Page 1 of 3 123 LastLast
Results 1 to 10 of 25

Thread: Heavy duty Javelin hacking

  1. #1
    Join Date
    May 2010
    Location
    In the land of make believe.
    Posts
    505

    Default Heavy duty Javelin hacking

    WOOO! Console Access. Open your Javelin, there is a 4 pin JST connector inside. Pic below. If looking from the front of the javelin, you need only remove the screw on the bottom of the unit, on the right side. Then slide the right panel forward. You will now see the main board. DO NOT ATTEMPT TO REMOVE THE MAIN BOARD! You must disassemble the chassis more to remove it without damaging it.

    The 4pin JST connector is TTL level serial. You will need a converter, I use my own custom board based on the Prolific PL-2303 for development, or a bus pirate, then a cheap Nokia-compatible phone cable for my final product. If you have a cable for a PBO, its the same cable with a pin-out change. If people really want them, i might start offering 20 dollar or so prebuilt cables.

    JST connectors are a pain in the ass to work with. Just buy something with the JST connector on it. I recommend this. Just attach your TTL/RS232 converter to it and you are done.

    Picture below details connector. Using my picture, pin 1 is the left most pin. Pin 1 is RX, pin 3 is TX... Maybe... I dunno, I have serial port dyslexia. But its those two pins. Pin 2 is GND, pin 4 is V+. If you cross RX and TX nothing bad happens. If you cross the others, some adapters will get VERY angry and release the mystical blue smoke. So don't do it.

    IMG_4698-1.JPG

    Code:
    U-Boot 1.3.4 (NS4600p - 015 - 800MHz) (Jan 27 2011 - 10:21:32)
    
    CPU:   AMCC PowerPC 431EXr at 800 MHz (PLB=200, OPB=100, EBC=100 MHz)
           Security/Kasumi support
           Bootstrap Option F - Boot ROM Location NAND (8 bits), booting from NAND
           Internal PCI arbiter disabled
           32 kB I-Cache 32 kB D-Cache
    Board: NS4600p - PROMISE 4-bay NAS Target Board, 1*PCIe/1*SATA
    I2C:   ready
    DRAM:  256 MB
    Enclosure: Load fan configurations from VPD
    NAND:  128 MiB
    eth0 MAC = 00:01:55:XX:XX:XX
    eth1 MAC = 00:00:00:00:00:00
    PCI:   Bus Dev VenId DevId Class Int
    PCIE1: successfully set as root-complex
            01  00  105a  3f20  0104  00
    SCSI:  Net:   ppc_4xx_eth0
    
    Hit Ctrl + C to stop autoboot:  0 
    No wakeup events detected! Auto booting...
    Leave clock generator PD mode... OK
    Leave net PHY PD mode... OK
    Turn on all activity LED power... OK
    Blinking LED... OK
    Turn on disk power... OK
    
    NAND read: device 0 offset 0xca0000, size 0x300000
     3145728 bytes read: OK
    
    NAND read: device 0 offset 0xfa0000, size 0x800000
    Skipping XXXXXXXXXXXXXX
     8388608 bytes read: OK
    
    NAND read: device 0 offset 0x100000, size 0x3000
     12288 bytes read: OK
    ## Booting kernel from Legacy Image at 01200000 ...
       Image Name:   Linux-2.6.32.14
       Created:      2011-01-20   4:39:31 UTC
       Image Type:   PowerPC Linux Kernel Image (gzip compressed)
       Data Size:    2339544 Bytes =  2.2 MB
       Load Address: 00000000
       Entry Point:  00000000
       Verifying Checksum ... OK
    ## Loading init Ramdisk from Legacy Image at 01b00000 ...
       Image Name:   XXXXXXXXXXXXXXX
       Created:      XXXXXXXXXXXX
       Image Type:   PowerPC Linux RAMDisk Image (gzip compressed)
       Data Size:    3710713 Bytes =  3.5 MB
       Load Address: 00000000
       Entry Point:  00000000
       Verifying Checksum ... OK
    ## Flattened Device Tree blob at 01a00000
       Booting using the fdt blob at 0x1a00000
       Uncompressing Kernel Image ... OK
       Loading Ramdisk to 0fa71000, end 0fdfaef9 ... OK
       Loading Device Tree to 00ffa000, end 00ffffff ... OK
    Using PowerPC 44x Platform machine description
    <SNIPPED KERNEL BOOT BORING STUFF>
    Last edited by BadIntentions; 07-03-2011 at 03:40 AM.
    I AM NOT A PATRIOT MEMORY EMPLOYEE.

    But they have, on occasion, bribed me with hardware.



    I am happy to help, but don't PM me. Post a thread in the appropriate forum so others may benefit and offer assistance.
    Your lack of planning is not an emergency on my part.

  2. #2
    Join Date
    May 2010
    Location
    In the land of make believe.
    Posts
    505

    Default

    Interesting things that have been learned so far:

    I may be able to make a USB bootable alternative firmware for linux power users. I would build it on openembedded or openwrt, depending on how bored I am.

    This thing has 128MB of flash, that's a lot of flash.
    This thing has 256MB of ram, rather beefy for an embedded device.
    The kernel compile is VERY fresh for an embedded device on the market, and its FAIRLY modern compared to many embedded devices... COOL!
    Last edited by BadIntentions; 07-03-2011 at 06:53 AM. Reason: late night typing...
    I AM NOT A PATRIOT MEMORY EMPLOYEE.

    But they have, on occasion, bribed me with hardware.



    I am happy to help, but don't PM me. Post a thread in the appropriate forum so others may benefit and offer assistance.
    Your lack of planning is not an emergency on my part.

