
isWithinCellRectangle(), Rectangle cell, width: 100, height: 80, direction: 45
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -5000000000, ULy: 4000000000, LRx: 5000000000, LRy: -4000000000
original (x,y) = (32, 32), rotated (x,y) =(4525486048, 32)
isWithinCellRectangle, Rotated corner points: (-707107240, 6363964750),(6363964760, -707107150),(707107240, -6363964750),(-6363964760, 707107150)
isWithinCellRectangle, Rotated points: (4525486048, 32)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is within rectangle (width=100,height=80) at location(74215543,-124819895,70000) rotated by 45 degree
isWithinCellRectangle(), Rectangle cell, width: 100, height: 80, direction: 90
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -5000000000, ULy: 4000000000, LRx: 5000000000, LRy: -4000000000
original (x,y) = (32, 32), rotated (x,y) =(3200000000, -3200000000)
isWithinCellRectangle, Rotated corner points: (4000000000, 5000000000),(4000000000, -5000000000),(-4000000000, -5000000000),(-4000000000, 5000000000)
isWithinCellRectangle, Rotated points: (3200000000, -3200000000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is within rectangle (width=100,height=80) at location(74215543,-124819895,70000) rotated by 90 degree
isWithinCellRectangle(), Rectangle cell, width: 100, height: 80, direction: 135
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -5000000000, ULy: 4000000000, LRx: 5000000000, LRy: -4000000000
original (x,y) = (32, 32), rotated (x,y) =(64, -4525486016)
isWithinCellRectangle, Rotated corner points: (6363964700, 707107280),(-707107100, -6363964720),(-6363964700, -707107280),(707107100, 6363964720)
isWithinCellRectangle, Rotated points: (64, -4525486016)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is NOT within rectangle (width=100,height=80) at location(74215543,-124819895,70000) rotated by 135 degree
isWithinCellRectangle(), Rectangle cell, width: 100, height: 80, direction: 180
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -5000000000, ULy: 4000000000, LRx: 5000000000, LRy: -4000000000
original (x,y) = (32, 32), rotated (x,y) =(-3200000000, -3200000000)
isWithinCellRectangle, Rotated corner points: (5000000000, -4000000000),(-5000000000, -4000000000),(-5000000000, 4000000000),(5000000000, 4000000000)
isWithinCellRectangle, Rotated points: (-3200000000, -3200000000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is within rectangle (width=100,height=80) at location(74215543,-124819895,70000) rotated by 180 degree
isWithinCellRectangle(), Rectangle cell, width: 20, height: 20, direction: 0
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -1000000000, ULy: 1000000000, LRx: 1000000000, LRy: -1000000000
original (x,y) = (-12, 10), rotated (x,y) =(-1200000000, 1000000000)
isWithinCellRectangle, Rotated corner points: (-1000000000, 1000000000),(1000000000, 1000000000),(1000000000, -1000000000),(-1000000000, -1000000000)
isWithinCellRectangle, Rotated points: (-1200000000, 1000000000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4257952647,-7147357669,68)-(4257961757,-7147372623,68)=16 (m)
Location (74315452,-124745185,68) is NOT within rectangle (width=20,height=20) at location(74315293,-124744924,68) rotated by 0 degree
isWithinCellRectangle(), Rectangle cell, width: 30, height: 30, direction: 0
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -1500000000, ULy: 1500000000, LRx: 1500000000, LRy: -1500000000
original (x,y) = (-12, 10), rotated (x,y) =(-1200000000, 1000000000)
isWithinCellRectangle, Rotated corner points: (-1500000000, 1500000000),(1500000000, 1500000000),(1500000000, -1500000000),(-1500000000, -1500000000)
isWithinCellRectangle, Rotated points: (-1200000000, 1000000000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4257952647,-7147357669,68)-(4257961757,-7147372623,68)=16 (m)
