OpenWrt Forum Archive

Topic: Bootloader/Image for a DLink DWL-2100AP

The content of this topic has been archived between 26 Mar 2018 and 5 May 2018. Unfortunately there are posts – most likely complete pages – missing.

Post #26
bitbucket
2 Apr 2007, 12:59
ramponis wrote:

I have tried to reflash the 2100AP bootloader

But i receive an error.
The chip flash is not recognized.
My 2100AP have an ATMEL AT49BV322A

What's wrong?

It is "hello" from atheros: you need to load definition file for this cpu and setup flash controller:

jtag> cable parallel 0x378 WIGGLER
jtag> detect
jtag> include atheros/ar2312/ar2312
jtag> poke 0x58400000 0x000e3ce1
jtag> detectflash 0x1fc00000
Post #27
ramponis
2 Apr 2007, 13:43

I'm wrong.

The flash was recognized, but i can't flash it

I have done the commands correctly.

You can see it in my log 

jtag> cable parallel 0x378 DLC5
jtag> detect
jtag> include atheros/ar2312/ar2312
jtag> poke 0x58400000 0x000e3ce1
jtag> detectflash 0x1fc00000

But when i try to flash....

jtag> flashmem 0x1fc00000 boot.bin
Chip: AMD Flash
        Manufacturer: Unknown manufacturer (ID 0x0000)
        Chip: Unknown (ID 0x0000)
        Protected: 0001
program:
flash_unlock_block 0x1FC00000 IGNORE

block 0 unlocked
flash_erase_block 0x1FC00000
flash_erase_block 0x1FC00000 FAILED
erasing block 0: 99
addr: 0x1FC00000
flash error
jtag>

It can't erase the falsh

(Last edited by ramponis on 2 Apr 2007, 13:44)

Post #28
bitbucket
3 Apr 2007, 08:41
ramponis wrote:
jtag> cable parallel 0x378 DLC5

I don't know, will it works with DLC5. Try to erase/detect flash by hands (with OCD Commander, may be), dont forget enable flash in flash controller.

PS: What jtad said when you issue 'detect' after loading definition file ?

Post #29
ramponis
3 Apr 2007, 09:18

Now i have build a WIGGLER (not buffered) cable.

But i have tha same problem, i can read but i can not erase and/or write.

Try to erase/detect flash by hands (with OCD Commander, may be), dont forget enable flash in flash controller.

Can you tell me the settings of the connection in OCD?
Target processor?

Can you describe me the procedure with OCD Commander?
Can you tell me how to enable flash in flash controller?

Thank you

Post #30
bitbucket
3 Apr 2007, 13:41
ramponis wrote:

Now i have build a WIGGLER (not buffered) cable.

But i have tha same problem, i can read but i can not erase and/or write.

Try to erase sector by hands from OCD Commander

Target processor?

MIPS, of course. 4KE or 5KC.

ramponis wrote:

Can you describe me the procedure with OCD Commander?
Can you tell me how to enable flash in flash controller?

Erase 1st secrot code from OCD Commander:

long 0xb8400000 = 0x000e3ce1
byte 0x1fc00aaa = 0xaa
byte 0x1fc00555 = 0x55
byte 0x1fc00aaa = 0x80
byte 0x1fc00aaa = 0xaa
byte 0x1fc00555 = 0x55
byte 0x1fc08000 = 0x30

1st line enables flash controller.

I use this script to initialize jtag and to access flash.

cable parallel 0x378 WIGGLER
detect
include atheros/ar2312/ar2312
poke 0x58400000 0x000e3ce1
detectflash 0x1fc00000

Result:

jtag> include aths
Initializing Macraigor Wiggler JTAG Cable on parallel port at 0x378
IR length: 5
Chain length: 1
Device Id: 00000000000000000000000000000001
  Unknown manufacturer!
chain.c(110) Part 0 without active instruction
chain.c(133) Part 0 without active instruction
chain.c(110) Part 0 without active instruction
ImpCode=01000000010000000100000000000000
EJTAG version: 2.6
EJTAG Implementation flags: R4k ASID_8 NoDMA MIPS32
Query identification string:
        Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set)
        Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
Query system interface information:
        Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
        Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
        Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV
        Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV
        Typical timeout per single byte/word program: 128 us
        Typical timeout for maximum-size multi-byte program: 128 us
        Typical timeout per individual block erase: 1024 ms
        Typical timeout for full chip erase: 0 ms
        Maximum timeout for byte/word program: 256 us
        Maximum timeout for multi-byte program: 4096 us
        Maximum timeout per individual block erase: 16384 ms
        Maximum timeout for chip erase: 0 ms
Device geometry definition:
        Device Size: 4194304 B (4096 KiB, 4 MiB)
        Flash Device Interface Code description: 0x0002 (x8/x16)
        Maximum number of bytes in multi-byte program: 32
        Number of Erase Block Regions within device: 2
        Erase Block Region Information:
                Region 0:
                        Erase Block Size: 8192 B (8 KiB)
                        Number of Erase Blocks: 8
                Region 1:
                        Erase Block Size: 65536 B (64 KiB)
                        Number of Erase Blocks: 63
Post #31
ramponis
3 Apr 2007, 14:55

