Yes, and root's read and writ
1 Like
Unfortunately I cannot read the article on https://www.right.com.cn/forum/thread-4037482-1-1.html as the content is hidden to non-members. Would someone post the full manual please.
Also https://hackmd.io/@tAQ3QkjhQp6sdU_ak2LXgQ/HJ678KU68 needs a translation and I don't know where to get the file APPSBL_signed from. It is hard if you understand only 10th senence only...
Had a go at tftp booting the initramfs for the generic IPQ8074 (local build), see logs below
TFTP from server 192.168.31.100; our IP address is 192.168.31.1
Filename 'openwrt-ipq807x-ipq8074-hk01-fit-uImage-initramfs.itb'.
Load address: 0x44000000
Loading: *
Got TFTP_OACK: TFTP remote port: changes from 69 to 46944
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#############
4.9 MiB/s
done
Bytes transferred = 11629372 (b1733c hex)
ipq807x_eth_halt: done
IPQ807x# bootm
## Loading kernel from FIT Image at 44000000 ...
Using 'config@hk01' configuration
Trying 'kernel@1' kernel subimage
Description: ARM64 OpenWrt Linux-5.4.48
Type: Kernel Image
Compression: uncompressed
Data Start: 0x440000e8
Data Size: 11618816 Bytes = 11.1 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x41080000
Entry Point: 0x41080000
Hash algo: crc32
Hash value: c3a1505d
Hash algo: sha1
Hash value: 01016216000a2a36e14d6ce4c667767c814e6841
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
Using 'config@hk01' configuration
Trying 'fdt@1' fdt subimage
Description: ARM64 OpenWrt ipq8074-hk01 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x44b14c24
Data Size: 8674 Bytes = 8.5 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: bbe758ec
Hash algo: sha1
Hash value: 76248dd1af77af676502689ef5a9dff329aec8e4
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x44b14c24
Loading Kernel Image ... OK
Loading Device Tree to 4a3fa000, end 4a3ff1e1 ... OK
Using machid 0x8010010 from environment
Starting kernel ...
Jumping to AARCH64 kernel via monitor
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[ 0.000000] Linux version 5.4.48 (shane@wasp) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r13686-78b632134f)) #0 SMP PREEMPT Sat Jul 4 19:00:11 2020
[ 0.000000] Machine model: Qualcomm Technologies, Inc. IPQ8074-HK01
[ 0.000000] efi: Getting EFI parameters from FDT:
[ 0.000000] efi: UEFI not found.
[ 0.000000] psci: probing for conduit method from DT.
[ 0.000000] psci: PSCIv1.0 detected in firmware.
[ 0.000000] psci: Using standard PSCI v0.2 function IDs
[ 0.000000] psci: MIGRATE_INFO_TYPE not supported.
[ 0.000000] psci: SMC Calling Convention v1.0
[ 0.000000] psci: OSI mode supported.
[ 0.000000] percpu: Embedded 21 pages/cpu s48408 r8192 d29416 u86016
[ 0.000000] Detected VIPT I-cache on CPU0
[ 0.000000] CPU features: detected: ARM erratum 845719
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 129024
[ 0.000000] Kernel command line:
[ 0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 494072K/524288K available (6780K kernel code, 402K rwdata, 2144K rodata, 1920K init, 272K bss, 30216K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] rcu: Preemptible hierarchical RCU implementation.
[ 0.000000] Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[ 0.000000] random: get_random_bytes called from start_kernel+0x2ec/0x44c with crng_init=0
[ 0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[ 0.000005] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[ 0.000103] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=76800)
[ 0.000116] pid_max: default: 32768 minimum: 301
[ 0.000238] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.000250] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.023974] ASID allocator initialised with 32768 entries
[ 0.031972] rcu: Hierarchical SRCU implementation.
[ 0.040088] EFI services will not be available.
[ 0.048011] smp: Bringing up secondary CPUs ...
[ 0.080309] Detected VIPT I-cache on CPU1
[ 0.080360] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[ 0.112339] Detected VIPT I-cache on CPU2
[ 0.112374] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[ 0.144406] Detected VIPT I-cache on CPU3
[ 0.144439] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[ 0.144512] smp: Brought up 1 node, 4 CPUs
[ 0.144534] SMP: Total of 4 processors activated.
[ 0.144543] CPU features: detected: 32-bit EL0 Support
[ 0.144551] CPU features: detected: CRC32 instructions
[ 0.144594] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[ 0.144603] CPU: All CPU(s) started at EL1
[ 0.144625] alternatives: patching kernel code
[ 0.148570] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[ 0.148592] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[ 0.148776] pinctrl core: initialized pinctrl subsystem
[ 0.149224] DMI not present or invalid.
