Fritz!Repeater 3000, ubirmvol

Yes. I also tryed the recover procedure from AVM (works fine) with the 7.29. After this I tryed it again and its the same error. I have a second new repeater here, I can try with this one.

I have tried again with a second new device. But it also fails.
I put some Screenshots here:

Any Ideas?

Br and thx

Anyone can help? I have tried with two repeaters but its the same error on both devices.

I think that AVM has changed something?

Br

I can also confirm the behavior on my side. The volumes /dev/ubi0 do not exist (anymore). After a sysupgrade, the access point immediately reboots to FTP mode 192.186.178.1.

In the kernel log you can see that attaching mtd10 fails.
I have also opened an issue on Github.

root@OpenWrt:~# dmesg | grep ubi
[ 1.269661] 0x000001300000-0x000008000000 : "ubi"
[ 594.840161] ubi0: attaching mtd10
[ 594.841373] ubi0 warning: 0xc067d7fc: error -524 while reading 64 bytes from PEB 0:0, read only 0 bytes, retry
[ 594.843318] ubi0 warning: 0xc067d7fc: error -524 while reading 64 bytes from PEB 0:0, read only 0 bytes, retry
[ 594.853320] ubi0 warning: 0xc067d7fc: error -524 while reading 64 bytes from PEB 0:0, read only 0 bytes, retry
[ 594.863277] ubi0 error: 0xc067d848: error -524 while reading 64 bytes from PEB 0:0, read 0 bytes
[ 594.872374] CPU: 2 PID: 2590 Comm: ubiattach Not tainted 5.4.154 #0
[ 594.971784] ubi0 error: 0xc06780d8: failed to attach mtd10, error -524
root@OpenWrt:~# cat /proc/mtd
dev: size erasesize name
mtd0: 00080000 00020000 "SBL1"
mtd1: 00080000 00020000 "MIBIB"
mtd2: 00080000 00020000 "QSEE"
mtd3: 00040000 00020000 "CDT"
mtd4: 00080000 00020000 "QSEE_B"
mtd5: 00040000 00020000 "urlader0"
mtd6: 00040000 00020000 "urlader1"
mtd7: 00840000 00020000 "nand-tffs"
mtd8: 00400000 00020000 "uboot0"
mtd9: 00400000 00020000 "uboot1"
mtd10: 06d00000 00020000 "ubi"

Try to recover an older version e.g. 7.27...and then try to follow my instructions in Reinstall 21.02 on Fritz!Repeater 3000 - #7 by frollic

Might help....

I searched already for a older version, but I don't find the recovery setup. I write to AVM but the said, that a Downgrade isn't possible.

It is possible. I have tried it with 7.20 and 7.27.
You can find it via archive.org
But even with the older versions I don‘t have the /dev/ubi volumes.

http://ftp.avm.de/archive/fritz.box/

The Repeater 3000 is not listed.

Is it possible that the AVM 3000 has a different NAND chip inside? With the Fritzbox 7530 this has probably also happened. AVM FRITZ!Box 7530: New NAND chip?
Could someone help me figure this out on the AVM 3000?

The symptoms look similar, which NAND ID is reported in the boot log?

If I interpret the boot log correctly it is a "Macronix MX30LF1G28AD".
Attached is the complete boot log.

