I bricked xiaomi mi router 4a (R4AC) I have UART console now what?

Installing and Using OpenWrt
1

I used the OpenWRTInvasion method to flash openwrt Snapshot, then upgraded to this: https://downloads.openwrt.org/releases/22.03.2/targets/ramips/mt76x8/xiaomi_mi-router-4a-100m-intl-squashfs-sysupgrade.bin

which bricked the router.

I tried the TFTP method, the hoddysguides method nothing worked, so I decided to go for uart.
Here is what I'm getting when I boot:

U-Boot 1.1.3 (Nov 24 2021 - 02:49:49)


Board: Ralink APSoC DRAM:  64 MB
Power on memory test. Memory size= 64 MB...OK!
relocate_code Pointer at: 83fb0000
RT2880_RSTSTAT_REG 0xc0030204
******************************
Software System Reset Occurred
******************************
flash manufacture id: 1c, device id 71 18
find flash: EN25QX128A
env is right!
============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Nov 24 2021  Time:02:49:49
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 575 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP.

   n3: System Boot system code via Flash.
Booting System 1
## Booting image at bc260000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.146
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2196224 Bytes =  2.1 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
commandline uart_en=0 factory_mode=0 mem=64m root=/dev/mtdblock8
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 5.10.146 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r19803-9a599fee93) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Fri Oct 14 22:44:41 2022
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is Xiaomi Mi Router 4A (100M International Edition)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 56416K/65536K available (5669K kernel code, 616K rwdata, 692K rodata, 1204K init, 209K bss, 9120K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] intc: using register map from devicetree
[    0.000000] CPU Clock: 575MHz
[    0.000000] timer_probe: no matching timers found
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6647862422 ns
[    0.000010] sched_clock: 32 bits at 287MHz, resolution 3ns, wraps every 7469508094ns
[    0.007647] Calibrating delay loop... 380.92 BogoMIPS (lpj=1904640)
[    0.073534] pid_max: default: 32768 minimum: 301
[    0.078171] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.085191] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.095088] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.106413] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.115933] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.122575] pinctrl core: initialized pinctrl subsystem
[    0.132695] NET: Registered protocol family 16
[    0.137850] thermal_sys: Registered thermal governor 'step_wise'
[    0.247668] mt7620-pci 10140000.pcie: Port 0 N_FTS = 1b105000
[    0.408124] PCI host bridge /pcie@10140000 ranges:
[    0.412703]  MEM 0x0000000020000000..0x000000002fffffff
[    0.417735]   IO 0x0000000010160000..0x000000001016ffff
[    0.472503] PCI host bridge to bus 0000:00
[    0.476425] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.483151] pci_bus 0000:00: root bus resource [io  0x10160000-0x1016ffff]
[    0.489733] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.496293] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.503984] pci 0000:00:00.0: [14c3:0801] type 01 class 0x060400
[    0.509747] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    0.515775] pci 0000:00:00.0: reg 0x14: [mem 0x20200000-0x2020ffff]
[    0.521899] pci 0000:00:00.0: supports D1
[    0.525704] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.533136] pci 0000:01:00.0: [14c3:7662] type 00 class 0x028000
[    0.538921] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit]
[    0.545518] pci 0000:01:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    0.552033] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[    0.559449] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    0.565793] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[    0.572247] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.578575] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.585310] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    0.591850] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[    0.598829] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.605382] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[    0.612454] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[    0.619399] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.624198] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
[    0.630740] pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
[    0.644970] clocksource: Switched to clocksource MIPS
[    0.651250] NET: Registered protocol family 2
[    0.655772] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.663643] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.671833] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.679216] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.686004] TCP: Hash tables configured (established 1024 bind 1024)
[    0.692290] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.698622] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.705667] NET: Registered protocol family 1
[    0.709895] PCI: CLS 0 bytes, default 32
[    0.721363] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.732905] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.738566] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.750249] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    0.759958] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.765684] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.771238] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.776974] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.785922] printk: console [ttyS0] disabled
[    0.790091] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
[    0.798873] printk: console [ttyS0] enabled
[    0.798873] printk: console [ttyS0] enabled
[    0.807273] printk: bootconsole [early0] disabled
[    0.807273] printk: bootconsole [early0] disabled
[    0.818264] spi-mt7621 10000b00.spi: sys_freq: 191666666
[    0.842738] spi-nor spi0.0: unrecognized JEDEC id bytes: 1c 71 18 1c 71 18
[    0.849847] spi-nor: probe of spi0.0 failed with error -2
[    0.903547] rt3050-esw 10110000.esw: mediatek esw at 0xb0110000, irq 25 initialized
[    0.911486] mtk_soc_eth 10100000.ethernet: generated random MAC address 16:a6:bc:f2:90:c4
[    0.920530] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    0.930726] NET: Registered protocol family 10
[    0.940692] Segment Routing with IPv6
[    0.944564] NET: Registered protocol family 17
[    0.949255] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    0.962430] 8021q: 802.1Q VLAN Support v1.8
[    0.969140] /dev/root: Can't open blockdev
[    0.973319] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    0.980972] Please append a correct "root=" boot option; here are the available partitions:
[    0.989475] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    0.997858] Rebooting in 1 seconds..

