OpenWrt support for HP Prototype Access Point?

I'm not a developer, so I can't really answer any of the how-to's when it comes to adding support for a device.

That said, you can start by reading the developer guide and then post specific questions as they arise on the developer section of the forum. There is a certain amount of assumed knowledge when you're posting in that section, so be clear about what you do and don't know so that you can get the right help.

Usually one starts from a working OEM firmware, which can be analyzed to determine what needs to be done to port OpenWrt to the device - lacking this known-working setup won't make it any easier (nor that powerpc is rather underrepresented in terms of OpenWrt in the first place).

2 Likes

This ^^^^^

Does it look like a commerical case that it is in? A picture might help someone identify what it became if it is a near-release prototype of some kind.

Other than that I'd probably throw every image I could find of the right platform at it to see if it gets past that Boot: Invalid image header: bad magic error. Once you know what is needed there you can get help to patch the most likely looking images (maybe the one you already tried) to be bootable.

Are there any PPC variants supported? Nothing in target/linux looks obviously PPC to me, although one of those could be the name for a PowerPC subvariant.

There's a few other threads that might help you nudge forwards if you search the forums for just "P1020E", for example:Adding OpenWrt support for ws-ap3825i.

Trying to search for something similar online, the closest I can come up with is this.

Except that it only has two antenna connectors on that side (bottom when mounted upright) labeled "wlan chain 0" and "wlan chain 1" with the extra hole open (serial cable was run through it) and the top side has two antenna connectors labeled "wlan chain 2 default" and "wlan chain 2 alternate" as well as a GPS antenna. I will try to upload some pictures soon.

I've been unable to find a copy of the firmware for the msm466-r available for download. HP wants you to sign up to be a partner, and all the web sites I've found with links either point to HP or are no longer valid.

I did make some small progress (I think) on identifying a chip. Playing around with the i2c command in U-Boot last night, I found that there is one device on address 0x56.

Looking up devices that use that address I found these results.

0x56 PCA9685 MB85RC

I'm guessing (and could be wrong) that it's more likely to be the MB85RC than the PCA9685. I mean, would a 16 channel PWM driver be needed in an AP? Though I have not actually looked at the chips yet to identify them.

Just for reference, this is what I get from the serial when I try to boot it with whatever is on there.

^^GO:fe50008
NAND:  0 nand_init ffa00000
fsl_elbc_nand using SW ECC with HW layout
NAND device: Manufacturer ID: 0x2c, Chip ID: 0xa1 (Micron NAND 128MiB 1,8V 8-bit)
nand_unlock: start: ffa00000, length: 134217728!
Nandflash_init BOOT
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
nandbbx: searching partblock from 3fd to 3e9, bbt_td 3ff, bbt_md 3fe
block_read 3fb
block_read 3fa
nandbbx: partblock found 3fb and 3fa
Partitions:
Num StartBk BkCount Mtd Repl Skip Name
  0       0       6   4    0    1 boot
  1       6       2  -1    1    1 bid
  2       8      20   0    1    1 kernel
  3      28      20   1    1    1 nvinfo
  4      48     2e0   2    1    1 slash
  5     328      20  -1    1    0 pool
  6     348      b0   3    1    1 flash
  7     3f8       8  -1    0    0 bbt
block_read 347
block_read 346
nandbbx: superblock found 347 and 346
nandbbx: bid found at blk 6 and 7
nandbbx: started; map from: 6, pool: used 328-327 (6%), free 328-345
128 MiB
read_vblock 6


U-Boot 96.1 (Apr 24 2012 - 08:38:10)

Using default environment

read_vblock 6
    eTSEC2 is in sgmii mode.

    PCIE2 connected to Slot 1 as Root Complex (base addr ffe09000)
Outbound memory range: a0000000:c0000000
PCICSRBAR @ 0xfff00000
R0 bus_start: 0 phys_start: 0 size: 10000000
PCI reg:0 00000000a0000000:00000000a0000000 0000000020000000 00000000
PCI reg:1 00000000ffc20000:0000000000000000 0000000000010000 00000001
PCI reg:2 00000000ffe00000:00000000fff00000 0000000000100000 00000100
PCI reg:3 0000000000000000:0000000000000000 0000000010000000 00000108
PCI Autoconfig: Bus Memory region: [0xa0000000-0xbfffffff],
                Physical Memory [a0000000-bfffffffx]
PCI Autoconfig: Bus I/O region: [0x0-0xffff],
                Physical Memory: [ffc20000-ffc2ffff]
....PCIe link error. LTSSM=0x01.  Asserting PCIe reset @ffe09f00 = 88400000
....PCIE link error.  Skipping scan.LTSSM=0x01
    PCIE2 on bus 00 - 00