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.4.188 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16554-1d4dea6d4f)) #0 SMP Sat Apr 16 12:59:34 2022
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt: Machine model: AVM FRITZ!Repeater 3000
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] On node 0 totalpages: 65024
[    0.000000]   Normal zone: 576 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 65024 pages, LIFO batch:15
[    0.000000] percpu: Embedded 15 pages/cpu s30156 r8192 d23092 u61440
[    0.000000] pcpu-alloc: s30156 r8192 d23092 u61440 alloc=15*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64448
[    0.000000] Kernel command line: 
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 238380K/260096K available (5794K kernel code, 189K rwdata, 876K rodata, 11264K init, 241K bss, 21716K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] random: get_random_bytes called from 0xc0a00cfc with crng_init=0
[    0.000000] arch_timer: cp15 timer(s) running at 48.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb11fd3bfb, max_idle_ns: 440795203732 ns
[    0.000008] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 4398046511096ns
[    0.000022] Switching to timer-based delay loop, resolution 20ns
[    0.000224] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=480000)
[    0.000242] pid_max: default: 32768 minimum: 301
[    0.000444] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.000461] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.001439] CPU: Testing write buffer coherency: ok
[    0.002452] Setting up static identity map for 0x80300000 - 0x80300060
[    0.002587] rcu: Hierarchical SRCU implementation.
[    0.003027] smp: Bringing up secondary CPUs ...
[    0.006089] smp: Brought up 1 node, 4 CPUs
[    0.006107] SMP: Total of 4 processors activated (384.00 BogoMIPS).
[    0.006116] CPU: All CPU(s) started in SVC mode.
[    0.010349] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[    0.010506] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.010530] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.010729] pinctrl core: initialized pinctrl subsystem
[    0.011721] NET: Registered protocol family 16
[    0.011992] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.013209] cpuidle: using governor ladder
[    0.013253] cpuidle: using governor menu
[    0.032596] cryptd: max_cpu_qlen set to 1000
[    0.035945] usbcore: registered new interface driver usbfs
[    0.036011] usbcore: registered new interface driver hub
[    0.036070] usbcore: registered new device driver usb
[    0.036116] pps_core: LinuxPPS API ver. 1 registered
[    0.036126] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.036151] PTP clock support registered
[    0.037651] clocksource: Switched to clocksource arch_sys_counter
[    0.038397] thermal_sys: Registered thermal governor 'step_wise'
[    0.038685] NET: Registered protocol family 2
[    0.038846] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.039622] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.039665] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear)
[    0.039704] TCP bind hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.039753] TCP: Hash tables configured (established 2048 bind 2048)
[    0.039873] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.039908] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.040220] NET: Registered protocol family 1
[    0.040263] PCI: CLS 0 bytes, default 64
[    0.183132] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[    0.188934] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.188948] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.237472] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248)
[    0.239139] qcom-pcie 40000000.pci: host bridge /soc/pci@40000000 ranges:
[    0.239187] qcom-pcie 40000000.pci:    IO 0x40200000..0x402fffff -> 0x40200000
[    0.239216] qcom-pcie 40000000.pci:   MEM 0x40300000..0x40ffffff -> 0x40300000
[    0.519216] qcom-pcie 40000000.pci: Link up
[    0.519372] qcom-pcie 40000000.pci: PCI host bridge to bus 0000:00
[    0.519392] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.519410] pci_bus 0000:00: root bus resource [io  0x0000-0xfffff] (bus address [0x40200000-0x402fffff])
[    0.519424] pci_bus 0000:00: root bus resource [mem 0x40300000-0x40ffffff]
[    0.519466] pci 0000:00:00.0: [17cb:1001] type 01 class 0x060400
[    0.519505] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x00000fff]
[    0.519573] pci 0000:00:00.0: PME# supported from D0 D3hot
[    0.520964] PCI: bus0: Fast back to back transfers disabled
[    0.521176] pci 0000:01:00.0: [168c:0046] type 00 class 0x028000
[    0.521345] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    0.521867] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[    0.523360] PCI: bus1: Fast back to back transfers disabled
[    0.523413] pci 0000:00:00.0: BAR 8: assigned [mem 0x40400000-0x405fffff]
[    0.523430] pci 0000:00:00.0: BAR 0: assigned [mem 0x40300000-0x40300fff]
[    0.523451] pci 0000:01:00.0: BAR 0: assigned [mem 0x40400000-0x405fffff 64bit]
[    0.523514] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    0.523530] pci 0000:00:00.0:   bridge window [mem 0x40400000-0x405fffff]
[    0.526360] pcieport 0000:00:00.0: AER: enabled with IRQ 94
[    0.528075] bam-dma-engine 8e04000.dma: num-channels unspecified in dt
[    0.528094] bam-dma-engine 8e04000.dma: num-ees unspecified in dt
[    0.529315] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000
[    0.529402] tcsr 1953000.ess_tcsr: setting ess interface select = 0
[    0.529485] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222
[    0.529791] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.531665] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.531710] msm_serial 78af000.serial: uartclk = 1843200
