Heavy duty Javelin hacking

**BadIntentions** · 07-03-2011, 03:33 AM

WOOO! Console Access. Open your Javelin, there is a 4 pin JST connector inside. Pic below. If looking from the front of the javelin, you need only remove the screw on the bottom of the unit, on the right side. Then slide the right panel forward. You will now see the main board. DO NOT ATTEMPT TO REMOVE THE MAIN BOARD! You must disassemble the chassis more to remove it without damaging it.

The 4pin JST connector is TTL level serial. You will need a converter, I use my own custom board based on the Prolific PL-2303 for development, or a bus pirate, then a cheap Nokia-compatible phone cable for my final product. If you have a cable for a PBO, its the same cable with a pin-out change. If people really want them, i might start offering 20 dollar or so prebuilt cables.

JST connectors are a pain in the ass to work with. Just buy something with the JST connector on it. I recommend this. Just attach your TTL/RS232 converter to it and you are done.

Picture below details connector. Using my picture, pin 1 is the left most pin. Pin 1 is RX, pin 3 is TX... Maybe... I dunno, I have serial port dyslexia. But its those two pins. Pin 2 is GND, pin 4 is V+. If you cross RX and TX nothing bad happens. If you cross the others, some adapters will get VERY angry and release the mystical blue smoke. So don't do it.

IMG_4698-1.JPG

Code:

U-Boot 1.3.4 (NS4600p - 015 - 800MHz) (Jan 27 2011 - 10:21:32)

CPU:   AMCC PowerPC 431EXr at 800 MHz (PLB=200, OPB=100, EBC=100 MHz)
       Security/Kasumi support
       Bootstrap Option F - Boot ROM Location NAND (8 bits), booting from NAND
       Internal PCI arbiter disabled
       32 kB I-Cache 32 kB D-Cache
Board: NS4600p - PROMISE 4-bay NAS Target Board, 1*PCIe/1*SATA
I2C:   ready
DRAM:  256 MB
Enclosure: Load fan configurations from VPD
NAND:  128 MiB
eth0 MAC = 00:01:55:XX:XX:XX
eth1 MAC = 00:00:00:00:00:00
PCI:   Bus Dev VenId DevId Class Int
PCIE1: successfully set as root-complex
        01  00  105a  3f20  0104  00
SCSI:  Net:   ppc_4xx_eth0

Hit Ctrl + C to stop autoboot:  0 
No wakeup events detected! Auto booting...
Leave clock generator PD mode... OK
Leave net PHY PD mode... OK
Turn on all activity LED power... OK
Blinking LED... OK
Turn on disk power... OK

NAND read: device 0 offset 0xca0000, size 0x300000
 3145728 bytes read: OK

NAND read: device 0 offset 0xfa0000, size 0x800000
Skipping XXXXXXXXXXXXXX
 8388608 bytes read: OK

NAND read: device 0 offset 0x100000, size 0x3000
 12288 bytes read: OK
## Booting kernel from Legacy Image at 01200000 ...
   Image Name:   Linux-2.6.32.14
   Created:      2011-01-20   4:39:31 UTC
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    2339544 Bytes =  2.2 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Loading init Ramdisk from Legacy Image at 01b00000 ...
   Image Name:   XXXXXXXXXXXXXXX
   Created:      XXXXXXXXXXXX
   Image Type:   PowerPC Linux RAMDisk Image (gzip compressed)
   Data Size:    3710713 Bytes =  3.5 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 01a00000
   Booting using the fdt blob at 0x1a00000
   Uncompressing Kernel Image ... OK
   Loading Ramdisk to 0fa71000, end 0fdfaef9 ... OK
   Loading Device Tree to 00ffa000, end 00ffffff ... OK
Using PowerPC 44x Platform machine description
<SNIPPED KERNEL BOOT BORING STUFF>

**BadIntentions** · 07-03-2011, 03:37 AM

Interesting things that have been learned so far:

I may be able to make a USB bootable alternative firmware for linux power users. I would build it on openembedded or openwrt, depending on how bored I am.

This thing has 128MB of flash, that's a lot of flash.
This thing has 256MB of ram, rather beefy for an embedded device.
The kernel compile is VERY fresh for an embedded device on the market, and its FAIRLY modern compared to many embedded devices... COOL!