    PCIE1 connected to Slot 2 as Root Complex (base addr ffe0a000)
Outbound memory range: c0000000:e0000000
PCICSRBAR @ 0xfff00000
R0 bus_start: 0 phys_start: 0 size: 10000000
PCI reg:0 00000000c0000000:00000000c0000000 0000000020000000 00000000
PCI reg:1 00000000ffc30000:0000000000000000 0000000000010000 00000001
PCI reg:2 00000000ffe00000:00000000fff00000 0000000000100000 00000100
PCI reg:3 0000000000000000:0000000000000000 0000000010000000 00000108
PCI Autoconfig: Bus Memory region: [0xc0000000-0xdfffffff],
                Physical Memory [c0000000-dfffffffx]
PCI Autoconfig: Bus I/O region: [0x0-0xffff],
                Physical Memory: [ffc30000-ffc3ffff]
...PCIE LTSSM=0x16, Negotiated link width=1
               Scanning PCI bus 02
PCI Scan: Found Bus 2, Device 0, Function 0
PCI Autoconfig: BAR 0, Mem, size=0x20000, address=0xc0000000 bus_lower=0xc0020000
        02  00  168c  0033  0280  ff
    PCIE1 on bus 01 - 02

In:    serial
Out:   serial
Err:   serial
Net:   eTSEC1
hw_flag=80000000, bss=fff0000 (27288 bytes), code=ff70000 (340992 bytes)
sys_clk=66666666

  Protocol Supported: ARP, ICMP, IP, TCP, UDP, TFTP, DHCP
  Server Ready
checking for reset/clear button... : not pressed
watchDogSetup: enabled  HW_FLAG  80000000
Hit any key to stop autoboot:  0
Waiting for PHY auto negotiation to complete...... TIMEOUT !
eTSEC1: Link down, half duplex, 1000 Mbps
read_vblock 6
Kernel arg: 'ro'
## Trying to boot Linux kernel from flash block 0...
read_vblock 8
## Booting image at 00200000 ...
   Image Name:   root_Voyager26_
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    2165670 Bytes =  2.1 MB
   Load Address: 01000000
   Entry Point:  01000000
read_vblock 9
read_vblock a
read_vblock b
read_vblock c
read_vblock d
read_vblock e
read_vblock f
read_vblock 10
read_vblock 11
read_vblock 12
read_vblock 13
read_vblock 14
read_vblock 15
read_vblock 16
read_vblock 17
read_vblock 18
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
## Booting image2 at 00200000 ...
read_vblock 6
bid at fec5270 and ffee80
## Transferring control to Linux (at address 01000000) ...
## Loading Linux (at address 01000000) ...
Nanaimo platform_init▒▒Memory <- <0x0 0x0 0x0 0x10000000> (256MB)
ENET0: local-mac-address <- 08:2e:5f:ee:f0:f6
CPU clock-frequency <- 0x2faf07f8 (800MHz)
CPU timebase-frequency <- 0x2faf080 (50MHz)
CPU bus-frequency <- 0x17d783fc (400MHz)

zImage starting: loaded at 0x01000000 (sp: 0x0121a7f8)
Allocating 0x4621d0 bytes for kernel ...
gunzipping (0x00000000 <- 0x0100cff4:0x012183bd)...done 0x43c6a4 bytes

Linux/PowerPC load: root=/dev/mtdblock2 ro bd_p=1219064
Finalizing device tree... flat tree at 0x1227300
Using P1020 RDB machine description
Memory CAM mapping: 256 Mb, residual: 0Mb
Linux version 2.6.34.1-colubris (root@paradise-One) (gcc version 3.4.4) #1 Tue Jan 8 23:50:48 EST 2013
bd recovered from c1219064
bootconsole [udbg0] enabled
setup_arch: bootmem
mpc85xx_rdb_setup_arch()
Found FSL PCI host bridge at 0x00000000ffe09000. Firmware bus number: 0->255
PCI host bridge /pcie@ffe09000  ranges:
 MEM 0x00000000a0000000..0x00000000bfffffff -> 0x00000000a0000000
  IO 0x00000000ffc30000..0x00000000ffc3ffff -> 0x0000000000000000
/pcie@ffe09000: PCICSRBAR @ 0xfff00000
Found FSL PCI host bridge at 0x00000000ffe0a000. Firmware bus number: 0->255
PCI host bridge /pcie@ffe0a000  ranges:
 MEM 0x00000000c0000000..0x00000000dfffffff -> 0x00000000c0000000
  IO 0x00000000ffc20000..0x00000000ffc2ffff -> 0x0000000000000000
/pcie@ffe0a000: PCICSRBAR @ 0xfff00000
MPC85xx RDB board from Freescale Semiconductor
arch: exit
Zone PFN ranges:
  DMA      0x00000000 -> 0x00010000
  Normal   empty
  HighMem  empty
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00010000
MMU: Allocated 1088 bytes of context maps for 255 contexts
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
Kernel command line: root=/dev/mtdblock2 ro bd_p=1219064
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 255340k/262144k available (4188k kernel code, 6804k reserved, 152k data, 148k bss, 164k init)
Kernel virtual memory layout:
  * 0xfffd0000..0xfffff000  : fixmap
  * 0xff800000..0xffc00000  : highmem PTEs
  * 0xff7d8000..0xff800000  : early ioremap
  * 0xd1000000..0xff7d8000  : vmalloc & ioremap
SLUB: Genslabs=13, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
RCU-based detection of stalled CPUs is enabled.
NR_IRQS:512 nr_irqs:512
mpic: Setting up MPIC " OpenPIC  " version 1.2 at ffe40000, max 2 CPUs
mpic: ISU size: 256, shift: 8, mask: ff
mpic: Initializing for 256 sources
clocksource: timebase mult[5000000] shift[22] registered
Console: colour dummy device 80x25
Mount-cache hash table entries: 512
NET: Registered protocol family 16