  3. #3
    Join Date
    May 2010
    Location
    In the land of make believe.
    Posts
    505

    Default

    uBoot is quite fully featured on this board. Output of the help command:

    Code:
    => help
    ?       - alias for 'help'
    askenv  - get environment variables from stdin
    autoscr - DEPRECATED - use "source" command instead
    base    - print or set address offset
    bdinfo  - print Board Info structure
    boot    - boot default, i.e., run 'bootcmd'
    bootd   - boot default, i.e., run 'bootcmd'
    bootelf - Boot from an ELF image in memory
    bootm   - boot application image from memory
    bootp   - boot image via network using BOOTP/TFTP protocol
    bootstrap- program the I2C bootstrap EEPROM
    bootvx  - Boot vxWorks from an ELF image
    burnin  - burnin system
    chkdisk - Check back plate connetcion
    chkloopback- Check loop back plane connection
    chpart  - change active partition
    cmp     - memory compare
    coninfo - print console devices and information
    cp      - memory copy
    crc32   - checksum calculation
    date    - get/set/reset date & time
    dcache  - enable or disable data cache
    dhcp    - boot image via network using DHCP/TFTP protocol
    diagnostic- diagnostic sub-system
    echo    - echo args to console
    eeprom  - EEPROM sub-system
    erase   - erase FLASH memory
    exit    - exit script
    ext2load- load binary file from a Ext2 filesystem
    ext2ls  - list files in a directory (default /)
    fatinfo - print information about filesystem
    fatload - load binary file from a dos filesystem
    fatls   - list files in a directory (default /)
    fdt     - flattened device tree utility commands
    flinfo  - print FLASH memory information
    fwversion- fwversion      - get firmware version
    
    getdcr  - Get an AMCC PPC 4xx DCR's value
    getidcr - Get a register value via indirect DCR addressing
    go      - start application at address 'addr'
    help    - print online help
    icache  - enable or disable instruction cache
    icrc32  - checksum calculation
    iloop   - infinite loop on address range
    imd     - i2c memory display
    iminfo  - print header information for application image
    imls    - list all images found in flash
    imm     - i2c memory modify (auto-incrementing)
    imw     - memory write (fill)
    imxtract- extract a part of a multi-image
    inm     - memory modify (constant address)
    interrupts- enable or disable interrupts
    iprobe  - probe to discover valid I2C chip addresses
    irqinfo - print information about IRQs
    isdram  - print SDRAM configuration information
    itest   - return true/false on integer compare
    loadb   - load binary file over serial line (kermit mode)
    loads   - load S-Record file over serial line
    loady   - load binary file over serial line (ymodem mode)
    loop    - infinite loop on address range
    loopw   - infinite write loop on address range
    md      - memory display
    mdc     - memory display cyclic
    mii     - MII utility commands
    mm      - memory modify (auto-incrementing)
    mtdparts- define flash/nand partitions
    mtest   - simple RAM test
    mw      - memory write (fill)
    mwc     - memory write cyclic
    nand    - NAND sub-system
    nboot   - boot from NAND device
    nfs     - boot image via network using NFS protocol
    nm      - memory modify (constant address)
    pci     - list and access PCI Configuration Space
    ping    - send ICMP ECHO_REQUEST to network host
    printenv- print environment variables
    protect - enable or disable FLASH write protection
    rarpboot- boot image via network using RARP/TFTP protocol
    reginfo - print register information
    reset   - Perform RESET of the CPU
    run     - run commands in an environment variable
    sata    - SATA sub system
    saveenv - save environment variables to persistent storage
    scsi    - SCSI sub-system
    scsiboot- boot from SCSI device
    setdcr  - Set an AMCC PPC 4xx DCR's value
    setenv  - set environment variables
    setidcr - Set a register value via indirect DCR addressing
    showvar - print local hushshell variables
    shutdown- shutdown system
    sleep   - delay execution for some time
    sntp    - synchronize RTC via network
    source  - run script from memory
    standby - standby sub-system
    test    - minimal test like /bin/sh
    tftpboot- boot image via network using TFTP protocol
    usb     - USB sub-system
    usbboot - boot from USB device
    version - print monitor version
    vpd     - vpd sub-system
    vpdcs   - vpdcs   - calculate and write vpd checksum
    
    vpdr    - read vpd content
    vpdw    - write vpd content
    I AM NOT A PATRIOT MEMORY EMPLOYEE.

    But they have, on occasion, bribed me with hardware.



    I am happy to help, but don't PM me. Post a thread in the appropriate forum so others may benefit and offer assistance.
    Your lack of planning is not an emergency on my part.

  4. #4
    Join Date
    May 2010
    Location
    In the land of make believe.
    Posts
    505