[ 0.149512] NET: Registered protocol family 16
[ 0.149811] DMA: preallocated 256 KiB pool for atomic allocations
[ 0.150205] cpuidle: using governor ladder
[ 0.150230] cpuidle: using governor menu
[ 0.150331] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[ 0.221121] pps_core: LinuxPPS API ver. 1 registered
[ 0.221133] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[ 0.221154] PTP clock support registered
[ 0.221367] Advanced Linux Sound Architecture Driver Initialized.
[ 0.221964] clocksource: Switched to clocksource arch_sys_counter
[ 0.222579] thermal_sys: Registered thermal governor 'step_wise'
[ 0.222583] thermal_sys: Registered thermal governor 'user_space'
[ 0.222751] NET: Registered protocol family 2
[ 0.223144] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.223167] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.223216] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[ 0.223299] TCP: Hash tables configured (established 4096 bind 4096)
[ 0.223377] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.223401] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.223554] NET: Registered protocol family 1
[ 0.223584] PCI: CLS 0 bytes, default 64
[ 1.607209] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[ 1.611768] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 1.611778] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 1.634049] msm_serial 78b3000.serial: msm_serial: detected port #0
[ 1.634079] msm_serial 78b3000.serial: uartclk = 3686400
[ 1.634115] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 8, base_baud = 230400) is a MSM
[ 1.634133] msm_serial: console setup on port #0
[ 2.123927] printk: console [ttyMSM0] enabled
[ 2.128788] msm_serial 78b1000.serial: msm_serial: detected port #1
[ 2.132791] msm_serial 78b1000.serial: uartclk = 19200000
[ 2.138876] 78b1000.serial: ttyMSM1 at MMIO 0x78b1000 (irq = 10, base_baud = 1200000) is a MSM
[ 2.144572] msm_serial: driver initialized
[ 2.159495] brd: module loaded
[ 2.160650] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[ 2.161951] spi-nor spi0.0: unrecognized JEDEC id bytes: ff ff ff ff ff ff
[ 2.168669] spi-nor: probe of spi0.0 failed with error -2
[ 2.175923] libphy: Fixed MDIO Bus: probed
[ 2.180811] i2c /dev entries driver
[ 2.185814] sdhci: Secure Digital Host Controller Interface driver
[ 2.188190] sdhci: Copyright(c) Pierre Ossman
[ 2.194435] sdhci-pltfm: SDHCI platform and OF driver helper
[ 2.200194] NET: Registered protocol family 10
[ 2.209361] Segment Routing with IPv6
[ 2.209435] NET: Registered protocol family 17
[ 2.212610] 8021q: 802.1Q VLAN Support v1.8
[ 2.234120] hctosys: unable to open rtc device (rtc0)
[ 2.234782] ------------[ cut here ]------------
[ 2.238145] gcc_usb1_master_clk status stuck at 'on'
[ 2.238196] WARNING: CPU: 1 PID: 1 at drivers/clk/qcom/clk-branch.c:92 clk_branch_toggle+0x130/0x140
[ 2.247788] Modules linked in:
[ 2.256896] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.4.48 #0
[ 2.259761] Hardware name: Qualcomm Technologies, Inc. IPQ8074-HK01 (DT)
[ 2.265581] pstate: 60400085 (nZCv daIf +PAN -UAO)
[ 2.272520] pc : clk_branch_toggle+0x130/0x140
[ 2.277120] lr : clk_branch_toggle+0x130/0x140
[ 2.281545] sp : ffffffc01002bca0
[ 2.285971] x29: ffffffc01002bca0 x28: 0000000000000000
[ 2.289360] x27: 0000000000000000 x26: ffffffc01095047c
[ 2.294743] x25: ffffffc010935ef8 x24: ffffffc0108c71d0
[ 2.300036] x23: 0000000000000000 x22: ffffffc01043f4b8
[ 2.305333] x21: ffffffc010b61df8 x20: 0000000000000000
[ 2.310628] x19: 0000000000000000 x18: 0000000000001800
[ 2.315924] x17: 0000000000001400 x16: 0000000000001c00
[ 2.321217] x15: 0000000000001000 x14: ffffffc010b9cb12
[ 2.326513] x13: 0000000000000000 x12: ffffffc010b9c000
[ 2.331808] x11: 0000000000000004 x10: 000000000000000d
