Another brick in the TP-Link EAP245 Wall (help needed)

Tharvys · January 28, 2023, 10:52pm

Hi Everyone,

due to my stupidity i have bricked my EAP245V3.I had OpenWRT 22.03.3 running and accidentally flashed the OpenWRT.bin again with Luci. Now the device is stuck in a bootloop.
The only thing i can see ist the TP Link recovery mode. But if i upload a proper TP-Link binary (V. 5.0.6 EU) it says Firmware Update succesful but only shows the recovery mode again. I can´t upload OpenWRT since there the recovery mode has got a signature check running. I also tried older stock binaries.
I tried TFTPD with different binaries (OpenWRT and Stock) as well getting the same result.
Any help is appreciated.

svanheule · January 29, 2023, 9:48am

You'll most likely have to get access to the serial console to work out what's going on.

For extra information, please have a look at two older threads:

Tharvys · February 3, 2023, 9:13pm

Hi,

took me a while to get a serial adapter... thats what i can see:

U-Boot 1.1.4--LSDK-10.2-00082-4 (Mar 19 2018 - 14:55:50)

board956x - Dragonfly 1.0DRAM:
sri
ath_ddr_initial_config(287): (ddr2 init)
ath_ddr_initial_config: DDR_EMR2_ADDRESS=0x180000bc, EMR2 value=0x80
ath_sys_frequency: ref_clk 25000000
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0xf, 0xf, 0xf, 0xf)
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 454k for U-Boot at: 87f8c000
Reserving 192k for malloc() at: 87f5c000
Reserving 44 Bytes for Board Info at: 87f5bfd4
Reserving 36 Bytes for Global Data at: 87f5bfb0
Reserving 128k for boot params() at: 87f3bfb0
Stack Pointer at: 87f3bf98
Now running in RAM - U-Boot at: 87f8c000
Flash Manuf Id 0x1c, DeviceId0 0x70, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Setting 0x181162c0 to 0x40802100
Hit Ctrl+B to stop autoboot:  0
[NM_Error](nm_api_checkInteger) 00373: factory boot check integer flag is not 1.

Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Trying eth0
eth0 link down
FAIL

Any ideas ?

Thanks !

Borromini · February 3, 2023, 9:50pm

You should do what it says, then see what the bootloader allows you to do (ideally load an image through TFTP e.g.).

Please use code tags around your paste, improves readability.

Tharvys · February 3, 2023, 10:55pm

i tried to load an openwrt image with the u-boot tftpboot, but its realy slow and stops after 100k with to many timeouts.

TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename '0101A8C0.img'.
Load address: 0x81000000
Loading: T #T T T T #T T T T T #
Retry count exceeded; starting again
Trying eth0

bootelf 0x9f0c0000 doesn´t work either (No elf image at address 0x9f0c0000)

Tharvys · February 3, 2023, 11:05pm

When uploading the stock firmware via http uploader i get this:

Rsa verify success
Firmware process common.

Image verify OK!

Firmware file Verify ok!

Firmwave supports EAP245(TP-Link|UN|AC1750-D):3.0, check OK..

Firmware Recovery check ok!

upgrade_filecheck ok
HTTP upload is done! Upgrading...
do http upgrade
Firmware Recovery file length : 7996667

Rsa verify success
Firmware process common.

Image verify OK!

Firmware file Verify ok!

Firmwave supports EAP245(TP-Link|UN|AC1750-D):3.0, check OK..

Firmware Recovery check ok!

set integer flag to 0.

[NM_Error](nm_updateDataToNvram) 00652: memory malloc failed.

[NM_Error](nm_upgradeFwupFile) 01666: updateDataToNvram failed.

[NM_Error](nm_tpFirmwareRecovery) 01627: upgrade firmware failed!

Web recovery failed type 0.
## Error: HTTP ugrade failed!

its basically the same problem "DoritosVodka" had in the thread linked by svanheule but other than him i can´t boot into openwrt with the bootelf command.

svanheule · February 6, 2023, 9:28pm

TFTP should be a lot more reliable than what you're seeing. I assume you've correctly set the IP addresses and also modified the filename of the initramfs image to "0101A8C0.img"?

It might be that something went wrong while flashing, and your flash was left erased. Does md.l 0x9f0c0000 display anything that looks like an ELF binary?

Tharvys · February 6, 2023, 9:47pm

I´m finally able to load images with tftpboot. i could load the snapshot upgrade bin and was able to boot it. at least until i got a kernel panic

ath> bootelf 0x81000000
Loading .text @ 0x80060000 (2503113 bytes)
## Starting application at 0x80060000 ...


OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80060000...