[04010D09][04010C0F][88890000][24254849][00242548]
DU Setting Cal Done

if I press reset button before I boot with combination TinyPXE I get the following:

DHCPHandler: got packet: (src=67, dst=68, len=308) state: 3
Filtering pkt = 0
DHCPHandler: got DHCP packet: (src=67, dst=68, len=308) state: 3
DHCP: state=SELECTING bp_file: "test.bin"
TRANSITIONING TO REQUESTING STATE
*** Unhandled DHCP Option in OFFER/ACK: 13
*** Unhandled DHCP Option in OFFER/ACK: 28
*** Unhandled DHCP Option in OFFER/ACK: 66
*** Unhandled DHCP Option in OFFER/ACK: 175
Bootfile: test.bin
DhcpSendRequestPkt: Sending DHCPREQUEST
Transmitting DHCPREQUEST packet: len = 343
DHCPHandler: got packet: (src=67, dst=68, len=308) state: 4
Filtering pkt = 0
DHCPHandler: got DHCP packet: (src=67, dst=68, len=308) state: 4
DHCP State: REQUESTING
*** Unhandled DHCP Option in OFFER/ACK: 13
*** Unhandled DHCP Option in OFFER/ACK: 28
*** Unhandled DHCP Option in OFFER/ACK: 66
*** Unhandled DHCP Option in OFFER/ACK: 175
Bootfile: test.bin
DHCP client bound to address 192.168.31.113
TFTP from server 192.168.31.111; our IP address is 192.168.31.113
Filename 'test.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (d0:17:c2:95:03:33)
Got it
T Got ARP REQUEST, return our IP
T T T T T T T T T T T T


Retry count exceeded; starting again

BOOTP broadcast 1
DHCPHandler: got packet: (src=61454, dst=1900, len=175) state: 3
Filtering pkt = -1
DHCPHandler: got packet: (src=61467, dst=1900, len=170) state: 3
Filtering pkt = -1
DHCPHandler: got packet: (src=61454, dst=1900, len=175) state: 3
Filtering pkt = -1
DHCPHandler: got packet: (src=61467, dst=1900, len=170) state: 3
Filtering pkt = -1
BOOTP broadcast 2
DHCPHandler: got packet: (src=61454, dst=1900, len=175) state: 3
Filtering pkt = -1
DHCPHandler: got packet: (src=61467, dst=1900, len=170) state: 3
Filtering pkt = -1
DHCPHandler: got packet: (src=61454, dst=1900, len=175) state: 3
Filtering pkt = -1
DHCPHandler: got packet: (src=61467, dst=1900, len=170) state: 3
Filtering pkt = -1
BOOTP broadcast 3
BOOTP broadcast 4
BOOTP broadcast 5

and it keeps looping back without grabbing the test.bin (i.e. the firmware)

2

It looks like they changed production to a new type of flash chip which is not supported by 22.03, you will need to keep using snapshots.