[ 2.337104] x9 : ffffffc01002bca0 x8 : 6b63757473207375
[ 2.342399] x7 : 74617473206b6c63 x6 : ffffffc010b9c1c0
[ 2.347694] x5 : 0000000000000000 x4 : 0000000000000000
[ 2.352988] x3 : 00000000ffffffff x2 : ffffffc00f391000
[ 2.358284] x1 : ffffff801e860000 x0 : 0000000000000028
[ 2.363579] Call trace:
[ 2.368871] clk_branch_toggle+0x130/0x140
[ 2.371043] clk_branch2_disable+0x18/0x20
[ 2.375211] clk_disable_unused_subtree+0xd0/0x110
[ 2.379291] clk_disable_unused_subtree+0x2c/0x110
[ 2.384064] clk_disable_unused_subtree+0x2c/0x110
[ 2.388839] clk_disable_unused_subtree+0x2c/0x110
[ 2.393614] clk_disable_unused_subtree+0x2c/0x110
[ 2.398389] clk_disable_unused+0x3c/0x120
[ 2.403164] do_one_initcall+0x74/0x1b0
[ 2.407244] kernel_init_freeable+0x190/0x224
[ 2.410976] kernel_init+0x10/0xfc
[ 2.415487] ret_from_fork+0x10/0x18
[ 2.418785] ---[ end trace 526d1de8c72559d8 ]---
[ 2.422903] ------------[ cut here ]------------
[ 2.427120] gcc_usb0_master_clk status stuck at 'on'
[ 2.427155] WARNING: CPU: 1 PID: 1 at drivers/clk/qcom/clk-branch.c:92 clk_branch_toggle+0x130/0x140
[ 2.436675] Modules linked in:
[ 2.445783] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 5.4.48 #0
[ 2.448652] Hardware name: Qualcomm Technologies, Inc. IPQ8074-HK01 (DT)
[ 2.455858] pstate: 60400085 (nZCv daIf +PAN -UAO)
[ 2.462798] pc : clk_branch_toggle+0x130/0x140
[ 2.467398] lr : clk_branch_toggle+0x130/0x140
[ 2.471824] sp : ffffffc01002bca0
[ 2.476249] x29: ffffffc01002bca0 x28: 0000000000000000
[ 2.479638] x27: 0000000000000000 x26: ffffffc01095047c
[ 2.485021] x25: ffffffc010935ef8 x24: ffffffc0108c72e8
[ 2.490315] x23: 0000000000000000 x22: ffffffc01043f4b8
[ 2.495611] x21: ffffffc010b62178 x20: 0000000000000000
[ 2.500906] x19: 0000000000000000 x18: 0000000000001800
[ 2.506201] x17: 0000000000001400 x16: 0000000000001c00
[ 2.511496] x15: 0000000000001000 x14: ffffffc010b9cb12
[ 2.516790] x13: 0000000000000000 x12: ffffffc010b9c000
[ 2.522085] x11: 0000000000000004 x10: 000000000000000d
[ 2.527381] x9 : ffffffc01002bca0 x8 : 6b63757473207375
[ 2.532677] x7 : 74617473206b6c63 x6 : ffffffc010b9c1c0
[ 2.537971] x5 : 0000000000000000 x4 : 0000000000000000
[ 2.543266] x3 : 00000000ffffffff x2 : ffffffc00f391000
[ 2.548562] x1 : ffffff801e860000 x0 : 0000000000000028
[ 2.553855] Call trace:
[ 2.559149] clk_branch_toggle+0x130/0x140
[ 2.561321] clk_branch2_disable+0x18/0x20
[ 2.565488] clk_disable_unused_subtree+0xd0/0x110
[ 2.569569] clk_disable_unused_subtree+0x2c/0x110
[ 2.574343] clk_disable_unused_subtree+0x2c/0x110
[ 2.579116] clk_disable_unused_subtree+0x2c/0x110
[ 2.583892] clk_disable_unused_subtree+0x2c/0x110
[ 2.588666] clk_disable_unused+0x3c/0x120
[ 2.593438] do_one_initcall+0x74/0x1b0
[ 2.597519] kernel_init_freeable+0x190/0x224
[ 2.601253] kernel_init+0x10/0xfc
[ 2.605764] ret_from_fork+0x10/0x18
[ 2.609062] ---[ end trace 526d1de8c72559d9 ]---
[ 2.613420] ALSA devi�[ 2.621630] Freeing unused kernel memory: 1920K
[ 2.626036] Run /init as init process
[ 2.654702] init: Console is alive
[ 2.659479] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 2.659584] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 2.675373] init: - preinit -
[ 2.751901] random: jshn: uninitialized urandom read (4 bytes read)
[ 2.759698] random:im thinking that we will need jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 5.817120] procd: - early -
[ 6.332568] procd: - ubus -
[ 6.335146] random: ubusd: uninitialized urandom read (4 bytes read)
[ 6.382333] random: ubusd: uninitialized urandom read (4 bytes read)
[ 6.382553] random: ubusd: uninitialized urandom read (4 bytes read)
[ 6.388379] procd: - init -
[ 6.510586] kmodloader: loading kernel modules from /etc/modules.d/*
[ 6.525674] xt_time: kernel timezone is -0000
[ 6.526356] urngd: v1.0.2 started.
