ZyXEL P2812HNU-F1 u-boot

To boot OpenWrt on P2812HNU-Fx the stock u-boot has to be exchanged by a custom one. @ScApi has provided these some 6 years ago. It has been in my boxes since then. However, when trying to boot an initramfs-kernel.bin, it has since long failed with 'Uncompressing Kernel Image ... LZMA: uncompress or overwrite error 7 - must RESET b', followed by a reboot. Somewhere, I don't remember where, I've read that this u-boot can't uncompress more than 8MiB target space. I can imagine an initramfs-kernel is bigger. For the F3 ScApi provided a TFTP boot image size fix, which might deal with that, but unfortunately not for the F1.
Problem is now that when sysupgrading to snapshot, I get the same lzma error on boot of the box. Binwalk told me that the uncompressed kernel is 8550713 bytes, while the uncompressed kernel of 21.01-rc3 is 7883213 bytes. so indeed the 8MiB limit has been exceeded. Either a new u-boot is needed, or the decompressor has to be piggybacked on the kernel in order to boot this.
OpenWrt/Lede never provided a nand u-boot for any xrx200 device, but it provides a ram version for the P2812HNU-Fx and others, and a nor version for some others. Is there something special in nand u-boot making it harder to provide this? How should I start to build a new nand u-boot?

In short words, yes.
For nand lantiq loads only first bytes (spl boot) witch then loads rest of uboot, as it was long ago I dont remember what was the fix for F3 but they share most od the code. I dont have any of this devices now so I can only help to trobleshoot.

1 Like

OK, thanks. I downloaded the OpenWrt sources, and found in packages/boot/u-boot-lantiq/Makefile

define U-Boot/p2812hnufx_ram
  NAME:=ZyXEL P-2812HNU-Fx (RAM)
  BUILD_SUBTARGET:=xrx200
  BUILD_DEVICES:=zyxel_p-2812hnu-f1
  DDR_SETTINGS:=board/zyxel/p2812hnufx/ddr_settings.h
endef

define U-Boot/p2812hnufx_nandspl
  NAME:=ZyXEL P-2812HNU-Fx (NAND SPL)
  BUILD_SUBTARGET:=xrx200
  BUILD_DEVICES:=zyxel_p-2812hnu-f1
  UBOOT_IMAGE:=u-boot.ltq.lzo.nandspl
  DEPENDS+=@BROKEN
endef

So there is a nand u-boot somehow, but it's marked broken. I removed the 'broken' flag, and it built without any problems. But the binary is not just a binary u-boot with a pre-loader in front:

$ binwalk u-boot.ltq.lzo.nandspl 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
8320          0x2080          CRC32 polynomial table, little endian
9412          0x24C4          LZO compressed data
16448         0x4040          LZO compressed data
124700        0x1E71C         LZO compressed data

So I suppose the first 8320 bytes contain both a preloader, and a decompressor. Some extra level in complexity. I suppose there is no way testing this without flashing? Any idea why it's marked broken?
It's a bit strange that the source tree does contain a nand u-boot for the F1, but not a nor for the F3, while it provides nor u-boot's for other Lantiqs.

I found this commit from 2017 to be responsible for the 'broken' mark. On my system is lzop available, and so it build. Unfortunately the comment doesn't mention where NAND-SPL support is broken, but assuming it's in u-boot itself, odds are that it's repaired by now. I'll just try to flash it.

Scratch that. U-boot 2013.10 is used, so if the 'solution' is not in the OpenWrt patches, it's not repaired.

Indeed NAND-SPL is broken. After flashing the u-boot I got no further than

ROM VER: 1.0.5
CFG 06
NAND
NAND Read OK

@Mafketel , when googling I found you were also experiencing this problem. Did you ever solve it?

On my github You can find U-Boot with commit regarding Livebox, or one for HHv5 with commits from @xdarklight, use Them as base, as far as I can tell they have this problem mostly fixed.

Solved. When sifting the trunk files I found the 16MiB patch is in package/boot/uboot-lantiq/patches/0107-MIPS-add-board-support-for-ZyXEL-P-2812HNU-Fx.patch :

+
+#define CONFIG_SYS_BOOTM_LEN          0x1000000       /* 16 MB */
+

With the patch reverted, I build the nand-spl u-boot a second time, extracted the lzo compressed part using binwalk, and looked at the differences in the binaries. It appeared there were only four bytes different (apart from a timestamp in ascii), two pairs '00 80' which had become '01 00'. (I think I know how the 32MiB patch would work out :slight_smile: ). So I took @ScApi's r47026 bootloader, extracted the payload, hexedited the file and repackaged it. (And when I was there, I also edited the timestamp). It worked! This bootloaded can uncompress to >8MiB:

ROM VER: 1.0.5
CFG 06
NAND
NAND Read OK

U-Boot SPL 2013.10-openwrt5 (Nov 18 2014 - 19:54:01)
SPL: initializing NAND flash
SPL: checking U-Boot image
SPL: loading U-Boot to RAM
SPL: decompressing U-Boot with LZO
SPL: jumping to U-Boot


U-Boot 2013.10-openwrt5 (Jul 06 2021 - 10:04:01) P-2812HNU-Fx

Board: ZyXEL P-2812HNU-Fx
SoC:   Lantiq VRX288 v1.1
CPU:   500 MHz
IO:    250 MHz
BUS:   250 MHz
BOOT:  NAND
DRAM:  128 MiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
Net:   ltq-eth
Hit any key to stop autoboot:  2  0 
P-2812HNU-Fx # tftpboot openwrt-19.07.7-lantiq-xrx200-zyxel_p-2812hnu-f1-initramfs-kernel.bin
ltq_phy: addr 0, link 1, speed 1000, duplex 1
ltq_phy: addr 1, link 0, speed 10, duplex 0
ltq_phy: addr 17, link 0, speed 10, duplex 0
ltq_phy: addr 19, link 0, speed 10, duplex 0
ltq_phy: addr 5, link 0, speed 10, duplex 0
Using ltq-eth device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt-19.07.7-lantiq-xrx200-zyxel_p-2812hnu-f1-initramfs-kernel.bin'.
Load address: 0x82000000
Loading: *#################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #####################################################
	 8 MiB/s
done
Bytes transferred = 4586129 (45fa91 hex)
P-2812HNU-Fx # bootm
## Booting kernel from Legacy Image at 82000000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.221
   Created:      2021-02-15  15:22:37 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    4586065 Bytes = 4.4 MiB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 4.14.221 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11306-c4a6851c72)) #0 SMP Mon Feb 15 15:22:37 2021

I uploaded the u-boot here. Thanks again, @ScApi , for providing the original u-boot!

4 Likes

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.