Hi there...I have some questions about that device. It's based on IXP435 CPU with 64MB RAM and 16MB flash. I've managed to screw redboot partitions and now I can't get running it properly. Clearly the stock firmware is based on OpenWrt, which in turn boot another kernel. Whatever...I do not want to use the stock firm and after a while I've managed to screw things up and now I have only redboot and OpenWrt part of stock firm running. When I try to use ixp4xx generic or other zImage, boot process sops at: "Uncompressing Linux... done, booting the kernel." No more debug info is displayed. Witch stock zImage dmesg is as follows:

Trying NPE-A...success. Using NPE-A with PHY 0.
Ethernet lan: MAC address 00:03:47:df:32:a8
IP: 192.168.1.1/255.255.255.0, Gateway: 192.168.1.254
Default server: 192.168.1.254

RedBoot(tm) bootstrap and debug environment [ROM]
Red Hat certified release, version 2.04 - built 16:43:22, Jan 14 2011

Platform: KIXRP435 Development Platform (IXP43X) BE
Copyright (C) 2000, 2001, 2002, 2003, 2004, 2007 Free Software Foundation, Inc.

RAM: 0x00000000-0x04000000, [0x000255d0-0x03f64000] available
FLASH: 0x50000000 - 0x51000000, 128 blocks of 0x00020000 bytes each.
== Executing boot script in 5.000 seconds - enter ^C to abort
RedBoot> fis load zImage
RedBoot> exec
Using base address 0x00800000 and length 0x001cc7ac
Uncompressing Linux... done, booting the kernel.
Linux version 2.6.36 (pkelle@sles11) (gcc version 4.5.1 (GCC) ) #15 Mon May 23 14:21:06 CEST 2011
CPU: XScale-IXP43x Family [69054041] revision 1 (ARMv5TE), cr=000039ff
CPU: VIVT data cache, VIVT instruction cache
Machine: Intel KIXRP435 Reference Platform
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: rootfstype=squashfs,jffs2 console=ttyS0,115200
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 64MB = 64MB total
Memory: 61756k/61756k available, 3780k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
    vmalloc : 0xc4800000 - 0xff000000   ( 936 MB)
    lowmem  : 0xc0000000 - 0xc4000000   (  64 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc012e000   (1176 kB)
      .text : 0xc012e000 - 0xc0303000   (1876 kB)
      .data : 0xc0304000 - 0xc0313520   (  62 kB)
NR_IRQS:64
Calibrating delay loop... 398.95 BogoMIPS (lpj=1994752)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
IXP4xx: Using 16MiB expansion bus window size
bio: create slab <bio-0> at 0
Switching to clocksource OSTS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
IXP4xx Queue Manager initialized.
NPE-B: reset: npe_debug_instr(): timeout
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (LZO) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 120
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xc8000000 (irq = 15) is a XScale
console [ttyS0] enabled
IXP4XX-Flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000089 Chip ID 0x008818
Intel/Sharp Extended Query Table at 0x010A
Intel/Sharp Extended Query Table at 0x010A
Intel/Sharp Extended Query Table at 0x010A
Intel/Sharp Extended Query Table at 0x010A
Intel/Sharp Extended Query Table at 0x010A
Using buffer write method
Using auto-unlock on power-up/resume
cfi_cmdset_0001: Erase suspend on write enabled
Searching for RedBoot partition table in IXP4XX-Flash.0 at offset 0xfe0000
4 RedBoot partitions found on MTD device IXP4XX-Flash.0
IXP4xx flash: using dynamic partition definition
Creating 4 MTD partitions on "IXP4XX-Flash.0":
0x000000000000-0x000000080000 : "RedBoot"
0x000000080000-0x000000260000 : "zImage"
0x000000fc0000-0x000000fe0000 : "RedBoot config"
0x000000fe0000-0x000001000000 : "FIS directory"
IP17xx: Found IP175C at 0:00
IXP4xx MII Bus: probed
eth0: MII PHY 0 on NPE-A
eth1: MII PHY 4 on NPE-C
IXP4xx Watchdog Timer: heartbeat 60 sec
TCP cubic registered
NET: Registered protocol family 17
XScale DSP coprocessor detected.
drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
Freeing init memory: 1176K
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
- init -

Please press Enter to activate this console. jffs2: Too few erase blocks (4)
NPE-C: firmware's license can be found in /usr/share/doc/LICENSE.IPL
NPE-C: firmware functionality 0x5, revision 0x2:1

Is there anything I can do to build OpenWRT for that configuration?

(Last edited by bfka on 13 Jun 2017, 12:04)

Hi

I realise it has been some time since you posted this - can you be a bit more detailed about how you got a new kernel to the RED10 and starting to boot it?