[ 6.536543] PPP generic driver version 2.4.2
[ 6.537273] NET: Registered protocol family 24
[ 6.544939] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 6.566356] random: crng init done
[ 6.566384] random: 5 urandom warning(s) missed due to ratelimiting
It hangs after that pointy, looks like need some patches to the qcom clock drivers
1 Like
Scratch that, was able to get to the fallback shell
BusyBox v1.31.1 () built-in shell (ash)
ash: can't access tty; job control turned off
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt SNAPSHOT, r13686-78b632134f
-----------------------------------------------------
================= FAILSAFE MODE active ================
special commands:
* firstboot reset settings to factory defaults
* mount_root mount root-partition with config files
after mount_root:
* passwd change root's password
* /etc/config directory with config files
for more help see:
https://openwrt.org/docs/guide-user/troubleshooting/
- failsafe_and_factory_reset
- root_password_reset
=======================================================
root@(none):/#
root@(none):/#
root@(none):/#
root@(none):/#
root@(none):/# ls
bin init mnt rom sys var
dev lib overlay root tmp www
etc lib64 proc sbin usr
root@(none):/# uname -a
Linux (none) 5.4.48 #0 SMP PREEMPT Sat Jul 4 19:00:11 2020 aarch64 GNU/Linux
root@(none):/# cat /proc/cpuinfo
processor : 0
BogoMIPS : 38.40
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
CPU implementer : 0x41
CPU architecture: 8
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4
processor : 1
BogoMIPS : 38.40
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
CPU implementer : 0x41
CPU architecture: 8
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4
processor : 2
BogoMIPS : 38.40
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
CPU implementer : 0x41
CPU architecture: 8
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4
processor : 3
BogoMIPS : 38.40
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
CPU implementer : 0x41
CPU architecture: 8
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4
root@(none):/# dmesg
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[ 0.000000] Linux version 5.4.48 (shane@wasp) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r13686-78b632134f)) #0 SMP PREEMPT Sat Jul 4 19:00:11 2020
[ 0.000000] Machine model: Qualcomm Technologies, Inc. IPQ8074-HK01
[ 0.000000] efi: Getting EFI parameters from FDT:
[ 0.000000] efi: UEFI not found.
[ 0.000000] On node 0 totalpages: 131072
[ 0.000000] DMA32 zone: 2048 pages used for memmap
[ 0.000000] DMA32 zone: 0 pages reserved
[ 0.000000] DMA32 zone: 131072 pages, LIFO batch:31
[ 0.000000] psci: probing for conduit method from DT.
[ 0.000000] psci: PSCIv1.0 detected in firmware.
[ 0.000000] psci: Using standard PSCI v0.2 function IDs
[ 0.000000] psci: MIGRATE_INFO_TYPE not supported.
[ 0.000000] psci: SMC Calling Convention v1.0
[ 0.000000] psci: OSI mode supported.
[ 0.000000] percpu: Embedded 21 pages/cpu s48408 r8192 d29416 u86016
[ 0.000000] pcpu-alloc: s48408 r8192 d29416 u86016 alloc=21*4096
[ 0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[ 0.000000] Detected VIPT I-cache on CPU0
[ 0.000000] CPU features: detected: ARM erratum 845719
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 129024
[ 0.000000] Kernel command line:
[ 0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 494072K/524288K available (6780K kernel code, 402K rwdata, 2144K rodata, 1920K init, 272K bss, 30216K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] rcu: Preemptible hierarchical RCU implementation.
[ 0.000000] Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[ 0.000000] random: get_random_bytes called from start_kernel+0x2ec/0x44c with crng_init=0
[ 0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[ 0.000005] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[ 0.000102] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=76800)
[ 0.000115] pid_max: default: 32768 minimum: 301
[ 0.000238] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.000250] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.023975] ASID allocator initialised with 32768 entries
[ 0.031972] rcu: Hierarchical SRCU implementation.