**BadIntentions** · 07-03-2011, 07:17 AM

uBoot is quite fully featured on this board. Output of the help command:

Code:

=> help
?       - alias for 'help'
askenv  - get environment variables from stdin
autoscr - DEPRECATED - use "source" command instead
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
bootstrap- program the I2C bootstrap EEPROM
bootvx  - Boot vxWorks from an ELF image
burnin  - burnin system
chkdisk - Check back plate connetcion
chkloopback- Check loop back plane connection
chpart  - change active partition
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
date    - get/set/reset date & time
dcache  - enable or disable data cache
dhcp    - boot image via network using DHCP/TFTP protocol
diagnostic- diagnostic sub-system
echo    - echo args to console
eeprom  - EEPROM sub-system
erase   - erase FLASH memory
exit    - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls  - list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fdt     - flattened device tree utility commands
flinfo  - print FLASH memory information
fwversion- fwversion      - get firmware version

getdcr  - Get an AMCC PPC 4xx DCR's value
getidcr - Get a register value via indirect DCR addressing
go      - start application at address 'addr'
help    - print online help
icache  - enable or disable instruction cache
icrc32  - checksum calculation
iloop   - infinite loop on address range
imd     - i2c memory display
iminfo  - print header information for application image
imls    - list all images found in flash
imm     - i2c memory modify (auto-incrementing)
imw     - memory write (fill)
imxtract- extract a part of a multi-image
inm     - memory modify (constant address)
interrupts- enable or disable interrupts
iprobe  - probe to discover valid I2C chip addresses
irqinfo - print information about IRQs
isdram  - print SDRAM configuration information
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
loopw   - infinite write loop on address range
md      - memory display
mdc     - memory display cyclic
mii     - MII utility commands
mm      - memory modify (auto-incrementing)
mtdparts- define flash/nand partitions
mtest   - simple RAM test
mw      - memory write (fill)
mwc     - memory write cyclic
nand    - NAND sub-system
nboot   - boot from NAND device
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reginfo - print register information
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
sata    - SATA sub system
saveenv - save environment variables to persistent storage
scsi    - SCSI sub-system
scsiboot- boot from SCSI device
setdcr  - Set an AMCC PPC 4xx DCR's value
setenv  - set environment variables
setidcr - Set a register value via indirect DCR addressing
showvar - print local hushshell variables
shutdown- shutdown system
sleep   - delay execution for some time
sntp    - synchronize RTC via network
source  - run script from memory
standby - standby sub-system
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor version
vpd     - vpd sub-system
vpdcs   - vpdcs   - calculate and write vpd checksum

vpdr    - read vpd content
vpdw    - write vpd content

**BadIntentions** · 07-03-2011, 07:21 AM

Environment Var Dump

Code:

