I recently purchased a MX8500 it is bricked. I only have access to uboot. It says Starting Kernel on one of the partitions but never completes bootup. I am assuming some other config is messed up. I have a working MX8500. via uboot how can I clone/ backup the nand. How can I revert the bad one to factory? Then get it to install openwrt as the methods listed in the git commit do not work
Use method 3 from the git commit ?
Shouldn't require any bootable firmware ...
If it doesn't, you need to post the boot/flash sequence, and the uboot settings, to start with.
When I tried method 3 it failed the hash check.
This is the boot log to where it stops at Starting Kernel
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B - 201 - PBL, Start
B - 2736 - bootable_media_detect_entry, Start
B - 3444 - bootable_media_detect_success, Start
B - 3448 - elf_loader_entry, Start
B - 6116 - auth_hash_seg_entry, Start
B - 6359 - auth_hash_seg_exit, Start
B - 68334 - elf_segs_hash_verify_entry, Start
B - 131190 - PBL, End
B - 218441 - SBL1, Start
B - 298015 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B - 307958 - pm_device_init, Start
B - 492361 - PM_SET_VAL:Skip
D - 182451 - pm_device_init, Delta
B - 494771 - pm_driver_init, Start
D - 5368 - pm_driver_init, Delta
B - 501145 - clock_init, Start
D - 2074 - clock_init, Delta
B - 505141 - boot_flash_init, Start
D - 12688 - boot_flash_init, Delta
B - 521519 - boot_config_data_table_init, Start
D - 3141 - boot_config_data_table_init, Delta - (575 Bytes)
B - 528961 - Boot Setting : 0x00000618
B - 532987 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:18
B - 539911 - sbl1_ddr_set_params, Start
B - 543723 - CPR configuration: 0x30c
B - 547200 - cpr_init, Start
B - 549976 - Rail:0 Mode: 5 Voltage: 808000
B - 555161 - CL CPR settled at 760000mV
B - 557967 - Rail:1 Mode: 5 Voltage: 880000
B - 562145 - Rail:1 Mode: 7 Voltage: 904000
D - 16500 - cpr_init, Delta
B - 569038 - Pre_DDR_clock_init, Start
B - 573034 - Pre_DDR_clock_init, End
B - 576419 - DDR Type : PCDDR3
B - 582153 - do ddr sanity test, Start
D - 1037 - do ddr sanity test, Delta
B - 586911 - DDR: Start of HAL DDR Boot Training
B - 591639 - DDR: End of HAL DDR Boot Training
B - 597342 - DDR: Checksum to be stored on flash is -1521926734
B - 607743 - Image Load, Start
D - 225486 - QSEE Image Loaded, Delta - (1374928 Bytes)
B - 833321 - Image Load, Start
D - 61 - SEC Image Loaded, Delta - (0 Bytes)
B - 841007 - Image Load, Start
D - 10766 - DEVCFG Image Loaded, Delta - (26148 Bytes)
B - 851865 - Image Load, Start
D - 22173 - RPM Image Loaded, Delta - (86660 Bytes)
B - 874130 - Image Load, Start
D - 96349 - APPSBL Image Loaded, Delta - (587226 Bytes)
B - 970632 - QSEE Execution, Start
D - 61 - QSEE Execution, Delta
B - 976427 - USB D+ check, Start
D - 0 - USB D+ check, Delta
B - 982801 - SBL1, End
D - 766678 - SBL1, Delta
S - Flash Throughput, 6673 KB/s (2076209 Bytes, 311093 us)
S - DDR Frequency, 466 MHz
S - Core 0 Frequency, 1651 MHz
U-Boot 2016.01 (Mar 02 2021 - 16:31:25 +0800)
version: v0.5.0_(spf11.3_ed3)
DRAM: smem ram ptable found: ver: 1 len: 4
1 GiB
board_devinfo_offset=1060000, board_devinfo_size=20000
board_senv_offset=1040000, board_senv_size=20000
board_kernel_offset=0x1080000, board_fw_size=0x9600000, board_altkernel_offset=0xa680000\nNAND: Could not find nand_gpio in dts, using defaults
ONFI device found
ID = 1590acad
Vendor = ad
Device = ac
qpic_nand: changing oobsize to 64 from 128 bytes
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
512 MiB
MMC: <NULL>: 0
devinfo_import--devinfo_mem_pool.crc=8326e0ec
fun=cmd_init DEVINFO_ITEMS=511
devinfo: data is valid!
read senv success
#### auto_recovery enabled:1, boot_part:1, boot_part_ready:3, boot_count=3
####[boot_count_write] erase:0, auto_recovery->block_offset:0x1040000 offset=0x105D000
Updating boot_count ...
