OpenWrt Forum Archive

Topic: Flashing OpenWRT onto HornetUB2 16MB/64MB- WORKING! See bottom post.

The content of this topic has been archived on 19 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Well, I got the new HornetUB2.
The instructions for flashing on the wiki aren't working. (http://wiki.openwrt.org/toh/alfa.network/hornet-ub?s[]=hornet)
I'm trying to dissect why certain memory ranges are chosen to correctly adjust them for this newer board.

So first we see

tftp 0xa0800000 openwrt-ar71xx-generic-hornet-ub-jffs2-sysupgrade.bin

0xa0800000 seems to be just blank space suitable for temporary storage. This address is notably different from the one describe on ALFA's instructions: http://www.alfa.com.tw/press_c_show.php?sn=4

 
tftp 0x80600000 kernel.bin

Now I've had ALFAs instructions work on the 8MB/32MB version, but I've never tried OpenWRT's method with the sysupgrade file.
Anyways, the conclusion I've reached, assuming OpenWRTs instructions are correct, is that it's just extra space and not a big deal. OpenWRT is just further along the memory pool.

So, we first copy the firmware to a temporary place, is the address at 0xa0800000 going to be far enough in the memory pool to avoid overwriting necessary files? I don't know! I can't figure out how they even chose that address to begin with besides just choosing one far enough away from the flash to enter the ram. So lets think here, assuming it starts at 0x0, that address is 2692743168 bytes away from the start. That works out to exactly 2568MB...um...no...something is wrong here.
Ok so maybe it's in bits and not bytes, leaves us at 321MB, nope...

Soooo, OK, maybe we don't start with 0x0? Let's look at the 8MB U-Boot output:

U-Boot 1.1.4-g971cc15e-dirty (Sep  7 2011 - 11:44:55)

AP121-8MB (ar9331) U-boot
DRAM:  32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 248k for U-Boot at: 81fc0000
Reserving 192k for malloc() at: 81f90000
Reserving 44 Bytes for Board Info at: 81f8ffd4
Reserving 36 Bytes for Global Data at: 81f8ffb0
Reserving 128k for boot params() at: 81f6ffb0
Stack Pointer at: 81f6ff98
Now running in RAM - U-Boot at: 81fc0000
id read 0x100000ff
flash size 8388608, sector count = 128
Flash:  8 MB
In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1

Please choose the operation:
   1: Entr boot command line interface.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).                                   0


 System Boot system code via Flash.
## Booting image at 9f650000 ...
   Image Name:   MIPS OpenWrt Linux-3.10.49
   Created:      2014-10-09  15:29:28 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1057290 Bytes =  1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f650040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 33554432

Starting kernel ...

Ah ha! I see top of RAM starts at 82000000
Let's do a quick test, from the top of usable ram 82000000 minus the start of the reservation 81fc0000 we get 256KB (or 40000 in hex)
Hmmm, so sounds like our math is right, that's common amount of memory, so it's our starting location that is off.

So let's check the temporary storage address in relation to 82000000 which is the top of the usable ram for U-Boot:
a0800000  - 82000000 = 488MB....nope...ok...so that 256 could have just been a coincidence...

I'm pretty damn sure I'm doing something completely wrong here. I'm going to do some research on memory address calculations.

Any help on this would be greatly appreciated. I'll continue to post as I try to figure this out, I wish ALFA would have posted why they chose these addresses instead of just posting the instructions.

(Last edited by jivex5k on 11 Oct 2014, 01:25)

Alright it turns out I'm reading these addresses completely wrong.

Just to make things difficult, memory addresses are normally written not as one but as two hex numbers. Eg: 0x9FFF:000F. On the left of the colon is the Segment part, and on the right is the Offset part.

So I found this cheeky description here. Update incoming.

Ok so let's get the real values of the ranges now:

We will begin with the start of the RAM usable for U-Boot:

8200 0000 (ok now shift this left by appending the first number in the last four digits to the end of the first four digits.
82000 (now we add the offset, or last four digits to this)
+0000 
82000 is what we get here.

Let's do the same for the start of the U-Boot memory

81fc 0000 (we do the same as above, since the offset is all 0 this one is easy)
81fc0 is what we get here

So now we have addresses we can do math with. So we do 82000 - 81fc0 = 40.
We convert 40 to decimal: 64 bytes
So there should be 64 bytes between these 2 addresses.
Hmmm. Doesn't really make sense to me considering the startup says we have 248k reserved for u-boot starting at 81fc 0000.

