Re: [LEDE-DEV] VRV9510KWAC23
Thank you for your response, Here you can find some pictures of the board. I can send high res ones if still needed http://www.redeszone.net/orange/livebox-next/ Yes lan is working at lease in the first port. I can use tftp with it without problems. I tried to boot the kernel via tftp but got locked because could not find the root fs on flash. On Fri, Oct 7, 2016 at 8:10 AM, Sylwek Petela wrote: > Can You post some hi rez pictures of board ? > > LAN is working on my U-Boot ? > > > Regards > > Sylwek/ScApi > > > W dniu 2016-10-04 o 21:59, Juan Rios pisze: >> >> Hello again. Thanks to borderline at >> >> http://foro.seguridadwireless.net/openwrt/(desarrollo)-openwrt-en-livevox-next-(astoria-networks-vrv9510)/ >> I could install the ZyXEL P-2812HNU-F1 uboot and I can boot into it. >> >> What I did was shortcut the flash pins like described here >> https://wiki.openwrt.org/toh/arcadyan/arv7519#bootloader_hack till I >> got the VR9 prompt and >> then used U -> 0 and uploaded via xmodem the file >> >> https://github.com/ScApi/P2812HNUFx-Pre-Build/blob/OpenWrt-Designated-Driver-r47026/F1%20OpenWRT/uboot-lantiq-p2812hnufx_nandtpl/openwrt-lantiq-p2812hnufx_nandtpl-u-boot.img >> >> With that installed this is the bootlog >> >> ROM VER: 1.1.4 >> CFG 06 >> NAND >> NAND Read OK >> >> U-Boot SPL 2013.10-openwrt5 (Nov 18 2014 - 19:54:01) >> SPL: initializing NAND flash >> SPL: checking U-Boot image >> SPL: loading U-Boot to RAM >> SPL: decompressing U-Boot with LZO >> SPL: jumping to U-Boot >> >> >> U-Boot 2013.10-openwrt5 (Nov 18 2014 - 19:54:01) P-2812HNU-Fx >> >> Board: ZyXEL P-2812HNU-Fx >> SoC: Lantiq VRX288 v1.2 >> CPU: 500 MHz >> IO:250 MHz >> BUS: 250 MHz >> BOOT: NAND >> DRAM: 256 MiB >> NAND: 128 MiB >> *** Warning - bad CRC, using default environment >> >> In:serial >> Out: serial >> Err: serial >> Net: ltq-eth >> Hit any key to stop autoboot: 0 >> Wrong Image Format for bootm command >> ERROR: can't get kernel image! >> P-2812HNU-Fx # >> >> >> How can I get the information to make a proper .dts file for this >> device ? The layout of the flash for the P-2812HNU-Fx has nothing to >> do with this device. >> >> >> --- >> AreaAddress Length >> --- >> [0] Boot0x1024K >> [1] Image 0 0x0010 10240K >> [2] Image 1 0x00B0 10240K >> [3] Configuration 0x01502048K >> [4] Boot Params 0x01702048K >> [5] Nvram 0x01901024K >> [6] Cert0x01A0 32768K >> [7] EmergencyValue 0x03A06144K >> [8] Configuration2 0x04002048K >> [9] All area0x 67584K >> >> On Mon, Aug 29, 2016 at 10:49 PM, Mathias Kresin wrote: >>> >>> 28.08.2016 13:24, Mathias Kresin: >>> Am 28.08.2016 um 12:15 schrieb Hauke Mehrtens: > > On 08/28/2016 10:31 AM, Mathias Kresin wrote: >> >> Am 27.08.2016 um 19:44 schrieb Juan Rios: >>> >>> I can load to memory using xmodem transfer and run but all I tried >>> get >>> locked without any output. > > > Have you tried the kenrel with both serial interfaces? The SoC supports > two and I do not know which on is used on your hardware. > > @Mathias is it normal that this does not work? Mhh, I've missed that part of Juans mail. It's not clear to me what Juan tried to load and run from ram. Loadx and run the kernel from ram is a brilliant idea. Albeit I've done it dozen times with u-boot, I never considered doing the same with brnboot. I might have some time later the day to give it a try. >>> >>> >>> I couldn't manage to start an uncompressed LEDE kernel from ram. I've >>> tried >>> kernels with brncmdline and without. But the router immediately resets >>> itself. >>> >>> Running the uncompressed recovery kernel from ram worked however. >>> >>> Mathias >>> >> ___ >> Lede-dev mailing list >> Lede-dev@lists.infradead.org >> http://lists.infradead.org/mailman/listinfo/lede-dev > > > > ___ > Lede-dev mailing list > Lede-dev@lists.infradead.org > http://lists.infradead.org/mailman/listinfo/lede-dev ___ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/lede-dev
Re: [LEDE-DEV] VRV9510KWAC23
Can You post some hi rez pictures of board ? LAN is working on my U-Boot ? Regards Sylwek/ScApi W dniu 2016-10-04 o 21:59, Juan Rios pisze: Hello again. Thanks to borderline at http://foro.seguridadwireless.net/openwrt/(desarrollo)-openwrt-en-livevox-next-(astoria-networks-vrv9510)/ I could install the ZyXEL P-2812HNU-F1 uboot and I can boot into it. What I did was shortcut the flash pins like described here https://wiki.openwrt.org/toh/arcadyan/arv7519#bootloader_hack till I got the VR9 prompt and then used U -> 0 and uploaded via xmodem the file https://github.com/ScApi/P2812HNUFx-Pre-Build/blob/OpenWrt-Designated-Driver-r47026/F1%20OpenWRT/uboot-lantiq-p2812hnufx_nandtpl/openwrt-lantiq-p2812hnufx_nandtpl-u-boot.img With that installed this is the bootlog ROM VER: 1.1.4 CFG 06 NAND NAND Read OK U-Boot SPL 2013.10-openwrt5 (Nov 18 2014 - 19:54:01) SPL: initializing NAND flash SPL: checking U-Boot image SPL: loading U-Boot to RAM SPL: decompressing U-Boot with LZO SPL: jumping to U-Boot U-Boot 2013.10-openwrt5 (Nov 18 2014 - 19:54:01) P-2812HNU-Fx Board: ZyXEL P-2812HNU-Fx SoC: Lantiq VRX288 v1.2 CPU: 500 MHz IO:250 MHz BUS: 250 MHz BOOT: NAND DRAM: 256 MiB NAND: 128 MiB *** Warning - bad CRC, using default environment In:serial Out: serial Err: serial Net: ltq-eth Hit any key to stop autoboot: 0 Wrong Image Format for bootm command ERROR: can't get kernel image! P-2812HNU-Fx # How can I get the information to make a proper .dts file for this device ? The layout of the flash for the P-2812HNU-Fx has nothing to do with this device. --- AreaAddress Length --- [0] Boot0x1024K [1] Image 0 0x0010 10240K [2] Image 1 0x00B0 10240K [3] Configuration 0x01502048K [4] Boot Params 0x01702048K [5] Nvram 0x01901024K [6] Cert0x01A0 32768K [7] EmergencyValue 0x03A06144K [8] Configuration2 0x04002048K [9] All area0x 67584K On Mon, Aug 29, 2016 at 10:49 PM, Mathias Kresin wrote: 28.08.2016 13:24, Mathias Kresin: Am 28.08.2016 um 12:15 schrieb Hauke Mehrtens: On 08/28/2016 10:31 AM, Mathias Kresin wrote: Am 27.08.2016 um 19:44 schrieb Juan Rios: I can load to memory using xmodem transfer and run but all I tried get locked without any output. Have you tried the kenrel with both serial interfaces? The SoC supports two and I do not know which on is used on your hardware. @Mathias is it normal that this does not work? Mhh, I've missed that part of Juans mail. It's not clear to me what Juan tried to load and run from ram. Loadx and run the kernel from ram is a brilliant idea. Albeit I've done it dozen times with u-boot, I never considered doing the same with brnboot. I might have some time later the day to give it a try. I couldn't manage to start an uncompressed LEDE kernel from ram. I've tried kernels with brncmdline and without. But the router immediately resets itself. Running the uncompressed recovery kernel from ram worked however. Mathias ___ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/lede-dev ___ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/lede-dev
Re: [LEDE-DEV] VRV9510KWAC23
Hello again. Thanks to borderline at http://foro.seguridadwireless.net/openwrt/(desarrollo)-openwrt-en-livevox-next-(astoria-networks-vrv9510)/ I could install the ZyXEL P-2812HNU-F1 uboot and I can boot into it. What I did was shortcut the flash pins like described here https://wiki.openwrt.org/toh/arcadyan/arv7519#bootloader_hack till I got the VR9 prompt and then used U -> 0 and uploaded via xmodem the file https://github.com/ScApi/P2812HNUFx-Pre-Build/blob/OpenWrt-Designated-Driver-r47026/F1%20OpenWRT/uboot-lantiq-p2812hnufx_nandtpl/openwrt-lantiq-p2812hnufx_nandtpl-u-boot.img With that installed this is the bootlog ROM VER: 1.1.4 CFG 06 NAND NAND Read OK U-Boot SPL 2013.10-openwrt5 (Nov 18 2014 - 19:54:01) SPL: initializing NAND flash SPL: checking U-Boot image SPL: loading U-Boot to RAM SPL: decompressing U-Boot with LZO SPL: jumping to U-Boot U-Boot 2013.10-openwrt5 (Nov 18 2014 - 19:54:01) P-2812HNU-Fx Board: ZyXEL P-2812HNU-Fx SoC: Lantiq VRX288 v1.2 CPU: 500 MHz IO:250 MHz BUS: 250 MHz BOOT: NAND DRAM: 256 MiB NAND: 128 MiB *** Warning - bad CRC, using default environment In:serial Out: serial Err: serial Net: ltq-eth Hit any key to stop autoboot: 0 Wrong Image Format for bootm command ERROR: can't get kernel image! P-2812HNU-Fx # How can I get the information to make a proper .dts file for this device ? The layout of the flash for the P-2812HNU-Fx has nothing to do with this device. --- AreaAddress Length --- [0] Boot0x1024K [1] Image 0 0x0010 10240K [2] Image 1 0x00B0 10240K [3] Configuration 0x01502048K [4] Boot Params 0x01702048K [5] Nvram 0x01901024K [6] Cert0x01A0 32768K [7] EmergencyValue 0x03A06144K [8] Configuration2 0x04002048K [9] All area0x 67584K On Mon, Aug 29, 2016 at 10:49 PM, Mathias Kresin wrote: > 28.08.2016 13:24, Mathias Kresin: > >> Am 28.08.2016 um 12:15 schrieb Hauke Mehrtens: >>> >>> On 08/28/2016 10:31 AM, Mathias Kresin wrote: Am 27.08.2016 um 19:44 schrieb Juan Rios: > > I can load to memory using xmodem transfer and run but all I tried get > locked without any output. >>> >>> >>> Have you tried the kenrel with both serial interfaces? The SoC supports >>> two and I do not know which on is used on your hardware. >>> >>> @Mathias is it normal that this does not work? >> >> >> Mhh, I've missed that part of Juans mail. It's not clear to me what Juan >> tried to load and run from ram. >> >> Loadx and run the kernel from ram is a brilliant idea. Albeit I've done >> it dozen times with u-boot, I never considered doing the same with >> brnboot. >> >> I might have some time later the day to give it a try. > > > I couldn't manage to start an uncompressed LEDE kernel from ram. I've tried > kernels with brncmdline and without. But the router immediately resets > itself. > > Running the uncompressed recovery kernel from ram worked however. > > Mathias > ___ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/lede-dev
Re: [LEDE-DEV] VRV9510KWAC23
28.08.2016 13:24, Mathias Kresin: Am 28.08.2016 um 12:15 schrieb Hauke Mehrtens: On 08/28/2016 10:31 AM, Mathias Kresin wrote: Am 27.08.2016 um 19:44 schrieb Juan Rios: I can load to memory using xmodem transfer and run but all I tried get locked without any output. Have you tried the kenrel with both serial interfaces? The SoC supports two and I do not know which on is used on your hardware. @Mathias is it normal that this does not work? Mhh, I've missed that part of Juans mail. It's not clear to me what Juan tried to load and run from ram. Loadx and run the kernel from ram is a brilliant idea. Albeit I've done it dozen times with u-boot, I never considered doing the same with brnboot. I might have some time later the day to give it a try. I couldn't manage to start an uncompressed LEDE kernel from ram. I've tried kernels with brncmdline and without. But the router immediately resets itself. Running the uncompressed recovery kernel from ram worked however. Mathias smime.p7s Description: S/MIME Cryptographic Signature ___ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/lede-dev
Re: [LEDE-DEV] VRV9510KWAC23
Thanks for your help The oem boot log, oem boot log with uart output enabled in config and the recovery boot is included... I tried several images from ARV7519RW22 because is the previous model but this one is NOR. Also tried with EASY80920NAND and P2812HNUF1 but this ones not tried the initramfs. Now I am compiling the EASY80920NAND to get the initramfs but not sure about what compressions to use. Will try none, gzip and lzma. If there is anything I can try let me know. On Sun, Aug 28, 2016 at 12:24 PM, Mathias Kresin wrote: > Am 28.08.2016 um 12:15 schrieb Hauke Mehrtens: >> >> On 08/28/2016 10:31 AM, Mathias Kresin wrote: >>> >>> Am 27.08.2016 um 19:44 schrieb Juan Rios: I can load to memory using xmodem transfer and run but all I tried get locked without any output. >> >> >> Have you tried the kenrel with both serial interfaces? The SoC supports >> two and I do not know which on is used on your hardware. >> >> @Mathias is it normal that this does not work? > > > Mhh, I've missed that part of Juans mail. It's not clear to me what Juan > tried to load and run from ram. > > Loadx and run the kernel from ram is a brilliant idea. Albeit I've done it > dozen times with u-boot, I never considered doing the same with brnboot. > > I might have some time later the day to give it a try. ROM VER: 1.1.4 CFG 06 NAND NAND Read OK ROM VER: 1.1.4 CFG 06 NAND NAND Read OK DDR PARAM flash addr 170 DDR PARAM: 00142404 00142304 00566504 00566504 0700 Rev 0.3d DDR check ok... start booting... END TUNE DDR Start booting... === Wireless ADSL IAD VR9 Loader v1.00.13 build Apr 25 2014 13:12:00 Arcadyan Technology Corporation === A2x VR9 0xbe22ff1c : e71074ef 0xBf203014 : 7038 EON/Zentel NAND 128MB 3,3V 8-bit found - NAND page size: 2048 NAND oob size : 64 NAND block size : 131072 NAND page/block : 64 NAND block/chip : 1024 NAND chip size: 0x800 NAND page shift : 11 NAND page mask: 0x NAND block shift : 17 - Scan BAD Block ... BAD Block [1023] : 0x07FE data: 0x00 1 Bad Block(s) Copying boot params.DONE Enter command mode ... Get Primary to 1.Image Check from FLASH_AREA_IMAGE_1 : Unzipping firmware at 0x80002000 ... with nAREA[2][ZIP 3] [ZIP 1] done Ready to run firmware Enable UART TX Disable UART TX Enable UART TX Disable UART TX Enable UART TX RFPI before chk 07 07 00 10 10 Disable UART TX Enable UART TX VPE loader: VPE1 running successfully [KERN_ERR]ifx_pcie_wait_phy_link_up timeout ifx_pmu_set: PMU_PWDCR1 = 0x006d module 32 regid 1 regbit 0 ifx_pmu_set: Module PCIE-PHY still is being used 0 times ifx_pmu_set: Actual disabling..2 ifx_pmu_set: Module PCIE-PHY disactivated!!! ifx_pmu_set: PMU_PWDCR1 = 0x006d module 36 regid 1 regbit 4 ifx_pmu_set: Module PDI has been activated 2 times before ifx_pmu_set: PMU_PWDCR1 = 0x006c module 32 regid 1 regbit 0 ifx_pmu_set: Actual enabling.. 1 ifx_pmu_set: Module PCIE-PHY has been activated 1 times before ifx_pmu_set: PMU_PWDCR1 = 0x006c module 33 regid 1 regbit 1 ifx_pmu_set: Module PCIE-CTRL has been activated 2 times before ifx_pmu_set: PMU_PWDCR0 = 0x06110093 module 31 regid 0 regbit 31 ifx_pmu_set: Module PCIE_L0_CLK has been activated 2 times before pciauto_assign_resources : bus 1 Autoconfig PCI channel 0x80D47038 Scanning bus 01, I/O 0x1d80:0x1d90, Mem 0x1c00:0x1d00 (bus:dev:fun)= 01:00.0 Class 0280: VenID 14e4: DevID 4360 (rev 03) ifx_pcie_write_config : bus_number = 0 ifx_pcie_write_config : bus_number = 0 ifx_pcie_write_config : bus_number = 0 Memifx_pcie_write_config : bus_number = 0 ifx_pcie_write_config : bus_number = 0 at 0x1c00 [size=0x8000] ifx_pcie_write_config : bus_number = 0 ifx_pcie_write_config : bus_number = 0 ifx_pcie_write_config : bus_number = 0 ifx_pcie_write_config : bus_number = 0 === Console Debug === (1) Alert Mail Testing (3) Write Web (4) Firmware Upgrage (8) Show B0,B1 Mem pool (9) Toggle AAL5 Frame Dumping (A)ADSL (B)gSetting (c)DHCP Client (d)Dial (e)Ethernet (f)Firewall (F)FTP (g)LED (i)UPnP (l)SSL (n)NetBIOS/Printer (p)PPPoE (q)QoS (r)USB-IF Testing (s)System (t)WSC (u)USB Subsystem (U)UMTS (v)VOIP (w)Wireless (x) Exit (y) Enable SIP Packet Display (Y) Disable SIP Packet Display a(+ 20) / j(+ 10) / b(- 20) Change SIP Bandwidth (20~800) (h) Enable VOIP Bandwidth Management (H) Disable VOIP Bandwidth Management (k) Dump Tel Session Status (K) Dump Voice Session Status (,)DECT (?) Help = [Debug]: after pciauto_assign_resources ??? Scanning bus 00 pc
Re: [LEDE-DEV] VRV9510KWAC23
Am 28.08.2016 um 12:15 schrieb Hauke Mehrtens: On 08/28/2016 10:31 AM, Mathias Kresin wrote: Am 27.08.2016 um 19:44 schrieb Juan Rios: I can load to memory using xmodem transfer and run but all I tried get locked without any output. Have you tried the kenrel with both serial interfaces? The SoC supports two and I do not know which on is used on your hardware. @Mathias is it normal that this does not work? Mhh, I've missed that part of Juans mail. It's not clear to me what Juan tried to load and run from ram. Loadx and run the kernel from ram is a brilliant idea. Albeit I've done it dozen times with u-boot, I never considered doing the same with brnboot. I might have some time later the day to give it a try. ___ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/lede-dev
Re: [LEDE-DEV] VRV9510KWAC23
On 08/28/2016 10:31 AM, Mathias Kresin wrote: > Am 27.08.2016 um 19:44 schrieb Juan Rios: >> Hello, >>I managed to get this router and want to get lede on it. The >> hardware is this >> >> Lantiq VRX288 500Mhz >> 2 NANYA NT5TU128M8HE-AC 256MB RAM >> ZENTEL A501GA31ATS 8G 128MB NAND FLASH. >> Wireless 2.4Ghz BCM43222KFBG >> Wireless 5Ghz BCM4360KMLG >> VDSL/ADSL2+ XWAY VRX208 >> 5 port GB Ethernet The SoC including the DSL part is support by LEDE. > I would suggest to check whether the wireless chips are supported by any > open source driver and to decide afterwards if it's worth the time to > work further on this device. Broadcom and open source (wireless) drivers > is usually a story of pain. BCM43222KFBG is supported by b43 with ieee802.11g rates max. BCM4360KMLG is not supported by any driver in LEDE. >> I already found serial port pins and got the console log. The log is >> almost silent. I managed to get to the brnboot shell short cutting >> pins in the flash but cant do a flash dump. > > Next time please paste the serial logs anyway. Maybe someone else is > able to spot something interesting. > >> >> ERASE Flash >> --- >> AreaAddress Length >> --- >> [0] Boot0x1024K >> [1] Image 0 0x0010 10240K >> [2] Image 1 0x00B0 10240K >> [3] Configuration 0x01502048K >> [4] Boot Params 0x01702048K >> [5] Nvram 0x01901024K >> [6] Cert0x01A0 32768K >> [7] EmergencyValue 0x03A06144K >> [8] Configuration2 0x04002048K >> [9] All area0x 67584K > > I wouldn't trust this flash layout. Doesn't look right to me for a 128MB > flash chip. 128MB NAND flash chips are the cheapest NAND chips, using only 64MB is more expensive than using 128MB, 256MB NAND should already have a similar price tag as 128MB. This looks like a dual image configuration with 10MB for each image, there 128MB NAND flash is probably the cheapest solution. >> If I try to read from above address the router gets locked. >> >> I can read from certain area like memory or 0xBC00 or 0xBE00 >> but others locks the router. > > You can not access the NAND flash via the system memory addresses. It > only works for memory mapped flash like NOR. NAND is I/O mapped. > >> The boot ask for a password and continues booting. >> >> The emergency boot kernel is openwrt 10.3 > > What is a emergency boot kernel? Are you talking about the recovery web > interface you get when press and hold the reset button on power on? If > they are using OpenWrt, they have to provide the GPL sources. Ask for them! > >> I found out that short cutting R201 I get CFG 07 instead of CFG 06 so >> maybe UART Mode is R201 + R203 but not sure. Not quite sure to try >> it... > > With Lantiq SoCs in NAND boot config it should be enough to bring one of > the bootsel pins to GND to force the SoC into UART mode. > >> I can load to memory using xmodem transfer and run but all I tried get >> locked without any output. Have you tried the kenrel with both serial interfaces? The SoC supports two and I do not know which on is used on your hardware. @Mathias is it normal that this does not work? >> What I want is first dump the current content of the flash. Any ideas? > > You can try to build an ascii (UART) u-boot for this device. But this > requires the correct GPIO settings and matching memory parameters for > the RAM chip. Usually I'm extracting the RAM chip parameters from the > brnboot binary. But this seams to me a "chicken or the egg" problem here. > > What's more likely to work is to create a second stage (brnboot) u-boot > which doesn't have to do the low level chip initialisation and can be > started from the brnboot shell [1]. You can use the u-boot for the BT > HomeHub 5A [2] as a beginning and add the missing SYS_BOOT_BRN stuff > from the VGV7510KW22 [3]. This might allow you to dump the NAND from the > second stage u-boot. > > Mathias > > > [1] > https://wiki.openwrt.org/toh/arcadyan/vgv7510kw22#starting_u-boot_from_brnboot > > [2] > https://github.com/danielschwierzeck/u-boot-lantiq/commit/84581834622d6e7e3ceaee08b2ef8bcce3c227f7 > > [3] > https://github.com/danielschwierzeck/u-boot-lantiq/commit/899107f62ad97ba123f74f378179c765f8469e01 > ___ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/lede-dev
