OpenWrt support for Zyxel PMG5617GA, first GPON support !?

alexceltare2 · February 9, 2023, 7:16am

I'm afraid XMODEM is only used for flashing, not dumping. USB doesn't have a working driver at boot time and TFTP isn't available as a command on the bootloader so in the end I'm stuck with painstakingly copy and paste the bytes the dump and nandrd commands spew out in the terminal. There is a nice Python script that automatises that for you in here but needs some tweaking for higher memory. Turns out that Ralink, Mediatek, Econet and Airoha SoCs all share the same core silicon and command set.

During this time, I found a Nokia G-240G-E modem that has the same exact SoC so I can afford to do more messy stuff and break the device since it's nothing but a spare. Details are available here with serial dumps and chip data.

One thing I don't understand is why the nand data is mirrored onto the ram at boot time. Is it to create a ramdisk? Wouldn't that be a waste of ram memory?
Secondly, I also don't understand the purpose of kernel/root/tclinux and kernel/root/tclinux-slave if it's already copied onto the ram.
And thirdly, which way should I backup the flash? Nand seems to be lzma compressed and ram seems to have Zyxel trx headers.

cjd · March 7, 2023, 11:19am

Hello Alex, this is an interesting project, thanks for pursuing it!

In the past, I have dumped other devices by using picocom -g so that it will log to a text file, then I read the flash into memory and use md.b to dump memory out to console, then close picocom and manipulate the file with sed and awk to convert it into a binary. Same idea as the python script.

Regarding why nand is read into memory, maybe I'm not understanding the question, but when it's the Linux kernel, the code needs to execute from memory. Generally squashfs will stay on the flash until the file is being read, but ramdisk based builds will load the FS into memory as well.

Looking at your MTD layout, my first instinct is:

bootloader -> u-boot binary code
romfile -> Likely to be u-boot environment, worth looking at this because you don't have printenv command
kernel -> main linux
rootfs -> main squashfs + jffs2 (or UBI, I'm not sure) partition
tclinux -> I have no idea what this might be
kernel_slave -> backup linux kernel in case main one is corrupted or for updating
rootfs_slave -> backup root fs
tclinux_slave -> backup mystery fs
wwan -> Don't know, potentially parameters for the laser, if it is this then you definitely do not want to delete them, they're unique to each unit
data -> Possible an FS containing some config stuff like wifi password, might also be laser parameters
rom-d -> Don't know
reservedarea -> Don't know, might be empty, check the hex dump

The best way to know what they are is to dump each one into a series of bins and then compare the first bytes to see what it is. UBIFS starts with 55 42 49 ("UBI"), squashfs starts with 68 73 71 73 (hsqs).

I would recommend running strings on the bootloader and the romfile, you might get lucky enough that it will print the env vars for u-boot and you'll see how it's booted and how it's updated.

Thanks,
Caleb

alexceltare2 · March 7, 2023, 4:25pm

Awesome stuff. Regarding tclinux, that's a toolchain TrendChip and its descendants SoC (Ralink, Econet, Mediatek, Airoha) use to build and decompose firmware as discussed in here. A variant of it named tcrevange (github page here) is used but from what i've heard it's mostly unmaintained. I've tried emailing Airoha if they can provide some SDKs/Toolchains to help but to no avail so far so we have to make use of what we have.

cjd · March 8, 2023, 1:26pm

Thanks for the links re tclinux, I've ordered a sample of an EN7526 device because I'm interested in pursuing this as well.

Someone wrote a shell script in owrt to build images for this zloader: https://github.com/FreifunkHalle/gluon-changes/blob/facabe76ded6d0eb56c0c884bb1f43bf713c3dec/patches/openwrt/0008-ipq40xx-add-support-for-the-ZyXEL-NBG6617.patch#L240
I found a rather impressive amount of documentation about ZyXEL boot process here: https://github.com/chear/SWNote/blob/master/ZyXEL.md

Tony.He · March 9, 2023, 11:33am

Hi, thanks for your effort. I'm very interested too. I have played many OpenWRT routers. However, I don't see any OpenWRT routers with GPON support. I want to know if there is firmware for GPON part like wireless chips . You know almost all wireless chips have own firmware since wifi5. If only driver in linux kernel side is needed, this should be easier to support.

tower · March 11, 2023, 9:56am

Bootloader(U-Boot) from keenetic runs on a device with the same processor (Sercomm FG824CD).

U-Boot log

BGA IC
Xtal:1
DDR3 init.
DRAMC init done.
Calculate size.
DRAM size=256MB
Set new TRFC.
ddr-1066

7512DRAMC V1.2.2 (0)


U-Boot 1.1.3 [4.0.0.4-33] (Nov 29 2019 - 18:49:25)

Board: Ralink APSoC DRAM:  256 MB
relocate_code Pointer at: 8ff8c000


******************************
Software System Reset Occurred
******************************
Set SPI Clock to 50 Mhz
spi_nand_probe: mfr_id = 0xc2, dev_id = 0x12
Using Flash ECC.
Detected SPI NAND Flash: MXIC MX35LF1G, Flash Size: 128 MB
bmt pool size: 81
BBT found, bad block count: 0
BMT & BBT Init Success
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 4.0.0.4_NDMS
--------------------------------------------
ASIC 7512_MP (Port5<->None)
SYS_CLK: 225 MHz
DRAM_CONF_FROM: From SPRAM
DRAM_TYPE: DDR3
DRAM component: 2048 Mbits
DRAM bus: 16 bit
Total memory: 256 MBytes
Flash component: SPI NAND Flash
Date:Nov 29 2019  Time:18:49:25
============================================
icache: sets: 512, ways:4, linesz:32, total: 64kB
dcache: sets: 256, ways:4, linesz:32, total: 32kB

 ##### The CPU freq = 900 MHZ ####
 estimate memory size = 256 Mbytes

Detected internal switch MT7530

Detected external switch MT7530
Dual image:     on
Boot active:    1
Boot backup:    1
Boot fails:     0


Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Enter boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.                                                                                                                                                    0

3: System Boot system code via Flash.
## Booting image at 00060000 ...
Bad Magic Number,FFFFFFFF

Load system code then write to Flash via TFTP.