bootcmd=standby
bootdelay=0
baudrate=115200
loads_echo=
preboot=echo
netmask=
hostname=canyonlands
netdev=eth0
nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=${serverip}:${rootpath}
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs ${bootargs} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}:${netdev}:off panic=1
addtty=setenv bootargs ${bootargs} console=ttyS0,${baudrate}
addmisc=setenv bootargs ${bootargs}
initrd_high=30000000
kernel_addr_r=1000000
fdt_addr_r=1800000
ramdisk_addr_r=1900000
hostname=canyonlands
bootfile=canyonlands/uImage
ramdisk_file=canyonlands/uRamdisk
nload=tftp 200000 canyonlands/u-boot-nand.bin
nupdate=nand erase 0 100000;nand write 200000 0 100000;setenv filesize;saveenv
nupd=run nload nupdate
pciconfighost=1
pcie_mode=RP:RP
mtdids=nand0=nand0
mtdargs=setenv bootargs ${bootargs} ${mtdparts}
addramdisk=setenv bootargs ${bootargs} ramdisk_size=131072
nfsboot=run nfsargs addip addtty;nand read.e 1200000 kernel 300000;nand read.e 1a00000 dtb 3000;bootm 1200000 - 1a00000
safeboot=run ramargs addramdisk addtty mtdargs;nand read.e 1200000 safe-k 300000;nand read.e 1b00000 safe-r 800000;nand read.e 1a00000 dtb 3000;bootm 1200000 1b00000 1a00000
nandboot=run ramargs addtty mtdargs;nand read.e 1200000 kernel 300000;nand read.e 1b00000 rootfs 800000;nand read.e 1a00000 dtb 3000;bootm 1200000 1b00000 1a00000
burnin=done
ext_ready_time=25
enable_usb=echo ext_storage is $ext_storage;echo Wait $ext_ready_time seconds for device ready;sleep $ext_ready_time;usb start
enable_sata=echo ext_storage is $ext_storage;sata info
enable_ext=run enable_$ext_storage
load_ext_kernel=echo Load kernel from external storage...;ext2load $ext_storage 0:1 1200000 images/kernel
load_ext_rootfs=echo Load rootfs from external storage...;ext2load $ext_storage 0:1 1b00000 images/rootfs;
load_ext_dtb=echo Load dtb from external storage...;ext2load $ext_storage 0:1 1a00000 images/dtb
extboot=run enable_ext;run ramargs addtty;nand read.e 1200000 kernel 300000;run load_ext_rootfs;nand read.e 1a00000 dtb 3000;bootm 1200000 1b00000 1a00000
ethact=ppc_4xx_eth0
mtdparts=mtdparts=nand0:1024K(u-boot),512K(dtb),3200K(safe-k),8192K(safe-r),3072K(kernel),8576K(rootfs),16384K(usr),2048K(data),1024K(oem),86144K(app)
dynparts=done
gateway=
ipaddr=
gatewayip=
ext_storage=
bootargs=root=/dev/ram rw console=ttyS0,115200
partition=nand0,0
mtddevnum=0
mtddevname=u-boot
rootpath=
serverip=
real_bootcmd=run nandboot
ethaddr=00:01:55:XX:XX:XX
eth1addr=00:00:00:00:00:00
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 1.3.4 (NS4600p - 015 - 800MHz) (Jan 27 2011 - 10:21:32)

Environment size: 2687/131068 bytes

**BadIntentions** · 10-03-2011, 05:40 AM

So i built a fresh kernel (Linux 3.0.3) and attempted to boot it.

PowerPC boots funny compared to arm, requiring a 'dtb' file to describe the device. I have not yet gotten a boot, but i have gotten the kernel to unpack, flatten my DTB, and attempt to boot. its better than nothing i suppose....

Code:

bootm 1200000 - 1a00000
## Booting kernel from Legacy Image at 01200000 ...
   Image Name:   Linux-3.0.3
   Created:      2011-10-03   5:02:58 UTC
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    2294506 Bytes =  2.2 MB
   Load Address: 00400000
   Entry Point:  00400458
   Verifying Checksum ... OK
## Flattened Device Tree blob at 01a00000
   Booting using the fdt blob at 0x1a00000
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 00fdd000, end 00ffffff ... OK

**BadIntentions** · 10-06-2011, 06:17 AM

Good news! There IS a reset switch for the CPU, permitting the board to be reset without removing power. This makes debugging easier! It is on what would be the top left corner of the board as installed into the Javelin, Just under the top connectors solder pads. It is labelled SW3.

**BadIntentions** · 10-06-2011, 06:40 AM

It boots! Sorta...

Well, i mean, i dont have full os or anything, but i have an actual, factual booting Linux Kernel/uImage! That is 80% of the big hurdle to overcome.

Code:

=> tftp 1200000 mistake.img
Waiting for PHY auto negotiation to complete... done
ENET Speed is 1000 Mbps - FULL duplex connection (EMAC0)
Using ppc_4xx_eth0 device
TFTP from server 192.168.1.87; our IP address is 192.168.1.250
Filename 'mistake.img'.
Load address: 0x1200000
Loading: #################################################################
         #################################################################
         #################################################################
         ########################################################
done
Bytes transferred = 3670016 (380000 hex)
=> nand read.e 1a00000 dtb 3000