Well...hmmm...let's try figuring out why alfa chose the address they did for temporary storage.
So they use address 0x80600000, or 8060 0000, or 80600 for calculating size between ranges.
OK, well this address is in front of the U-Boot which begins at 81fc 0000 , so lets see how much space they put in between this.

81FC0
-
80600
=
6592 bytes....uhhhh....this seems really wrong considering the rootfs.bin is 2347012 bytes. Won't this overwrite the U-Boot? Maybe it's supposed to?

Another interesting thing I found was this:

 cp.b 0x80600000 0x9f650000 d695a 

This is the command to copy the memory at 8060 0000 to 9f65 0000 with a size of d695a. This specific command is transferring the kernel.bin file, which is that exact file size.
Well, I found this in the booting information of the hornet:

 System Boot system code via Flash.
## Booting image at 9f650000 ...
   Image Name:   MIPS OpenWrt Linux-3.10.49
   Created:      2014-10-09  15:29:28 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1057290 Bytes =  1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f650040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 33554432

There's the address referenced 9f650000. OK cool, makes sense, we copy the kernel.bin to that location. The load address looks similar but it isn't the same so don't be mistaken: 8006 0000 = Load Point / 8060 0000 = temporary storage, notice the shifted 0. The temp storage is after the load point.

So what address is referenced in the 16MB/64MB hornet?

## Booting image at 9fe50000 ...
   Image Name:   Linux Kernel Image
   Created:      2013-04-25   6:01:19 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    772455 Bytes = 754.4 kB
   Load Address: 80002000
   Entry Point:  8019c240
   Verifying Checksum at 0x9fe50040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8019c240) ...
## Giving linux memsize in bytes, 67108864

Ah ha! 9fe5 0000
So theoretically this is where we want to copy our kernel.bin. However, this is assuming the address is hardcoded into u-boot.
At least we have a connection at this point. So we could find the file size of our new kernel.bin which is built compiled with the UB2 (aka 64/16MB hornet) profile selected in the make menuconfig of openwrt, and then follow the same format ALFA described with the right numbers.

In my specific case my custom kernel.bin is 1,114,112 bytes, so we convert to hex and get 110000.
So lets look at the steps required to get this far:

The first thing ALFA does is

setenv bootargs “board=ALFA console=ttyATH0,115200 rootfstype=squashfs,jffs2 
noinitrd”
saveenv 

Well, that's a problem. We have no saveenv on this U-Boot.

 ar7240> saveenv
Unknown command 'saveenv' - try 'help'

Well...crap...so...let's see what is hardcoded in it.

ar7240> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),14336k(rootfs),1600k(uImage),64k(NVRAM),64k(ART) REVISIONID

Wow...that's a lot different, and we can't even change it with setenv. Well, we can, but it just goes back to the above value upon restarting.

Hmmm....well I made this kernel.bin, and I only specified squashFS as the filesystem target, you know what, I'm going to try to flash it anyways and leave the current FS intact. As long as I don't screw up U-Boot I should be fine.

Anyway, let's check out the next command

 tftp 0x80600000 kernel.bin

OK, this we can do, but the address leaves me a bit worried about uboot. So let's use openwrt's suggested address for this, which is well past any possible uboot files.

 tftp 0xa0800000 

So the next step ALFA lists is:

erase 0x9f650000 +0x190000 

This will erase 1.56mb of space? Maybe? Probably not.

The OpenWRT instructions say:

erase 0x9f050000 +0x790000
Erase Flash from 0x9f050000 to 0x9f7dffff in Bank # 1
First 0x5 last 0x7d sector size 0x10000
 125
Erased 121 sectors

So...Hmmm
Interesting that they erase where ALFA instructs to erase for the rootfs:

erase 0x9f050000 +0x600000

Also they are using a sysupgrade.bin file instead of the rootfs and kernel.bin

Man....I feel like I'm close yet so far off with calculating this stuff....
Why does OpenWRT use systemupgrade.bin and not rootfs/kernel?
Why does OpenWRT suggest temporary storage at such a different location than ALFA?