I have done this with OCD

>CPU
PC: 00000002  HI: 00000002  LO: 00000002
LWR $0,  0( $8)
>Reset
>long 0xb8400000 = 0x000e3ce1
>byte 0x1fc00aaa = 0xaa
>byte 0x1fc00555 = 0x55
>byte 0x1fc00aaa = 0x80
>byte 0x1fc00aaa = 0xaa
>byte 0x1fc00555 = 0x55
>byte 0x1fc08000 = 0x30

I have build this script (like yours) to flash the bootloader with openwince JTAG

cable parallel 0x378 WIGGLER
detect
include atheros/ar2312/ar2312
poke 0x58400000 0x000e3ce1
detectflash 0x1fc00000
flashmem 0x1fc00000 boot.bin

The boot.bin file is your bootloader renamed.

This is the result

$ jtag
JTAG Tools 0.6-cvs-20051228
Copyright (C) 2002, 2003 ETC s.r.o.
JTAG Tools is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for JTAG Tools.

Warning: JTAG Tools may damage your hardware! Type "quit" to exit!

Type "help" for help.

jtag> include aths
Initializing Macraigor Wiggler JTAG Cable on parallel port at 0x378
IR length: 5
Chain length: 1
Device Id: 00000000000000000000000000000001
  Unknown manufacturer!
chain.c(110) Part 0 without active instruction
chain.c(133) Part 0 without active instruction
chain.c(110) Part 0 without active instruction
ImpCode=01000000010000000100000000000000
EJTAG version: 2.6
EJTAG Implementation flags: R4k ASID_8 NoDMA MIPS32
Query identification string:
        Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set)
        Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
Query system interface information:
        Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
        Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
        Vpp [Programming] Supply Minimum Write/Erase voltage: 11500 mV
        Vpp [Programming] Supply Maximum Write/Erase voltage: 12500 mV
        Typical timeout per single byte/word program: 16 us
        Typical timeout for maximum-size multi-byte program: 0 us
        Typical timeout per individual block erase: 1024 ms
        Typical timeout for full chip erase: 65536 ms
        Maximum timeout for byte/word program: 256 us
        Maximum timeout for multi-byte program: 0 us
        Maximum timeout per individual block erase: 4096 ms
        Maximum timeout for chip erase: 262144 ms
Device geometry definition:
        Device Size: 4194304 B (4096 KiB, 4 MiB)
        Flash Device Interface Code description: 0x0002 (x8/x16)
        Maximum number of bytes in multi-byte program: 1
        Number of Erase Block Regions within device: 2
        Erase Block Region Information:
                Region 0:
                        Erase Block Size: 65536 B (64 KiB)
                        Number of Erase Blocks: 63
                Region 1:
                        Erase Block Size: 8192 B (8 KiB)
                        Number of Erase Blocks: 8
Chip: AMD Flash
        Manufacturer: Unknown manufacturer (ID 0x0000)
        Chip: Unknown (ID 0x0000)
        Protected: 0001
program:
flash_unlock_block 0x1FC00000 IGNORE

block 0 unlocked
flash_erase_block 0x1FC00000
flash_erase_block 0x1FC00000 FAILED
erasing block 0: 99
addr: 0x1FC00000
flash error
jtag>

All seem to be correct, but it can not flash. Why?

Post #32
bitbucket
4 Apr 2007, 10:32
ramponis wrote:

All seem to be correct, but it can not flash. Why?

You work in 16 or 32 bit mode.