Location (74315452,-124745185,68) is within rectangle (width=30,height=30) at location(74315293,-124744924,68) rotated by 0 degree
isWithinCellRectangle(), Rectangle cell, width: 40, height: 40, direction: 0
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -2000000000, ULy: 2000000000, LRx: 2000000000, LRy: -2000000000
original (x,y) = (-12, 10), rotated (x,y) =(-1200000000, 1000000000)
isWithinCellRectangle, Rotated corner points: (-2000000000, 2000000000),(2000000000, 2000000000),(2000000000, -2000000000),(-2000000000, -2000000000)
isWithinCellRectangle, Rotated points: (-1200000000, 1000000000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4257952647,-7147357669,68)-(4257961757,-7147372623,68)=16 (m)
Location (74315452,-124745185,68) is within rectangle (width=40,height=40) at location(74315293,-124744924,68) rotated by 0 degree
Generic platform RAM MTD, (c) 2004 Simtec Electronics
NAND device: Manufacturer ID: 0x2c, Chip ID: 0xa1 (Micron NAND 128MiB 1,8V 8-bit)
RedBoot partition parsing not available
Creating 4 MTD partitions on "ffa00000.flash":
0x000000100000-0x000000500000 : "NAND (RO) Linux Kernel Image"
ftl_cs: FTL header not found.
0x000000500000-0x000000900000 : "NAND (RO) NV Info"
ftl_cs: FTL header not found.
0x000000900000-0x000006900000 : "NAND (R0) MTD2"
ftl_cs: FTL header not found.
0x000006900000-0x000007f00000 : "NAND (RW) JFFS2 Root File System"
ftl_cs: FTL header not found.
Nandflash_init KERNEL Fs start 5
eLBC NAND device at 0xffa00000, bank 0
Fixed MDIO Bus: probed
eth0: Gianfar Ethernet Controller Version 1.2, 08:2e:5f:ee:f0:f6
eth0: Running with NAPI enabled
eth0: RX BD ring size for Q[0]: 256
eth0: RX BD ring size for Q[1]: 256
eth0: RX BD ring size for Q[2]: 256
eth0: RX BD ring size for Q[3]: 256
eth0: RX BD ring size for Q[4]: 256
eth0: RX BD ring size for Q[5]: 256
eth0: RX BD ring size for Q[6]: 256
eth0: RX BD ring size for Q[7]: 256
eth0: TX BD ring size for Q[0]: 256
eth0: TX BD ring size for Q[1]: 256
eth0: TX BD ring size for Q[2]: 256
eth0: TX BD ring size for Q[3]: 256
eth0: TX BD ring size for Q[4]: 256
eth0: TX BD ring size for Q[5]: 256
eth0: TX BD ring size for Q[6]: 256
eth0: TX BD ring size for Q[7]: 256
Freescale PowerQUICC MII Bus: probed
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
i2c /dev entries driver
rtc-ds1307 0-0056: SET TIME!
rtc-ds1307 0-0056: rtc core: registered ds1339 as rtc0
serial-sc16is850l 1-004d: SC16IS850L chip found
PowerPC Book-E Watchdog Timer Loaded
PowerPC Book-E Watchdog Timer Enabled (wdt_period=107 secs)
SPRN_TCR = 6c100000
Software Watchdog Timer: 0.07 initialized. soft_noboot=0 soft_margin=60 sec (nowayout= 0)
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
u32 classifier
nf_conntrack version 0.5.0 (3989 buckets, 15956 max)
UDP tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 164k init
fsl-elbc ffe05000.localbus: command failed: fir 4125e000 fcr 300000 status 20000001 mdr 0
end_request: I/O error, dev mtdblock2, sector 17544
SQUASHFS error: squashfs_read_data failed to read block 0x888383
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
fsl-elbc ffe05000.localbus: command failed: fir 4125e000 fcr 300000 status 20000001 mdr 0
end_request: I/O error, dev mtdblock2, sector 17544
SQUASHFS error: squashfs_read_data failed to read block 0x888383
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
Kernel panic - not syncing: Attempted to kill init!
Call Trace:
[cf833d30] [c0008d30] 0xc0008d30 (unreliable)
[cf833d60] [c003c170] 0xc003c170
[cf833df0] [c003efd0] 0xc003efd0
[cf833e30] [c003f204] 0xc003f204
[cf833e40] [c004a9c8] 0xc004a9c8
[cf833e70] [c0009cdc] 0xc0009cdc
[cf833f40] [c0011858] 0xc0011858
Rebooting in 180 seconds..
14