####[boot_count_write] offset:0x105D000 , length:2048
done
PCI Link Intialized
In: serial@78B3000
Out: serial@78B3000
Err: serial@78B3000
machid: 8010012
Card did not respond to voltage select!
eth0 MAC Address from ART is not valid
eth1 MAC Address from ART is not valid
eth2 MAC Address from ART is not valid
eth3 MAC Address from ART is not valid
eth4 MAC Address from ART is not valid
eth5 MAC Address from ART is not valid
Saving Environment to NAND...
Erasing NAND...
Erasing at 0x1020000 -- 100% complete.
Writing to NAND... OK
#### auto_recovery:2 ####
#### auto_recovery:2 ####
auto_recovery_check changes bootcmd: boot from partition 2
Bus 0: i2c@78b6000
Setting bus to 0
Valid chip addresses: 62
Hit 'Space' or 'Enter' key to stop autoboot: 0
Normal boot
NAND read: device 0 offset 0xa680000, size 0x600000
6291456 bytes read: OK
## Loading kernel from FIT Image at 44000000 ...
Using 'config@1' configuration
Trying 'kernel@1' kernel subimage
Description: ARM OpenWrt Linux-4.4.60
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x440000e4
Data Size: 3939904 Bytes = 3.8 MiB
Architecture: ARM
OS: Linux
Load Address: 0x41208000
Entry Point: 0x41208000
Hash algo: crc32
Hash value: 4826ae0a
Hash algo: sha1
Hash value: ab84fac955de2dc6d6380ab02c7b5510133758ea
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
Using 'config@1' configuration
Trying 'fdt@1' fdt subimage
Description: ARM OpenWrt diablo device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x443c2054
Data Size: 85339 Bytes = 83.3 KiB
Architecture: ARM
Hash algo: crc32
Hash value: b2b1801a
Hash algo: sha1
Hash value: 61cd52529e937969fb2e1195d0ddfb20076e70b4
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x443c2054
Uncompressing Kernel Image ... OK
Loading Device Tree to 4a3e8000, end 4a3ffd5a ... OK
Using machid 0x8010012 from environment
Starting kernel ...
this is the printenv
FwSize=0x9600000
altKernAddr=0xa680000
auto_recovery=yes
baudrate=115200
boot_part=1
boot_part_ready=3
bootargs=console=ttyMSM0,115200n8 cnss2.bdf_pci0=0xa4
bootcmd=if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi
bootdelay=2
bootpart1=setenv bootargs $partbootargs1 && nand read $loadaddr $priKernAddr $kernsize && bootm $loadaddr
bootpart2=setenv bootargs $partbootargs2 && nand read $loadaddr $altKernAddr $kernsize && bootm $loadaddr
bootusb=usb start && usbboot $loadaddr && bootm $loadaddr
dumpipq_data=0
ethact=eth0
ethaddr=00:03:7f:ba:db:ad
fdt_high=0x4A400000
fdtcontroladdr=4a9790f0
firmwareName=diablo.img
flash_alt_image=tftpboot $loadaddr $firmwareName && nand erase $altKernAddr $FwSize && nand write $loadaddr $altKernAddr $filesize
flash_both_images=run flash_pri_image && nand erase $altKernAddr $FwSize && nand write $loadaddr $altKernAddr $filesize
flash_pri_image=tftpboot $loadaddr $firmwareName && nand erase $priKernAddr $FwSize && nand write $loadaddr $priKernAddr $filesize
flash_type=2
ipaddr=192.168.1.1
kernsize=0x600000
loadaddr=0x44000000
machid=8010012
mtdids=nand0=nand0
netmask=255.255.255.0
partbootargs1=console=ttyMSM0,115200n8 ubi.mtd=rootfs root=ubi0:ubifs rootfstype=ubifs rootwait swiotlb=1
partbootargs2=console=ttyMSM0,115200n8 ubi.mtd=alt_rootfs root=ubi0:ubifs rootfstype=ubifs rootwait swiotlb=1
priKernAddr=0x1080000
serverip=192.168.1.254
soc_hw_version=200d0200
soc_version_major=2
soc_version_minor=0
stderr=serial@78B3000
stdin=serial@78B3000
stdout=serial@78B3000
Environment size: 1655/262140 bytes
this is the git method 3
IPQ807x# usb reset
resetting USB...