Re: [LEDE-DEV] VRV9510KWAC23
Am 27.08.2016 um 19:44 schrieb Juan Rios: Hello, I managed to get this router and want to get lede on it. The hardware is this Lantiq VRX288 500Mhz 2 NANYA NT5TU128M8HE-AC 256MB RAM ZENTEL A501GA31ATS 8G 128MB NAND FLASH. Wireless 2.4Ghz BCM43222KFBG Wireless 5Ghz BCM4360KMLG VDSL/ADSL2+ XWAY VRX208 5 port GB Ethernet I would suggest to check whether the wireless chips are supported by any open source driver and to decide afterwards if it's worth the time to work further on this device. Broadcom and open source (wireless) drivers is usually a story of pain. I already found serial port pins and got the console log. The log is almost silent. I managed to get to the brnboot shell short cutting pins in the flash but cant do a flash dump. Next time please paste the serial logs anyway. Maybe someone else is able to spot something interesting. ERASE Flash --- AreaAddress Length --- [0] Boot0x1024K [1] Image 0 0x0010 10240K [2] Image 1 0x00B0 10240K [3] Configuration 0x01502048K [4] Boot Params 0x01702048K [5] Nvram 0x01901024K [6] Cert0x01A0 32768K [7] EmergencyValue 0x03A06144K [8] Configuration2 0x04002048K [9] All area0x 67584K I wouldn't trust this flash layout. Doesn't look right to me for a 128MB flash chip. If I try to read from above address the router gets locked. I can read from certain area like memory or 0xBC00 or 0xBE00 but others locks the router. You can not access the NAND flash via the system memory addresses. It only works for memory mapped flash like NOR. NAND is I/O mapped. The boot ask for a password and continues booting. The emergency boot kernel is openwrt 10.3 What is a emergency boot kernel? Are you talking about the recovery web interface you get when press and hold the reset button on power on? If they are using OpenWrt, they have to provide the GPL sources. Ask for them! I found out that short cutting R201 I get CFG 07 instead of CFG 06 so maybe UART Mode is R201 + R203 but not sure. Not quite sure to try it... With Lantiq SoCs in NAND boot config it should be enough to bring one of the bootsel pins to GND to force the SoC into UART mode. I can load to memory using xmodem transfer and run but all I tried get locked without any output. What I want is first dump the current content of the flash. Any ideas? You can try to build an ascii (UART) u-boot for this device. But this requires the correct GPIO settings and matching memory parameters for the RAM chip. Usually I'm extracting the RAM chip parameters from the brnboot binary. But this seams to me a "chicken or the egg" problem here. What's more likely to work is to create a second stage (brnboot) u-boot which doesn't have to do the low level chip initialisation and can be started from the brnboot shell [1]. You can use the u-boot for the BT HomeHub 5A [2] as a beginning and add the missing SYS_BOOT_BRN stuff from the VGV7510KW22 [3]. This might allow you to dump the NAND from the second stage u-boot. Mathias [1] https://wiki.openwrt.org/toh/arcadyan/vgv7510kw22#starting_u-boot_from_brnboot [2] https://github.com/danielschwierzeck/u-boot-lantiq/commit/84581834622d6e7e3ceaee08b2ef8bcce3c227f7 [3] https://github.com/danielschwierzeck/u-boot-lantiq/commit/899107f62ad97ba123f74f378179c765f8469e01 ___ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/lede-dev