I hope someone can clear things up. I just want to get OpenWRT on my new HornetUB2, I mean the profile is listed in the menuconfig, someone's done it right?
I found a post somewhere saying we need a newer linux kernel to get openwrt to work, he links it, but doesn't describe the process of flashing it. http://en.data-alliance.net/hornet-ub-64mb/
I messaged George about it, maybe he will get back to me.

I found another tutorial on getting FreeBSD on this version (https://code.google.com/p/freebsd-wifi- … _Hornet_UB)
So I can assume according to that it's safe to erase: 0x9f050000 +0xd90000
Temp storage at: 0x80050000

Yet he copies nothing to the address 9fe50000, instead putting the kernel here: 0x9f050000, and the rootfs here: 0x9f1e0000
He is also using uImage files and not bin files....

Any clarification on how these values were ascertained for the hornetUB 8MB/32MB version would be extremely helpful.
Instructions on flashing this to the UB2 16MB/64MB board would be awesome, I haven't found any, honestly though I'd really like to know how they figured it out.

I'm probably making a bunch of mistakes in my memory range calculations. Even clarification in that would be helpful. I'm not entirely comfortable just starting and testing commands to see if it works at this low level, if I overwrite U-Boot it will brick the system AFAIK.

So thanks for advance, sorry for the long ass post, and I hope someone can help me figure this out. I'll keep on researching in the meantime.

(Last edited by jivex5k on 10 Oct 2014, 21:05)

OK I took a leap of faith and tried some stuff, none of which worked. Read some stuff here: https://dev.openwrt.org/ticket/10830
So let's start by simplifying this all.

HornetUB method confirmed to work:
http://downloads.openwrt.org/attitude_a … pgrade.bin

setenv serverip 192.168.1.254; setenv ipaddr 192.168.1.
tftp 0xa0800000 openwrt-ar71xx-generic-hornet-ub-jffs2-sysupgrade.bin
erase 0x9f050000 +0x790000
cp.b 0xa0800000 0x9f050000 0x790000

This doesn't work on HornetUB2

No filesystem could mount root, tried:  squashfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)

I assume it's because the address is wrong, as it is still booting the factory linux kernel this thing shipped with. (not openWRT)

## Booting image at 9fe50000 ...
   Image Name:   Linux Kernel Image
   Created:      2013-04-25   6:01:19 UTC

Ok fine, I see a sysupgrade version in 14.07 specifically for UB2.
http://downloads.openwrt.org/barrier_br … pgrade.bin
The filesize is way off though, this one is 3.2MB, other was 7.1MB, let's try it anyway using the exact same commands above but with this new file.

Nope, didn't work, same as above, same old kernel, same error message. So obviously this address is wrong, and maybe we can't even use this sysupgrade file for it. But I do see a rootfs and kernel file for this:
http://downloads.openwrt.org/barrier_br … kernel.bin
http://downloads.openwrt.org/barrier_br … uashfs.bin

In this case we would need to follow ALFA's instructions, ignoring setting the bootargs environment values.

tftp 0x80600000 kernel.bin
erase 0x9f650000 +0x190000
cp.b 0x80600000 0x9f650000 d695a

tftp 0x80600000 rootfs.bin 
erase 0x9f050000 +0x600000
cp.b 0x80600000 0x9f050000 23d004

Now why on earth are they using that format for filesize? According to the openwrt ticket we can simple use 0x190000 and 0x9f050000. How are those even related to d695a and 23d004? And what's with the different temp address? Also notice the rootfs starts at the same address listed in the OpenWRT method. Well, let's try it with this method regardless, substituting the actual file size instead of d695a and 23d004.