Nanaimo init
^^
PowerPC Book-E Watchdog Timer Enabled
PCI: Probing PCI hardware
pci 0000:00:00.0: ignoring class b20 (doesn't match header type 01)
pci 0000:00:00.0: PCI bridge to [bus 01-ff]
pci 0001:02:00.0: ignoring class b20 (doesn't match header type 01)
pci 0001:02:00.0: PCI bridge to [bus 03-ff]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0:   bridge window [io  0xff7ec000-0xff7fbfff]
pci 0000:00:00.0:   bridge window [mem 0xa0000000-0xbfffffff]
pci 0000:00:00.0:   bridge window [mem pref disabled]
pci 0000:00:00.0: enabling device (0106 -> 0107)
pci 0001:02:00.0: BAR 9: can't assign mem pref (size 0x100000)
pci 0001:03:00.0: BAR 6: assigned [mem 0xc0020000-0xc002ffff pref]
pci 0001:02:00.0: PCI bridge to [bus 03-03]
pci 0001:02:00.0:   bridge window [io  0xff7d9000-0xff7e8fff]
pci 0001:02:00.0:   bridge window [mem 0xc0000000-0xdfffffff]
pci 0001:02:00.0:   bridge window [mem pref disabled]
pci 0001:02:00.0: enabling device (0106 -> 0107)
bio: create slab <bio-0> at 0
vgaarb: loaded
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Freescale Elo / Elo Plus DMA driver
Switching to clocksource timebase
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
fsl-elo-dma ffe21300.dma: #0 (fsl,eloplus-dma-channel), irq 20
fsl-elo-dma ffe21300.dma: #1 (fsl,eloplus-dma-channel), irq 21
fsl-elo-dma ffe21300.dma: #2 (fsl,eloplus-dma-channel), irq 22
fsl-elo-dma ffe21300.dma: #3 (fsl,eloplus-dma-channel), irq 23
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NTFS driver 2.1.29 [Flags: R/O].
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
SGI XFS with security attributes, no debug enabled
msgmni has been set to 498
Crypto engine S/W registered as #4
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Generic non-volatile memory driver v1.1
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250.0: ttyS0 at MMIO 0xffe04500 (irq = 42) is a 16550A
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Loaded Module sc16is850l
brd: module loaded
loop: module loaded
nbd: registered device at major 43
Hello, hp math
Testing multiplication, multiply 74215543 by 2 = 148431086
Testing division, divide 74215543 by 2 = 37107771
********* SINE CALCULATION TESTING *********
*************************,0
**********************************,22
******************************************,44
************************************************,67
**************************************************,89
************************************************,112
******************************************,134
**********************************,157
*************************,179
****************,202
********,224
**,247
,269
**,292
********,314
****************,337
*************************,359
********* COSINE CALCULATION TESTING *********
**************************************************,0
************************************************,22
******************************************,44
**********************************,67
*************************,89
****************,112
********,134
**,157
,179
**,202
********,224
****************,247
*************************,269
**********************************,292
******************************************,314
************************************************,337
**************************************************,359
********* TESTING GPS DISTANCE *********
position1: lat=74215543, lon=-124819895, alt=70000
position2: lat=74216045, lon=-124819232, alt=72000
getEarthRadius(), earth radius (m): 6553500
GPS distance = 45
Testing square root
theta: 0, sqroot: 0
theta: 19634954, sqroot: 4431
theta: 39269908, sqroot: 6266
theta: 58904862, sqroot: 7674
theta: 78539816, sqroot: 8862
theta: 98174770, sqroot: 9908
theta: 117809724, sqroot: 10854
theta: 137444678, sqroot: 11723
theta: 157079632, sqroot: 12533
theta: 176714586, sqroot: 13293
theta: 196349540, sqroot: 14012
theta: 215984494, sqroot: 14696
theta: 235619448, sqroot: 15349
theta: 255254402, sqroot: 15976
theta: 274889356, sqroot: 16579
theta: 294524310, sqroot: 17161
theta: 314159264, sqroot: 17724
theta: 333794218, sqroot: 18270
theta: 353429172, sqroot: 18799
theta: 373064126, sqroot: 19314
theta: 392699080, sqroot: 19816
theta: 412334034, sqroot: 20306
theta: 431968988, sqroot: 20783
theta: 451603942, sqroot: 21250
theta: 471238896, sqroot: 21708
theta: 490873850, sqroot: 22155
theta: 510508804, sqroot: 22594
theta: 530143758, sqroot: 23024
theta: 549778712, sqroot: 23447
theta: 569413666, sqroot: 23862
theta: 589048620, sqroot: 24270
theta: 608683574, sqroot: 24671
theta: 628318528, sqroot: 25066

