OpenWrt Forum Archive

Topic: Bootloader/Image for a DLink DWL-2100AP

The content of this topic has been archived between 26 Mar 2018 and 5 May 2018. Unfortunately there are posts – most likely complete pages – missing.

Hi

I have tweaked the ar531x target/patches in the development trunk and created a vmlinux file (with embedded ramdisk) that can be successfully booted via TFTP on a DLink DWL-2100 AP (rev A5), using the VxWorks boot console through serial cable. I would like to know what you think is the next logical step to take in order to replace the stock firmware more permanently (i.e. in the flash). The major problem, as I see it, is that the standard VxWorks firmware is stored in TFFS format, of which there seems to be little information available.

I THINK I have gathered enough information about the processor/chipset to write a substitution bootloader but I have no real experience in that area so would like to avoid or delegate it, if possible. Otherwise, what would the best base to begin on? RedBoot? CFE?

Another possible route would be to create a .tfp (DLink's firmware format) image and update the device that way, but there doesn't seem to be much information available on the format of those files.

I have dumped the contents of the flash and reverse engineered the first part of the bootloader, but am currently stuck on the decompression code that loads the second stage of the bootloader (not really that comfortable with MIPS assembler :-) ). I could provide it if someone wants to take a look at it.

Thanks,
MH

Hi MH,

There is a (not entirely) secret project going on for redboot on all known Atheros based hardware. At present I can make images for a few boards, would you help me sort one for the DWL-2100AP. I need to know how much ram & flash and the switch chip. Then I can make a redboot ram loadable image for you to test.

Thanks

Mike

Hi Mike

The DWL 2100-AP is equipped with 16MB RAM and 4MB Flash. The switch chip is a Marvell 88E6060. Source code for the linux PHY drivers can be found in DLink's GPL tarball (at ftp.dlink.com/GPL/dwl2210ap), in apps/atheros/linux/arch/mips/ar531x/mvPhy.*. You will also (I think) need a driver for the watchdog timer in order to avoid the board triggering an NMI or reset. Source code for that can be found at the same place, in ar531xwatchdog.c.
Let me know if you need any more information!

Regards,
MH

Hi MH,

I can already make working redboots (which is just the bootloader) already. Sadly you've omitted the pieces of information I actually need. The flash chip type (AT49BV322D or similar) and the SDRAM chip number (and preferably a link to the datasheet).

I've already got a board working with a marvell luckily.

Anyhow as for the watchdog redboot doesn't have a driver for that. If it becomes a problem I'll look into it then, but as redboot resets all of the hardware it shouldn't be a problem.

Mike

Hi again

Sorry about the misunderstanding, I usually don't program that low level :-)

The SDRAM is an ESMT M12L128168A-7T which has a data sheet on http://www.esmt.com.tw/DB/manager/uploa … 28168A.pdf .

The flash is a Spansion S29GL032M - 90TFIR4. The data sheet is on http://www.spansion.com/s29gl-m_00_b5_e.pdf . Do remember that the DWL 2100-AP only has an 8-bit flash bus since it's AR2313-based. If it helps, the following message is displayed when booting linux:
<5>physmap flash device: 200000 at be000000
<5> Amd/Fujitsu Extended Query Table v1.1 at 0x0040
<5>number of CFI chips: 1
<5>cfi_cmdset_0002: Disabling fast programming due to code brokenness.
<5>Using physmap partition definition
<5>Creating 1 MTD partitions on "Physically mapped flash":
<5>0x000f0000-0x001d0000 : "rootfs"

Please don't hesistate to ask if you need more information

Regards,
MH

Edit: Never trust Google when you can go directly to the source...
Edit: I now see that the Ethernet switch is actually an ICPlus IP101. It works with the Marvell drivers though, so I guess they are software compatible.

(Last edited by mhojlund on 6 Jul 2006, 09:26)

Hello Mike, any progress?

I might proceed by porting RedBoot myself, is there any chance of having a look at the work you have already done?

Regards,
MH

Hi MH,

I have an image you can try. The problem is finding somewhere to put it safely. Email me at malbon@openwrt.org and I'll send you the image.