    Default

    Environment Var Dump

    Code:
    bootcmd=standby
    bootdelay=0
    baudrate=115200
    loads_echo=
    preboot=echo
    netmask=
    hostname=canyonlands
    netdev=eth0
    nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=${serverip}:${rootpath}
    ramargs=setenv bootargs root=/dev/ram rw
    addip=setenv bootargs ${bootargs} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}:${netdev}:off panic=1
    addtty=setenv bootargs ${bootargs} console=ttyS0,${baudrate}
    addmisc=setenv bootargs ${bootargs}
    initrd_high=30000000
    kernel_addr_r=1000000
    fdt_addr_r=1800000
    ramdisk_addr_r=1900000
    hostname=canyonlands
    bootfile=canyonlands/uImage
    ramdisk_file=canyonlands/uRamdisk
    nload=tftp 200000 canyonlands/u-boot-nand.bin
    nupdate=nand erase 0 100000;nand write 200000 0 100000;setenv filesize;saveenv
    nupd=run nload nupdate
    pciconfighost=1
    pcie_mode=RP:RP
    mtdids=nand0=nand0
    mtdargs=setenv bootargs ${bootargs} ${mtdparts}
    addramdisk=setenv bootargs ${bootargs} ramdisk_size=131072
    nfsboot=run nfsargs addip addtty;nand read.e 1200000 kernel 300000;nand read.e 1a00000 dtb 3000;bootm 1200000 - 1a00000
    safeboot=run ramargs addramdisk addtty mtdargs;nand read.e 1200000 safe-k 300000;nand read.e 1b00000 safe-r 800000;nand read.e 1a00000 dtb 3000;bootm 1200000 1b00000 1a00000
    nandboot=run ramargs addtty mtdargs;nand read.e 1200000 kernel 300000;nand read.e 1b00000 rootfs 800000;nand read.e 1a00000 dtb 3000;bootm 1200000 1b00000 1a00000
    burnin=done
    ext_ready_time=25
    enable_usb=echo ext_storage is $ext_storage;echo Wait $ext_ready_time seconds for device ready;sleep $ext_ready_time;usb start
    enable_sata=echo ext_storage is $ext_storage;sata info
    enable_ext=run enable_$ext_storage
    load_ext_kernel=echo Load kernel from external storage...;ext2load $ext_storage 0:1 1200000 images/kernel
    load_ext_rootfs=echo Load rootfs from external storage...;ext2load $ext_storage 0:1 1b00000 images/rootfs;
    load_ext_dtb=echo Load dtb from external storage...;ext2load $ext_storage 0:1 1a00000 images/dtb
    extboot=run enable_ext;run ramargs addtty;nand read.e 1200000 kernel 300000;run load_ext_rootfs;nand read.e 1a00000 dtb 3000;bootm 1200000 1b00000 1a00000
    ethact=ppc_4xx_eth0
    mtdparts=mtdparts=nand0:1024K(u-boot),512K(dtb),3200K(safe-k),8192K(safe-r),3072K(kernel),8576K(rootfs),16384K(usr),2048K(data),1024K(oem),86144K(app)
    dynparts=done
    gateway=
    ipaddr=
    gatewayip=
    ext_storage=
    bootargs=root=/dev/ram rw console=ttyS0,115200
    partition=nand0,0
    mtddevnum=0
    mtddevname=u-boot
    rootpath=
    serverip=
    real_bootcmd=run nandboot
    ethaddr=00:01:55:XX:XX:XX
    eth1addr=00:00:00:00:00:00
    stdin=serial
    stdout=serial
    stderr=serial
    ver=U-Boot 1.3.4 (NS4600p - 015 - 800MHz) (Jan 27 2011 - 10:21:32)
    
    Environment size: 2687/131068 bytes
    I AM NOT A PATRIOT MEMORY EMPLOYEE.

    But they have, on occasion, bribed me with hardware.



    I am happy to help, but don't PM me. Post a thread in the appropriate forum so others may benefit and offer assistance.
    Your lack of planning is not an emergency on my part.

  5. #5
    Join Date
    May 2010
    Location
    In the land of make believe.
    Posts
    505

    Default

    So i built a fresh kernel (Linux 3.0.3) and attempted to boot it.

    PowerPC boots funny compared to arm, requiring a 'dtb' file to describe the device. I have not yet gotten a boot, but i have gotten the kernel to unpack, flatten my DTB, and attempt to boot. its better than nothing i suppose....

    Code:
    bootm 1200000 - 1a00000
    ## Booting kernel from Legacy Image at 01200000 ...
       Image Name:   Linux-3.0.3
       Created:      2011-10-03   5:02:58 UTC
       Image Type:   PowerPC Linux Kernel Image (gzip compressed)
       Data Size:    2294506 Bytes =  2.2 MB
       Load Address: 00400000
       Entry Point:  00400458
       Verifying Checksum ... OK
    ## Flattened Device Tree blob at 01a00000
       Booting using the fdt blob at 0x1a00000
       Uncompressing Kernel Image ... OK
       Loading Device Tree to 00fdd000, end 00ffffff ... OK
    I AM NOT A PATRIOT MEMORY EMPLOYEE.

    But they have, on occasion, bribed me with hardware.



    I am happy to help, but don't PM me. Post a thread in the appropriate forum so others may benefit and offer assistance.
    Your lack of planning is not an emergency on my part.

  6. #6
    Join Date
    May 2010
    Location
    In the land of make believe.
    Posts
    505

    Default

    Good news! There IS a reset switch for the CPU, permitting the board to be reset without removing power. This makes debugging easier! It is on what would be the top left corner of the board as installed into the Javelin, Just under the top connectors solder pads. It is labelled SW3.
    I AM NOT A PATRIOT MEMORY EMPLOYEE.

    But they have, on occasion, bribed me with hardware.



    I am happy to help, but don't PM me. Post a thread in the appropriate forum so others may benefit and offer assistance.
    Your lack of planning is not an emergency on my part.

  7. #7
    Join Date
    May 2010
    Location
    In the land of make believe.
    Posts
    505

    Default

    It boots! Sorta...

    Well, i mean, i dont have full os or anything, but i have an actual, factual booting Linux Kernel/uImage! That is 80% of the big hurdle to overcome.

