Asus WL500g Premium (BCM47XX) problem

Asus WL500g Premium (BCM47XX) problem

[Waldemar Brodkorb]

[-- Attachment #1: Type: text/plain, Size: 1440 bytes --]

Hi MIPS hackers,

attached is the bootup log of Linux 6.18.13 (vanilla) on a Asus WL500g Premium
WLAN router. See here for details:
https://openwrt.org/toh/asus/wl-500gp

It is v1 version of the hardware. The CPU BCM3300 is correctly
recognized, but it seems some of the cpu features might be
misconfigured? What could be the problem?

Could this be the problem:
https://dev.archive.openwrt.org/ticket/1485

The userland works fine with a Linksys WRT54GS v1.0 and it
has the same CPU (BCM3300).
Is it because the kernel recognizes the WLAN router:
MIPS: machine is Linksys WRT54G/GS/GL
root@freewrt:~# cat /proc/cpuinfo 
system type             : Broadcom BCM4712
machine                 : Linksys WRT54G/GS/GL
processor               : 0
cpu model               : Broadcom BMIPS3300 V0.7
BogoMIPS                : 198.65
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : no
isa                     : mips1 mips2 mips32r1
ASEs implemented        :
Options implemented     : tlb 4kex 4k_cache prefetch mcheck ejtag llsc nan_legacy nan_2008
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

And the Asus WL500g Premium is unknown? Or is it non-critical?

Any hints are welcome.

best regards
 Waldemar



[-- Attachment #2: dmesg.txt --]
[-- Type: text/plain, Size: 8134 bytes --]

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: �T 12�� 14 15:54:18 CST 2005 (root@localhost.localdomain)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena
Initializing Devices.
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.90.23.0
rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
CPU type 0x29006: 264MHz
Total memory: 33554432 KBytes

Total memory used by CFE:  0x80800000 - 0x8089B590 (636304)
Initialized Data:          0x80831700 - 0x80833DE0 (9952)
BSS Area:                  0x80833DE0 - 0x80835590 (6064)
Local Heap:                0x80835590 - 0x80899590 (409600)
Stack Area:                0x80899590 - 0x8089B590 (8192)
Text (code) segment:       0x80800000 - 0x80831700 (202496)
Boot area (physical):      0x0089C000 - 0x008DC000
Relocation Factor:         I:00000000 - D:00000000

Device eth0:  hwaddr 00-17-31-D6-90-96, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Null Rescue Flag.
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3728 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
Linux version 6.18.13 (wbx@fluor) (mipsel-freewrt-linux-uclibc-gcc (GCC) 15.2.0, GNU ld (GNU Binutils) 2.46.0.20260210) #1 Tue Feb 24 16:38:24 CET 2026
printk: legacy bootconsole [early0] enabled
CPU0 revision is: 00029006 (Broadcom BMIPS3300)
bcm47xx: Using ssb bus
ssb: Found chip with id 0x4704, rev 0x09 and package 0x00
ssb: Sonics Silicon Backplane found at address 0x18000000
Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Zone ranges:
  Normal   [mem 0x0000000000000000-0x0000000001ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x0000000000000000-0x0000000001ffffff]
Initmem setup node 0 [mem 0x0000000000000000-0x0000000001ffffff]
Kernel command line: root=/dev/mtdblock4 rootfstype=squashfs init=/etc/preinit noinitrd console=ttyS0,115200
Unknown kernel command line parameters "noinitrd", will be passed to user space.
printk: log buffer data + meta data: 131072 + 409600 = 540672 bytes
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes, linear)
Built 1 zonelists, mobility grouping on.  Total pages: 8192
mem auto-init: stack:all(zero), heap alloc:off, heap free:off
SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS: 256
MIPS: machine is Unknown Board
clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 14479245804 ns
sched_clock: 32 bits at 132MHz, resolution 7ns, wraps every 16268815356ns
Console: colour dummy device 80x25
Calibrating delay loop... 263.42 BogoMIPS (lpj=526848)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
Memory: 26316K/32768K available (3838K kernel code, 568K rwdata, 916K rodata, 172K init, 268K bss, 6092K reserved, 0K cma-reserved)
devtmpfs: initialized
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
posixtimers hash table entries: 512 (order: 0, 2048 bytes, linear)
futex hash table entries: 256 (4096 bytes on 1 NUMA nodes, total 4 KiB, linear).
NET: Registered PF_NETLINK/PF_ROUTE protocol family
clocksource: Switched to clocksource MIPS
gpio gpiochip0: Static allocation of GPIO base is deprecated, use dynamic allocation.
NET: Registered PF_INET protocol family
IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
TCP: Hash tables configured (established 1024 bind 1024)
UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
NET: Registered PF_UNIX/PF_LOCAL protocol family
Initialise system trusted keyrings
workingset: timestamp_bits=30 max_order=13 bucket_order=0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Key type asymmetric registered
Asymmetric key parser 'x509' registered
io scheduler mq-deadline registered
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
printk: legacy console [ttyS0] disabled
serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 3, base_baud = 4125000) is a 16550A
printk: legacy console [ttyS0] enabled
printk: legacy console [ttyS0] enabled
printk: legacy bootconsole [early0] disabled
printk: legacy bootconsole [early0] disabled
serial8250.0: ttyS1 at MMIO 0xb8000400 (irq = 3, base_baud = 4125000) is a 16550A
physmap-flash physmap-flash.0: physmap platform flash device: [mem 0x1c000000-0x1e000000]
physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x001301
Amd/Fujitsu Extended Query Table at 0x0040
  Amd/Fujitsu Extended Query version 1.3.
number of CFI chips: 1
3 bcm47xxpart partitions found on MTD device physmap-flash.0
Creating 3 MTD partitions on "physmap-flash.0":
0x000000000000-0x000000040000 : "boot"
0x000000040000-0x0000007f0000 : "firmware"
3 trx partitions found on MTD device firmware
Creating 3 MTD partitions on "firmware":
0x00000000001c-0x00000000095c : "loader"
mtd: partition "loader" doesn't start on an erase/write block boundary -- force read-only
0x00000000095c-0x0000001af400 : "linux"
mtd: partition "linux" doesn't start on an erase/write block boundary -- force read-only
0x0000001af400-0x0000007b0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
0x0000007f0000-0x000000800000 : "nvram"
Generic PHY 1:1e: attached PHY driver (mii_bus:phy_addr=1:1e, irq=POLL)
b44 ssb0:0 eth0: Broadcom 44xx/47xx 10/100 PCI ethernet driver 00:17:31:d6:90:96
b44 ssb0:1: No PHY present on this MAC, aborting
NET: Registered PF_PACKET protocol family
Loading compiled-in X.509 certificates
check access for rdinit=/init failed: -2, ignoring
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
devtmpfs: mounted
Freeing unused kernel image (initmem) memory: 172K
This architecture does not have kernel memory protection.
Run /etc/preinit as init process
Data bus error, epc == 80015750, ra == 80013de8
Oops[#1]:
CPU: 0 UID: 0 PID: 1 Comm: preinit Not tainted 6.18.13 #1 NONE
Hardware name: Unknown Board
$ 0   : 00000000 10008800 fffd1000 00000000
$ 4   : 8102e000 fffd1000 8102ef00 805af1e0
$ 8   : 00000034 803b9808 77e3afff 77e39000
$12   : 80534164 00000001 00000801 00001533
$16   : 8102e000 805af1e0 00000001 00000255
$20   : 80bb6700 77e39000 80bb6700 80bb5000
$24   : 00000000 00000003
$28   : 8082e000 8082fe38 00000000 80013de8
Hi    : 00000000
Lo    : 00000000
epc   : 80015750 copy_page+0x48/0x548
ra    : 80013de8 copy_user_highpage+0x94/0xf8
Status: 10008803        KERNEL EXL IE
Cause : 0080001c (ExcCode 07)
PrId  : 00029006 (Broadcom BMIPS3300)
Modules linked in:
Process preinit (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=00000000)
Stack : 77e39000 00000249 80561000 00000000 805c39e0 800c2404 77e39000 77e3afff
        809a150c 00000000 8082feb4 00000000 00000000 00000000 00000a55 804b0000
        00000000 e09c7372 80bbc000 80bb6700 00100cca 0000000f 77e39000 77e39ff8
        00000a55 80ae977c 80ae977c 005ee689 00000000 805af1e0 80bbc8e4 80bb502c
        00000000 e09c7372 8082ff28 77e39ff8 80830000 00000001 00000255 00000001
        ...
Call Trace:
[<80015750>] copy_page+0x48/0x548
[<80013de8>] copy_user_highpage+0x94/0xf8
[<800c2404>] handle_mm_fault+0xbac/0xfec
[<80013528>] do_page_fault+0x118/0x470
[<80017098>] tlb_do_page_fault_1+0x118/0x120

Code: cc9e0060  cc9e0070  cca40100 <8ca80000> 8ca90004  8caa0008  8cab000c  cc9e0080  ac880000

---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---

Re: Asus WL500g Premium (BCM47XX) problem

[Waldemar Brodkorb]

Hi,

Waldemar Brodkorb wrote,

> Hi MIPS hackers,
> 
> attached is the bootup log of Linux 6.18.13 (vanilla) on a Asus WL500g Premium
> WLAN router. See here for details:
> https://openwrt.org/toh/asus/wl-500gp
> 
> It is v1 version of the hardware. The CPU BCM3300 is correctly
> recognized, but it seems some of the cpu features might be
> misconfigured? What could be the problem?
> 
> Could this be the problem:
> https://dev.archive.openwrt.org/ticket/1485

It seems this old patch is good to make the userland more stable.
I now can login via SSH to the device. WHat you think about
something like that? It was made for 6.18.13 ATM.

From 9663df570daaa57f412eacb66fdd28d438073102 Mon Sep 17 00:00:00 2001
From: Waldemar Brodkorb <wbx@openadk.org>
Date: Tue, 24 Feb 2026 22:02:00 +0100
Subject: [PATCH] bcm47xx: fix for oops in copy_page() on BCM3300 CPU

On a Asus WL500gP WLAn router, see here for hardware details:
https://openwrt.org/toh/asus/wl-500gp
You get a kernel oops like this:
Data bus error, epc == 80015750, ra == 80013de8
Oops[#1]:
CPU: 0 UID: 0 PID: 1 Comm: preinit Not tainted 6.18.13 #1 NONE
Hardware name: Unknown Board
$ 0   : 00000000 10008800 fffd1000 00000000
$ 4   : 8102e000 fffd1000 8102ef00 805af1e0
$ 8   : 00000034 803b9808 77e3afff 77e39000
$12   : 80534164 00000001 00000801 00001533
$16   : 8102e000 805af1e0 00000001 00000255
$20   : 80bb6700 77e39000 80bb6700 80bb5000
$24   : 00000000 00000003
$28   : 8082e000 8082fe38 00000000 80013de8
Hi    : 00000000
Lo    : 00000000
epc   : 80015750 copy_page+0x48/0x548
ra    : 80013de8 copy_user_highpage+0x94/0xf8
Status: 10008803        KERNEL EXL IE
Cause : 0080001c (ExcCode 07)
PrId  : 00029006 (Broadcom BMIPS3300)
Modules linked in:
Process preinit (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=00000000)
Stack : 77e39000 00000249 80561000 00000000 805c39e0 800c2404 77e39000 77e3afff
        809a150c 00000000 8082feb4 00000000 00000000 00000000 00000a55 804b0000
        00000000 e09c7372 80bbc000 80bb6700 00100cca 0000000f 77e39000 77e39ff8
        00000a55 80ae977c 80ae977c 005ee689 00000000 805af1e0 80bbc8e4 80bb502c
        00000000 e09c7372 8082ff28 77e39ff8 80830000 00000001 00000255 00000001
        ...
Call Trace:
[<80015750>] copy_page+0x48/0x548
[<80013de8>] copy_user_highpage+0x94/0xf8
[<800c2404>] handle_mm_fault+0xbac/0xfec
[<80013528>] do_page_fault+0x118/0x470
[<80017098>] tlb_do_page_fault_1+0x118/0x120

Code: cc9e0060  cc9e0070  cca40100 <8ca80000> 8ca90004  8caa0008  8cab000c  cc9e0080  ac880000

---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---

Fix is from old OpenWrt svn archive:
https://git.openwrt.org/?p=openwrt/svn-archive/openwrt.git;a=blob;f=target/linux/brcm47xx/patches-3.18/160-kmap_coherent.patch;h=924138690d54757fbfb24569b8730cf2576cc5af;hb=refs/heads/chaos_calmer

See here for details:
https://dev.archive.openwrt.org/ticket/1485

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
---
 arch/mips/include/asm/cpu-features.h                       | 3 +++
 arch/mips/include/asm/mach-bcm47xx/cpu-feature-overrides.h | 1 +
 arch/mips/mm/c-r4k.c                                       | 4 ++--
 arch/mips/mm/init.c                                        | 6 +++---
 4 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
index 404390bb87ea..9f1b2c2f3739 100644
--- a/arch/mips/include/asm/cpu-features.h
+++ b/arch/mips/include/asm/cpu-features.h
@@ -257,6 +257,9 @@
 #ifndef cpu_has_pindexed_dcache
 #define cpu_has_pindexed_dcache	(cpu_data[0].dcache.flags & MIPS_CACHE_PINDEX)
 #endif
+#ifndef cpu_use_kmap_coherent
+#define cpu_use_kmap_coherent	1
+#endif
 
 /*
  * I-Cache snoops remote store.	 This only matters on SMP.  Some multiprocessors
diff --git a/arch/mips/include/asm/mach-bcm47xx/cpu-feature-overrides.h b/arch/mips/include/asm/mach-bcm47xx/cpu-feature-overrides.h
index 69899c1e122d..47314a7048a1 100644
--- a/arch/mips/include/asm/mach-bcm47xx/cpu-feature-overrides.h
+++ b/arch/mips/include/asm/mach-bcm47xx/cpu-feature-overrides.h
@@ -22,6 +22,7 @@
 #define cpu_has_mcheck			1
 #define cpu_has_ejtag			1
 #define cpu_has_llsc			1
+#define cpu_use_kmap_coherent   	0
 
 /* cpu_has_mips16 */
 #define cpu_has_mdmx			0
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index 10413b6f6662..558b780b4d72 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -576,7 +576,7 @@ static inline void local_r4k_flush_cache_page(void *args)
 		map_coherent = (cpu_has_dc_aliases &&
 				folio_mapped(folio) &&
 				!folio_test_dcache_dirty(folio));
-		if (map_coherent)
+		if (map_coherent && cpu_use_kmap_coherent)
 			vaddr = kmap_coherent(page, addr);
 		else
 			vaddr = kmap_atomic(page);
@@ -598,7 +598,7 @@ static inline void local_r4k_flush_cache_page(void *args)
 	}
 
 	if (vaddr) {
-		if (map_coherent)
+		if (map_coherent && cpu_use_kmap_coherent)
 			kunmap_coherent();
 		else
 			kunmap_atomic(vaddr);
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index a673d3d68254..ab394299d5eb 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -167,7 +167,7 @@ void copy_user_highpage(struct page *to, struct page *from,
 	void *vfrom, *vto;
 
 	vto = kmap_atomic(to);
-	if (cpu_has_dc_aliases &&
+	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
 	    folio_mapped(src) && !folio_test_dcache_dirty(src)) {
 		vfrom = kmap_coherent(from, vaddr);
 		copy_page(vto, vfrom);
@@ -191,7 +191,7 @@ void copy_to_user_page(struct vm_area_struct *vma,
 {
 	struct folio *folio = page_folio(page);
 
-	if (cpu_has_dc_aliases &&
+	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
 	    folio_mapped(folio) && !folio_test_dcache_dirty(folio)) {
 		void *vto = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
 		memcpy(vto, src, len);
@@ -211,7 +211,7 @@ void copy_from_user_page(struct vm_area_struct *vma,
 {
 	struct folio *folio = page_folio(page);
 
-	if (cpu_has_dc_aliases &&
+	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
 	    folio_mapped(folio) && !folio_test_dcache_dirty(folio)) {
 		void *vfrom = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
 		memcpy(dst, vfrom, len);
-- 
2.47.3

Re: Asus WL500g Premium (BCM47XX) problem

[Peter Münster]

On Thu, Feb 26 2026, Waldemar Brodkorb wrote:

> It seems this old patch is good to make the userland more stable.

Hi Waldemar,

Has it been integrated into the kernel, and if yes, in what version
please?

TIA and kind regards,
-- 
           Peter

Re: Asus WL500g Premium (BCM47XX) problem

[Waldemar Brodkorb]

Hi Peter,
Peter Münster wrote,

> On Thu, Feb 26 2026, Waldemar Brodkorb wrote:
> 
> > It seems this old patch is good to make the userland more stable.
> 
> Hi Waldemar,
> 
> Has it been integrated into the kernel, and if yes, in what version
> please?

It is not integrated. You can find the patch which applies on latest
6.18 kernel here:
https://www.freewrt.de/trac/browser/freewrt/target/linux/brcm-6.18/patches/0002-bcm47xx-fix-for-oops-in-copy_page-on-BCM3300-CPU.patch

best regards
 Waldemar

Re: Asus WL500g Premium (BCM47XX) problem

[Peter Münster]

[-- Attachment #1: Type: text/plain, Size: 271 bytes --]

On Sun, May 17 2026, Waldemar Brodkorb wrote:

> It is not integrated.

Is it planned? If not, what could I do please, to make it happen?


> You can find the patch which applies on latest 6.18 kernel here:

I get "Error: Forbidden"...

-- 
           Peter

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 211 bytes --]

Re: Asus WL500g Premium (BCM47XX) problem

[Waldemar Brodkorb]

Hi Peter,
Peter Münster wrote,

> On Sun, May 17 2026, Waldemar Brodkorb wrote:
> 
> > It is not integrated.
> 
> Is it planned? If not, what could I do please, to make it happen?

What device do you have?
Can you test the patch, maybe I can resend it. Last time
I got no response, so I thought nobody is interested in it.
 
> > You can find the patch which applies on latest 6.18 kernel here:
> 
> I get "Error: Forbidden"...

Ah, I forgot that I had disabled the Sourcebrowser for
unauthenticated users because of massive AI crawler attacks.

You can always clone my repo of FreeWRT to get the patch:
git clone https://git.freewrt.de/git/freewrt

best regards
 Waldemar

Re: Asus WL500g Premium (BCM47XX) problem

[Peter Münster]

[-- Attachment #1: Type: text/plain, Size: 543 bytes --]

On Mon, May 18 2026, Waldemar Brodkorb wrote:

> What device do you have?

Hi Waldemar,

The WL500g-P.


> Can you test the patch,

Yes, perhaps in 1-2 weeks.


> maybe I can resend it.

That would be nice. Here is the guide:
https://docs.kernel.org/process/submitting-patches.html
You should include "[PATCH]" in the subject.


> Last time I got no response,

I guess because of the missing "[PATCH]".


> You can always clone my repo of FreeWRT to get the patch:

Thanks!

Kind regards,
-- 
           Peter

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 211 bytes --]