[ 0.040088] EFI services will not be available.
[ 0.048010] smp: Bringing up secondary CPUs ...
[ 0.080309] Detected VIPT I-cache on CPU1
[ 0.080361] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[ 0.112338] Detected VIPT I-cache on CPU2
[ 0.112375] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[ 0.144407] Detected VIPT I-cache on CPU3
[ 0.144439] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[ 0.144512] smp: Brought up 1 node, 4 CPUs
[ 0.144535] SMP: Total of 4 processors activated.
[ 0.144543] CPU features: detected: 32-bit EL0 Support
[ 0.144550] CPU features: detected: CRC32 instructions
[ 0.144595] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[ 0.144603] CPU: All CPU(s) started at EL1
[ 0.144625] alternatives: patching kernel code
[ 0.148571] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[ 0.148592] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[ 0.148777] pinctrl core: initialized pinctrl subsystem
[ 0.149225] DMI not present or invalid.
[ 0.149509] NET: Registered protocol family 16
[ 0.149810] DMA: preallocated 256 KiB pool for atomic allocations
[ 0.150204] cpuidle: using governor ladder
[ 0.150229] cpuidle: using governor menu
[ 0.150330] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[ 0.221114] pps_core: LinuxPPS API ver. 1 registered
[ 0.221126] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[ 0.221147] PTP clock support registered
[ 0.221361] Advanced Linux Sound Architecture Driver Initialized.
[ 0.221965] clocksource: Switched to clocksource arch_sys_counter
[ 0.222580] thermal_sys: Registered thermal governor 'step_wise'
[ 0.222583] thermal_sys: Registered thermal governor 'user_space'
[ 0.222754] NET: Registered protocol family 2
[ 0.223150] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.223173] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.223221] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[ 0.223299] TCP: Hash tables configured (established 4096 bind 4096)
[ 0.223375] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.223400] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.223550] NET: Registered protocol family 1
[ 0.223579] PCI: CLS 0 bytes, default 64
[ 1.607027] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[ 1.611591] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 1.611602] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 1.634062] msm_serial 78b3000.serial: msm_serial: detected port #0
[ 1.634093] msm_serial 78b3000.serial: uartclk = 3686400
[ 1.634135] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 8, base_baud = 230400) is a MSM
[ 1.634152] msm_serial: console setup on port #0
[ 2.123946] printk: console [ttyMSM0] enabled
[ 2.128820] msm_serial 78b1000.serial: msm_serial: detected port #1
[ 2.132812] msm_serial 78b1000.serial: uartclk = 19200000
[ 2.138890] 78b1000.serial: ttyMSM1 at MMIO 0x78b1000 (irq = 10, base_baud = 1200000) is a MSM
[ 2.144597] msm_serial: driver initialized
[ 2.159482] brd: module loaded
[ 2.160640] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[ 2.161996] spi-nor spi0.0: unrecognized JEDEC id bytes: ff ff ff ff ff ff
[ 2.168658] spi-nor: probe of spi0.0 failed with error -2
[ 2.175913] libphy: Fixed MDIO Bus: probed
[ 2.180799] i2c /dev entries driver
[ 2.185791] sdhci: Secure Digital Host Controller Interface driver
[ 2.188177] sdhci: Copyright(c) Pierre Ossman
[ 2.194423] sdhci-pltfm: SDHCI platform and OF driver helper
[ 2.200172] NET: Registered protocol family 10
[ 2.205387] Segment Routing with IPv6
[ 2.208897] NET: Registered protocol family 17
[ 2.212595] 8021q: 802.1Q VLAN Support v1.8
[ 2.234030] hctosys: unable to open rtc device (rtc0)
[ 2.234699] ------------[ cut here ]------------
[ 2.238054] gcc_usb1_master_clk status stuck at 'on'
[ 2.238103] WARNING: CPU: 0 PID: 1 at drivers/clk/qcom/clk-branch.c:92 clk_branch_toggle+0x130/0x140