NAND read: device 0 offset 0x100000, size 0x3000
 12288 bytes read: OK
=> bootm 1200000 - 1a00000
## Booting kernel from Legacy Image at 01200000 ...
   Image Name:   <SNIPPED>
   Created:      <SNIPPED>
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    1234448 Bytes =  1.2 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 01a00000
   Booting using the fdt blob at 0x1a00000
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 00ffa000, end 00ffffff ... OK
Using PowerPC 44x Platform machine description
Linux version <SNIPPED>
Zone PFN ranges:
  DMA      0x00000000 -> 0x00010000
  Normal   0x00010000 -> 0x00010000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00010000
MMU: Allocated 1088 bytes of context maps for 255 contexts
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
Kernel command line: root=/dev/ram rw console=ttyS0,115200
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 256896k/262144k available (2508k kernel code, 5024k reserved, 144k data, 71k bss, 128k init)
Kernel virtual memory layout:
  * 0xffffe000..0xfffff000  : fixmap
  * 0xfde00000..0xfe000000  : consistent mem
  * 0xfde00000..0xfde00000  : early ioremap
  * 0xd1000000..0xfde00000  : vmalloc & ioremap
Hierarchical RCU implementation.
NR_IRQS:512
UIC0 (32 IRQ sources) at DCR 0xc0
UIC1 (32 IRQ sources) at DCR 0xd0
UIC2 (32 IRQ sources) at DCR 0xe0
UIC3 (32 IRQ sources) at DCR 0xf0
clocksource: timebase mult[500000] shift[22] registered
Mount-cache hash table entries: 512
NET: Registered protocol family 16
256k L2-cache enabled
PCIE0: Port disabled via device-tree
PCIE1: Checking link...
PCIE1: Device detected, waiting for link...
PCIE1: link is up !
PCI host bridge /plb/pciex@d20000000 (primary) ranges:
 MEM 0x0000000e80000000..0x0000000effffffff -> 0x0000000080000000
 MEM 0x0000000f00100000..0x0000000f001fffff -> 0x0000000000000000
  IO 0x0000000f80010000..0x0000000f8001ffff -> 0x0000000000000000
 Removing ISA hole at 0x0000000f00100000
4xx PCI DMA offset set to 0x00000000
/plb/pciex@d20000000: Legacy ISA memory support enabled
PCIE1: successfully set as root-complex
PCI: Probing PCI hardware
PCI: Hiding 4xx host bridge resources 0000:80:00.0
pci 0000:80:00.0: PCI bridge, secondary bus 0000:81
pci 0000:80:00.0:   IO window: 0x1000-0x1fff
pci 0000:80:00.0:   MEM window: 0x80000000-0x800fffff
pci 0000:80:00.0:   PREFETCH window: disabled
bio: create slab <bio-0> at 0
Switching to clocksource timebase
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
msgmni has been set to 502
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250.0: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a 16550A
console [ttyS0] enabled
serial8250.0: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a 16550A
4ef600300.serial: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a 16550
4ef600400.serial: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a 16550
of-flash 4e0000000.nor_flash: do_map_probe() failed
PPC 4xx OCP EMAC driver, version 3.54
MAL v2 /plb/mcmal, 2 TX channels, 16 RX channels
ZMII /plb/opb/emac-zmii@ef600d00 initialized
RGMII /plb/opb/emac-rgmii@ef601500 initialized with MDIO support
TAH /plb/opb/emac-tah@ef601350 initialized
TAH /plb/opb/emac-tah@ef601450 initialized
/plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
eth0: EMAC-0 /plb/opb/ethernet@ef600e00, MAC 00:01:55:31:00:e4
eth0: found Generic MII PHY (0x00)
/plb/opb/emac-rgmii@ef601500: input 1 in RGMII mode
/plb/opb/ethernet@ef600f00: can't find PHY!
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Cannot open root device "ram" or unknown-block(1,0)
Please append a correct "root=" boot option; here are the available partitions:
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(1,0)
Rebooting in 180 seconds..

Further more, it appears to detect the PCIE port, meaning the RAID controller can probably be seen.

**BadIntentions** · 10-09-2011, 06:43 AM

I have compiled a kernel completely from publicly available source, using no binary blobs or anything with a non GPL license, and have gotten it to boot... somewhat.

Why it doesnt want to output to console is beyond me, but i can reset the board, probe the console buffer and see my kernel starting to boot. Its a pretty good sign i will be able to build an alternate firmware for more advanced users...