System Boot log

3: System Boot system code via Flash.

## Booting image at 00060000 ...

   Image Name:   Keenetic DSL

   Created:      2018-10-23  16:55:17 UTC

   Image Type:   MIPS Linux Kernel Image (lzma compressed)

   Data Size:    1268528 Bytes =  1.2 MB

   Load Address: 80020000

   Entry Point:  802ef100

   Verifying Checksum ... OK

   Uncompressing Kernel Image ... OK

No initrd

## Transferring control to Linux (at address 802ef100) ...

## Giving linux memsize in MB, 256


Starting kernel ...


Linux version 3.4.113 (developers@ndmsystems.com) (gcc version 7.3.0 (crosstool-NG crosstool-ng-1.23.0-ndm-4 - NDMS Toolkit 1.0.0) ) #1 SMP Tue Oct 16 18:48:53 MSK 2018
ISPRAM0: PA=00300000,Size=00010000,enabled
EcoNet SoC: RAM: DDR3 256MB
CPU/SYS frequency: 900/225 MHz
SoC power status: Hard reset occured
CPU revision is: 00019558 (MIPS 34Kc)
Determined physical RAM map:
 memory: 0ffe0000 @ 00020000 (usable)
Wasting 1024 bytes for tracking 32 unused pages
Zone PFN ranges:
  Normal   
0x00000020 -> 0x00010000
Movable zone start PFN for each node
Early memory PFN ranges
    0: 0x00000020 -> 0x00010000
Detected 1 available secondary CPU(s)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
PERCPU: Embedded 7 pages/cpu @81203000 s5984 r8192 d14496 u32768
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 64992
Kernel command line: console=ttyS0,57600n8 rdinit=/sbin/init es=1
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Writing ErrCtl register=0003b800
Readback ErrCtl register=0003b800
NMI base is 8124c200
Memory: 255612k/262016k available (3008k kernel code, 6404k reserved, 618k data, 212k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:41
 Using 200.000 MHz high precision timer
console [ttyS0] enabled
Calibrating delay loop... 597.60 BogoMIPS (lpj=2988032)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
Config7: 0x80080500
ISPRAM0: PA=00300000,Size=00010000,enabled
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
CPU revision is: 00019558 (MIPS 34Kc)
Synchronize counters for CPU 1: done.
Brought up 2 CPUs
NET: Registered protocol family 16
PCIe RC0 no card, disable PHY
bio: create slab <bio-0> at 0
NET: Registered protocol family 8
NET: Registered protocol family 20
Switching to clocksource TC HPT
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP: reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 499
io scheduler noop registered (default)
tc3162_uart: UART driver for EN751x SoC, buffer size is 4096 bytes
ttyS0 at I/O 0xbfbf0003 (irq = 1) is a TC3162
Registering NDM partitions parser
EcoNET SPI NAND driver init
Detected SPI NAND Flash: MXIC35LF1G, Flash Size: 128MB
NAND device: Manufacturer ID: 0xc2, Chip ID: 0x12 (Macronix MXIC35LF1G), 128MiB, page size: 2048, OOB size: 64
BMT pool size: 81
BBT found, bad block count: 0
BMT & BBT init success
di: active = 1, backup = 1, current = 1
15 ndmpart partitions found on MTD device EN7512-SPI_NAND
Creating 15 MTD partitions on "EN7512-SPI_NAND":
0x000000000000-0x000000020000: "U-Boot"
0x000000020000-0x000000040000: "U-Config"
0x000000040000-0x000000060000: "RF-EEPROM"
0x000000060000-0x0000001c0000: "Kernel_1"
0x0000001c0000-0x000001da0000: "RootFS_1"
mtd: device 4 (RootFS_1) set to be root filesystem
0x000000060000-0x000001da0000: "Firmware_1"
0x000001da0000-0x000001dc0000: "Config_1"
0x000001dc0000-0x000001fc0000: "Storage"
0x000001fc0000-0x000002000000: "Dump"
0x000003ae0000-0x000003b00000: "U-State"
0x000003b00000-0x000003b20000: "U-Config_res"
0x000003b20000-0x000003b40000: "RF-EEPROM_res"
0x000003b40000-0x000005880000: "Firmware_2"
0x000005880000-0x0000058a0000: "Config_2"
0x000000000000-0x0000075e0000: "Full"
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
Netfilter messages via NETLINK v0.30.
nfnl_dryrun: registering with nfnetlink.
nf_conntrack version 0.5.0 (16384 buckets, 32768 max)
ctnetlink v0.93: registering with nfnetlink.
xt_time: kernel timezone is -0000
ip_set: protocol 6
Bridge firewalling registered
ubridge: Tiny bridge driver, 1.1
IPv4 over IPv4 tunneling driver
gre: GRE over IPv4 demultiplexor driver
Fast NAT loaded
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
8021q: 802.1Q VLAN Support v1.8
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 212k freed
init: init process was started.

init: press Enter to activate this console.

Due to the lack of drivers, only the console and usb work. The network subsystem is not working.