    Code:
    => tftp 1200000 mistake.img
    Waiting for PHY auto negotiation to complete... done
    ENET Speed is 1000 Mbps - FULL duplex connection (EMAC0)
    Using ppc_4xx_eth0 device
    TFTP from server 192.168.1.87; our IP address is 192.168.1.250
    Filename 'mistake.img'.
    Load address: 0x1200000
    Loading: #################################################################
             #################################################################
             #################################################################
             ########################################################
    done
    Bytes transferred = 3670016 (380000 hex)
    => nand read.e 1a00000 dtb 3000
    
    NAND read: device 0 offset 0x100000, size 0x3000
     12288 bytes read: OK
    => bootm 1200000 - 1a00000
    ## Booting kernel from Legacy Image at 01200000 ...
       Image Name:   <SNIPPED>
       Created:      <SNIPPED>
       Image Type:   PowerPC Linux Kernel Image (gzip compressed)
       Data Size:    1234448 Bytes =  1.2 MB
       Load Address: 00000000
       Entry Point:  00000000
       Verifying Checksum ... OK
    ## Flattened Device Tree blob at 01a00000
       Booting using the fdt blob at 0x1a00000
       Uncompressing Kernel Image ... OK
       Loading Device Tree to 00ffa000, end 00ffffff ... OK
    Using PowerPC 44x Platform machine description
    Linux version <SNIPPED>
    Zone PFN ranges:
      DMA      0x00000000 -> 0x00010000
      Normal   0x00010000 -> 0x00010000
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
        0: 0x00000000 -> 0x00010000
    MMU: Allocated 1088 bytes of context maps for 255 contexts
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
    Kernel command line: root=/dev/ram rw console=ttyS0,115200
    PID hash table entries: 1024 (order: 0, 4096 bytes)
    Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
    Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
    Memory: 256896k/262144k available (2508k kernel code, 5024k reserved, 144k data, 71k bss, 128k init)
    Kernel virtual memory layout:
      * 0xffffe000..0xfffff000  : fixmap
      * 0xfde00000..0xfe000000  : consistent mem
      * 0xfde00000..0xfde00000  : early ioremap
      * 0xd1000000..0xfde00000  : vmalloc & ioremap
    Hierarchical RCU implementation.
    NR_IRQS:512
    UIC0 (32 IRQ sources) at DCR 0xc0
    UIC1 (32 IRQ sources) at DCR 0xd0
    UIC2 (32 IRQ sources) at DCR 0xe0
    UIC3 (32 IRQ sources) at DCR 0xf0
    clocksource: timebase mult[500000] shift[22] registered
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    256k L2-cache enabled
    PCIE0: Port disabled via device-tree
    PCIE1: Checking link...
    PCIE1: Device detected, waiting for link...
    PCIE1: link is up !
    PCI host bridge /plb/pciex@d20000000 (primary) ranges:
     MEM 0x0000000e80000000..0x0000000effffffff -> 0x0000000080000000
     MEM 0x0000000f00100000..0x0000000f001fffff -> 0x0000000000000000
      IO 0x0000000f80010000..0x0000000f8001ffff -> 0x0000000000000000
     Removing ISA hole at 0x0000000f00100000
    4xx PCI DMA offset set to 0x00000000
    /plb/pciex@d20000000: Legacy ISA memory support enabled
    PCIE1: successfully set as root-complex
    PCI: Probing PCI hardware
    PCI: Hiding 4xx host bridge resources 0000:80:00.0
    pci 0000:80:00.0: PCI bridge, secondary bus 0000:81
    pci 0000:80:00.0:   IO window: 0x1000-0x1fff
    pci 0000:80:00.0:   MEM window: 0x80000000-0x800fffff
    pci 0000:80:00.0:   PREFETCH window: disabled
    bio: create slab <bio-0> at 0
    Switching to clocksource timebase
    NET: Registered protocol family 2
    IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
    TCP established hash table entries: 8192 (order: 4, 65536 bytes)
    TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
    TCP: Hash tables configured (established 8192 bind 8192)
    TCP reno registered
    NET: Registered protocol family 1
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    Registering mini_fo version $Id$
    JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
    msgmni has been set to 502
    io scheduler noop registered
    io scheduler deadline registered (default)
    Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
    serial8250.0: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a 16550A
    console [ttyS0] enabled
    serial8250.0: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a 16550A
    4ef600300.serial: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a 16550
    4ef600400.serial: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a 16550
    of-flash 4e0000000.nor_flash: do_map_probe() failed
    PPC 4xx OCP EMAC driver, version 3.54
    MAL v2 /plb/mcmal, 2 TX channels, 16 RX channels
    ZMII /plb/opb/emac-zmii@ef600d00 initialized
    RGMII /plb/opb/emac-rgmii@ef601500 initialized with MDIO support
    TAH /plb/opb/emac-tah@ef601350 initialized
    TAH /plb/opb/emac-tah@ef601450 initialized
    /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
    eth0: EMAC-0 /plb/opb/ethernet@ef600e00, MAC 00:01:55:31:00:e4
    eth0: found Generic MII PHY (0x00)
    /plb/opb/emac-rgmii@ef601500: input 1 in RGMII mode
    /plb/opb/ethernet@ef600f00: can't find PHY!
    TCP westwood registered
    NET: Registered protocol family 17
    802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
    All bugs added by David S. Miller <davem@redhat.com>
    VFS: Cannot open root device "ram" or unknown-block(1,0)
    Please append a correct "root=" boot option; here are the available partitions:
    Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(1,0)
    Rebooting in 180 seconds..
    Further more, it appears to detect the PCIE port, meaning the RAID controller can probably be seen.
    Last edited by BadIntentions; 10-06-2011 at 06:49 AM.
    I AM NOT A PATRIOT MEMORY EMPLOYEE.