Usually failure to TFTP is a problem with the TFTP server, these are the most common two reasons:

  • a firewall is active on the TFTP machine
  • the Ethernet port dropped while the router was off, so at the time the router tried to TFTP there was no IP configured on the PC port. Connect an Ethernet switch between the router and the PC.
3 Likes
3

The last thing I doubted was my firewall, but you were right!
I turned it off and got the firmware to be flashed. HOWEVER:

Filename 'miwifi_r4ac_all_c4b35_2.18.28.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (d0:17:c2:95:03:33)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###########Got ARP REQUEST, return our IP
######################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################
done
Bytes transferred = 11398340 (adecc4 hex)
CRC verify success!
RSA signature verify success!
Erasing SPI Flash...
raspi_erase: offs:ff0000 len:10000
.
Writing to SPI Flash...
.
done
Offset[0]: Invalid flash address, skip upgrade...
Upgrade uboot.bin...
raspi_erase_write: offs:0, count:1e8dc
raspi_erase: offs:0 len:10000
.
.
raspi_erase: offs:10000 len:10000
.
.
Done!
Upgrade firmware.bin...
raspi_erase_write: offs:160000, count:ac0004
raspi_erase: offs:160000 len:ac0000
............................................................................................................................................................................
............................................................................................................................................................................
raspi_erase: offs:c20000 len:10000
.
.
Done!
Erasing SPI Flash...
raspi_erase: offs:ff0000 len:10000
.
Writing to SPI Flash...
.
done
========Upgrade success!========
Erasing SPI Flash...
raspi_erase: offs:ff0000 len:10000
.
Writing to SPI Flash...
.
done
.
Writing to SPI Flash...
.
done
## Booting image at bc160000 ...
   Image Name:   MIPS OpenWrt Linux-3.10.14
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1425228 Bytes =  1.4 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
Erasing SPI Flash...
raspi_erase: offs:20000 len:10000
.
Writing to SPI Flash...
.
done
commandline uart_en=0 factory_mode=0 mem=64m root=/dev/mtdblock8
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...


LINUX started...