ar7240> setenv ipaddr 192.168.100.184; setenv serverip 192.168.100.182
ar7240> tftp 0x80600000 kernel.bin
eth0 link down
FAIL
dup 1 speed 1000
Using eth1 device
TFTP from server 192.168.100.182; our IP address is 192.168.100.184
Filename 'kernel.bin'.
Load address: 0x80600000
Loading: #################################################################
         #################################################################
         #################################################################
         #######################
done
Bytes transferred = 1114112 (110000 hex)
ar7240> erase 0x9f650000 +0x190000
Erase Flash from 0x9f650000 to 0x9f7dffff in Bank # 1
First 0x65 last 0x7d sector size 0x10000                                     125
Erased 25 sectors
ar7240> cp.b 0x80600000 0x9f650000 110000
Copy to Flash... write addr: 9f650000
done
ar7240> tftp 0x80600000 rootfs.bin
dup 1 speed 100
Using eth0 device
TFTP from server 192.168.100.182; our IP address is 192.168.100.184
Filename 'rootfs.bin'.
Load address: 0x80600000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######
done
Bytes transferred = 2359296 (240000 hex)
ar7240> erase 0x9f050000 +0x600000
Erase Flash from 0x9f050000 to 0x9f64ffff in Bank # 1
First 0x5 last 0x64 sector size 0x10000                                      100
Erased 96 sectors
ar7240> cp.b 0x80600000 0x9f050000 240000
Copy to Flash... write addr: 9f050000

Nope, same damn kernel. So my address ranges gotta be off. What I need to figure out is:
1. What memory address does the rootfs start at.
2. How much space to erase after that. Presumably it's the file size, but I don't see how 23d004 = 0x600000 in ALFAs instructions.

If I figure out 2, I can do the same for the kernel.bin which starts at 9fe50000 in the hornetub2.

Can somebody help me understand this? And if on the UB the rootfs starts at 0x9f050000 and the kernel starts at 0x9f650000, how can I figure out where the UB2 rootFS should start, is it even the same amount of space???

I'm pretty much stuck at this point...

(Last edited by jivex5k on 10 Oct 2014, 23:56)

Holy crap, I got it to work with some help.
The rootFS stays in the same place, however the kernel starts at a completely new place.
We must also change the erase amount to erase everything from the beginning of rootfs until the beginning of the new kernel address.

This is using these two files:
http://downloads.openwrt.org/barrier_br … kernel.bin
http://downloads.openwrt.org/barrier_br … uashfs.bin
I renamed them to kernel.bin and rootfs.bin for simplicity.

Here's a quick and dirty log, I'll update this later to clean it up and detail a method.

AP121 (ar9331) U-boot

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 149k for U-Boot at: 83fd8000
Reserving 192k for malloc() at: 83fa8000
Reserving 44 Bytes for Board Info at: 83fa7fd4
Reserving 36 Bytes for Global Data at: 83fa7fb0
Reserving 128k for boot params() at: 83f87fb0
Stack Pointer at: 83f87f98
Now running in RAM - U-Boot at: 83fd8000
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16777216, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
Fetching MAC Address from 0x83ff0608
Fetching MAC Address from 0x83ff0608
: cfg1 0x5 cfg2 0x7114
eth0: 00:c0:ca:7e:7c:a5
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:c0:ca:7e:7c:a4
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Hit any key to stop autoboot:  0
ar7240> setenv ipaddr 192.168.100.184; setenv serverip 192.168.100.182
ar7240> tftp 0x80600000 kernel.bin
eth0 link down
FAIL
dup 1 speed 1000
Using eth1 device
TFTP from server 192.168.100.182; our IP address is 192.168.100.184
Filename 'kernel.bin'.
Load address: 0x80600000
Loading: #################################################################
         #################################################################
         #################################################################
         #######################
done
Bytes transferred = 1114112 (110000 hex)
ar7240> erase 0x9fe50000 +0x190000
Bad address format
ar7240>
Unknown command '' - try 'help'
ar7240> erase 0x9fe50000 +0x190000
Erase Flash from 0x9fe50000 to 0x9ffdffff in Bank # 1
First 0xe5 last 0xfd sector size 0x10000                                     253
Erased 25 sectors
ar7240> cp.b 0x80600000 0x9fe50000 <INTERRUPT>
ar7240> cp.b 0x80600000 0x9fe50000 110000
Copy to Flash... write addr: 9fe50000
done
ar7240> tftp 0x80600000 rootfs.bin
dup 1 speed 100
Using eth0 device
TFTP from server 192.168.100.182; our IP address is 192.168.100.184
Filename 'rootfs.bin'.
Load address: 0x80600000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######
done
Bytes transferred = 2359296 (240000 hex)
ar7240> erase 0x9f050000 +0xE00000
Erase Flash from 0x9f050000 to 0x9fe4ffff in Bank # 1
First 0x5 last 0xe4 sector size 0x10000                                      228
Erased 224 sectors
ar7240> cp.b 0x80600000 0x9f050000 240000
Copy to Flash... write addr: 9f050000
done
ar7240> ▒