    But they have, on occasion, bribed me with hardware.



    I am happy to help, but don't PM me. Post a thread in the appropriate forum so others may benefit and offer assistance.
    Your lack of planning is not an emergency on my part.

  8. #8
    Join Date
    May 2010
    Location
    In the land of make believe.
    Posts
    505

    Default

    I have compiled a kernel completely from publicly available source, using no binary blobs or anything with a non GPL license, and have gotten it to boot... somewhat.

    Why it doesnt want to output to console is beyond me, but i can reset the board, probe the console buffer and see my kernel starting to boot. Its a pretty good sign i will be able to build an alternate firmware for more advanced users...

    Code:
    => md 0029b740
    0029b740: 3c363e55 73696e67 20506f77 65725043    <6>Using PowerPC
    0029b750: 20343478 20506c61 74666f72 6d206d61     44x Platform ma
    0029b760: 6368696e 65206465 73637269 7074696f    chine descriptio
    0029b770: 6e0a3c35 3e4c696e 75782076 65727369    n.<5>Linux versi
    0029b780: 6f6e2032 2e362e33 322e3237 20286275    on 2.6.32.27 (bu
    0029b790: 696c6465 72404261 64496e74 656e7469    ilder@BadIntenti
    0029b7a0: 6f6e7329 20286763 63207665 7273696f    ons) (gcc versio
    0029b7b0: 6e20342e 342e3320 28474343 29202920    n 4.4.3 (GCC) )
    0029b7c0: 23312054 6875204f 63742036 2030323a    #1 Thu Oct 6 02:
    0029b7d0: 31343a31 39204344 54203230 31310a3c    14:19 CDT 2011.<
    0029b7e0: 373e466f 756e6420 6c656761 63792073    7>Found legacy s
    0029b7f0: 65726961 6c20706f 72742030 20666f72    erial port 0 for
    0029b800: 202f706c 622f6f70 622f7365 7269616c     /plb/opb/serial
    0029b810: 40656636 30303330 300a3c37 3e20206d    @ef600300.<7>  m
    0029b820: 656d3d34 65663630 30333030 2c207461    em=4ef600300, ta
    0029b830: 6464723d 34656636 30303330 302c2069    ddr=4ef600300, i
    I AM NOT A PATRIOT MEMORY EMPLOYEE.

    But they have, on occasion, bribed me with hardware.



    I am happy to help, but don't PM me. Post a thread in the appropriate forum so others may benefit and offer assistance.
    Your lack of planning is not an emergency on my part.

  9. #9
    Join Date
    May 2010
    Location
    In the land of make believe.
    Posts
    505

    Default

    Even better. Porting a few of my changes to a newer kernel, i get all the way up to looking for a root to boot off of! YAY! The tool chain is PROBABLY a bit TOO bleeding edge. I am running prerelease compilers and ultra fresh linux 3.0.3. I look forward to trying to build busybox and some others with such a new implementation.