[ 2.247698] Modules linked in:
[ 2.256806] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.4.48 #0
[ 2.259671] Hardware name: Qualcomm Technologies, Inc. IPQ8074-HK01 (DT)
[ 2.265491] pstate: 60400085 (nZCv daIf +PAN -UAO)
[ 2.272430] pc : clk_branch_toggle+0x130/0x140
[ 2.277031] lr : clk_branch_toggle+0x130/0x140
[ 2.281456] sp : ffffffc01002bca0
[ 2.285881] x29: ffffffc01002bca0 x28: 0000000000000000
[ 2.289271] x27: 0000000000000000 x26: ffffffc01095047c
[ 2.294653] x25: ffffffc010935ef8 x24: ffffffc0108c71d0
[ 2.299946] x23: 0000000000000000 x22: ffffffc01043f4b8
[ 2.305243] x21: ffffffc010b61df8 x20: 0000000000000000
[ 2.310538] x19: 0000000000000000 x18: 0000000000001800
[ 2.315833] x17: 0000000000001400 x16: 0000000000001c00
[ 2.321128] x15: 0000000000001000 x14: ffffffc010b9cb12
[ 2.326423] x13: 0000000000000000 x12: ffffffc010b9c000
[ 2.331717] x11: 0000000000000004 x10: 000000000000000d
[ 2.337013] x9 : ffffffc01002bca0 x8 : 6b63757473207375
[ 2.342308] x7 : 74617473206b6c63 x6 : ffffffc010b9c1c0
[ 2.347602] x5 : 0000000000000000 x4 : 0000000000000000
[ 2.352899] x3 : 00000000ffffffff x2 : ffffffc00f37c000
[ 2.358193] x1 : ffffff801e860000 x0 : 0000000000000028
[ 2.363489] Call trace:
[ 2.368781] clk_branch_toggle+0x130/0x140
[ 2.370953] clk_branch2_disable+0x18/0x20
[ 2.375122] clk_disable_unused_subtree+0xd0/0x110
[ 2.379201] clk_disable_unused_subtree+0x2c/0x110
[ 2.383976] clk_disable_unused_subtree+0x2c/0x110
[ 2.388750] clk_disable_unused_subtree+0x2c/0x110
[ 2.393523] clk_disable_unused_subtree+0x2c/0x110
[ 2.398298] clk_disable_unused+0x3c/0x120
[ 2.403074] do_one_initcall+0x74/0x1b0
[ 2.407154] kernel_init_freeable+0x190/0x224
[ 2.410887] kernel_init+0x10/0xfc
[ 2.415399] ret_from_fork+0x10/0x18
[ 2.418694] ---[ end trace fc107b84d8da9b8f ]---
[ 2.422814] ------------[ cut here ]------------
[ 2.427029] gcc_usb0_master_clk status stuck at 'on'
[ 2.427063] WARNING: CPU: 0 PID: 1 at drivers/clk/qcom/clk-branch.c:92 clk_branch_toggle+0x130/0x140
[ 2.436586] Modules linked in:
[ 2.445692] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 5.4.48 #0
[ 2.448562] Hardware name: Qualcomm Technologies, Inc. IPQ8074-HK01 (DT)
[ 2.455768] pstate: 60400085 (nZCv daIf +PAN -UAO)
[ 2.462709] pc : clk_branch_toggle+0x130/0x140
[ 2.467309] lr : clk_branch_toggle+0x130/0x140
[ 2.471734] sp : ffffffc01002bca0
[ 2.476158] x29: ffffffc01002bca0 x28: 0000000000000000
[ 2.479547] x27: 0000000000000000 x26: ffffffc01095047c
[ 2.484929] x25: ffffffc010935ef8 x24: ffffffc0108c72e8
[ 2.490224] x23: 0000000000000000 x22: ffffffc01043f4b8
[ 2.495520] x21: ffffffc010b62178 x20: 0000000000000000
[ 2.500816] x19: 0000000000000000 x18: 0000000000001800
[ 2.506111] x17: 0000000000001400 x16: 0000000000001c00
[ 2.511405] x15: 0000000000001000 x14: ffffffc010b9cb12
[ 2.516701] x13: 0000000000000000 x12: ffffffc010b9c000
[ 2.521996] x11: 0000000000000004 x10: 000000000000000d
[ 2.527292] x9 : ffffffc01002bca0 x8 : 6b63757473207375
[ 2.532587] x7 : 74617473206b6c63 x6 : ffffffc010b9c1c0
[ 2.537880] x5 : 0000000000000000 x4 : 0000000000000000
[ 2.543175] x3 : 00000000ffffffff x2 : ffffffc00f37c000
[ 2.548471] x1 : ffffff801e860000 x0 : 0000000000000028
[ 2.553766] Call trace:
[ 2.559057] clk_branch_toggle+0x130/0x140
[ 2.561231] clk_branch2_disable+0x18/0x20
[ 2.565397] clk_disable_unused_subtree+0xd0/0x110
[ 2.569478] clk_disable_unused_subtree+0x2c/0x110
[ 2.574253] clk_disable_unused_subtree+0x2c/0x110
[ 2.579027] clk_disable_unused_subtree+0x2c/0x110
[ 2.583800] clk_disable_unused_subtree+0x2c/0x110
[ 2.588576] clk_disable_unused+0x3c/0x120
[ 2.593350] do_one_initcall+0x74/0x1b0
[ 2.597428] kernel_init_freeable+0x190/0x224
[ 2.601164] kernel_init+0x10/0xfc
[ 2.605674] ret_from_fork+0x10/0x18
[ 2.608972] ---[ end trace fc107b84d8da9b90 ]---
[ 2.613318] ALSA device list:
[ 2.617324] No soundcards found.