[    0.531764] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 24, base_baud = 115200) is a MSM
[    0.531792] msm_serial: console setup on port #0
[    1.146730] printk: console [ttyMSM0] enabled
[    1.151669] msm_serial: driver initialized
[    1.160605] loop: module loaded
[    1.162121] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xf1
[    1.162688] nand: Macronix MX30LF1G28AD
[    1.169334] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 128
[    1.172856] nand: WARNING: qcom_nand.0: the ECC used on your system is too weak compared to the one required by the NAND chip
[    1.180584] 11 fixed-partitions partitions found on MTD device qcom_nand.0
[    1.191960] Creating 11 MTD partitions on "qcom_nand.0":
[    1.198750] 0x000000000000-0x000000080000 : "SBL1"
[    1.205620] 0x000000080000-0x000000100000 : "MIBIB"
[    1.210200] 0x000000100000-0x000000180000 : "QSEE"
[    1.214915] 0x000000180000-0x0000001c0000 : "CDT"
[    1.219629] 0x0000001c0000-0x000000240000 : "QSEE_B"
[    1.224526] 0x000000240000-0x000000280000 : "urlader0"
[    1.229387] 0x000000280000-0x0000002c0000 : "urlader1"
[    1.234275] 0x0000002c0000-0x000000b00000 : "nand-tffs"
[    1.247277] 0x000000b00000-0x000000f00000 : "uboot0"
[    1.252035] 0x000000f00000-0x000001300000 : "uboot1"
[    1.253171] random: fast init done
[    1.259989] 0x000001300000-0x000008000000 : "ubi"
[    1.438716] ESS reset ok!
[    1.462864] ESS reset ok!
[    1.892731] i2c /dev entries driver
[    1.894573] sdhci: Secure Digital Host Controller Interface driver
[    1.895024] sdhci: Copyright(c) Pierre Ossman
[    1.901363] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.909121] NET: Registered protocol family 10
[    1.912681] Segment Routing with IPv6
[    1.915771] NET: Registered protocol family 17
[    1.919512] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.923772] 8021q: 802.1Q VLAN Support v1.8
[    1.936932] Registering SWP/SWPB emulation handler
[    1.951039] UBI error: unable to read from mtd10
[    1.951091] hctosys: unable to open rtc device (rtc0)
[    1.971331] Freeing unused kernel memory: 11264K
[    2.011804] Run /init as init process
[    2.405536] init: Console is alive
[    2.405742] init: - watchdog -
[    2.416654] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.426370] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.429140] init: - preinit -
[    2.665999] random: jshn: uninitialized urandom read (4 bytes read)
[    2.717468] random: jshn: uninitialized urandom read (4 bytes read)
[    2.777976] random: jshn: uninitialized urandom read (4 bytes read)
[    3.012621] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    7.235631] procd: - early -
[    7.235767] procd: - watchdog -
[    7.785874] procd: - watchdog -
[    7.789390] procd: - ubus -
[    7.804295] urandom_read: 5 callbacks suppressed
[    7.804321] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.843582] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.860375] procd: - init -
[    8.176328] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.185119] Loading modules backported from Linux version v5.10.110-0-g3238bffaf992
[    8.185158] Backport generated by backports.git v5.10.110-1-0-g1fbde860
[    8.189902] urngd: v1.0.2 started.
[    8.205620] xt_time: kernel timezone is -0000
[    8.235895] PPP generic driver version 2.4.2
[    8.237375] NET: Registered protocol family 24
[    8.256962] ath10k 5.10 driver, optimized for CT firmware, probing pci device: 0x46.
[    8.257974] ath10k_pci 0000:01:00.0: enabling device (0140 -> 0142)
[    8.260901] crng init done
[    8.264366] ath10k_pci 0000:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0
[    9.571446] ath10k_pci 0000:01:00.0: Failed to find firmware-N.bin (N between 2 and 6) from ath10k/QCA9984/hw1.0: -12
[    9.571522] ath10k_pci 0000:01:00.0: could not fetch firmware files (-12)
[    9.581157] ath10k_pci 0000:01:00.0: could not probe fw (-12)
[   10.586131] ath10k_ahb a000000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[   10.586228] ath10k_ahb a000000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   10.599103] ath10k_ahb a000000.wifi: firmware ver 10.4b-ct-4019-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 6b2b5c5b
[   10.628199] ath10k_ahb a000000.wifi: failed to fetch board data for bus=ahb,vendor=0000,device=0000,subsystem-vendor=0000,subsystem-device=0000,variant=AVM-FRITZRepeat from ath10k/QCA4019/hw1.0/board-2.bin
[   10.696017] ath10k_ahb a000000.wifi: failed to fetch board-2.bin or board.bin from ath10k/QCA4019/hw1.0
[   10.696066] ath10k_ahb a000000.wifi: failed to fetch board file: -12
[   10.704538] ath10k_ahb a000000.wifi: could not probe fw (-12)
[   11.745336] ath10k_ahb a800000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[   11.745394] ath10k_ahb a800000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   11.758191] ath10k_ahb a800000.wifi: firmware ver 10.4b-ct-4019-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 6b2b5c5b
[   11.787599] ath10k_ahb a800000.wifi: failed to fetch board data for bus=ahb,vendor=0000,device=0000,subsystem-vendor=0000,subsystem-device=0000,variant=AVM-FRITZRepeat from ath10k/QCA4019/hw1.0/board-2.bin
[   11.878985] ath10k_ahb a800000.wifi: failed to fetch board-2.bin or board.bin from ath10k/QCA4019/hw1.0
[   11.879045] ath10k_ahb a800000.wifi: failed to fetch board file: -12
[   11.887370] ath10k_ahb a800000.wifi: could not probe fw (-12)
[   11.897293] kmodloader: done loading kernel modules from /etc/modules.d/*
[   33.378377] br-lan: port 1(eth0) entered blocking state
[   33.378432] br-lan: port 1(eth0) entered disabled state
[   33.382814] device eth0 entered promiscuous mode
[   34.407917] br-lan: port 1(eth0) entered blocking state
[   34.407999] br-lan: port 1(eth0) entered forwarding state
[   34.416400] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