USB0: Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.10
scanning bus 0 for devices... 2 USB Device(s) found
USB1: Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.10
scanning bus 1 for devices... 1 USB Device(s) found
IPQ807x# usbboot 0x44000000 0 && bootm 0x44000000
Loading from usb device 0, partition 0: Name: Whole Disk Type: U-Boot
Fit image detected...
FIT description: ARM64 OpenWrt FIT (Flattened Image Tree)
Image 0 (kernel-1)
Description: ARM64 OpenWrt Linux-6.6.47
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x440000e8
Data Size: 15388522 Bytes = 14.7 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x41000000
Entry Point: 0x41000000
Hash algo: crc32
Hash value: e783c00b
Hash algo: sha1
Hash value: 8a055fe8eb508b3be33214a67ea5528b27ea0f44
Image 1 (fdt-1)
Description: ARM64 OpenWrt linksys_mx8500 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x44ead194
Data Size: 47509 Bytes = 46.4 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: ec2a0bb5
Hash algo: sha1
Hash value: cf129310aaf70dd1e5aec834785fb0e9093ab9e8
Default Configuration: 'config@1'
Configuration 0 (config@1)
Description: OpenWrt linksys_mx8500
Kernel: kernel-1
FDT: fdt-1
## Loading kernel from FIT Image at 44000000 ...
Using 'config@1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-6.6.47
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x440000e8
Data Size: 15388522 Bytes = 14.7 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x41000000
Entry Point: 0x41000000
Hash algo: crc32
Hash value: e783c00b
Hash algo: sha1
Hash value: 8a055fe8eb508b3be33214a67ea5528b27ea0f44
Verifying Hash Integrity ... crc32 error!
Bad hash value for 'hash-1' hash node in 'kernel-1' image node
Bad Data Hash
ERROR: can't get kernel image!
I'd like to see the whole sequence, from when you've booted the initramfs ...
The post right before yours that says this is method 3 is the result. it starts with me doing a usb reset to get it to recognize the drive
DL a new initramfs (KERNEL) for your device, and try booting it.
Ok redid all the steps this is where it gets.
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B - 201 - PBL, Start
B - 2736 - bootable_media_detect_entry, Start
B - 3444 - bootable_media_detect_success, Start
B - 3448 - elf_loader_entry, Start
B - 6115 - auth_hash_seg_entry, Start
B - 6362 - auth_hash_seg_exit, Start
B - 68338 - elf_segs_hash_verify_entry, Start
B - 131194 - PBL, End
B - 145485 - SBL1, Start
B - 198524 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B - 205143 - pm_device_init, Start
B - 329491 - PM_SET_VAL:Skip
D - 123830 - pm_device_init, Delta
B - 331901 - pm_driver_init, Start
D - 5398 - pm_driver_init, Delta
B - 338275 - clock_init, Start
D - 2135 - clock_init, Delta
B - 342210 - boot_flash_init, Start
D - 12688 - boot_flash_init, Delta
B - 358680 - boot_config_data_table_init, Start
D - 3141 - boot_config_data_table_init, Delta - (575 Bytes)
B - 366122 - Boot Setting : 0x00000618
B - 370148 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:18
B - 377071 - sbl1_ddr_set_params, Start
B - 380884 - CPR configuration: 0x30c
B - 384361 - cpr_init, Start
B - 387136 - Rail:0 Mode: 5 Voltage: 808000
B - 392321 - CL CPR settled at 760000mV
B - 395127 - Rail:1 Mode: 5 Voltage: 880000
B - 399306 - Rail:1 Mode: 7 Voltage: 904000
D - 16500 - cpr_init, Delta
B - 406168 - Pre_DDR_clock_init, Start
B - 410194 - Pre_DDR_clock_init, End
B - 413580 - DDR Type : PCDDR3
B - 419314 - do ddr sanity test, Start
D - 1037 - do ddr sanity test, Delta
B - 424072 - DDR: Start of HAL DDR Boot Training
B - 428799 - DDR: End of HAL DDR Boot Training
B - 434472 - DDR: Checksum to be stored on flash is -1521926734
B - 444995 - Image Load, Start
D - 225700 - QSEE Image Loaded, Delta - (1374928 Bytes)
B - 670786 - Image Load, Start
D - 61 - SEC Image Loaded, Delta - (0 Bytes)
B - 678472 - Image Load, Start
D - 10767 - DEVCFG Image Loaded, Delta - (26148 Bytes)
B - 689330 - Image Load, Start
D - 22204 - RPM Image Loaded, Delta - (86660 Bytes)