Mike

malbon wrote:

Hi MH,

I have an image you can try. The problem is finding somewhere to put it safely. Email me at malbon@openwrt.org and I'll send you the image.

Mike

I have also interest to bootloader-image for the DWL 2100-AP


Thanks,
Holger

Hi there !
I have successfully compiled redboot for DWL2100AP - it works when loaded via JTAG into RAM. ROM version does not works, because something wrong in hardware initialization. BUT, it is possible now to use part of original bootloader as hardware initializer, that loads redboot. For now i have working redboot, loaded with part of original bootloader. It can load compresed linux kernel from flash or network.

ar531x rev 0x00005850 firmware startup...
SDRAM TEST...PASSED
+
RedBoot startup
Ethernet eth0: MAC address xx:xx:xx:xx:xx:xx
IP: 0.0.0.0/255.255.255.0, Gateway: 0.0.0.0
Default server: 0.0.0.0, DNS server IP: 0.0.0.0

RedBoot(tm) bootstrap and debug environment [RAM]
Non-certified release, version v2_0 - built 17:19:25, Mar  9 2007

Copyright (C) 2000, 2001, 2002, Red Hat, Inc.

RAM: 0x80010000-0x81000000, 0x806bd9d8-0x80ff3000 available
FLASH: 0xbfc00000 - 0xbffe0000, 31 blocks of 0x00020000 bytes each.
== Executing boot script in 10.000 seconds - enter ^C to abort
^C
RedBoot>

Now I'm trying to get redboot works without original bootloader, work in progress.

But, there are some problems with hardware:
I don't know why, but in my version of D-Link works only ENET1 and WLAN1 (not ENET0 and WLAN0 as it sould to be). So I patched redboot to use ENET1. Original bootloader also use et1 (not et0). The same thing with wireless card: it works fine as WLAN1 and platform ap43 with lastest version of madwifi.

Also, to get redboot access to flash it have to be described in flash_am29xxxxx_parts.inl like this:

 {   // S29gl032m90
        device_id  : FLASHWORD(0x7e),
        block_size : 0x20000 * CYGNUM_FLASH_INTERLEAVE,
        block_count: 32,
        device_size: 0x400000 * CYGNUM_FLASH_INTERLEAVE,
        base_mask  : ~(0x400000 * CYGNUM_FLASH_INTERLEAVE - 1),
        bootblock  : true,
        bootblocks : { 0x004000 * CYGNUM_FLASH_INTERLEAVE,
                       0x004000 * CYGNUM_FLASH_INTERLEAVE,
                       0x004000 * CYGNUM_FLASH_INTERLEAVE,
                       0x004000 * CYGNUM_FLASH_INTERLEAVE,
                       0x004000 * CYGNUM_FLASH_INTERLEAVE,
                       0x004000 * CYGNUM_FLASH_INTERLEAVE,
                       0x004000 * CYGNUM_FLASH_INTERLEAVE,
                       0x004000 * CYGNUM_FLASH_INTERLEAVE,
                       0x3e0000 * CYGNUM_FLASH_INTERLEAVE,
                       _LAST_BOOTBLOCK
                     },
        banked     : false
    },

Also, flash works only in x8 bit mode, so it really slow when programming via JTAG (I've tried to set x6 bit mode in flash controller, but it does not works). And flash layout is not so good: in Spansion S29GL032M R4 bootblocks are in the bottom, but bootloader is about 0x20000 bytes long, so small blocks in bottom of flash are useles. But at the top of flash there are small pars of data. like redboot fis directory or board config. They are all small, but each use 1 sector of flash (128k). So, I've decided do not use fis at all, and hard coded flash layout into kernel and redboot: now I have ~3.8Mb of free space for root filesystem and kernel (flash layout like in WRT54) and 128k for configuration.

(Last edited by bitbucket on 10 Mar 2007, 16:46)

bitbucket, you have done a good work.

I live in Italy and i write a little guide regarding 2100AP

http://xoomer.alice.it/ramponis/Documen … 2100ap.rar  (right click to save)

I'm very interested to flash the 2100AP with openwrt

Can i ask you some questions?

What's the software you use to flash the 2100AP through the JTAG?

Can you give me the schema of the jtag cable to compare with the my cable?

Can you write a little guide to describe your work?