In src/flash.c set 8 bit mode:

static void
set_flash_driver( void )
{
//      int i;
        cfi_query_structure_t *cfi;

        flash_driver = NULL;
        if (cfi_array == NULL)
                return;
        cfi = &cfi_array->cfi_chips[0]->cfi;

#if 0
        for (i = 0; flash_drivers[i] != NULL; i++)
                if (flash_drivers[i]->autodetect( cfi_array )) {
                        flash_driver = flash_drivers[i];
                        flash_driver->print_info( cfi_array );
                        return;
                }

        printf( _("unknown flash - vendor id: %d (0x%04x)\n"),
                cfi->identification_string.pri_id_code,
                cfi->identification_string.pri_id_code );

        printf( _("Flash not supported!\n") );
#endif
  flash_driver=&amd_8_flash_driver;
  flash_driver->print_info( cfi_array );
}
Post #33
ramponis
4 Apr 2007, 15:13

I must modify the flash.c and then...
Do i must reinstall the jtag-0.6-cvs-20051228?

Thank you

Post #34
bitbucket
4 Apr 2007, 15:44
ramponis wrote:

I must modify the flash.c and then...

recompile and use it.

Post #35
ramponis
10 Apr 2007, 14:45
bitbucket wrote:

recompile and use it.

I have tried but with the same result.

I have also tried the jtag-brecis-ok.zip

It recognized the flash but i can only read and i have this error when i try to flash

jtag> flashmem 0x1fc00000 boot.bin
program blocks:
Chip: AMD Flash
        Manufacturer: Atmel
        Chip: AT49BV322A
        Protected: 0090
flash_unlock_block 0x1FC00000 IGNORE
block 0 unlocked
flash_erase_block 0x1FC00000
................................................................................
................................................................................
........................................flash_erase_block 0x1FC00000 FAILED
erasing block 0 to program 8192 bytes, status: 99
flash_unlock_block 0x1FC02000 IGNORE
block 1 unlocked
flash_erase_block 0x1FC02000
................................................................................
................................................................................
........................................flash_erase_block 0x1FC02000 FAILED
erasing block 1 to program 8192 bytes, status: 99
addr: 0x1FC02AC0

Is it possible that this flash is locked and i need to unloack it?

(Last edited by ramponis on 10 Apr 2007, 14:45)

Post #36
bitbucket
10 Apr 2007, 15:11
ramponis wrote:

Is it possible that this flash is locked and i need to unloack it?

If flash erase command works from ocd commander, it have to work and from openwince jtag. Try to erase flash from ocd commander, and programm it form jtag tool.

Post #37
ramponis
10 Apr 2007, 15:29

Can you tell me the correct command to erase the flash?

Thank you

Post #38
bitbucket
10 Apr 2007, 16:24
ramponis wrote:

Can you tell me the correct command to erase the flash?

long 0xb8400000 = 0x000e3ce1
byte 0x1fc00aaa = 0xaa
byte 0x1fc00555 = 0x55
byte 0x1fc00aaa = 0x80
byte 0x1fc00aaa = 0xaa
byte 0x1fc00555 = 0x55
byte 0x1fcXXXXX = 0x30

XXXXX - sector address. Check datasheet for your flash ic to get sectors addrs.

Post #39
ramponis
13 Apr 2007, 15:47

I have flashed my 2100AP successfully!!! big_smile

I have repaired the bootloader of my 2100AP!!!

Now i can try your redboot.

Do you have a compiled openwrt firmware that i can try?

Thank you

Post #40
bitbucket
13 Apr 2007, 18:45
ramponis wrote:

Now i can try your redboot.

Do you have a compiled openwrt firmware that i can try?

No, I have not. OpenWRT use 7z compression, but I have no time now to get compression code to redboot.

Post #41
GoldServe
13 Apr 2007, 19:04

you can use redboot with compress gz. Slightly bigger than the 7z compression.

Post #42
bitbucket
13 Apr 2007, 19:49
GoldServe wrote:

you can use redboot with compress gz. Slightly bigger than the 7z compression.

OpenWRT use 7z compressed kernel. I know, it better.

Try to compile OpenWRT yourself. Wireless is working - you have to modify madwifi : http://madwifi.org/ticket/886 .

Other changes in kernel:
ar5312.c:

 // flash width is 8bit
static struct physmap_flash_data ar5312_flash_data = {
//      .width    = 2, 
        .width    = 1,
};

To make ethernet work I have to switch interrup numbers: vxworks bootloader use ethernet #1, not #0. Without this patch kernel will hang on first incoming ethernet packet.

