タグ: lzma-loader

WR8750Nメモ(5) OpenWrtとWDT

前回の記事の続きの様なもの。

WR8750NではBootloaderがWDTに設定する制限時間が短いためにOpenWrtのLinux Kernelを起動する際にWDTドライバをロードするタイミングが間に合わない。
なのでOpenWrtのLZMA-LoaderをBootloaderから最初に開始させ、board_init() でAR9344のWDTレジスタのカウントを最大値に設定したうえでLZMA圧縮のKernelを展開、実行を渡して開始するようにした。
なお、LZMA-Loaderのコンパイル時に CONFIG_BOARD_ボード名 を構成するために必要なコードが ath79/image/Makefile に1行不足していたため、付け足した。

ath79/image/lzma-loader/src/board.c

tlwr1043nd_init()と同様に、最後にREADREGした方が良いのだろうか。

#ifdef CONFIG_BOARD_WR8750N
static void wr8750n_init(void)
{
	unsigned int reg = KSEG1ADDR(AR71XX_RESET_BASE);
	unsigned int t;

	t = 0xfffffffful;
	WRITEREG(reg + AR71XX_RESET_REG_WDOG, t);
}
#else
static inline void wr8750n_init(void) {}
#endif

void board_init(void)
{
	tlwr1043nd_init();  // 別途あるTL-WR1043ND用コード
	wr8750n_init();
}

ath79/image/Makefileの追加部分

	$(MAKE) -C lzma-loader \
		PKG_BUILD_DIR="$@.src" \
		TARGET_DIR="$(dir $@)" LOADER_NAME="$(notdir $@)" \
+		BOARD="$(BOARDNAME)" \
		LZMA_TEXT_START=0x80a00000 LOADADDR=0x80060000 \
		$(1) compile loader.$(LOADER_TYPE)
	mv "$@.$(LOADER_TYPE)" "$@"

Bootlog

BootloaderでWDT関連のレジスタを設定する必要は無し

IPL:HARD-RESET
memory test ... ok
flinstall OK

boot version: 1.0.0

PKG "Orthos-HP"
CPU "Atheros/AR9344"
Revision 212.1 CLOCK 560.0 MHz
HEAP MEMORY 262144 bytes
Boot:InitFilesystem
phy0.1: "Atheros/AR8327(SW)"
phy0.0: "Atheros/AR8327(phy)"
active ch:0
post start
DRAM Test ..... PASS
Timer test .... PASS
FLASH CHKSUM .. PASS
LAN Test ..... 
LoopBack count 0 .. 
phy0.1: "Atheros/AR8327(SW)"
phy0.0: "Atheros/AR8327(phy)"
active ch:0
active ch:1
phy0.1: "Atheros/AR8327(SW)"
phy0.0: "Atheros/AR8327(phy)"
active ch:0
PASS
Package TYPE = 0x01
post success
now booting Firmware ...
loaded Firmware

welcome to boot console
Password:
boot> tftpd
tftpd start 192.168.0.1
boot> start tftp load kern.bin
end tftp load length = 3217712
start memory load ... 
memory load complete
  begin  : 0x80060000
  length : 3217687
  startup: 0x80060000
boot
begin  : 0x80060000
length : 3217687
startup: 0x80060000
option: 0x0


OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos 
Decompressing kernel... done!
Starting kernel at 80060000...