Can you also share on a web-space your redboot for my test?

Excuse me for my questions

Thank you

(Last edited by ramponis on 13 Mar 2007, 17:25)

ramponis wrote:

What's the software you use to flash the 2100AP through the JTAG?

I described all about JTAG on wiki, http://wiki.openwrt.org/OpenWrtDocs/Har … DWL-2100AP
JTAG cable scheme http://wiki.openwrt.org/OpenWrtDocs/Cus … JTAG_Cable , I use buffered wiggler cable, it works with OSC Commander for debug and openwincejtag for flashing.

ramponis wrote:

Can you also share on a web-space your redboot for my test?

It is only redboot code, compressed to work with vxworks bootloader. The 1st stage bootloader you can get from flash, it is first 27441 bytes of flash memory. To get this data you can use linux kernel from kamikadze, compiled with embedded initrd or using openwince jtag programm. To get all things works it needs to concatenate both files - 1st bootloader and redboot.z, simply like this: cat 1st.bin redboot.z > bootloader.bin .
Warning ! Flashing bootloaderd may damage you device if something goes wrong. Use this information at your own risk ! If you have no expirience how to work with jtag cable and software you may brick your DWL2100AP. First af make a backup of all flash !
http://rapidshare.com/files/20880272/redboot.z.html - compressed bootloader I use. It can boot kermel from network and FIS.
Source of this redboot version I forund somewhere at openwrt.org. What you need to change in it I described in wiki. Also, I changed target.ld to place reset_vector code at the beginning of image, and relocate RAM image at 0x80680000 like 2nd stage of original bootloader:

.rom_vectors 0x80680000 : { KEEP (*(.reset_vector)) KEEP (*(.utlb_vector)) . = ALIGN(0x80); KEEP(*(.other_vector)) KEEP(*(.debug_vector)) } > ram

RAM space begins at 0x80010000, flash at 0xbfc00000, it is in x8 bit mode only !
Also, redboot load.c file require some changes to allow load kernel image at 0x80041000 . I'm not finished my work with redboot, so when I'm done I'll made a big diff of all changes I made, to get redboot work on DWL2100AP.

NOTE: openwince jtag sometimes does not see device, when vxworks or something else is running. So I use OCD Commander to stop software runing and cleared 1st sector of flash (see flash ic manual, and don't forget to enable flash in flash controller: long 0x58400000 = 0x000e3ce1 ) by hands from OCD commander, and than reboot device to get CPU stop because wrong operation code at the beginning of flash (0xff 0xff 0xff).

Now I'm trying to get redboot work standalone, without 1st stage bootloader, but the compiled and uncompressed image of redboot is bigger than 0x20000 bytes, to it will use more flash.Also I'm thinking abot method of booting kernel from flash: I'm dont know what to do: embed squashfs code to redboot, so it can load kernel from flash, or use booting  scheme like in wrt54g/gs: trx header + gzipped kernel + squashfs root.

Thank you for your informations and for your work.

It is very interesting!

I have already done the Jtag Unbuffered Cable.
I have download the software, and i have do the solders of the pin of the jtag and the serial on the 2100AP board.
The serial works correctly, but i have not tried the jtag

Con this cable work with OSC Commander and openwincejtag?
Or, do i need the buffered wiggler cable?

Thank you

ramponis wrote:

Con this cable work with OSC Commander and openwincejtag?

May be it can, or may be not - it depends on length of the cable and clock frequency in jtag connection. At the beginning of hacking DWL2100AP I've made unbuffered cable: it works, but not so stable, as I want.

ramponis wrote:

Or, do i need the buffered wiggler cable?

Best of all - buffered cable. I use buffered - all software works right, no errors when reading/flashing.

BTW, also you have to made a console cable with MAX232 level shifter.

bitbucket wrote:

BTW, also you have to made a console cable with MAX232 level shifter.

I have already build the serial console cable with a siemens telefon cable an it wors very well

I can see the boot procedure

ar531x rev 0x00005850 firmware startup... 
SDRAM TEST...PASSED 



  WAP-G02A  Boot Procedure                       V1.0 
--------------------------------------------------------- 
  Start ..Boot.B14.. 

Atheros AR5001AP default version 3.0.0.43A 


 0 
auto-booting... 