MyNeville testing, given:
i=0, x=2, f=500000
i=1, x=4, f=250000
i=2, x=5, f=200000
Here are approximation for other values of x
x=1, f=700000
x=2, f=500000
x=3, f=350000
x=4, f=250000
x=5, f=200000
x=6, f=200000
x=7, f=250000
x=8, f=350000
x=9, f=500000
Test degreesToRadians()
degress: 4257961740, radians: 74315451
Testing AL1 cell radius
getEarthRadius(), earth radius (m): 6553500
isWithinCellRadius(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is NOT within 30m of location(74215543,-124819895,70000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRadius(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is within 50m of location(74215543,-124819895,70000)
Testing AL1 cell rectangle
isWithinCellRectangle(), Rectangle cell, width: 100, height: 80, direction: 0
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -5000000000, ULy: 4000000000, LRx: 5000000000, LRy: -4000000000
original (x,y) = (32, 32), rotated (x,y) =(3200000000, 3200000000)
isWithinCellRectangle, Rotated corner points: (-5000000000, 4000000000),(5000000000, 4000000000),(5000000000, -4000000000),(-5000000000, -4000000000)
isWithinCellRectangle, Rotated points: (3200000000, 3200000000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is within rectangle (width=100,height=80) at location(74215543,-124819895,70000) rotated by 0 degree
isWithinCellRectangle(), Rectangle cell, width: 100, height: 80, direction: 45
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -5000000000, ULy: 4000000000, LRx: 5000000000, LRy: -4000000000
original (x,y) = (32, 32), rotated (x,y) =(4525486048, 32)
isWithinCellRectangle, Rotated corner points: (-707107240, 6363964750),(6363964760, -707107150),(707107240, -6363964750),(-6363964760, 707107150)
isWithinCellRectangle, Rotated points: (4525486048, 32)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is within rectangle (width=100,height=80) at location(74215543,-124819895,70000) rotated by 45 degree
isWithinCellRectangle(), Rectangle cell, width: 100, height: 80, direction: 90
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -5000000000, ULy: 4000000000, LRx: 5000000000, LRy: -4000000000
original (x,y) = (32, 32), rotated (x,y) =(3200000000, -3200000000)
isWithinCellRectangle, Rotated corner points: (4000000000, 5000000000),(4000000000, -5000000000),(-4000000000, -5000000000),(-4000000000, 5000000000)
isWithinCellRectangle, Rotated points: (3200000000, -3200000000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is within rectangle (width=100,height=80) at location(74215543,-124819895,70000) rotated by 90 degree
isWithinCellRectangle(), Rectangle cell, width: 100, height: 80, direction: 135
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -5000000000, ULy: 4000000000, LRx: 5000000000, LRy: -4000000000
original (x,y) = (32, 32), rotated (x,y) =(64, -4525486016)
isWithinCellRectangle, Rotated corner points: (6363964700, 707107280),(-707107100, -6363964720),(-6363964700, -707107280),(707107100, 6363964720)
isWithinCellRectangle, Rotated points: (64, -4525486016)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is NOT within rectangle (width=100,height=80) at location(74215543,-124819895,70000) rotated by 135 degree
isWithinCellRectangle(), Rectangle cell, width: 100, height: 80, direction: 180
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -5000000000, ULy: 4000000000, LRx: 5000000000, LRy: -4000000000
original (x,y) = (32, 32), rotated (x,y) =(-3200000000, -3200000000)
isWithinCellRectangle, Rotated corner points: (5000000000, -4000000000),(-5000000000, -4000000000),(-5000000000, 4000000000),(5000000000, 4000000000)
isWithinCellRectangle, Rotated points: (-3200000000, -3200000000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4252237393,-7151653190,70000)-(4252266155,-7151615203,72000)=45 (m)
Location (74216045,-124819232,72000) is within rectangle (width=100,height=80) at location(74215543,-124819895,70000) rotated by 180 degree
isWithinCellRectangle(), Rectangle cell, width: 20, height: 20, direction: 0
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -1000000000, ULy: 1000000000, LRx: 1000000000, LRy: -1000000000
original (x,y) = (-12, 10), rotated (x,y) =(-1200000000, 1000000000)
isWithinCellRectangle, Rotated corner points: (-1000000000, 1000000000),(1000000000, 1000000000),(1000000000, -1000000000),(-1000000000, -1000000000)
isWithinCellRectangle, Rotated points: (-1200000000, 1000000000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4257952647,-7147357669,68)-(4257961757,-7147372623,68)=16 (m)