An attempt at porting EcoNet/Mediatek EN7512 SoC to Linux 5.
The system from @minhng99 repository was also launched.

cjd · March 18, 2023, 1:11pm

I received my unit and began doing some testing, it IS a different unit so YMMV but I was able to dump the mtdblock images and:

romfile is a tar.gz of a file called ctromfile.cfg which contains roughly this: https://github.com/cjdelisle/EN751221-Linux26/blob/master/tclinux_phoenix/apps/private/etc_script/ct/romfile_pon.cfg
reservedarea is a structure containing a backup of the rom file as well as a number of other things...
ctromfile.cfg has a trx header TRX_MAGIC3
kernel and kernel_slave have trx headers with TRX_MAGIC2 ( https://github.com/cjdelisle/EN751221-Linux26/blob/master/tclinux_phoenix/tools/trx/trx.h#L35 )
It took me a while to notice that tclinux and tclinux_slave are just concatenated "views" of kernel+rootfs and kernel_slave+rootfs_slave, I didn't at first see that they have overlapping addresses.

My MTD layout (with -- notes):

bldr> mtd
0x00000000-0x00040000 : "bootloader"
0x00040000-0x00080000 : "romfile" -- tar.gz
0x00080000-0x0022f39e : "kernel" -- TRX_MAGIC2
0x0022f39e-0x010df39e : "rootfs" -- squashfs
0x00080000-0x01480000 : "tclinux"
0x01480000-0x0162f39e : "kernel_slave" -- TRX_MAGIC2
0x0162f39e-0x0253f39e : "rootfs_slave" -- squashfs
0x01480000-0x02880000 : "tclinux_slave"
0x02880000-0x04880000 : "openjdk" -- squashfs
0x04880000-0x0d980000 : "ubifs" -- ubifs
0x0de40000-0x0e000000 : "reservearea" -- see below

Reserved Area

Initially I thought this was a backup of the romfile only because tar.gz happily unpacked it, but on closer inspection it contains a bit more...

This layout seems to match my board.

---------------------------------------------------------------------------------
@reserve area table 7 BLOCK@
|sector		name				cover area				note
|1			backupromfile			0~0x3ffff					256k
|2			defaultromfile			0x40000~0x7ffff			256k
|3			syslog				0x80000~0xBffff			256k
|4			proline      			0xc0000~0xfffff			256k
|5			temp				0x100000~0x13ffff			256k
|5.1			cerm1				0x100000~0x100fff		4k
|5.2			cerm2				0x101000~0x101fff		4k
|5.3			cerm3				0x102000~0x102fff		4k
|5.4			cerm4				0x103000~0x103fff		4k
|6			block6				0x140000~0x17ffff			256k
|6.1			eeprom				0x140000~0x1403ff		1k(reserve 1k,no use 256 bytes)
|6.2			bob.conf				0x140400~0x14049f		160bytes
|7			block7				0x180000~0x1bffff			256k
|7.1			imgbootflag			0x180000~0x18003f		64bytes
|7.2			11ac					0x180040~0x18023f		512bytes
|7.3			11ac	 reserved			0x180240~0x18043f		512bytes
------------------------------------------------------------------------------------

In my case:

backupromfile - identical to gzipped file contained in mtdblock2
defaultromfile - empty (ffff)
syslog - 00000000: 456e 644f 6654 4353 7973 4c6f 670d 0aff EndOfTCSysLog... followed by ffff
proline - contains structured data, seems to be this
temp - empty (ffff)
eeprom - contains RT30xxEEPROM.bin (eeprom for MT7592 2.4ghz wifi chip)
bob.conf - empty (ffff)
imgbootflag contains ascii 1 or 0 as it's first byte to decide if we will boot kernel_slave or kernel, this is used along with the crc32 check to ensure that in case of power loss during update, the device will still boot. It does not protect against "valid" kernels which are wrongly written and panic on boot.
11ac - contains MT7610EEPROM.bin (eeprom for MT7612 5ghz wifi chip)
11ac reserved - empty (ffff)

I know I'm on a different board so please let me know if I'm making too much noise in this thread. Thanks,
Caleb

alexceltare2 · March 18, 2023, 6:08pm

There is never too much noise on this thread, bro. If you want, I can send you my Nokia G-240G-E but I don't know how to get the "dynamic password" for accessing the extended command set in ssh.

tower · March 18, 2023, 7:18pm

I also have another board. But after a little rework, it became pmg5617ga.

For the convenience of working with SPI and CH341A programmer, use an adapter:

adapter

Install the adapter on the device board, securing the installation site with hot glue:

Summary

quick connector to second adapter:

Write the loader and the system into memory by the programmer.

pmg5617ga

cjd · March 18, 2023, 9:44pm

@alexceltare2 The board I'm using doesn't have zyxel's zloader so when you press a key it drops directly into bldr>, which is rather convenient. Unfortunately I can't read flash into memory without entering linux. I think these devices are identical except for software and I'm sure I don't need another toy, but thanks for the offer.

@tower Being able to direct program the flash chip is kind of an attractive idea, I don't immediately see the 8 pad pattern on the board but I'll look on the bottom when I shut it down. I'm not so interested in flashing zloader on it, but it would be nice to be able to reliably unbrick it.

alexceltare2 · March 18, 2023, 9:53pm

We don't really care about zloader much since it's just a ZyXeL secondary bootloader. The project has a wider aim which is "Having a fully functional Econet EN7526 SoC build". Once we have the base done, we can add the rest on top of it (LEDs, Wifi drivers, Telephony, PON and other interfaces...). Ideally the build will go under ramips/en7526/ target. From my differences between ZyXeL PMG5617GA and Nokia G-240G-E which i both dumped the serial output it looks like 2 things are obvious:

The PON driver isn't in the SoC but a separate kernel module and hardware since they both have different drivers (EN7571 for ZyXeL vs. GN25L98 for Nokia)
There are a set of partitions found on both routers which I guess they are Econet specific:

"bootloader"
"romfile"
"kernel"
"rootfs"
"tclinux"
"kernel_slave"
"rootfs_slave"
"tclinux_slave"
"reservearea"

cjd · March 18, 2023, 10:09pm

Yeah, that's kind of what I'm going for. From examining https://github.com/cjdelisle/EN751221-Linux26 I've observed that the EN7526 is very similar to the EN7512 ( which is supported in https://github.com/keenetic/kernel-49 ), so I'm thinking of trying to compile an openwrt-v19.x with kernel-49 and then see if I can xmodem just the raw kernel code into device memory, jump to it, and see if it will boot without panicking. I already confirmed that I can call decomp and then jump to 0x80002000 and it boots. So if I can do it with kernel-49 instead of the one in flash, then I might look at building a holistic kernel+squashfs with the TRX header and see if I can flash it. Also going to try to see how heavily that kernel-49 is patched so we can see how ugly it would be to try to port those patches to 5.15.

cjd · March 19, 2023, 12:44pm

I managed to get a (relatively) clean patch from kernel-49, unfortunately:

It's built on top of android-4.9-q, not mainline
This kernel is for all of their products so there's a bunch of support for various MTK processors
It's very diverged and there's a lot of trash in the patch

Patch: https://gist.github.com/cjdelisle/1bf34f4b16a476ce28dd5513e8a91dc1

Exact diff:

git diff 41d9243e51a1c1cff4ce9b2e55d119ae94b49264 87ddbd109cc4cc70c68673818a3757810b2991f6

At first glance, it seems the parts we need to care about are the following:

arch/mips/include/asm/tc3162
arch/mips/tc3262
drivers/mtd/ralink/en75xx_nand
drivers/tty/serial/tc3162_uart.c

So in fact it might prove easier to manually copy the directories over and patch only the relevant makefiles.

cjd · March 19, 2023, 10:51pm

Update: I got kernel-49 built and copied the ELF file into memory using XMODEM. I was not paying attention to the load address and the ELF wanted to be loaded to 0x80020000 rather than 0x80002000 (some boards load at one address and others to the other).

I loaded it to the location it prescribed and jumped to the specified entrypoint but I got a crash before it had a chance to write anything to the serial output.

bldr> jump 80366a88                                                                                                                                                                                         
Jump to 80366A88                                                                                                                                                                                            
Undefined Exception happen.CP0_STATUS=1000ff03                                                                                                                                                              
CP0_CAUSE=50000008                                                                                                                                                                                          
CP0_EPC=80                                                                                                                                                                                                  
CP0_BADVADDR=80                                                                                                                                                                                             
                                                                                                                                                                                                            
Undefined Exception happen.CP0_STATUS=1000ff03                                                                                                                                                              
CP0_CAUSE=40000010                                                                                                                                                                                          
CP0_EPC=80                                                                                                                                                                                                  
CP0_BADVADDR=a0009a                                                                                                                                                                                         
                                                                                                                                                                                                            
 lo=4350305f hi=43415553                                                                                                                                                                                    
 cp0_epc=453d2578 cp0_badvaddr=a000000                                                                                                                                                                      
 cp0_status=4350305f cp0_cause=4550433d                                                                                                                                                                     
pad0                                                                                                                                                                                                        
                                                                                                                                                                                                            
 0x206c6f3d 0x25782068 0x693d2578 0xa000000                                                                                                                                                                 
 0x20637030 0x5f657063                                                                                                                                                                                      
regs                                                                                                                                                                                                        
                                                                                                                                                                                                            
 3d257820 6370305f 62616476 61646472                                                                                                                                                                        
 3d25780a 0 20637030 5f737461                                                                                                                                                                               
 7475733d 25782063 70305f63 61757365                                                                                                                                                                        
 3d25780a 0 70616430 a000000                                                                                                                                                                                
 20307825 78000000 a726567 730a0000                                                                                                                                                                         
 20257800 556e6465 66696e65 64204578                                                                                                                                                                        
 63657074 696f6e20 68617070 656e2e00                                                                                                                                                                        
 4350305f 53544154 55533d25 780a0000

I think my next step will be to read out the decompressed factory kernel from memory and then see about getting it to load into qemu because then I'll be able to compare it to kernel-49 and see what's going on. There's a fair chance I just messed up something in the config with dram initialization or such but it's hard to know without a debugger.

NOTE: The factory kernel is a bare binary but the entrypoint is the same as the load address (I confirmed by loading and then jumping to it), I'm still not sure how to create a kernel like this.

tower · March 20, 2023, 4:52am

The man from the next topic has advanced a bit on this issue. In his repository, he was building a working kernel version 5.9.9.

README.md

Bootloader

Bootloader sources: mtk/bootrom.

Emacs modes for hiding {} blocks (hs-minor-mode), for hiding ifdefs (hide-ifdef-mode), will be helpfull. The sources include SPI and NAND code, 7512 ethernet code, even leds (light diods) IO configs.

Bootloader may support jump addr command. The command will call function (jump to) at addr. tftp will save file to TFTP_BUF_BASE: 0x80020000 addr. (net/tftpput.c).

$ nm output/build/linux-custom/vmlinux | grep kernel_en 80020000 T __kernel_entry 802c48c8 T kernel_entry

__kernel_entry will jump to kernel_entry. kernel_entry is linux entry point. __kernel_entry is defined in arch/mips/kernel/head.S under #if CONFIG_BOOT_RAW. Selecting TC3262 CPU will "select" this option.

vmlinux includes ELF header. arch/mips/boot/vmlinux.bin is vmlinux with ELF header removed (by objcopy) and can be used with jump command.

When vmblinux.bin is uploaded, tftp will not write the file to flash and will complain that file name is invalid, but that is OK and jump 80020000 command can be called.

Did not test this yet:

flash dst src len command will call flash_write(dst, len, &retlen, (const unsigned char *) (src)) src should be set to TFT_BUF_BASE. dst.. go figure.