Attaching to TFFS... done. 
Loading /fl/APIMG1... 

  Please wait, loading  image ... 

  image check ok!!! 

/fl/  - Volume is OK 
Reading Configuration File "/fl/apcfg". 
Configuration file checksum: 5f3a7c is good 
Attaching interface lo0...done 
wireless access point starting... 
wlan1 Ready 
vxWorksTftpPackageInit: init. finish & success! 
Ready
ramponis wrote:
wlan1 Ready

As you can see DWL2100AP use wlan1 (not wlan0, as it shold to be), the same thing with ethernet deice. So, it needs to patch redboot as I described above, and linux kernel:

ar5312.c:
-#define AR531X_IRQ_ENET0_INTRS  MIPS_CPU_IRQ_BASE+3 /* C0_CAUSE: 0x0800 */
-#define AR531X_IRQ_ENET1_INTRS  MIPS_CPU_IRQ_BASE+4 /* C0_CAUSE: 0x1000 */
+#define AR531X_IRQ_ENET0_INTRS  MIPS_CPU_IRQ_BASE+4 /* C0_CAUSE: 0x0800 */
+#define AR531X_IRQ_ENET1_INTRS  MIPS_CPU_IRQ_BASE+3 /* C0_CAUSE: 0x1000 */
...
static struct physmap_flash_data ar5312_flash_data = {
-      .width    = 2,
+      .width    = 1,
};
...
asmlinkage void ar5312_irq_dispatch(void)
{
        int pending = read_c0_status() & read_c0_cause();

        if (pending & CAUSEF_IP2)
                do_IRQ(AR531X_IRQ_WLAN0_INTRS);
        else if (pending & CAUSEF_IP3)
                do_IRQ(AR531X_IRQ_ENET0_INTRS);
        else if (pending & CAUSEF_IP4)
-               do_IRQ(AR531X_IRQ_ENET0_INTRS);
+              do_IRQ(AR531X_IRQ_ENET1_INTRS);
        else if (pending & CAUSEF_IP5)
                do_IRQ(AR531X_IRQ_WLAN1_INTRS);

After these changes I've got working kernel.
Madwifi also need changes (see ticket 886 in madwifi):

if_ath_ahb.c:

#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,19)
static int ahb_wmac_probe(struct platform_device *pdev)
{
        u32 devid;
        struct ar531x_config *config;

        config = (struct ar531x_config *) pdev->dev.platform_data;
        devid = (u32) config->tag;
        config->tag = NULL;

+        if (pdev->id>0) return -ENODEV;

-        return init_ath_wmac((u_int16_t) devid, pdev->id, config);
+        return init_ath_wmac((u_int16_t) devid, pdev->id+1, config);
}

After this changes madwifi loads and wireless works.

As you can see DWL2100AP use wlan1 (not wlan0, as it shold to be), the same thing with ethernet deice.

Yes this is true

After these changes I've got working kernel.

Good work

After this changes madwifi loads and wireless works.

Very interesting.

So you have compiled a working kernel and filesystem?
The flash memory is divided in some partition?
How do you have configured the partition?

If you want...

Send me detailed information (my mail is ramponis<at>tiscali.it)
I will integrate it in my guide and in my site

Thank you

I'm trying to use openwincejtag, but i use windows.

I have installed Cygwin, but when i send the command ./configure i receive this error:

$ ./configure
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for gawk... gawk
checking whether make sets $(MAKE)... no
checking whether to enable maintainer-specific portions of Makefiles... no
checking for hwbench installation... no
checking for gcc... no
checking for cc... no
checking for cc... no
checking for cl... no
configure: error: no acceptable C compiler found in $PATH
See `config.log' for more details.

I have downloade gcc-3.4.6.tar.gz but i do not know how to install it.

Can you help me?

Thank you

(Last edited by ramponis on 23 Mar 2007, 17:13)

ramponis wrote:

I'm trying to use openwincejtag, but i use windows.

You have to install gcc using cygwin install utility. Also, you need to install readline library, and some tools to make 'configure' works.

You have to install gcc using cygwin install utility. Also, you need to install readline library, and some tools to make 'configure' works.

I have solved this problem.
Now jtag software start correctly, but my xilinx cable do not work correctly.

Now i have found an other schema for this cable. I try to assembly it.
If it do not work i will do a wiggler cable.

ramponis wrote:

If it do not work i will do a wiggler cable.

xilinx cable does not work - I've tested. Make buffered wiggler - it works.

(Last edited by bitbucket on 28 Mar 2007, 11:20)

xilinx cable does not work - I've tested. Make buffered wiggler - it works.

Now my xilinx cable works correcly big_smile

I can start my tests

Can you describe the commands you use to flash the 2100AP?
Excuse me, but i do not know the command of openwince JTAG.
Or if you can tell me a link with a list of commands and/or manual.

Thank you

Can you tell me the address of the bootloader and the leng.

I have a 2100AP with corrupted flash and i want to upload your bootloader.

ramponis wrote:

Can you tell me the address of the bootloader and the leng.

I have a 2100AP with corrupted flash and i want to upload your bootloader.

Flash starts at 0x1fc00000 , it is in 8bit mode. Bootloader size is 0x41690 . At 0x50000 starts tffs filesystem.

http://rapidshare.com/files/23550744/athorigbl.bin.html - original bootloader from my device.

I have tried to reflash the 2100AP bootloader

But i receive an error.
The chip flash is not recognized.
My 2100AP have an ATMEL AT49BV322A

What's wrong?

This is the sequence of the commands

$ jtag
JTAG Tools 0.6-cvs-20051228
Copyright (C) 2002, 2003 ETC s.r.o.
JTAG Tools is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for JTAG Tools.

Warning: JTAG Tools may damage your hardware! Type "quit" to exit!

Type "help" for help.

jtag> cable parallel 0x378 DLC5
Initializing Xilinx DLC5 JTAG Parallel Cable III on parallel port at 0x378
jtag> detect
IR length: 5
Chain length: 1
Device Id: 00000000000000000000000000000001
  Unknown manufacturer!
chain.c(110) Part 0 without active instruction
chain.c(133) Part 0 without active instruction
chain.c(110) Part 0 without active instruction
jtag> include atheros/ar2312/ar2312
jtag> poke 0x58400000 0x000e3ce1
ImpCode=01000000010000000100000000000000
EJTAG version: 2.6
EJTAG Implementation flags: R4k ASID_8 NoDMA MIPS32
jtag> detectflash 0x1fc00000
Query identification string:
        Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AM
/Fujitsu Standard Command Set)
        Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (
ull)
Query system interface information:
        Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
        Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
        Vpp [Programming] Supply Minimum Write/Erase voltage: 11500 mV
        Vpp [Programming] Supply Maximum Write/Erase voltage: 12500 mV
        Typical timeout per single byte/word program: 16 us
        Typical timeout for maximum-size multi-byte program: 0 us
        Typical timeout per individual block erase: 1024 ms
        Typical timeout for full chip erase: 65536 ms
        Maximum timeout for byte/word program: 256 us
        Maximum timeout for multi-byte program: 0 us
        Maximum timeout per individual block erase: 4096 ms
        Maximum timeout for chip erase: 262144 ms
Device geometry definition:
        Device Size: 4194304 B (4096 KiB, 4 MiB)
        Flash Device Interface Code description: 0x0002 (x8/x16)
        Maximum number of bytes in multi-byte program: 1
        Number of Erase Block Regions within device: 2
        Erase Block Region Information:
                Region 0:
                        Erase Block Size: 65536 B (64 KiB)
                        Number of Erase Blocks: 63
                Region 1:
                        Erase Block Size: 8192 B (8 KiB)
                        Number of Erase Blocks: 8
jtag> flashmem 0x1fc00000 boot.bin
Chip: AMD Flash
        Manufacturer: Unknown manufacturer (ID 0x0000)
        Chip: Unknown (ID 0x0000)
        Protected: 0001
program:
flash_unlock_block 0x1FC00000 IGNORE

block 0 unlocked
flash_erase_block 0x1FC00000
flash_erase_block 0x1FC00000 FAILED
erasing block 0: 99
addr: 0x1FC00000
flash error
jtag>

Can you help me?

thank you

(Last edited by ramponis on 1 Apr 2007, 14:05)