[    0.000000] Linux version 5.15.91 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.2.0 r22000-6bc675c0be) 12.2.0, GNU ld (GNU Binutils) 2.39) #0 Sun Feb 5 21:39:17 2023
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is TP-Link EAP245 v3 / EAP265 HD v1
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 120244K/131072K available (6150K kernel code, 592K rwdata, 1328K rodata, 1200K init, 217K bss, 10828K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000001] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008291] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074816] pid_max: default: 32768 minimum: 301
[    0.079885] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087620] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.098070] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.108567] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.118985] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.126267] pinctrl core: initialized pinctrl subsystem
[    0.133195] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.139926] thermal_sys: Registered thermal governor 'step_wise'
[    0.154704] clocksource: Switched to clocksource MIPS
[    0.167256] NET: Registered PF_INET protocol family
[    0.172613] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.181023] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.189901] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.198084] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.206181] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.213621] TCP: Hash tables configured (established 1024 bind 1024)
[    0.220446] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.227398] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.235061] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.241062] PCI: CLS 0 bytes, default 32
[    0.248228] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.258858] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.265066] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.276325] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.286992] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.294077] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.302905] printk: console [ttyS0] disabled
[    0.307529] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.316654] printk: console [ttyS0] enabled
[    0.316654] printk: console [ttyS0] enabled
[    0.325722] printk: bootconsole [early0] disabled
[    0.325722] printk: bootconsole [early0] disabled
[    0.352711] spi-nor spi0.0: en25qh128 (16384 Kbytes)
[    0.357994] 10 fixed-partitions partitions found on MTD device spi0.0
[    0.364679] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.371569] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.378965] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.385897] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.393181] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.400098] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.407171] Creating 10 MTD partitions on "spi0.0":
[    0.412226] 0x000000000000-0x000000040000 : "factory-boot"
[    0.424056] 0x000000040000-0x000000080000 : "u-boot"
[    0.430159] 0x000000080000-0x000000090000 : "partition-table"
[    0.438601] 0x000000090000-0x0000000a0000 : "info"
[    0.444523] 0x0000000a0000-0x0000000b0000 : "art"
[    0.451924] 0x0000000b0000-0x0000000c0000 : "extra-para"
[    0.458452] 0x0000000c0000-0x000000f00000 : "firmware"
[    0.466268] 0x000000f00000-0x000000f30000 : "config"
[    0.472347] 0x000000f30000-0x000000fb0000 : "mutil-log"
[    0.480223] 0x000000fb0000-0x000000ff0000 : "oops"
[    1.217322] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0
[    1.869298] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    1.880562] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[    1.887492] i2c_dev: i2c /dev entries driver
[    1.893650] NET: Registered PF_INET6 protocol family
[    1.908492] Segment Routing with IPv6
[    1.912359] In-situ OAM (IOAM) with IPv6
[    1.916586] NET: Registered PF_PACKET protocol family
[    1.921878] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.935284] 8021q: 802.1Q VLAN Support v1.8
[    1.940691] PCI host bridge to bus 0000:00
[    1.944988] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    1.952094] pci_bus 0000:00: root bus resource [io  0x0000]
[    1.957862] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.966099] pci 0000:00:00.0: [168c:0040] type 00 class 0x028000
[    1.972341] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    1.979491] pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
[    1.985826] pci 0000:00:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    2.002296] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    2.009211] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    2.021550] /dev/root: Can't open blockdev
[    2.025860] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    2.033584] Please append a correct "root=" boot option; here are the available partitions:
[    2.042234] 1f00             256 mtdblock0
[    2.042245]  (driver?)
[    2.049001] 1f01             256 mtdblock1
[    2.049010]  (driver?)
[    2.055766] 1f02              64 mtdblock2
[    2.055775]  (driver?)
[    2.062520] 1f03              64 mtdblock3
[    2.062527]  (driver?)
[    2.069285] 1f04              64 mtdblock4
[    2.069293]  (driver?)
[    2.076051] 1f05              64 mtdblock5
[    2.076059]  (driver?)
[    2.082805] 1f06           14592 mtdblock6
[    2.082812]  (driver?)
[    2.089571] 1f07             192 mtdblock7
[    2.089579]  (driver?)
[    2.096336] 1f08             512 mtdblock8
[    2.096345]  (driver?)
[    2.103090] 1f09             256 mtdblock9
[    2.103098]  (driver?)
[    2.109856] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    2.118387] Rebooting in 1 seconds..

svanheule · February 6, 2023, 9:51pm

That's because the sysupgrade image expects a filesystem on flash, which isn't there. The initramfs uses the same ELF format as the sysupgrade image, so it's not clear to me at the moment why that would break.