On power-up, bootloader calls boot_kernel (init/main.c) which loads image, performs tests and jumps to loaded kernel memory address. First, the trx_header (mtk/tools/trx/trx.h) struct len, magic, crc32 will be read from flash and compared. trx_header address: flash_base + flash_tclinux_start. The variables set in flash/flashhal.c, in *_init functions. 0x0 + 0x40000 * 2 if IS_NANDFLASH and TCSUPPORT_BB_NAND, flash command dst will be 0x80000.

cjd · March 22, 2023, 12:01pm

Update: After a bit of printf() debugging, I was able to nail down my problem to the fact that the kernel was crashing early because it was fishing around in memory looking for uboot kernel args.

Current status (littered with prom_printf()):

bldr> jump 80002000                                                                                                                                                                                         
Jump to 80002000                                                                                                                                                                                            
UART ONLINE                                                                                                                                                                                                 
TC_AHB                                                                                                                                                                                                      
TC_USB                                                                                                                                                                                                      
TC_DMT                                                                                                                                                                                                      
TC_PCM                                                                                                                                                                                                      
TC_FE                                                                                                                                                                                                       
GOT MEM TYPE DDR3                                                                                                                                                                                           
INITIAL RESERVED MEM                                                                                                                                                                                        
NORMAL MEM                                                                                                                                                                                                  
HWQ                                                                                                                                                                                                         
HIGHMEM                                                                                                                                                                                                     
RAM                                                                                                                                                                                                         
DMA                                                                                                                                                                                                         
SMP_OPSOK                                                                                                                                                                                                   
COMPLETE                                                                                                                                                                                                    
PROM_INIT                                                                                                                                                                                                   
EARLY_FDC_CONSOLE  
[    0.000000] Linux version 4.9-ndm-5 (user@ee055d46035a) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r8077-7cbbab7246) ) #15 SMP Wed Mar 22 12:02:56 UTC 2023                                                   
[    0.000000] ISPRAM0: PA=00220000,Size=00010000,enabled                                                                                                                                                   
[    0.000000] First printk                                                                                                                                                                                 
[    0.000000] EcoNet SoC: RAM: DDR3 512 MB                                                                                                                                                                 
[    0.000000] CPU/SYS frequency: 900/225 MHz                                                                                                                                                               
[    0.000000] bootconsole [early0] enabled                                                                                                                                                                 
EARLY_PRINTK                                                                                                                                                                                                
[    0.000000] CPU0 revision is: 00019558 (MIPS 34Kc)                                                                                                                                                       
CPU_REPORT                                                                                                                                                                                                  
[    0.000000] Determined physical RAM map:                                                                                                                                                                 
[    0.000000]  memory: 00020000 @ 00000000 (reserved)                                                                                                                                                      
[    0.000000]  memory: 1bbe0000 @ 00020000 (usable)                                                                                                                                                        
[    0.000000]  memory: 00400000 @ 1bc00000 (reserved)                                                                                                                                                      
[    0.000000] Wasting 1024 bytes for tracking 32 unused pages                                                                                                                                              
[    0.000000] Detected 1 available secondary CPU(s)                                                                                                                                                        
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.                                                                                                                              
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes                                                                                                                       
[    0.000000] Zone ranges:                                                                                                                                                                                 
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000001bbfffff]                                                                                                                                       
[    0.000000] Movable zone start for each node                                                                                                                                                             
[    0.000000] Early memory node ranges                                                                                                                                                                     
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000001bbfffff]                                                                                                                                      
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000001bbfffff]                                                                                                                             
[    0.000000] percpu: Embedded 11 pages/cpu s16272 r8192 d20592 u45056                                                                                                                                     
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 112776                                                                                                                  
[    0.000000] Kernel command line: console=ttyS0,115200n8 es=1                                                                                                                                             
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)                                                                                                                                          
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)                                                                                                                              
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)                                                                                                                               
[    0.000000] Writing ErrCtl register=00067c7e                                                                                                                                                             
[    0.000000] Readback ErrCtl register=00067c7e                                                                                                                                                            
[    0.000000] NMI base is 813fc200                                                                                                                                                                         
[    0.000000] Memory: 447416K/454656K available (2200K kernel code, 105K rwdata, 468K rodata, 156K init, 223K bss, 7240K reserved, 0K cma-reserved)                                                        
[    0.000000] Hierarchical RCU implementation.                                                                                                                                                             
[    0.000000]  Build-time adjustment of leaf fanout to 32.                                                                                                                                                 
[    0.000000] NR_IRQS:41                                                                                                                                                                                   
[    0.000000] hpt: using 200.000 MHz high precision timer                                                                                                                                                  
[    0.000000] clocksource: hpt: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns                                                                                                        
[    0.000007] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns                                                                                                                    
[    0.008003] console [ttyS0] enabled                                                                                                                                                                      
[    0.008003] console [ttyS0] enabled                                                                                                                                                                      
[    0.014795] bootconsole [early0] disabled                                                                                                                                                                
[    0.014795] bootconsole [early0] disabled  
[    0.022789] Calibrating delay loop... 599.04 BogoMIPS (lpj=1198080)                                                                                                                                      
[    0.053322] pid_max: default: 32768 minimum: 301                                                                                                                                                         
[    0.058074] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)                                                                                                                                  
[    0.064533] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)                                                                                                                             
[    0.072597] Config7: 0x80080500                                                                                                                                                                          
[    0.078036] ISPRAM0: PA=00220000,Size=00010000,enabled                                                                                                                                                   
[    0.078861] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.                                                                                                                              
[    0.078867] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes                                                                                                                       
[    0.078952] CPU1 revision is: 00019558 (MIPS 34Kc)                                                                                                                                                       
[    0.132502] Synchronize counters for CPU 1: done.                                                                                                                                                        
[    0.137188] Brought up 2 CPUs                                                                                                                                                                            
[    0.140051] CPU1: update max cpu_capacity 1024                                                                                                                                                           
[    0.144550] CPU1: update max cpu_capacity 1024                                                                                                                                                           
[    0.145912] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns                                                                                              
[    0.145929] futex hash table entries: 512 (order: 2, 16384 bytes)
[    0.551900] PCI host bridge to bus 0000:00
[    0.556012] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.562781] pci_bus 0000:00: root bus resource [io  0x1f600000-0x1f60ffff]
[    0.569610] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.576364] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.586492] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.594486] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.605235] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    0.611911] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
[    0.618696] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.623643] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
[    0.630464] pci 0000:00:01.0: PCI bridge to [bus 02]
[    0.635645] clocksource: Switched to clocksource hpt
[    0.645030] workingset: timestamp_bits=29 max_order=17 bucket_order=0
[    0.651668] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.658504] io scheduler noop registered (default)
[    0.663523] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[    0.672304] tc3162_uart: UART driver for EN751x SoC, buffer size is 4096 bytes
[    0.679715] ttyS0 at I/O 0xbfbf0003 (irq = 1, base_baud = 7200) is a TC3162
[    0.680211] ndmpart: registering the NDM partition parser...
[    0.680238] EcoNET SPI NAND driver init
[    0.680269] Set SPI Clock to 50 Mhz
[    0.680299] Using Flash ECC
[    0.680313] Detected SPI NAND Flash: TC58CVG1S3H, Flash Size: 256 MB
[    0.680606] nand: device found, Manufacturer ID: 0x98, Chip ID: 0xcb
[    0.680616] nand: Toshiba TC58CVG1S3H
[    0.680629] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    0.745041] BMT pool size: 163
[    0.746851] BBT found, bad block count: 3
[    0.746862] BBT bad block:  
[7 4365] Kerne] BBTib - blt sync536:
                                    VFS: 0n74688to moBT  ro tloc :n un7
[ - lock(6,41] [    0.762564] Machine restart...

