I managed to run busybox My messy notes.txt can be found on http://lekensteyn.nl/files/sx551/ (everything is done on trunk fyi)
If you just want to try the build, use fw.bin. If it says that the initrd cannot be found on boot (e.g. after flashing), try turning the device off (serial needs to be detached as well). Wait for a second and put the serial in again. When you've your console, turn the device on.

The kernel and busybox config is attached as well. I couldn't get networking working, TX bytes/packets stay 0, I can't ping or anything. When there is network activity from the main router however, the RX bytes/packets increase (for example, on arpscan).

So overall: pretty much success this weekend, no 1 April joke

Busybox usage:
http://www.busybox.net/downloads/BusyBox.html

(Last edited by Lekensteyn on 1 Apr 2012, 14:41)

Networking is ALSO working now, perhaps cpmac was conflicting with the mvswitch-thing driver. Anyway, I immediately continued with grabbing a 3.2 kernel source to see if things had improved. Started with "make allnoconfig", I've tried to get a kernel as small as possible (even no iptables). The resulting firmware package contains only busybox, a kernel, a few small configuration files and /init.
See the revised notes.txt http://lekensteyn.nl/files/sx551/, the blob is available in http://lekensteyn.nl/files/sx551/firmware/

Happy hacking!

Nice! Works for me.

The sequence is not clear to me. Did the network work before or after you went to Linux 3.2?

Networking did not work for me on 2.6.37.6 (openwrt patches applied; cpmac and mvswitch thingey compiled in). With 3.2 from kernel.org and some patches, it works. I still have issues with a larger initramfs (or even kernel?) though, even a 64KB larger initramfs (larger busybox+initscripts) resulted in a rootfs not found error. Either I have bad RAM/flash or addresses are wrongly mapped.

I've found that code. It's in trunc/build_dir/linux-ar7/acx-mac80211-20111030/pci.c.
Reading this I think the code you found was to emulate a PCI bus for the PCI driver of certain wireless nic's and that code is moved to the nic driver instead.

I've been searching for info on VLYNQ2PCI bridges. And I've found that the acx miniPCI cards in some AR7 routers have some unused PCI pins mapped to the VLYNQ interface. That's why they work in any miniPCI slot, but you can't put another miniPCI card in that router, as PCI itself is not wired on the router. (BTW, another reason to beleive this box has a PCI bus. The wifi card isn't acx)
Further I found generic info on VLYNQ, stating how smart and brilliant (and proprietary) it is, and telling that it's possible to connect vlynq-USB, vlynq-OTG or vlync-PCI bridges.
And I found info about the SX553, telling it has an TNETV100PZ VLYNQ2PCI bridge. Just like our SX551. I don't think the 553 is actually different.

What I didn't find is a datasheet for the TNETV100PZ (lots of dead links from Chinese chip sellers), nor any source code for such a bridge. I also haven't found any evidence that such a bridge has been used on anything else than these Siemens boxes.

BTW, VLYNQ is also implemented on the arm omap and davinci SoC's.

===========================================================
 TI ADSL AR7300 Loader 0.71.4 build Oct 18 2005 11:13:40
                 Broad Net Technology, INC.
===========================================================
ESS ES29LV160D bottom boot 16-bit mode found

Copying boot params.....DONE

Flash Checking  Passed.