    Code:
    => nand read.e 1a00000 dtb 3000
    
    NAND read: device 0 offset 0x100000, size 0x3000
     12288 bytes read: OK
    => tftp 1200000 openwrt-ppc44x-uimage
    Using ppc_4xx_eth0 device
    TFTP from server 192.168.1.87; our IP address is 192.168.1.250
    Filename 'openwrt-ppc44x-uimage'.
    Load address: 0x1200000
    Loading: #################################################################
             #################################################################
             ###############
    done
    Bytes transferred = 2124415 (206a7f hex)
    => bootm 1200000 - 1a00000
    ## Booting kernel from Legacy Image at 01200000 ...
       Image Name:   Linux-3.0.3
       Created:      2011-10-09   8:00:32 UTC
       Image Type:   PowerPC Linux Kernel Image (gzip compressed)
       Data Size:    2124351 Bytes =  2 MB
       Load Address: 00000000
       Entry Point:  00000000
       Verifying Checksum ... OK
    ## Flattened Device Tree blob at 01a00000
       Booting using the fdt blob at 0x1a00000
       Uncompressing Kernel Image ... OK
       Loading Device Tree to 00ffa000, end 00ffffff ... OK
    Using Canyonlands machine description
    Linux version 3.0.3 (builder@BadIntentions) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #1 Sun Oct 9 02:57:48 CDT 2011
    Zone PFN ranges:
      DMA      0x00000000 -> 0x00010000
      Normal   empty
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
        0: 0x00000000 -> 0x00010000
    MMU: Allocated 1088 bytes of context maps for 255 contexts
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
    Kernel command line: root=/dev/ram rw console=ttyS0,115200
    PID hash table entries: 1024 (order: 0, 4096 bytes)
    Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
    Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
    Memory: 257264k/262144k available (2324k kernel code, 4880k reserved, 140k data, 55k bss, 128k init)
    Kernel virtual memory layout:
      * 0xfffdf000..0xfffff000  : fixmap
      * 0xfde00000..0xfe000000  : consistent mem
      * 0xfde00000..0xfde00000  : early ioremap
      * 0xd1000000..0xfde00000  : vmalloc & ioremap
    NR_IRQS:512
    UIC0 (32 IRQ sources) at DCR 0xc0
    UIC1 (32 IRQ sources) at DCR 0xd0
    UIC2 (32 IRQ sources) at DCR 0xe0
    UIC3 (32 IRQ sources) at DCR 0xf0
    clocksource: timebase mult[500000] shift[22] registered
    pid_max: default: 32768 minimum: 301
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    256k L2-cache enabled
    PCIE0: Port disabled via device-tree
    PCIE1: Checking link...
    PCIE1: Device detected, waiting for link...
    PCIE1: link is up !
    PCI host bridge /plb/pciex@d20000000 (primary) ranges:
     MEM 0x0000000e80000000..0x0000000effffffff -> 0x0000000080000000
     MEM 0x0000000f00100000..0x0000000f001fffff -> 0x0000000000000000
      IO 0x0000000f80010000..0x0000000f8001ffff -> 0x0000000000000000
     Removing ISA hole at 0x0000000f00100000
    4xx PCI DMA offset set to 0x00000000
    /plb/pciex@d20000000: Legacy ISA memory support enabled
    PCIE1: successfully set as root-complex
    PCI: Probing PCI hardware
    PCI: Hiding 4xx host bridge resources 0000:80:00.0
    pci 0000:80:00.0: PCI bridge to [bus 81-bf]
    pci 0000:80:00.0: BAR 8: assigned [mem 0xe80000000-0xe800fffff]
    pci 0000:80:00.0: BAR 7: assigned [io  0x1000-0x1fff]
    pci 0000:81:00.0: BAR 4: assigned [mem 0xe80000000-0xe8001ffff]
    pci 0000:81:00.0: BAR 4: set to [mem 0xe80000000-0xe8001ffff] (PCI address [0x80000000-0x8001ffff])
    pci 0000:81:00.0: BAR 5: assigned [mem 0xe80020000-0xe80021fff]
    pci 0000:81:00.0: BAR 5: set to [mem 0xe80020000-0xe80021fff] (PCI address [0x80020000-0x80021fff])
    pci 0000:81:00.0: BAR 3: assigned [mem 0xe80022000-0xe80022fff]
    pci 0000:81:00.0: BAR 3: set to [mem 0xe80022000-0xe80022fff] (PCI address [0x80022000-0x80022fff])
    pci 0000:81:00.0: BAR 2: assigned [io  0x1000-0x10ff]
    pci 0000:81:00.0: BAR 2: set to [io  0x1000-0x10ff] (PCI address [0x1000-0x10ff])
    pci 0000:81:00.0: BAR 0: assigned [io  0x1400-0x147f]
    pci 0000:81:00.0: BAR 0: set to [io  0x1400-0x147f] (PCI address [0x1400-0x147f])
    pci 0000:80:00.0: PCI bridge to [bus 81-bf]
    pci 0000:80:00.0:   bridge window [io  0x1000-0x1fff]
    pci 0000:80:00.0:   bridge window [mem 0xe80000000-0xe800fffff]
    pci 0000:80:00.0:   bridge window [mem pref disabled]
    bio: create slab <bio-0> at 0
    Switching to clocksource timebase
    NET: Registered protocol family 2
    IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
    TCP established hash table entries: 8192 (order: 4, 65536 bytes)
    TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
    TCP: Hash tables configured (established 8192 bind 8192)
    TCP reno registered
    UDP hash table entries: 256 (order: 0, 4096 bytes)
    UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    NET: Registered protocol family 1
    failed did not find amcc, ppc460ex bcsr node
    setting trigger mode 3 for irq 43 failed (0xc0015968)
    setting trigger mode 3 for irq 43 failed (0xc0015968)
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
    msgmni has been set to 502
    io scheduler noop registered
    io scheduler deadline registered (default)
    Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
    serial8250.0: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a U6_16550A
    console [ttyS0] enabled
    serial8250.0: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a U6_16550A
    4ef600300.serial: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a 16550
    4ef600400.serial: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a 16550
    of-flash 4e0000000.nor_flash: do_map_probe() failed
    PPC 4xx OCP EMAC driver, version 3.54
    MAL v2 /plb/mcmal, 2 TX channels, 16 RX channels
    ZMII /plb/opb/emac-zmii@ef600d00 initialized
    RGMII /plb/opb/emac-rgmii@ef601500 initialized with MDIO support
    TAH /plb/opb/emac-tah@ef601350 initialized
    TAH /plb/opb/emac-tah@ef601450 initialized
    /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
    eth0: EMAC-0 /plb/opb/ethernet@ef600e00, MAC 00:01:55:31:00:e4
    eth0: found Generic MII PHY (0x00)
    /plb/opb/emac-rgmii@ef601500: input 1 in RGMII mode
    /plb/opb/ethernet@ef600f00: can't find PHY!
    TCP westwood registered
    NET: Registered protocol family 17
    802.1Q VLAN Support v1.8
    VFS: Cannot open root device "ram" or unknown-block(1,0)
    Please append a correct "root=" boot option; here are the available partitions:
    Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(1,0)
    Call Trace:
    [cf82bef0] [c0006080] 0xc0006080 (unreliable)
    [cf82bf30] [c01d96d4] 0xc01d96d4
    [cf82bf80] [c0225bd4] 0xc0225bd4
    [cf82bfd0] [c0225db0] 0xc0225db0
    [cf82bfe0] [c0225828] 0xc0225828
    [cf82bff0] [c000a8a8] 0xc000a8a8
    Rebooting in 180 seconds..
    Last edited by BadIntentions; 10-09-2011 at 08:05 AM.
    I AM NOT A PATRIOT MEMORY EMPLOYEE.

    But they have, on occasion, bribed me with hardware.



    I am happy to help, but don't PM me. Post a thread in the appropriate forum so others may benefit and offer assistance.
    Your lack of planning is not an emergency on my part.

  10. #10
    Join Date
    May 2010
    Location
    In the land of make believe.
    Posts
    505

    Default My Happy Place!

    My patches are complete, and work!

    What follows is a complete, start to finish boot of OpenWRT on the Javelin. A working ramdisk, with some basic tools to verify that i have booted into a working os!