This seems like it will be quite a bit easier to debug now.

cjd · March 23, 2023, 3:06pm

Update: Got a clean boot

BGA IC                                                                                                
Xtal:1                                                                                                
DDR3 init.                                                                                            
DRAMC init done.                                                                                      
Calculate size.                                                                                       
DRAM size=512MB(supported max size)                                                                   
Set new TRFC.                                                                                         
ddr-1066                                                                                              
                                                                                                      
7512DRAMC V1.2.2 (0)                                                                                  
                                                                                                      
                                                                                                      
EN751221 at Tue Nov 7 20:42:52 CST 2017 version 1.1 free bootbase                
                                                                                                      
Memory size 512MB                                                                                     
                                                                                                      
Set SPI Clock to 25 Mhz                                                                               
spi_nand_probe: mfr_id=0x98, dev_id=0xcb                                                              
Using Flash ECC.                                                                                      
Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_TC58CVG1S3H, Flash Size=0x10000000                      
bmt pool size: 163                                                                                    
BMT & BBT Init Success                                                                                                                                                                                      
                                                                                                      
Press any key in 3 secs to enter boot command mode.              
.......................                                                                               
UserName: telecomadmin                                                                                
Password: ********                                                                                    
                                                                                                      
bldr> xmdm 80002000 786630                                                                            
CCCC                                                                                                  
*** file: /root/pkt_access/openwrt/linux.bin
$ lsx -vv /root/pkt_access/openwrt/linux.bin                                                          
Sending /root/pkt_access/openwrt/linux.bin, 61644 blocks: Give your local XMODEM receive command now.
Bytes Sent:7890560   BPS:7989                                          
                                                                                                      