Location (74315452,-124745185,68) is NOT within rectangle (width=20,height=20) at location(74315293,-124744924,68) rotated by 0 degree
isWithinCellRectangle(), Rectangle cell, width: 30, height: 30, direction: 0
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -1500000000, ULy: 1500000000, LRx: 1500000000, LRy: -1500000000
original (x,y) = (-12, 10), rotated (x,y) =(-1200000000, 1000000000)
isWithinCellRectangle, Rotated corner points: (-1500000000, 1500000000),(1500000000, 1500000000),(1500000000, -1500000000),(-1500000000, -1500000000)
isWithinCellRectangle, Rotated points: (-1200000000, 1000000000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4257952647,-7147357669,68)-(4257961757,-7147372623,68)=16 (m)
Location (74315452,-124745185,68) is within rectangle (width=30,height=30) at location(74315293,-124744924,68) rotated by 0 degree
isWithinCellRectangle(), Rectangle cell, width: 40, height: 40, direction: 0
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle, UpperLeft and LowerRight corners, ULx: -2000000000, ULy: 2000000000, LRx: 2000000000, LRy: -2000000000
original (x,y) = (-12, 10), rotated (x,y) =(-1200000000, 1000000000)
isWithinCellRectangle, Rotated corner points: (-2000000000, 2000000000),(2000000000, 2000000000),(2000000000, -2000000000),(-2000000000, -2000000000)
isWithinCellRectangle, Rotated points: (-1200000000, 1000000000)
getEarthRadius(), earth radius (m): 6553500
isWithinCellRectangle(), distance (4257952647,-7147357669,68)-(4257961757,-7147372623,68)=16 (m)
Location (74315452,-124745185,68) is within rectangle (width=40,height=40) at location(74315293,-124744924,68) rotated by 0 degree
Generic platform RAM MTD, (c) 2004 Simtec Electronics
NAND device: Manufacturer ID: 0x2c, Chip ID: 0xa1 (Micron NAND 128MiB 1,8V 8-bit)
RedBoot partition parsing not available
Creating 4 MTD partitions on "ffa00000.flash":
0x000000100000-0x000000500000 : "NAND (RO) Linux Kernel Image"
ftl_cs: FTL header not found.
0x000000500000-0x000000900000 : "NAND (RO) NV Info"
ftl_cs: FTL header not found.
0x000000900000-0x000006900000 : "NAND (R0) MTD2"
ftl_cs: FTL header not found.
0x000006900000-0x000007f00000 : "NAND (RW) JFFS2 Root File System"
ftl_cs: FTL header not found.
Nandflash_init KERNEL Fs start 5
eLBC NAND device at 0xffa00000, bank 0
Fixed MDIO Bus: probed
eth0: Gianfar Ethernet Controller Version 1.2, 08:2e:5f:ee:f0:f6
eth0: Running with NAPI enabled
eth0: RX BD ring size for Q[0]: 256
eth0: RX BD ring size for Q[1]: 256
eth0: RX BD ring size for Q[2]: 256
eth0: RX BD ring size for Q[3]: 256
eth0: RX BD ring size for Q[4]: 256
eth0: RX BD ring size for Q[5]: 256
eth0: RX BD ring size for Q[6]: 256
eth0: RX BD ring size for Q[7]: 256
eth0: TX BD ring size for Q[0]: 256
eth0: TX BD ring size for Q[1]: 256
eth0: TX BD ring size for Q[2]: 256
eth0: TX BD ring size for Q[3]: 256
eth0: TX BD ring size for Q[4]: 256
eth0: TX BD ring size for Q[5]: 256
eth0: TX BD ring size for Q[6]: 256
eth0: TX BD ring size for Q[7]: 256
Freescale PowerQUICC MII Bus: probed
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
i2c /dev entries driver
rtc-ds1307 0-0056: SET TIME!
rtc-ds1307 0-0056: rtc core: registered ds1339 as rtc0
serial-sc16is850l 1-004d: SC16IS850L chip found
PowerPC Book-E Watchdog Timer Loaded
PowerPC Book-E Watchdog Timer Enabled (wdt_period=107 secs)
SPRN_TCR = 6c100000
Software Watchdog Timer: 0.07 initialized. soft_noboot=0 soft_margin=60 sec (nowayout= 0)
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
u32 classifier
nf_conntrack version 0.5.0 (3989 buckets, 15956 max)
UDP tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 164k init
fsl-elbc ffe05000.localbus: command failed: fir 4125e000 fcr 300000 status 20000001 mdr 0
end_request: I/O error, dev mtdblock2, sector 17544
SQUASHFS error: squashfs_read_data failed to read block 0x888383
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
fsl-elbc ffe05000.localbus: command failed: fir 4125e000 fcr 300000 status 20000001 mdr 0
end_request: I/O error, dev mtdblock2, sector 17544
SQUASHFS error: squashfs_read_data failed to read block 0x888383
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
SQUASHFS error: Unable to read data cache entry [888383]
SQUASHFS error: Unable to read page, block 888383, size e91d
Kernel panic - not syncing: Attempted to kill init!
Call Trace:
[cf833d30] [c0008d30] 0xc0008d30 (unreliable)
[cf833d60] [c003c170] 0xc003c170
[cf833df0] [c003efd0] 0xc003efd0
[cf833e30] [c003f204] 0xc003f204
[cf833e40] [c004a9c8] 0xc004a9c8
[cf833e70] [c0009cdc] 0xc0009cdc
[cf833f40] [c0011858] 0xc0011858
Rebooting in 180 seconds..