Also, how did you connect to the console?  I see a five pin header on the motherboard when I open mine, is this a TTL console port?

TIA

I've manage to compile generic openwrt with some tweaks to bypass machine id check, which in turn boots kernel fine, but can't get network interfaces to work. ifconfig founds nothing! During kernel booting everything seems find, no errors, no nothing. In the end - I've abandoned the device, as I have no more knowledge how to continue with debugging.
p.s Yes, it's a serial port

(Last edited by bfka on 5 Feb 2018, 15:02)

I pulled a copy of the firmware from a RED Recovery package and ran binwalk on it and it seems the rootfs is a cpio archive with telltale markers of OpenWrt.  Based on the kernel version, I'd wager it's been forked from Kamikaze.  On top of that, there are no kernel modules for the NICs, which makes me think they're compiled into the kernel and are likely proprietary.

If that's the case, all you'd really need to do is replace the userland with a Kamikaze one, assuming there's no trickery elsewhere in the bootloader that might get in the way.

Failing that, do you recall what tweaks you did to get the kernel to boot?  I might be able to pick up where you left off.

If forked from Kamikaze, would they not owe GPL sources that could be recompiled or patched into some more appropriate source tree? Could be a viable option.

So I've downloaded chaos_calmer release and in make menuconfig changed target to: IXP4xx, subtarget: generic, profile: default. In kernel modules->network devices I've '*' kmod-ixp4xx-eth, kmod-swtich-ip17xx (it's presented on board). In make kernel_menuconfig CONFIG_TARGET=subtarget I've enabled kernel low level debugging functions via UART, early printk and timing information on printk. Then compile the kernel and test, which result in halt, because r1 = 0x00000455 (machine ID) was not found in available ID's. Then I've hardcoded machine ID to 0x000005bc (CAMBRIA) in atags_parse.c, recompile again and voila:

Using base address 0x00025800 and length 0x0011b2f0
Uncompressing Linux... done, booting the kernel.
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 3.18.98 (rosse@kali) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r49                        630) ) #4 Wed Apr 4 18:33:25 EEST 2018
[    0.000000] CPU: XScale-IXP43x Family [69054041] revision 1 (ARMv5TE), cr=000039ff
[    0.000000] CPU: VIVT data cache, VIVT instruction cache
[    0.000000] Machine: Gateworks Cambria series
[    0.000000] Memory policy: Data cache writeback
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0                        ,115200
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Memory: 61556K/65536K available (2262K kernel code, 129K rwdata, 644K rodata, 124K init,                         179K bss, 3980K reserved, 0K cma-reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xffe00000   (2048 kB)
[    0.000000]     vmalloc : 0xc4800000 - 0xff000000   ( 936 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc4000000   (  64 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .text : 0xc0008000 - 0xc02ded74   (2908 kB)
[    0.000000]       .init : 0xc02df000 - 0xc02fe000   ( 124 kB)
[    0.000000]       .data : 0xc02fe000 - 0xc031e460   ( 130 kB)
[    0.000000]        .bss : 0xc031e460 - 0xc034b26c   ( 180 kB)
[    0.000000] NR_IRQS:64
[    0.000022] sched_clock: 32 bits at 66MHz, resolution 15ns, wraps every 64425153520ns
[    0.000485] Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656)
[    0.050157] pid_max: default: 32768 minimum: 301
[    0.050506] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.050540] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.051569] CPU: Testing write buffer coherency: ok
[    0.052254] Setting up static identity map for 0x10478 - 0x104c8
[    0.056739] NET: Registered protocol family 16
[    0.057660] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.059086] IXP4xx: Using 16MiB expansion bus window size
[    0.069190] i2c-gpio i2c-gpio.0: using pins 7 (SDA) and 6 (SCL)
[    0.071056] Switched to clocksource OSTS
[    0.073401] NET: Registered protocol family 2
[    0.075236] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.075306] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.075354] TCP: Hash tables configured (established 1024 bind 1024)
[    0.075484] TCP: reno registered
[    0.075515] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.075562] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.076045] NET: Registered protocol family 1
[    0.078103] IXP4xx Queue Manager initialized.
[    0.079851] NPE-B: reset: npe_debug_instr(): timeout
[    0.081648] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.084146] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.084199] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat                        , Inc.
[    0.084977] msgmni has been set to 120
[    0.107930] io scheduler noop registered
[    0.107979] io scheduler deadline registered (default)
[    0.108332] gw_i2c_pld 0-0056: gpios 16..23 on a gw_i2c_pld
[    0.108549] gw_i2c_pld 0-0057: gpios 24..25 on a gw_i2c_pld
[    0.180285] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
[    0.182905] console [ttyS0] disabled
[    0.183010] serial8250.0: ttyS0 at MMIO 0xc8000000 (irq = 15, base_baud = 921600) is a XScale
[    0.593435] console [ttyS0] enabled
[    0.598472] at24 0-0051: 1024 byte 24c08 EEPROM, read-only, 0 bytes/write
[    0.783218] IXP4XX-Flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000089 Chip                         ID 0x008818
[    0.793562] Intel/Sharp Extended Query Table at 0x010A
[    0.798748] Intel/Sharp Extended Query Table at 0x010A
[    0.803979] Intel/Sharp Extended Query Table at 0x010A
[    0.809194] Intel/Sharp Extended Query Table at 0x010A
[    0.814458] Intel/Sharp Extended Query Table at 0x010A
[    0.819733] Using buffer write method
[    0.823408] Using auto-unlock on power-up/resume
[    0.828026] cfi_cmdset_0001: Erase suspend on write enabled
[    0.833976] Searching for RedBoot partition table in IXP4XX-Flash.0 at offset 0xfe0000
[    0.961161] 5 RedBoot partitions found on MTD device IXP4XX-Flash.0
[    0.967450] Creating 5 MTD partitions on "IXP4XX-Flash.0":
[    0.973056] 0x000000000000-0x000000080000 : "RedBoot"
[    0.980084] 0x000000080000-0x0000001a0000 : "zImage"
[    0.987134] 0x0000001a0000-0x000000fc0000 : "rootfs"
[    0.995108] mtd: device 2 (rootfs) set to be root filesystem
[    1.000856] 1 squashfs-split partitions found on MTD device rootfs
[    1.007149] 0x000000360000-0x000000fc0000 : "rootfs_data"
[    1.015174] 0x000000fc0000-0x000000fe0000 : "RedBoot config"
[    1.022687] 0x000000fe0000-0x000001000000 : "FIS directory"
[    1.046806] libphy: IXP4xx MII Bus: probed
[    1.051459] rtc-ds1672 0-0068: chip found, driver version 0.4
[    1.059293] rtc-ds1672 0-0068: ds1672_get_datetime: read error
[    1.065644] rtc-ds1672 0-0068: rtc core: registered rtc-ds1672 as rtc0
[    1.073182] rtc-ds1672 0-0068: ds1672_get_control: read error
[    1.078951] rtc-ds1672 0-0068: Unable to read the control register
[    1.085212] rtc-ds1672 0-0068: Oscillator not enabled. Set time to enable.
[    1.092724] i2c /dev entries driver
[    1.103813] ad7418 0-0028: ad7418 chip found
[    1.108883] ad7418 0-0028: cannot read configuration register
[    1.115392] gsp 0-0029: gsp chip found
[    1.120097] ixp4xx_wdt: timer heartbeat 60 sec
[    1.125740] TCP: cubic registered
[    1.129094] NET: Registered protocol family 17
[    1.133803] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts                         to load br_netfilter if you need this.
[    1.146521] 8021q: 802.1Q VLAN Support v1.8
[    1.150924] XScale DSP coprocessor detected.
[    1.157668] rtc-ds1672 0-0068: ds1672_get_datetime: read error
[    1.163620] rtc-ds1672 0-0068: hctosys: unable to read the hardware clock
[    1.185141] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    1.192740] Freeing unused kernel memory: 124K
[    2.859721] init: Console is alive
[    2.863723] init: - watchdog -
[    4.996087] init: - preinit -
[    5.777106] random: mktemp urandom read with 8 bits of entropy available
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    9.215102] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    9.241712] procd: - early -
[    9.244917] procd: - watchdog -
[   10.937057] procd: - ubus -
[   11.952218] procd: - init -
Please press Enter to activate this console.
[   15.012454] NET: Registered protocol family 10
[   15.047461] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   15.088292] IP17xx: Found IP175C at ixp4xx-eth-0:00
[   15.100213] Loading modules backported from Linux version v4.4-rc5-1913-gc8fdf68
[   15.107716] Backport generated by backports.git backports-20151218-0-g2f58d9d
[   15.126949] ip_tables: (C) 2000-2006 Netfilter Core Team
[   15.160043] nf_conntrack version 0.5.0 (963 buckets, 3852 max)
[   15.298136] xt_time: kernel timezone is -0000
[   15.465826] PPP generic driver version 2.4.2
[   15.473374] NET: Registered protocol family 24
[   26.331859] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   26.338818] jffs2_build_filesystem(): unlocking the mtd device... done.
[   26.346459] jffs2_build_filesystem(): erasing all blocks after the end marker... done.
[   80.719331] jffs2: notice: (2022) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   81.651209] random: nonblocking pool is initialized

That's all I can do. I don't have knowledge/skills to debug further, nor I can find information from where to begin with.

(Last edited by bfka on 5 Apr 2018, 08:15)