[    0.000000] Linux version 4.14.88 (jenkins@tofu-z77hvub18_openwrt) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r0+8777-fcf066db8c)) #0 Mon Dec 17 11:20:03 2018
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[    0.000000] MIPS: machine is NEC Aterm WR8750N
[    0.000000] SoC: Atheros AR9344 rev 1
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] random: get_random_bytes called from 0x8045572c with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,9600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 118584K/131072K available (3444K kernel code, 132K rwdata, 468K rodata, 6636K init, 195K bss, 12488K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 560.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6825930166 ns
[    0.000011] sched_clock: 32 bits at 280MHz, resolution 3ns, wraps every 7669584382ns
[    0.092710] Calibrating delay loop... 278.93 BogoMIPS (lpj=1394688)
[    0.237626] pid_max: default: 32768 minimum: 301
[    0.293071] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.372219] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.461138] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.578798] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.651747] pinctrl core: initialized pinctrl subsystem
[    0.715215] NET: Registered protocol family 16
[    0.769091] Can't analyze schedule() prologue at 803b8de4
[    0.836058] PCI host bridge /ahb/apb/pcie-controller@180c0000 ranges:
[    0.913162]  MEM 0x0000000010000000..0x0000000013ffffff
[    0.975618]   IO 0x0000000000000000..0x0000000000000000
[    1.055170] PCI host bridge to bus 0000:00
[    1.104208] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[    1.186426] pci_bus 0000:00: root bus resource [io  0x0000]
[    1.253088] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    1.334313] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.429637] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1001ffff 64bit]
[    1.517089] pci 0000:00:00.0: BAR 6: assigned [mem 0x10020000-0x1002ffff pref]
[    1.604083] clocksource: Switched to clocksource MIPS
[    1.665603] NET: Registered protocol family 2
[    1.718521] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    1.801848] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    1.877835] TCP: Hash tables configured (established 1024 bind 1024)
[    1.953975] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    2.023781] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    2.098978] NET: Registered protocol family 1
[    2.288373] Crashlog allocated RAM at address 0x3f00000
[    2.352186] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[    2.434245] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.504014] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    2.695925] io scheduler noop registered
[    2.742819] io scheduler deadline registered (default)
[    2.804559] ar7200-usb-phy usb-phy: phy reset is missing
[    2.870405] pinctrl-single 1804002c.pinmux: 544 pins at pa b804002c size 68
[    2.954930] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    3.031753] console [ttyS0] disabled
[    3.074516] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 8, base_baud = 2500000) is a 16550A
[    3.177529] console [ttyS0] enabled
[    3.177529] console [ttyS0] enabled
[    3.260806] bootconsole [early0] disabled
[    3.260806] bootconsole [early0] disabled
[    3.362788] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    3.421166] 6 fixed-partitions partitions found on MTD device spi0.0
[    3.497204] Creating 6 MTD partitions on "spi0.0":
[    3.554516] 0x000000000000-0x000000020000 : "Bootloader"
[    3.618904] 0x000000020000-0x000000022000 : "config"
[    3.679109] 0x000000022000-0x000000030000 : "reserved"
[    3.741418] 0x000000030000-0x000000040000 : "art"
[    3.798475] 0x000000040000-0x000000040040 : "fw_info"
[    3.859724] 0x000000040040-0x000000800000 : "os-image"
[    3.922674] libphy: Fixed MDIO Bus: probed
[    4.304478] libphy: ag71xx_mdio: probed
[    4.375105] switch0: Atheros AR8327 rev. 2 switch registered on mdio-bus.0
[    5.445260] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:00 [uid=004dd033, driver=Atheros AR8216/AR8236/AR8316]
[    5.573941] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:RGMII