That's an interesting device.

From the dmesg the device tree is marking it as an nxp development board, P1020. Positively those boards have dts in mainline linux;

Are you certain it's an access point though? If so, why all the GPS hardware and calibration and no WLAN interface drivers in their kernel. Very odd!

Build a few images with the nxp dts and see what you get. Best of luck.

It is definitely an access point. I can only upload one picture in a post as a new user, so here's a link to my OneDrive with the pictures of it.

I haven't played at this level much, but AIUI there is nothing particularly magic about the magic numbers. They are just a sanity check that what is about to be booted is probably intended to be there, because it has a magic number to imply that.

I also vaguely recall that the magic number is a the start of the block, and uboot has commands to read / write arbitrary memory (md / mw maybe?).

So pulling that together, if you read the magic number just before the standard firmware boots and then write it into the firmware you've FTPed into place will that boot?

I've been busy for a few days, but I got back to playing around with it today and with the tftpboot command I uploaded the kernel image for HiveAP 330 and booting it from RAM I got the following and then it just froze.

=> tftpboot openwrt-21.02.0-mpc85xx-p1020-aerohive_hiveap-330-initramfs-kernel.bin
Using eTSEC1 device
TFTP from server 192.168.1.158; our IP address is 192.168.1.1
Filename 'openwrt-21.02.0-mpc85xx-p1020-aerohive_hiveap-330-initramfs-kernel.bin'.
Load address: 0x1000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #######################
done
Bytes transferred = 11098244 (a95884 hex)
=> bootm
read_vblock 6
Kernel arg: 'ro'
## Booting image at 01000000 ...
   Image Name:   POWERPC OpenWrt
   Image Type:   PowerPC Linux Kernel Image (uncompressed)
   Data Size:    11098180 Bytes = 10.6 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK

That would suggest that the kernel worked, right? But obviously it was not actually written to the nand, nor was the squashfs that goes with it. So, I'm assuming that's why it just hung there, because there was not an actual filesystem to load the os.

The initramfs is a self contained OS, run in RAM.

Like booting from an image written to an old school ramdrive.

I get that. Forgive me as I am still learning, but this image I used looks like it's 2 part setup when upgrading from the factory firmware of the HiveAP. There is the initramfs-kernel, and then there is the squashfs-fdt.

I was just thinking that the freezing had something to do with missing the squashfs. Or would it be because this particular kernel, while it seems to check out and not give the bad magic number error, is not exactly built for whatever chips are on this board?

Also, for anybody with u-boot experience, what is the difference (not physical, but in the u-boot scenario) between nand and eeprom? I guess, not knowing any better, that I thought it would have one or the other. Or maybe that eeprom would just for variable storage while the firmware would be stored in the nand. I seem to have an eeprom chip at i2c address 0x56, but then there is also the nand chip. Reading portions of both of them, some of the content has the same hex value, but at the beginning of the eeprom I see this. (read from eeprom into ram at 0x1000000)

01000000: 43 6f 6c 75 62 72 69 73 5f 42 49 44 5f 24 24 24 Colubris_BID_$$$

The first line of the nand is this.

01000000: 00ffffff ffffffff ffffffff ffffffff ................

And tons of ffffffff after that until I see some data at 01010000 that from that point on matches some data in the eeprom starting at 01011000.

Try appending earlyprintk to your bootargs

That will tell the kernel to continue printing messages to the serial console.

Hmmm...I tried running setenv bootargs ro earlyprintk, which printenv verified was successful, but every time I try it and try booting the image it always says

Kernel arg: 'ro'

Well that’s a bit odd. Can you post another printenv output?

Try just having earlyprintk and no other bootargs, any change?