Tharvys · February 10, 2023, 7:28pm

OK, making some progress here:

ath> tftpboot
Trying eth0
dup 1 speed 1000
*** Warning: no boot file name; using '0101A8C0.img'
Using eth0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename '0101A8C0.img'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##############################################
done
Bytes transferred = 6553907 (640133 hex)

ath> erase 0x9f0c0000 +$filesize
Erasing flash...
First 0xc last 0x70 sector size 0x10000                                                                                           112
Erased 101 sectors
ath> cp.b $fileaddr 0x9f0c0000 $filesize
Copy to Flash... write addr: 9f0c0000
done
ath> bootelf 0x9f0c0000
Loading .text @ 0x80060000 (2254150 bytes)
## Starting application at 0x80060000 ...


OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80060000...

[    0.000000] Linux version 5.10.161 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r20028-43d71ad93e) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Tue Jan 3 00:24:21 2023
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is TP-Link EAP245 v3
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 121092K/131072K available (5862K kernel code, 611K rwdata, 748K rodata, 1216K init, 210K bss, 9980K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000007] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008276] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074802] pid_max: default: 32768 minimum: 301
[    0.079803] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087512] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.097686] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.108191] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.118600] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.125869] pinctrl core: initialized pinctrl subsystem
[    0.135463] NET: Registered protocol family 16
[    0.140881] thermal_sys: Registered thermal governor 'step_wise'
[    0.188943] clocksource: Switched to clocksource MIPS
[    0.201763] NET: Registered protocol family 2
[    0.206563] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.214967] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.223890] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.231991] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.239435] TCP: Hash tables configured (established 1024 bind 1024)
[    0.246259] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.253206] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.260851] NET: Registered protocol family 1
[    0.265469] PCI: CLS 0 bytes, default 32
[    0.275459] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.285886] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.292092] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.304128] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.314519] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.321612] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.330441] printk: console [ttyS0] disabled
[    0.335007] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.344152] printk: console [ttyS0] enabled
[    0.344152] printk: console [ttyS0] enabled
[    0.353215] printk: bootconsole [early0] disabled
[    0.353215] printk: bootconsole [early0] disabled
[    0.379180] spi-nor spi0.0: en25qh128 (16384 Kbytes)
[    0.384391] 10 fixed-partitions partitions found on MTD device spi0.0
[    0.391118] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.397968] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.405452] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.412371] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.419436] Creating 10 MTD partitions on "spi0.0":
[    0.424488] 0x000000000000-0x000000040000 : "factory-boot"
[    0.434819] 0x000000040000-0x000000080000 : "u-boot"
[    0.440951] 0x000000080000-0x000000090000 : "partition-table"
[    0.449340] 0x000000090000-0x0000000a0000 : "info"
[    0.455259] 0x0000000a0000-0x0000000b0000 : "art"
[    0.462542] 0x0000000b0000-0x0000000c0000 : "extra-para"
[    0.469024] 0x0000000c0000-0x000000f00000 : "firmware"
[    0.476744] 2 elf-loader-fw partitions found on MTD device firmware
[    0.483283] Creating 2 MTD partitions on "firmware":
[    0.488418] 0x000000000000-0x0000002276e4 : "kernel"
[    0.493556] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
[    0.503764] 0x0000002276e4-0x000000e40000 : "rootfs"
[    0.508902] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[    0.519419] mtd: setting mtd8 (rootfs) as root device
[    0.525485] 1 squashfs-split partitions found on MTD device rootfs
[    0.531930] 0x000000640000-0x000000e40000 : "rootfs_data"
[    0.538409] 0x000000f00000-0x000000f30000 : "config"
[    0.546000] 0x000000f30000-0x000000fb0000 : "mutil-log"
[    0.552432] 0x000000fb0000-0x000000ff0000 : "oops"
[    1.281584] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0
[    1.933434] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    1.944711] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[    1.951566] i2c /dev entries driver
[    1.956838] NET: Registered protocol family 10
[    1.969080] Segment Routing with IPv6
[    1.972969] NET: Registered protocol family 17
[    1.977658] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.991079] 8021q: 802.1Q VLAN Support v1.8
[    1.996209] PCI host bridge /ahb/pcie-controller@18250000 ranges:
[    2.002584]  MEM 0x0000000012000000..0x0000000013ffffff
[    2.007985]   IO 0x0000000000000000..0x0000000000000000
[    2.013568] PCI host bridge to bus 0000:00
[    2.017812] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    2.024942] pci_bus 0000:00: root bus resource [io  0x0000]
[    2.030709] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    2.037720] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    2.045956] pci 0000:00:00.0: [168c:0040] type 00 class 0x028000
[    2.052203] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    2.059351] pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
[    2.065670] pci 0000:00:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    2.081877] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    2.088729] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    2.107077] VFS: Mounted root (squashfs filesystem) readonly on device 31:8.
[    2.121216] Freeing unused kernel memory: 1216K
[    2.125892] This architecture does not have kernel memory protection.
[    2.132578] Run /sbin/init as init process
[    2.877871] init: Console is alive
[    2.881911] init: - watchdog -
[    4.282459] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.328093] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.346045] init: - preinit -
[    5.623135] random: jshn: uninitialized urandom read (4 bytes read)
[    5.767089] random: jshn: uninitialized urandom read (4 bytes read)
[    5.858176] random: jshn: uninitialized urandom read (4 bytes read)
[    7.238332] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 2 is up
[    7.252085] eth0: link up (1000Mbps/Full duplex)
[    7.256899] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    7.278376] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[    7.306517] random: procd: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   11.489441] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[   11.500217] urandom-seed: Seed file not found (/etc/urandom.seed)
[   11.634422] eth0: link down
[   11.656584] procd: - early -
[   11.660541] procd: - watchdog -
[   12.318680] procd: - watchdog -
[   12.354361] procd: - ubus -
[   12.464020] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.473237] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.480391] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.494690] procd: - init -
Please press Enter to activate this console.
[   13.556480] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.577923] random: ubus: uninitialized urandom read (4 bytes read)
[   13.641310] kmodloader: loading kernel modules from /etc/modules.d/*
[   13.703388] random: jsonfilter: uninitialized urandom read (4 bytes read)
[   14.045864] urngd: v1.0.2 started.
[   14.171106] Loading modules backported from Linux version v5.15.81-0-ge4a7232c917c
[   14.178984] Backport generated by backports.git v5.15.81-1-0-ge1867d55
[   14.231433] random: crng init done
[   14.234958] random: 24 urandom warning(s) missed due to ratelimiting
[   14.383928] PPP generic driver version 2.4.2
[   14.391653] NET: Registered protocol family 24
[   14.424968] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x40.
[   14.434768] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
[   14.441569] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[   17.252032] ath10k_pci 0000:00:00.0: qca99x0 hw2.0 target 0x01000000 chip_id 0x003b01ff sub 168c:0002
[   17.261597] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   17.279696] ath10k_pci 0000:00:00.0: firmware ver 10.4b-ct-9980-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 b36a12bf
[   17.367031] ath10k_pci 0000:00:00.0: Loading BDF type 0
[   17.380649] ath10k_pci 0000:00:00.0: board_file api 2 bmi_id 1:1 crc32 e4a0f655
[   18.539169] ath10k_pci 0000:00:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   18.546910] ath10k_pci 0000:00:00.0: msdu-desc: 2500  skid: 32
[   18.622606] ath10k_pci 0000:00:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   18.633919] ath10k_pci 0000:00:00.0: wmi print 'free: 31080 iram: 23028 sram: 9596'
[   18.894725] ath10k_pci 0000:00:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1
[   19.119518] ieee80211 phy1: Atheros AR9561 Rev:0 mem=0xb8100000, irq=2
[   19.239972] kmodloader: done loading kernel modules from /etc/modules.d/*
[   74.099216] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   74.106359] jffs2_build_filesystem(): unlocking the mtd device...
[   74.106363] done.
[   74.114751] jffs2_build_filesystem(): erasing all blocks after the end marker...
[   75.875036] eth0: link up (1000Mbps/Full duplex)
[   75.904040] br-lan: port 1(eth0.1) entered blocking state
[   75.909700] br-lan: port 1(eth0.1) entered disabled state
[   75.915551] device eth0.1 entered promiscuous mode
[   75.920551] device eth0 entered promiscuous mode
[   75.947500] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   75.989145] br-lan: port 1(eth0.1) entered blocking state
[   75.994736] br-lan: port 1(eth0.1) entered forwarding state
[   76.899555] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[  110.515731] done.
[  110.517755] jffs2: notice: (2189) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  110.984909] overlayfs: upper fs does not support tmpfile.
[  111.617508] br-lan: port 1(eth0.1) entered disabled state
[  111.768734] device eth0.1 left promiscuous mode
[  111.773473] device eth0 left promiscuous mode
[  111.778085] br-lan: port 1(eth0.1) entered disabled state
[  111.828520] eth0: link down
[  111.878912] eth0: link up (1000Mbps/Full duplex)
[  111.894151] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[  111.902419] br-lan: port 1(eth0.1) entered blocking state
[  111.908007] br-lan: port 1(eth0.1) entered disabled state
[  111.913895] device eth0.1 entered promiscuous mode
[  111.918855] device eth0 entered promiscuous mode
[  111.999157] br-lan: port 1(eth0.1) entered blocking state
[  112.004758] br-lan: port 1(eth0.1) entered forwarding state

OpenWRT with LuCI starts and seems to work.
But after switchting the device off and on again it get the same error as before

Tharvys · February 10, 2023, 7:48pm

I replaced the mtd5 partition with one from my working EAP245.
I still get the CRC error but get a clean boot into openwrt.

Thanks for your help svanheule, i owe you a coffee