Closed uragit closed 2 years ago
hi! i was very much sure i would be the only owner of a hacked TR4400 v2 ever, lol congrats on your hardware hack!!! seems all the pics and text i wrote weren't completely a waste :)
so there are 2 issues here:
(1) your firmware is newer:
yours:
Revision: 1782
Last Changed Author: lucien
Last Changed Rev: 1782
Last Changed Date: 2019-08-05 10:19:11 +0800 (Mon, 05 Aug 2019)
VERSION:
Build from: PD1-build01 /home/rdrelease/TR4400v2/TR4400v2_0719_191108/Source by rdrelease
DATE: Mon Nov 11 10:44:03 CST 2019
mine:
Revision: 1418
Last Changed Author: sandy
Last Changed Rev: 1418
Last Changed Date: 2018-03-01 16:54:42 +0800 (Thu, 01 Mar 2018)
VERSION:
Build from: sercomm-QCA-Server /home2/mark/TR4400v2_0419b_0301/Source by mark
DATE: Thu Mar 1 17:10:58 CST 2018
as long as my SSH server enabling hack works (it does in your case) and the partition layout doesn't change (it sort of doesn't), then you'd succeed in installing by script. note that in the event of a brick, you can always halt the bootloader and try recovering from there.
but there is a more serious issue here:
(2) your system is booting from the alternate system !!!
this device has 2 copies of the system: for each required partition there are two actual partitions, named "NAME" and "NAME_1". for example: "rootfs" and "rootfs_1". the inactive one has the "_1" in the name. when the bootloader wants to switch to the alternate system, it swaps the names assigned to these partitions. in my case, during install my rootfs was partition mtd11 (see here: https://github.com/Lanchon/openwrt-tr4400-v2/blob/e7d707d6bd7839fbd0b8d0bd180fce451df77e47/check-svn1418.sh#L67). but in your case, rootfs is mtd21 !! this means in your system mtd21 is mounted and the commands needed to execute the install actually reside in mtd21. the problem is: the install needs to wipe mtd21. SO DO NOT TRY IT !!!
what you need to do is:
first: get a full backup of MTDs and UBIs. use my scripts.
then: convince your router to boot from the other system. i don't know how, but you can do it by talking to the bootloader (UBOOT). some of the gurus of the IPQ806x platform surely know how to force the bootloader to switch. it might also switch by itself if you power down the router while booting a number of consecutive times. please let me know how you end up doing this so i can document it.
note that we can't rule out that the other system (the currently inactive one, call it "main") could be corrupted or outdated in your installation, so it might fail to boot. but you can always copy contents of the current "XXX" partitions to their respective "main" ones, that for now are named "XXX_1". but note that writing to bootloader partitions might be dangerous.
please note that in MTD devices, the partition names are given dynamically by the bootloader (in your case) or are embedded in the kernel (in the standard openwrt distribution) but DO NOT EXIST on a table on the device like they do in PC disks. this is why the bootloader can choose which system to boot: it assign the non-"_1" names to the partitions it wants to boot and passes those names to the kernel, which mounts the "rootfs" partition, whatever number might be, as informed by the bootloader.
if you want you can send me your backups to lanchon at gmail, but keep in mind that they contain secret info about your router so don't post them publicly.
On Mon, Nov 28, 2022 at 02:39:55AM -0800, Lanchon wrote:
hi! i was very much sure i would be the only owner of a hacked TR4400 v2 ever, lol congrats on your hardware hack!!! seems all the pics and text i wrote weren't completely a waste :)
...
Lanchon
Thanks for the quick response.
I do indeed get the impression the the entire worldwide community of RACV21A users might just be the two of us. (If there's more, I hope they jump in: maybe there's as many as 3 of us worldwide!)
I'm not very knowledgable about the boot process so I'm not sure I understand all the mtd/boot issues.
After several (several, several) attempts at interrupting the boot process, I never got it to use mtd11 instead of mtd21 for rootfs.
I was able to run your two backup scripts, although I got a couple of error messages:
Running lanchon scripts to backup mtd
@. ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [18] ssh @. sh <mtd-backup.sh
...
backing up mtd30 to 'mtd30-ubi_config.gz'
gzip: can't open '/dev/mtd30': Device or resource busy
-> mtd30: backup failed
tarring backup files to '/tmp/lanchon/mtd-backup.tar'
;
@. ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [24] ssh @. sh <ubi-backup.sh
ubiattach: error!: cannot attach mtd21
error 17 (File exists)
creating backup files:
backing up ubi0_0 to 'ubi0_0-kernel.gz'
backing up ubi0_1 to 'ubi0_1-ubi_rootfs.gz'
backing up ubi0_2 to 'ubi0_2-rootfs_data.gz'
backing up ubi1_0 to 'ubi1_0-ubi_config.gz'
tarring backup files to '/tmp/lanchon/ubi-backup.tar'
ubidetach: error!: cannot detach mtd21
error 16 (Device or resource busy)
I've put the tar files on my webserver:
I've also included the console log for device bootup in case it provides useful info. It certainly contains a bunch of mtd/boot info but I can't tell what is going wrong.
Early on in the boot process, I can get into what I assume is some sort of bootloader (uboot?):
Hit any key to stop autoboot: 0 [I hit space bar, it interrupts the boot]
(IPQ) #
(IPQ) #
(IPQ) #
(IPQ) #
(IPQ) # help
...
(IPQ) # printenv
baudrate=115200
bootargs=console=ttyMSM0,115200n8
bootcmd=bootipq
bootdelay=2
ethact=eth0
machid=1260
stderr=serial
stdin=serial
stdout=serial
...
I played around with setenv to try different bootargs but my bootargs kung-fu
is weak; I didn't achieve anything useful.
I'll keep poking at it, but I've got to learn a bunch more about booting, mtd, uboot before I can get much of a handle on anything, and I'm a bit worried about bricking the router if I screw up.
Thanks for any insight you can provide. I've come this far and I hope there's a way to get this router loaded.
--
uragit (Martin)
hi!
-> mtd30: backup failed
never mind this. this is mounted via UBI, the real partition was backed up as mtd23.
ubiattach: error!: cannot attach mtd21
this happens because mtd21 (alternate system) is already mounted. the main system was not mounted and thus was not backed up. i updated the ubi-backup script to support your case. please update your copy, rerun it, and update your uploaded file. this way we will know whether both copies of the OS are mountable and whether they are the same.
bootcmd=bootipq
bootcmd is a normal variable that is auto-executed as a script during boot. in this case it is invoking the bootipq command.
bootipq is a custom qualcomm UBOOT command that does the dual system failover magic. i'll be looking up how it works, but i'll write this post as i go. this command attempts to boot a copy of the system, and if certain conditions are met, it will switch over to the other system (like -i assume- if system corruption is found). so it should be enough to erase mtd21 to force UBOOT to switch to the other (mtd11) copy. but don't! we still don't know if the other copy is corrupted or old. and we don't know if bootipq actually works as expected.
interrupt the boot process and type bootipq debug
. capture UBOOT output again, we might see usefull detail of how/way bootipq is choosing 2nd OS.
(IPQ) # printenv
note that the OpenWrt command fw_printenv and UBOOT commad printenv print different things. it seems that they are reading different stuff and the OpenWrt build is incorrectly configured. this is worrying because if you run my install script it might fail to configure UBOOT and it might write to... who knows where.
my expectation after reading some cmd_bootipq.c files and looking at your dumps is that changing byte 4 (fifth bytes) from 2 to 0 in your mtd19-0:BOOTCONFIG1 would revert your system to boot the primary OS... assuming that copy works.
but i'd like a non-persistent way to try this. let's ask the experts...
hi @Ansuel, i guess you are the undisputed expert here.
this is an IPQ806x system. the boot command is bootipq
. we got serial access to UBOOT and stock OpenWrt.
the system is booting the alternate partition set (the _1 suffixes are swapped after linux boot), which for an intricate reason stops us from installing official OpenWrt.
is there a UBOOT command or some other way to tell bootipq to switch to the main partition set, be it temporarily or permanently?
thank you!!!
(IPQ) # printenv
baudrate=115200
bootargs=console=ttyMSM0,115200n8
bootcmd=bootipq
bootdelay=2
ethact=eth0
machid=1260
stderr=serial
stdin=serial
stdout=serial
EDIT: we solved it by adjusting the "age" parameter on one of the BOOTCONFIG partitions. but still it'd be nice to know a UBOOT command to boot from an alternate slot, if only temporary.
@uragit check this out:
this is the bootconfig v2 struct in use on your device. your device has 2. those MTDs arw hardpointed to by the early bootloader, i think. each copy lists dual-system partition names and whether to add a suffix to each of them:
there is also the "age" value (bytes number 4 to 7) of each bootconfig. so i think when an update is done, the inactive partitions are written and then its bootconfig copy is updated, setting its age to one plus the highest value of all other (the other) bootconfig copies.
your device shipped with BOOTCONFIG with age 1 and BOOTCONFIG1 with age 0. this caused bootipq to choose BOOTCONFIG and its configuration (don't swap the _1 suffix in partition names). at some point fw was updated. new firmware was written to the inactive partitions. then BOOTCONFIG1 was updated with age 2. this forces bootipq to choose BOOTCONFIG1 and its configuration (swap the _1 suffix in partition names).
this is why i think setting BOOTCONFIG1 age to zero would revert the fw update... assuming the previous fw works. make a UBI backup first with the new script to so i can check its content: this undo might take you to the version of the fw for which all my scripts were developed... :) i suppose just erasing BOOTCONFIG1 should work too, but better if you don't.
I recaptured the console log with 'bootipq debug', I've added it as console.log2.bootipq_debug in http://telemage.com/uragit/
I notice, early in the boot process, the extra text:
Using nand device 0 bootargs=console=ttyMSM0,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs Booting from flash
There's also this, a few lines later: bootm @.***_3
Hope this is providing some useful info!
On Thu, Dec 01, 2022 at 12:45:16AM -0800, Lanchon wrote:
hi!
-> mtd30: backup failed
never mind this. this is mounted via UBI, the real partition was backed up as mtd23.
ubiattach: error!: cannot attach mtd21
this happens because mtd21 (alternate system) is already mounted. the main system was not mounted and thus was not backed up. i updated the ubi-backup script to support your case. please update your copy, rerun it, and update your uploaded file. this way we will know whether both copies of the OS are mountable and whether they are the same.
bootcmd=bootipq
bootcmd is a normal variable that is auto-executed as a script during boot. in this case it is invoking the bootipq command.
bootipq is a custom qualcomm UBOOT command that does the dual system failover magic. i'll be looking up how it works, but i'll write this post as i go. this command attempts to boot a copy of the system, and if certain conditions are met, it will switch over to the other system (like -i assume- if system corruption is found). so it should be enough to erase mtd21 to force UBOOT to switch to the other (mtd11) copy. but don't! we still don't know if the other copy is corrupted or old. and we don't know if bootipq actually works as expected.
interrupt the boot process and type
bootipq debug
. capture UBOOT output again, we might see usefull detail of how/way bootipq is choosing 2nd OS.(IPQ) # printenv
note that the OpenWrt command fw_printenv and UBOOT commad printenv print different things. it seems that they are reading different stuff and the OpenWrt build is incorrectly configured. this is worrying because if you run my install script it might fail to configure UBOOT and it might write to... who knows where.
my expectation after reading some cmd_bootipq.c files and looking at your dumps is that changing byte number 5 from 2 to 0 in your mtd19-0:BOOTCONFIG1 would revert your system to boot the primary OS... assuming that copy works.
but i'd like a non-persistent way to try this. let's ask the experts...
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1333409866 You are receiving this because you authored the thread.
Message ID: @.***>
--
Martin
Martin Emmerson.
I grabbed the new version of ubi-backup.sh and ran through it. I've put the new tar file on http://telemage.com/uragit/ as 'ubi-backup.tar.new'
Certainly looks like it is storing the extra info, compared to previous one:
@.*** ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [38] tar tvf ubi-backup.tar.new -rw-r--r-- root/root 3372 2019-11-10 19:09 ubi-info.txt -rw-r--r-- root/root 3525990 2019-11-10 19:08 ubi0_0-kernel.gz -rw-r--r-- root/root 31382623 2019-11-10 19:09 ubi0_1-ubi_rootfs.gz -rw-r--r-- root/root 158 2019-11-10 19:09 ubi0_2-rootfs_data.gz -rw-r--r-- root/root 48861 2019-11-10 19:09 ubi1_0-ubi_config.gz -rw-r--r-- root/root 3525854 2019-11-10 19:09 ubi2_0-kernel.gz -rw-r--r-- root/root 23485279 2019-11-10 19:09 ubi2_1-ubi_rootfs.gz -rw-r--r-- root/root 158 2019-11-10 19:09 ubi2_2-rootfs_data.gz
I hope it helps! I'm following along as best I can but I'm unfamiliar with ubi/mtd/uboot!
--
Martin
On Thu, Dec 01, 2022 at 12:45:16AM -0800, Lanchon wrote:
hi!
-> mtd30: backup failed
never mind this. this is mounted via UBI, the real partition was backed up as mtd23.
ubiattach: error!: cannot attach mtd21
this happens because mtd21 (alternate system) is already mounted. the main system was not mounted and thus was not backed up. i updated the ubi-backup script to support your case. please update your copy, rerun it, and update your uploaded file. this way we will know whether both copies of the OS are mountable and whether they are the same.
bootcmd=bootipq
bootcmd is a normal variable that is auto-executed as a script during boot. in this case it is invoking the bootipq command.
bootipq is a custom qualcomm UBOOT command that does the dual system failover magic. i'll be looking up how it works, but i'll write this post as i go. this command attempts to boot a copy of the system, and if certain conditions are met, it will switch over to the other system (like -i assume- if system corruption is found). so it should be enough to erase mtd21 to force UBOOT to switch to the other (mtd11) copy. but don't! we still don't know if the other copy is corrupted or old. and we don't know if bootipq actually works as expected.
interrupt the boot process and type
bootipq debug
. capture UBOOT output again, we might see usefull detail of how/way bootipq is choosing 2nd OS.(IPQ) # printenv
note that the OpenWrt command fw_printenv and UBOOT commad printenv print different things. it seems that they are reading different stuff and the OpenWrt build is incorrectly configured. this is worrying because if you run my install script it might fail to configure UBOOT and it might write to... who knows where.
my expectation after reading some cmd_bootipq.c files and looking at your dumps is that changing byte number 5 from 2 to 0 in your mtd19-0:BOOTCONFIG1 would revert your system to boot the primary OS... assuming that copy works.
but i'd like a non-persistent way to try this. let's ask the experts...
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1333409866 You are receiving this because you authored the thread.
Message ID: @.***>
--
Martin
Martin Emmerson.
bootargs=console=ttyMSM0,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs
that's the command line passed to the linux kernel (it takes a command line as if it were a regular executable). i already knew the contents because the checking /proc/cmdline
line (first post) showed it was the same as my stock rom.
bootm 0x44000000#config@4704_3
that's when bootipq invokes bootm, the command that boots a kernel from RAM. good, i didn't know bootipq fell though to bootm. 0x44000000 is the address of the in-memory kernel.
UBI crash course:
a UBI device is a specially formatted MTD partition. when the partition is "attached" -it is mounted so to speak- a UBI /dev/ubiN device is created, where N is the ubi device number assigned at attachment.
a UBI device contains zero or more volumes, and/or unallocated space. it handles flash memory wear leveling and defect handling. a volume can be presented as a read-only block device, or can be mounted via a specialized file system, such as UBIFS.
UBIFS is a R/W file system designed to inhabit a UBI volume. once mounted, a UBIFS /dev/ubiN_M device is created, where N is the ubi device number and M is the volume number within that device. volume numbers and names are specified at volume creation time.
I grabbed the new version of ubi-backup.sh and ran through it
great! we now have backups of all ubi volumes inside the 3 ubi devices: rootfs, rootfs_1 and config. check the ubi info file inside the backup tar for details on what is backed up where. rootfs (mtd21) is ubi0, config is ubi1, and rootfs_1 is ubi2 (mtd11). the rootfs ubi devices each have 3 volumes inside for kernel (raw image), squashfs rootfs (squashfs), and rootfs overlay (ubifs).
i'll check the contents next.
I'm wondering if there's a way to update the software again, via the web interface on the current version. This might cause the flip back to the other rootfs.
The strange thing is that I can't see any way to upgrade to a newer 'official' release. So, not sure how it managed to get updated in the first place. (I don't know the history of the router; it was left behind by a guy who moved out of a rental. It's ISP-supplied, from charter/spectrum in Reno, NV and is typically paired with a separate cable modem.)
It reports, via the web interface:
Hardware and Software Versions: Serial Number: A4U4H956C14585 Bootcode Version: 1.00.0 Hardware Version: 1.0 Firmware Version: A1.00.004-190802
So, in short, I didn't find any useful way to do an upgrade!
--
Martin
On Thu, Dec 01, 2022 at 12:21:44PM -0800, Lanchon wrote:
bootargs=console=ttyMSM0,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs
that's the command line passed to the linux kernel (it takes a command line as if it were a regular executable). i already knew the contents because the
checking /proc/cmdline
line (first post) showed it was the same as my stock rom.bootm @.***_3
that's when bootipq invokes bootm, the command that boots a kernel from RAM. good, i didn't know bootipq fell though to bootm. 0x44000000 is the address of the in-memory kernel.
UBI crash course:
a UBI device is a specially formatted MTD partition. when the partition is "attached" -it is mounted so to speak- a UBI /dev/ubiN device is created, where N is the ubi device number assigned at attachment.
a UBI device contains zero or more volumes, and/or unallocated space. it handles flash memory wear leveling and defect handling. a volume can be presented as a read-only block device, or can be mounted via a specialized file system, such as UBIFS.
UBIFS is a R/W file system designed to inhabit a UBI volume. once mounted, a UBIFS /dev/ubiN_M device is created, where N is the ubi device number and M is the volume number within that device. volume numbers and names are specified at volume creation time.
I grabbed the new version of ubi-backup.sh and ran through it
great! we now have backups of all ubi volumes inside the 3 ubi devices: rootfs, rootfs_1 and config. check the ubi info file inside the backup tar for details on what is backed up where. rootfs (mtd21) is ubi0, config is ubi1, and rootfs_1 is ubi2 (mtd11). the rootfs ubi devices each have 3 volumes inside for kernel (raw image), squashfs rootfs (squashfs), and rootfs overlay (ubifs).
i'll check the contents next.
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334398424 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
no, you are right, the UI does not allow upgrades nor local flashes, it's a PoS. that's why i didn't suggest that option.
but the router hardware is very good :)
as you can see, the two OSes on your router are different. hashes would match on at least 2 pairs of partitions otherwise:
rod@rod-latitude:~/hardware/routers/arris-tr4400-v2/backup-svn1782 (uragit)/ubi-backup$ md5sum *.gz
e7f954f8efc197e371895a35e7334c2f ubi0_0-kernel.gz
e856028dbbe613cd2908dd893390b259 ubi0_1-ubi_rootfs.gz
f883efb58387017ed1ee8d9425b745f3 ubi0_2-rootfs_data.gz
06a66a1461e309f4d6a25d100ab927bb ubi1_0-ubi_config.gz
eaa31d7f772d685e47b9d0ee9fd9e603 ubi2_0-kernel.gz
95326380b3e1275afc120b645b891082 ubi2_1-ubi_rootfs.gz
e1932b8e04381cb0cba50b7518a621e9 ubi2_2-rootfs_data.gz
on the other hand, ub2_XXX doesn't match my version either, so it seems there are 3 versions at play here:
rod@rod-latitude:~/hardware/routers/arris-tr4400-v2/backup-svn1418 (mine)/tr4400-v2-stock-firmware/r1418-2018-03-01$ md5sum *.gz
8c80a52678aeb28387d091e8702c525e ubi0_0-kernel.gz
5ea9b59b28d199a5283af08b67c0ecf3 ubi0_1-ubi_rootfs.gz
cdd4b2ccfc75875ced0932658f06624c ubi0_2-rootfs_data.gz
i'm doing 10 things at the same time, please hold on for more...
ok ubi0 (mtd21) contains rootfs for:
Revision: 1782
Last Changed Author: lucien
Last Changed Rev: 1782
Last Changed Date: 2019-08-05 10:19:11 +0800 (Mon, 05 Aug 2019)
VERSION:
Build from: PD1-build01 /home/rdrelease/TR4400v2/TR4400v2_0719_191108/Source by rdrelease
DATE: Mon Nov 11 10:44:03 CST 2019
no surprise here, we already knew this, this is the currently active OS.
but ubi2 (mtd11) has a newer OS! not and older one as expected:
Revision: 1806
Last Changed Author: jason
Last Changed Rev: 1806
Last Changed Date: 2019-11-12 13:15:23 +0800 (Tue, 12 Nov 2019)
VERSION:
Build from: PD1-build01 /home/rdrelease/TR4400v2/TR4400v2_MT_191108/Source by rdrelease
DATE: Tue Nov 12 13:22:44 CST 2019
which begs the question of why it has a smaller "age", ie, why is it not booting. maybe it's corrupted?
in any case, you router seems to have been subjected to upgrade processes. maybe the upgrade code is flawed. it wouldn't surprise me.
i'll be uploading those firmwares soon here: https://github.com/Lanchon/tr4400-v2-stock-firmware
so... it seems we know enough to proceed. you need to change one byte of one of the BOOTCONFIG partitions. this will make the main OS copy bootable and (if it boots) allow OpenWrt install.
you may want to copy the current system over to unused (main) OS slot beforehand to increase chances of booting successfully. or you may try to boot svn1806 instead. note that boot failure would mean that you'd probably require to fix things from UBOOT. it'd be fixable, but laborious.
so how do you want to proceed?
Okay, I'm happy with whatever options you recommend. It's not the end of the world if we brick it, although I'm hoping for the best.
What's the best option for editing the one byte on the partition? Presumably if it all goes wrong, I might be able to re-edit it to get back to our starting point (unless we end up thoroughly bricked).
I don't know how to "copy the current system over to unused (main) OS slot".
Also not sure what the option is to "boot svn1806 instead".
But I think I understand the basic principle of changing the one byte to force it to boot the other firmware, and happy to give it a go. Although it does seem suspicious that the 'older' version is actually newer.
(I've been trying to figure out how to get you direct serial-port access to the router, in case that helps to check anything out. Still working on it.)
--
Martin
On Thu, Dec 01, 2022 at 01:53:56PM -0800, Lanchon wrote:
i'll be uploading those firmwares soon here: https://github.com/Lanchon/tr4400-v2-stock-firmware
so... it seems we know enough to proceed. you need to change one byte of one of the BOOTCONFIG partitions. this will make the main OS copy bootable and (if it boots) allow OpenWrt install.
you may want to copy the current system over to unused (main) OS slot beforehand to increase chances of booting successfully. or you may try to boot svn1806 instead. note that boot failure would mean that you'd probably require to fix things from UBOOT. it'd be fixable, but laborious.
so how do you want to proceed?
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334493819 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
I don't know how to "copy the current system over to unused (main) OS slot".
i can tell you. when i get a little time.
Also not sure what the option is to "boot svn1806 instead".
i mean not copying the current OS to the inactive slot and hoping that the inactive OS, which version 1806 on the SVN (the source control scheme), boots fine.
so we change that byte. and optionally copy your current OS over before that.
i'll assist you with commands soon, but can´t right now.
No worries. Whenever you have time. I appreciate all the help!
When you have a minute, can you try:
ssh -p 222 -l socat smtp1.telemage.com
Password: racv21a!
It should put you in contact with the router serial port (unless I've grabbed it at the time for some investigation).
(The terminal settings aren't quite right so it echoes each line typed.)
--
Martin
On Thu, Dec 01, 2022 at 05:17:40PM -0800, Lanchon wrote:
I don't know how to "copy the current system over to unused (main) OS slot".
i can tell you. when i get a little time.
Also not sure what the option is to "boot svn1806 instead".
i mean not copying the current OS to the inactive slot and hoping that the inactive OS, which version 1806 on the SVN (the source control scheme), boots fine.
so we change that byte. and optionally copy your current OS over before that.
i'll assist you with commands soon, but can´t right now.
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334645845 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
lol anyone reading can make a mess there!!!
i tried logging as follows, and i could twice, but now gives an error:
rod@rod-latitude:~$ ssh -o KexAlgorithms=diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=ssh-rsa,ssh-dss -p 222 socat@smtp1.telemage.com
socat@smtp1.telemage.com's password:
Permission denied, please try again.
socat@smtp1.telemage.com's password:
hello
Error: Invalid interval time "v"
Connection to smtp1.telemage.com closed.
btw, your box is running insecure ssh protocols.
On Thu, Dec 01, 2022 at 09:42:04PM -0800, Lanchon wrote:
lol anyone reading can make a mess there!!!
Doh! I'd forgotten we were leaving a trail. I'll change ports and passwords and email you separately.
Also probably time I updated my ssh protocols!
I think it probably stopped working briefly when I was experimenting with replacing telnet with netcat, but it didn't improve the line/character mode problem I was having.
--
Martin
i tried logging as follows, and i could twice, but now gives an error:
***@***.***:~$ ssh -o KexAlgorithms=diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=ssh-rsa,ssh-dss -p 222 ***@***.*** ***@***.***'s password: Permission denied, please try again. ***@***.***'s password: hello Error: Invalid interval time "v" Connection to smtp1.telemage.com closed.
btw, your box is running insecure ssh protocols.
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334787528 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
anyway, you can do it...
you will copy the complete UBI device holding the 3 volumes. UBI images cannot be written to MTD as regular images, use this command:
cat /dev/mtd21 | ubiformat /dev/mtd11 -f -
should succeed unless mtd partitions are read-only to the stock kernel. now let's verify. attach the new ubi device to access its volumes:
ubiattach -m 11
it should attach as ubi2, while mtd21 is already attached as ubi0. lets check the MD5 of all UBI volumes, verify that pairs of MD5 hashes for volumes ubi0_N and ubi2_N (for N 0 to 2) match:
md5sum /dev/ubi*_*
continue only if the 3 pairs match.
cd /tmp
dd if=/dev/mtd19 bs=4K count=1 >bc1
dd if=bc1 bs=1 count=4 >bc1-mod
dd if=bc1 bs=1 skip=5 count=1 >>bc1-mod
dd if=bc1 bs=1 skip=5 >>bc1-mod
check the edited file before writing it:
cmp -l bc1 bc1-mod
# should output only one byte difference at position 5 from 2 to 0:
# 5 2 0
if ok, write the edited file to the partition:
mtd erase /dev/mtd19
mtd write bc1-mod /dev/mtd19
now if you reboot you should be running the same OS version but running it from the main slot mtd11... hopefully. verify this using cat /proc/mtd
to list the partitions: mtd11 should be called rootfs, and no longer be called rootfs_1.
once there you can try following the installation instruction. lets hope that the UBOOT environment gets written correctly by the install script.
so you are online! maybe you can try now? let me know and i'll standby while you do it. its 3:30 am here lol
sorry i was writing that long post and didn't see your message
ok i'm in again. you seem to not be here so i'll proceed and log.
starting...
I'm here but I need to configure my email client to make a noise when new email arrives!
You're making the changes now? I'll stand by.
Only 10:50pm here. California, PST.
Meanwhile, I'm figuring out how to update the keyex protocols on my ancient openwrt/dropbear box!
--
Martin
On Thu, Dec 01, 2022 at 10:35:04PM -0800, Lanchon wrote:
starting...
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334820589 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
yes, i'm working and logging. ubiformat did not work. there are bad blocks in your main OS area, though ubi should tolerate that. im trying workarounds.
first part ready. bad blocks, but i was able to copy volumes one by one instead of the whole device...
rod@rod-latitude:~$ sshpass -p ********* ssh -o KexAlgorithms=diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=ssh-rsa,ssh-dss -p 222 socat@smtp1.telemage.com
hello
root@OpenWrt:~#
root@OpenWrt:~# ls
ls
bin dev home mnt proc sbin tmp var
config etc lib overlay rom sys usr www
root@OpenWrt:~#
root@OpenWrt:~# reboot
reboot
procd: - reboot -
root@OpenWrt:~# [41370.541686] reboot: Restarting system
U-Boot 2012.07 [Barrier Breaker r1596,r1596] (Nov 08 2019 - 19:18:40)
smem ram ptable found: ver: 0 len: 5
DRAM: 491 MiB
NAND: SF: Unsupported manufacturer 00
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC:
NAND read from offset 1180000 failed -74
*** Warning - readenv() failed, using default environment
In: serial
Out: serial
Err: serial
MMC Device 0 not found
cdp: get part failed for 0:HLOS
Net: MAC0 addr:0:3:7f:ba:db:0
athrs17_reg_init: complete
athrs17_vlan_config: Sercomm modify vlan config
athrs17_vlan_config ...done
S17c init done
MAC1 addr:0:3:7f:ba:db:1
MAC2 addr:0:3:7f:ba:db:2
Port:2 speed 10Mbps
MAC3 addr:0:3:7f:ba:db:3
Port:3 speed 10Mbps
eth0, eth1, eth2, eth3
Done!
Index Name Offset Length Real_Offs Real_Size
0 SBL1 0 40000 0 40000
1 MIBIB 40000 140000 40000 140000
2 SBL2 180000 140000 180000 140000
3 SBL3 2c0000 280000 2c0000 280000
4 DDRCONFIG 540000 120000 540000 120000
5 SSD 660000 120000 660000 120000
6 TZ 780000 280000 780000 280000
7 RPM a00000 280000 a00000 280000
8 APPSBL c80000 500000 c80000 500000
9 APPSBLENV 1180000 80000 1180000 80000
10 ART 1200000 140000 1200000 140000
11 rootfs 1340000 4000000 1340000 4000000
12 BOOTCONFIG 5340000 60000 5340000 60000
13 SBL2_1 53a0000 140000 53a0000 140000
14 SBL3_1 54e0000 280000 54e0000 280000
15 DDRCONFIG_1 5760000 120000 5760000 120000
16 SSD_1 5880000 120000 5880000 120000
17 TZ_1 59a0000 280000 59a0000 280000
18 RPM_1 5c20000 280000 5c20000 280000
19 BOOTCONFIG_1 5ea0000 60000 5ea0000 60000
20 APPSBL_1 5f00000 500000 5f00000 500000
21 rootfs_1 6400000 4000000 6400000 4000000
22 fw_env a400000 100000 a400000 100000
23 config a500000 800000 a500000 800000
24 PKI ad00000 200000 ad00000 200000
25 scfgmgr af00000 100000 af00000 100000
Hit any key to stop autoboot: 0
DOWNLOAD MODE BIT CHECK
INTO NORMAL MODE:ff ff
MMC Device 0 not found
MMC Device 0 not found
Creating 1 MTD partitions on "nand0":
0x000006400000-0x00000a400000 : "mtd=0"
UBI: attaching mtd1 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI: attached mtd1 to ubi0
UBI: MTD device name: "mtd=0"
UBI: MTD device size: 64 MiB
UBI: number of good PEBs: 512
UBI: number of bad PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 3
UBI: available PEBs: 222
UBI: total number of reserved PEBs: 290
UBI: number of PEBs reserved for bad PEB handling: 5
UBI: max/mean erase counter: 68/2
Read 0 bytes from volume kernel to 44000000
No size specified -> Using max size (4063232)
## Booting kernel from FIT Image at 44000000 ...
Using 'config@4704_3' configuration
Trying 'kernel@1' kernel subimage
Description: ARM Linux-3.14.43
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x44000104
Data Size: 3364674 Bytes = 3.2 MiB
Architecture: ARM
OS: Linux
Load Address: 0x42208000
Entry Point: 0x42208000
Hash algo: crc32
Hash value: 02a8d79f
Hash algo: sha1
Hash value: b087bd50333a5a9f5425c73a956cfd8f40fb3d3e
Verifying Hash Integrity ... crc32+ sha1+ OK
## Flattened Device Tree from FIT Image at 44000000
Using 'config@4704_3' configuration
Trying 'fdt@3' FDT blob subimage
Description: ARM qcom_ipq806x_ap.akxx device tree blob
Type: Flat Device Tree
Compression: gzip compressed
Data Start: 0x44338cf8
Data Size: 6446 Bytes = 6.3 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 407be927
Hash algo: sha1
Hash value: c754eaafaac8105e838947ac245594531d90d07a
Verifying Hash Integrity ... crc32+ sha1+ OK
gzip compressed FDT image found
FDT load address is: 0x43f00000
Loading FDT from 0x44338cf8 to 0x43f00000
Uncompressing Flat Device Tree ... OK
Booting using the fdt blob at 0x43f00000
Uncompressing Kernel Image ... OK
Loading Device Tree to 47ff6000, end 47fff501 ... OK
mtdparts = mtdparts=nand0:256K@0x0(0:SBL1),1280K@0x40000(0:MIBIB),1280K@0x53a0000(0:SBL2),2560K@0x54e0000(0:SBL3),1152K@0x5760000(0:DDRCONFIG),1152K@0x660000(0:SSD),2560K@0x59a0000(0:TZ),2560K@0x5c20000(0:RPM),5M@0x5f00000(0:APPSBL),512K@0x1180000(0:APPSBLENV),1280K@0x1200000(0:ART),64M@0x6400000(rootfs),384K@0x5340000(0:BOOTCONFIG),1280K@0x180000(0:SBL2_1),2560K@0x2c0000(0:SBL3_1),1152K@0x540000(0:DDRCONFIG_1),1152K@0x5880000(0:SSD_1),2560K@0x780000(0:TZ_1),2560K@0xa00000(0:RPM_1),384K@0x5ea0000(0:BOOTCONFIG1),5M@0xc80000(0:APPSBL_1),64M@0x1340000(rootfs_1),1024K@0xa400000(fw_env),8M@0xa500000(config),2M@0xad00000(PKI),1024K@0xaf00000(scfgmgr),
Device nand1 not found!
Using machid 0x1260 from environment
Starting kernel ...
[ 0.000000] Booting Linux on physical CPU 0x0
[...]
SSDK Init OK!
operate done.
BusyBox v1.22.1 (2019-11-08 20:31:25 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
MM NM MMMMMMM M M
$MMMMM MMMMM MMMMMMMMMMM MMM MMM
MMMMMMMM MM MMMMM. MMMMM:MMMMMM: MMMM MMMMM
MMMM= MMMMMM MMM MMMM MMMMM MMMM MMMMMM MMMM MMMMM'
MMMM= MMMMM MMMM MM MMMMM MMMM MMMM MMMMNMMMMM
MMMM= MMMM MMMMM MMMMM MMMM MMMM MMMMMMMM
MMMM= MMMM MMMMMM MMMMM MMMM MMMM MMMMMMMMM
MMMM= MMMM MMMMM, NMMMMMMMM MMMM MMMM MMMMMMMMMMM
MMMM= MMMM MMMMMM MMMMMMMM MMMM MMMM MMMM MMMMMM
MMMM= MMMM MM MMMM MMMM MMMM MMMM MMMM MMMM
MMMM$ ,MMMMM MMMMM MMMM MMM MMMM MMMMM MMMM MMMM
MMMMMMM: MMMMMMM M MMMMMMMMMMMM MMMMMMM MMMMMMM
MMMMMM MMMMN M MMMMMMMMM MMMM MMMM
MMMM M MMMMMMM M M
M
---------------------------------------------------------------
For those about to rock... (Bleeding Edge, r1602)
---------------------------------------------------------------
root@OpenWrt:~#
root@OpenWrt:~#
root@OpenWrt:~# cat /proc/mtd
cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00020000 "0:SBL1"
mtd1: 00140000 00020000 "0:MIBIB"
mtd2: 00140000 00020000 "0:SBL2_1"
mtd3: 00280000 00020000 "0:SBL3_1"
mtd4: 00120000 00020000 "0:DDRCONFIG_1"
mtd5: 00120000 00020000 "0:SSD"
mtd6: 00280000 00020000 "0:TZ_1"
mtd7: 00280000 00020000 "0:RPM_1"
mtd8: 00500000 00020000 "0:APPSBL_1"
mtd9: 00080000 00020000 "0:APPSBLENV"
mtd10: 00140000 00020000 "0:ART"
mtd11: 04000000 00020000 "rootfs_1"
mtd12: 00060000 00020000 "0:BOOTCONFIG"
mtd13: 00140000 00020000 "0:SBL2"
mtd14: 00280000 00020000 "0:SBL3"
mtd15: 00120000 00020000 "0:DDRCONFIG"
mtd16: 00120000 00020000 "0:SSD_1"
mtd17: 00280000 00020000 "0:TZ"
mtd18: 00280000 00020000 "0:RPM"
mtd19: 00060000 00020000 "0:BOOTCONFIG1"
mtd20: 00500000 00020000 "0:APPSBL"
mtd21: 04000000 00020000 "rootfs"
mtd22: 00100000 00020000 "fw_env"
mtd23: 00800000 00020000 "config"
mtd24: 00200000 00020000 "PKI"
mtd25: 00100000 00020000 "scfgmgr"
mtd26: 00008000 00008000 "spi32766.0"
mtd27: 003e0000 0001f000 "kernel"
mtd28: 01e08000 0001f000 "ubi_rootfs"
mtd29: 0001f000 0001f000 "rootfs_data"
mtd30: 00744000 0001f000 "ubi_config"
root@OpenWrt:~# cat /dev/mtd21 | ubiformat /dev/mtd11 -f -
cat /dev/mtd21 | ubiformat /dev/mtd11 -f -
ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 511 -- 100 % complete
ubiformat: 510 eraseblocks have valid erase counter, mean value is 2
ubiformat: 2 bad eraseblocks found, numbers: 232, 234
ubiformat: error!: must use '-S' with non-zero value when reading from stdin
cat: write error: Broken pipe
root@OpenWrt:~# ubiformat /dev/mtd11 -f /dev/mtd21
ubiformat /dev/mtd11 -f /dev/mtd21
ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 511 -- 100 % complete
ubiformat: 510 eraseblocks have valid erase counter, mean value is 2
ubiformat: 2 bad eraseblocks found, numbers: 232, 234
Floating point exception
root@OpenWrt:~# # hmmmmm...
# hmmmmm...
root@OpenWrt:~# ubiattach -m 11
ubiattach -m 11
UBI device number 2, total 510 LEBs (64757760 bytes, 61.8 MiB), available 288 LEBs (36569088 bytes, 34.9 MiB), LEB size 126976 bytes (124.0 KiB)
root@OpenWrt:~# md5sum /dev/ubi*_*
md5sum /dev/ubi*_*
1e7876636109535510dd7cee16386d36 /dev/ubi0_0
edcd4e0e5732f18e81da7b33892fe784 /dev/ubi0_1
f7d566ac0d14fb993db66ed5ea370797 /dev/ubi0_2
f6f1ef4942c4539e992431e2eb504e9b /dev/ubi1_0
18dd98b1ec7b488ab258e08d0e9aca2d /dev/ubi2_0
65f361c1be627f2da8ba791d65795bf5 /dev/ubi2_1
f7d566ac0d14fb993db66ed5ea370797 /dev/ubi2_2
md5sum: can't read '/dev/ubi_ctrl': Invalid argument
root@OpenWrt:~# ubinfo -a
ubinfo -a
UBI version: 1
Count of UBI devices: 3
UBI control device major/minor: 10:60
Present UBI devices: ubi0, ubi1, ubi2
ubi0
Volumes count: 3
Logical eraseblock size: 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks: 512 (65011712 bytes, 62.0 MiB)
Amount of available logical eraseblocks: 227 (28823552 bytes, 27.5 MiB)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 0
Current maximum erase counter value: 68
Minimum input/output unit size: 2048 bytes
Character device major/minor: 249:0
Present volumes: 0, 1, 2
Volume ID: 0 (on ubi0)
Type: dynamic
Alignment: 1
Size: 32 LEBs (4063232 bytes, 3.9 MiB)
State: OK
Name: kernel
Character device major/minor: 249:1
-----------------------------------
Volume ID: 1 (on ubi0)
Type: dynamic
Alignment: 1
Size: 248 LEBs (31490048 bytes, 30.0 MiB)
State: OK
Name: ubi_rootfs
Character device major/minor: 249:2
-----------------------------------
Volume ID: 2 (on ubi0)
Type: dynamic
Alignment: 1
Size: 1 LEBs (126976 bytes, 124.0 KiB)
State: OK
Name: rootfs_data
Character device major/minor: 249:3
===================================
ubi1
Volumes count: 1
Logical eraseblock size: 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks: 64 (8126464 bytes, 7.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 0
Current maximum erase counter value: 2
Minimum input/output unit size: 2048 bytes
Character device major/minor: 248:0
Present volumes: 0
Volume ID: 0 (on ubi1)
Type: dynamic
Alignment: 1
Size: 60 LEBs (7618560 bytes, 7.3 MiB)
State: OK
Name: ubi_config
Character device major/minor: 248:1
===================================
ubi2
Volumes count: 3
Logical eraseblock size: 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks: 510 (64757760 bytes, 61.8 MiB)
Amount of available logical eraseblocks: 288 (36569088 bytes, 34.9 MiB)
Maximum count of volumes 128
Count of bad physical eraseblocks: 2
Count of reserved physical eraseblocks: 0
Current maximum erase counter value: 226
Minimum input/output unit size: 2048 bytes
Character device major/minor: 243:0
Present volumes: 0, 1, 2
Volume ID: 0 (on ubi2)
Type: dynamic
Alignment: 1
Size: 32 LEBs (4063232 bytes, 3.9 MiB)
State: OK
Name: kernel
Character device major/minor: 243:1
-----------------------------------
Volume ID: 1 (on ubi2)
Type: dynamic
Alignment: 1
Size: 185 LEBs (23490560 bytes, 22.4 MiB)
State: OK
Name: ubi_rootfs
Character device major/minor: 243:2
-----------------------------------
Volume ID: 2 (on ubi2)
Type: dynamic
Alignment: 1
Size: 1 LEBs (126976 bytes, 124.0 KiB)
State: OK
Name: rootfs_data
Character device major/minor: 243:3
root@OpenWrt:~# ubidetach -m 11
ubidetach -m 11
root@OpenWrt:~# mtd --help
mtd --help
mtd: invalid option -- -
Usage: mtd [<options> ...] <command> [<arguments> ...] <device>[:<device>...]
The device is in the format of mtdX (eg: mtd4) or its label.
mtd recognizes these commands:
unlock unlock the device
refresh refresh mtd partition
erase erase all data on device
verify <imagefile>|- verify <imagefile> (use - for stdin) to device
write <imagefile>|- write <imagefile> (use - for stdin) to device
jffs2write <file> append <file> to the jffs2 partition on the device
Following options are available:
-q quiet mode (once: no [w] on writing,
twice: no status messages)
-n write without first erasing the blocks
-r reboot after successful command
-f force write without trx checks
-e <device> erase <device> before executing the command
-d <name> directory for jffs2write, defaults to "tmp"
-j <name> integrate <file> into jffs2 data when writing an image
-s <number> skip the first n bytes when appending data to the jffs2 partiton, defaults to "0"
-p write beginning at partition offset
Example: To write linux.trx to mtd4 labeled as linux and reboot afterwards
mtd -r write linux.trx linux
root@OpenWrt:~# mtd erase /dev/mtd11
mtd erase /dev/mtd11
Unlocking /dev/mtd11 ...
Erasing /dev/mtd11 ...
Skipping bad block at 0x1d00000
Skipping bad block at 0x1d40000 root@OpenWrt:~#
root@OpenWrt:~# cat /dev/mtd21 | ubiformat /dev/mtd11 -f -
cat /dev/mtd21 | ubiformat /dev/mtd11 -f -
ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 511 -- 100 % complete
ubiformat: 510 eraseblocks are supposedly empty
ubiformat: 2 bad eraseblocks found, numbers: 232, 234
ubiformat: error!: must use '-S' with non-zero value when reading from stdin
cat: write error: Broken pipe
root@OpenWrt:~# ubiformat /dev/mtd11 -f /dev/mtd21
ubiformat /dev/mtd11 -f /dev/mtd21
ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 511 -- 100 % complete
ubiformat: 510 eraseblocks are supposedly empty
ubiformat: 2 bad eraseblocks found, numbers: 232, 234
Floating point exception
root@OpenWrt:~# ubiattach -m 11
ubiattach -m 11
UBI device number 2, total 510 LEBs (64757760 bytes, 61.8 MiB), available 506 LEBs (64249856 bytes, 61.3 MiB), LEB size 126976 bytes (124.0 KiB)
root@OpenWrt:~# ubinfo -a
ubinfo -a
UBI version: 1
Count of UBI devices: 3
UBI control device major/minor: 10:60
Present UBI devices: ubi0, ubi1, ubi2
ubi0
Volumes count: 3
Logical eraseblock size: 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks: 512 (65011712 bytes, 62.0 MiB)
Amount of available logical eraseblocks: 227 (28823552 bytes, 27.5 MiB)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 0
Current maximum erase counter value: 68
Minimum input/output unit size: 2048 bytes
Character device major/minor: 249:0
Present volumes: 0, 1, 2
Volume ID: 0 (on ubi0)
Type: dynamic
Alignment: 1
Size: 32 LEBs (4063232 bytes, 3.9 MiB)
State: OK
Name: kernel
Character device major/minor: 249:1
-----------------------------------
Volume ID: 1 (on ubi0)
Type: dynamic
Alignment: 1
Size: 248 LEBs (31490048 bytes, 30.0 MiB)
State: OK
Name: ubi_rootfs
Character device major/minor: 249:2
-----------------------------------
Volume ID: 2 (on ubi0)
Type: dynamic
Alignment: 1
Size: 1 LEBs (126976 bytes, 124.0 KiB)
State: OK
Name: rootfs_data
Character device major/minor: 249:3
===================================
ubi1
Volumes count: 1
Logical eraseblock size: 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks: 64 (8126464 bytes, 7.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 0
Current maximum erase counter value: 2
Minimum input/output unit size: 2048 bytes
Character device major/minor: 248:0
Present volumes: 0
Volume ID: 0 (on ubi1)
Type: dynamic
Alignment: 1
Size: 60 LEBs (7618560 bytes, 7.3 MiB)
State: OK
Name: ubi_config
Character device major/minor: 248:1
===================================
ubi2
Volumes count: 0
Logical eraseblock size: 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks: 510 (64757760 bytes, 61.8 MiB)
Amount of available logical eraseblocks: 506 (64249856 bytes, 61.3 MiB)
Maximum count of volumes 128
Count of bad physical eraseblocks: 2
Count of reserved physical eraseblocks: 0
Current maximum erase counter value: 1
Minimum input/output unit size: 2048 bytes
Character device major/minor: 243:0
root@OpenWrt:~# ubimkvol /dev/ubi2 -N kernel -S 32
ubimkvol /dev/ubi2 -N kernel -S 32
Volume ID 0, size 32 LEBs (4063232 bytes, 3.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
root@OpenWrt:~# ubimkvol /dev/ubi2 -N ubi_rootfs -S 248
ubimkvol /dev/ubi2 -N ubi_rootfs -S 248
Volume ID 1, size 248 LEBs (31490048 bytes, 30.0 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "ubi_rootfs", alignment 1
root@OpenWrt:~# ubimkvol /dev/ubi2 -N rootfs_data -S 1
ubimkvol /dev/ubi2 -N rootfs_data -S 1
Volume ID 2, size 1 LEBs (126976 bytes, 124.0 KiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
root@OpenWrt:~# ubinfo -a
ubinfo -a
UBI version: 1
Count of UBI devices: 3
UBI control device major/minor: 10:60
Present UBI devices: ubi0, ubi1, ubi2
ubi0
Volumes count: 3
Logical eraseblock size: 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks: 512 (65011712 bytes, 62.0 MiB)
Amount of available logical eraseblocks: 227 (28823552 bytes, 27.5 MiB)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 0
Current maximum erase counter value: 68
Minimum input/output unit size: 2048 bytes
Character device major/minor: 249:0
Present volumes: 0, 1, 2
Volume ID: 0 (on ubi0)
Type: dynamic
Alignment: 1
Size: 32 LEBs (4063232 bytes, 3.9 MiB)
State: OK
Name: kernel
Character device major/minor: 249:1
-----------------------------------
Volume ID: 1 (on ubi0)
Type: dynamic
Alignment: 1
Size: 248 LEBs (31490048 bytes, 30.0 MiB)
State: OK
Name: ubi_rootfs
Character device major/minor: 249:2
-----------------------------------
Volume ID: 2 (on ubi0)
Type: dynamic
Alignment: 1
Size: 1 LEBs (126976 bytes, 124.0 KiB)
State: OK
Name: rootfs_data
Character device major/minor: 249:3
===================================
ubi1
Volumes count: 1
Logical eraseblock size: 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks: 64 (8126464 bytes, 7.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes 128
Count of bad physical eraseblocks: 0
Count of reserved physical eraseblocks: 0
Current maximum erase counter value: 2
Minimum input/output unit size: 2048 bytes
Character device major/minor: 248:0
Present volumes: 0
Volume ID: 0 (on ubi1)
Type: dynamic
Alignment: 1
Size: 60 LEBs (7618560 bytes, 7.3 MiB)
State: OK
Name: ubi_config
Character device major/minor: 248:1
===================================
ubi2
Volumes count: 3
Logical eraseblock size: 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks: 510 (64757760 bytes, 61.8 MiB)
Amount of available logical eraseblocks: 225 (28569600 bytes, 27.2 MiB)
Maximum count of volumes 128
Count of bad physical eraseblocks: 2
Count of reserved physical eraseblocks: 0
Current maximum erase counter value: 2
Minimum input/output unit size: 2048 bytes
Character device major/minor: 243:0
Present volumes: 0, 1, 2
Volume ID: 0 (on ubi2)
Type: dynamic
Alignment: 1
Size: 32 LEBs (4063232 bytes, 3.9 MiB)
State: OK
Name: kernel
Character device major/minor: 243:1
-----------------------------------
Volume ID: 1 (on ubi2)
Type: dynamic
Alignment: 1
Size: 248 LEBs (31490048 bytes, 30.0 MiB)
State: OK
Name: ubi_rootfs
Character device major/minor: 243:2
-----------------------------------
Volume ID: 2 (on ubi2)
Type: dynamic
Alignment: 1
Size: 1 LEBs (126976 bytes, 124.0 KiB)
State: OK
Name: rootfs_data
Character device major/minor: 243:3
root@OpenWrt:~# ubiupdatevol /dev/ubi2_0 /dev/ubi0_0
ubiupdatevol /dev/ubi2_0 /dev/ubi0_0
root@OpenWrt:~# md5sum /dev/ubi*_0
md5sum /dev/ubi*_0
1e7876636109535510dd7cee16386d36 /dev/ubi0_0
f6f1ef4942c4539e992431e2eb504e9b /dev/ubi1_0
faa1e5da33e5779508737687b3d68778 /dev/ubi2_0
root@OpenWrt:~# hexdump -C /dev/ubi0_0 | head
hexdump -C /dev/ubi0_0 | head
00000000 d0 0d fe ed 00 3e 00 00 00 00 00 38 00 36 17 4c |.....>.....8.6.L|
00000010 00 00 00 28 00 00 00 11 00 00 00 10 00 00 00 00 |...(............|
00000020 00 00 00 6c 00 36 17 14 00 00 00 00 00 00 00 00 |...l.6..........|
00000030 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 |................|
00000040 00 00 00 03 00 00 00 04 00 00 00 62 5d c8 cb 41 |...........b]..A|
00000050 00 00 00 03 00 00 00 1f 00 00 00 00 41 52 4d 20 |............ARM |
00000060 46 49 54 20 28 46 6c 61 74 74 65 6e 65 64 20 49 |FIT (Flattened I|
00000070 6d 61 67 65 20 54 72 65 65 29 00 00 00 00 00 03 |mage Tree)......|
00000080 00 00 00 04 00 00 00 0c 00 00 00 01 00 00 00 01 |................|
00000090 69 6d 61 67 65 2d 69 6e 66 6f 00 00 00 00 00 03 |image-info......|
root@OpenWrt:~#
root@OpenWrt:~# hexdump -C /dev/ubi2_0 | head
hexdump -C /dev/ubi2_0 | head
00000000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
003e0000
root@OpenWrt:~# cd /tmp
cd /tmp
root@OpenWrt:/tmp# cat /dev/ubi0_0 >u0
cat /dev/ubi0_0 >u0
root@OpenWrt:/tmp# md5sum u0 /dev/ubi0_0
md5sum u0 /dev/ubi0_0
1e7876636109535510dd7cee16386d36 u0
1e7876636109535510dd7cee16386d36 /dev/ubi0_0
root@OpenWrt:/tmp# ubiupdatevol /dev/ubi2_0 u0
ubiupdatevol /dev/ubi2_0 u0
root@OpenWrt:/tmp# md5sum /dev/ubi*_0
md5sum /dev/ubi*_0
1e7876636109535510dd7cee16386d36 /dev/ubi0_0
f6f1ef4942c4539e992431e2eb504e9b /dev/ubi1_0
1e7876636109535510dd7cee16386d36 /dev/ubi2_0
root@OpenWrt:/tmp# # cool !!!!
# cool !!!!
root@OpenWrt:/tmp# cat /dev/ubi0_1 >u1
cat /dev/ubi0_1 >u1
root@OpenWrt:/tmp# cat /dev/ubi0_2 >u2
cat /dev/ubi0_2 >u2
root@OpenWrt:/tmp# ubiupdatevol /dev/ubi2_1 u1
ubiupdatevol /dev/ubi2_1 u1
root@OpenWrt:/tmp# ubiupdatevol /dev/ubi2_2 u2
ubiupdatevol /dev/ubi2_2 u2
root@OpenWrt:/tmp# md5sum /dev/ubi*_*
md5sum /dev/ubi*_*
1e7876636109535510dd7cee16386d36 /dev/ubi0_0
edcd4e0e5732f18e81da7b33892fe784 /dev/ubi0_1
f7d566ac0d14fb993db66ed5ea370797 /dev/ubi0_2
f6f1ef4942c4539e992431e2eb504e9b /dev/ubi1_0
1e7876636109535510dd7cee16386d36 /dev/ubi2_0
edcd4e0e5732f18e81da7b33892fe784 /dev/ubi2_1
f7d566ac0d14fb993db66ed5ea370797 /dev/ubi2_2
md5sum: can't read '/dev/ubi_ctrl': Invalid argument
root@OpenWrt:/tmp# # cool, all volumret = 0
es copied
# cool, all volumes copied
root@OpenWrt:/tmp# reboot
Sounds good.
Should I worry about the bad blocks?
Let me know if you need any power resets or ethernet connectivity on the board.
--
Martin
On Thu, Dec 01, 2022 at 11:14:34PM -0800, Lanchon wrote:
first part ready. bad blocks, but i was able to copy volumes one by one instead of the whole device...
***@***.***:~$ sshpass -p ********* ssh -o KexAlgorithms=diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=ssh-rsa,ssh-dss -p 222 ***@***.*** hello ***@***.***:~# ***@***.***:~# ls ls bin dev home mnt proc sbin tmp var config etc lib overlay rom sys usr www ***@***.***:~# ***@***.***:~# reboot reboot procd: - reboot - ***@***.***:~# [41370.541686] reboot: Restarting system U-Boot 2012.07 [Barrier Breaker r1596,r1596] (Nov 08 2019 - 19:18:40) smem ram ptable found: ver: 0 len: 5 DRAM: 491 MiB NAND: SF: Unsupported manufacturer 00 ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0) 256 MiB MMC: NAND read from offset 1180000 failed -74 *** Warning - readenv() failed, using default environment In: serial Out: serial Err: serial MMC Device 0 not found cdp: get part failed for 0:HLOS Net: MAC0 addr:0:3:7f:ba:db:0 athrs17_reg_init: complete athrs17_vlan_config: Sercomm modify vlan config athrs17_vlan_config ...done S17c init done MAC1 addr:0:3:7f:ba:db:1 MAC2 addr:0:3:7f:ba:db:2 Port:2 speed 10Mbps MAC3 addr:0:3:7f:ba:db:3 Port:3 speed 10Mbps eth0, eth1, eth2, eth3 Done! Index Name Offset Length Real_Offs Real_Size 0 SBL1 0 40000 0 40000 1 MIBIB 40000 140000 40000 140000 2 SBL2 180000 140000 180000 140000 3 SBL3 2c0000 280000 2c0000 280000 4 DDRCONFIG 540000 120000 540000 120000 5 SSD 660000 120000 660000 120000 6 TZ 780000 280000 780000 280000 7 RPM a00000 280000 a00000 280000 8 APPSBL c80000 500000 c80000 500000 9 APPSBLENV 1180000 80000 1180000 80000 10 ART 1200000 140000 1200000 140000 11 rootfs 1340000 4000000 1340000 4000000 12 BOOTCONFIG 5340000 60000 5340000 60000 13 SBL2_1 53a0000 140000 53a0000 140000 14 SBL3_1 54e0000 280000 54e0000 280000 15 DDRCONFIG_1 5760000 120000 5760000 120000 16 SSD_1 5880000 120000 5880000 120000 17 TZ_1 59a0000 280000 59a0000 280000 18 RPM_1 5c20000 280000 5c20000 280000 19 BOOTCONFIG_1 5ea0000 60000 5ea0000 60000 20 APPSBL_1 5f00000 500000 5f00000 500000 21 rootfs_1 6400000 4000000 6400000 4000000 22 fw_env a400000 100000 a400000 100000 23 config a500000 800000 a500000 800000 24 PKI ad00000 200000 ad00000 200000 25 scfgmgr af00000 100000 af00000 100000 Hit any key to stop autoboot: 0 DOWNLOAD MODE BIT CHECK INTO NORMAL MODE:ff ff MMC Device 0 not found MMC Device 0 not found Creating 1 MTD partitions on "nand0": 0x000006400000-0x00000a400000 : "mtd=0" UBI: attaching mtd1 to ubi0 UBI: physical eraseblock size: 131072 bytes (128 KiB) UBI: logical eraseblock size: 126976 bytes UBI: smallest flash I/O unit: 2048 UBI: VID header offset: 2048 (aligned 2048) UBI: data offset: 4096 UBI: attached mtd1 to ubi0 UBI: MTD device name: "mtd=0" UBI: MTD device size: 64 MiB UBI: number of good PEBs: 512 UBI: number of bad PEBs: 0 UBI: max. allowed volumes: 128 UBI: wear-leveling threshold: 4096 UBI: number of internal volumes: 1 UBI: number of user volumes: 3 UBI: available PEBs: 222 UBI: total number of reserved PEBs: 290 UBI: number of PEBs reserved for bad PEB handling: 5 UBI: max/mean erase counter: 68/2 Read 0 bytes from volume kernel to 44000000 No size specified -> Using max size (4063232) ## Booting kernel from FIT Image at 44000000 ... Using ***@***.***_3' configuration Trying ***@***.***' kernel subimage Description: ARM Linux-3.14.43 Type: Kernel Image Compression: gzip compressed Data Start: 0x44000104 Data Size: 3364674 Bytes = 3.2 MiB Architecture: ARM OS: Linux Load Address: 0x42208000 Entry Point: 0x42208000 Hash algo: crc32 Hash value: 02a8d79f Hash algo: sha1 Hash value: b087bd50333a5a9f5425c73a956cfd8f40fb3d3e Verifying Hash Integrity ... crc32+ sha1+ OK ## Flattened Device Tree from FIT Image at 44000000 Using ***@***.***_3' configuration Trying ***@***.***' FDT blob subimage Description: ARM qcom_ipq806x_ap.akxx device tree blob Type: Flat Device Tree Compression: gzip compressed Data Start: 0x44338cf8 Data Size: 6446 Bytes = 6.3 KiB Architecture: ARM Hash algo: crc32 Hash value: 407be927 Hash algo: sha1 Hash value: c754eaafaac8105e838947ac245594531d90d07a Verifying Hash Integrity ... crc32+ sha1+ OK gzip compressed FDT image found FDT load address is: 0x43f00000 Loading FDT from 0x44338cf8 to 0x43f00000 Uncompressing Flat Device Tree ... OK Booting using the fdt blob at 0x43f00000 Uncompressing Kernel Image ... OK Loading Device Tree to 47ff6000, end 47fff501 ... OK mtdparts = ***@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.******@***.***(scfgmgr), Device nand1 not found! Using machid 0x1260 from environment Starting kernel ... [ 0.000000] Booting Linux on physical CPU 0x0 [...] SSDK Init OK! operate done. BusyBox v1.22.1 (2019-11-08 20:31:25 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. MM NM MMMMMMM M M $MMMMM MMMMM MMMMMMMMMMM MMM MMM MMMMMMMM MM MMMMM. MMMMM:MMMMMM: MMMM MMMMM MMMM= MMMMMM MMM MMMM MMMMM MMMM MMMMMM MMMM MMMMM' MMMM= MMMMM MMMM MM MMMMM MMMM MMMM MMMMNMMMMM MMMM= MMMM MMMMM MMMMM MMMM MMMM MMMMMMMM MMMM= MMMM MMMMMM MMMMM MMMM MMMM MMMMMMMMM MMMM= MMMM MMMMM, NMMMMMMMM MMMM MMMM MMMMMMMMMMM MMMM= MMMM MMMMMM MMMMMMMM MMMM MMMM MMMM MMMMMM MMMM= MMMM MM MMMM MMMM MMMM MMMM MMMM MMMM MMMM$ ,MMMMM MMMMM MMMM MMM MMMM MMMMM MMMM MMMM MMMMMMM: MMMMMMM M MMMMMMMMMMMM MMMMMMM MMMMMMM MMMMMM MMMMN M MMMMMMMMM MMMM MMMM MMMM M MMMMMMM M M M --------------------------------------------------------------- For those about to rock... (Bleeding Edge, r1602) --------------------------------------------------------------- ***@***.***:~# ***@***.***:~# ***@***.***:~# cat /proc/mtd cat /proc/mtd dev: size erasesize name mtd0: 00040000 00020000 "0:SBL1" mtd1: 00140000 00020000 "0:MIBIB" mtd2: 00140000 00020000 "0:SBL2_1" mtd3: 00280000 00020000 "0:SBL3_1" mtd4: 00120000 00020000 "0:DDRCONFIG_1" mtd5: 00120000 00020000 "0:SSD" mtd6: 00280000 00020000 "0:TZ_1" mtd7: 00280000 00020000 "0:RPM_1" mtd8: 00500000 00020000 "0:APPSBL_1" mtd9: 00080000 00020000 "0:APPSBLENV" mtd10: 00140000 00020000 "0:ART" mtd11: 04000000 00020000 "rootfs_1" mtd12: 00060000 00020000 "0:BOOTCONFIG" mtd13: 00140000 00020000 "0:SBL2" mtd14: 00280000 00020000 "0:SBL3" mtd15: 00120000 00020000 "0:DDRCONFIG" mtd16: 00120000 00020000 "0:SSD_1" mtd17: 00280000 00020000 "0:TZ" mtd18: 00280000 00020000 "0:RPM" mtd19: 00060000 00020000 "0:BOOTCONFIG1" mtd20: 00500000 00020000 "0:APPSBL" mtd21: 04000000 00020000 "rootfs" mtd22: 00100000 00020000 "fw_env" mtd23: 00800000 00020000 "config" mtd24: 00200000 00020000 "PKI" mtd25: 00100000 00020000 "scfgmgr" mtd26: 00008000 00008000 "spi32766.0" mtd27: 003e0000 0001f000 "kernel" mtd28: 01e08000 0001f000 "ubi_rootfs" mtd29: 0001f000 0001f000 "rootfs_data" mtd30: 00744000 0001f000 "ubi_config" ***@***.***:~# cat /dev/mtd21 | ubiformat /dev/mtd11 -f - cat /dev/mtd21 | ubiformat /dev/mtd11 -f - ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes libscan: scanning eraseblock 511 -- 100 % complete ubiformat: 510 eraseblocks have valid erase counter, mean value is 2 ubiformat: 2 bad eraseblocks found, numbers: 232, 234 ubiformat: error!: must use '-S' with non-zero value when reading from stdin cat: write error: Broken pipe ***@***.***:~# ubiformat /dev/mtd11 -f /dev/mtd21 ubiformat /dev/mtd11 -f /dev/mtd21 ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes libscan: scanning eraseblock 511 -- 100 % complete ubiformat: 510 eraseblocks have valid erase counter, mean value is 2 ubiformat: 2 bad eraseblocks found, numbers: 232, 234 Floating point exception ***@***.***:~# # hmmmmm... # hmmmmm... ***@***.***:~# ubiattach -m 11 ubiattach -m 11 UBI device number 2, total 510 LEBs (64757760 bytes, 61.8 MiB), available 288 LEBs (36569088 bytes, 34.9 MiB), LEB size 126976 bytes (124.0 KiB) ***@***.***:~# md5sum /dev/ubi*_* md5sum /dev/ubi*_* 1e7876636109535510dd7cee16386d36 /dev/ubi0_0 edcd4e0e5732f18e81da7b33892fe784 /dev/ubi0_1 f7d566ac0d14fb993db66ed5ea370797 /dev/ubi0_2 f6f1ef4942c4539e992431e2eb504e9b /dev/ubi1_0 18dd98b1ec7b488ab258e08d0e9aca2d /dev/ubi2_0 65f361c1be627f2da8ba791d65795bf5 /dev/ubi2_1 f7d566ac0d14fb993db66ed5ea370797 /dev/ubi2_2 md5sum: can't read '/dev/ubi_ctrl': Invalid argument ***@***.***:~# ubinfo -a ubinfo -a UBI version: 1 Count of UBI devices: 3 UBI control device major/minor: 10:60 Present UBI devices: ubi0, ubi1, ubi2 ubi0 Volumes count: 3 Logical eraseblock size: 126976 bytes, 124.0 KiB Total amount of logical eraseblocks: 512 (65011712 bytes, 62.0 MiB) Amount of available logical eraseblocks: 227 (28823552 bytes, 27.5 MiB) Maximum count of volumes 128 Count of bad physical eraseblocks: 0 Count of reserved physical eraseblocks: 0 Current maximum erase counter value: 68 Minimum input/output unit size: 2048 bytes Character device major/minor: 249:0 Present volumes: 0, 1, 2 Volume ID: 0 (on ubi0) Type: dynamic Alignment: 1 Size: 32 LEBs (4063232 bytes, 3.9 MiB) State: OK Name: kernel Character device major/minor: 249:1 ----------------------------------- Volume ID: 1 (on ubi0) Type: dynamic Alignment: 1 Size: 248 LEBs (31490048 bytes, 30.0 MiB) State: OK Name: ubi_rootfs Character device major/minor: 249:2 ----------------------------------- Volume ID: 2 (on ubi0) Type: dynamic Alignment: 1 Size: 1 LEBs (126976 bytes, 124.0 KiB) State: OK Name: rootfs_data Character device major/minor: 249:3 =================================== ubi1 Volumes count: 1 Logical eraseblock size: 126976 bytes, 124.0 KiB Total amount of logical eraseblocks: 64 (8126464 bytes, 7.8 MiB) Amount of available logical eraseblocks: 0 (0 bytes) Maximum count of volumes 128 Count of bad physical eraseblocks: 0 Count of reserved physical eraseblocks: 0 Current maximum erase counter value: 2 Minimum input/output unit size: 2048 bytes Character device major/minor: 248:0 Present volumes: 0 Volume ID: 0 (on ubi1) Type: dynamic Alignment: 1 Size: 60 LEBs (7618560 bytes, 7.3 MiB) State: OK Name: ubi_config Character device major/minor: 248:1 =================================== ubi2 Volumes count: 3 Logical eraseblock size: 126976 bytes, 124.0 KiB Total amount of logical eraseblocks: 510 (64757760 bytes, 61.8 MiB) Amount of available logical eraseblocks: 288 (36569088 bytes, 34.9 MiB) Maximum count of volumes 128 Count of bad physical eraseblocks: 2 Count of reserved physical eraseblocks: 0 Current maximum erase counter value: 226 Minimum input/output unit size: 2048 bytes Character device major/minor: 243:0 Present volumes: 0, 1, 2 Volume ID: 0 (on ubi2) Type: dynamic Alignment: 1 Size: 32 LEBs (4063232 bytes, 3.9 MiB) State: OK Name: kernel Character device major/minor: 243:1 ----------------------------------- Volume ID: 1 (on ubi2) Type: dynamic Alignment: 1 Size: 185 LEBs (23490560 bytes, 22.4 MiB) State: OK Name: ubi_rootfs Character device major/minor: 243:2 ----------------------------------- Volume ID: 2 (on ubi2) Type: dynamic Alignment: 1 Size: 1 LEBs (126976 bytes, 124.0 KiB) State: OK Name: rootfs_data Character device major/minor: 243:3 ***@***.***:~# ubidetach -m 11 ubidetach -m 11 ***@***.***:~# mtd --help mtd --help mtd: invalid option -- - Usage: mtd [<options> ...] <command> [<arguments> ...] <device>[:<device>...] The device is in the format of mtdX (eg: mtd4) or its label. mtd recognizes these commands: unlock unlock the device refresh refresh mtd partition erase erase all data on device verify <imagefile>|- verify <imagefile> (use - for stdin) to device write <imagefile>|- write <imagefile> (use - for stdin) to device jffs2write <file> append <file> to the jffs2 partition on the device Following options are available: -q quiet mode (once: no [w] on writing, twice: no status messages) -n write without first erasing the blocks -r reboot after successful command -f force write without trx checks -e <device> erase <device> before executing the command -d <name> directory for jffs2write, defaults to "tmp" -j <name> integrate <file> into jffs2 data when writing an image -s <number> skip the first n bytes when appending data to the jffs2 partiton, defaults to "0" -p write beginning at partition offset Example: To write linux.trx to mtd4 labeled as linux and reboot afterwards mtd -r write linux.trx linux ***@***.***:~# mtd erase /dev/mtd11 mtd erase /dev/mtd11 Unlocking /dev/mtd11 ... Erasing /dev/mtd11 ... Skipping bad block at 0x1d00000 Skipping bad block at 0x1d40000 ***@***.***:~# ***@***.***:~# cat /dev/mtd21 | ubiformat /dev/mtd11 -f - cat /dev/mtd21 | ubiformat /dev/mtd11 -f - ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes libscan: scanning eraseblock 511 -- 100 % complete ubiformat: 510 eraseblocks are supposedly empty ubiformat: 2 bad eraseblocks found, numbers: 232, 234 ubiformat: error!: must use '-S' with non-zero value when reading from stdin cat: write error: Broken pipe ***@***.***:~# ubiformat /dev/mtd11 -f /dev/mtd21 ubiformat /dev/mtd11 -f /dev/mtd21 ubiformat: mtd11 (nand), size 67108864 bytes (64.0 MiB), 512 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes libscan: scanning eraseblock 511 -- 100 % complete ubiformat: 510 eraseblocks are supposedly empty ubiformat: 2 bad eraseblocks found, numbers: 232, 234 Floating point exception ***@***.***:~# ubiattach -m 11 ubiattach -m 11 UBI device number 2, total 510 LEBs (64757760 bytes, 61.8 MiB), available 506 LEBs (64249856 bytes, 61.3 MiB), LEB size 126976 bytes (124.0 KiB) ***@***.***:~# ubinfo -a ubinfo -a UBI version: 1 Count of UBI devices: 3 UBI control device major/minor: 10:60 Present UBI devices: ubi0, ubi1, ubi2 ubi0 Volumes count: 3 Logical eraseblock size: 126976 bytes, 124.0 KiB Total amount of logical eraseblocks: 512 (65011712 bytes, 62.0 MiB) Amount of available logical eraseblocks: 227 (28823552 bytes, 27.5 MiB) Maximum count of volumes 128 Count of bad physical eraseblocks: 0 Count of reserved physical eraseblocks: 0 Current maximum erase counter value: 68 Minimum input/output unit size: 2048 bytes Character device major/minor: 249:0 Present volumes: 0, 1, 2 Volume ID: 0 (on ubi0) Type: dynamic Alignment: 1 Size: 32 LEBs (4063232 bytes, 3.9 MiB) State: OK Name: kernel Character device major/minor: 249:1 ----------------------------------- Volume ID: 1 (on ubi0) Type: dynamic Alignment: 1 Size: 248 LEBs (31490048 bytes, 30.0 MiB) State: OK Name: ubi_rootfs Character device major/minor: 249:2 ----------------------------------- Volume ID: 2 (on ubi0) Type: dynamic Alignment: 1 Size: 1 LEBs (126976 bytes, 124.0 KiB) State: OK Name: rootfs_data Character device major/minor: 249:3 =================================== ubi1 Volumes count: 1 Logical eraseblock size: 126976 bytes, 124.0 KiB Total amount of logical eraseblocks: 64 (8126464 bytes, 7.8 MiB) Amount of available logical eraseblocks: 0 (0 bytes) Maximum count of volumes 128 Count of bad physical eraseblocks: 0 Count of reserved physical eraseblocks: 0 Current maximum erase counter value: 2 Minimum input/output unit size: 2048 bytes Character device major/minor: 248:0 Present volumes: 0 Volume ID: 0 (on ubi1) Type: dynamic Alignment: 1 Size: 60 LEBs (7618560 bytes, 7.3 MiB) State: OK Name: ubi_config Character device major/minor: 248:1 =================================== ubi2 Volumes count: 0 Logical eraseblock size: 126976 bytes, 124.0 KiB Total amount of logical eraseblocks: 510 (64757760 bytes, 61.8 MiB) Amount of available logical eraseblocks: 506 (64249856 bytes, 61.3 MiB) Maximum count of volumes 128 Count of bad physical eraseblocks: 2 Count of reserved physical eraseblocks: 0 Current maximum erase counter value: 1 Minimum input/output unit size: 2048 bytes Character device major/minor: 243:0 ***@***.***:~# ubimkvol /dev/ubi2 -N kernel -S 32 ubimkvol /dev/ubi2 -N kernel -S 32 Volume ID 0, size 32 LEBs (4063232 bytes, 3.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1 ***@***.***:~# ubimkvol /dev/ubi2 -N ubi_rootfs -S 248 ubimkvol /dev/ubi2 -N ubi_rootfs -S 248 Volume ID 1, size 248 LEBs (31490048 bytes, 30.0 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "ubi_rootfs", alignment 1 ***@***.***:~# ubimkvol /dev/ubi2 -N rootfs_data -S 1 ubimkvol /dev/ubi2 -N rootfs_data -S 1 Volume ID 2, size 1 LEBs (126976 bytes, 124.0 KiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1 ***@***.***:~# ubinfo -a ubinfo -a UBI version: 1 Count of UBI devices: 3 UBI control device major/minor: 10:60 Present UBI devices: ubi0, ubi1, ubi2 ubi0 Volumes count: 3 Logical eraseblock size: 126976 bytes, 124.0 KiB Total amount of logical eraseblocks: 512 (65011712 bytes, 62.0 MiB) Amount of available logical eraseblocks: 227 (28823552 bytes, 27.5 MiB) Maximum count of volumes 128 Count of bad physical eraseblocks: 0 Count of reserved physical eraseblocks: 0 Current maximum erase counter value: 68 Minimum input/output unit size: 2048 bytes Character device major/minor: 249:0 Present volumes: 0, 1, 2 Volume ID: 0 (on ubi0) Type: dynamic Alignment: 1 Size: 32 LEBs (4063232 bytes, 3.9 MiB) State: OK Name: kernel Character device major/minor: 249:1 ----------------------------------- Volume ID: 1 (on ubi0) Type: dynamic Alignment: 1 Size: 248 LEBs (31490048 bytes, 30.0 MiB) State: OK Name: ubi_rootfs Character device major/minor: 249:2 ----------------------------------- Volume ID: 2 (on ubi0) Type: dynamic Alignment: 1 Size: 1 LEBs (126976 bytes, 124.0 KiB) State: OK Name: rootfs_data Character device major/minor: 249:3 =================================== ubi1 Volumes count: 1 Logical eraseblock size: 126976 bytes, 124.0 KiB Total amount of logical eraseblocks: 64 (8126464 bytes, 7.8 MiB) Amount of available logical eraseblocks: 0 (0 bytes) Maximum count of volumes 128 Count of bad physical eraseblocks: 0 Count of reserved physical eraseblocks: 0 Current maximum erase counter value: 2 Minimum input/output unit size: 2048 bytes Character device major/minor: 248:0 Present volumes: 0 Volume ID: 0 (on ubi1) Type: dynamic Alignment: 1 Size: 60 LEBs (7618560 bytes, 7.3 MiB) State: OK Name: ubi_config Character device major/minor: 248:1 =================================== ubi2 Volumes count: 3 Logical eraseblock size: 126976 bytes, 124.0 KiB Total amount of logical eraseblocks: 510 (64757760 bytes, 61.8 MiB) Amount of available logical eraseblocks: 225 (28569600 bytes, 27.2 MiB) Maximum count of volumes 128 Count of bad physical eraseblocks: 2 Count of reserved physical eraseblocks: 0 Current maximum erase counter value: 2 Minimum input/output unit size: 2048 bytes Character device major/minor: 243:0 Present volumes: 0, 1, 2 Volume ID: 0 (on ubi2) Type: dynamic Alignment: 1 Size: 32 LEBs (4063232 bytes, 3.9 MiB) State: OK Name: kernel Character device major/minor: 243:1 ----------------------------------- Volume ID: 1 (on ubi2) Type: dynamic Alignment: 1 Size: 248 LEBs (31490048 bytes, 30.0 MiB) State: OK Name: ubi_rootfs Character device major/minor: 243:2 ----------------------------------- Volume ID: 2 (on ubi2) Type: dynamic Alignment: 1 Size: 1 LEBs (126976 bytes, 124.0 KiB) State: OK Name: rootfs_data Character device major/minor: 243:3 ***@***.***:~# ubiupdatevol /dev/ubi2_0 /dev/ubi0_0 ubiupdatevol /dev/ubi2_0 /dev/ubi0_0 ***@***.***:~# md5sum /dev/ubi*_0 md5sum /dev/ubi*_0 1e7876636109535510dd7cee16386d36 /dev/ubi0_0 f6f1ef4942c4539e992431e2eb504e9b /dev/ubi1_0 faa1e5da33e5779508737687b3d68778 /dev/ubi2_0 ***@***.***:~# hexdump -C /dev/ubi0_0 | head hexdump -C /dev/ubi0_0 | head 00000000 d0 0d fe ed 00 3e 00 00 00 00 00 38 00 36 17 4c |.....>.....8.6.L| 00000010 00 00 00 28 00 00 00 11 00 00 00 10 00 00 00 00 |...(............| 00000020 00 00 00 6c 00 36 17 14 00 00 00 00 00 00 00 00 |...l.6..........| 00000030 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 |................| 00000040 00 00 00 03 00 00 00 04 00 00 00 62 5d c8 cb 41 |...........b]..A| 00000050 00 00 00 03 00 00 00 1f 00 00 00 00 41 52 4d 20 |............ARM | 00000060 46 49 54 20 28 46 6c 61 74 74 65 6e 65 64 20 49 |FIT (Flattened I| 00000070 6d 61 67 65 20 54 72 65 65 29 00 00 00 00 00 03 |mage Tree)......| 00000080 00 00 00 04 00 00 00 0c 00 00 00 01 00 00 00 01 |................| 00000090 69 6d 61 67 65 2d 69 6e 66 6f 00 00 00 00 00 03 |image-info......| ***@***.***:~# ***@***.***:~# hexdump -C /dev/ubi2_0 | head hexdump -C /dev/ubi2_0 | head 00000000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| * 003e0000 ***@***.***:~# cd /tmp cd /tmp ***@***.***:/tmp# cat /dev/ubi0_0 >u0 cat /dev/ubi0_0 >u0 ***@***.***:/tmp# md5sum u0 /dev/ubi0_0 md5sum u0 /dev/ubi0_0 1e7876636109535510dd7cee16386d36 u0 1e7876636109535510dd7cee16386d36 /dev/ubi0_0 ***@***.***:/tmp# ubiupdatevol /dev/ubi2_0 u0 ubiupdatevol /dev/ubi2_0 u0 ***@***.***:/tmp# md5sum /dev/ubi*_0 md5sum /dev/ubi*_0 1e7876636109535510dd7cee16386d36 /dev/ubi0_0 f6f1ef4942c4539e992431e2eb504e9b /dev/ubi1_0 1e7876636109535510dd7cee16386d36 /dev/ubi2_0 ***@***.***:/tmp# # cool !!!! # cool !!!! ***@***.***:/tmp# cat /dev/ubi0_1 >u1 cat /dev/ubi0_1 >u1 ***@***.***:/tmp# cat /dev/ubi0_2 >u2 cat /dev/ubi0_2 >u2 ***@***.***:/tmp# ubiupdatevol /dev/ubi2_1 u1 ubiupdatevol /dev/ubi2_1 u1 ***@***.***:/tmp# ubiupdatevol /dev/ubi2_2 u2 ubiupdatevol /dev/ubi2_2 u2 ***@***.***:/tmp# md5sum /dev/ubi*_* md5sum /dev/ubi*_* 1e7876636109535510dd7cee16386d36 /dev/ubi0_0 edcd4e0e5732f18e81da7b33892fe784 /dev/ubi0_1 f7d566ac0d14fb993db66ed5ea370797 /dev/ubi0_2 f6f1ef4942c4539e992431e2eb504e9b /dev/ubi1_0 1e7876636109535510dd7cee16386d36 /dev/ubi2_0 edcd4e0e5732f18e81da7b33892fe784 /dev/ubi2_1 f7d566ac0d14fb993db66ed5ea370797 /dev/ubi2_2 md5sum: can't read '/dev/ubi_ctrl': Invalid argument ***@***.***:/tmp# # cool, all volumret = 0 es copied # cool, all volumes copied ***@***.***:/tmp# reboot
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334846505 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
second part now, edit BOOTCONFIG1 to force booting from primary slot...
SSDK Init OK!
operate done.
BusyBox v1.22.1 (2019-11-08 20:31:25 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
MM NM MMMMMMM M M
$MMMMM MMMMM MMMMMMMMMMM MMM MMM
MMMMMMMM MM MMMMM. MMMMM:MMMMMM: MMMM MMMMM
MMMM= MMMMMM MMM MMMM MMMMM MMMM MMMMMM MMMM MMMMM'
MMMM= MMMMM MMMM MM MMMMM MMMM MMMM MMMMNMMMMM
MMMM= MMMM MMMMM MMMMM MMMM MMMM MMMMMMMM
MMMM= MMMM MMMMMM MMMMM MMMM MMMM MMMMMMMMM
MMMM= MMMM MMMMM, NMMMMMMMM MMMM MMMM MMMMMMMMMMM
MMMM= MMMM MMMMMM MMMMMMMM MMMM MMMM MMMM MMMMMM
MMMM= MMMM MM MMMM MMMM MMMM MMMM MMMM MMMM
MMMM$ ,MMMMM MMMMM MMMM MMM MMMM MMMMM MMMM MMMM
MMMMMMM: MMMMMMM M MMMMMMMMMMMM MMMMMMM MMMMMMM
MMMMMM MMMMN M MMMMMMMMM MMMM MMMM
MMMM M MMMMMMM M M
M
---------------------------------------------------------------
For those about to rock... (Bleeding Edge, r1602)
---------------------------------------------------------------
root@OpenWrt:/tmp#
root@OpenWrt:/tmp#
root@OpenWrt:/tmp# cd /tmp
dd if=/dev/mtd19 bs=4K count=1 >bc1
dd if=bc1 bs=1 count=4 >bc1-mod
dd if=bc1 bs=1 skip=5 count=1 >>bc1-mod
dd if=bc1 bs=1 skip=5 >>bc1-mod
cd /tmp
root@OpenWrt:/tmp# dd if=/dev/mtd19 bs=4K count=1 >bc1
1+0 records in
1+0 records out
root@OpenWrt:/tmp# dd if=bc1 bs=1 count=4 >bc1-mod
4+0 records in
4+0 records out
root@OpenWrt:/tmp# dd if=bc1 bs=1 skip=5 count=1 >>bc1-mod
1+0 records in
1+0 records out
root@OpenWrt:/tmp# dd if=bc1 bs=1 skip=5 >>bc1-mod
4091+0 records in
4091+0 records out
root@OpenWrt:/tmp#
root@OpenWrt:/tmp# cmp -l bc1 bc1-mod
cmp -l bc1 bc1-mod
5 2 0
root@OpenWrt:/tmp# mtd erase /dev/mtd19
mtd erase /dev/mtd19
Unlocking /dev/mtd19 ...
Erasing /dev/mtd19 ...
root@OpenWrt:/tmp# mtd write bc1-mod /dev/mtd19
mtd write bc1-mod /dev/mtd19
Unlocking /dev/mtd19 ...
Writing from bc1-mod to /dev/mtd19 ...
root@OpenWrt:/tmp# cmp -l bc1-mod /dev/mtd19
cmp -l bc1-mod /dev/mtd19
cmp: EOF on bc1-mod
root@OpenWrt:/tmp# # next boot should be from primary slot??? or maybe brick :(
# next boot should be from primary slot??? or maybe brick :(
root@OpenWrt:/tmp# reboot
booted from primary slot, rootfs is now mtd11, not mtd21:
SSDK Init OK!
operate done.
BusyBox v1.22.1 (2019-11-08 20:31:25 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
MM NM MMMMMMM M M
$MMMMM MMMMM MMMMMMMMMMM MMM MMM
MMMMMMMM MM MMMMM. MMMMM:MMMMMM: MMMM MMMMM
MMMM= MMMMMM MMM MMMM MMMMM MMMM MMMMMM MMMM MMMMM'
MMMM= MMMMM MMMM MM MMMMM MMMM MMMM MMMMNMMMMM
MMMM= MMMM MMMMM MMMMM MMMM MMMM MMMMMMMM
MMMM= MMMM MMMMMM MMMMM MMMM MMMM MMMMMMMMM
MMMM= MMMM MMMMM, NMMMMMMMM MMMM MMMM MMMMMMMMMMM
MMMM= MMMM MMMMMM MMMMMMMM MMMM MMMM MMMM MMMMMM
MMMM= MMMM MM MMMM MMMM MMMM MMMM MMMM MMMM
MMMM$ ,MMMMM MMMMM MMMM MMM MMMM MMMMM MMMM MMMM
MMMMMMM: MMMMMMM M MMMMMMMMMMMM MMMMMMM MMMMMMM
MMMMMM MMMMN M MMMMMMMMM MMMM MMMM
MMMM M MMMMMMM M M
M
---------------------------------------------------------------
For those about to rock... (Bleeding Edge, r1602)
---------------------------------------------------------------
root@OpenWrt:~# cat /proc/mtd
cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00020000 "0:SBL1"
mtd1: 00140000 00020000 "0:MIBIB"
mtd2: 00140000 00020000 "0:SBL2"
mtd3: 00280000 00020000 "0:SBL3"
mtd4: 00120000 00020000 "0:DDRCONFIG"
mtd5: 00120000 00020000 "0:SSD"
mtd6: 00280000 00020000 "0:TZ"
mtd7: 00280000 00020000 "0:RPM"
mtd8: 00500000 00020000 "0:APPSBL"
mtd9: 00080000 00020000 "0:APPSBLENV"
mtd10: 00140000 00020000 "0:ART"
mtd11: 04000000 00020000 "rootfs"
mtd12: 00060000 00020000 "0:BOOTCONFIG"
mtd13: 00140000 00020000 "0:SBL2_1"
mtd14: 00280000 00020000 "0:SBL3_1"
mtd15: 00120000 00020000 "0:DDRCONFIG_1"
mtd16: 00120000 00020000 "0:SSD_1"
mtd17: 00280000 00020000 "0:TZ_1"
mtd18: 00280000 00020000 "0:RPM_1"
mtd19: 00060000 00020000 "0:BOOTCONFIG1"
mtd20: 00500000 00020000 "0:APPSBL_1"
mtd21: 04000000 00020000 "rootfs_1"
mtd22: 00100000 00020000 "fw_env"
mtd23: 00800000 00020000 "config"
mtd24: 00200000 00020000 "PKI"
mtd25: 00100000 00020000 "scfgmgr"
mtd26: 00008000 00008000 "spi32766.0"
mtd27: 003e0000 0001f000 "kernel"
mtd28: 01e08000 0001f000 "ubi_rootfs"
mtd29: 0001f000 0001f000 "rootfs_data"
mtd30: 00744000 0001f000 "ubi_config"
Nice!
So we're ready for the upgrade!?
--
Martin
On Thu, Dec 01, 2022 at 11:27:16PM -0800, Lanchon wrote:
second part now, edit BOOTCONFIG1 to force booting from primary slot...
SSDK Init OK! operate done. BusyBox v1.22.1 (2019-11-08 20:31:25 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. MM NM MMMMMMM M M $MMMMM MMMMM MMMMMMMMMMM MMM MMM MMMMMMMM MM MMMMM. MMMMM:MMMMMM: MMMM MMMMM MMMM= MMMMMM MMM MMMM MMMMM MMMM MMMMMM MMMM MMMMM' MMMM= MMMMM MMMM MM MMMMM MMMM MMMM MMMMNMMMMM MMMM= MMMM MMMMM MMMMM MMMM MMMM MMMMMMMM MMMM= MMMM MMMMMM MMMMM MMMM MMMM MMMMMMMMM MMMM= MMMM MMMMM, NMMMMMMMM MMMM MMMM MMMMMMMMMMM MMMM= MMMM MMMMMM MMMMMMMM MMMM MMMM MMMM MMMMMM MMMM= MMMM MM MMMM MMMM MMMM MMMM MMMM MMMM MMMM$ ,MMMMM MMMMM MMMM MMM MMMM MMMMM MMMM MMMM MMMMMMM: MMMMMMM M MMMMMMMMMMMM MMMMMMM MMMMMMM MMMMMM MMMMN M MMMMMMMMM MMMM MMMM MMMM M MMMMMMM M M M --------------------------------------------------------------- For those about to rock... (Bleeding Edge, r1602) --------------------------------------------------------------- ***@***.***:/tmp# ***@***.***:/tmp# ***@***.***:/tmp# cd /tmp dd if=/dev/mtd19 bs=4K count=1 >bc1 dd if=bc1 bs=1 count=4 >bc1-mod dd if=bc1 bs=1 skip=5 count=1 >>bc1-mod dd if=bc1 bs=1 skip=5 >>bc1-mod cd /tmp ***@***.***:/tmp# dd if=/dev/mtd19 bs=4K count=1 >bc1 1+0 records in 1+0 records out ***@***.***:/tmp# dd if=bc1 bs=1 count=4 >bc1-mod 4+0 records in 4+0 records out ***@***.***:/tmp# dd if=bc1 bs=1 skip=5 count=1 >>bc1-mod 1+0 records in 1+0 records out ***@***.***:/tmp# dd if=bc1 bs=1 skip=5 >>bc1-mod 4091+0 records in 4091+0 records out ***@***.***:/tmp# ***@***.***:/tmp# cmp -l bc1 bc1-mod cmp -l bc1 bc1-mod 5 2 0 ***@***.***:/tmp# mtd erase /dev/mtd19 mtd erase /dev/mtd19 Unlocking /dev/mtd19 ... Erasing /dev/mtd19 ... ***@***.***:/tmp# mtd write bc1-mod /dev/mtd19 mtd write bc1-mod /dev/mtd19 Unlocking /dev/mtd19 ... Writing from bc1-mod to /dev/mtd19 ... ***@***.***:/tmp# cmp -l bc1-mod /dev/mtd19 cmp -l bc1-mod /dev/mtd19 cmp: EOF on bc1-mod ***@***.***:/tmp# # next boot should be from primary slot??? or maybe brick :( # next boot should be from primary slot??? or maybe brick :( ***@***.***:/tmp# reboot
yasssss!!
booted from primary slot, rootfs is now mtd11, not mtd21:
SSDK Init OK! operate done. BusyBox v1.22.1 (2019-11-08 20:31:25 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. MM NM MMMMMMM M M $MMMMM MMMMM MMMMMMMMMMM MMM MMM MMMMMMMM MM MMMMM. MMMMM:MMMMMM: MMMM MMMMM MMMM= MMMMMM MMM MMMM MMMMM MMMM MMMMMM MMMM MMMMM' MMMM= MMMMM MMMM MM MMMMM MMMM MMMM MMMMNMMMMM MMMM= MMMM MMMMM MMMMM MMMM MMMM MMMMMMMM MMMM= MMMM MMMMMM MMMMM MMMM MMMM MMMMMMMMM MMMM= MMMM MMMMM, NMMMMMMMM MMMM MMMM MMMMMMMMMMM MMMM= MMMM MMMMMM MMMMMMMM MMMM MMMM MMMM MMMMMM MMMM= MMMM MM MMMM MMMM MMMM MMMM MMMM MMMM MMMM$ ,MMMMM MMMMM MMMM MMM MMMM MMMMM MMMM MMMM MMMMMMM: MMMMMMM M MMMMMMMMMMMM MMMMMMM MMMMMMM MMMMMM MMMMN M MMMMMMMMM MMMM MMMM MMMM M MMMMMMM M M M --------------------------------------------------------------- For those about to rock... (Bleeding Edge, r1602) --------------------------------------------------------------- ***@***.***:~# cat /proc/mtd cat /proc/mtd dev: size erasesize name mtd0: 00040000 00020000 "0:SBL1" mtd1: 00140000 00020000 "0:MIBIB" mtd2: 00140000 00020000 "0:SBL2" mtd3: 00280000 00020000 "0:SBL3" mtd4: 00120000 00020000 "0:DDRCONFIG" mtd5: 00120000 00020000 "0:SSD" mtd6: 00280000 00020000 "0:TZ" mtd7: 00280000 00020000 "0:RPM" mtd8: 00500000 00020000 "0:APPSBL" mtd9: 00080000 00020000 "0:APPSBLENV" mtd10: 00140000 00020000 "0:ART" mtd11: 04000000 00020000 "rootfs" mtd12: 00060000 00020000 "0:BOOTCONFIG" mtd13: 00140000 00020000 "0:SBL2_1" mtd14: 00280000 00020000 "0:SBL3_1" mtd15: 00120000 00020000 "0:DDRCONFIG_1" mtd16: 00120000 00020000 "0:SSD_1" mtd17: 00280000 00020000 "0:TZ_1" mtd18: 00280000 00020000 "0:RPM_1" mtd19: 00060000 00020000 "0:BOOTCONFIG1" mtd20: 00500000 00020000 "0:APPSBL_1" mtd21: 04000000 00020000 "rootfs_1" mtd22: 00100000 00020000 "fw_env" mtd23: 00800000 00020000 "config" mtd24: 00200000 00020000 "PKI" mtd25: 00100000 00020000 "scfgmgr" mtd26: 00008000 00008000 "spi32766.0" mtd27: 003e0000 0001f000 "kernel" mtd28: 01e08000 0001f000 "ubi_rootfs" mtd29: 0001f000 0001f000 "rootfs_data" mtd30: 00744000 0001f000 "ubi_config"
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334854747 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
the primary slot was corrupted, possibly because of NAND bad blocks. the rootfs volume was truncated 23 MB instead of being 31MB as it should. this was visible in the first ubinfo -a
in the number of LEBs, and also in your UBI backups, but i hadn't noticed. if we hadn't rewritten the main slot we'd have a brick now lol.
bad blocks are normal, should not be an issue. but i guess the factory image programmer was not smart enough to restructure the UBI device around the defects, it one copy of your OS was dead. UBI IS smart enough, and that's why it shouldn't be an issue (it is working!)
now it's your turn to follow the standard install instructions. i can't cause i'd need ssh access to the device on top of serial access. so you do it, i'll be around some more.
Okay! I'll give it a go...
On Thu, Dec 01, 2022 at 11:34:29PM -0800, Lanchon wrote:
now it's your turn to follow the standard install instructions. i can't cause i'd need ssh access to the device on top of serial access. so you do it, i'll be around some more.
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334859546 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
my installer will complain about your OS version being unknown. just use the "force" flag to ignore that.
@. ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [54] ssh @. "sh /tmp/install-recovery.sh" | tee log1.txt
checking current firmware version (-f to disable check) md5sum: WARNING: 1 of 1 computed checksums did NOT match /etc/svn.info: FAILED
Should I go with '-f' ?
On Thu, Dec 01, 2022 at 11:34:29PM -0800, Lanchon wrote:
now it's your turn to follow the standard install instructions. i can't cause i'd need ssh access to the device on top of serial access. so you do it, i'll be around some more.
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334859546 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
lol i beat you to that one
On Thu, Dec 01, 2022 at 11:44:16PM -0800, Lanchon wrote:
lol i beat you to that one
:-)
A few errors/warnings. Does it look okay? Can go to next step...
@. ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [55] ssh @. "sh /tmp/install-recovery.sh -f" | tee log1.txt
checking for downloaded initramfs recovery image -rw------- 1 root root 6461405 Nov 10 19:02 /tmp/recovery.bin
creating recovery volume ubirmvol: error!: cannot find UBI volume "recovery" error 2 (No such file or directory) Volume ID 9, size 100 LEBs (12697600 bytes, 12.1 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "recovery", alignment 1 installing recovery
checking status of new fw_env partition stock ubi partition found, data copy from stock fw_env needed verifying contents of stock fw_env partition MySpectrumWiFi83-2G attempting backup of fw_env data Volume ID 8, size 1 LEBs (126976 bytes, 124.0 KiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "fw_env_backup", alignment 1 1+0 records in 1+0 records out copying contents of stock fw_env partition Unlocking /dev/mtd21 ... Erasing /dev/mtd21 ... Unlocking /dev/mtd21 ...
Writing from
verifying contents of new fw_env partition MySpectrumWiFi83-2G
checking status of config ubi partition ubi1:ubi_config on /config type ubifs (rw,relatime) wiping config ubi partition Unlocking /dev/mtd23 ... Erasing /dev/mtd23 ...
setting up u-boot environment Warning: Bad CRC, using default environment
all done!
a reboot should now take you to the recovery initramfs firmware from there do a sysupgrade to a squashfs firmware to finish the install
@.*** ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [56]
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334866154 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
ubirmvol: error!: cannot find UBI volume "recovery"
Warning: Bad CRC, using default environment
the script breaks on unexpected errors. those are ok :)
Okay, rebooting. Then will flash...
On Thu, Dec 01, 2022 at 11:50:12PM -0800, Lanchon wrote:
ubirmvol: error!: cannot find UBI volume "recovery"
Warning: Bad CRC, using default environment
the script breaks on unexpected errors. those are ok :)
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334870226 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
you should be booting into a recovery ram-only system now. from there you'll install the real system.
if you ever brick and recovery doesn't invoke automatically, you should be able to run recovery manually by stopping the boot loader via the serial and entering this command there:
run boot_recovery
Flashing...
On Thu, Dec 01, 2022 at 11:57:36PM -0800, Lanchon wrote:
you should be booting into a recovery ram-only system now. from there you'll install the real system.
if you ever brick and recovery doesn't invoke automatically, you should be able to run recovery manually by stopping the boot loader via the serial and entering this command there:
run boot_recovery
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334875772 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
I think it worked!
From Luci:
System Hostname OpenWrt Model Arris TR4400 v2 Architecture ARMv7 Processor rev 0 (v7l) Target Platform ipq806x/generic Firmware Version OpenWrt 22.03.2 r19803-9a599fee93 / LuCI openwrt-22.03 branch git-22.288.45147-96ec0cd Kernel Version 5.10.146 Local Time 2022-10-14 22:47:27 Uptime 0h 3m 4s Load Average 0.07, 0.12, 0.06
On Thu, Dec 01, 2022 at 11:57:36PM -0800, Lanchon wrote:
you should be booting into a recovery ram-only system now. from there you'll install the real system.
if you ever brick and recovery doesn't invoke automatically, you should be able to run recovery manually by stopping the boot loader via the serial and entering this command there:
run boot_recovery
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334875772 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
congrats!!! it's a solid device.
now a glass of wine and bed :)
On Fri, Dec 02, 2022 at 12:06:13AM -0800, Lanchon wrote:
congrats!!! it's a solid device.
now a glass of wine and bed :)
Thanks! Enjoy the wine. And the sleeping!
I'm going to do some network config so it doesn't keep reverting to 192.168.1.1
Super excited that we got it working instead of bricking it!
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1334883478 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
how is it that you were able to do the hardware mod? are you an electronics major?
how did you handle the 1.8V serial? were you able to find a ready-made adapter? got a pointer to that?
thanks!
That was some tricky soldering! I could barely see the resistor pads. Had to break out the head magnifier. I've been (hobby-level) soldering a few circuits here and there but only relatively recently attempted any surface-mount.
I'm pretty sure an electronics major would have done a better job than this [attached]!! I decided to bridge the first resistor and then just attach wirewrap wire to the pad of the missing FET. The soldering heat melts away more of the insulation than I'd have liked. Very fragile in the end but it held together. I've been paranoid about even breathing on it until we had a successful network-updateable firmware running. We'll see if it holds together when I put all the hardware back together.
Might actually have been easier to solder all the missing resistors and FETs instead of the solder-crime I perpetrated on the poor board. If I ever convert another router, I think I'll use this first one to figure out workable values for components and then have a go at populating the next board. I've never soldered SMD smaller than about 0603 before though. Might be an excuse to get that desk microscope I'm sure I need.
Like you, I was also lucky with my 3.3V USB serial adapter. It seemed perfectly happy with the 1.8V level input.
--
Martin
On Fri, Dec 02, 2022 at 07:41:31AM -0800, Lanchon wrote:
how is it that you were able to do the hardware mod? are you an electronics major?
how did you handle the 1.8V serial? were you able to find a ready-made adapter? got a pointer to that?
thanks!
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1335437294 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
Huge thanks again for all of your efforts with this. I'd have given up long ago without your endless help and detailed instructions. Very nice to have a useful device instead of another piece of useless electronics to toss in the dumpster.
I've left the networked serial port connection up in case there's any extra post-mortem (post-reincarnation?) info you need to get from the router while it's still on my desk. Or just let me know if there's any console logs or command output you'd like me to run.
I'm hoping other people will also be able to follow your instructions to mod these devices but I have to admit that the soldering part would be a major hurdle to most folks. I also hope they don't run into the strange MTD problems that we had, but at least now there's some history for them to look at!
--
Martin
On Fri, Dec 02, 2022 at 07:41:31AM -0800, Lanchon wrote:
how is it that you were able to do the hardware mod? are you an electronics major?
how did you handle the 1.8V serial? were you able to find a ready-made adapter? got a pointer to that?
thanks!
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1335437294 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
hold on! are you injecting the 3.3V signal into the 1.8V input of the SoC?
you might fry the chip any second!! or affect its reliability. the input ESD protection diode is probably conducting a sustained current and it is really not made for that! id disconnect the usb adapter asap if i were you.
No, sorry, I should have been clearer! The 1.8V -> 3.3V is just for outbound signal from router. I use 2x 10K resistors to half the inbound signal.
--
Martin
On Fri, Dec 02, 2022 at 01:42:48PM -0800, Lanchon wrote:
hold on! are you injecting the 3.3V signal into the 1.8V input of the SoC?
you might fry the chip any second!! or affect its reliability. the input ESD protection diode is probably conducting a sustained current and it is really not made for that! id disconnect the usb adapter asap if i were you.
-- Reply to this email directly or view it on GitHub: https://github.com/Lanchon/openwrt-tr4400-v2/issues/1#issuecomment-1335870970 You are receiving this because you were mentioned.
Message ID: @.***>
--
Martin
Martin Emmerson.
i added detection for your case during install: https://github.com/Lanchon/openwrt-tr4400-v2/commit/f1b99b5a8e4f178c64972767a9d8893a1a2b2181
hi and sorry for not having time to answer properly.
soldering this MOFO is a b*tch.
also, the pads to which you are soldering the wires WILL peel off and break! it's inevitable. i'd cut those wires short and solder them to the currently disconnected though-holes of the serial connector, even if you don't add a connector. at least forces on them will diminish and they might survive. you never know when you might need serial again.
good to know you are using a voltage divider network... :+1:
I've left the networked serial port connection up
thanks! not needed anymore. AFAICK, your device is exactly like mine, but with different OS versions and some NAND flash defects.
thanks for reporting, got to know more about this platform.
take care :)
Hi! (Hope this is the right place to raise this):
After the tricky business of opening the case, soldering tiny wires, getting a serial console...
I'm stuck installing openwrt on my RACV21A version Arris TR4400 v2. There's a whole bunch of differences flagged up by check-svn1418.sh (see below).
Does this mean there's a problem with check-svn1418.sh, or can I safely ignore the errors?
emmerson@mingo ~/openwrt_arris_racv21a/openwrt-tr4400-v2-main [9] ssh -l root 10.9.124.4 sh <check-svn1418.sh
This script checks the current state of your router in depth. If all checks pass, you are good to go on installing OpenWRT. The router USB port should be empty when running this script.
checking /proc/cmdline checking /etc/svn.info /etc/svn.info - differ: char 69, line 2
ERROR: /etc/svn.info
Path: . URL: svn://10.10.67.238:36901/svn/Router/TR4400v2/TR4400v2_0719/Source Repository Root: svn://10.10.67.238:36901/svn/Router/TR4400v2 Repository UUID: a6b6dc33-2ea1-44c0-8bf5-3169134277e6 Revision: 1782 Node Kind: directory Schedule: normal Last Changed Author: lucien Last Changed Rev: 1782 Last Changed Date: 2019-08-05 10:19:11 +0800 (Mon, 05 Aug 2019)
VERSION: Build from: PD1-build01 /home/rdrelease/TR4400v2/TR4400v2_0719_191108/Source by rdrelease DATE: Mon Nov 11 10:44:03 CST 2019 BOARD_ID: TR4400-CH
checking /etc/openwrt_release /etc/openwrt_release - differ: char 74, line 3
ERROR: /etc/openwrt_release
DISTRIB_ID="OpenWrt" DISTRIB_RELEASE="Bleeding Edge" DISTRIB_REVISION="r1602" DISTRIB_CODENAME="barrier_breaker" DISTRIB_TARGET="ipq806x/generic" DISTRIB_DESCRIPTION="OpenWrt Barrier Breaker r1602" DISTRIB_TAINTS="no-all busybox override"
checking /proc/version /proc/version - differ: char 24, line 1
ERROR: /proc/version
Linux version 3.14.43 (rdrelease@PD1-build01) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.01 r1602) ) #1 SMP PREEMPT Fri Nov 8 20:42:04 CST 2019
checking /proc/mtd /proc/mtd - differ: char 130, line 4
ERROR: /proc/mtd
dev: size erasesize name mtd0: 00040000 00020000 "0:SBL1" mtd1: 00140000 00020000 "0:MIBIB" mtd2: 00140000 00020000 "0:SBL2_1" mtd3: 00280000 00020000 "0:SBL3_1" mtd4: 00120000 00020000 "0:DDRCONFIG_1" mtd5: 00120000 00020000 "0:SSD" mtd6: 00280000 00020000 "0:TZ_1" mtd7: 00280000 00020000 "0:RPM_1" mtd8: 00500000 00020000 "0:APPSBL_1" mtd9: 00080000 00020000 "0:APPSBLENV" mtd10: 00140000 00020000 "0:ART" mtd11: 04000000 00020000 "rootfs_1" mtd12: 00060000 00020000 "0:BOOTCONFIG" mtd13: 00140000 00020000 "0:SBL2" mtd14: 00280000 00020000 "0:SBL3" mtd15: 00120000 00020000 "0:DDRCONFIG" mtd16: 00120000 00020000 "0:SSD_1" mtd17: 00280000 00020000 "0:TZ" mtd18: 00280000 00020000 "0:RPM" mtd19: 00060000 00020000 "0:BOOTCONFIG1" mtd20: 00500000 00020000 "0:APPSBL" mtd21: 04000000 00020000 "rootfs" mtd22: 00100000 00020000 "fw_env" mtd23: 00800000 00020000 "config" mtd24: 00200000 00020000 "PKI" mtd25: 00100000 00020000 "scfgmgr" mtd26: 00008000 00008000 "spi32766.0" mtd27: 003e0000 0001f000 "kernel" mtd28: 01e08000 0001f000 "ubi_rootfs" mtd29: 0001f000 0001f000 "rootfs_data" mtd30: 00744000 0001f000 "ubi_config"
checking /proc/mounts /proc/mounts - differ: char 300, line 8
ERROR: /proc/mounts
rootfs / rootfs rw 0 0 mtd:ubi_rootfs /rom squashfs ro,relatime 0 0 proc /proc proc rw,noatime 0 0 sysfs /sys sysfs rw,noatime 0 0 tmpfs /tmp tmpfs rw,nosuid,nodev,noatime 0 0 tmpfs /tmp/root tmpfs rw,noatime,mode=755 0 0 overlayfs:/tmp/root / overlayfs rw,noatime,lowerdir=/,upperdir=/tmp/root 0 0 ubi1:ubi_config /config ubifs rw,relatime 0 0 tmpfs /dev tmpfs rw,relatime,size=512k,mode=755 0 0 devpts /dev/pts devpts rw,relatime,mode=600 0 0 debugfs /sys/kernel/debug debugfs rw,noatime 0 0 ramfs /home ramfs rw,relatime 0 0 ramfs /mnt ramfs rw,relatime 0 0 ramfs /etc ramfs rw,relatime 0 0
checking /proc/bus/pci/devices cmp: EOF on
ERROR: /proc/bus/pci/devices
/proc/bus/pci/devices
checking /etc/fw_env.config Warning: Bad CRC, using default environment checking fw_printenv fw_printenv - differ: char 2, line 1
ERROR: fw_printenv
bootcmd=bootp; setenv bootargs root=/dev/nfs nfsroot=${serverip}:${rootpath} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}::off; bootm bootdelay=5 baudrate=115200
checking dmesg-ubi-attached dmesg-ubi-attached - differ: char 18, line 1
ERROR: dmesg-ubi-attached
UBI: attached mtd21 (name "rootfs", size 64 MiB) to ubi0 UBI: attached mtd23 (name "config", size 8 MiB) to ubi1
checking dmesg-ubifs-mounted checking ubi0_0-kernel ubi0_0-kernel - differ: char 1, line 1
ERROR: ubi0_0-kernel
1e7876636109535510dd7cee16386d36 /dev/ubi0_0
checking ubi0_1-ubi_rootfs ubi0_1-ubi_rootfs - differ: char 1, line 1
ERROR: ubi0_1-ubi_rootfs
edcd4e0e5732f18e81da7b33892fe784 /dev/ubi0_1
checking ubi0_2-rootfs_data
WARNING: Do not proceed installing OpenWrt if any errors were output! Save the output and seek help in the forums instead.