=> printenv
bootargs=ro
bootcmd=setenv bootargs root=/dev/$bdev rw rootdelay=30 console=$consoledev,$baudrate $othbootargs;usb start;ext2load usb 0:1 $loadaddr /boot/$bootfile;ext2load usb 0:1 $fdtaddr /boot/$fdtfile;bootm $loadaddr - $fdtaddr
ramboot=setenv bootargs root=/dev/ram rw console=$consoledev,$baudrate $othbootargs; tftp $ramdiskaddr $ramdiskfile;tftp $loadaddr $bootfile;tftp $fdtaddr $fdtfile;bootm $loadaddr $ramdiskaddr $fdtaddr
nfsboot=setenv bootargs root=/dev/nfs rw nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip:$gatewayip:$netmask:$hostname:$netdev:off console=$consoledev,$baudrate $othbootargs;tftp $loadaddr $bootfile;tftp $fdtaddr $fdtfile;bootm $loadaddr - $fdtaddr
bootdelay=3
baudrate=115200
loads_echo=1
rootpath=/opt/nfsroot
hostname=NANAIMO
bootfile=uImage
loadaddr=1000000
netdev=eth0
uboot=u-boot.bin
loadaddr=1000000
bootfile=uImage
tftpflash=tftpboot $loadaddr $uboot; protect off 0x01001000 +$filesize; erase 0x01001000 +$filesize; cp.b $loadaddr 0x01001000 $filesize; protect on 0x01001000 +$filesize; cmp.b $loadaddr 0x01001000 $filesize
consoledev=ttyS0
ramdiskaddr=2000000
ramdiskfile=rootfs.ext2.gz.uboot
fdtaddr=c00000
fdtfile=p2020rdb.dtb
bdev=sda1
jffs2nand=mtdblock9
nandbootaddr=200000
nandfdtaddr=100000
nandimgsize=400000
nandfdtsize=100000
usb_phy_type=ulpi
vscfw_addr=ef000000
othbootargs=ramdisk_size=700000 cache-sram-size=0x10000
nandboot=setenv bootargs root=/dev/$jffs2nand rw rootfstype=jffs2 console=$consoledev,$baudrate $othbootargs;nand read 2000000 $nandbootaddr $nandimgsize;nand read 3000000 $nandfdtaddr $nandfdtsize;bootm 2000000 - 3000000;
recreate_bbt=nandbbx scanbbt; nandbbx trashsb; reset
ethaddr=08:2e:5f:ee:f0:f6
ethact=eTSEC1
ipaddr=192.168.1.13
serverip=192.168.1.158

Environment size: 1734/131068 bytes
=> setenv bootargs earlyprintk
=> printenv
bootcmd=setenv bootargs root=/dev/$bdev rw rootdelay=30 console=$consoledev,$baudrate $othbootargs;usb start;ext2load usb 0:1 $loadaddr /boot/$bootfile;ext2load usb 0:1 $fdtaddr /boot/$fdtfile;bootm $loadaddr - $fdtaddr
ramboot=setenv bootargs root=/dev/ram rw console=$consoledev,$baudrate $othbootargs; tftp $ramdiskaddr $ramdiskfile;tftp $loadaddr $bootfile;tftp $fdtaddr $fdtfile;bootm $loadaddr $ramdiskaddr $fdtaddr
nfsboot=setenv bootargs root=/dev/nfs rw nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip:$gatewayip:$netmask:$hostname:$netdev:off console=$consoledev,$baudrate $othbootargs;tftp $loadaddr $bootfile;tftp $fdtaddr $fdtfile;bootm $loadaddr - $fdtaddr
bootdelay=3
baudrate=115200
loads_echo=1
rootpath=/opt/nfsroot
hostname=NANAIMO
bootfile=uImage
loadaddr=1000000
netdev=eth0
uboot=u-boot.bin
loadaddr=1000000
bootfile=uImage
tftpflash=tftpboot $loadaddr $uboot; protect off 0x01001000 +$filesize; erase 0x01001000 +$filesize; cp.b $loadaddr 0x01001000 $filesize; protect on 0x01001000 +$filesize; cmp.b $loadaddr 0x01001000 $filesize
consoledev=ttyS0
ramdiskaddr=2000000
ramdiskfile=rootfs.ext2.gz.uboot
fdtaddr=c00000
fdtfile=p2020rdb.dtb
bdev=sda1
jffs2nand=mtdblock9
nandbootaddr=200000
nandfdtaddr=100000
nandimgsize=400000
nandfdtsize=100000
usb_phy_type=ulpi
vscfw_addr=ef000000
othbootargs=ramdisk_size=700000 cache-sram-size=0x10000
nandboot=setenv bootargs root=/dev/$jffs2nand rw rootfstype=jffs2 console=$consoledev,$baudrate $othbootargs;nand read 2000000 $nandbootaddr $nandimgsize;nand read 3000000 $nandfdtaddr $nandfdtsize;bootm 2000000 - 3000000;
recreate_bbt=nandbbx scanbbt; nandbbx trashsb; reset
ethaddr=08:2e:5f:ee:f0:f6
ethact=eTSEC1
ipaddr=192.168.1.13
serverip=192.168.1.158
bootargs=earlyprintk