[ 2.621438] Freeing unused kernel memory: 1920K
[ 2.626035] Run /init as init process
[ 2.654686] init: Console is alive
[ 2.659478] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 2.659582] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 2.675335] init: - preinit -
[ 2.752378] random: jshn: uninitialized urandom read (4 bytes read)
[ 2.760297] random: jshn: uninitialized urandom read (4 bytes read)
[ 8.041997] random: crng init done
Seems the very basics are working
The errors do not surprise me, because the used device tree does not match the hardware.
The ax3600 has no USB and the errors seem to come from the usb driver.
yeah, tho other than missing HW on the ax3600 (like USB) the DTS files match pretty well.
Later this week ill try and find what patches are needed to get the NAND started.
Seeing as it gets to the fail-safe shell that is a pretty good 1st step
4 Likes
Can you post which commands are available from the u-boot shell?
Probably we can simply solder a spi-nor flash and boot our OpenWrt from here if we can simply override the bootcmd env variable.
I'm soldering a pin header tonight and probably i solder a 16M 1.8V nor-flash that i have laying around too.
Sure, output of "help"
IPQ807x# help
? - alias for 'help'
aq_load_fw- LOAD aq-fw-binary
aq_phy_restart- Restart Aquantia phy
base - print or set address offset
bdinfo - print Board Info structure
bootm - boot application image from memory
bootmiwifi- bootmiwifi from flash device
bootp - boot image via network using BOOTP/TFTP protocol
bootz - boot Linux zImage image from memory
btnc - check reset button if pressed to 5s - if so ret 1
btni - init gpios for button
chpart - change active partition
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
dcache - enable or disable data cache
dhcp - boot image via network using DHCP/TFTP protocol
dm - Driver model low level access
echo - echo args to console
env - environment handling commands
erase - erase FLASH memory
exectzt - execute TZT
exit - exit script
false - do nothing, unsuccessfully
fdt - flattened device tree utility commands
flash - flash part_name
flash part_name load_addr file_size
flasherase- flerase part_name
flinfo - print FLASH memory information
fuseipq - fuse QFPROM registers from memory
go - start application at address 'addr'
help - print command description/usage
i2c - I2C sub-system
icache - enable or disable instruction cache
imxtract- extract a part of a multi-image
ipq_mdio- IPQ mdio utility commands
is_sec_boot_enabled- check secure boot fuse is enabled or not
itest - return true/false on integer compare
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mtest - simple RAM read/write test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nm - memory modify (constant address)
pci - list and access PCI Configuration Space
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
reset - Perform RESET of the CPU
rmemcrash- miwifi check and save crash buff to mtd
run - run commands in an environment variable
runmulticore- Enable and schedule secondary cores
saveenv - save environment variables to persistent storage
secure_authenticate- authenticate the signed image
setenv - set environment variables
sf - SPI flash sub-system
showvar - print local hushshell variables
sleep - delay execution for some time
smeminfo- print SMEM FLASH information
source - run script from memory
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
tftpput - TFTP put command, for uploading files to a server
true - do nothing, successfully
uart - UART sub-system
ubi - ubi commands
usb - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version
xqup - load image and upgrade to flash
IPQ807x#
Also "printenv" (serial number removed
IPQ807x# printenv
CountryCode=CN
Router_unconfigured=0
SN=266##E0P######
boot_wait=on
bootargs=ubi.mtd=rootfs_1 root=mtd:ubi_rootfs rootfstype=squashfs rootwait
bootcmd=bootmiwifi
bootdelay=5
color=101
eth1addr=8c:53:c3:b2:8a:2e
eth2addr=8c:53:c3:d6:db:3a
eth3addr=8c:53:c3:d6:db:3a
eth4addr=8c:53:c3:d6:db:3a
ethact=eth0
ethaddr=8c:53:c3:d6:db:3a
fdt_high=0x4A400000
fdtcontroladdr=4a979e10
flag_boot_rootfs=1
flag_boot_success=1
flag_boot_type=2
flag_last_success=1