 THIS IS ASIC
[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.10.14 (jenkins@a0c60680870f) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 MiWiFi-R4AC-2.18.28 Tue Oct 23 13:43:12 UTC 2018
[    0.000000]
[    0.000000]  The CPU feqenuce set to 575 MHz
[    0.000000]
[    0.000000]  MIPS CPU sleep mode enabled.
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] Software DMA cache coherency
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS1,115200n8 uart_en=0 factory_mode=0 mem=64m root=/dev/mtdblock8
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000003
[    0.000000] Readback ErrCtl register=00000003
[    0.000000] allocated 131072 bytes of page_cgroup
[    0.000000] please try 'cgroup_disable=memory' option if you don't want memory cgroups
[    0.000000] Memory: 60488k/65536k available (3212k kernel code, 5048k reserved, 723k data, 220k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:128
[    0.000000] console [ttyS1] enabled
[    0.120000] Calibrating delay loop... 380.92 BogoMIPS (lpj=1904640)
[    0.180000] pid_max: default: 32768 minimum: 301
[    0.180000] Mount-cache hash table entries: 512
[    0.190000] Initializing cgroup subsys memory
[    0.190000] Initializing cgroup subsys net_cls
[    0.200000] NET: Registered protocol family 16
[    0.200000] RALINK_GPIOMODE = 54054404
[    0.210000] RALINK_GPIOMODE = 54044404
[    0.310000] ***** Xtal 25MHz *****
[    0.310000] start PCIe register access
[    0.810000] RALINK_RSTCTRL = 2400000
[    0.820000] RALINK_CLKCFG1 = fdbfffc0
[    0.820000]
[    0.820000] *************** MT7628 PCIe RC mode *************
[    1.320000] PCIE0 enabled
[    1.320000] Port 0 N_FTS = 1b105000
[    1.330000] init_rt2880pci done
[    1.350000] bio: create slab <bio-0> at 0
[    1.360000] PCI host bridge to bus 0000:00
[    1.360000] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    1.370000] pci_bus 0000:00: root bus resource [io  0x10160000-0x1016ffff]
[    1.370000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.380000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.380000] pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
[    1.390000] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    1.390000] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[    1.400000] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    1.400000] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[    1.410000] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[    1.410000] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.420000] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
[    1.420000] pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
[    1.430000] BAR0 at slot 0 = 0
[    1.430000] bus=0x0, slot = 0x0
[    1.430000] res[0]->start = 0
[    1.430000] res[0]->end = 0
[    1.440000] res[1]->start = 20200000
[    1.440000] res[1]->end = 2020ffff
[    1.440000] res[2]->start = 0
[    1.450000] res[2]->end = 0
[    1.450000] res[3]->start = 0
[    1.450000] res[3]->end = 0
[    1.450000] res[4]->start = 0
[    1.460000] res[4]->end = 0
[    1.460000] res[5]->start = 0
[    1.460000] res[5]->end = 0
[    1.460000] bus=0x1, slot = 0x0
[    1.470000] res[0]->start = 20000000
[    1.470000] res[0]->end = 200fffff
[    1.470000] res[1]->start = 0
[    1.480000] res[1]->end = 0
[    1.480000] res[2]->start = 0
[    1.480000] res[2]->end = 0
[    1.480000] res[3]->start = 0
[    1.490000] res[3]->end = 0
[    1.490000] res[4]->start = 0
[    1.490000] res[4]->end = 0
[    1.490000] res[5]->start = 0
[    1.500000] res[5]->end = 0
[    1.500000] cfg80211: Calling CRDA to update world regulatory domain
[    1.510000] Switching to clocksource Ralink Systick timer
[    1.510000] NET: Registered protocol family 2
[    1.520000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    1.520000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    1.530000] TCP: Hash tables configured (established 512 bind 512)
[    1.530000] TCP: reno registered
[    1.540000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.540000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.550000] NET: Registered protocol family 1
[    1.570000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.570000] jffs2: version 2.2. (ZLIB) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.580000] msgmni has been set to 118
[    1.590000] io scheduler noop registered
[    1.590000] io scheduler deadline registered (default)
[    1.600000] MIWIFI panic notifier registered
[    1.600000] pcieport 0000:00:00.0: device [14c3:0801] has invalid IRQ; check vendor BIOS