Code:

=> md 0029b740
0029b740: 3c363e55 73696e67 20506f77 65725043    <6>Using PowerPC
0029b750: 20343478 20506c61 74666f72 6d206d61     44x Platform ma
0029b760: 6368696e 65206465 73637269 7074696f    chine descriptio
0029b770: 6e0a3c35 3e4c696e 75782076 65727369    n.<5>Linux versi
0029b780: 6f6e2032 2e362e33 322e3237 20286275    on 2.6.32.27 (bu
0029b790: 696c6465 72404261 64496e74 656e7469    ilder@BadIntenti
0029b7a0: 6f6e7329 20286763 63207665 7273696f    ons) (gcc versio
0029b7b0: 6e20342e 342e3320 28474343 29202920    n 4.4.3 (GCC) )
0029b7c0: 23312054 6875204f 63742036 2030323a    #1 Thu Oct 6 02:
0029b7d0: 31343a31 39204344 54203230 31310a3c    14:19 CDT 2011.<
0029b7e0: 373e466f 756e6420 6c656761 63792073    7>Found legacy s
0029b7f0: 65726961 6c20706f 72742030 20666f72    erial port 0 for
0029b800: 202f706c 622f6f70 622f7365 7269616c     /plb/opb/serial
0029b810: 40656636 30303330 300a3c37 3e20206d    @ef600300.<7>  m
0029b820: 656d3d34 65663630 30333030 2c207461    em=4ef600300, ta
0029b830: 6464723d 34656636 30303330 302c2069    ddr=4ef600300, i

**BadIntentions** · 10-09-2011, 08:01 AM

Even better. Porting a few of my changes to a newer kernel, i get all the way up to looking for a root to boot off of! YAY! The tool chain is PROBABLY a bit TOO bleeding edge. I am running prerelease compilers and ultra fresh linux 3.0.3. I look forward to trying to build busybox and some others with such a new implementation.

Code:

=> nand read.e 1a00000 dtb 3000

NAND read: device 0 offset 0x100000, size 0x3000
 12288 bytes read: OK
=> tftp 1200000 openwrt-ppc44x-uimage
Using ppc_4xx_eth0 device
TFTP from server 192.168.1.87; our IP address is 192.168.1.250
Filename 'openwrt-ppc44x-uimage'.
Load address: 0x1200000
Loading: #################################################################
         #################################################################
         ###############
done
Bytes transferred = 2124415 (206a7f hex)
=> bootm 1200000 - 1a00000
## Booting kernel from Legacy Image at 01200000 ...
   Image Name:   Linux-3.0.3
   Created:      2011-10-09   8:00:32 UTC
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    2124351 Bytes =  2 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 01a00000
   Booting using the fdt blob at 0x1a00000
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 00ffa000, end 00ffffff ... OK
Using Canyonlands machine description
Linux version 3.0.3 (builder@BadIntentions) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #1 Sun Oct 9 02:57:48 CDT 2011
Zone PFN ranges:
  DMA      0x00000000 -> 0x00010000
  Normal   empty
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00010000
MMU: Allocated 1088 bytes of context maps for 255 contexts
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
Kernel command line: root=/dev/ram rw console=ttyS0,115200
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 257264k/262144k available (2324k kernel code, 4880k reserved, 140k data, 55k bss, 128k init)
Kernel virtual memory layout:
  * 0xfffdf000..0xfffff000  : fixmap
  * 0xfde00000..0xfe000000  : consistent mem
  * 0xfde00000..0xfde00000  : early ioremap
  * 0xd1000000..0xfde00000  : vmalloc & ioremap
NR_IRQS:512
UIC0 (32 IRQ sources) at DCR 0xc0
UIC1 (32 IRQ sources) at DCR 0xd0
UIC2 (32 IRQ sources) at DCR 0xe0
UIC3 (32 IRQ sources) at DCR 0xf0
clocksource: timebase mult[500000] shift[22] registered
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
256k L2-cache enabled
PCIE0: Port disabled via device-tree
PCIE1: Checking link...
PCIE1: Device detected, waiting for link...
PCIE1: link is up !
PCI host bridge /plb/pciex@d20000000 (primary) ranges:
 MEM 0x0000000e80000000..0x0000000effffffff -> 0x0000000080000000
 MEM 0x0000000f00100000..0x0000000f001fffff -> 0x0000000000000000
  IO 0x0000000f80010000..0x0000000f8001ffff -> 0x0000000000000000
 Removing ISA hole at 0x0000000f00100000
4xx PCI DMA offset set to 0x00000000
/plb/pciex@d20000000: Legacy ISA memory support enabled
PCIE1: successfully set as root-complex
PCI: Probing PCI hardware
PCI: Hiding 4xx host bridge resources 0000:80:00.0
pci 0000:80:00.0: PCI bridge to [bus 81-bf]
pci 0000:80:00.0: BAR 8: assigned [mem 0xe80000000-0xe800fffff]
pci 0000:80:00.0: BAR 7: assigned [io  0x1000-0x1fff]
pci 0000:81:00.0: BAR 4: assigned [mem 0xe80000000-0xe8001ffff]
pci 0000:81:00.0: BAR 4: set to [mem 0xe80000000-0xe8001ffff] (PCI address [0x80000000-0x8001ffff])
pci 0000:81:00.0: BAR 5: assigned [mem 0xe80020000-0xe80021fff]
pci 0000:81:00.0: BAR 5: set to [mem 0xe80020000-0xe80021fff] (PCI address [0x80020000-0x80021fff])
pci 0000:81:00.0: BAR 3: assigned [mem 0xe80022000-0xe80022fff]
pci 0000:81:00.0: BAR 3: set to [mem 0xe80022000-0xe80022fff] (PCI address [0x80022000-0x80022fff])
pci 0000:81:00.0: BAR 2: assigned [io  0x1000-0x10ff]
pci 0000:81:00.0: BAR 2: set to [io  0x1000-0x10ff] (PCI address [0x1000-0x10ff])
pci 0000:81:00.0: BAR 0: assigned [io  0x1400-0x147f]
pci 0000:81:00.0: BAR 0: set to [io  0x1400-0x147f] (PCI address [0x1400-0x147f])
pci 0000:80:00.0: PCI bridge to [bus 81-bf]
pci 0000:80:00.0:   bridge window [io  0x1000-0x1fff]
pci 0000:80:00.0:   bridge window [mem 0xe80000000-0xe800fffff]
pci 0000:80:00.0:   bridge window [mem pref disabled]
bio: create slab <bio-0> at 0
Switching to clocksource timebase
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
failed did not find amcc, ppc460ex bcsr node
setting trigger mode 3 for irq 43 failed (0xc0015968)
setting trigger mode 3 for irq 43 failed (0xc0015968)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 502
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250.0: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a U6_16550A
console [ttyS0] enabled
serial8250.0: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a U6_16550A
4ef600300.serial: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a 16550
4ef600400.serial: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a 16550
of-flash 4e0000000.nor_flash: do_map_probe() failed
PPC 4xx OCP EMAC driver, version 3.54
MAL v2 /plb/mcmal, 2 TX channels, 16 RX channels
ZMII /plb/opb/emac-zmii@ef600d00 initialized
RGMII /plb/opb/emac-rgmii@ef601500 initialized with MDIO support
TAH /plb/opb/emac-tah@ef601350 initialized
TAH /plb/opb/emac-tah@ef601450 initialized
/plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
eth0: EMAC-0 /plb/opb/ethernet@ef600e00, MAC 00:01:55:31:00:e4
eth0: found Generic MII PHY (0x00)
/plb/opb/emac-rgmii@ef601500: input 1 in RGMII mode
/plb/opb/ethernet@ef600f00: can't find PHY!
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8
VFS: Cannot open root device "ram" or unknown-block(1,0)
Please append a correct "root=" boot option; here are the available partitions:
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(1,0)
Call Trace:
[cf82bef0] [c0006080] 0xc0006080 (unreliable)
[cf82bf30] [c01d96d4] 0xc01d96d4
[cf82bf80] [c0225bd4] 0xc0225bd4
[cf82bfd0] [c0225db0] 0xc0225db0
[cf82bfe0] [c0225828] 0xc0225828
[cf82bff0] [c000a8a8] 0xc000a8a8
Rebooting in 180 seconds..

**BadIntentions** · 10-09-2011, 08:44 AM

My patches are complete, and work!

What follows is a complete, start to finish boot of OpenWRT on the Javelin. A working ramdisk, with some basic tools to verify that i have booted into a working os!