    Code:
    U-Boot 1.3.4 (NS4600p - 015 - 800MHz) (Jan 27 2011 - 10:21:32)
    
    CPU:   AMCC PowerPC 431EXr at 800 MHz (PLB=200, OPB=100, EBC=100 MHz)
           Security/Kasumi support
           Bootstrap Option F - Boot ROM Location NAND (8 bits), booting from NAND
           Internal PCI arbiter disabled
           32 kB I-Cache 32 kB D-Cache
    Board: NS4600p - PROMISE 4-bay NAS Target Board, 1*PCIe/1*SATA
    I2C:   ready
    DRAM:  256 MB
    Enclosure: Load fan configurations from VPD
    NAND:  128 MiB
    eth0 MAC = 00:01:55:31:00:e4
    eth1 MAC = 00:00:00:00:00:00
    PCI:   Bus Dev VenId DevId Class Int
    PCIE1: successfully set as root-complex
            01  00  105a  3f20  0104  00
    SCSI:  Net:   ppc_4xx_eth0
    
    Hit Ctrl + C to stop autoboot:  0
    Leave clock generator PD mode... OK
    Leave net PHY PD mode... OK
    Turn on all activity LED power... OK
    FAN_SET mode... OK
    Turn off all status LED... OK
    Turn on disk power... OK
    => <INTERRUPT>
    => <INTERRUPT>
    => nand read.e 1a00000 dtb 3000
    
    NAND read: device 0 offset 0x100000, size 0x3000
     12288 bytes read: OK
    => tftp 1200000 uimage
    Waiting for PHY auto negotiation to complete... done
    ENET Speed is 1000 Mbps - FULL duplex connection (EMAC0)
    Using ppc_4xx_eth0 device
    TFTP from server 192.168.1.87; our IP address is 192.168.1.250
    Filename 'uimage'.
    Load address: 0x1200000
    Loading: #################################################################
             #################################################################
             #############
    done
    Bytes transferred = 2097631 (2001df hex)
    => bootm 1200000 - 1a00000
    ## Booting kernel from Legacy Image at 01200000 ...
       Image Name:   Linux-3.0.3
       Created:      2011-10-09   8:00:32 UTC
       Image Type:   PowerPC Linux Kernel Image (gzip compressed)
       Data Size:    2097567 Bytes =  2 MB
       Load Address: 00000000
       Entry Point:  00000000
       Verifying Checksum ... OK
    ## Flattened Device Tree blob at 01a00000
       Booting using the fdt blob at 0x1a00000
       Uncompressing Kernel Image ... OK
       Loading Device Tree to 00ffa000, end 00ffffff ... OK
    Using Canyonlands machine description
    Linux version 3.0.3 (builder@BadIntentions) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #2 Sun Oct 9 03:00:31 CDT 2011
    Zone PFN ranges:
      DMA      0x00000000 -> 0x00010000
      Normal   empty
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
        0: 0x00000000 -> 0x00010000
    MMU: Allocated 1088 bytes of context maps for 255 contexts
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
    Kernel command line: root=/dev/ram rw console=ttyS0,115200
    PID hash table entries: 1024 (order: 0, 4096 bytes)
    Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
    Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
    Memory: 255296k/262144k available (4292k kernel code, 6848k reserved, 140k data, 55k bss, 2096k init)
    Kernel virtual memory layout:
      * 0xfffdf000..0xfffff000  : fixmap
      * 0xfde00000..0xfe000000  : consistent mem
      * 0xfde00000..0xfde00000  : early ioremap
      * 0xd1000000..0xfde00000  : vmalloc & ioremap
    NR_IRQS:512
    UIC0 (32 IRQ sources) at DCR 0xc0
    UIC1 (32 IRQ sources) at DCR 0xd0
    UIC2 (32 IRQ sources) at DCR 0xe0
    UIC3 (32 IRQ sources) at DCR 0xf0
    clocksource: timebase mult[500000] shift[22] registered
    pid_max: default: 32768 minimum: 301
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    256k L2-cache enabled
    PCIE0: Port disabled via device-tree
    PCIE1: Checking link...
    PCIE1: Device detected, waiting for link...
    PCIE1: link is up !
    PCI host bridge /plb/pciex@d20000000 (primary) ranges:
     MEM 0x0000000e80000000..0x0000000effffffff -> 0x0000000080000000
     MEM 0x0000000f00100000..0x0000000f001fffff -> 0x0000000000000000
      IO 0x0000000f80010000..0x0000000f8001ffff -> 0x0000000000000000
     Removing ISA hole at 0x0000000f00100000
    4xx PCI DMA offset set to 0x00000000
    /plb/pciex@d20000000: Legacy ISA memory support enabled
    PCIE1: successfully set as root-complex
    PCI: Probing PCI hardware
    PCI: Hiding 4xx host bridge resources 0000:80:00.0
    pci 0000:80:00.0: PCI bridge to [bus 81-bf]
    pci 0000:80:00.0: BAR 8: assigned [mem 0xe80000000-0xe800fffff]
    pci 0000:80:00.0: BAR 7: assigned [io  0x1000-0x1fff]
    pci 0000:81:00.0: BAR 4: assigned [mem 0xe80000000-0xe8001ffff]
    pci 0000:81:00.0: BAR 4: set to [mem 0xe80000000-0xe8001ffff] (PCI address [0x80000000-0x8001ffff])
    pci 0000:81:00.0: BAR 5: assigned [mem 0xe80020000-0xe80021fff]
    pci 0000:81:00.0: BAR 5: set to [mem 0xe80020000-0xe80021fff] (PCI address [0x80020000-0x80021fff])
    pci 0000:81:00.0: BAR 3: assigned [mem 0xe80022000-0xe80022fff]
    pci 0000:81:00.0: BAR 3: set to [mem 0xe80022000-0xe80022fff] (PCI address [0x80022000-0x80022fff])
    pci 0000:81:00.0: BAR 2: assigned [io  0x1000-0x10ff]
    pci 0000:81:00.0: BAR 2: set to [io  0x1000-0x10ff] (PCI address [0x1000-0x10ff])
    pci 0000:81:00.0: BAR 0: assigned [io  0x1400-0x147f]
    pci 0000:81:00.0: BAR 0: set to [io  0x1400-0x147f] (PCI address [0x1400-0x147f])
    pci 0000:80:00.0: PCI bridge to [bus 81-bf]
    pci 0000:80:00.0:   bridge window [io  0x1000-0x1fff]
    pci 0000:80:00.0:   bridge window [mem 0xe80000000-0xe800fffff]
    pci 0000:80:00.0:   bridge window [mem pref disabled]
    bio: create slab <bio-0> at 0
    Switching to clocksource timebase
    NET: Registered protocol family 2
    IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
    TCP established hash table entries: 8192 (order: 4, 65536 bytes)
    TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
    TCP: Hash tables configured (established 8192 bind 8192)
    TCP reno registered
    UDP hash table entries: 256 (order: 0, 4096 bytes)
    UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    NET: Registered protocol family 1
    failed did not find amcc, ppc460ex bcsr node
    setting trigger mode 3 for irq 43 failed (0xc0015968)
    setting trigger mode 3 for irq 43 failed (0xc0015968)
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
    msgmni has been set to 498
    io scheduler noop registered
    io scheduler deadline registered (default)
    Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
    serial8250.0: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a U6_16550A
    console [ttyS0] enabled
    serial8250.0: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a U6_16550A
    4ef600300.serial: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a 16550
    4ef600400.serial: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a 16550
    of-flash 4e0000000.nor_flash: do_map_probe() failed
    PPC 4xx OCP EMAC driver, version 3.54
    MAL v2 /plb/mcmal, 2 TX channels, 16 RX channels
    ZMII /plb/opb/emac-zmii@ef600d00 initialized
    RGMII /plb/opb/emac-rgmii@ef601500 initialized with MDIO support
    TAH /plb/opb/emac-tah@ef601350 initialized
    TAH /plb/opb/emac-tah@ef601450 initialized
    /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
    eth0: EMAC-0 /plb/opb/ethernet@ef600e00, MAC 00:01:55:31:00:e4
    eth0: found Generic MII PHY (0x00)
    /plb/opb/emac-rgmii@ef601500: input 1 in RGMII mode
    /plb/opb/ethernet@ef600f00: can't find PHY!
    TCP westwood registered
    NET: Registered protocol family 17
    802.1Q VLAN Support v1.8
    Freeing unused kernel memory: 2096k init
    - preinit -
    Press the [f] key and hit [enter] to enter failsafe mode
    - regular preinit -
    - init -
    