U-Boot 1.1.4 (Apr 25 2013 - 14:01:10)

AP121 (ar9331) U-boot

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 149k for U-Boot at: 83fd8000
Reserving 192k for malloc() at: 83fa8000
Reserving 44 Bytes for Board Info at: 83fa7fd4
Reserving 36 Bytes for Global Data at: 83fa7fb0
Reserving 128k for boot params() at: 83f87fb0
Stack Pointer at: 83f87f98
Now running in RAM - U-Boot at: 83fd8000
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16777216, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
Fetching MAC Address from 0x83ff0608
Fetching MAC Address from 0x83ff0608
: cfg1 0x5 cfg2 0x7114
eth0: 00:c0:ca:7e:7c:a5
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:c0:ca:7e:7c:a4
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Hit any key to stop autoboot:  0
## Booting image at 9fe50000 ...
   Image Name:   MIPS OpenWrt Linux-3.10.49
   Created:      2014-10-02   6:57:00 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1107111 Bytes =  1.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9fe50040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

[    0.000000] Linux version 3.10.49 (bb@builder1) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r42625) ) #3 Wed Oct 1 14:00:51 CEST 2014
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR9330 rev 1
[    0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:25.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  board=HORNET-UB console=ttyATH0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,15936k(firmware),64k(nvram),64k(art)ro rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 61076k/65536k available (2369k kernel code, 4460k reserved, 621k data, 272k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
[    0.080000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 512
[    0.090000] NET: Registered protocol family 16
[    0.100000] MIPS: machine is ALFA NETWORK Hornet-UB
[    0.550000] bio: create slab <bio-0> at 0
[    0.560000] Switching to clocksource MIPS
[    0.570000] NET: Registered protocol family 2
[    0.570000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.570000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.570000] TCP: Hash tables configured (established 512 bind 512)
[    0.580000] TCP: reno registered
[    0.580000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.590000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.600000] NET: Registered protocol family 1
[    0.620000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.630000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.640000] msgmni has been set to 119
[    0.640000] io scheduler noop registered
[    0.640000] io scheduler deadline registered (default)
[    0.650000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.660000] ar933x-uart: ttyATH0 at MMIO 0x18020000 (irq = 11) is a AR933X UART
[    0.670000] console [ttyATH0] enabled, bootconsole disabled
[    0.670000] console [ttyATH0] enabled, bootconsole disabled
[    0.680000] ath79-spi ath79-spi: master is unqueued, this is deprecated
[    0.690000] m25p80 spi0.0: found mx25l12805d, expected m25p80
[    0.690000] m25p80 spi0.0: mx25l12805d (16384 Kbytes)
[    0.700000] 5 cmdlinepart partitions found on MTD device spi0.0
[    0.700000] Creating 5 MTD partitions on "spi0.0":
[    0.710000] 0x000000000000-0x000000040000 : "u-boot"
[    0.720000] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.720000] 0x000000050000-0x000000fe0000 : "firmware"
[    0.760000] 2 uimage-fw partitions found on MTD device firmware
[    0.760000] 0x000000050000-0x000000e50000 : "rootfs"
[    0.770000] mtd: device 3 (rootfs) set to be root filesystem
[    0.770000] 1 squashfs-split partitions found on MTD device rootfs
[    0.780000] 0x000000270000-0x000000e50000 : "rootfs_data"
[    0.790000] 0x000000e50000-0x000000f5e4e7 : "kernel"
[    0.790000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.800000] 0x000000fe0000-0x000000ff0000 : "nvram"
[    0.810000] 0x000000ff0000-0x000001000000 : "art"
[    0.830000] libphy: ag71xx_mdio: probed
[    1.380000] ag71xx-mdio.1: Found an AR7240/AR9330 built-in switch
[    2.420000] eth0: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[    2.970000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd041, driver=Generic PHY]
[    2.980000] eth1: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[    2.990000] TCP: cubic registered
[    2.990000] NET: Registered protocol family 17
[    3.000000] Bridge firewalling registered
[    3.000000] 8021q: 802.1Q VLAN Support v1.8
[    3.010000] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[    3.020000] Freeing unused kernel memory: 272K (8034c000 - 80390000)
procd: Console is alive
procd: - watchdog -
[    5.910000] usbcore: registered new interface driver usbfs
[    5.910000] usbcore: registered new interface driver hub
[    5.920000] usbcore: registered new device driver usb
[    5.930000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    5.930000] ehci-platform: EHCI generic platform driver
[    5.940000] ehci-platform ehci-platform: EHCI Host Controller
[    5.940000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
[    5.950000] ehci-platform ehci-platform: irq 3, io mem 0x1b000000
[    5.980000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
[    5.980000] hub 1-0:1.0: USB hub found
[    5.980000] hub 1-0:1.0: 1 port detected
procd: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
jffs2 is not ready - marker found
procd: - early -
procd: - watchdog -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
[   12.480000] NET: Registered protocol family 10
[   12.510000] nf_conntrack version 0.5.0 (958 buckets, 3832 max)
[   12.520000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   12.530000] Loading modules backported from Linux version master-2014-05-22-0-gf2032ea
[   12.540000] Backport generated by backports.git backports-20140320-37-g5c33da0
[   12.550000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   12.610000] xt_time: kernel timezone is -0000
[   12.640000] cfg80211: Calling CRDA to update world regulatory domain
[   12.640000] cfg80211: World regulatory domain updated:
[   12.650000] cfg80211:  DFS Master region: unset
[   12.650000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   12.660000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   12.670000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   12.680000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   12.680000] cfg80211:   (5170000 KHz - 5250000 KHz @ 160000 KHz), (N/A, 2000 mBm), (N/A)
[   12.690000] cfg80211:   (5250000 KHz - 5330000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   12.700000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   12.710000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   12.720000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   12.800000] PPP generic driver version 2.4.2
[   12.800000] NET: Registered protocol family 24
[   12.890000] ieee80211 phy0: Atheros AR9330 Rev:1 mem=0xb8100000, irq=2
[   12.900000] cfg80211: Calling CRDA for country: US
[   12.900000] cfg80211: Regulatory domain changed to country: US
[   12.910000] cfg80211:  DFS Master region: FCC
[   12.910000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   12.920000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 3000 mBm), (N/A)
[   12.930000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 1700 mBm), (N/A)
[   12.940000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz), (N/A, 2300 mBm), (0 s)
[   12.940000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 3000 mBm), (N/A)
[   12.950000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 4000 mBm), (N/A)
[   21.650000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   21.650000] jffs2_build_filesystem(): unlocking the mtd device... done.
[   21.660000] jffs2_build_filesystem(): erasing all blocks after the end marker... [   26.750000] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   26.750000] device eth0 entered promiscuous mode
[   26.780000] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   26.830000] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
[   29.290000] eth1: link up (100Mbps/Full duplex)
[   29.290000] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
done.
[   86.820000] jffs2: notice: (917) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
procd: - init complete -