[    1.620000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.620000] serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
[    1.630000] serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
[    1.640000] led=44, on=4000, off=1, blinks,=1, reset=1, time=4000
[    1.640000] Ralink gpio driver initialized
[    1.650000] flash manufacture id: 1c, device id 71 18
[    1.650000] Warning: un-recognized chip ID, please update SPI driver!
[    1.660000] EN25F16(1c 31151c31) (2048 Kbytes)
[    1.660000] mtd .name = raspi, .size = 0x00200000 (2M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
[    1.670000] Creating 9 MTD partitions on "raspi":
[    1.680000] 0x000000000000-0x000000200000 : "ALL"
[    1.690000] 0x000000000000-0x000000020000 : "Bootloader"
[    1.690000] 0x000000020000-0x000000030000 : "Config"
[    1.700000] 0x000000030000-0x000000040000 : "Factory"
[    1.710000] 0x000000040000-0x000000050000 : "crash"
[    1.710000] 0x000000050000-0x000000060000 : "cfg_bak"
[    1.720000] 0x000000060000-0x000000160000 : "overlay"
[    1.730000] 0x000000160000-0x000000dc0000 : "OS1"
[    1.730000] mtd: partition "OS1" extends beyond the end of device "raspi" -- size truncated to 0xa0000
[    1.740000] mtd: try split OS1 partition
[    1.750000] mtd: split_firmware
[    1.750000] mtd: firmware_partition->size   0xc60000
[    1.750000] mtd: firmware_partition->offset 0x160000
[    1.760000] mtd: uimage_len 1425292
[    1.760000] mtd: uimage_len 1441792
[    1.770000] mtd: rootfs_partition->size   0xb00000
[    1.770000] mtd: rootfs_partition->offset 0x2c0000
[    1.780000] mtd: partition "rootfs" created automatically, ofs=2C0000, len=B00000
[    1.780000] 0x0000002c0000-0x000000dc0000 : "rootfs"
[    1.790000] mtd: partition "rootfs" is out of reach -- disabled
[    1.800000] 0x000000dc0000-0x000001000000 : "disk"
[    1.800000] mtd: partition "disk" is out of reach -- disabled
[    1.810000] PPP generic driver version 2.4.2
[    1.810000] PPP MPPE Compression module registered
[    1.820000] NET: Registered protocol family 24
[    1.820000] PPTP driver version 0.8.5
[    1.830000] GMAC1_MAC_ADRH -- : 0x00005c02
[    1.830000] GMAC1_MAC_ADRL -- : 0x14c6a34c
[    1.840000] Ralink APSoC Ethernet Driver Initilization. v3.1  256 rx/tx descriptors allocated, mtu = 1500!
[    1.850000] GMAC1_MAC_ADRH -- : 0x00005c02
[    1.850000] GMAC1_MAC_ADRL -- : 0x14c6a34c
[    1.860000] PROC INIT OK!
[    1.860000] Ralink APSoC Hardware Watchdog Timer
[    1.860000] Mirror/redirect action on
[    1.870000] u32 classifier
[    1.870000]     input device check on
[    1.870000]     Actions configured
[    1.880000] Netfilter messages via NETLINK v0.30.
[    1.880000] nfnl_acct: registering with nfnetlink.
[    1.890000] nf_conntrack version 0.5.0 (945 buckets, 3780 max)
[    1.890000] ipip: IPv4 over IPv4 tunneling driver
[    1.900000] gre: GRE over IPv4 demultiplexor driver
[    1.900000] ip_gre: GRE over IPv4 tunneling driver
[    1.910000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.920000] Type=Restricted Cone
[    1.920000] TCP: cubic registered
[    1.930000] NET: Registered protocol family 10
[    1.930000] NET: Registered protocol family 17
[    1.940000] l2tp_core: L2TP core driver, V2.0
[    1.940000] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[    1.950000] l2tp_netlink: L2TP netlink interface
[    1.950000] 8021q: 802.1Q VLAN Support v1.8
[    1.970000] end_request: I/O error, dev mtdblock8, sector 0
[    1.980000] SQUASHFS error: squashfs_read_data failed to read block 0x0
[    1.980000] SQUASHFS error: unable to read squashfs_super_block
[    1.990000] VFS: Cannot open root device "mtdblock8" or unknown-block(31,8): error -5
[    2.000000] Please append a correct "root=" boot option; here are the available partitions:
[    2.010000] 1f00            2048 mtdblock0  (driver?)
[    2.010000] 1f01             128 mtdblock1  (driver?)
[    2.020000] 1f02              64 mtdblock2  (driver?)
[    2.020000] 1f03              64 mtdblock3  (driver?)
[    2.030000] 1f04              64 mtdblock4  (driver?)
[    2.030000] 1f05              64 mtdblock5  (driver?)
[    2.040000] 1f06            1024 mtdblock6  (driver?)
[    2.040000] 1f07             640 mtdblock7  (driver?)
[    2.050000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,8)
[    2.050000] Rom Version: 3.0.15
[    2.050000] Trying to store crash
[    2.050000] 11979 bytes dumped, 11979 bytes saved.

I'm stuck here now.

when I try fo flash openwrt directly I get:

done
Bytes transferred = 5440838 (530546 hex)
TRX MAGIC error!
Header check error!
Image verify failed!
========Upgrade fail!========