That's an interesting device.

From the dmesg the device tree is marking it as an nxp development board, P1020. Positively those boards have dts in mainline linux;

Are you certain it's an access point though? If so, why all the GPS hardware and calibration and no WLAN interface drivers in their kernel. Very odd!

Build a few images with the nxp dts and see what you get. Best of luck.

15

It is definitely an access point. I can only upload one picture in a post as a new user, so here's a link to my OneDrive with the pictures of it.

16

I haven't played at this level much, but AIUI there is nothing particularly magic about the magic numbers. They are just a sanity check that what is about to be booted is probably intended to be there, because it has a magic number to imply that.

I also vaguely recall that the magic number is a the start of the block, and uboot has commands to read / write arbitrary memory (md / mw maybe?).

So pulling that together, if you read the magic number just before the standard firmware boots and then write it into the firmware you've FTPed into place will that boot?

17

I've been busy for a few days, but I got back to playing around with it today and with the tftpboot command I uploaded the kernel image for HiveAP 330 and booting it from RAM I got the following and then it just froze.

=> tftpboot openwrt-21.02.0-mpc85xx-p1020-aerohive_hiveap-330-initramfs-kernel.bin
Using eTSEC1 device
TFTP from server 192.168.1.158; our IP address is 192.168.1.1
Filename 'openwrt-21.02.0-mpc85xx-p1020-aerohive_hiveap-330-initramfs-kernel.bin'.
Load address: 0x1000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #######################
done
Bytes transferred = 11098244 (a95884 hex)
=> bootm
read_vblock 6
Kernel arg: 'ro'
## Booting image at 01000000 ...
   Image Name:   POWERPC OpenWrt
   Image Type:   PowerPC Linux Kernel Image (uncompressed)
   Data Size:    11098180 Bytes = 10.6 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK

That would suggest that the kernel worked, right? But obviously it was not actually written to the nand, nor was the squashfs that goes with it. So, I'm assuming that's why it just hung there, because there was not an actual filesystem to load the os.

18

The initramfs is a self contained OS, run in RAM.

Like booting from an image written to an old school ramdrive.

19

I get that. Forgive me as I am still learning, but this image I used looks like it's 2 part setup when upgrading from the factory firmware of the HiveAP. There is the initramfs-kernel, and then there is the squashfs-fdt.

I was just thinking that the freezing had something to do with missing the squashfs. Or would it be because this particular kernel, while it seems to check out and not give the bad magic number error, is not exactly built for whatever chips are on this board?

Also, for anybody with u-boot experience, what is the difference (not physical, but in the u-boot scenario) between nand and eeprom? I guess, not knowing any better, that I thought it would have one or the other. Or maybe that eeprom would just for variable storage while the firmware would be stored in the nand. I seem to have an eeprom chip at i2c address 0x56, but then there is also the nand chip. Reading portions of both of them, some of the content has the same hex value, but at the beginning of the eeprom I see this. (read from eeprom into ram at 0x1000000)

01000000: 43 6f 6c 75 62 72 69 73 5f 42 49 44 5f 24 24 24 Colubris_BID_$$$

The first line of the nand is this.

01000000: 00ffffff ffffffff ffffffff ffffffff ................

And tons of ffffffff after that until I see some data at 01010000 that from that point on matches some data in the eeprom starting at 01011000.

20

Try appending earlyprintk to your bootargs

That will tell the kernel to continue printing messages to the serial console.