Transfer complete                                                                                     
                                                                                                      
*** exit status: 0 ***                                                                                
ived len=786680                                                                                       
bldr> jump 80002000                                                                                   
Jump to 80002000                                                                                      
[    0.000000] Linux version 4.9-ndm-5 (user@5247154d066c) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r8077-7cbbab7246) ) #0 SMP Wed Nov 11 20:09:58 2020
[    0.000000] ISPRAM0: PA=00350000,Size=00010000,enabled                                             
[    0.000000] EcoNet SoC: RAM: DDR3 512 MB                                                           
[    0.000000] CPU/SYS frequency: 900/225 MHz                                                                                                                                                               
[    0.000000] bootconsole [early0] enabled                                                           
[    0.000000] CPU0 revision is: 00019558 (MIPS 34Kc)                                                 
[    0.000000] Determined physical RAM map:      
[    0.000000]  memory: 00020000 @ 00000000 (reserved)                       
[    0.000000]  memory: 1bbe0000 @ 00020000 (usable)                         
[    0.000000]  memory: 00400000 @ 1bc00000 (reserved) 
[    0.000000]  memory: 1bbe0000 @ 00020000 (usable)                                                                                                                                               [100/412]
[    0.000000]  memory: 00400000 @ 1bc00000 (reserved)                      
[    0.000000] Wasting 1024 bytes for tracking 32 unused pages                           
[    0.000000] Initrd not found or empty - disabling initrd                               
[    0.000000] Detected 1 available secondary CPU(s)                                      
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:                                                                           
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000001bbfffff]   
[    0.000000] Movable zone start for each node                                                       
[    0.000000] Early memory node ranges                                                               
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000001bbfffff]           
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000001bbfffff]
[    0.000000] percpu: Embedded 12 pages/cpu s17968 r8192 d22992 u49152          
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 112776
[    0.000000] Kernel command line: console=ttyS0,115200                                              
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)       
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)  
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Writing ErrCtl register=00067c6c                                                       
[    0.000000] Readback ErrCtl register=00067c6c                                                      
[    0.000000] NMI base is 813fc200                                                                   
[    0.000000] Memory: 442588K/454656K available (3448K kernel code, 144K rwdata, 664K rodata, 3472K init, 243K bss, 12068K reserved, 0K cma-reserved)
[    0.000000] Hierarchical RCU implementation.                                                       
[    0.000000]  Build-time adjustment of leaf fanout to 32.      
[    0.000000] NR_IRQS:41                                                                             
[    0.000000] hpt: using 200.000 MHz high precision timer             
[    0.000000] clocksource: hpt: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns
[    0.000007] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns
[    0.008002] console [ttyS0] enabled                                                                
[    0.008002] console [ttyS0] enabled                                                                
[    0.014795] bootconsole [early0] disabled
[    0.014795] bootconsole [early0] disabled                                                          
[    0.022791] Calibrating delay loop... 599.04 BogoMIPS (lpj=1198080)
[    0.053324] pid_max: default: 32768 minimum: 301                    
[    0.058067] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.064535] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.075290] ISPRAM0: PA=00350000,Size=00010000,enabled                            
[    0.076140] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.076147] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.076231] CPU1 revision is: 00019558 (MIPS 34Kc)                                                 
[    0.132050] Synchronize counters for CPU 1: done.                                                  
[    0.136839] Brought up 2 CPUs              
[    0.139727] CPU1: update max cpu_capacity 589                                                      
[    0.144090] CPU1: update max cpu_capacity 589                                                      
[    0.145303] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.145320] futex hash table entries: 512 (order: 2, 16384 bytes)
[    0.164595] NET: Registered protocol family 16                                                     
[    0.567802] PCI host bridge to bus 0000:00    
[    0.571849] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.578739] pci_bus 0000:00: root bus resource [io  0x1f600000-0x1f60ffff]
[    0.585472] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.578739] pci_bus 0000:00: root bus resource [io  0x1f600000-0x1f60ffff]                                                                                                                       [50/412]
[    0.585472] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.592238] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.602306] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.610299] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.622617] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    0.629289] pci 0000:00:01.0: BAR 8: assigned [mem 0x20100000-0x202fffff]
[    0.636027] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
[    0.642835] pci 0000:00:00.0: PCI bridge to [bus 01]                 
[    0.647784] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
[    0.654613] pci 0000:02:00.0: BAR 0: assigned [mem 0x20100000-0x201fffff 64bit]
[    0.661907] pci 0000:02:00.0: BAR 6: assigned [mem 0x20200000-0x2020ffff pref]
[    0.669031] pci 0000:00:01.0: PCI bridge to [bus 02]                     
[    0.674001] pci 0000:00:01.0:   bridge window [mem 0x20100000-0x202fffff]     
[    0.681969] clocksource: Switched to clocksource hpt
[    0.688429] NET: Registered protocol family 2                                                      
[    0.692898] IP idents hash table entries: 8192 (order: 4, 65536 bytes)
[    0.700252] TCP established hash table entries: 16384 (order: 4, 65536 bytes)
[    0.707536] TCP bind hash table entries: 16384 (order: 5, 131072 bytes)  
[    0.714525] TCP: Hash tables configured (established 16384 bind 16384)
[    0.721057] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.726786] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) 
[    0.733266] NET: Registered protocol family 1                                                      
[    0.812038] workingset: timestamp_bits=29 max_order=17 bucket_order=0
[    0.818598] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.826354] io scheduler noop registered (default)
[    0.831391] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)        
[    0.838901] PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
[    0.846744] tc3162_uart: UART driver for EN751x SoC, buffer size is 4096 bytes
[    0.854130] ttyS0 at I/O 0xbfbf0003 (irq = 1, base_baud = 7200) is a TC3162
[    0.854592] ndmpart: registering the NDM partition parser...             
[    0.854620] EcoNET SPI NAND driver init
[    0.854645] Set SPI Clock to 50 Mhz                                                                
[    0.854673] Using Flash ECC
[    0.854685] Detected SPI NAND Flash: TC58CVG1S3H, Flash Size: 256 MB
[    0.854976] nand: device found, Manufacturer ID: 0x98, Chip ID: 0xcb
[    0.854983] nand: Toshiba TC58CVG1S3H
[    0.854994] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    0.919424] BMT pool size: 163               
[    0.921233] BBT found, bad block count: 3      
[    0.921242] BBT bad block: 3                                                                       
[    0.921249] BBT bad block: 1536                                                                    
[    0.921256] BBT bad block: 1537            
[    0.921314] BMT & BBT init success                                                                 
[    0.926674] ndmpart: di: unknown magic 0x55424923
[    0.926689] mtd: failed to find partitions; one or more parsers reports errors (-22)
[    0.927694] tun: Universal TUN/TAP device driver, 1.6
[    0.927717] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    0.927788] PPP generic driver version 2.4.2  
[    0.927934] PPP MPPE Compression module registered
[    0.927948] NET: Registered protocol family 24 
[    0.927974] PPTP driver version 0.8.5
[    0.927948] NET: Registered protocol family 24
[    0.927974] PPTP driver version 0.8.5
[    0.929555] nf_conntrack version 0.5.0 (56320 buckets, 112640 max)
[    0.929993] gre: GRE over IPv4 demultiplexor driver
[    0.930117] NET: Registered protocol family 10
[    0.931277] NET: Registered protocol family 17
[    0.931311] 8021q: 802.1Q VLAN Support v1.8
[    0.946350] Freeing unused kernel memory: 3472K
[    0.946374] This architecture does not have kernel memory protection.
[    0.946382] RNG reseed started
[    0.946425] cannot get MTD device Config: -19
[    0.958088] init: Console is alive
[    0.972789] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    0.973142] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    0.979246] init: - preinit -
[    1.060623] random: jshn: uninitialized urandom read (4 bytes read)
[    1.081849] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    4.189751] procd: - early -
[    4.740799] procd: - ubus -
[    4.747511] random: ubusd: uninitialized urandom read (4 bytes read)
[    4.790943] random: ubusd: uninitialized urandom read (4 bytes read)
[    4.791428] random: ubusd: uninitialized urandom read (4 bytes read)
[    4.792290] procd: - init -
Please press Enter to activate this console.
[    4.924298] kmodloader: loading kernel modules from /etc/modules.d/*
[    4.927875] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    4.938230] ip_tables: (C) 2000-2006 Netfilter Core Team
[    4.975870] xt_time: kernel timezone is -0000
[    4.981559] kmodloader: done loading kernel modules from /etc/modules.d/*
[    6.139263] random: fast init done
[    9.034952] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready



BusyBox v1.28.4 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 18.06.9, r8077-7cbbab7246
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#

Notes:

[ 0.000000] ISPRAM0: PA=00350000,Size=00010000,enabled - the 2.6 kernel says this should be 32k not 64k and this kernel has it hard coded to 64k. I don't know anything about ISPRAM or whether this means there will be zero space for CONFIG_TC3162_DMEM, or if it will map addresses off the chip and eventually crash, or if it just doesn't matter and it's better to do it this way.
[ 0.136839] Brought up 2 CPUs - the 2.6 kernel brings up 4 "virtual" CPUs, unclear which is better
[ 0.926689] mtd: failed to find partitions; one or more parsers reports errors (-22) - this needs fixing so that we can load the squashfs and not rely on initramfs
[ 0.946425] cannot get MTD device Config: -19 - random number generator, low priority

TODO:

Probably ethernet, the driver is in the kernel tree so this should be relatively low hanging fruit
Figure out the MTD situation
Wifi drivers
USB (this is another case where the EN7512 differs from the EN7526 and so the kernel is initializing the USB incorrectly)
Check if EPON drivers exist in this kernel (I'm not sure - didn't check)
Port the prom and all of the working drivers to stock openwrt kernel-5.15 and stop using this divergent 4.9
Build a trx "tclinux.bin" file so I can flash to the chip
Propose patches to OpenWRT

But this weekend I will push my hacky openwrt tree to github and write some instructions for anyone who wants to follow along.

alexceltare2 · March 23, 2023, 5:56pm

Awesome job dude. I guess you've loaded the image in RAM and not flash it in NAND yet. Also, did you fiddled with the core .c files and/or any kernel patches to make it boot?
I was going to suggest creating a repo on Github and come up with commits so we can work along. But not this weekend for me as i have work (ironically for an ISP).

cjd · March 23, 2023, 7:14pm

I guess you've loaded the image in RAM and not flash it in NAND yet <-- yup, that way I could:

Reduce any risk of bricking
Not have to futz around with the TRX header and custom image compression logic
I'm updating the kernel every boot anyway, so might as well just push it into memory rather than writing it

fiddled with the core .c files and/or any kernel patches to make it boot? <-- The only file I modified was tc3262/Platform to change 0xffffffff80020000 to 0xffffffff80002000 which is the default load address for the EN7526. That said, I'm not convinced that its even necessary for now when I'm manually loading and jumping. What I did patch rather extensively was the config.

And now some bad news: The Ethernet module is a big ugly blob of code which is not present in any of keenetic's public codebases. Keenetic probably has the source but I think it has some scary anti-GPL "do not share this" warnings on it, as does the Linux2.6 one.

So what's probably the next step on this is to just port everything we have into 5.15 and then we can copy that big ugly Ethernet module into an openwrt kmod and see what horrors await us when we try to port a driver from 2.6 to 5.15

cjd · March 25, 2023, 1:59pm

Update: I have published what I did on github.

I'm not going to pursue this kernel too much more, anything that would land into OpenWRT is going to be based on 5.15 so my next plans are to port over the core support files to 5.15 and then get a new branch going which is branched off of master with a (patched) mainline kernel.

The good news is that the wireless chips are connected over plain old PCIe, so getting these to work should be a piece of cake. The harder project will be migrating the ethernet driver. Then we have XPON which will be similar to ethernet, and USB which I have not seriously investigated.

I think the MTD partitions will come up as soon as we just write a devicetree file.

01:00.0 Network controller: MEDIATEK Corp. Device 7603                                                
        Subsystem: MEDIATEK Corp. Device 7603
        Flags: fast devsel, IRQ 255
        Memory at 20000000 (32-bit, non-prefetchable) [disabled] [size=1M]
        Capabilities: [40] Power Management version 3
        Capabilities: [50] MSI: Enable- Count=1/1 Maskable- 64bit+
        Capabilities: [70] Express Endpoint, MSI 00
        Capabilities: [100] Advanced Error Reporting
        Capabilities: [140] Device Serial Number 00-00-00-00-00-00-00-00
        Capabilities: [150] Latency Tolerance Reporting

02:00.0 Network controller: MEDIATEK Corp. MT7662E 802.11ac PCI Express Wireless Network Adapter
        Subsystem: MEDIATEK Corp. MT7662E 802.11ac PCI Express Wireless Network Adapter
        Flags: fast devsel, IRQ 255
        Memory at 20100000 (64-bit, non-prefetchable) [disabled] [size=1M]
        [virtual] Expansion ROM at 20200000 [disabled] [size=64K]
        Capabilities: [40] Power Management version 3
        Capabilities: [50] MSI: Enable- Count=1/1 Maskable- 64bit+
        Capabilities: [70] Express Endpoint, MSI 00 
        Capabilities: [100] Advanced Error Reporting
        Capabilities: [148] Device Serial Number 00-00-00-00-00-00-00-00
        Capabilities: [158] Latency Tolerance Reporting
        Capabilities: [160] L1 PM Substates