    Please press Enter to activate this console. eth0: link is up, 1000 FDX
    device eth0 entered promiscuous mode
    br-lan: port 1(eth0) entering forwarding state
    br-lan: port 1(eth0) entering forwarding state
    ip_tables: (C) 2000-2006 Netfilter Core Team
    nf_conntrack version 0.5.0 (4021 buckets, 16084 max)
    
    
    
    BusyBox v1.18.5 (2011-10-09 02:54:39 CDT) built-in shell (ash)
    Enter 'help' for a list of built-in commands.
    
      _______                     ________        __
     |       |.-----.-----.-----.|  |  |  |.----.|  |_
     |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
     |_______||   __|_____|__|__||________||__|  |____|
              |__| W I R E L E S S   F R E E D O M
     ATTITUDE ADJUSTMENT (bleeding edge, r28387) ----------
      * 1/4 oz Vodka      Pour all ingredients into mixing
      * 1/4 oz Gin        tin with ice, strain into glass.
      * 1/4 oz Amaretto
      * 1/4 oz Triple sec
      * 1/4 oz Peach schnapps
      * 1/4 oz Sour mix
      * 1 splash Cranberry juice
     -----------------------------------------------------
    root@OpenWrt:/# uname -a
    Linux OpenWrt 3.0.3 #2 Sun Oct 9 03:00:31 CDT 2011 ppc GNU/Linux
    root@OpenWrt:/#
    I have verified networking has basic functionality (must disable the bridge first)
    After configuring DNS server, the OpenWRT'd Javelin can talk to the outside world.
    Installing packages can be achived by moving overlay into ramdisk. (Temporary Only)
    USB causes a crash.
    SATA does not yet work (neither the promise controller nor the onboard controller AKA esata)

    Up next is booting from USB (kernel and everything). This shouldnt be TOO hard, given that the Javelin U-Boot bootloader apparently is okay with USB.

    If you want to boot my kernel + ramdisk, right now you will need a serial cable as described in my Console Access post, and a tftp server setup (tftpd32 is free). it is not yet for the faint of heart. Pretty soon, hopefully all you will need is a Serial cable and a USB stick for a permanent install, with failsafe back to the built in OS.
    Last edited by BadIntentions; 10-09-2011 at 09:18 AM.
    I AM NOT A PATRIOT MEMORY EMPLOYEE.

    But they have, on occasion, bribed me with hardware.



    I am happy to help, but don't PM me. Post a thread in the appropriate forum so others may benefit and offer assistance.
    Your lack of planning is not an emergency on my part.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •