Add support for TP-Link Archer A10

Hi everybody!

Looking to get help and help in getting this device supported.

Mandatory I'm 100% new and I have no idea what I'm doing disclaimer.
All the advances I made so far with this device has been thanks to the amazing posts of the community :slight_smile:

The TL;DR of current status: booting fine through a generated initramfs image, LAN ports and Wifi seem to be working (thankfully it has very similar hardware to other devices). Currently finding ways to flash to NAND but it will probably require a U-boot rewrite as the stock U-boot seems to do some firmware checks. Details below.

Hardware:

CPU: MediaTek MT7621AT
NAND Flash: 128 MiB (ESMT F59L1G81MA-25T)
RAM: 256 MiB (Nanya NT5CC128M16IP-DI)
1x USB 3.0 port
Wireless: 5G MediaTek MT7615N, 2.4G MediaTek MT7615N
ETH1 chip: MediaTek MT7621AT
Network ports: 1-WAN, 4-1GbE-LAN

There seem to be 2 variants of the A10 which are A10 and A10 Pro. The only difference seems to be the USB 3.0 port on the Pro version.
The device on my hands was bought in Japan and on the inside it has a tag that says "Archer A2600 Pro(JP)Ver:1.0". I've seen this model ambiguously refered to as the A2600 and A10 (Pro and non Pro versions).
The TP-Link GPL source code for this model also includes sections for/from the Archer C2300 v2 and partially the Archer C6U (couldn't identify the version).

This device is also incredibly similar to the TP-Link EC330-G5u perhaps only with RAM variations, I'm linking to a 4pda forum post where they already took quite a deep dive on the EC330-G5u and that's from where I learned most of the info on how to work on my device:
https://4pda.to/forum/index.php?showtopic=1030035

In fact the A10 is mentioned in this thread and they note the A10 is super similar but has more RAM and no SkyWorks amplifiers. Hopefully by uniting efforts we can get OpenWRT support on several similar devices.
I recently revisited this thread and saw there was some work with the GPL sources but they are not really complete.

With some tweaks I managed to have it partially work but pretty much it only outputs U-boot images, no kernel images.
I saw some targets to make an image but the GPL sources definitely don't have everything needed to create one. In particular some tools which will be mentioned below.

The board has easily accesible UART pins which leads to a console with root access.

Information regarding the flash layout is as follows:

root@Akronite:/proc/sys# cat /proc/mtd
dev:    size   erasesize  name offset
mtd0: 00100000 00020000 "uboot" 00000000
mtd1: 00100000 00020000 "ubootenv" 00100000
mtd2: 03000000 00020000 "os0" 00200000
mtd3: 03000000 00020000 "os1" 03200000
mtd4: 00800000 00020000 "tp_data" 06200000
mtd5: 00400000 00020000 "radio" 06a00000
mtd6: 01180000 00020000 "data" 06e00000
mtd7: 07f80000 00020000 "wholeflash" 00000000
mtd8: 00100000 00020000 "nvram" 00100000
mtd9: 03000000 00020000 "rootfs" 00200000
mtd10: 03000000 00020000 "backup" 03200000

console boot log shows the following:

 Creating 11 MTD partitions on "MT7621-NAND":
[    2.412000] 0x000000000000-0x000000100000 : "uboot"
[    2.416000] 0x000000100000-0x000000200000 : "ubootenv"
[    2.424000] 0x000000200000-0x000003200000 : "os0"
[    2.440000] 0x000003200000-0x000006200000 : "os1"
[    2.460000] 0x000006200000-0x000006a00000 : "tp_data"
[    2.468000] 0x000006a00000-0x000006e00000 : "radio"
[    2.476000] 0x000006e00000-0x000007f80000 : "data"
[    2.488000] 0x000000000000-0x000007f80000 : "wholeflash"
[    2.528000] 0x000000100000-0x000000200000 : "nvram"
[    2.532000] 0x000000200000-0x000003200000 : "rootfs"
[    2.552000] 0x000003200000-0x000006200000 : "backup"

I have a backup of the wholeflash just in case.

From what I can gather, the rootfs, kernel, and final bootloader, all are inside a jffs2 filesystem. However the kernel and final bootloader are uncompressed within the fs with what I assume is a custom tool.

on the /bootfs/ dir there are three files: vmlinuz, tag_kernel and the confusingly named cferam.000
I can see CFE ram is related to the bootloader of Broadcom devices so I guess these devices are mostly running patched code from the C2300 v1.
However, when comparing the cferam.000 file of this device, it looks nothing like the cferam.000 of a broadcom device. It seems rather to be the final bootloader ("image bootloader"):

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x51F87DAE, created: 2020-04-21 01:57:26, image size: 146544 bytes, Data Address: 0xA01FB040, Entry Point: 0xA0200000, data CRC: 0xF6571FE5, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: "NAND Flash I"
121124        0x1D924         CRC32 polynomial table, little endian
122148        0x1DD24         U-Boot version string, "U-Boot 1.1.3 (Apr 21 2020 - 09:57:19)"

The sources suggest there are 3 bootloaders: the first U-boot, the main U-boot and the image u-boot (which is apparently the one that lives in cferam.000)
The image U-boot is not in the Uboot partition but in the jffs2 filsystem, uncompressed.

In the source the makefile shows the following section:


        echo "build firmware..."
        #@$(CONFIG_DIR)/buildFs $(IMAGE_DIR) $(CONFIG_DIR) $(SDK_ROOT_DIR)
        cp -f $(SDK_BIN_DIR)/linux.7z $(IMAGE_DIR)/vmlinuz
        cp -f $(CONFIG_DIR)/imageuboot.bin $(IMAGE_DIR)/uboot.bin

        @# prepare bootfs
        [ -d $(IMAGE_DIR)/bootfs ] || mkdir -p $(IMAGE_DIR)/bootfs
        @cp $(IMAGE_DIR)/uboot.bin $(IMAGE_DIR)/bootfs/cferam.000
        @cp $(IMAGE_DIR)/vmlinuz $(IMAGE_DIR)/bootfs/
        @dd if=/dev/zero of=$(IMAGE_DIR)/bootfs/tag_kernel bs=512 count=1
        @cp -pf $(IMAGE_DIR)/bootfs/* $(IMAGE_ROOTFS_DIR)/
        @echo "/cferam.000" > $(IMAGE_DIR)/nocomprlist
        @echo "/vmlinuz" >> $(IMAGE_DIR)/nocomprlist
        @echo "/tag_kernel" >> $(IMAGE_DIR)/nocomprlist
        @mkdir -p $(IMAGE_ROOTFS_DIR)/data
        @mkdir -p $(IMAGE_ROOTFS_DIR)/tp_data
        @mkdir -p $(IMAGE_ROOTFS_DIR)/radio
        @ln -sf /tag_kernel $(IMAGE_ROOTFS_DIR)/etc/tag_kernel
        @$(HOSTTOOLS_DIR)/fakeroot $(HOSTTOOLS_DIR)/mkfs.jffs2 -l -p -n -e 131072 -r $(IMAGE_ROOTFS_DIR)/ -o $(IMAGE_DIR)/rootfs.jffs2 -N $(IMAGE_DIR)/nocomprlist
        @$(HOSTTOOLS_DIR)/fakeroot $(HOSTTOOLS_DIR)/mktag_jffs2 -E 1 -s 48 -f $(IMAGE_DIR)/rootfs.jffs2 -o $(IMAGE_DIR)/rootfs.img
        @rm -rf $(IMAGE_DIR)/nocomprlist

I was unable to find a mkfs.jffs2 version that accepts the -N option to keep some files uncompressed and I didn't find the mktag_jffs2 binary anywhere.

The U-boot partition is looking like this. I am guessing it contains the first U-boot and 3 copies of the main U-boot, each with its own copy of the recovery webpage:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x84C4E28, created: 2020-04-21 01:57:07, image size: 109480 bytes, Data Address: 0xA0200000, Entry Point: 0xA0200000, data CRC: 0x98F1E723, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: "NAND Flash I"
86872         0x15358         U-Boot version string, "U-Boot 1.1.3 (Apr 21 2020 - 09:57:01)"
131072        0x20000         uImage header, header size: 64 bytes, header CRC: 0x12E54695, created: 2020-04-21 01:57:17, image size: 205892 bytes, Data Address: 0xA01FC040, Entry Point: 0xA0200000, data CRC: 0x2F0122FD, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: "NAND Flash I"
287068        0x4615C         CRC32 polynomial table, little endian
288092        0x4655C         U-Boot version string, "U-Boot 1.1.3 (Apr 21 2020 - 09:57:10)"
312819        0x4C5F3         HTML document header
332423        0x51287         HTML document footer
393216        0x60000         uImage header, header size: 64 bytes, header CRC: 0x12E54695, created: 2020-04-21 01:57:17, image size: 205892 bytes, Data Address: 0xA01FC040, Entry Point: 0xA0200000, data CRC: 0x2F0122FD, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: "NAND Flash I"
549212        0x8615C         CRC32 polynomial table, little endian
550236        0x8655C         U-Boot version string, "U-Boot 1.1.3 (Apr 21 2020 - 09:57:10)"
574963        0x8C5F3         HTML document header
594567        0x91287         HTML document footer
655360        0xA0000         uImage header, header size: 64 bytes, header CRC: 0x12E54695, created: 2020-04-21 01:57:17, image size: 205892 bytes, Data Address: 0xA01FC040, Entry Point: 0xA0200000, data CRC: 0x2F0122FD, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: "NAND Flash I"
811356        0xC615C         CRC32 polynomial table, little endian
812380        0xC655C         U-Boot version string, "U-Boot 1.1.3 (Apr 21 2020 - 09:57:10)"
837107        0xCC5F3         HTML document header
856711        0xD1287         HTML document footer

If I remember correctly (this was a while ago) I was able to modify the image U-boot in the "cferam.000" and modify the tag_kernel but the U-boot still checks the filesystem integrity as I got the following error:

CRC of rootfs is wrong(original 0xab426777 calculated 0x13938054)

I guess I'm going on the wrong path and it requires a U-boot partition rewrite but I was avoiding that route as to avoid bricking my device without knowing what I'm exactly doing although I'm very aware that's the risk.

The boot section of the console logs look like this (redacted a couple of parts):

U-Boot 1.1.3 (Apr 21 2020 - 09:57:10)

Board: Ralink APSoC DRAM:  256 MB
relocate_code Pointer at: 8ff84000

Config XHCI 40M PLL
Allocate 16 byte aligned buffer: 8ffca770
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [REDACTED]
Device found in MTK table, ID: c8d1, EXT_ID: 809540
Support this Device in MTK table! c8d1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
.
partable is:
uboot:0x100000@0x0
ubootenv:0x100000@0x100000
os0:0x3000000@0x200000
os1:0x3000000@0x3200000
tp_data:0x800000@0x6200000
radio:0x400000@0x6a00000
data:0x1180000@0x6e00000
.============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Apr 21 2020  Time:09:57:10
============================================
THIS IS Main Uboot: Including recovery webserver.
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =256 Mbytes
this uboot is loaded from 0xbc020000

Press '4' or 't' to break the booting process

Press 'x' to enter recovery web server                                                              0

3: System Boot system code via Flash.
boot rootfs from os0 image 0.
........found kernel tag, fslen = 33030144, bincrc = ab426777
........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................copy kernel len 3663359 fs_len 33030144
## Booting image at 89100000 ...
   Image Name:   NAND Flash I
   Image Type:   MIPS Linux Standalone Program (uncompressed)
   Data Size:    146544 Bytes = 143.1 kB
   Load Address: a01fb040
   Entry Point:  a0200000
   Verifying Checksum ... OK
data copied to 0xa01fb040
OK
jump to memory 0xa0200000


U-Boot 1.1.3 (Apr 21 2020 - 09:57:19)

Board: Ralink APSoC DRAM:  256 MB
relocate_code Pointer at: 8ff94000

Config XHCI 40M PLL
Allocate 16 byte aligned buffer: 8ffcaf70
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [REDACTED]
Device found in MTK table, ID: c8d1, EXT_ID: 809540
Support this Device in MTK table! c8d1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
.
partable is:
uboot:0x100000@0x0
ubootenv:0x100000@0x100000
os0:0x3000000@0x200000
os1:0x3000000@0x3200000
tp_data:0x800000@0x6200000
radio:0x400000@0x6a00000
data:0x1180000@0x6e00000
.============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Apr 21 2020  Time:09:57:19
============================================
THIS IS Image Uboot: Uboot included in upgrade image.
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =256 Mbytes
this uboot is loaded from 0x89100000

Press '2' or 't' to break the booting process


3: System Boot system code via Flash.
[get]mem environment not init yet.
[get]mem environment not init yet.
checking mem environment needn't save
try kernel boot addr 89200000 length 0x03000000
## Booting image at 89200000 ...
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    3663295 Bytes =  3.5 MB
   Load Address: 81001000
   Entry Point:  816a4980
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 816a4980) ...
## Giving linux memsize in MB, 256

Starting kernel ...

To get to build the initramfs to test, I used the following parameters (I referred to it as the A2600 Pro but it would likely be better to write A10 instead)

mt7621.mk file:

define Device/tplink_a2600pro-v1
  $(Device/dsa-migration)
  $(Device/tplink-safeloader)
  DEVICE_MODEL := A2600PRO
  DEVICE_VARIANT := v1
  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware \
	kmod-usb3 kmod-usb-ledtrig-usbport
  TPLINK_BOARD_ID := A2600PRO-V1
  KERNEL_INITRAMFS := $(KERNEL_DTB) | uImage lzma
  IMAGE_SIZE := 15744k

endef
TARGET_DEVICES += tplink_a2600pro-v1

mt7621_tplink_archer-a2600pro-v1.dts file:

#include "mt7621_tplink_archer-a2600pro-v1.dtsi"

/ {
	model = "TP-Link Archer A2600 Pro v1";
	compatible = "tplink,a2600pro-v1", "mediatek,mt7621-soc";
};

mt7621_tplink_archer-a2600pro-v1.dtsi file: (I tested the leds and buttons and most if not all are correct, they are also listed on the source. I have not yet been able to retrieve the MAC address from flash, details below.)

https://paste.c-net.org/MarryingStylist

01_leds file:

tplink,a2600pro-v1)
	ucidef_set_led_netdev "wifi2g" "Wifi 2.4G" "white:wifi2G" "wlan0"
	ucidef_set_led_netdev "wifi5g" "Wifi 5G" "white:wifi5G" "wlan1"
	ucidef_set_led_netdev "eth_link" "LAN link" "white:lan" "lan" "link"
	ucidef_set_led_netdev "wan" "WAN" "white:wan" "wan"
	ucidef_set_led_netdev "wan" "WAN" "orange:wan" "wan"
	;;

The tp_data partition contains the 2 eeprom files for the radios and a file named default-mac which has the MAC address of the system surprisingly instead of on the radio partition. MAC addresses are then used as follows:
eth0, the 2.4GHz radio and the switch ports get their MAC address straight form default-mac
The 5 GHz radio MAC address is the default-mac address minus one.

That's all I've got for now. Thank you very much in advance everyone!

5 Likes

Kinda like the specs of this router, sure has enough flash ram. the mediatek platform seems like a plus since the drivers are well open sourced. My appreciated for TP-Link has risen a lot lately , Have a few C6U's I'm experimenting with. I was actually looking for a TP-Link device that also uses Mediatek but has more flash on board and this one kinda got my attention. Hope you get this one to work, the specs surely look like once you get this one to boot the proper image, things will work.

1 Like

Thanks for the encouraging words :slight_smile:

Alright so I spent some time trying to figure out Uboot and learned enough to be able to experiment and not brick my router..... yet. I am just playing with the secondary bootloaders, not the very first one.

At least the GPL sources for the A10 do get to compile all 3 uboot images as used in the stock router. The configuration files for compilation (menuconfig) allow 4 options to select what to boot next: another Uboot, Image, Kernel or All.

Selecting Image will get it back to booting the stock way, it will get to their very custom code and find and verify the jffs2 filesystem with the weird cferam.000 file as stock.

Selecting Kernel and writing the address in flash where I wrote the sysupgrade image I compiled (partition os0) as the option for the load address seems to do the trick and at least I got the kernel to start booting and then panic due to not finding the rootfs. Probably it's not even recognizing the mtd partitions but I'm slowly moving forward and trying to figure it out.

U-Boot 1.1.3 (Apr 21 2020 - 09:57:01)

Board: Ralink APSoC DRAM:  256 MB
relocate_code Pointer at: 8ff9c000

Config XHCI 40M PLL
******************************
Software System Reset Occurred
******************************
Allocate 16 byte aligned buffer: 8ffcaeb0
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [REDACTED]
Device found in MTK table, ID: c8d1, EXT_ID: 809540
Support this Device in MTK table! c8d1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8

partable is:
part0:0x20000@0x0
part1:0x7f60000@0x20000
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Apr 21 2020  Time:09:57:01
============================================
THIS IS First Uboot: The first uboot located in NAND Flash to load next full-fea                            ture Uboot.
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =256 Mbytes
this uboot is loaded from 0xbc020000

Press '1' or 't' to break the booting process                                 0

3: System Boot system code via Flash.
## Booting image at bc020000 ...
   Image Name:   NAND Flash I
   Image Type:   MIPS Linux Standalone Program (uncompressed)
   Data Size:    142200 Bytes = 138.9 kB
   Load Address: a01fb040
   Entry Point:  a0200000
...   Verifying Checksum ... OK
data copied to 0xa01fb040
OK
jump to memory 0xa0200000


U-Boot 1.1.3 (Mar  3 2022 - 22:21:50)

Board: Ralink APSoC DRAM:  256 MB
relocate_code Pointer at: 8ff94000

Config XHCI 40M PLL
Allocate 16 byte aligned buffer: 8ffc9e70
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [REDACTED]
Device found in MTK table, ID: c8d1, EXT_ID: 809540
Support this Device in MTK table! c8d1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8

partable is:
uboot:0x100000@0x0
ubootenv:0x100000@0x100000
os0:0x3000000@0x200000
os1:0x3000000@0x3200000
tp_data:0x400000@0x6200000
radio:0x400000@0x6600000
data:0x1580000@0x6a00000
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Mar  3 2022  Time:22:21:50
============================================
THIS IS the modified Uboot for OpenWRT.
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =256 Mbytes
this uboot is loaded from 0xbc020000

Press '2' or 't' to break the booting process                                 0

3: System Boot system code via Flash.
## Booting image at bc200000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.88
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2680346 Bytes =  2.6 MB
   Load Address: 80001000
   Entry Point:  80001000
.........................................   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80001000) ...
## Giving linux memsize in MB, 256

Starting kernel ...

[    0.000000] Linux version 5.10.88 (builder@buildhost) (mipsel-openwrt-linux-m                            usl-gcc (OpenWrt GCC 11.2.0 r18437-92820cc5b9) 11.2.0, GNU ld (GNU Binutils) 2.3                            7) #0 SMP Mon Dec 27 20:20:10 2021
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is TP-Link Archer A2600 Pro v1
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                            es
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] percpu: Embedded 15 pages/cpu s30160 r8192 d23088 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64960
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,j                            ffs2
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, l                            inear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, lin                            ear)
[    0.000000] Writing ErrCtl register=00008350
[    0.000000] Readback ErrCtl register=00008350
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 249424K/262144K available (6949K kernel code, 624K rwdata                            , 820K rodata, 1256K init, 243K bss, 12720K reserved, 0K cma-reserved, 0K highme                            m)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jif                            fies.
[    0.000000] NR_IRQS: 256
[    0.000000] random: get_random_bytes called from 0x80836a80 with crng_init=0
[    0.000000] CPU Clock: 880MHz
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478ab                            b4, max_idle_ns: 440795247997 ns
[    0.000012] sched_clock: 64 bits at 880MHz, resolution 1ns, wraps every 43980                            46511103ns
[    0.007940] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_i                            dle_ns: 4343773742 ns
[    0.016920] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[    0.083070] pid_max: default: 32768 minimum: 301
[    0.087830] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linea                            r)
[    0.095033] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes,                             linear)
[    0.105292] rcu: Hierarchical SRCU implementation.
[    0.110268] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE                             build
[    0.118265] smp: Bringing up secondary CPUs ...
[    0.123386] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.123397] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                            es
[    0.123408] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.123481] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.178122] Synchronize counters for CPU 1: done.
[    0.209990] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.210000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                            es
[    0.210009] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.210056] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.269160] Synchronize counters for CPU 2: done.
[    0.299621] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.299630] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                            es
[    0.299639] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.299692] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.354339] Synchronize counters for CPU 3: done.
[    0.384201] smp: Brought up 1 node, 4 CPUs
[    0.392438] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, ma                            x_idle_ns: 19112604462750000 ns
[    0.402256] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[    0.409264] pinctrl core: initialized pinctrl subsystem
[    0.416493] NET: Registered protocol family 16
[    0.422159] thermal_sys: Registered thermal governor 'step_wise'
[    0.423082] cpuidle: using governor teo
[    0.450728] random: fast init done
[    0.471889] clocksource: Switched to clocksource GIC
[    0.478619] NET: Registered protocol family 2
[    0.483325] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear                            )
[    0.491628] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144                             bytes, linear)
[    0.500023] TCP established hash table entries: 2048 (order: 1, 8192 bytes, l                            inear)
[    0.507677] TCP bind hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.514780] TCP: Hash tables configured (established 2048 bind 2048)
[    0.521207] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.527704] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.534883] NET: Registered protocol family 1
[    0.539175] PCI: CLS 0 bytes, default 32
[    0.545662] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[    0.556244] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.562029] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORIT                            Y) (c) 2001-2006 Red Hat, Inc.
[    0.572532] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 2                            51)
[    0.581507] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.587434] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.593296] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.599770] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.610154] printk: console [ttyS0] disabled
[    0.614481] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 19, base_baud                             = 3125000) is a 16550A
[    0.623476] printk: console [ttyS0] enabled
[    0.623476] printk: console [ttyS0] enabled
[    0.631741] printk: bootconsole [early0] disabled
[    0.631741] printk: bootconsole [early0] disabled
[    0.644218] spi-mt7621 1e000b00.spi: sys_freq: 220000000
[    0.651061] spi-nor spi0.0: unrecognized JEDEC id bytes: ff ff ff ff ff ff
[    0.658036] spi-nor: probe of spi0.0 failed with error -2
[    0.665283] libphy: Fixed MDIO Bus: probed
[    0.703066] libphy: mdio: probed
[    0.706998] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    0.715360] mtk_soc_eth 1e100000.ethernet: generated random MAC address e6:aa                            :e5:92:ac:f6
[    0.724388] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe                            100000, irq 21
[    0.735834] mt7621-pci 1e140000.pcie: host bridge /pcie@1e140000 ranges:
[    0.742577] mt7621-pci 1e140000.pcie:   No bus range found for /pcie@1e140000                            , using [bus 00-ff]
[    0.751354] mt7621-pci 1e140000.pcie:      MEM 0x0060000000..0x006fffffff ->                             0x0000000000
[    0.759523] mt7621-pci 1e140000.pcie:       IO 0x001e160000..0x001e16ffff ->                             0x0000000000
[    0.767789] mt7621-pci 1e140000.pcie: Parsing DT failed
[    0.775365] NET: Registered protocol family 10
[    0.781368] Segment Routing with IPv6
[    0.785193] NET: Registered protocol family 17
[    0.789708] bridge: filtering via arp/ip/ip6tables is no longer available by                             default. Update your scripts to load br_netfilter if you need this.
[    0.802952] 8021q: 802.1Q VLAN Support v1.8
[    0.810276] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    0.831268] libphy: dsa slave smi: probed
[    0.835861] mt7530 mdio-bus:1f wan (uninitialized): PHY [dsa-0.0:00] driver [                            Generic PHY] (irq=POLL)
[    0.846636] mt7530 mdio-bus:1f lan1 (uninitialized): PHY [dsa-0.0:01] driver                             [Generic PHY] (irq=POLL)
[    0.857565] mt7530 mdio-bus:1f lan2 (uninitialized): PHY [dsa-0.0:02] driver                             [Generic PHY] (irq=POLL)
[    0.868446] mt7530 mdio-bus:1f lan3 (uninitialized): PHY [dsa-0.0:03] driver                             [Generic PHY] (irq=POLL)
[    0.879306] mt7530 mdio-bus:1f lan4 (uninitialized): PHY [dsa-0.0:04] driver                             [Generic PHY] (irq=POLL)
[    0.891077] mt7530 mdio-bus:1f: configuring for fixed/rgmii link mode
[    0.901703] DSA: tree 0 setup
[    0.904998] rt2880-pinmux pinctrl: pcie is already enabled
[    0.910547] mt7621-pci 1e140000.pcie: host bridge /pcie@1e140000 ranges:
[    0.917266] mt7621-pci 1e140000.pcie:   No bus range found for /pcie@1e140000                            , using [bus 00-ff]
[    0.926087] mt7621-pci 1e140000.pcie:      MEM 0x0060000000..0x006fffffff ->                             0x0000000000
[    0.934263] mt7621-pci 1e140000.pcie:       IO 0x001e160000..0x001e16ffff ->                             0x0000000000
[    0.942526] mt7621-pci-phy 1e149000.pcie-phy: PHY for 0xbe149000 (dual port =                             1)
[    0.950237] mt7621-pci-phy 1e14a000.pcie-phy: PHY for 0xbe14a000 (dual port =                             0)
[    0.957866] mt7621-pci 1e140000.pcie: failed to parse bus ranges property: -2                            2
[    1.065289] mt7621-pci-phy 1e149000.pcie-phy: Xtal is 40MHz
[    1.070855] mt7621-pci-phy 1e14a000.pcie-phy: Xtal is 40MHz
[    1.176591] mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK)
[    1.183545] mt7621-pci 1e140000.pcie: PCIE0 enabled
[    1.188400] mt7621-pci 1e140000.pcie: PCIE1 enabled
[    1.193280] mt7621-pci 1e140000.pcie: PCI coherence region base: 0x60000000,                             mask/settings: 0xf0000002
[    1.202732] mt7621-pci 1e140000.pcie: PCI host bridge to bus 0000:00
[    1.209078] pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
[    1.215962] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    1.222845] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.228312] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff] (b                            us address [0x00000000-0x0fffffff])
[    1.238509] pci 0000:00:00.0: [0e8d:0801] type 01 class 0x060400
[    1.244531] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    1.250774] pci 0000:00:00.0: reg 0x14: [mem 0x60400000-0x6040ffff]
[    1.257115] pci 0000:00:00.0: supports D1
[    1.261109] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    1.267491] pci 0000:00:01.0: [0e8d:0801] type 01 class 0x060400
[    1.273542] pci 0000:00:01.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    1.279785] pci 0000:00:01.0: reg 0x14: [mem 0x60410000-0x6041ffff]
[    1.286116] pci 0000:00:01.0: supports D1
[    1.290109] pci 0000:00:01.0: PME# supported from D0 D1 D3hot
[    1.297631] pci 0000:01:00.0: [14c3:7615] type 00 class 0x000280
[    1.303709] pci 0000:01:00.0: reg 0x10: initial BAR value 0x00000000 invalid
[    1.310732] pci 0000:01:00.0: reg 0x10: [mem size 0x00100000 64bit]
[    1.317165] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by                             2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe                             x1 link)
[    1.333589] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    1.338811] pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
[    1.344927] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    1.351711] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref                            ]
[    1.358908] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    1.365758] pci 0000:02:00.0: [14c3:7615] type 00 class 0x000280
[    1.371814] pci 0000:02:00.0: reg 0x10: initial BAR value 0x00000000 invalid
[    1.378836] pci 0000:02:00.0: reg 0x10: [mem size 0x00100000 64bit]
[    1.385266] pci 0000:02:00.0: 2.000 Gb/s available PCIe bandwidth, limited by                             2.5 GT/s PCIe x1 link at 0000:00:01.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe                             x1 link)
[    1.401775] pci 0000:00:01.0: PCI bridge to [bus 02-ff]
[    1.407001] pci 0000:00:01.0:   bridge window [io  0x0000-0x0fff]
[    1.413090] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
[    1.419850] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff pref                            ]
[    1.427068] pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 02
[    1.433726] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    1.440312] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    1.447268] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000]
[    1.453876] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000]
[    1.460811] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    1.467603] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref                            ]
[    1.474828] pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff]
[    1.481589] pci 0000:00:01.0: BAR 9: assigned [mem 0x60300000-0x603fffff pref                            ]
[    1.488803] pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff]
[    1.495594] pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff]
[    1.502382] pci 0000:00:00.0: BAR 7: assigned [io  0x1e160000-0x1e160fff]
[    1.509142] pci 0000:00:01.0: BAR 7: assigned [io  0x1e161000-0x1e161fff]
[    1.515932] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bi                            t]
[    1.523251] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.528196] pci 0000:00:00.0:   bridge window [io  0x1e160000-0x1e160fff]
[    1.534978] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    1.541761] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref                            ]
[    1.548960] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff 64bi                            t]
[    1.556268] pci 0000:00:01.0: PCI bridge to [bus 02]
[    1.561212] pci 0000:00:01.0:   bridge window [io  0x1e161000-0x1e161fff]
[    1.567993] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
[    1.574775] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff pref                            ]
[    1.584285] /dev/root: Can't open blockdev
[    1.588382] VFS: Cannot open root device "(null)" or unknown-block(0,0): erro                            r -6
[    1.595893] Please append a correct "root=" boot option; here are the availab                            le partitions:
[    1.604254] Kernel panic - not syncing: VFS: Unable to mount root fs on unkno                            wn-block(0,0)
[    1.612513] Rebooting in 1 seconds..

1 Like

What are you passing to the kernel as the rootfs location? The bootlog is missing that info.

1 Like

Oops! The terminal output somehow broke in parts when copying, weird.

OEM bootargs are:

flashname=MT7621-NAND mtdparts=MT7621-NAND:0x00100000@0x00000000(uboot)ro,0x00100000@0x00100000(ubootenv),0x03000000@0x00200000(os0),0x03000000@0x03200000(os1),0x00400000@0x06200000(tp_data),0x00400000@0x06600000(radio),0x01580000@0x06A00000(data),128M@0(wholeflash),0x00100000@0x00100000(nvram),0x03000000@0x00200000(rootfs)ro,0x03000000@0x03200000(backup) console=ttyS1,115200 root=/dev/mtdblock9 rootfstype=jffs2 init=/etc/preinit printk.time=1 nand0=MT7621-NAND

What I was passing (removed the init and time part for no good reason and added squashfs to rootfstype):

flashname=MT7621-NAND mtdparts=MT7621-NAND:0x00100000@0x00000000(uboot)ro,0x00100000@0x00100000(ubootenv),0x03000000@0x00200000(os0),0x03000000@0x03200000(os1),0x00400000@0x06200000(tp_data),0x00400000@0x06600000(radio),0x01580000@0x06A00000(data),128M@0(wholeflash),0x00100000@0x00100000(nvram),0x03000000@0x00200000(rootfs)ro,0x03000000@0x03200000(backup) console=ttyS1,115200 root=/dev/mtdblock9 rootfstype=jffs2,squashfs nand0=MT7621-NAND

For reference this is the stock partition table.

dev:    size   erasesize  name offset
mtd0: 00100000 00020000 "uboot" 00000000
mtd1: 00100000 00020000 "ubootenv" 00100000
mtd2: 03000000 00020000 "os0" 00200000
mtd3: 03000000 00020000 "os1" 03200000
mtd4: 00800000 00020000 "tp_data" 06200000
mtd5: 00400000 00020000 "radio" 06a00000
mtd6: 01180000 00020000 "data" 06e00000
mtd7: 07f80000 00020000 "wholeflash" 00000000
mtd8: 00100000 00020000 "nvram" 00100000
mtd9: 03000000 00020000 "rootfs" 00200000
mtd10: 03000000 00020000 "backup" 03200000

On flash I just copied the squashfs-sysupgrade image to mtd2/os0 (which is the same as mtd9/rootfs from what I understand) so pretty much they look like this:

binwalk openwrt-snapshot-r18437-92820cc5b9-ramips-mt7621-tplink_a2600pro-v1-squashfs-sysupgrade.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x540C760B, created: 2021-12-27 20:20:10, image size: 2680346 bytes, Data Address: 0x80001000, Entry Point: 0x80001000, data CRC: 0xA6B6C944, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt Linux-5.10.88"
64            0x40            LZMA compressed data, properties: 0x6D, dictionary size: 2097152 bytes, uncompressed size: 8835452 bytes
2680410       0x28E65A        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3823978 bytes, 1288 inodes, blocksize: 262144 bytes, created: 2021-12-27 20:20:10

I am guessing I should have the filesystem on a separate partition instead. (Edit: Likely I guessed wrong and I just created the dts/dtsi files the wrong way, currently experimenting with that)

Thanks for the help!

1 Like

That’s a pretty unique mtd description. I suggest setting the command line in uboot to have the rootfs at mtd2 and see if it boots.

1 Like

Indeed, I spent so much time figuring the mtd layout because it differed from most TP-Link usual layouts even with almost the exact same hardware like the RE650.

Taking all your suggestions I did another dive and try to understand flash types. I changed some values in the .dtsi file and then the kernel booted up!

Part of the .dtsi looked like this:

&spi0 {
	status = "okay";

	flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <40000000>;

But it was wrong, it's not spi for the A10. So I checked the files for other routers that use NAND storage (not quite sure yet the difference between NAND and SPI mind you) then I made some changes. Now that section before the partition definitions looks like this instead:

&nand {
        status = "okay";

This got the kernel booting successfully and I was quite excited, it seemed to initialize the rootfs on the first boot BUT it was failing after first restart and it would use a tmpfs instead, no changes were saved. Sad but there was progress.

I noticed these lines on the bootlog which caught my attention:

[    3.720418] UBI: auto-attach mtd6
[    3.723756] ubi0: attaching mtd6

Then I learned about UBI and that a script attaches automatically partitions called data or ubi and finds the UBI# magic value, which it did because the stock firmware also uses a ubi partition.

Since I got the information on how to build the DTS file for NAND storage from a Xiaomi router I further saw the other configuration files for that router and noticed it uses separate kernel and rootfs images so I modified the section on the m7621.mk file for the A10 like this:

define Device/tplink_a2600pro-v1
  $(Device/dsa-migration)
  $(Device/uimage-lzma-loader)
  DEVICE_MODEL := A2600PRO
  DEVICE_VARIANT := v1
  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware \
        kmod-usb3 kmod-usb-ledtrig-usbport uboot-envtools
  TPLINK_BOARD_ID := A2600PRO-V1
  IMAGE_SIZE := 30000k
  BLOCKSIZE := 128k
  PAGESIZE := 2048
  KERNEL_SIZE := 4096k
  UBINIZE_OPTS := -E 5
  IMAGES += kernel1.bin rootfs0.bin
  IMAGE/kernel1.bin := append-kernel
  IMAGE/rootfs0.bin := append-ubi | check-size
endef
TARGET_DEVICES += tplink_a2600pro-v1

So I flashed the kernel on mtd2 as usual and the rootfs image on mtd6 (and modified the DTS file accordingly), also tried to put it on mtd3 for extra space but the kernel could never find it and would panic.

I spent an embarrassing amount of time troubleshooting why it was not finding the ubi partition (I was flashing everything from the first bootloader) when i decided to read directly the NAND on the main bootloader to check what it was seeing and noticed the main bootloader has a slightly different map of the memory than the first bootloader AND the GPL sources also have a tiny bit different memory map that was different than the stock one of my router.

Fixed all that, modified the partitions section of the .dtsi file like this:

&nand {
        status = "okay";

                partitions {
                        compatible = "fixed-partitions";
                        #address-cells = <1>;
                        #size-cells = <1>;

                        partition@0 {
                                label = "u-boot";
                                reg = <0x0 0x100000>;
                                read-only;
                        };

                        partition@100000 {
                                label = "u-boot-env";
                                reg = <0x100000 0x100000>;
                                read-only;
                        };

                        partition@200000 {
                                label = "os0";
                                reg = <0x200000 0x3000000>;
                        };

                        partition@3200000 {
                                label = "ubi";
                                reg = <0x3200000 0x3000000>;
                        };

                        tp_data: partition@6200000 {
                                label = "tp_data";
                                reg = <0x6200000 0x800000>;
                                read-only;
                        };

                        radio: partition@6a00000 {
                                label = "radio";
                                reg = <0x6a00000 0x400000>;
                                read-only;
                        };

                        partition@6e00000 {
                                label = "stock_data";
                                reg = <0x6e00000 0x1180000>;
                                read-only;
                        };
                };
};

And I finally got a complete boot! Changes survive reboots!

I wanted to paste the first good boot log but I hit the character limit so, just a couple of commands:

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r18437-92820cc5b9
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 3.8M      3.8M         0 100% /rom
tmpfs                   122.4M     72.0K    122.3M   0% /tmp
/dev/ubi0_1              35.1M     44.0K     33.2M   0% /overlay
overlayfs:/overlay       35.1M     44.0K     33.2M   0% /
tmpfs                   512.0K         0    512.0K   0% /dev
root@OpenWrt:/# mount
/dev/root on /rom type squashfs (ro,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,noatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,noatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
/dev/ubi0_1 on /overlay type ubifs (rw,noatime,assert=read-only,ubi=0,vol=1)
overlayfs:/overlay on / type overlay (rw,noatime,lowerdir=/,upperdir=/overlay/upper,workdir=/overlay/work)
tmpfs on /dev type tmpfs (rw,nosuid,relatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,mode=600,ptmxmode=000)
debugfs on /sys/kernel/debug type debugfs (rw,noatime)
none on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,noatime,mode=700)

Yay!! So....... Lot's of testing to do and issues to find (For starters I don't know why the leds were working in the initramfs version but not on the one on flash :stuck_out_tongue: ). Also some cleanup and I'll see what's the best way to provide the image files that worked with instructions to flash it on this particular model, maybe we can get it to work on similar models.

Btw, also pretty sure we can play with the partitions to have more room for storage.

2 Likes

All this is very encouraging. Have you made enough progress to release it yet?

1 Like

I'm also very interested in this! Just checking in.