B - 711595 - Image Load, Start
D - 96319 - APPSBL Image Loaded, Delta - (587226 Bytes)
B - 808006 - QSEE Execution, Start
D - 61 - QSEE Execution, Delta
B - 813831 - USB D+ check, Start
D - 0 - USB D+ check, Delta
B - 820206 - SBL1, End
D - 677039 - SBL1, Delta
S - Flash Throughput, 6669 KB/s (2076209 Bytes, 311304 us)
S - DDR Frequency, 466 MHz
S - Core 0 Frequency, 1651 MHz
U-Boot 2016.01 (Mar 02 2021 - 16:31:25 +0800)
version: v0.5.0_(spf11.3_ed3)
DRAM: smem ram ptable found: ver: 1 len: 4
1 GiB
board_devinfo_offset=1060000, board_devinfo_size=20000
board_senv_offset=1040000, board_senv_size=20000
board_kernel_offset=0x1080000, board_fw_size=0x9600000, board_altkernel_offset=0xa680000\nNAND: Could not find nand_gpio in dts, using defaults
ONFI device found
ID = 1590acad
Vendor = ad
Device = ac
qpic_nand: changing oobsize to 64 from 128 bytes
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
512 MiB
MMC: <NULL>: 0
devinfo_import--devinfo_mem_pool.crc=8326e0ec
fun=cmd_init DEVINFO_ITEMS=511
devinfo: data is valid!
read senv success
#### auto_recovery enabled:1, boot_part:1, boot_part_ready:3, boot_count=2
####[boot_count_write] erase:0, auto_recovery->block_offset:0x1040000 offset=0x1046000
Updating boot_count ...
####[boot_count_write] offset:0x1046000 , length:2048
done
PCI Link Intialized
In: serial@78B3000
Out: serial@78B3000
Err: serial@78B3000
machid: 8010012
Card did not respond to voltage select!
eth0 MAC Address from ART is not valid
eth1 MAC Address from ART is not valid
eth2 MAC Address from ART is not valid
eth3 MAC Address from ART is not valid
eth4 MAC Address from ART is not valid
eth5 MAC Address from ART is not valid
auto_recovery_check changes bootcmd: boot from partition 1
Bus 0: i2c@78b6000
Setting bus to 0
Valid chip addresses: 62 70
Hit 'Space' or 'Enter' key to stop autoboot: 0
Normal boot
starting USB...
USB0: Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.10
scanning bus 0 for devices... 2 USB Device(s) found
USB1: Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.10
scanning bus 1 for devices... 1 USB Device(s) found
Loading from usb device 0, partition 0: Name: Whole Disk Type: U-Boot
Fit image detected...
FIT description: ARM64 OpenWrt FIT (Flattened Image Tree)
Image 0 (kernel-1)
Description: ARM64 OpenWrt Linux-6.6.47
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x440000e8
Data Size: 15387613 Bytes = 14.7 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x41000000
Entry Point: 0x41000000
Hash algo: crc32
Hash value: ee831134
Hash algo: sha1
Hash value: 560abede18fdcbb5473bb80e25493e34beb33d96
Image 1 (fdt-1)
Description: ARM64 OpenWrt linksys_mx8500 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x44eace08
Data Size: 47509 Bytes = 46.4 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: ec2a0bb5
Hash algo: sha1
Hash value: cf129310aaf70dd1e5aec834785fb0e9093ab9e8
Default Configuration: 'config@1'
Configuration 0 (config@1)
Description: OpenWrt linksys_mx8500
Kernel: kernel-1
FDT: fdt-1
## Loading kernel from FIT Image at 44000000 ...
Using 'config@1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-6.6.47
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x440000e8
Data Size: 15387613 Bytes = 14.7 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x41000000
Entry Point: 0x41000000
Hash algo: crc32
Hash value: ee831134
Hash algo: sha1
Hash value: 560abede18fdcbb5473bb80e25493e34beb33d96
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
Using 'config@1' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt linksys_mx8500 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x44eace08
Data Size: 47509 Bytes = 46.4 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: ec2a0bb5
Hash algo: sha1
Hash value: cf129310aaf70dd1e5aec834785fb0e9093ab9e8
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x44eace08
Uncompressing Kernel Image ... OK
Loading Device Tree to 4a3f1000, end 4a3ff994 ... OK
Using machid 0x8010012 from environment
Starting kernel ...
Jumping to AARCH64 kernel via monitor