Yes, similar problem, but yours needs a bit less fixing: The NAND is detected correctly with an OOB size of 128 bytes, but the dts has 4 bit ECC hardcoded.

For OpenWrt, you just need a separate dts with the 8 bit ECC strength set up correctly.

U-Boot is also required for your device, right? Then U-Boot needs a similar patch in order to be able to load OpenWrt from flash (there is also a hardcoded default of 4 Bit ECC).

See the Fritz 7530 PR that is linked in my other thread for the discussion on this topic, it's not yet merged.

Thank you for checking. I'll try to put the new info together in the Github issue. Pull Request I won't be able to create myself, it's way beyond my skills :wink:

Any update on this? This looks like it is not yet fixed.

I recently bought a Fritz!Repeater 3000 and ran into the same issue. I guess other people fail, too. At least the device should be removed from the list of supported hardware.

I do not know if it is possible to make the new model compatible but I could try to support if someone gives me instructions.

The instructions are there, it shouldn't be too hard. But somebody owning the device has to do it.

I have a device but unfortunately I feel a little bit lost. So if you could give me a little bit more advice or point me to documentation that describes how to do this I will try.

There is not much documentation apart from this thread and its links. I would start by doing the following:

  • Set up a build system as described by the developer guide in the Wiki
  • Patch the respective dts in a similar way to the one for the 7530, i.e. remove the ECC restrictions (see here)
  • Build and boot an initramfs image - check if the error message is now gone
  • If everything works, try to install it

It is well possible that U-Boot needs a patch, too. In this case, you need to do the same as I did for the 7530 here.

I was able to setup the build system and run the build.
In staging_dir I can now find target-arm_cortex-a7+neon-vfpv4_musl_eabi and within a image folder that contains the uboot image. But I do not find the other images. Did I miss anything?
Target Images is left to default which means ramdisk and squashfs are selected.