Unzipping  web at 0x94f30000 ... [LZMA] done
Unzipping code at 0x94000000 ... [LZMA] done[    0.000000] Linux version 3.3.1 (Mijzelf@ubuntu) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #8 Sat Apr 7 21:30:52 CEST 2012
[    0.000000] gpiochip_add: registered GPIOs 0 to 31 on device: ar7-gpio
[    0.000000] ar7-gpio: registered 32 GPIOs
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00018448 (MIPS 4KEc)
[    0.000000] TI AR7 (TNETD7300), ID: 0x0005, Revision: 0x26
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 14000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00014000 -> 0x00016000
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00014000 -> 0x00016000
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line:  console=ttyS0,115200n8
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes.
[    0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 16 bytes
[    0.000000] Memory: 27820k/32768k available (2388k kernel code, 4948k reserved, 517k data, 1616k init, 0k highmem)
[    0.000000] NR_IRQS:256
[    0.000000] Calibrating delay loop... 148.88 BogoMIPS (lpj=744448)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.070000] Mount-cache hash table entries: 512
[    0.090000] NET: Registered protocol family 16
[    0.100000] bio: create slab <bio-0> at 0
[    0.100000] Switching to clocksource MIPS
[    0.110000] NET: Registered protocol family 2
[    0.110000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.120000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    0.130000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.140000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.140000] TCP reno registered
[    0.150000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.150000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.160000] NET: Registered protocol family 1
[    0.170000] RPC: Registered named UNIX socket transport module.
[    0.170000] RPC: Registered udp transport module.
[    0.180000] RPC: Registered tcp transport module.
[    0.180000] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.500000] unable to add cpmac-high phy: -19
[    0.500000] unable to add cpmac-low phy: -19
[    0.510000] io scheduler noop registered
[    0.510000] io scheduler deadline registered (default)
[    0.520000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.530000] serial8250: ttyS0 at MMIO 0x8610e00 (irq = 15) is a AR7

<snip about 600 empty lines>

 [    2.160000] Freeing unused kernel memory: 1616k freed
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
f
- failsafe -


BusyBox v1.19.4 (2012-04-07 15:31:41 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 ATTITUDE ADJUSTMENT (bleeding edge, r31158) ----------
  * 1/4 oz Vodka      Pour all ingredients into mixing
  * 1/4 oz Gin        tin with ice, strain into glass.
  * 1/4 oz Amaretto
  * 1/4 oz Triple sec
  * 1/4 oz Peach schnapps
  * 1/4 oz Sour mix
  * 1 splash Cranberry juice
 -----------------------------------------------------
root@(none):/# root@(none):/# ifconfig -a
lo        Link encap:Local Loopback  
          LOOPBACK  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

There are a few strange things here.
- The kernel says it cannot find initrd, but runs openwrt userland from it.
- Directly after initializing the serial port I get about 600 empty lines (0x0A). Maybe I'm also missing 600 loglines. At least the log of 75% of the Linux boottime is missing.
- There are no NIC's. When I've time again I'll put my kernel .config next to Lekensteyn's one.

That "Initrd not found or empty - disabling initrd" message comes from a different part of the kernel, the mips code to be precise. AFAIK, there are at least two ways to load a initial ramfs, using MIPS' specific rd_start/rd_size/(bootloader?) options, and the embedded initramfs feature in newer kernels (which is what I'm using).

About the serial issue, have you applied http://lekensteyn.nl/files/sx551/patche … -3.2.patch? Without it, words would be mixed in random order after "serial8250: ttyS0 at ...".

For the NIC to work, be sure to enable cpmac. The DSA_MARVELL thing did not work for me (the device is not attempted to get probed).

Sorted the NIC. CONFIG_FIXED_PHY=y had to be set. For some reason the serial output now works normal too. A bit flaky.

How large are your vmlinuz and initramfs files? How are you building the firmware image? Using my mkfirm2 script?

My vmlinux is 4320816 bytes, with build-in (lzma'd) initramfs. According to du the initramfs is 1892k. The compressed vmlinux is 1413408 bytes.
And I'm using an adapted version of mkfirm.

And it still boots properly? Weird, a vmlinux of 3092932 (with built-in initramfs) works fine, but a larger one causes errors (like root device not found). When I tried mkfirm from your link, the image created by it was larger with a bunch of useless 0xff bytes which is why I made this custom mkfirm2 script. What changes did you made to that file?

You can find my mkfirm here. The main difference is that I implemented a blocksize of 1k, instead of the 64k block of the original (I told you about the 4k boundary, but I remembered wrong. It was 1k). And I added partitionsizes and magic numbers for the SX551,  SX553 and SE555.

But I don't think it has anything to do with your sizeproblem. I believe that the fimwarefile is only important to get it flashed. Once flashed, the bootloader will accept anything, as long as he can decompress it.
Maybe my version works because I used 'the openwrt way'? (Don't know what that is. I just let openwrt create the whole thing for me.)

