AR7 with Intel flash - bootloader needed

[rokafeller]

Hi all,

I'm making some experiments on an AG300 Linksys box (here the details) got for free that natively runs PSP bootloader with all servers disabled (ie. no ftp connection at boot) and has a very restricted Busybox edition, not allowing to backup anything (tried a lot of different ways to save mtd partitions somewhere but with no success).

What I'm looking for is a PSP bootloader or ADAM2 bootloader compatible with Intel flash chip. Many of the links I find on the internet are broken, and still point to AMD compatible bootloaders. Would you have any Intel-compatible bootloader for AR7 to share?
(of course I have a JTAG available)

thanks a lot,
g

[thechief]

8mb flash and 32mb RAM. I don't think any RouterTech kernel supports that - even if you can get a bootloader that is compatible. Intel flash can be very problematic, and so I wouldn't hold out much hope for you.

I could easily build a pspboot image for Intel flash, and for 8mb/32mb flash/RAM. Whether it would work is another matter. More likely than not, you would get an almighty brick that requires JTAG to recover. If you are feeling brave enough, then let me know. But I disclaim all responsibility for trashing your router if that happens (which is more likely than not).

[rokafeller]

no worries about bricking it, I didn't pay for it and I'll trash it anyway if I can't put an alternative firmware on it.
JTAG and serial are there, so a pspboot image for intel would be very welcome.. then I'll share the outcome of my tests

thanks
g

[thechief]

Ok, see the attached. It contains one Adam2 image, and two pspboot images. Let's hope that one of them works for you. The difference between the two pspboot images is that one of them has some sensible mtd defaults for RT 1350A 2.97 wireless firmwares.

All disclaimers apply.

[rokafeller]

Very much appreciated.. as soon as I have some results, I'll post them.

cheers
g.

[rokafeller]

mm, I'm experiencing some weird issues with JTAG.
Using Ciclamab and tjtag3 I basically can read what's on chip, but can't write on it. As soon as I launch a write operation, both programs hang.

The JTAG interface used to work, and the wiring looks fine (Xilinx). Anyone ever encountered AR7 write-disabled chips?

[thechief]

Perhaps something different is needed in the wiring? Is it possible to have write-disabled chips? How do you then upgrade the firmware at all.

[rokafeller]

I managed to eventually flash the memory. I don't know which was the problem; Ciclamab still doesn't work but with the attached version of tjtag (got it from here, the Routertech version) I can write on flash with this command:

Code: Select all

rtjtagwin32.exe -erase:custom /window:90000000 /start:90000000 /length:30000 /wiggler

using a simplified wiggler (aka very poorman jtag interface - http://ciclamab.altervista.org/hard_corpo_jtag.htm).

After flashing the psbl_8M_32M_intel_AR7WRD_1.4.0.10.bin, the AG300 still doesn't come back alive. Before trying the other bins.. do I have to restore an mtd3 backup for the bootloader to work? or is it supposed to boot even without the mtd3 ie. creating a new one with default settings?

thanks
g.

[thechief]

The bootloader will create a new default environment (i.e., if it is working at all). If you have a serial console, you should be able to see what is happening. Perhaps the bootloader is not properly written to the flash at all.

[mstombs]

I guess that JTAG software is the same as in this thread

viewtopic.php?f=19&t=3732

I have never used in in wiggler mode (but original tjtag supported that).

I'd be interested to know the original size of bootloader and flash organisation, it is possible the minimum writable size (the flash erase block sector size) is bigger than the 64kB we are used to in RouterTech compatible AR7 routers.

The OpenWRT wiki seems to suggest the minimum size for the bootloader mtd2 and config mtd3 are 128kB, but mtd3 is at the end of the flash in adam2 mode, mtd4 is not the full single imade firmware that we are used to!