#if 0
#define AR531X_IRQ_ENET0_INTRS  MIPS_CPU_IRQ_BASE+3 /* C0_CAUSE: 0x0800 */
#define AR531X_IRQ_ENET1_INTRS  MIPS_CPU_IRQ_BASE+4 /* C0_CAUSE: 0x1000 */
#else
#define AR531X_IRQ_ENET0_INTRS  MIPS_CPU_IRQ_BASE+4 /* C0_CAUSE: 0x0800 */
#define AR531X_IRQ_ENET1_INTRS  MIPS_CPU_IRQ_BASE+3 /* C0_CAUSE: 0x1000 */
#endif

That is all I've changed in sources, to make kernel works for me. OpenWRT have to work with these modifications.

Post #43
NZLamb
19 Apr 2007, 11:35
ramponis wrote:

I have flashed my 2100AP successfully!!! big_smile

I have repaired the bootloader of my 2100AP!!!

Which tool did you end up using to flash it?

Post #44
ramponis
19 Apr 2007, 13:22

I have used openwince jtag (brecis_ok)

Post #45
ramponis
4 May 2007, 17:23

Hi bitbucket,

Now i'm able to flash and reflash my 2100AP with no problem.
I have reflashed the full content of the flash of my 2100AP and repair it.
I have try to concatenate the original bootload with your redboot

cat bootloader.bin redboot.z > new-bootloader.bin

Then i have flashed it in to the flash.

flashmem 0x1fc00000 new-bootloader.bin

Then i have restarted the 2100AP but the serial displayed nothing.

What's wrong?

Thank you

(Last edited by ramponis on 4 May 2007, 17:24)

Post #46
bitbucket
4 May 2007, 22:01
ramponis wrote:

Hi bitbucket,

Now i'm able to flash and reflash my 2100AP with no problem.
I have reflashed the full content of the flash of my 2100AP and repair it.
I have try to concatenate the original bootload with your redboot

cat bootloader.bin redboot.z > new-bootloader.bin

Then i have restarted the 2100AP but the serial displayed nothing.

What's wrong?

I don't know, what wrong. 1st stage bootloader (original) writes to console 

ar531x rev 0x00005850 firmware startup...
SDRAM TEST...PASSED

If you flashed it right - it have to write this messages. Size of the 1st stage bootloader is 27441 bytes,
after it comes compressed with zlib redboot plain image (not ELF).
Read flash image back and check, what wrong with bootloader.

Post #47
ramponis
8 May 2007, 07:54

If you flashed it right - it have to write this messages. Size of the 1st stage bootloader is 27441 bytes

I have extracted the first 27441 bytes of the boot-loader with this command

readmem 0x1fc00000    0x6B31 bootloader.bin

cat bootloader.bin redboot.z > new-bootloader.bin

and then


Then

flashmem 0x1fc00000 new-bootloader.bin

is this procedure ok?

I can retry all the procedure...

Do you have already a redboot bootloader?

Can you send me it?

Thank you

Post #48
ramponis
10 May 2007, 18:46

Hi bitbucket

I have compiled a openwrt firmware with ramdisk.
I have used ramdisk because if i try jffs or squahfs i receive "kernel panic".
I think the problem is caused by the bootloader.
The firmware try to findthe redboot partition to load some variables.

I have read some forum and i think that is possible to extract the correct redboot bootloader from the "fonera" and load it to the 2100AP.
The fonera use redboot like bootloader and it is based on an hardware similar to the 2100AP.
If it work we can compile a new firmware for the flash with jffs2 o squahfs support.

My 2100AP can boot from network with this firmware.
It load correctly the firmware, the ethernet is ok but not the wi-fi.
You can see in the serial log