Yep, I'm using 1K for blocksize as well. Hopefully my flash chip is not broken. Can you try to boot a firmware image that fails to boot here due to size? If yes, I can mail it to you (or another method you prefer).

If you're pass the linux-ar7/vmlinux file to mkfirm, there is no difference. The "OpenWRT" way is applying some patches (not affecting me AFAIK), build it and generate firmware images (which I don't directly use). The linux-ar7/vmlinux file is a stripped version of linux-ar7/linux-X.Y.Z/vmlinux file.

Sure. Put it on your server. (And give me a MD5 sum, just to be sure)

It does something more. It also puts the initramfs inside the kernel.

http://lekensteyn.nl/files/sx551/firmwa … re1.fw.bin
MD5: a00b283efe4e100a29ab2e97a5d44b75
Size: 1338378 bytes
Boot log: http://lekensteyn.nl/files/sx551/logs/b … -more1.txt

The initial ramfs is embedded into it as well (uncompressed though). Perhaps that makes the difference of failure?

My bootlog is identical to yours. So it's not your flash.

I thought my initramfs was uncompressed as well, but a look in the openwrt config shows it's lzma compressed. Don't know if it matters.

If you are interested, I uploaded my firmware to my mediafire folder. md5 b4e2bf09f702720e08db0548c34ac8eb

What a relief. Now I wonder what might have caused it. Perhaps the vmlinux image is uncompressed to a spot where it overlaps the initramfs uncompression space. What size is the file (vmlinux in particular?)? Can you mail it to me lekensteyn@gmail.com or provide a link?

I don't have a bare vmlinux. The output of the build is vmlinux with embedded initramfs.

Yea, that's OK. Just the linux-ar7/linux-xxx/System.map would be fine as it contains the addresses I'm looking for.

I uploaded System.map here.

That could be a way to use the psf partition to contain an initrd. Just hardcode the startaddress (0x94f30000) and endaddress in the kernel. Unfortutely the partition is just 249k, while my current initramfs is lzma compressed 478406 bytes. Would it be possible to combine the initramfs and initrd? Maybe initrd is available as /dev/ram, or something like that?

I've noticed that you've compressed all zeroes into a 1024 bytes PFS LZMA and am now trying to do the same. Furthermore, my instructions seem to miss one patch: change BOOT_ELF32 to BOOT_RAW in arch/mips/Kconfig under the AR7 target.

Initrd is a block device (includes the bloat of block devices like caching) where initramfs really runs in RAM. MIPS initrd seem to refer to initramfs too, not the block device thing.

Edit: tested with a smaller pfs, still fails with "Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)".

Can you share your kernel config?

(Last edited by Lekensteyn on 14 Apr 2012, 11:08)

Yeah, I had to provide *something*. Did you ever observe that /dev/zero compresses marvellous? :-)

I uploaded kernel .config here

And the filesize is minimal Most of the file size comes from the padding.

I checked your .config against my config on 3.3.2 and it looks fine. I've tried building 3.2.2 with three patches + one sed command applied, but it still fails.
Maybe it's because I'm using a file list now where I was using a directory in the past as initramfs source. The usr/initramfs_data.cpio file is properly generated though.

Can you tell me more about your method of building? What patches have you applied against the 3.2.1 tree?

I didn't document it as good as I should. But this is it, as far as I remember:
* Download trunk
* Edit trunk/target/ar7/Makefile:
    LINUX_VERSION:=3.3.1
* cd trunk
* run make defconfig
* run make menuconfig
   disabled pretty everything (now I know uci and mtd are necessary)
   in Target Images I enabled ramdisk.
* run make
* This errors out on applying the patch patches/generic/910-kobject_uevent.patch
* removed that patch from trunk/build_dir/linux-ar7/linux-3.3.1/patches/series
* applied your 2 patches manually, changed addresses, ...
* run make kernel_menuconfig
   removed everything I don't need
* build make again.

That's it, I think.