Code: Select all

Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit mode
Looking for mtd device :mtd0:
Found a mtd0 image (0xe0000), with size (0x6e0000).
Looking for mtd device :mtd1:
Found a mtd1 image (0x20000), with size (0x7a0000).
Looking for mtd device :mtd2:
Found a mtd2 image (0x0), with size (0x20000).
Looking for mtd device :mtd3:
Found a mtd3 image (0x7e0000), with size (0x20000).
Looking for mtd device :mtd4:
Found a mtd4 image (0x7c0000), with size (0x20000).
Looking for mtd device :mtd5:
Creating 5 MTD partitions on "Physically mapped flash":
0x000e0000-0x007c0000 : "mtd0"
0x00020000-0x007c0000 : "mtd1"
0x00000000-0x00020000 : "mtd2"
0x007e0000-0x00800000 : "mtd3"
0x007c0000-0x007e0000 : "mtd4"

[rokafeller]

here the details grabbed from the original psp bootloader, (attachment you have the full printenv result):

Code: Select all

mtd0            0x900e0000,0x907c0000
mtd1            0x90020000,0x907c0000
mtd2            0x90000000,0x90020000
mtd3            0x907e0000,0x90800000
mtd4            0x907c0000,0x907e0000

mtd2 looks to be suited for a 128Kb bootloader. So far I basically tried all the bootloader images I found with no success.
On this website http://www.digriz.org.uk/wag54g there is a guy who successfully reprogrammed a LInksys WAG54G - which should be the AG300 with WiFi, and also posted his original ADAM2 bootloader which I tried but didn't work.
That page is btw interesting because it shows how to connect to a microprocessor through JTAG with a hardware debugging (OpenOCD) tool, which is quite powerful if you know how to deal with it. He used a fancy (and expensive) interface, if anyone is interested I can post how to configure OpenOCD to use the Wiggler JTAG interface.

Using this tool, I could check the program counter (= the register pointing to the address of the currently executed instruction) and see that the boot process hangs at a very early stage. Interesting enough, but still don't understand why these drats bootloaders don't work.

I have two open points here:

• does the bootloader need to find a properly flashed mtd3 partition (ie. the config) to boot?
• flash compatibility. on older G3x0T it's documented that ADAM2 bootloaders for AMD flash chips were running with Intel chips, which prevented flash overwriting but allowed to boot. How mandatory is to have a bootloader consistent with flash for ADAM2 and PSP?

thanks
g

[rokafeller]

interestingly enough, using OpenOCD, this is how the flash is configured:

Code: Select all

> flash info 0
#0 : cfi at 0x90000000, size 0x00800000, buswidth 2, chipwidth 2
        #  0: 0x00000000 (0x20000 128kB) protected
        #  1: 0x00020000 (0x20000 128kB) not protected
        #  2: 0x00040000 (0x20000 128kB) not protected
        #  3: 0x00060000 (0x20000 128kB) not protected

apparently the bootloader memory segment 0x00000000 - 0x00020000 is write protected. I don't know exactly what this might mean, because I could actually flash it using tjtag (and if I dump it, the content matches the bin image loaded). Anyway, I'm going to unprotect this segment and see what happens..

[thechief]

All this is a bit too technical for me. But in the attached are 128kb psp bootloader images. Perhaps they will help ...

[rokafeller]

thanks for the help provided so far. Unfortunately none of the bootloaders posted worked. I tried several other bootloaders found around (both PSP and ADAM2) with no luck. Unfortunately I don't have enough knowledge about bootloaders to understant if there is still something that can be tweaked using an hex editor to get a bootloader work.

Just one question for The Chief: are you actually compiling the bootloaders shared above or do they come from actual dumps?

thanks again
g

[thechief]

I am compiling the bootloaders. I don't think I'm allowed to make the sources public though (but if you look hard enough on the net, you will find them). I don't remember now whether the 128kb bootloader is also compiled with 128kb for mtd3 - I'll have to check that later tonight.

You say that the bootloaders don't work, but you haven't told us what you are seeing at the serial console - are you seeing anything at all, or is it all just blank?