Code:

U-Boot 1.3.4 (NS4600p - 015 - 800MHz) (Jan 27 2011 - 10:21:32)

CPU:   AMCC PowerPC 431EXr at 800 MHz (PLB=200, OPB=100, EBC=100 MHz)
       Security/Kasumi support
       Bootstrap Option F - Boot ROM Location NAND (8 bits), booting from NAND
       Internal PCI arbiter disabled
       32 kB I-Cache 32 kB D-Cache
Board: NS4600p - PROMISE 4-bay NAS Target Board, 1*PCIe/1*SATA
I2C:   ready
DRAM:  256 MB
Enclosure: Load fan configurations from VPD
NAND:  128 MiB
eth0 MAC = 00:01:55:31:00:e4
eth1 MAC = 00:00:00:00:00:00
PCI:   Bus Dev VenId DevId Class Int
PCIE1: successfully set as root-complex
        01  00  105a  3f20  0104  00
SCSI:  Net:   ppc_4xx_eth0

Hit Ctrl + C to stop autoboot:  0
Leave clock generator PD mode... OK
Leave net PHY PD mode... OK
Turn on all activity LED power... OK
FAN_SET mode... OK
Turn off all status LED... OK
Turn on disk power... OK
=> <INTERRUPT>
=> <INTERRUPT>
=> nand read.e 1a00000 dtb 3000

NAND read: device 0 offset 0x100000, size 0x3000
 12288 bytes read: OK
=> tftp 1200000 uimage
Waiting for PHY auto negotiation to complete... done
ENET Speed is 1000 Mbps - FULL duplex connection (EMAC0)
Using ppc_4xx_eth0 device
TFTP from server 192.168.1.87; our IP address is 192.168.1.250
Filename 'uimage'.
Load address: 0x1200000
Loading: #################################################################
         #################################################################
         #############
done
Bytes transferred = 2097631 (2001df hex)
=> bootm 1200000 - 1a00000
## Booting kernel from Legacy Image at 01200000 ...
   Image Name:   Linux-3.0.3
   Created:      2011-10-09   8:00:32 UTC
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    2097567 Bytes =  2 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 01a00000
   Booting using the fdt blob at 0x1a00000
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 00ffa000, end 00ffffff ... OK
Using Canyonlands machine description
Linux version 3.0.3 (builder@BadIntentions) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #2 Sun Oct 9 03:00:31 CDT 2011
Zone PFN ranges:
  DMA      0x00000000 -> 0x00010000
  Normal   empty
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00010000
MMU: Allocated 1088 bytes of context maps for 255 contexts
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
Kernel command line: root=/dev/ram rw console=ttyS0,115200
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 255296k/262144k available (4292k kernel code, 6848k reserved, 140k data, 55k bss, 2096k init)
Kernel virtual memory layout:
  * 0xfffdf000..0xfffff000  : fixmap
  * 0xfde00000..0xfe000000  : consistent mem
  * 0xfde00000..0xfde00000  : early ioremap
  * 0xd1000000..0xfde00000  : vmalloc & ioremap
NR_IRQS:512
UIC0 (32 IRQ sources) at DCR 0xc0
UIC1 (32 IRQ sources) at DCR 0xd0
UIC2 (32 IRQ sources) at DCR 0xe0
UIC3 (32 IRQ sources) at DCR 0xf0
clocksource: timebase mult[500000] shift[22] registered
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
256k L2-cache enabled
PCIE0: Port disabled via device-tree
PCIE1: Checking link...
PCIE1: Device detected, waiting for link...
PCIE1: link is up !
PCI host bridge /plb/pciex@d20000000 (primary) ranges:
 MEM 0x0000000e80000000..0x0000000effffffff -> 0x0000000080000000
 MEM 0x0000000f00100000..0x0000000f001fffff -> 0x0000000000000000
  IO 0x0000000f80010000..0x0000000f8001ffff -> 0x0000000000000000
 Removing ISA hole at 0x0000000f00100000
4xx PCI DMA offset set to 0x00000000
/plb/pciex@d20000000: Legacy ISA memory support enabled
PCIE1: successfully set as root-complex
PCI: Probing PCI hardware
PCI: Hiding 4xx host bridge resources 0000:80:00.0
pci 0000:80:00.0: PCI bridge to [bus 81-bf]
pci 0000:80:00.0: BAR 8: assigned [mem 0xe80000000-0xe800fffff]
pci 0000:80:00.0: BAR 7: assigned [io  0x1000-0x1fff]
pci 0000:81:00.0: BAR 4: assigned [mem 0xe80000000-0xe8001ffff]
pci 0000:81:00.0: BAR 4: set to [mem 0xe80000000-0xe8001ffff] (PCI address [0x80000000-0x8001ffff])
pci 0000:81:00.0: BAR 5: assigned [mem 0xe80020000-0xe80021fff]
pci 0000:81:00.0: BAR 5: set to [mem 0xe80020000-0xe80021fff] (PCI address [0x80020000-0x80021fff])
pci 0000:81:00.0: BAR 3: assigned [mem 0xe80022000-0xe80022fff]
pci 0000:81:00.0: BAR 3: set to [mem 0xe80022000-0xe80022fff] (PCI address [0x80022000-0x80022fff])
pci 0000:81:00.0: BAR 2: assigned [io  0x1000-0x10ff]
pci 0000:81:00.0: BAR 2: set to [io  0x1000-0x10ff] (PCI address [0x1000-0x10ff])
pci 0000:81:00.0: BAR 0: assigned [io  0x1400-0x147f]
pci 0000:81:00.0: BAR 0: set to [io  0x1400-0x147f] (PCI address [0x1400-0x147f])
pci 0000:80:00.0: PCI bridge to [bus 81-bf]
pci 0000:80:00.0:   bridge window [io  0x1000-0x1fff]
pci 0000:80:00.0:   bridge window [mem 0xe80000000-0xe800fffff]
pci 0000:80:00.0:   bridge window [mem pref disabled]
bio: create slab <bio-0> at 0
Switching to clocksource timebase
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
failed did not find amcc, ppc460ex bcsr node
setting trigger mode 3 for irq 43 failed (0xc0015968)
setting trigger mode 3 for irq 43 failed (0xc0015968)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 498
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250.0: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a U6_16550A
console [ttyS0] enabled
serial8250.0: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a U6_16550A
4ef600300.serial: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a 16550
4ef600400.serial: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a 16550
of-flash 4e0000000.nor_flash: do_map_probe() failed
PPC 4xx OCP EMAC driver, version 3.54
MAL v2 /plb/mcmal, 2 TX channels, 16 RX channels
ZMII /plb/opb/emac-zmii@ef600d00 initialized
RGMII /plb/opb/emac-rgmii@ef601500 initialized with MDIO support
TAH /plb/opb/emac-tah@ef601350 initialized
TAH /plb/opb/emac-tah@ef601450 initialized
/plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
eth0: EMAC-0 /plb/opb/ethernet@ef600e00, MAC 00:01:55:31:00:e4
eth0: found Generic MII PHY (0x00)
/plb/opb/emac-rgmii@ef601500: input 1 in RGMII mode
/plb/opb/ethernet@ef600f00: can't find PHY!
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8
Freeing unused kernel memory: 2096k init
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
- init -