[    5.648738] NET: Registered protocol family 10
[    5.705612] Segment Routing with IPv6
[    5.749581] NET: Registered protocol family 17
[    5.803101] 8021q: 802.1Q VLAN Support v1.8
[    5.887862] Freeing unused kernel memory: 6636K
[    5.942052] This architecture does not have kernel memory protection.
[    6.033021] init: Console is alive
[    6.074051] init: - watchdog -
[    6.133277] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    6.226155] usbcore: registered new interface driver usbfs
[    6.291914] usbcore: registered new interface driver hub
[    6.355576] usbcore: registered new device driver usb
[    6.421983] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    6.501921] ehci-platform: EHCI generic platform driver
[    6.564700] ehci-platform 1b000000.usb: EHCI Host Controller
[    6.632465] ehci-platform 1b000000.usb: new USB bus registered, assigned bus number 1
[    6.726196] ehci-platform 1b000000.usb: irq 3, io mem 0x1b000000
[    6.808294] random: fast init done
[    6.849004] ehci-platform 1b000000.usb: USB 2.0 started, EHCI 1.00
[    6.923905] hub 1-0:1.0: USB hub found
[    6.969235] hub 1-0:1.0: 1 port detected
[    7.017730] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    7.114610] init: - preinit -
[    7.377286] random: jshn: uninitialized urandom read (4 bytes read)
[    7.452330] usb 1-1: new full-speed USB device number 2 using ehci-platform
[    7.625942] random: jshn: uninitialized urandom read (4 bytes read)
[    7.817234] usb 1-1: not running at top speed; connect to a high speed hub
[    7.986097] random: procd: uninitialized urandom read (4 bytes read)
[    8.062591] hub 1-1:1.0: USB hub found
[    8.139744] hub 1-1:1.0: 4 ports detected
[    8.414445] urandom_read: 3 callbacks suppressed
[    8.414454] random: jshn: uninitialized urandom read (4 bytes read)
[    8.640209] random: jshn: uninitialized urandom read (4 bytes read)
[    9.470671] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    9.540580] IPv6: ADDRCONF(NETDEV_UP): eth0.1: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   10.615361] eth0: link up (1000Mbps/Full duplex)
[   10.670697] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   10.748330] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[   12.923277] procd: - early -
[   12.958749] procd: - watchdog -
[   13.550005] procd: - watchdog -
[   13.587873] procd: - ubus -
[   13.629078] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.706349] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.783980] procd: - init -
[   13.817433] eth0: link down
Please press Enter to activate this console.
[   14.041652] kmodloader: loading kernel modules from /etc/modules.d/*
[   14.122269] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   14.197561] Loading modules backported from Linux version v4.19.7-0-g61c68f2a2af0
[   14.287162] Backport generated by backports.git v4.19.7-1-0-g148b072d
[   14.367119] ip_tables: (C) 2000-2006 Netfilter Core Team
[   14.439140] nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
[   14.568639] xt_time: kernel timezone is -0000
[   14.676786] PPP generic driver version 2.4.2
[   14.730501] NET: Registered protocol family 24
[   14.843628] ieee80211 phy0: Atheros AR9340 Rev:1 mem=0xb8100000, irq=11
[   14.926810] ath9k 0000:00:00.0: Direct firmware load for ath9k-eeprom-pci-0000:00:00.0.bin failed with error -2
[   15.047604] ath9k 0000:00:00.0: Falling back to user helper
[   15.539837] ieee80211 phy1: Atheros AR9300 Rev:3 mem=0xb0000000, irq=13
[   15.724512] kmodloader: done loading kernel modules from /etc/modules.d/*
[   26.224778] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   26.295920] eth0: link up (1000Mbps/Full duplex)
[   26.494156] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   26.595542] br-lan: port 1(eth0.1) entered blocking state
[   26.660149] br-lan: port 1(eth0.1) entered disabled state
[   26.725018] device eth0.1 entered promiscuous mode
[   26.782318] device eth0 entered promiscuous mode
[   27.164199] br-lan: port 1(eth0.1) entered blocking state
[   27.228780] br-lan: port 1(eth0.1) entered forwarding state
[   27.295623] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   27.368038] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[  121.754589] random: crng init done



BusyBox v1.29.3 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r0+8793-f2032c0977
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# 

WR8750Nメモ (2)

data format in NEC firmware

     |  0x0 - 0x3  |  0x4 - 0x7  |  0x8 - 0xB  |  0xC - 0xF  |
     +-------------+-------------+-------------+-------------+
 0x0 |  Data Flag  | Data Length | Data Offset |   checksum  |
     +-------------+-------------+-------------+-------------+
0x10 |  Load Addr  | Entry Point |           Data            |
     +-------------+-------------+---------------------------+
0x20 |                         Data                          |
     +-------------+-------------+---------------------------+
...

Note: checksumは上位2 byteのみ、下位2 byteは0埋め

例 (initramfs + loader, LOADER_TYPE := gz):

     |  0x0 - 0x3  |  0x4 - 0x7  |  0x8 - 0xB  |  0xC - 0xF  |
     +-------------+-------------+-------------+-------------+
 0x0 |  8002 7FFD  |  0035 8260  |  0000 0018  |  B002 0000  |
     +-------------+-------------+-------------+-------------+
0x10 |  8006 0000  |  8006 0000  |  1F8B 0800     0000 0000  |
     +-------------+-------------+---------------------------+
0x20 |  0203 8CB8     0550 5D4D     B726 7C70     7709 EEEE  |
     +-------------+-------------+---------------------------+
...

https://qiita.com/yamori813/items/8dccf20843f31c57ccd3

“Data Flag” in data header

|  0x0 - 0x1  |  0x2 - 0x3  |
+-------------+-------------+
|     Flag    |  NOT(Flag)  |
+-------------+-------------+

loader-kernel の LOADER_TYPE は bin/gzip どちらも下記を適切に記述すると Loader は起動できる

bin gzip
0x0 – 0x1 0x2 – 0x3 0x0 – 0x1 0x2 – 0x3
0x0002 0xFFFD 0x8002 0x7FFD

WR8750Nメモ

  • WR8750NからOpenWrtのKernel Loaderが実行できるところまで行った
  • Kernel LoaderがLZMAを展開中(または展開直後)に例外吐いてhard resetが掛かる
  • データのchecksum算出方法は依然として謎
    • data length値(hex)が2byteに収まる場合単純なIPヘッダチェックサムと同じ算出方法、2byteを超える場合は計算方法に何らかの変化が生じる模様
    • checksum算出範囲: data length~data lengthに示すdata終端

コード

devadd/wr8750n – musashino-build/openwrt

イメージ生成コード
plain.binは作業用の仮のモノ。

define Device/nec_wr8750n
  ATH_SOC := ar9344
  DEVICE_TITLE := NEC Aterm WR8750N
  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel
  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel
  LOADER_TYPE := bin
  IMAGES += plain.bin
  IMAGE/plain.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
    append-rootfs | pad-rootfs
  DEVICE_PACKAGES := kmod-usb-core kmod-usb2
endef
TARGET_DEVICES += nec_wr8750n

エラー

boot> start tftp load openwrt-ath79-generic-nec_wr8750
end tftp load length = 3505264
start memory load ... 
memory load complete
  begin  : 0x80060000
  length : 3505240
  startup: 0x80060000
boot
begin  : 0x80060000
length : 3505240
startup: 0x80060000
option: 0x0


OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos 
Decompressing kernel... 
                       @

exception!!
ExcCode:10 "Reserved instruction exception"

afbf001c (param1) 0c01ff11 (param2) 00402025 (param3) 
8fbf001c (param4) 03e00008 (errno) 40008028 (cause) 
27bdffe0 (ctx) 00003825 (fpcsr) 6c0d1a80 (badvaddr) 
afa00014 (pad) 10004002 (sr) 80a00c10 (epc) 
00000001 (lo) 00000000 (hi) 
00000000 (zero) a0080000 (at) 80ab1a80 (v0) 80a00d80 (v1) 
ffffffe0 (a0) 80a01510 (a1) 00000001 (a2) 80a01511 (a3) 
80a00258 (t0) 0000000a (t1) 80a015fd (t2) 00a51a9e (t3) 
00000000 (t4) 01000000 (t5) 80d59c04 (t6) 80a0028c (t7) 
80a00900 (s0) 80060000 (s1) 0000030d (s2) 005f0e3f (s3) 
00000001 (s4) 2cfa97a1 (s5) 80d5a930 (s6) 00000010 (s7) 
00000035 (t8) 80a00120 (t9) 00000028 (k0) 0000007c (k1) 
e087c52b (gp) 80d59c00 (sp) 00000001 (fp) 80a00bec (ra) 

call trace
pc: 80a00c10



IPL:HARD-RESET
(以降通常のブートシーケンス)

手順

※Windows使用する場合。

  • WR8750Nをブート
  • ESC連打でブートを止める
  • Bootloaderのコンソールに入る
  • tftpd 実行
  • Windows側で tftp -i 192.168.0.1 PUT filename
    (Windowsのpublicファイアウォールは切るかtftpポートを開ける)
  • WR8750N側でロードされる
  • boot 実行