Linux version 2.6.19.2 (ramponis@ramponis-desktop) (gcc version 4.1.2) #2 Thu Ma
y 10 12:53:05 CEST 2007
CPU revision is: 0001800a
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists.  Total pages: 4064
Kernel command line: console=ttyS0,9600 rootfstype=squashfs,jffs2 init=/etc/prei
nit
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB, 4-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 64 (order: 6, 256 bytes)
Using 92.000 MHz high precision timer.
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 11408k/16384k available (1942k kernel code, 4976k reserved, 282k data, 2
240k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
Radio config found at offset 0x10000(0x100)
NET: Registered protocol family 2
IP route cache hash table entries: 128 (order: -3, 512 bytes)
TCP established hash table entries: 512 (order: -1, 2048 bytes)
TCP bind hash table entries: 256 (order: -2, 1024 bytes)
TCP: Hash tables configured (established 512 bind 256)
TCP reno registered
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0xbc000003 (irq = 37) is a 16550A
eth0: Dropping NETIF_F_SG since no checksum feature.
eth0: Atheros AR231x: 00:13:46:60:cb:7c, irq 4
physmap platform flash device: 00400000 at 1e000000
physmap-flash.0: Found 1 x16 devices at 0x0 in 8-bit bank
 Amd/Fujitsu Extended Query Table at 0x0041
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
cmdlinepart partition parsing not available
Searching for RedBoot partition table in physmap-flash.0 at offset 0x3d0000
Searching for RedBoot partition table in physmap-flash.0 at offset 0x3e0000
Searching for RedBoot partition table in physmap-flash.0 at offset 0x3f0000
No RedBoot partition table detected in physmap-flash.0
ip_conntrack version 2.4 (128 buckets, 1024 max) - 240 bytes per conntrack
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP vegas registered
NET: Registered protocol family 1
NET: Registered protocol family 17
eth0: Configuring MAC for full duplex
Bridge firewalling registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Time: MIPS clocksource has been installed.
Freeing unused kernel memory: 2240k freed
Warning: unable to open an initial console.
Algorithmics/MIPS FPU Emulator v1.5
init started:  BusyBox v1.4.1 (2007-05-10 11:41:24 CEST) multi-call binary
wlan: 0.8.4.2 (0.9.2.1)

Please press Enter to activate this console. ath_hal: module license 'Proprietar
y' taints kernel.
ath_hal: 0.9.17.2 (AR5212, AR5312, RF2316, TX_DESC_SWAP)
ath_rate_sample: 1.2 (0.9.2.1)
wlan: mac acl policy registered
ath_ahb: 0.9.4.5 (0.9.2.1)
wifi%d: unable to attach hardware: 'Hardware revision not supported' (HAL status
 13)
: Committing new firmware id ...

: killall: matrixtunnel: no process killed




BusyBox v1.4.1 (2007-05-10 11:41:24 CEST) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r7156) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@OpenWrt:/#

I can also connect to the web administration interface (X-WRT) and i work (not so good).
Something is missing or do not work correcly, but the cpu and the ethernet are ok

What do you think?

Can you help me?

Thank you

Post #49
bitbucket
10 May 2007, 19:13

If you used my bootloader - it does not contain any jffs2 support. Also it does not have any redboot partition/config support or so (I need more space in flash for my wireless project). If I have time, I'll try to compile redboot for 2100 with jffs2 and variables support.
Also, you have to patch madwifi driver to get working wireless (look in this thread). Wireless works fine with my patch. Have you patched kernel from openwrt cvs, as I described in this thread ?

I think, that my bootloader can load openwrt like this:
1. Create uncompressed squashfs image with gzipped kernel on it. Only kernel.
2. Put this partition at 0x3a0000
3. Create jffs/jffs2 image with openwrt, but without kernel.
4. Put this image after kernel partition alligned by flash block size.
5. Use kernel command line (compiled in kernel) to make custom mtd partitions:
mtdparts=physmap-flash.0:0x20000@0x0(bootldr),0x3a0000@0x20000(root),put here where jffs starts and it size. Note, that at 0x3c0000 begins board configuration - it can not be moved or deleted.
6. Set root device in kernel command line "root=31:2"
7. Boot kernel and get (may be) working openwrt.

I recommend you flash partitions from linux, booted from network.

Post #50
ramponis
11 May 2007, 09:13

If I have time, I'll try to compile redboot for 2100 with jffs2 and variables support.

Thank you

Also, you have to patch madwifi driver to get working wireless (look in this thread). Wireless works fine with my patch. Have you patched kernel from openwrt cvs, as I described in this thread ?

I have done the patch, now it load the madwifi drivers correctly.
But i do not know how configure it.

There is a guide that describe the commands to set the wi-fi section?

I think, that my bootloader can load openwrt like this:
1. Create uncompressed squashfs image with gzipped kernel on it. Only kernel.
2. Put this partition at 0x3a0000
3. Create jffs/jffs2 image with openwrt, but without kernel.
4. Put this image after kernel partition alligned by flash block size.
5. Use kernel command line (compiled in kernel) to make custom mtd partitions:
mtdparts=physmap-flash.0:0x20000@0x0(bootldr),0x3a0000@0x20000(root),put here where jffs starts and it size. Note, that at 0x3c0000 begins board configuration - it can not be moved or deleted.
6. Set root device in kernel command line "root=31:2"
7. Boot kernel and get (may be) working openwrt.

If i have some free time, i want to do this test.

I recommend you flash partitions from linux, booted from network.

Thank you

Sorry, posts 51 to 50 are missing from our archive.