Environment size: 1743/131068 bytes
=> tftpboot 0x1000000 openwrt-21.02.1-mpc85xx-p1020-aerohive_hiveap-330-initramfs-kernel.bin
eTSEC1: Link up, full duplex, 100 Mbps
Using eTSEC1 device
TFTP from server 192.168.1.158; our IP address is 192.168.1.13
Filename 'openwrt-21.02.1-mpc85xx-p1020-aerohive_hiveap-330-initramfs-kernel.bin'.
Load address: 0x1000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ############################
done
Bytes transferred = 11122784 (a9b860 hex)
=> tftpboot 0x6000000 openwrt-21.02.1-mpc85xx-p1020-aerohive_hiveap-330-squashfs-fdt.bin
Using eTSEC1 device
TFTP from server 192.168.1.158; our IP address is 192.168.1.13
Filename 'openwrt-21.02.1-mpc85xx-p1020-aerohive_hiveap-330-squashfs-fdt.bin'.
Load address: 0x6000000
Loading: ###
done
Bytes transferred = 11446 (2cb6 hex)
=> bootm 0x1000000 - 0x6000000;
read_vblock 6
Kernel arg: 'ro'
## Booting image at 01000000 ...
   Image Name:   POWERPC OpenWrt
   Image Type:   PowerPC Linux Kernel Image (uncompressed)
   Data Size:    11122720 Bytes = 10.6 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK

I did find something interesting in the help.

colub   - colub   - colubris specific commands

which then brings up

colub - colub   - colubris specific commands


Usage:
colub - colubris specific commands

        colub bid FNM          (Burn bid into flash blocks 0 and last block, page 31)
        colub cache [d|i|b [on|off]] (Display or set 'd'ata, 'i'nstr or 'b'oth cache)
        colub colnet           (Enter Colubris Boot mode for debugging)
        colub cpu [CPUTYPE]    (Display or change the cputype in the BID)
        colub dump_bid         (Dump the BID)
        colub factory          (Reset factory defaults and boot)
        colub fipsoff          (Turn fips mode off)
        colub flash_display [BLK] (Display NAND flash BLK)
        colub flash_erase [BEGBLK [ENDBLK]] (Erase NAND flash blocks)
        colub flash_test [BEGPG [ENDPG]] (Test NAND flash)
        colub hwflag [VAL]     (Display or change the hw flag in the BID)
        colub kbackup [ADDRESS]  (TFTP to address ADDRESS and save the Kozio diags at block 15)
        colub krun [ADDRESS]  (Load from block 15 into address ADDRESS and run the Kozio diags)
        colub kozio [ADDRESS]  (TFTP to address ADDRESS and run the Kozio diag)
        colub led_off [LEDNUM] (Turn off specific leds)
        colub led_on  [LEDNUM] (Turn on specific leds)
        colub led_on_off       (Turn on then off all leds)
        colub led_test         (Test led operation)
        colub product [PRODUCT] (Display or change the product id in the BID)
        colub reset_test       (Test reset button)
        colub speed [auto|10|100|1000 [auto|full|half]] (Set ethernet speed and duplexity)
        colub update [FNM]     (Update boot code)
        colub phy_dump     (Dump all PHY registers)
        colub phy_regread [offset]  (Read a PHY register by specifying offset in decimal)
        colub phy_regwrite [offset [value]]  (Write to PHY register by specifying offset in decimal and value in hex)

some of the commands that showed any information

=> colub cpu
CPU Type is currently Unknown cpu type (18)
=> colub dump_bid
CPU Type            : 18
Design Id           : 52 (Unknown product (52))
MAC Address         : 08:2e:5f:ee:f0:f6
Base Clock Speed    : 64000000
Serial Number       : TW2ZG2W101
Date Code           : 4625
Board Assembly      : ZZ-ZZ-ZZZZ-ZZ
Linux Startup       : ro
Country Code        : 124 (Read Write)
Hardware Flag       : 80000000
Feature Code        : 2056
OEM Code            : 00
=> colub hwflag
Current HW Flag is 0x80000000
=> colub product
Product is currently Unknown product (52)
=> colub phy_dump
Dumping PHY registers from 0 to 32
[00-03]:1140 7969 0141 0e90
[04-07]:01e1 4de1 0007 2801
[08-11]:447a 0e00 4000 0000
[12-15]:0000 0000 0000 3000
[16-19]:3060 7c08 0000 dc48
[20-23]:0020 0000 0000 0000
[24-27]:0000 0000 0040 0000
[28-31]:0000 0005 0000 0000

Hmmm, well that's not positive. With the kernel not starting at all there are no clues where to go next.

Perhaps extract all the mtds from the flash via uboot and see if there's a working fdt in there (maybe not as it doesn't boot + appears the developers were booting from usb).

And try the images mentioned above for ap3825i and go through the steps used in that thread to bring the device up.

Images here;
https://downloads.laboratoryb.org/releases/snapshot/targets/mpc85xx/p1020/

Hey @kb1sph,

Could you give me an FCC ID of your device, or if not, tear it down a bit to see if you can get us some images of the board? I'd like to see if I can get one myself.

Pretty much all P1020E APs are going to be the same with some quirks: NXP's P1020WLAN development board was pretty popular. All we'll really need to figure out are the U-boot quirks, which are things like:

  • what U-boot is doing to initialize processors
  • how it is relocating the device tree blob (dtb, same thing as an fdt)
  • how it is manipulating the device tree blob

When you say "HP Apache Prototype", I'm thinking "Aruba". Does your device look like any of the Aruba series?