Please press Enter to activate this console. eth0: link is up, 1000 FDX
device eth0 entered promiscuous mode
br-lan: port 1(eth0) entering forwarding state
br-lan: port 1(eth0) entering forwarding state
ip_tables: (C) 2000-2006 Netfilter Core Team
nf_conntrack version 0.5.0 (4021 buckets, 16084 max)



BusyBox v1.18.5 (2011-10-09 02:54:39 CDT) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 ATTITUDE ADJUSTMENT (bleeding edge, r28387) ----------
  * 1/4 oz Vodka      Pour all ingredients into mixing
  * 1/4 oz Gin        tin with ice, strain into glass.
  * 1/4 oz Amaretto
  * 1/4 oz Triple sec
  * 1/4 oz Peach schnapps
  * 1/4 oz Sour mix
  * 1 splash Cranberry juice
 -----------------------------------------------------
root@OpenWrt:/# uname -a
Linux OpenWrt 3.0.3 #2 Sun Oct 9 03:00:31 CDT 2011 ppc GNU/Linux
root@OpenWrt:/#

I have verified networking has basic functionality (must disable the bridge first)
After configuring DNS server, the OpenWRT'd Javelin can talk to the outside world.
Installing packages can be achived by moving overlay into ramdisk. (Temporary Only)
USB causes a crash.
SATA does not yet work (neither the promise controller nor the onboard controller AKA esata)

Up next is booting from USB (kernel and everything). This shouldnt be TOO hard, given that the Javelin U-Boot bootloader apparently is okay with USB.

If you want to boot my kernel + ramdisk, right now you will need a serial cable as described in my Console Access post, and a tftp server setup (tftpd32 is free). it is not yet for the faint of heart. Pretty soon, hopefully all you will need is a Serial cable and a USB stick for a permanent install, with failsafe back to the built in OS.

Thread: Heavy duty Javelin hacking

Thread Tools

Display

Heavy duty Javelin hacking

My Happy Place!

Posting Permissions