flag_ota_reboot=0
flag_recover_config=1
flag_show_upgrade_info=0
flag_try_sys1_failed=0
flag_try_sys2_failed=0
flash_type=2
fsbootargs=ubi.mtd=rootfs_1 root=mtd:ubi_rootfs rootfstype=squashfs
ipaddr=192.168.31.1
machid=8010010
miot_did=331152123
miot_key=Znnp0KAIRN#####
mode=Router
model=R3600
mtddevname=fs
mtddevnum=0
mtdids=nand0=nand0
mtdparts=mtdparts=nand0:0x8000000@0x2dc0000(fs),
no_wifi_dev_times=0
nv_channel_secret=oOdzMQu8WCBKZaNCVF54AjGrl1/Ue########
nv_device_id=11fb8744-b346-####-5369-#######
nv_sys_pwd=7428394ddb9de74cb1cc819########
nv_wan_type=dhcp
nv_wifi_enc=mixed-psk
nv_wifi_enc1=mixed-psk
nv_wifi_pwd=######
nv_wifi_pwd1=########
nv_wifi_ssid=hornet
nv_wifi_ssid1=hornet5g
partition=nand0,0
restore_defaults=0
serverip=192.168.31.100
soc_version_major=2
soc_version_minor=0
ssh_en=1
stderr=serial@78B3000
stdin=serial@78B3000
stdout=serial@78B3000
telnet_en=0
uart_en=1
wl0_radio=1
wl0_ssid=Xiaomi_8A2E_75D1_5G
wl1_radio=1
wl1_ssid=Xiaomi_8A2E_75D1
wl2_ssid=Xiaomi_8A2E
Environment size: 1606/65532 bytes
Let me know if you get the SPI device recognised bu uboot.
1 Like
Are there any good instructions for opening the case without damaging the clamps or the case?
Its the normal "use thing plastic knife / phone opening tool" and open slowly around the edge (in this case this is a line above the Ethernet ports). but i was VERY cautious with mine but still broke 2 tabs. But the screws hold everything together fine regardless.
2 Likes
Has anyone succeeded in compiling this link?
If you succeed please tell me what Linux version and the development packages versions that you use?
I appreciate it.
Hi @Apache14, How dose you enter into u-boot?
After I type any key when the numbers count down, I can't execute any command in u-boot.
After connecting the serial TX / RX and GND you have to set the nvram to enable boot wait and the RX pin. So from the stock rom with ssh access
nvram set uart_en=1
nvram set boot_wait=on
nvram commit
After setting boot_wait=on, will the system boot after X seconds without any key interaction?
I'm asking because it could make sense to enable this from SSH even when one did not connect the serial-pins.
Yeah with boot_wait=on it waits for 5 seconds, if no keys are pressed it will boot to system. It is part of the install guide for the QSDK image here Xiaomi AX3600 install guide
But you can only interact with the UBOOT shell with a working serial connection.
1 Like
Soldered a w25q128fwsig to the spi-nor flash footprint but the command sf probe doesn't detect it.
On the bottom side below the spi-nor footprint there are two labeled resistor and one capacitor footprints that are not assembled. One resistor and one capacitor are for sure related to the vcc pin of our spi-nor flash footprint. But it was to late to figure out if the second resistor is also related to it. Probably this is a persitent "cs" or "write enable" pull up/down resistor.
Are these R88 R87 and C77 ? If so (from the images I have) they all seem to be off the same trace. The resistors could well just be 0 Ohm links, unsure about the capacitor tho.
But it should be east to check if those unpopulated pads are connected to the SPI pads and if so the VCC voltage.
I'm not at home, but if they are below the spi-nor footprint, then yes.
The resistor related to vcc is for sure a dummy 0 ohm resistor.
The other one is most likely a pull up resistor with high impedance.
This one is for sure to keep the vcc line clean and the power stable.
Humm, I have cropped some of the images I have and marked up what how i think the through holes match up to the SPI chip
C77 = Cap between VCC and GND
R87 = Resistor between RESET and VCC
R88 = Resistor between DI and VCC
Could well be wrong tho
1 Like
Very helpful images 
Your labeling and thoughts seems right to me.
Seems I have to solder at least a pull up resistor in R87 to keep the reset/hold line disabled (pulled up) as the W25Q128FWSIG SOIC-8 package hasn't an internal pull up resistor.
The cap's usage is almost clear to me, but i think it should work without too.
I'm a bit confused about R88. This can actually only be a pull up resistor, which get's pulled down by the soc's MOSI pin.