BusyBox v1.22.1 (2014-09-20 22:01:35 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 BARRIER BREAKER (14.07, r42625)
 -----------------------------------------------------
  * 1/2 oz Galliano         Pour all ingredients into
  * 4 oz cold Coffee        an irish coffee mug filled
  * 1 1/2 oz Dark Rum       with crushed ice. Stir.
  * 2 tsp. Creme de Cacao
 -----------------------------------------------------
root@OpenWrt:/# df
Filesystem           1K-blocks      Used Available Use% Mounted on
rootfs                   12160       472     11688   4% /
/dev/root                 2304      2304         0 100% /rom
tmpfs                    30672        64     30608   0% /tmp
tmpfs                    30672        44     30628   0% /tmp/root
tmpfs                      512         0       512   0% /dev
/dev/mtdblock4           12160       472     11688   4% /overlay
overlayfs:/overlay       12160       472     11688   4% /
root@OpenWrt:/# 

(Last edited by jivex5k on 11 Oct 2014, 01:03)

Hi Jivex5k,

Sorry to bump old topic. I've a device with similar hardware and more or less in similar situation like you use to be when you started with your device.

I've tried changing the firmware and looks like I'm missing the memory addresses or something with Uboot. After 2 attemps I'm now stuck at BAD MAGIC NUMBER 1 error.

If you got time and interested then please let me know I'll share more details.

PS: Also I'm gonna post separate topic on my device and will see if anyone joins me.

Thanks

The discussion might have continued from here.