Lanchon / openwrt-tr4400-v2

OpenWrt installation instructions for Arris TR4400 v2 / RAC2V1A
Other
4 stars 0 forks source link

Installation on devices with an active secondary OS slot #1

Closed uragit closed 1 year ago

uragit commented 1 year ago

Hi! (Hope this is the right place to raise this):

After the tricky business of opening the case, soldering tiny wires, getting a serial console...

I'm stuck installing openwrt on my RACV21A version Arris TR4400 v2. There's a whole bunch of differences flagged up by check-svn1418.sh (see below).

Does this mean there's a problem with check-svn1418.sh, or can I safely ignore the errors?

emmerson@mingo ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [9] ssh -l root 10.9.124.4 sh <check-svn1418.sh

This script checks the current state of your router in depth. If all checks pass, you are good to go on installing OpenWRT. The router USB port should be empty when running this script.

checking /proc/cmdline checking /etc/svn.info /etc/svn.info - differ: char 69, line 2

ERROR: /etc/svn.info

Path: . URL: svn://10.10.67.238:36901/svn/Router/TR4400v2/TR4400v2_0719/Source Repository Root: svn://10.10.67.238:36901/svn/Router/TR4400v2 Repository UUID: a6b6dc33-2ea1-44c0-8bf5-3169134277e6 Revision: 1782 Node Kind: directory Schedule: normal Last Changed Author: lucien Last Changed Rev: 1782 Last Changed Date: 2019-08-05 10:19:11 +0800 (Mon, 05 Aug 2019)

VERSION: Build from: PD1-build01 /home/rdrelease/TR4400v2/TR4400v2_0719_191108/Source by rdrelease DATE: Mon Nov 11 10:44:03 CST 2019 BOARD_ID: TR4400-CH

checking /etc/openwrt_release /etc/openwrt_release - differ: char 74, line 3

ERROR: /etc/openwrt_release

DISTRIB_ID="OpenWrt" DISTRIB_RELEASE="Bleeding Edge" DISTRIB_REVISION="r1602" DISTRIB_CODENAME="barrier_breaker" DISTRIB_TARGET="ipq806x/generic" DISTRIB_DESCRIPTION="OpenWrt Barrier Breaker r1602" DISTRIB_TAINTS="no-all busybox override"

checking /proc/version /proc/version - differ: char 24, line 1

ERROR: /proc/version

Linux version 3.14.43 (rdrelease@PD1-build01) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.01 r1602) ) #1 SMP PREEMPT Fri Nov 8 20:42:04 CST 2019

checking /proc/mtd /proc/mtd - differ: char 130, line 4

ERROR: /proc/mtd

dev: size erasesize name mtd0: 00040000 00020000 "0:SBL1" mtd1: 00140000 00020000 "0:MIBIB" mtd2: 00140000 00020000 "0:SBL2_1" mtd3: 00280000 00020000 "0:SBL3_1" mtd4: 00120000 00020000 "0:DDRCONFIG_1" mtd5: 00120000 00020000 "0:SSD" mtd6: 00280000 00020000 "0:TZ_1" mtd7: 00280000 00020000 "0:RPM_1" mtd8: 00500000 00020000 "0:APPSBL_1" mtd9: 00080000 00020000 "0:APPSBLENV" mtd10: 00140000 00020000 "0:ART" mtd11: 04000000 00020000 "rootfs_1" mtd12: 00060000 00020000 "0:BOOTCONFIG" mtd13: 00140000 00020000 "0:SBL2" mtd14: 00280000 00020000 "0:SBL3" mtd15: 00120000 00020000 "0:DDRCONFIG" mtd16: 00120000 00020000 "0:SSD_1" mtd17: 00280000 00020000 "0:TZ" mtd18: 00280000 00020000 "0:RPM" mtd19: 00060000 00020000 "0:BOOTCONFIG1" mtd20: 00500000 00020000 "0:APPSBL" mtd21: 04000000 00020000 "rootfs" mtd22: 00100000 00020000 "fw_env" mtd23: 00800000 00020000 "config" mtd24: 00200000 00020000 "PKI" mtd25: 00100000 00020000 "scfgmgr" mtd26: 00008000 00008000 "spi32766.0" mtd27: 003e0000 0001f000 "kernel" mtd28: 01e08000 0001f000 "ubi_rootfs" mtd29: 0001f000 0001f000 "rootfs_data" mtd30: 00744000 0001f000 "ubi_config"

checking /proc/mounts /proc/mounts - differ: char 300, line 8

ERROR: /proc/mounts

rootfs / rootfs rw 0 0 mtd:ubi_rootfs /rom squashfs ro,relatime 0 0 proc /proc proc rw,noatime 0 0 sysfs /sys sysfs rw,noatime 0 0 tmpfs /tmp tmpfs rw,nosuid,nodev,noatime 0 0 tmpfs /tmp/root tmpfs rw,noatime,mode=755 0 0 overlayfs:/tmp/root / overlayfs rw,noatime,lowerdir=/,upperdir=/tmp/root 0 0 ubi1:ubi_config /config ubifs rw,relatime 0 0 tmpfs /dev tmpfs rw,relatime,size=512k,mode=755 0 0 devpts /dev/pts devpts rw,relatime,mode=600 0 0 debugfs /sys/kernel/debug debugfs rw,noatime 0 0 ramfs /home ramfs rw,relatime 0 0 ramfs /mnt ramfs rw,relatime 0 0 ramfs /etc ramfs rw,relatime 0 0

checking /proc/bus/pci/devices cmp: EOF on

ERROR: /proc/bus/pci/devices

/proc/bus/pci/devices

checking /etc/fw_env.config Warning: Bad CRC, using default environment checking fw_printenv fw_printenv - differ: char 2, line 1

ERROR: fw_printenv

bootcmd=bootp; setenv bootargs root=/dev/nfs nfsroot=${serverip}:${rootpath} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}::off; bootm bootdelay=5 baudrate=115200

checking dmesg-ubi-attached dmesg-ubi-attached - differ: char 18, line 1

ERROR: dmesg-ubi-attached

UBI: attached mtd21 (name "rootfs", size 64 MiB) to ubi0 UBI: attached mtd23 (name "config", size 8 MiB) to ubi1

checking dmesg-ubifs-mounted checking ubi0_0-kernel ubi0_0-kernel - differ: char 1, line 1

ERROR: ubi0_0-kernel

1e7876636109535510dd7cee16386d36 /dev/ubi0_0

checking ubi0_1-ubi_rootfs ubi0_1-ubi_rootfs - differ: char 1, line 1

ERROR: ubi0_1-ubi_rootfs

edcd4e0e5732f18e81da7b33892fe784 /dev/ubi0_1

checking ubi0_2-rootfs_data

WARNING: Do not proceed installing OpenWrt if any errors were output! Save the output and seek help in the forums instead.

Lanchon commented 1 year ago

hi! i was very much sure i would be the only owner of a hacked TR4400 v2 ever, lol congrats on your hardware hack!!! seems all the pics and text i wrote weren't completely a waste :)

so there are 2 issues here:

(1) your firmware is newer:

yours:

Revision: 1782
Last Changed Author: lucien
Last Changed Rev: 1782
Last Changed Date: 2019-08-05 10:19:11 +0800 (Mon, 05 Aug 2019)

VERSION:
Build from: PD1-build01 /home/rdrelease/TR4400v2/TR4400v2_0719_191108/Source by rdrelease
DATE: Mon Nov 11 10:44:03 CST 2019

mine:

Revision: 1418
Last Changed Author: sandy
Last Changed Rev: 1418
Last Changed Date: 2018-03-01 16:54:42 +0800 (Thu, 01 Mar 2018)

VERSION:
Build from: sercomm-QCA-Server /home2/mark/TR4400v2_0419b_0301/Source by mark
DATE: Thu Mar 1 17:10:58 CST 2018

as long as my SSH server enabling hack works (it does in your case) and the partition layout doesn't change (it sort of doesn't), then you'd succeed in installing by script. note that in the event of a brick, you can always halt the bootloader and try recovering from there.

but there is a more serious issue here:

(2) your system is booting from the alternate system !!!

this device has 2 copies of the system: for each required partition there are two actual partitions, named "NAME" and "NAME_1". for example: "rootfs" and "rootfs_1". the inactive one has the "_1" in the name. when the bootloader wants to switch to the alternate system, it swaps the names assigned to these partitions. in my case, during install my rootfs was partition mtd11 (see here: https://github.com/Lanchon/openwrt-tr4400-v2/blob/e7d707d6bd7839fbd0b8d0bd180fce451df77e47/check-svn1418.sh#L67). but in your case, rootfs is mtd21 !! this means in your system mtd21 is mounted and the commands needed to execute the install actually reside in mtd21. the problem is: the install needs to wipe mtd21. SO DO NOT TRY IT !!!

what you need to do is:

first: get a full backup of MTDs and UBIs. use my scripts.

then: convince your router to boot from the other system. i don't know how, but you can do it by talking to the bootloader (UBOOT). some of the gurus of the IPQ806x platform surely know how to force the bootloader to switch. it might also switch by itself if you power down the router while booting a number of consecutive times. please let me know how you end up doing this so i can document it.

note that we can't rule out that the other system (the currently inactive one, call it "main") could be corrupted or outdated in your installation, so it might fail to boot. but you can always copy contents of the current "XXX" partitions to their respective "main" ones, that for now are named "XXX_1". but note that writing to bootloader partitions might be dangerous.

please note that in MTD devices, the partition names are given dynamically by the bootloader (in your case) or are embedded in the kernel (in the standard openwrt distribution) but DO NOT EXIST on a table on the device like they do in PC disks. this is why the bootloader can choose which system to boot: it assign the non-"_1" names to the partitions it wants to boot and passes those names to the kernel, which mounts the "rootfs" partition, whatever number might be, as informed by the bootloader.

if you want you can send me your backups to lanchon at gmail, but keep in mind that they contain secret info about your router so don't post them publicly.

uragit commented 1 year ago

On Mon, Nov 28, 2022 at 02:39:55AM -0800, Lanchon wrote:

hi! i was very much sure i would be the only owner of a hacked TR4400 v2 ever, lol congrats on your hardware hack!!! seems all the pics and text i wrote weren't completely a waste :)

...

Lanchon

Thanks for the quick response.

I do indeed get the impression the the entire worldwide community of RACV21A users might just be the two of us. (If there's more, I hope they jump in: maybe there's as many as 3 of us worldwide!)

I'm not very knowledgable about the boot process so I'm not sure I understand all the mtd/boot issues.

After several (several, several) attempts at interrupting the boot process, I never got it to use mtd11 instead of mtd21 for rootfs.

I was able to run your two backup scripts, although I got a couple of error messages:

Running lanchon scripts to backup mtd @. ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [18] ssh @. sh <mtd-backup.sh ... backing up mtd30 to 'mtd30-ubi_config.gz' gzip: can't open '/dev/mtd30': Device or resource busy -> mtd30: backup failed tarring backup files to '/tmp/lanchon/mtd-backup.tar' ;
@. ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [24] ssh @. sh <ubi-backup.sh ubiattach: error!: cannot attach mtd21 error 17 (File exists) creating backup files: backing up ubi0_0 to 'ubi0_0-kernel.gz' backing up ubi0_1 to 'ubi0_1-ubi_rootfs.gz' backing up ubi0_2 to 'ubi0_2-rootfs_data.gz' backing up ubi1_0 to 'ubi1_0-ubi_config.gz' tarring backup files to '/tmp/lanchon/ubi-backup.tar' ubidetach: error!: cannot detach mtd21 error 16 (Device or resource busy)

I've put the tar files on my webserver:

http://telemage.com/uragit/

I've also included the console log for device bootup in case it provides useful info. It certainly contains a bunch of mtd/boot info but I can't tell what is going wrong.

Early on in the boot process, I can get into what I assume is some sort of bootloader (uboot?):

Hit any key to stop autoboot: 0 [I hit space bar, it interrupts the boot] (IPQ) #
(IPQ) # (IPQ) # (IPQ) # (IPQ) # help ... (IPQ) # printenv baudrate=115200 bootargs=console=ttyMSM0,115200n8 bootcmd=bootipq bootdelay=2 ethact=eth0 machid=1260 stderr=serial stdin=serial stdout=serial ... I played around with setenv to try different bootargs but my bootargs kung-fu is weak; I didn't achieve anything useful.

I'll keep poking at it, but I've got to learn a bunch more about booting, mtd, uboot before I can get much of a handle on anything, and I'm a bit worried about bricking the router if I screw up.

Thanks for any insight you can provide. I've come this far and I hope there's a way to get this router loaded.

--

uragit (Martin)

Lanchon commented 1 year ago

hi!

  -> mtd30: backup failed

never mind this. this is mounted via UBI, the real partition was backed up as mtd23.

ubiattach: error!: cannot attach mtd21

this happens because mtd21 (alternate system) is already mounted. the main system was not mounted and thus was not backed up. i updated the ubi-backup script to support your case. please update your copy, rerun it, and update your uploaded file. this way we will know whether both copies of the OS are mountable and whether they are the same.

bootcmd=bootipq

bootcmd is a normal variable that is auto-executed as a script during boot. in this case it is invoking the bootipq command.

bootipq is a custom qualcomm UBOOT command that does the dual system failover magic. i'll be looking up how it works, but i'll write this post as i go. this command attempts to boot a copy of the system, and if certain conditions are met, it will switch over to the other system (like -i assume- if system corruption is found). so it should be enough to erase mtd21 to force UBOOT to switch to the other (mtd11) copy. but don't! we still don't know if the other copy is corrupted or old. and we don't know if bootipq actually works as expected.

interrupt the boot process and type bootipq debug. capture UBOOT output again, we might see usefull detail of how/way bootipq is choosing 2nd OS.

(IPQ) # printenv

note that the OpenWrt command fw_printenv and UBOOT commad printenv print different things. it seems that they are reading different stuff and the OpenWrt build is incorrectly configured. this is worrying because if you run my install script it might fail to configure UBOOT and it might write to... who knows where.

my expectation after reading some cmd_bootipq.c files and looking at your dumps is that changing byte 4 (fifth bytes) from 2 to 0 in your mtd19-0:BOOTCONFIG1 would revert your system to boot the primary OS... assuming that copy works.

but i'd like a non-persistent way to try this. let's ask the experts...

Lanchon commented 1 year ago

hi @Ansuel, i guess you are the undisputed expert here.

this is an IPQ806x system. the boot command is bootipq. we got serial access to UBOOT and stock OpenWrt.

the system is booting the alternate partition set (the _1 suffixes are swapped after linux boot), which for an intricate reason stops us from installing official OpenWrt.

is there a UBOOT command or some other way to tell bootipq to switch to the main partition set, be it temporarily or permanently?

thank you!!!

(IPQ) # printenv
baudrate=115200
bootargs=console=ttyMSM0,115200n8
bootcmd=bootipq
bootdelay=2
ethact=eth0
machid=1260
stderr=serial
stdin=serial
stdout=serial

EDIT: we solved it by adjusting the "age" parameter on one of the BOOTCONFIG partitions. but still it'd be nice to know a UBOOT command to boot from an alternate slot, if only temporary.

Lanchon commented 1 year ago

@uragit check this out:

https://github.com/blackfuel/asuswrt-brt-ac828/blob/35ed56039014d6acd8633282afbf9044556eaa6a/release/src-qca-ipq806x/uboot/arch/arm/include/asm/arch-ipq806x/smem.h#L107-L118

this is the bootconfig v2 struct in use on your device. your device has 2. those MTDs arw hardpointed to by the early bootloader, i think. each copy lists dual-system partition names and whether to add a suffix to each of them:

https://github.com/blackfuel/asuswrt-brt-ac828/blob/35ed56039014d6acd8633282afbf9044556eaa6a/release/src-qca-ipq806x/uboot/arch/arm/include/asm/arch-ipq806x/smem.h#L86-L91

there is also the "age" value (bytes number 4 to 7) of each bootconfig. so i think when an update is done, the inactive partitions are written and then its bootconfig copy is updated, setting its age to one plus the highest value of all other (the other) bootconfig copies.

your device shipped with BOOTCONFIG with age 1 and BOOTCONFIG1 with age 0. this caused bootipq to choose BOOTCONFIG and its configuration (don't swap the _1 suffix in partition names). at some point fw was updated. new firmware was written to the inactive partitions. then BOOTCONFIG1 was updated with age 2. this forces bootipq to choose BOOTCONFIG1 and its configuration (swap the _1 suffix in partition names).

this is why i think setting BOOTCONFIG1 age to zero would revert the fw update... assuming the previous fw works. make a UBI backup first with the new script to so i can check its content: this undo might take you to the version of the fw for which all my scripts were developed... :) i suppose just erasing BOOTCONFIG1 should work too, but better if you don't.

uragit commented 1 year ago

I recaptured the console log with 'bootipq debug', I've added it as console.log2.bootipq_debug in http://telemage.com/uragit/

I notice, early in the boot process, the extra text:

Using nand device 0 bootargs=console=ttyMSM0,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs Booting from flash

There's also this, a few lines later: bootm @.***_3

Hope this is providing some useful info!

On Thu, Dec 01, 2022 at 12:45:16AM -0800, Lanchon wrote:

hi!

  -> mtd30: backup failed

never mind this. this is mounted via UBI, the real partition was backed up as mtd23.

ubiattach: error!: cannot attach mtd21

this happens because mtd21 (alternate system) is already mounted. the main system was not mounted and thus was not backed up. i updated the ubi-backup script to support your case. please update your copy, rerun it, and update your uploaded file. this way we will know whether both copies of the OS are mountable and whether they are the same.

bootcmd=bootipq

bootcmd is a normal variable that is auto-executed as a script during boot. in this case it is invoking the bootipq command.

bootipq is a custom qualcomm UBOOT command that does the dual system failover magic. i'll be looking up how it works, but i'll write this post as i go. this command attempts to boot a copy of the system, and if certain conditions are met, it will switch over to the other system (like -i assume- if system corruption is found). so it should be enough to erase mtd21 to force UBOOT to switch to the other (mtd11) copy. but don't! we still don't know if the other copy is corrupted or old. and we don't know if bootipq actually works as expected.

interrupt the boot process and type bootipq debug. capture UBOOT output again, we might see usefull detail of how/way bootipq is choosing 2nd OS.

(IPQ) # printenv

note that the OpenWrt command fw_printenv and UBOOT commad printenv print different things. it seems that they are reading different stuff and the OpenWrt build is incorrectly configured. this is worrying because if you run my install script it might fail to configure UBOOT and it might write to... who knows where.

my expectation after reading some cmd_bootipq.c files and looking at your dumps is that changing byte number 5 from 2 to 0 in your mtd19-0:BOOTCONFIG1 would revert your system to boot the primary OS... assuming that copy works.

but i'd like a non-persistent way to try this. let's ask the experts...

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1333409866 You are receiving this because you authored the thread.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

uragit commented 1 year ago

I grabbed the new version of ubi-backup.sh and ran through it. I've put the new tar file on http://telemage.com/uragit/ as 'ubi-backup.tar.new'

Certainly looks like it is storing the extra info, compared to previous one:

@.*** ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [38] tar tvf ubi-backup.tar.new -rw-r--r-- root/root 3372 2019-11-10 19:09 ubi-info.txt -rw-r--r-- root/root 3525990 2019-11-10 19:08 ubi0_0-kernel.gz -rw-r--r-- root/root 31382623 2019-11-10 19:09 ubi0_1-ubi_rootfs.gz -rw-r--r-- root/root 158 2019-11-10 19:09 ubi0_2-rootfs_data.gz -rw-r--r-- root/root 48861 2019-11-10 19:09 ubi1_0-ubi_config.gz -rw-r--r-- root/root 3525854 2019-11-10 19:09 ubi2_0-kernel.gz -rw-r--r-- root/root 23485279 2019-11-10 19:09 ubi2_1-ubi_rootfs.gz -rw-r--r-- root/root 158 2019-11-10 19:09 ubi2_2-rootfs_data.gz

I hope it helps! I'm following along as best I can but I'm unfamiliar with ubi/mtd/uboot!

--

Martin

On Thu, Dec 01, 2022 at 12:45:16AM -0800, Lanchon wrote:

hi!

  -> mtd30: backup failed

never mind this. this is mounted via UBI, the real partition was backed up as mtd23.

ubiattach: error!: cannot attach mtd21

this happens because mtd21 (alternate system) is already mounted. the main system was not mounted and thus was not backed up. i updated the ubi-backup script to support your case. please update your copy, rerun it, and update your uploaded file. this way we will know whether both copies of the OS are mountable and whether they are the same.

bootcmd=bootipq

bootcmd is a normal variable that is auto-executed as a script during boot. in this case it is invoking the bootipq command.

bootipq is a custom qualcomm UBOOT command that does the dual system failover magic. i'll be looking up how it works, but i'll write this post as i go. this command attempts to boot a copy of the system, and if certain conditions are met, it will switch over to the other system (like -i assume- if system corruption is found). so it should be enough to erase mtd21 to force UBOOT to switch to the other (mtd11) copy. but don't! we still don't know if the other copy is corrupted or old. and we don't know if bootipq actually works as expected.

interrupt the boot process and type bootipq debug. capture UBOOT output again, we might see usefull detail of how/way bootipq is choosing 2nd OS.

(IPQ) # printenv

note that the OpenWrt command fw_printenv and UBOOT commad printenv print different things. it seems that they are reading different stuff and the OpenWrt build is incorrectly configured. this is worrying because if you run my install script it might fail to configure UBOOT and it might write to... who knows where.

my expectation after reading some cmd_bootipq.c files and looking at your dumps is that changing byte number 5 from 2 to 0 in your mtd19-0:BOOTCONFIG1 would revert your system to boot the primary OS... assuming that copy works.

but i'd like a non-persistent way to try this. let's ask the experts...

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1333409866 You are receiving this because you authored the thread.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

bootargs=console=ttyMSM0,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs

that's the command line passed to the linux kernel (it takes a command line as if it were a regular executable). i already knew the contents because the checking /proc/cmdline line (first post) showed it was the same as my stock rom.

bootm 0x44000000#config@4704_3

that's when bootipq invokes bootm, the command that boots a kernel from RAM. good, i didn't know bootipq fell though to bootm. 0x44000000 is the address of the in-memory kernel.

UBI crash course:

a UBI device is a specially formatted MTD partition. when the partition is "attached" -it is mounted so to speak- a UBI /dev/ubiN device is created, where N is the ubi device number assigned at attachment.

a UBI device contains zero or more volumes, and/or unallocated space. it handles flash memory wear leveling and defect handling. a volume can be presented as a read-only block device, or can be mounted via a specialized file system, such as UBIFS.

UBIFS is a R/W file system designed to inhabit a UBI volume. once mounted, a UBIFS /dev/ubiN_M device is created, where N is the ubi device number and M is the volume number within that device. volume numbers and names are specified at volume creation time.

I grabbed the new version of ubi-backup.sh and ran through it

great! we now have backups of all ubi volumes inside the 3 ubi devices: rootfs, rootfs_1 and config. check the ubi info file inside the backup tar for details on what is backed up where. rootfs (mtd21) is ubi0, config is ubi1, and rootfs_1 is ubi2 (mtd11). the rootfs ubi devices each have 3 volumes inside for kernel (raw image), squashfs rootfs (squashfs), and rootfs overlay (ubifs).

i'll check the contents next.

uragit commented 1 year ago

I'm wondering if there's a way to update the software again, via the web interface on the current version. This might cause the flip back to the other rootfs.

The strange thing is that I can't see any way to upgrade to a newer 'official' release. So, not sure how it managed to get updated in the first place. (I don't know the history of the router; it was left behind by a guy who moved out of a rental. It's ISP-supplied, from charter/spectrum in Reno, NV and is typically paired with a separate cable modem.)

It reports, via the web interface:

Hardware and Software Versions: Serial Number: A4U4H956C14585 Bootcode Version: 1.00.0 Hardware Version: 1.0 Firmware Version: A1.00.004-190802

So, in short, I didn't find any useful way to do an upgrade!

--

Martin

On Thu, Dec 01, 2022 at 12:21:44PM -0800, Lanchon wrote:

bootargs=console=ttyMSM0,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs

that's the command line passed to the linux kernel (it takes a command line as if it were a regular executable). i already knew the contents because the checking /proc/cmdline line (first post) showed it was the same as my stock rom.

bootm @.***_3

that's when bootipq invokes bootm, the command that boots a kernel from RAM. good, i didn't know bootipq fell though to bootm. 0x44000000 is the address of the in-memory kernel.

UBI crash course:

a UBI device is a specially formatted MTD partition. when the partition is "attached" -it is mounted so to speak- a UBI /dev/ubiN device is created, where N is the ubi device number assigned at attachment.

a UBI device contains zero or more volumes, and/or unallocated space. it handles flash memory wear leveling and defect handling. a volume can be presented as a read-only block device, or can be mounted via a specialized file system, such as UBIFS.

UBIFS is a R/W file system designed to inhabit a UBI volume. once mounted, a UBIFS /dev/ubiN_M device is created, where N is the ubi device number and M is the volume number within that device. volume numbers and names are specified at volume creation time.

I grabbed the new version of ubi-backup.sh and ran through it

great! we now have backups of all ubi volumes inside the 3 ubi devices: rootfs, rootfs_1 and config. check the ubi info file inside the backup tar for details on what is backed up where. rootfs (mtd21) is ubi0, config is ubi1, and rootfs_1 is ubi2 (mtd11). the rootfs ubi devices each have 3 volumes inside for kernel (raw image), squashfs rootfs (squashfs), and rootfs overlay (ubifs).

i'll check the contents next.

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334398424 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

no, you are right, the UI does not allow upgrades nor local flashes, it's a PoS. that's why i didn't suggest that option.

but the router hardware is very good :)

as you can see, the two OSes on your router are different. hashes would match on at least 2 pairs of partitions otherwise:

rod@rod-latitude:~/hardware/routers/arris-tr4400-v2/backup-svn1782 (uragit)/ubi-backup$ md5sum *.gz
e7f954f8efc197e371895a35e7334c2f  ubi0_0-kernel.gz
e856028dbbe613cd2908dd893390b259  ubi0_1-ubi_rootfs.gz
f883efb58387017ed1ee8d9425b745f3  ubi0_2-rootfs_data.gz
06a66a1461e309f4d6a25d100ab927bb  ubi1_0-ubi_config.gz
eaa31d7f772d685e47b9d0ee9fd9e603  ubi2_0-kernel.gz
95326380b3e1275afc120b645b891082  ubi2_1-ubi_rootfs.gz
e1932b8e04381cb0cba50b7518a621e9  ubi2_2-rootfs_data.gz

on the other hand, ub2_XXX doesn't match my version either, so it seems there are 3 versions at play here:

rod@rod-latitude:~/hardware/routers/arris-tr4400-v2/backup-svn1418 (mine)/tr4400-v2-stock-firmware/r1418-2018-03-01$ md5sum *.gz
8c80a52678aeb28387d091e8702c525e  ubi0_0-kernel.gz
5ea9b59b28d199a5283af08b67c0ecf3  ubi0_1-ubi_rootfs.gz
cdd4b2ccfc75875ced0932658f06624c  ubi0_2-rootfs_data.gz

i'm doing 10 things at the same time, please hold on for more...

Lanchon commented 1 year ago

ok ubi0 (mtd21) contains rootfs for:

Revision: 1782
Last Changed Author: lucien
Last Changed Rev: 1782
Last Changed Date: 2019-08-05 10:19:11 +0800 (Mon, 05 Aug 2019)

VERSION:
Build from: PD1-build01 /home/rdrelease/TR4400v2/TR4400v2_0719_191108/Source by rdrelease
DATE: Mon Nov 11 10:44:03 CST 2019

no surprise here, we already knew this, this is the currently active OS.

but ubi2 (mtd11) has a newer OS! not and older one as expected:

Revision: 1806
Last Changed Author: jason
Last Changed Rev: 1806
Last Changed Date: 2019-11-12 13:15:23 +0800 (Tue, 12 Nov 2019)

VERSION:
Build from: PD1-build01 /home/rdrelease/TR4400v2/TR4400v2_MT_191108/Source by rdrelease
DATE: Tue Nov 12 13:22:44 CST 2019

which begs the question of why it has a smaller "age", ie, why is it not booting. maybe it's corrupted?

in any case, you router seems to have been subjected to upgrade processes. maybe the upgrade code is flawed. it wouldn't surprise me.

Lanchon commented 1 year ago

i'll be uploading those firmwares soon here: https://github.com/Lanchon/tr4400-v2-stock-firmware

so... it seems we know enough to proceed. you need to change one byte of one of the BOOTCONFIG partitions. this will make the main OS copy bootable and (if it boots) allow OpenWrt install.

you may want to copy the current system over to unused (main) OS slot beforehand to increase chances of booting successfully. or you may try to boot svn1806 instead. note that boot failure would mean that you'd probably require to fix things from UBOOT. it'd be fixable, but laborious.

so how do you want to proceed?

uragit commented 1 year ago

Okay, I'm happy with whatever options you recommend. It's not the end of the world if we brick it, although I'm hoping for the best.

What's the best option for editing the one byte on the partition? Presumably if it all goes wrong, I might be able to re-edit it to get back to our starting point (unless we end up thoroughly bricked).

I don't know how to "copy the current system over to unused (main) OS slot".

Also not sure what the option is to "boot svn1806 instead".

But I think I understand the basic principle of changing the one byte to force it to boot the other firmware, and happy to give it a go. Although it does seem suspicious that the 'older' version is actually newer.

(I've been trying to figure out how to get you direct serial-port access to the router, in case that helps to check anything out. Still working on it.)

--

Martin

On Thu, Dec 01, 2022 at 01:53:56PM -0800, Lanchon wrote:

i'll be uploading those firmwares soon here: https://github.com/Lanchon/tr4400-v2-stock-firmware

so... it seems we know enough to proceed. you need to change one byte of one of the BOOTCONFIG partitions. this will make the main OS copy bootable and (if it boots) allow OpenWrt install.

you may want to copy the current system over to unused (main) OS slot beforehand to increase chances of booting successfully. or you may try to boot svn1806 instead. note that boot failure would mean that you'd probably require to fix things from UBOOT. it'd be fixable, but laborious.

so how do you want to proceed?

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334493819 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

I don't know how to "copy the current system over to unused (main) OS slot".

i can tell you. when i get a little time.

Also not sure what the option is to "boot svn1806 instead".

i mean not copying the current OS to the inactive slot and hoping that the inactive OS, which version 1806 on the SVN (the source control scheme), boots fine.

so we change that byte. and optionally copy your current OS over before that.

i'll assist you with commands soon, but can´t right now.

uragit commented 1 year ago

No worries. Whenever you have time. I appreciate all the help!

When you have a minute, can you try:

ssh -p 222 -l socat smtp1.telemage.com

Password: racv21a!

It should put you in contact with the router serial port (unless I've grabbed it at the time for some investigation).

(The terminal settings aren't quite right so it echoes each line typed.)

--

Martin

On Thu, Dec 01, 2022 at 05:17:40PM -0800, Lanchon wrote:

I don't know how to "copy the current system over to unused (main) OS slot".

i can tell you. when i get a little time.

Also not sure what the option is to "boot svn1806 instead".

i mean not copying the current OS to the inactive slot and hoping that the inactive OS, which version 1806 on the SVN (the source control scheme), boots fine.

so we change that byte. and optionally copy your current OS over before that.

i'll assist you with commands soon, but can´t right now.

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334645845 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

lol anyone reading can make a mess there!!!

i tried logging as follows, and i could twice, but now gives an error:

rod@rod-latitude:~$ ssh -o KexAlgorithms=diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=ssh-rsa,ssh-dss -p 222 socat@smtp1.telemage.com
socat@smtp1.telemage.com's password: 
Permission denied, please try again.
socat@smtp1.telemage.com's password: 
hello
Error: Invalid interval time "v"
Connection to smtp1.telemage.com closed.

btw, your box is running insecure ssh protocols.

uragit commented 1 year ago

On Thu, Dec 01, 2022 at 09:42:04PM -0800, Lanchon wrote:

lol anyone reading can make a mess there!!!

Doh! I'd forgotten we were leaving a trail. I'll change ports and passwords and email you separately.

Also probably time I updated my ssh protocols!

I think it probably stopped working briefly when I was experimenting with replacing telnet with netcat, but it didn't improve the line/character mode problem I was having.

--

Martin

i tried logging as follows, and i could twice, but now gives an error:

***@***.***:~$ ssh -o KexAlgorithms=diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=ssh-rsa,ssh-dss -p 222 ***@***.***
***@***.***'s password: 
Permission denied, please try again.
***@***.***'s password: 
hello
Error: Invalid interval time "v"
Connection to smtp1.telemage.com closed.

btw, your box is running insecure ssh protocols.

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334787528 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

anyway, you can do it...

copy the current working OS on the secondary slot mtd21 to the primary slot mtd11

you will copy the complete UBI device holding the 3 volumes. UBI images cannot be written to MTD as regular images, use this command:

cat /dev/mtd21 | ubiformat /dev/mtd11 -f -

should succeed unless mtd partitions are read-only to the stock kernel. now let's verify. attach the new ubi device to access its volumes:

ubiattach -m 11

it should attach as ubi2, while mtd21 is already attached as ubi0. lets check the MD5 of all UBI volumes, verify that pairs of MD5 hashes for volumes ubi0_N and ubi2_N (for N 0 to 2) match:

md5sum /dev/ubi*_*

continue only if the 3 pairs match.

edit BOOTCONFIG1 mtd19 so that its age field goes from 2 to 0

cd /tmp
dd if=/dev/mtd19 bs=4K count=1 >bc1
dd if=bc1 bs=1 count=4 >bc1-mod
dd if=bc1 bs=1 skip=5 count=1 >>bc1-mod
dd if=bc1 bs=1 skip=5 >>bc1-mod

check the edited file before writing it:

cmp -l bc1 bc1-mod
# should output only one byte difference at position 5 from 2 to 0:
#      5   2   0

if ok, write the edited file to the partition:

mtd erase /dev/mtd19
mtd write bc1-mod /dev/mtd19

now if you reboot you should be running the same OS version but running it from the main slot mtd11... hopefully. verify this using cat /proc/mtd to list the partitions: mtd11 should be called rootfs, and no longer be called rootfs_1.

once there you can try following the installation instruction. lets hope that the UBOOT environment gets written correctly by the install script.

Lanchon commented 1 year ago

so you are online! maybe you can try now? let me know and i'll standby while you do it. its 3:30 am here lol

Lanchon commented 1 year ago

sorry i was writing that long post and didn't see your message

Lanchon commented 1 year ago

ok i'm in again. you seem to not be here so i'll proceed and log.

Lanchon commented 1 year ago

starting...

uragit commented 1 year ago

I'm here but I need to configure my email client to make a noise when new email arrives!

You're making the changes now? I'll stand by.

Only 10:50pm here. California, PST.

Meanwhile, I'm figuring out how to update the keyex protocols on my ancient openwrt/dropbear box!

--

Martin

On Thu, Dec 01, 2022 at 10:35:04PM -0800, Lanchon wrote:

starting...

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334820589 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

yes, i'm working and logging. ubiformat did not work. there are bad blocks in your main OS area, though ubi should tolerate that. im trying workarounds.

Lanchon commented 1 year ago

first part ready. bad blocks, but i was able to copy volumes one by one instead of the whole device...

rod@rod-latitude:~$ sshpass -p ********* ssh -o KexAlgorithms=diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=ssh-rsa,ssh-dss -p 222 socat@smtp1.telemage.com
hello

root@OpenWrt:~# 

root@OpenWrt:~# ls
ls
bin      dev      home     mnt      proc     sbin     tmp      var
config   etc      lib      overlay  rom      sys      usr      www
root@OpenWrt:~# 

root@OpenWrt:~# reboot
reboot
procd: - reboot -
root@OpenWrt:~# [41370.541686] reboot: Restarting system

U-Boot 2012.07 [Barrier Breaker r1596,r1596] (Nov 08 2019 - 19:18:40)

smem ram ptable found: ver: 0 len: 5
DRAM:  491 MiB
NAND:  SF: Unsupported manufacturer 00
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC:   
NAND read from offset 1180000 failed -74
*** Warning - readenv() failed, using default environment

In:    serial
Out:   serial
Err:   serial
MMC Device 0 not found
cdp: get part failed for 0:HLOS
Net:   MAC0 addr:0:3:7f:ba:db:0
athrs17_reg_init: complete
athrs17_vlan_config: Sercomm modify vlan config
athrs17_vlan_config ...done
S17c init  done
MAC1 addr:0:3:7f:ba:db:1
MAC2 addr:0:3:7f:ba:db:2
Port:2 speed 10Mbps
MAC3 addr:0:3:7f:ba:db:3
Port:3 speed 10Mbps
eth0, eth1, eth2, eth3
Done!
 Index Name                Offset      Length      Real_Offs   Real_Size   
     0 SBL1                0           40000       0           40000       
     1 MIBIB               40000       140000      40000       140000      
     2 SBL2                180000      140000      180000      140000      
     3 SBL3                2c0000      280000      2c0000      280000      
     4 DDRCONFIG           540000      120000      540000      120000      
     5 SSD                 660000      120000      660000      120000      
     6 TZ                  780000      280000      780000      280000      
     7 RPM                 a00000      280000      a00000      280000      
     8 APPSBL              c80000      500000      c80000      500000      
     9 APPSBLENV           1180000     80000       1180000     80000       
    10 ART                 1200000     140000      1200000     140000      
    11 rootfs              1340000     4000000     1340000     4000000     
    12 BOOTCONFIG          5340000     60000       5340000     60000       
    13 SBL2_1              53a0000     140000      53a0000     140000      
    14 SBL3_1              54e0000     280000      54e0000     280000      
    15 DDRCONFIG_1         5760000     120000      5760000     120000      
    16 SSD_1               5880000     120000      5880000     120000      
    17 TZ_1                59a0000     280000      59a0000     280000      
    18 RPM_1               5c20000     280000      5c20000     280000      
    19 BOOTCONFIG_1        5ea0000     60000       5ea0000     60000       
    20 APPSBL_1            5f00000     500000      5f00000     500000      
    21 rootfs_1            6400000     4000000     6400000     4000000     
    22 fw_env              a400000     100000      a400000     100000      
    23 config              a500000     800000      a500000     800000      
    24 PKI                 ad00000     200000      ad00000     200000      
    25 scfgmgr             af00000     100000      af00000     100000      
Hit any key to stop autoboot:  0 
DOWNLOAD MODE BIT CHECK
INTO NORMAL MODE:ff ff
MMC Device 0 not found
MMC Device 0 not found
Creating 1 MTD partitions on "nand0":
0x000006400000-0x00000a400000 : "mtd=0"
UBI: attaching mtd1 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: attached mtd1 to ubi0
UBI: MTD device name:            "mtd=0"
UBI: MTD device size:            64 MiB
UBI: number of good PEBs:        512
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     3
UBI: available PEBs:             222
UBI: total number of reserved PEBs: 290
UBI: number of PEBs reserved for bad PEB handling: 5
UBI: max/mean erase counter: 68/2
Read 0 bytes from volume kernel to 44000000
No size specified -> Using max size (4063232)
## Booting kernel from FIT Image at 44000000 ...
   Using 'config@4704_3' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM Linux-3.14.43
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x44000104
     Data Size:    3364674 Bytes = 3.2 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x42208000
     Entry Point:  0x42208000
     Hash algo:    crc32
     Hash value:   02a8d79f
     Hash algo:    sha1
     Hash value:   b087bd50333a5a9f5425c73a956cfd8f40fb3d3e
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Flattened Device Tree from FIT Image at 44000000
   Using 'config@4704_3' configuration
   Trying 'fdt@3' FDT blob subimage
     Description:  ARM qcom_ipq806x_ap.akxx device tree blob
     Type:         Flat Device Tree
     Compression:  gzip compressed
     Data Start:   0x44338cf8
     Data Size:    6446 Bytes = 6.3 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   407be927
     Hash algo:    sha1
     Hash value:   c754eaafaac8105e838947ac245594531d90d07a
   Verifying Hash Integrity ... crc32+ sha1+ OK
   gzip compressed FDT image found
   FDT load address is: 0x43f00000
   Loading FDT from 0x44338cf8 to 0x43f00000
   Uncompressing Flat Device Tree ... OK
   Booting using the fdt blob at 0x43f00000
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 47ff6000, end 47fff501 ... OK
mtdparts = mtdparts=nand0:256K@0x0(0:SBL1),1280K@0x40000(0:MIBIB),1280K@0x53a0000(0:SBL2),2560K@0x54e0000(0:SBL3),1152K@0x5760000(0:DDRCONFIG),1152K@0x660000(0:SSD),2560K@0x59a0000(0:TZ),2560K@0x5c20000(0:RPM),5M@0x5f00000(0:APPSBL),512K@0x1180000(0:APPSBLENV),1280K@0x1200000(0:ART),64M@0x6400000(rootfs),384K@0x5340000(0:BOOTCONFIG),1280K@0x180000(0:SBL2_1),2560K@0x2c0000(0:SBL3_1),1152K@0x540000(0:DDRCONFIG_1),1152K@0x5880000(0:SSD_1),2560K@0x780000(0:TZ_1),2560K@0xa00000(0:RPM_1),384K@0x5ea0000(0:BOOTCONFIG1),5M@0xc80000(0:APPSBL_1),64M@0x1340000(rootfs_1),1024K@0xa400000(fw_env),8M@0xa500000(config),2M@0xad00000(PKI),1024K@0xaf00000(scfgmgr),
Device nand1 not found!
Using machid 0x1260 from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0

[...]

 SSDK Init OK!
operate done.

BusyBox v1.22.1 (2019-11-08 20:31:25 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

     MM           NM                    MMMMMMM          M       M
   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
  MMMMMMM:      MMMMMMM     M         MMMMMMMMMMMM  MMMMMMM MMMMMMM
    MMMMMM       MMMMN     M           MMMMMMMMM      MMMM    MMMM
     MMMM          M                    MMMMMMM        M       M
       M
 ---------------------------------------------------------------
   For those about to rock... (Bleeding Edge, r1602)
 ---------------------------------------------------------------
root@OpenWrt:~# 

root@OpenWrt:~# 

root@OpenWrt:~# cat /proc/mtd   
cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "0:SBL1"
mtd1: 00140000 00020000 "0:MIBIB"
mtd2: 00140000 00020000 "0:SBL2_1"
mtd3: 00280000 00020000 "0:SBL3_1"
mtd4: 00120000 00020000 "0:DDRCONFIG_1"
mtd5: 00120000 00020000 "0:SSD"
mtd6: 00280000 00020000 "0:TZ_1"
mtd7: 00280000 00020000 "0:RPM_1"
mtd8: 00500000 00020000 "0:APPSBL_1"
mtd9: 00080000 00020000 "0:APPSBLENV"
mtd10: 00140000 00020000 "0:ART"
mtd11: 04000000 00020000 "rootfs_1"
mtd12: 00060000 00020000 "0:BOOTCONFIG"
mtd13: 00140000 00020000 "0:SBL2"
mtd14: 00280000 00020000 "0:SBL3"
mtd15: 00120000 00020000 "0:DDRCONFIG"
mtd16: 00120000 00020000 "0:SSD_1"
mtd17: 00280000 00020000 "0:TZ"
mtd18: 00280000 00020000 "0:RPM"
mtd19: 00060000 00020000 "0:BOOTCONFIG1"
mtd20: 00500000 00020000 "0:APPSBL"
mtd21: 04000000 00020000 "rootfs"
mtd22: 00100000 00020000 "fw_env"
mtd23: 00800000 00020000 "config"
mtd24: 00200000 00020000 "PKI"
mtd25: 00100000 00020000 "scfgmgr"
mtd26: 00008000 00008000 "spi32766.0"
mtd27: 003e0000 0001f000 "kernel"
mtd28: 01e08000 0001f000 "ubi_rootfs"
mtd29: 0001f000 0001f000 "rootfs_data"
mtd30: 00744000 0001f000 "ubi_config"
root@OpenWrt:~# cat /dev/mtd21 | ubiformat /dev/mtd11 -f -
cat /dev/mtd21 | ubiformat /dev/mtd11 -f -
ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 511 -- 100 % complete  
ubiformat: 510 eraseblocks have valid erase counter, mean value is 2
ubiformat: 2 bad eraseblocks found, numbers: 232, 234
ubiformat: error!: must use '-S' with non-zero value when reading from stdin
cat: write error: Broken pipe
root@OpenWrt:~# ubiformat /dev/mtd11 -f /dev/mtd21
ubiformat /dev/mtd11 -f /dev/mtd21
ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 511 -- 100 % complete  
ubiformat: 510 eraseblocks have valid erase counter, mean value is 2
ubiformat: 2 bad eraseblocks found, numbers: 232, 234
Floating point exception
root@OpenWrt:~# # hmmmmm...
# hmmmmm...
root@OpenWrt:~# ubiattach -m 11
ubiattach -m 11
UBI device number 2, total 510 LEBs (64757760 bytes, 61.8 MiB), available 288 LEBs (36569088 bytes, 34.9 MiB), LEB size 126976 bytes (124.0 KiB)
root@OpenWrt:~# md5sum /dev/ubi*_*
md5sum /dev/ubi*_*
1e7876636109535510dd7cee16386d36  /dev/ubi0_0
edcd4e0e5732f18e81da7b33892fe784  /dev/ubi0_1
f7d566ac0d14fb993db66ed5ea370797  /dev/ubi0_2
f6f1ef4942c4539e992431e2eb504e9b  /dev/ubi1_0
18dd98b1ec7b488ab258e08d0e9aca2d  /dev/ubi2_0
65f361c1be627f2da8ba791d65795bf5  /dev/ubi2_1
f7d566ac0d14fb993db66ed5ea370797  /dev/ubi2_2
md5sum: can't read '/dev/ubi_ctrl': Invalid argument
root@OpenWrt:~# ubinfo -a
ubinfo -a
UBI version:                    1
Count of UBI devices:           3
UBI control device major/minor: 10:60
Present UBI devices:            ubi0, ubi1, ubi2

ubi0
Volumes count:                           3
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     512 (65011712 bytes, 62.0 MiB)
Amount of available logical eraseblocks: 227 (28823552 bytes, 27.5 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     68
Minimum input/output unit size:          2048 bytes
Character device major/minor:            249:0
Present volumes:                         0, 1, 2

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        32 LEBs (4063232 bytes, 3.9 MiB)
State:       OK
Name:        kernel
Character device major/minor: 249:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        248 LEBs (31490048 bytes, 30.0 MiB)
State:       OK
Name:        ubi_rootfs
Character device major/minor: 249:2
-----------------------------------
Volume ID:   2 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        1 LEBs (126976 bytes, 124.0 KiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 249:3

===================================

ubi1
Volumes count:                           1
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     64 (8126464 bytes, 7.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            248:0
Present volumes:                         0

Volume ID:   0 (on ubi1)
Type:        dynamic
Alignment:   1
Size:        60 LEBs (7618560 bytes, 7.3 MiB)
State:       OK
Name:        ubi_config
Character device major/minor: 248:1

===================================

ubi2
Volumes count:                           3
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     510 (64757760 bytes, 61.8 MiB)
Amount of available logical eraseblocks: 288 (36569088 bytes, 34.9 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       2
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     226
Minimum input/output unit size:          2048 bytes
Character device major/minor:            243:0
Present volumes:                         0, 1, 2

Volume ID:   0 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        32 LEBs (4063232 bytes, 3.9 MiB)
State:       OK
Name:        kernel
Character device major/minor: 243:1
-----------------------------------
Volume ID:   1 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        185 LEBs (23490560 bytes, 22.4 MiB)
State:       OK
Name:        ubi_rootfs
Character device major/minor: 243:2
-----------------------------------
Volume ID:   2 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        1 LEBs (126976 bytes, 124.0 KiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 243:3
root@OpenWrt:~# ubidetach -m 11
ubidetach -m 11
root@OpenWrt:~# mtd --help
mtd --help
mtd: invalid option -- -
Usage: mtd [<options> ...] <command> [<arguments> ...] <device>[:<device>...]

The device is in the format of mtdX (eg: mtd4) or its label.
mtd recognizes these commands:
        unlock                  unlock the device
        refresh                 refresh mtd partition
        erase                   erase all data on device
        verify <imagefile>|-    verify <imagefile> (use - for stdin) to device
        write <imagefile>|-     write <imagefile> (use - for stdin) to device
        jffs2write <file>       append <file> to the jffs2 partition on the device
Following options are available:
        -q                      quiet mode (once: no [w] on writing,
                                           twice: no status messages)
        -n                      write without first erasing the blocks
        -r                      reboot after successful command
        -f                      force write without trx checks
        -e <device>             erase <device> before executing the command
        -d <name>               directory for jffs2write, defaults to "tmp"
        -j <name>               integrate <file> into jffs2 data when writing an image
        -s <number>             skip the first n bytes when appending data to the jffs2 partiton, defaults to "0"
        -p                      write beginning at partition offset

Example: To write linux.trx to mtd4 labeled as linux and reboot afterwards
         mtd -r write linux.trx linux

root@OpenWrt:~# mtd erase /dev/mtd11
mtd erase /dev/mtd11
Unlocking /dev/mtd11 ...
Erasing /dev/mtd11 ...

Skipping bad block at 0x1d00000   
Skipping bad block at 0x1d40000   root@OpenWrt:~# 

root@OpenWrt:~# cat /dev/mtd21 | ubiformat /dev/mtd11 -f -
cat /dev/mtd21 | ubiformat /dev/mtd11 -f -
ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 511 -- 100 % complete  
ubiformat: 510 eraseblocks are supposedly empty
ubiformat: 2 bad eraseblocks found, numbers: 232, 234
ubiformat: error!: must use '-S' with non-zero value when reading from stdin
cat: write error: Broken pipe
root@OpenWrt:~# ubiformat /dev/mtd11 -f /dev/mtd21
ubiformat /dev/mtd11 -f /dev/mtd21
ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 511 -- 100 % complete  
ubiformat: 510 eraseblocks are supposedly empty
ubiformat: 2 bad eraseblocks found, numbers: 232, 234
Floating point exception
root@OpenWrt:~# ubiattach -m 11
ubiattach -m 11
UBI device number 2, total 510 LEBs (64757760 bytes, 61.8 MiB), available 506 LEBs (64249856 bytes, 61.3 MiB), LEB size 126976 bytes (124.0 KiB)
root@OpenWrt:~# ubinfo -a   
ubinfo -a
UBI version:                    1
Count of UBI devices:           3
UBI control device major/minor: 10:60
Present UBI devices:            ubi0, ubi1, ubi2

ubi0
Volumes count:                           3
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     512 (65011712 bytes, 62.0 MiB)
Amount of available logical eraseblocks: 227 (28823552 bytes, 27.5 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     68
Minimum input/output unit size:          2048 bytes
Character device major/minor:            249:0
Present volumes:                         0, 1, 2

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        32 LEBs (4063232 bytes, 3.9 MiB)
State:       OK
Name:        kernel
Character device major/minor: 249:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        248 LEBs (31490048 bytes, 30.0 MiB)
State:       OK
Name:        ubi_rootfs
Character device major/minor: 249:2
-----------------------------------
Volume ID:   2 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        1 LEBs (126976 bytes, 124.0 KiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 249:3

===================================

ubi1
Volumes count:                           1
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     64 (8126464 bytes, 7.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            248:0
Present volumes:                         0

Volume ID:   0 (on ubi1)
Type:        dynamic
Alignment:   1
Size:        60 LEBs (7618560 bytes, 7.3 MiB)
State:       OK
Name:        ubi_config
Character device major/minor: 248:1

===================================

ubi2
Volumes count:                           0
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     510 (64757760 bytes, 61.8 MiB)
Amount of available logical eraseblocks: 506 (64249856 bytes, 61.3 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       2
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     1
Minimum input/output unit size:          2048 bytes
Character device major/minor:            243:0
root@OpenWrt:~# ubimkvol /dev/ubi2 -N kernel -S 32
ubimkvol /dev/ubi2 -N kernel -S 32
Volume ID 0, size 32 LEBs (4063232 bytes, 3.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
root@OpenWrt:~# ubimkvol /dev/ubi2 -N ubi_rootfs -S 248
ubimkvol /dev/ubi2 -N ubi_rootfs -S 248
Volume ID 1, size 248 LEBs (31490048 bytes, 30.0 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "ubi_rootfs", alignment 1
root@OpenWrt:~# ubimkvol /dev/ubi2 -N rootfs_data -S 1
ubimkvol /dev/ubi2 -N rootfs_data -S 1
Volume ID 2, size 1 LEBs (126976 bytes, 124.0 KiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
root@OpenWrt:~# ubinfo -a
ubinfo -a
UBI version:                    1
Count of UBI devices:           3
UBI control device major/minor: 10:60
Present UBI devices:            ubi0, ubi1, ubi2

ubi0
Volumes count:                           3
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     512 (65011712 bytes, 62.0 MiB)
Amount of available logical eraseblocks: 227 (28823552 bytes, 27.5 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     68
Minimum input/output unit size:          2048 bytes
Character device major/minor:            249:0
Present volumes:                         0, 1, 2

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        32 LEBs (4063232 bytes, 3.9 MiB)
State:       OK
Name:        kernel
Character device major/minor: 249:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        248 LEBs (31490048 bytes, 30.0 MiB)
State:       OK
Name:        ubi_rootfs
Character device major/minor: 249:2
-----------------------------------
Volume ID:   2 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        1 LEBs (126976 bytes, 124.0 KiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 249:3

===================================

ubi1
Volumes count:                           1
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     64 (8126464 bytes, 7.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            248:0
Present volumes:                         0

Volume ID:   0 (on ubi1)
Type:        dynamic
Alignment:   1
Size:        60 LEBs (7618560 bytes, 7.3 MiB)
State:       OK
Name:        ubi_config
Character device major/minor: 248:1

===================================

ubi2
Volumes count:                           3
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     510 (64757760 bytes, 61.8 MiB)
Amount of available logical eraseblocks: 225 (28569600 bytes, 27.2 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       2
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            243:0
Present volumes:                         0, 1, 2

Volume ID:   0 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        32 LEBs (4063232 bytes, 3.9 MiB)
State:       OK
Name:        kernel
Character device major/minor: 243:1
-----------------------------------
Volume ID:   1 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        248 LEBs (31490048 bytes, 30.0 MiB)
State:       OK
Name:        ubi_rootfs
Character device major/minor: 243:2
-----------------------------------
Volume ID:   2 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        1 LEBs (126976 bytes, 124.0 KiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 243:3
root@OpenWrt:~# ubiupdatevol /dev/ubi2_0 /dev/ubi0_0       
ubiupdatevol /dev/ubi2_0 /dev/ubi0_0
root@OpenWrt:~# md5sum /dev/ubi*_0
md5sum /dev/ubi*_0
1e7876636109535510dd7cee16386d36  /dev/ubi0_0
f6f1ef4942c4539e992431e2eb504e9b  /dev/ubi1_0
faa1e5da33e5779508737687b3d68778  /dev/ubi2_0
root@OpenWrt:~# hexdump -C /dev/ubi0_0 | head
hexdump -C /dev/ubi0_0 | head
00000000  d0 0d fe ed 00 3e 00 00  00 00 00 38 00 36 17 4c  |.....>.....8.6.L|
00000010  00 00 00 28 00 00 00 11  00 00 00 10 00 00 00 00  |...(............|
00000020  00 00 00 6c 00 36 17 14  00 00 00 00 00 00 00 00  |...l.6..........|
00000030  00 00 00 00 00 00 00 00  00 00 00 01 00 00 00 00  |................|
00000040  00 00 00 03 00 00 00 04  00 00 00 62 5d c8 cb 41  |...........b]..A|
00000050  00 00 00 03 00 00 00 1f  00 00 00 00 41 52 4d 20  |............ARM |
00000060  46 49 54 20 28 46 6c 61  74 74 65 6e 65 64 20 49  |FIT (Flattened I|
00000070  6d 61 67 65 20 54 72 65  65 29 00 00 00 00 00 03  |mage Tree)......|
00000080  00 00 00 04 00 00 00 0c  00 00 00 01 00 00 00 01  |................|
00000090  69 6d 61 67 65 2d 69 6e  66 6f 00 00 00 00 00 03  |image-info......|
root@OpenWrt:~# 
root@OpenWrt:~# hexdump -C /dev/ubi2_0 | head
hexdump -C /dev/ubi2_0 | head
00000000  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
003e0000
root@OpenWrt:~# cd /tmp 
cd /tmp
root@OpenWrt:/tmp# cat /dev/ubi0_0 >u0
cat /dev/ubi0_0 >u0
root@OpenWrt:/tmp# md5sum u0 /dev/ubi0_0
md5sum u0 /dev/ubi0_0
1e7876636109535510dd7cee16386d36  u0
1e7876636109535510dd7cee16386d36  /dev/ubi0_0
root@OpenWrt:/tmp# ubiupdatevol /dev/ubi2_0 u0
ubiupdatevol /dev/ubi2_0 u0
root@OpenWrt:/tmp# md5sum /dev/ubi*_0
md5sum /dev/ubi*_0
1e7876636109535510dd7cee16386d36  /dev/ubi0_0
f6f1ef4942c4539e992431e2eb504e9b  /dev/ubi1_0
1e7876636109535510dd7cee16386d36  /dev/ubi2_0
root@OpenWrt:/tmp# # cool !!!!
# cool !!!!
root@OpenWrt:/tmp# cat /dev/ubi0_1 >u1
cat /dev/ubi0_1 >u1
root@OpenWrt:/tmp# cat /dev/ubi0_2 >u2        
cat /dev/ubi0_2 >u2
root@OpenWrt:/tmp# ubiupdatevol /dev/ubi2_1 u1
ubiupdatevol /dev/ubi2_1 u1
root@OpenWrt:/tmp# ubiupdatevol /dev/ubi2_2 u2
ubiupdatevol /dev/ubi2_2 u2
root@OpenWrt:/tmp# md5sum /dev/ubi*_*
md5sum /dev/ubi*_*
1e7876636109535510dd7cee16386d36  /dev/ubi0_0
edcd4e0e5732f18e81da7b33892fe784  /dev/ubi0_1
f7d566ac0d14fb993db66ed5ea370797  /dev/ubi0_2
f6f1ef4942c4539e992431e2eb504e9b  /dev/ubi1_0
1e7876636109535510dd7cee16386d36  /dev/ubi2_0
edcd4e0e5732f18e81da7b33892fe784  /dev/ubi2_1
f7d566ac0d14fb993db66ed5ea370797  /dev/ubi2_2
md5sum: can't read '/dev/ubi_ctrl': Invalid argument
root@OpenWrt:/tmp# # cool, all volumret = 0
es copied
# cool, all volumes copied
root@OpenWrt:/tmp# reboot
uragit commented 1 year ago

Sounds good.

Should I worry about the bad blocks?

Let me know if you need any power resets or ethernet connectivity on the board.

--

Martin

On Thu, Dec 01, 2022 at 11:14:34PM -0800, Lanchon wrote:

first part ready. bad blocks, but i was able to copy volumes one by one instead of the whole device...

***@***.***:~$ sshpass -p ********* ssh -o KexAlgorithms=diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=ssh-rsa,ssh-dss -p 222 ***@***.***
hello

***@***.***:~# 

***@***.***:~# ls
ls
bin      dev      home     mnt      proc     sbin     tmp      var
config   etc      lib      overlay  rom      sys      usr      www
***@***.***:~# 

***@***.***:~# reboot
reboot
procd: - reboot -
***@***.***:~# [41370.541686] reboot: Restarting system

U-Boot 2012.07 [Barrier Breaker r1596,r1596] (Nov 08 2019 - 19:18:40)

smem ram ptable found: ver: 0 len: 5
DRAM:  491 MiB
NAND:  SF: Unsupported manufacturer 00
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC:   
NAND read from offset 1180000 failed -74
*** Warning - readenv() failed, using default environment

In:    serial
Out:   serial
Err:   serial
MMC Device 0 not found
cdp: get part failed for 0:HLOS
Net:   MAC0 addr:0:3:7f:ba:db:0
athrs17_reg_init: complete
athrs17_vlan_config: Sercomm modify vlan config
athrs17_vlan_config ...done
S17c init  done
MAC1 addr:0:3:7f:ba:db:1
MAC2 addr:0:3:7f:ba:db:2
Port:2 speed 10Mbps
MAC3 addr:0:3:7f:ba:db:3
Port:3 speed 10Mbps
eth0, eth1, eth2, eth3
Done!
 Index Name                Offset      Length      Real_Offs   Real_Size   
     0 SBL1                0           40000       0           40000       
     1 MIBIB               40000       140000      40000       140000      
     2 SBL2                180000      140000      180000      140000      
     3 SBL3                2c0000      280000      2c0000      280000      
     4 DDRCONFIG           540000      120000      540000      120000      
     5 SSD                 660000      120000      660000      120000      
     6 TZ                  780000      280000      780000      280000      
     7 RPM                 a00000      280000      a00000      280000      
     8 APPSBL              c80000      500000      c80000      500000      
     9 APPSBLENV           1180000     80000       1180000     80000       
    10 ART                 1200000     140000      1200000     140000      
    11 rootfs              1340000     4000000     1340000     4000000     
    12 BOOTCONFIG          5340000     60000       5340000     60000       
    13 SBL2_1              53a0000     140000      53a0000     140000      
    14 SBL3_1              54e0000     280000      54e0000     280000      
    15 DDRCONFIG_1         5760000     120000      5760000     120000      
    16 SSD_1               5880000     120000      5880000     120000      
    17 TZ_1                59a0000     280000      59a0000     280000      
    18 RPM_1               5c20000     280000      5c20000     280000      
    19 BOOTCONFIG_1        5ea0000     60000       5ea0000     60000       
    20 APPSBL_1            5f00000     500000      5f00000     500000      
    21 rootfs_1            6400000     4000000     6400000     4000000     
    22 fw_env              a400000     100000      a400000     100000      
    23 config              a500000     800000      a500000     800000      
    24 PKI                 ad00000     200000      ad00000     200000      
    25 scfgmgr             af00000     100000      af00000     100000      
Hit any key to stop autoboot:  0 
DOWNLOAD MODE BIT CHECK
INTO NORMAL MODE:ff ff
MMC Device 0 not found
MMC Device 0 not found
Creating 1 MTD partitions on "nand0":
0x000006400000-0x00000a400000 : "mtd=0"
UBI: attaching mtd1 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: attached mtd1 to ubi0
UBI: MTD device name:            "mtd=0"
UBI: MTD device size:            64 MiB
UBI: number of good PEBs:        512
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     3
UBI: available PEBs:             222
UBI: total number of reserved PEBs: 290
UBI: number of PEBs reserved for bad PEB handling: 5
UBI: max/mean erase counter: 68/2
Read 0 bytes from volume kernel to 44000000
No size specified -> Using max size (4063232)
## Booting kernel from FIT Image at 44000000 ...
   Using ***@***.***_3' configuration
   Trying ***@***.***' kernel subimage
     Description:  ARM Linux-3.14.43
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x44000104
     Data Size:    3364674 Bytes = 3.2 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x42208000
     Entry Point:  0x42208000
     Hash algo:    crc32
     Hash value:   02a8d79f
     Hash algo:    sha1
     Hash value:   b087bd50333a5a9f5425c73a956cfd8f40fb3d3e
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Flattened Device Tree from FIT Image at 44000000
   Using ***@***.***_3' configuration
   Trying ***@***.***' FDT blob subimage
     Description:  ARM qcom_ipq806x_ap.akxx device tree blob
     Type:         Flat Device Tree
     Compression:  gzip compressed
     Data Start:   0x44338cf8
     Data Size:    6446 Bytes = 6.3 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   407be927
     Hash algo:    sha1
     Hash value:   c754eaafaac8105e838947ac245594531d90d07a
   Verifying Hash Integrity ... crc32+ sha1+ OK
   gzip compressed FDT image found
   FDT load address is: 0x43f00000
   Loading FDT from 0x44338cf8 to 0x43f00000
   Uncompressing Flat Device Tree ... OK
   Booting using the fdt blob at 0x43f00000
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 47ff6000, end 47fff501 ... OK
mtdparts = ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***(scfgmgr),
Device nand1 not found!
Using machid 0x1260 from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0

[...]

 SSDK Init OK!
operate done.

BusyBox v1.22.1 (2019-11-08 20:31:25 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

     MM           NM                    MMMMMMM          M       M
   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
  MMMMMMM:      MMMMMMM     M         MMMMMMMMMMMM  MMMMMMM MMMMMMM
    MMMMMM       MMMMN     M           MMMMMMMMM      MMMM    MMMM
     MMMM          M                    MMMMMMM        M       M
       M
 ---------------------------------------------------------------
   For those about to rock... (Bleeding Edge, r1602)
 ---------------------------------------------------------------
***@***.***:~# 

***@***.***:~# 

***@***.***:~# cat /proc/mtd  
cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "0:SBL1"
mtd1: 00140000 00020000 "0:MIBIB"
mtd2: 00140000 00020000 "0:SBL2_1"
mtd3: 00280000 00020000 "0:SBL3_1"
mtd4: 00120000 00020000 "0:DDRCONFIG_1"
mtd5: 00120000 00020000 "0:SSD"
mtd6: 00280000 00020000 "0:TZ_1"
mtd7: 00280000 00020000 "0:RPM_1"
mtd8: 00500000 00020000 "0:APPSBL_1"
mtd9: 00080000 00020000 "0:APPSBLENV"
mtd10: 00140000 00020000 "0:ART"
mtd11: 04000000 00020000 "rootfs_1"
mtd12: 00060000 00020000 "0:BOOTCONFIG"
mtd13: 00140000 00020000 "0:SBL2"
mtd14: 00280000 00020000 "0:SBL3"
mtd15: 00120000 00020000 "0:DDRCONFIG"
mtd16: 00120000 00020000 "0:SSD_1"
mtd17: 00280000 00020000 "0:TZ"
mtd18: 00280000 00020000 "0:RPM"
mtd19: 00060000 00020000 "0:BOOTCONFIG1"
mtd20: 00500000 00020000 "0:APPSBL"
mtd21: 04000000 00020000 "rootfs"
mtd22: 00100000 00020000 "fw_env"
mtd23: 00800000 00020000 "config"
mtd24: 00200000 00020000 "PKI"
mtd25: 00100000 00020000 "scfgmgr"
mtd26: 00008000 00008000 "spi32766.0"
mtd27: 003e0000 0001f000 "kernel"
mtd28: 01e08000 0001f000 "ubi_rootfs"
mtd29: 0001f000 0001f000 "rootfs_data"
mtd30: 00744000 0001f000 "ubi_config"
***@***.***:~# cat /dev/mtd21 | ubiformat /dev/mtd11 -f -
cat /dev/mtd21 | ubiformat /dev/mtd11 -f -
ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 511 -- 100 % complete  
ubiformat: 510 eraseblocks have valid erase counter, mean value is 2
ubiformat: 2 bad eraseblocks found, numbers: 232, 234
ubiformat: error!: must use '-S' with non-zero value when reading from stdin
cat: write error: Broken pipe
***@***.***:~# ubiformat /dev/mtd11 -f /dev/mtd21
ubiformat /dev/mtd11 -f /dev/mtd21
ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 511 -- 100 % complete  
ubiformat: 510 eraseblocks have valid erase counter, mean value is 2
ubiformat: 2 bad eraseblocks found, numbers: 232, 234
Floating point exception
***@***.***:~# # hmmmmm...
# hmmmmm...
***@***.***:~# ubiattach -m 11
ubiattach -m 11
UBI device number 2, total 510 LEBs (64757760 bytes, 61.8 MiB), available 288 LEBs (36569088 bytes, 34.9 MiB), LEB size 126976 bytes (124.0 KiB)
***@***.***:~# md5sum /dev/ubi*_*
md5sum /dev/ubi*_*
1e7876636109535510dd7cee16386d36  /dev/ubi0_0
edcd4e0e5732f18e81da7b33892fe784  /dev/ubi0_1
f7d566ac0d14fb993db66ed5ea370797  /dev/ubi0_2
f6f1ef4942c4539e992431e2eb504e9b  /dev/ubi1_0
18dd98b1ec7b488ab258e08d0e9aca2d  /dev/ubi2_0
65f361c1be627f2da8ba791d65795bf5  /dev/ubi2_1
f7d566ac0d14fb993db66ed5ea370797  /dev/ubi2_2
md5sum: can't read '/dev/ubi_ctrl': Invalid argument
***@***.***:~# ubinfo -a
ubinfo -a
UBI version:                    1
Count of UBI devices:           3
UBI control device major/minor: 10:60
Present UBI devices:            ubi0, ubi1, ubi2

ubi0
Volumes count:                           3
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     512 (65011712 bytes, 62.0 MiB)
Amount of available logical eraseblocks: 227 (28823552 bytes, 27.5 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     68
Minimum input/output unit size:          2048 bytes
Character device major/minor:            249:0
Present volumes:                         0, 1, 2

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        32 LEBs (4063232 bytes, 3.9 MiB)
State:       OK
Name:        kernel
Character device major/minor: 249:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        248 LEBs (31490048 bytes, 30.0 MiB)
State:       OK
Name:        ubi_rootfs
Character device major/minor: 249:2
-----------------------------------
Volume ID:   2 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        1 LEBs (126976 bytes, 124.0 KiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 249:3

===================================

ubi1
Volumes count:                           1
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     64 (8126464 bytes, 7.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            248:0
Present volumes:                         0

Volume ID:   0 (on ubi1)
Type:        dynamic
Alignment:   1
Size:        60 LEBs (7618560 bytes, 7.3 MiB)
State:       OK
Name:        ubi_config
Character device major/minor: 248:1

===================================

ubi2
Volumes count:                           3
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     510 (64757760 bytes, 61.8 MiB)
Amount of available logical eraseblocks: 288 (36569088 bytes, 34.9 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       2
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     226
Minimum input/output unit size:          2048 bytes
Character device major/minor:            243:0
Present volumes:                         0, 1, 2

Volume ID:   0 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        32 LEBs (4063232 bytes, 3.9 MiB)
State:       OK
Name:        kernel
Character device major/minor: 243:1
-----------------------------------
Volume ID:   1 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        185 LEBs (23490560 bytes, 22.4 MiB)
State:       OK
Name:        ubi_rootfs
Character device major/minor: 243:2
-----------------------------------
Volume ID:   2 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        1 LEBs (126976 bytes, 124.0 KiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 243:3
***@***.***:~# ubidetach -m 11
ubidetach -m 11
***@***.***:~# mtd --help
mtd --help
mtd: invalid option -- -
Usage: mtd [<options> ...] <command> [<arguments> ...] <device>[:<device>...]

The device is in the format of mtdX (eg: mtd4) or its label.
mtd recognizes these commands:
        unlock                  unlock the device
        refresh                 refresh mtd partition
        erase                   erase all data on device
        verify <imagefile>|-    verify <imagefile> (use - for stdin) to device
        write <imagefile>|-     write <imagefile> (use - for stdin) to device
        jffs2write <file>       append <file> to the jffs2 partition on the device
Following options are available:
        -q                      quiet mode (once: no [w] on writing,
                                           twice: no status messages)
        -n                      write without first erasing the blocks
        -r                      reboot after successful command
        -f                      force write without trx checks
        -e <device>             erase <device> before executing the command
        -d <name>               directory for jffs2write, defaults to "tmp"
        -j <name>               integrate <file> into jffs2 data when writing an image
        -s <number>             skip the first n bytes when appending data to the jffs2 partiton, defaults to "0"
        -p                      write beginning at partition offset

Example: To write linux.trx to mtd4 labeled as linux and reboot afterwards
         mtd -r write linux.trx linux

***@***.***:~# mtd erase /dev/mtd11
mtd erase /dev/mtd11
Unlocking /dev/mtd11 ...
Erasing /dev/mtd11 ...

Skipping bad block at 0x1d00000   
Skipping bad block at 0x1d40000   ***@***.***:~# 

***@***.***:~# cat /dev/mtd21 | ubiformat /dev/mtd11 -f -
cat /dev/mtd21 | ubiformat /dev/mtd11 -f -
ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 511 -- 100 % complete  
ubiformat: 510 eraseblocks are supposedly empty
ubiformat: 2 bad eraseblocks found, numbers: 232, 234
ubiformat: error!: must use '-S' with non-zero value when reading from stdin
cat: write error: Broken pipe
***@***.***:~# ubiformat /dev/mtd11 -f /dev/mtd21
ubiformat /dev/mtd11 -f /dev/mtd21
ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 511 -- 100 % complete  
ubiformat: 510 eraseblocks are supposedly empty
ubiformat: 2 bad eraseblocks found, numbers: 232, 234
Floating point exception
***@***.***:~# ubiattach -m 11
ubiattach -m 11
UBI device number 2, total 510 LEBs (64757760 bytes, 61.8 MiB), available 506 LEBs (64249856 bytes, 61.3 MiB), LEB size 126976 bytes (124.0 KiB)
***@***.***:~# ubinfo -a   
ubinfo -a
UBI version:                    1
Count of UBI devices:           3
UBI control device major/minor: 10:60
Present UBI devices:            ubi0, ubi1, ubi2

ubi0
Volumes count:                           3
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     512 (65011712 bytes, 62.0 MiB)
Amount of available logical eraseblocks: 227 (28823552 bytes, 27.5 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     68
Minimum input/output unit size:          2048 bytes
Character device major/minor:            249:0
Present volumes:                         0, 1, 2

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        32 LEBs (4063232 bytes, 3.9 MiB)
State:       OK
Name:        kernel
Character device major/minor: 249:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        248 LEBs (31490048 bytes, 30.0 MiB)
State:       OK
Name:        ubi_rootfs
Character device major/minor: 249:2
-----------------------------------
Volume ID:   2 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        1 LEBs (126976 bytes, 124.0 KiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 249:3

===================================

ubi1
Volumes count:                           1
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     64 (8126464 bytes, 7.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            248:0
Present volumes:                         0

Volume ID:   0 (on ubi1)
Type:        dynamic
Alignment:   1
Size:        60 LEBs (7618560 bytes, 7.3 MiB)
State:       OK
Name:        ubi_config
Character device major/minor: 248:1

===================================

ubi2
Volumes count:                           0
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     510 (64757760 bytes, 61.8 MiB)
Amount of available logical eraseblocks: 506 (64249856 bytes, 61.3 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       2
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     1
Minimum input/output unit size:          2048 bytes
Character device major/minor:            243:0
***@***.***:~# ubimkvol /dev/ubi2 -N kernel -S 32
ubimkvol /dev/ubi2 -N kernel -S 32
Volume ID 0, size 32 LEBs (4063232 bytes, 3.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
***@***.***:~# ubimkvol /dev/ubi2 -N ubi_rootfs -S 248
ubimkvol /dev/ubi2 -N ubi_rootfs -S 248
Volume ID 1, size 248 LEBs (31490048 bytes, 30.0 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "ubi_rootfs", alignment 1
***@***.***:~# ubimkvol /dev/ubi2 -N rootfs_data -S 1
ubimkvol /dev/ubi2 -N rootfs_data -S 1
Volume ID 2, size 1 LEBs (126976 bytes, 124.0 KiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
***@***.***:~# ubinfo -a
ubinfo -a
UBI version:                    1
Count of UBI devices:           3
UBI control device major/minor: 10:60
Present UBI devices:            ubi0, ubi1, ubi2

ubi0
Volumes count:                           3
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     512 (65011712 bytes, 62.0 MiB)
Amount of available logical eraseblocks: 227 (28823552 bytes, 27.5 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     68
Minimum input/output unit size:          2048 bytes
Character device major/minor:            249:0
Present volumes:                         0, 1, 2

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        32 LEBs (4063232 bytes, 3.9 MiB)
State:       OK
Name:        kernel
Character device major/minor: 249:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        248 LEBs (31490048 bytes, 30.0 MiB)
State:       OK
Name:        ubi_rootfs
Character device major/minor: 249:2
-----------------------------------
Volume ID:   2 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        1 LEBs (126976 bytes, 124.0 KiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 249:3

===================================

ubi1
Volumes count:                           1
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     64 (8126464 bytes, 7.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            248:0
Present volumes:                         0

Volume ID:   0 (on ubi1)
Type:        dynamic
Alignment:   1
Size:        60 LEBs (7618560 bytes, 7.3 MiB)
State:       OK
Name:        ubi_config
Character device major/minor: 248:1

===================================

ubi2
Volumes count:                           3
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     510 (64757760 bytes, 61.8 MiB)
Amount of available logical eraseblocks: 225 (28569600 bytes, 27.2 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       2
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            243:0
Present volumes:                         0, 1, 2

Volume ID:   0 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        32 LEBs (4063232 bytes, 3.9 MiB)
State:       OK
Name:        kernel
Character device major/minor: 243:1
-----------------------------------
Volume ID:   1 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        248 LEBs (31490048 bytes, 30.0 MiB)
State:       OK
Name:        ubi_rootfs
Character device major/minor: 243:2
-----------------------------------
Volume ID:   2 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        1 LEBs (126976 bytes, 124.0 KiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 243:3
***@***.***:~# ubiupdatevol /dev/ubi2_0 /dev/ubi0_0       
ubiupdatevol /dev/ubi2_0 /dev/ubi0_0
***@***.***:~# md5sum /dev/ubi*_0
md5sum /dev/ubi*_0
1e7876636109535510dd7cee16386d36  /dev/ubi0_0
f6f1ef4942c4539e992431e2eb504e9b  /dev/ubi1_0
faa1e5da33e5779508737687b3d68778  /dev/ubi2_0
***@***.***:~# hexdump -C /dev/ubi0_0 | head
hexdump -C /dev/ubi0_0 | head
00000000  d0 0d fe ed 00 3e 00 00  00 00 00 38 00 36 17 4c  |.....>.....8.6.L|
00000010  00 00 00 28 00 00 00 11  00 00 00 10 00 00 00 00  |...(............|
00000020  00 00 00 6c 00 36 17 14  00 00 00 00 00 00 00 00  |...l.6..........|
00000030  00 00 00 00 00 00 00 00  00 00 00 01 00 00 00 00  |................|
00000040  00 00 00 03 00 00 00 04  00 00 00 62 5d c8 cb 41  |...........b]..A|
00000050  00 00 00 03 00 00 00 1f  00 00 00 00 41 52 4d 20  |............ARM |
00000060  46 49 54 20 28 46 6c 61  74 74 65 6e 65 64 20 49  |FIT (Flattened I|
00000070  6d 61 67 65 20 54 72 65  65 29 00 00 00 00 00 03  |mage Tree)......|
00000080  00 00 00 04 00 00 00 0c  00 00 00 01 00 00 00 01  |................|
00000090  69 6d 61 67 65 2d 69 6e  66 6f 00 00 00 00 00 03  |image-info......|
***@***.***:~# 
***@***.***:~# hexdump -C /dev/ubi2_0 | head
hexdump -C /dev/ubi2_0 | head
00000000  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
003e0000
***@***.***:~# cd /tmp 
cd /tmp
***@***.***:/tmp# cat /dev/ubi0_0 >u0
cat /dev/ubi0_0 >u0
***@***.***:/tmp# md5sum u0 /dev/ubi0_0
md5sum u0 /dev/ubi0_0
1e7876636109535510dd7cee16386d36  u0
1e7876636109535510dd7cee16386d36  /dev/ubi0_0
***@***.***:/tmp# ubiupdatevol /dev/ubi2_0 u0
ubiupdatevol /dev/ubi2_0 u0
***@***.***:/tmp# md5sum /dev/ubi*_0
md5sum /dev/ubi*_0
1e7876636109535510dd7cee16386d36  /dev/ubi0_0
f6f1ef4942c4539e992431e2eb504e9b  /dev/ubi1_0
1e7876636109535510dd7cee16386d36  /dev/ubi2_0
***@***.***:/tmp# # cool !!!!
# cool !!!!
***@***.***:/tmp# cat /dev/ubi0_1 >u1
cat /dev/ubi0_1 >u1
***@***.***:/tmp# cat /dev/ubi0_2 >u2        
cat /dev/ubi0_2 >u2
***@***.***:/tmp# ubiupdatevol /dev/ubi2_1 u1
ubiupdatevol /dev/ubi2_1 u1
***@***.***:/tmp# ubiupdatevol /dev/ubi2_2 u2
ubiupdatevol /dev/ubi2_2 u2
***@***.***:/tmp# md5sum /dev/ubi*_*
md5sum /dev/ubi*_*
1e7876636109535510dd7cee16386d36  /dev/ubi0_0
edcd4e0e5732f18e81da7b33892fe784  /dev/ubi0_1
f7d566ac0d14fb993db66ed5ea370797  /dev/ubi0_2
f6f1ef4942c4539e992431e2eb504e9b  /dev/ubi1_0
1e7876636109535510dd7cee16386d36  /dev/ubi2_0
edcd4e0e5732f18e81da7b33892fe784  /dev/ubi2_1
f7d566ac0d14fb993db66ed5ea370797  /dev/ubi2_2
md5sum: can't read '/dev/ubi_ctrl': Invalid argument
***@***.***:/tmp# # cool, all volumret = 0
es copied
# cool, all volumes copied
***@***.***:/tmp# reboot

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334846505 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

second part now, edit BOOTCONFIG1 to force booting from primary slot...

 SSDK Init OK!
operate done.

BusyBox v1.22.1 (2019-11-08 20:31:25 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

     MM           NM                    MMMMMMM          M       M
   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
  MMMMMMM:      MMMMMMM     M         MMMMMMMMMMMM  MMMMMMM MMMMMMM
    MMMMMM       MMMMN     M           MMMMMMMMM      MMMM    MMMM
     MMMM          M                    MMMMMMM        M       M
       M
 ---------------------------------------------------------------
   For those about to rock... (Bleeding Edge, r1602)
 ---------------------------------------------------------------
root@OpenWrt:/tmp# 

root@OpenWrt:/tmp# 

root@OpenWrt:/tmp# cd /tmp
dd if=/dev/mtd19 bs=4K count=1 >bc1
dd if=bc1 bs=1 count=4 >bc1-mod
dd if=bc1 bs=1 skip=5 count=1 >>bc1-mod
dd if=bc1 bs=1 skip=5 >>bc1-mod
cd /tmp
root@OpenWrt:/tmp# dd if=/dev/mtd19 bs=4K count=1 >bc1
1+0 records in
1+0 records out
root@OpenWrt:/tmp# dd if=bc1 bs=1 count=4 >bc1-mod
4+0 records in
4+0 records out
root@OpenWrt:/tmp# dd if=bc1 bs=1 skip=5 count=1 >>bc1-mod
1+0 records in
1+0 records out
root@OpenWrt:/tmp# dd if=bc1 bs=1 skip=5 >>bc1-mod
4091+0 records in
4091+0 records out
root@OpenWrt:/tmp# 

root@OpenWrt:/tmp# cmp -l bc1 bc1-mod
cmp -l bc1 bc1-mod
5   2   0
root@OpenWrt:/tmp# mtd erase /dev/mtd19
mtd erase /dev/mtd19
Unlocking /dev/mtd19 ...
Erasing /dev/mtd19 ...
root@OpenWrt:/tmp# mtd write bc1-mod /dev/mtd19
mtd write bc1-mod /dev/mtd19
Unlocking /dev/mtd19 ...

Writing from bc1-mod to /dev/mtd19 ...     
root@OpenWrt:/tmp# cmp -l bc1-mod /dev/mtd19
cmp -l bc1-mod /dev/mtd19
cmp: EOF on bc1-mod
root@OpenWrt:/tmp# # next boot should be from primary slot??? or maybe brick :(
# next boot should be from primary slot??? or maybe brick :(
root@OpenWrt:/tmp# reboot

yasssss!!

booted from primary slot, rootfs is now mtd11, not mtd21:

 SSDK Init OK!
operate done.

BusyBox v1.22.1 (2019-11-08 20:31:25 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

     MM           NM                    MMMMMMM          M       M
   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
  MMMMMMM:      MMMMMMM     M         MMMMMMMMMMMM  MMMMMMM MMMMMMM
    MMMMMM       MMMMN     M           MMMMMMMMM      MMMM    MMMM
     MMMM          M                    MMMMMMM        M       M
       M
 ---------------------------------------------------------------
   For those about to rock... (Bleeding Edge, r1602)
 ---------------------------------------------------------------
root@OpenWrt:~# cat /proc/mtd               
cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "0:SBL1"
mtd1: 00140000 00020000 "0:MIBIB"
mtd2: 00140000 00020000 "0:SBL2"
mtd3: 00280000 00020000 "0:SBL3"
mtd4: 00120000 00020000 "0:DDRCONFIG"
mtd5: 00120000 00020000 "0:SSD"
mtd6: 00280000 00020000 "0:TZ"
mtd7: 00280000 00020000 "0:RPM"
mtd8: 00500000 00020000 "0:APPSBL"
mtd9: 00080000 00020000 "0:APPSBLENV"
mtd10: 00140000 00020000 "0:ART"
mtd11: 04000000 00020000 "rootfs"
mtd12: 00060000 00020000 "0:BOOTCONFIG"
mtd13: 00140000 00020000 "0:SBL2_1"
mtd14: 00280000 00020000 "0:SBL3_1"
mtd15: 00120000 00020000 "0:DDRCONFIG_1"
mtd16: 00120000 00020000 "0:SSD_1"
mtd17: 00280000 00020000 "0:TZ_1"
mtd18: 00280000 00020000 "0:RPM_1"
mtd19: 00060000 00020000 "0:BOOTCONFIG1"
mtd20: 00500000 00020000 "0:APPSBL_1"
mtd21: 04000000 00020000 "rootfs_1"
mtd22: 00100000 00020000 "fw_env"
mtd23: 00800000 00020000 "config"
mtd24: 00200000 00020000 "PKI"
mtd25: 00100000 00020000 "scfgmgr"
mtd26: 00008000 00008000 "spi32766.0"
mtd27: 003e0000 0001f000 "kernel"
mtd28: 01e08000 0001f000 "ubi_rootfs"
mtd29: 0001f000 0001f000 "rootfs_data"
mtd30: 00744000 0001f000 "ubi_config"
uragit commented 1 year ago

Nice!

So we're ready for the upgrade!?

--

Martin

On Thu, Dec 01, 2022 at 11:27:16PM -0800, Lanchon wrote:

second part now, edit BOOTCONFIG1 to force booting from primary slot...

 SSDK Init OK!
operate done.

BusyBox v1.22.1 (2019-11-08 20:31:25 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

     MM           NM                    MMMMMMM          M       M
   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
  MMMMMMM:      MMMMMMM     M         MMMMMMMMMMMM  MMMMMMM MMMMMMM
    MMMMMM       MMMMN     M           MMMMMMMMM      MMMM    MMMM
     MMMM          M                    MMMMMMM        M       M
       M
 ---------------------------------------------------------------
   For those about to rock... (Bleeding Edge, r1602)
 ---------------------------------------------------------------
***@***.***:/tmp# 

***@***.***:/tmp# 

***@***.***:/tmp# cd /tmp
dd if=/dev/mtd19 bs=4K count=1 >bc1
dd if=bc1 bs=1 count=4 >bc1-mod
dd if=bc1 bs=1 skip=5 count=1 >>bc1-mod
dd if=bc1 bs=1 skip=5 >>bc1-mod
cd /tmp
***@***.***:/tmp# dd if=/dev/mtd19 bs=4K count=1 >bc1
1+0 records in
1+0 records out
***@***.***:/tmp# dd if=bc1 bs=1 count=4 >bc1-mod
4+0 records in
4+0 records out
***@***.***:/tmp# dd if=bc1 bs=1 skip=5 count=1 >>bc1-mod
1+0 records in
1+0 records out
***@***.***:/tmp# dd if=bc1 bs=1 skip=5 >>bc1-mod
4091+0 records in
4091+0 records out
***@***.***:/tmp# 

***@***.***:/tmp# cmp -l bc1 bc1-mod
cmp -l bc1 bc1-mod
5   2   0
***@***.***:/tmp# mtd erase /dev/mtd19
mtd erase /dev/mtd19
Unlocking /dev/mtd19 ...
Erasing /dev/mtd19 ...
***@***.***:/tmp# mtd write bc1-mod /dev/mtd19
mtd write bc1-mod /dev/mtd19
Unlocking /dev/mtd19 ...

Writing from bc1-mod to /dev/mtd19 ...     
***@***.***:/tmp# cmp -l bc1-mod /dev/mtd19
cmp -l bc1-mod /dev/mtd19
cmp: EOF on bc1-mod
***@***.***:/tmp# # next boot should be from primary slot??? or maybe brick :(
# next boot should be from primary slot??? or maybe brick :(
***@***.***:/tmp# reboot

yasssss!!

booted from primary slot, rootfs is now mtd11, not mtd21:

 SSDK Init OK!
operate done.

BusyBox v1.22.1 (2019-11-08 20:31:25 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

     MM           NM                    MMMMMMM          M       M
   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
  MMMMMMM:      MMMMMMM     M         MMMMMMMMMMMM  MMMMMMM MMMMMMM
    MMMMMM       MMMMN     M           MMMMMMMMM      MMMM    MMMM
     MMMM          M                    MMMMMMM        M       M
       M
 ---------------------------------------------------------------
   For those about to rock... (Bleeding Edge, r1602)
 ---------------------------------------------------------------
***@***.***:~# cat /proc/mtd               
cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "0:SBL1"
mtd1: 00140000 00020000 "0:MIBIB"
mtd2: 00140000 00020000 "0:SBL2"
mtd3: 00280000 00020000 "0:SBL3"
mtd4: 00120000 00020000 "0:DDRCONFIG"
mtd5: 00120000 00020000 "0:SSD"
mtd6: 00280000 00020000 "0:TZ"
mtd7: 00280000 00020000 "0:RPM"
mtd8: 00500000 00020000 "0:APPSBL"
mtd9: 00080000 00020000 "0:APPSBLENV"
mtd10: 00140000 00020000 "0:ART"
mtd11: 04000000 00020000 "rootfs"
mtd12: 00060000 00020000 "0:BOOTCONFIG"
mtd13: 00140000 00020000 "0:SBL2_1"
mtd14: 00280000 00020000 "0:SBL3_1"
mtd15: 00120000 00020000 "0:DDRCONFIG_1"
mtd16: 00120000 00020000 "0:SSD_1"
mtd17: 00280000 00020000 "0:TZ_1"
mtd18: 00280000 00020000 "0:RPM_1"
mtd19: 00060000 00020000 "0:BOOTCONFIG1"
mtd20: 00500000 00020000 "0:APPSBL_1"
mtd21: 04000000 00020000 "rootfs_1"
mtd22: 00100000 00020000 "fw_env"
mtd23: 00800000 00020000 "config"
mtd24: 00200000 00020000 "PKI"
mtd25: 00100000 00020000 "scfgmgr"
mtd26: 00008000 00008000 "spi32766.0"
mtd27: 003e0000 0001f000 "kernel"
mtd28: 01e08000 0001f000 "ubi_rootfs"
mtd29: 0001f000 0001f000 "rootfs_data"
mtd30: 00744000 0001f000 "ubi_config"

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334854747 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

the primary slot was corrupted, possibly because of NAND bad blocks. the rootfs volume was truncated 23 MB instead of being 31MB as it should. this was visible in the first ubinfo -a in the number of LEBs, and also in your UBI backups, but i hadn't noticed. if we hadn't rewritten the main slot we'd have a brick now lol.

Lanchon commented 1 year ago

bad blocks are normal, should not be an issue. but i guess the factory image programmer was not smart enough to restructure the UBI device around the defects, it one copy of your OS was dead. UBI IS smart enough, and that's why it shouldn't be an issue (it is working!)

Lanchon commented 1 year ago

now it's your turn to follow the standard install instructions. i can't cause i'd need ssh access to the device on top of serial access. so you do it, i'll be around some more.

uragit commented 1 year ago

Okay! I'll give it a go...

On Thu, Dec 01, 2022 at 11:34:29PM -0800, Lanchon wrote:

now it's your turn to follow the standard install instructions. i can't cause i'd need ssh access to the device on top of serial access. so you do it, i'll be around some more.

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334859546 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

my installer will complain about your OS version being unknown. just use the "force" flag to ignore that.

uragit commented 1 year ago

@. ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [54] ssh @. "sh /tmp/install-recovery.sh" | tee log1.txt

checking current firmware version (-f to disable check) md5sum: WARNING: 1 of 1 computed checksums did NOT match /etc/svn.info: FAILED

Should I go with '-f' ?

On Thu, Dec 01, 2022 at 11:34:29PM -0800, Lanchon wrote:

now it's your turn to follow the standard install instructions. i can't cause i'd need ssh access to the device on top of serial access. so you do it, i'll be around some more.

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334859546 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

lol i beat you to that one

uragit commented 1 year ago

On Thu, Dec 01, 2022 at 11:44:16PM -0800, Lanchon wrote:

lol i beat you to that one

:-)

A few errors/warnings. Does it look okay? Can go to next step...

@. ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [55] ssh @. "sh /tmp/install-recovery.sh -f" | tee log1.txt

checking for downloaded initramfs recovery image -rw------- 1 root root 6461405 Nov 10 19:02 /tmp/recovery.bin

creating recovery volume ubirmvol: error!: cannot find UBI volume "recovery" error 2 (No such file or directory) Volume ID 9, size 100 LEBs (12697600 bytes, 12.1 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "recovery", alignment 1 installing recovery

checking status of new fw_env partition stock ubi partition found, data copy from stock fw_env needed verifying contents of stock fw_env partition MySpectrumWiFi83-2G attempting backup of fw_env data Volume ID 8, size 1 LEBs (126976 bytes, 124.0 KiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "fw_env_backup", alignment 1 1+0 records in 1+0 records out copying contents of stock fw_env partition Unlocking /dev/mtd21 ... Erasing /dev/mtd21 ... Unlocking /dev/mtd21 ...

Writing from to /dev/mtd21 ... [ ]1+0 records in 1+0 records out

verifying contents of new fw_env partition MySpectrumWiFi83-2G

checking status of config ubi partition ubi1:ubi_config on /config type ubifs (rw,relatime) wiping config ubi partition Unlocking /dev/mtd23 ... Erasing /dev/mtd23 ...

setting up u-boot environment Warning: Bad CRC, using default environment

all done!

a reboot should now take you to the recovery initramfs firmware from there do a sysupgrade to a squashfs firmware to finish the install

@.*** ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [56]

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334866154 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

ubirmvol: error!: cannot find UBI volume "recovery"

Warning: Bad CRC, using default environment

the script breaks on unexpected errors. those are ok :)

uragit commented 1 year ago

Okay, rebooting. Then will flash...

On Thu, Dec 01, 2022 at 11:50:12PM -0800, Lanchon wrote:

ubirmvol: error!: cannot find UBI volume "recovery"

Warning: Bad CRC, using default environment

the script breaks on unexpected errors. those are ok :)

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334870226 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

you should be booting into a recovery ram-only system now. from there you'll install the real system.

if you ever brick and recovery doesn't invoke automatically, you should be able to run recovery manually by stopping the boot loader via the serial and entering this command there:

run boot_recovery
uragit commented 1 year ago

Flashing...

On Thu, Dec 01, 2022 at 11:57:36PM -0800, Lanchon wrote:

you should be booting into a recovery ram-only system now. from there you'll install the real system.

if you ever brick and recovery doesn't invoke automatically, you should be able to run recovery manually by stopping the boot loader via the serial and entering this command there:

run boot_recovery

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334875772 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

uragit commented 1 year ago

I think it worked!

From Luci:

System Hostname OpenWrt Model Arris TR4400 v2 Architecture ARMv7 Processor rev 0 (v7l) Target Platform ipq806x/generic Firmware Version OpenWrt 22.03.2 r19803-9a599fee93 / LuCI openwrt-22.03 branch git-22.288.45147-96ec0cd Kernel Version 5.10.146 Local Time 2022-10-14 22:47:27 Uptime 0h 3m 4s Load Average 0.07, 0.12, 0.06

On Thu, Dec 01, 2022 at 11:57:36PM -0800, Lanchon wrote:

you should be booting into a recovery ram-only system now. from there you'll install the real system.

if you ever brick and recovery doesn't invoke automatically, you should be able to run recovery manually by stopping the boot loader via the serial and entering this command there:

run boot_recovery

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334875772 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

congrats!!! it's a solid device.

now a glass of wine and bed :)

uragit commented 1 year ago

On Fri, Dec 02, 2022 at 12:06:13AM -0800, Lanchon wrote:

congrats!!! it's a solid device.

now a glass of wine and bed :)

Thanks! Enjoy the wine. And the sleeping!

I'm going to do some network config so it doesn't keep reverting to 192.168.1.1

Super excited that we got it working instead of bricking it!

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334883478 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

how is it that you were able to do the hardware mod? are you an electronics major?

how did you handle the 1.8V serial? were you able to find a ready-made adapter? got a pointer to that?

thanks!

uragit commented 1 year ago

That was some tricky soldering! I could barely see the resistor pads. Had to break out the head magnifier. I've been (hobby-level) soldering a few circuits here and there but only relatively recently attempted any surface-mount.

I'm pretty sure an electronics major would have done a better job than this [attached]!! I decided to bridge the first resistor and then just attach wirewrap wire to the pad of the missing FET. The soldering heat melts away more of the insulation than I'd have liked. Very fragile in the end but it held together. I've been paranoid about even breathing on it until we had a successful network-updateable firmware running. We'll see if it holds together when I put all the hardware back together.

Might actually have been easier to solder all the missing resistors and FETs instead of the solder-crime I perpetrated on the poor board. If I ever convert another router, I think I'll use this first one to figure out workable values for components and then have a go at populating the next board. I've never soldered SMD smaller than about 0603 before though. Might be an excuse to get that desk microscope I'm sure I need.

Like you, I was also lucky with my 3.3V USB serial adapter. It seemed perfectly happy with the 1.8V level input.

--

Martin

On Fri, Dec 02, 2022 at 07:41:31AM -0800, Lanchon wrote:

how is it that you were able to do the hardware mod? are you an electronics major?

how did you handle the 1.8V serial? were you able to find a ready-made adapter? got a pointer to that?

thanks!

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1335437294 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

uragit commented 1 year ago

Huge thanks again for all of your efforts with this. I'd have given up long ago without your endless help and detailed instructions. Very nice to have a useful device instead of another piece of useless electronics to toss in the dumpster.

I've left the networked serial port connection up in case there's any extra post-mortem (post-reincarnation?) info you need to get from the router while it's still on my desk. Or just let me know if there's any console logs or command output you'd like me to run.

I'm hoping other people will also be able to follow your instructions to mod these devices but I have to admit that the soldering part would be a major hurdle to most folks. I also hope they don't run into the strange MTD problems that we had, but at least now there's some history for them to look at!

--

Martin

On Fri, Dec 02, 2022 at 07:41:31AM -0800, Lanchon wrote:

how is it that you were able to do the hardware mod? are you an electronics major?

how did you handle the 1.8V serial? were you able to find a ready-made adapter? got a pointer to that?

thanks!

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1335437294 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

hold on! are you injecting the 3.3V signal into the 1.8V input of the SoC?

you might fry the chip any second!! or affect its reliability. the input ESD protection diode is probably conducting a sustained current and it is really not made for that! id disconnect the usb adapter asap if i were you.

uragit commented 1 year ago

No, sorry, I should have been clearer! The 1.8V -> 3.3V is just for outbound signal from router. I use 2x 10K resistors to half the inbound signal.

--

Martin

On Fri, Dec 02, 2022 at 01:42:48PM -0800, Lanchon wrote:

hold on! are you injecting the 3.3V signal into the 1.8V input of the SoC?

you might fry the chip any second!! or affect its reliability. the input ESD protection diode is probably conducting a sustained current and it is really not made for that! id disconnect the usb adapter asap if i were you.

-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1335870970 You are receiving this because you were mentioned.

Message ID: @.***>

--

Martin


Martin Emmerson.

@.*** +1 408 245 6743

Lanchon commented 1 year ago

i added detection for your case during install: https://github.com/Lanchon/openwrt-tr4400-v2/commit/f1b99b5a8e4f178c64972767a9d8893a1a2b2181

Lanchon commented 1 year ago

hi and sorry for not having time to answer properly.

soldering this MOFO is a b*tch.

also, the pads to which you are soldering the wires WILL peel off and break! it's inevitable. i'd cut those wires short and solder them to the currently disconnected though-holes of the serial connector, even if you don't add a connector. at least forces on them will diminish and they might survive. you never know when you might need serial again.

good to know you are using a voltage divider network... :+1:

I've left the networked serial port connection up

thanks! not needed anymore. AFAICK, your device is exactly like mine, but with different OS versions and some NAND flash defects.

thanks for reporting, got to know more about this platform.

take care :)