Install fail on Fritz!box 7530 LM

Hi all,

I'm trying to get OpenWRT running on a 7530 LM, but I can't get the firmware to install? I followed the install instructions on Fritz!box 7530.

I can get uboot uploaded to the system okay, and then it pulls the OpenWRT initramfs via TFTP. I then scp over the squashfs and uboot to the system, and write the bootloader to uboot[01], and finally run sysupgrade. It doesn't work though :frowning: It never boots successfully. Is this possibly a flash layout difference in the LM version?

I have a tcpdump from the AVM recovery tool, and when it writes to uboot via FTP (ie it says 'flashing mtd8' in the tool) it does the following:

220 ADAM2 FTP Server ready
USER adam2
331 Password required for adam2
PASS adam2
230 User adam2 successfully logged in
SYST
215 AVM EVA Version 1.10733 0x0 0x46409
TYPE I
200 Type set to BINARY
MEDIA FLSH
200 Media set to MEDIA_FLASH
P@SW
227 Entering Passive Mode (192,168,178,1,131,252)
STOR mtdnand
150 Opening BINARY data connection
226 Transfer complete
BYE
221 Thank you for using the FTP service on ADAM2
221 Goodbye.

later on when it writes the image, it uses the following offsets:

220 ADAM2 FTP Server ready
USER adam2
331 Password required for adam2
PASS adam2
230 User adam2 successfully logged in
SYST
215 AVM EVA Version 1.10733 0x0 0x46409
SETENV memsize 0xe46a100
200 SETENV command successful
SETENV kernel_args_tmp mtdram1=0x8e46a100,0x90000000
200 SETENV command successful
TYPE I
200 Type set to BINARY
MEDIA SDRAM
200 Media set to MEDIA_SDRAM
P@SW
227 Entering Passive Mode (192,168,178,1,220,192)
STOR 0x8e46a100 0x90000000
150 Opening BINARY data connection
226 Transfer complete

Should I try sending the uboot image to mtdnand like that recovery tool does? Or would that be a really bad idea :wink:

Thanks Z

Firmware and boot loader on the device (after AVM reset) are:

Version successfully detected!
    Hardware:	FRITZ!Box 7530
    Bootstrap:	10733
    Firmware:	164.07.21

So I can confirm that the uboot bootloader is stored on flash, as is the squashfs filesystem. But the device just refuses to handover to the uboot on disk. If I catch the pre-boot FTP server and send it uboot, then it will load openwrt from the local filesystem. dmesg output is:

[    0.000000] Linux version 5.4.119 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16122-c2139eef27)) #0 SMP Fri May 28 14:04:04 2021
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt: Machine model: AVM FRITZ!Box 7530
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] On node 0 totalpages: 65024
[    0.000000]   Normal zone: 576 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 65024 pages, LIFO batch:15
[    0.000000] percpu: Embedded 15 pages/cpu s30156 r8192 d23092 u61440
[    0.000000] pcpu-alloc: s30156 r8192 d23092 u61440 alloc=15*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64448
[    0.000000] Kernel command line: 
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 248620K/260096K available (5777K kernel code, 188K rwdata, 872K rodata, 1024K init, 241K bss, 11476K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] random: get_random_bytes called from 0xc0a00bbc with crng_init=0
[    0.000000] arch_timer: cp15 timer(s) running at 48.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb11fd3bfb, max_idle_ns: 440795203732 ns
[    0.000008] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 4398046511096ns
[    0.000022] Switching to timer-based delay loop, resolution 20ns
[    0.000235] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=480000)
[    0.000251] pid_max: default: 32768 minimum: 301
[    0.000450] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.000468] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.001444] CPU: Testing write buffer coherency: ok
[    0.002445] Setting up static identity map for 0x80300000 - 0x80300060
[    0.002581] rcu: Hierarchical SRCU implementation.
[    0.003026] smp: Bringing up secondary CPUs ...
[    0.006080] smp: Brought up 1 node, 4 CPUs
[    0.006099] SMP: Total of 4 processors activated (384.00 BogoMIPS).
[    0.006108] CPU: All CPU(s) started in SVC mode.
[    0.010382] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[    0.010532] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.010558] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.010761] pinctrl core: initialized pinctrl subsystem
[    0.011752] NET: Registered protocol family 16
[    0.012021] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.013191] cpuidle: using governor ladder
[    0.013237] cpuidle: using governor menu
[    0.017950] GPIO line 461 (enable USB3 power) hogged as output/high
[    0.032805] cryptd: max_cpu_qlen set to 1000
[    0.036082] usbcore: registered new interface driver usbfs
[    0.036150] usbcore: registered new interface driver hub
[    0.036206] usbcore: registered new device driver usb
[    0.036253] pps_core: LinuxPPS API ver. 1 registered
[    0.036262] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.036288] PTP clock support registered
[    0.036976] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[    0.038000] clocksource: Switched to clocksource arch_sys_counter
[    0.038777] thermal_sys: Registered thermal governor 'step_wise'
[    0.039057] NET: Registered protocol family 2
[    0.039218] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.039969] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.040013] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear)
[    0.040129] TCP bind hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.040179] TCP: Hash tables configured (established 2048 bind 2048)
[    0.040310] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.040348] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.040603] NET: Registered protocol family 1
[    0.040644] PCI: CLS 0 bytes, default 64
[    0.042445] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[    0.048061] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.048077] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.098146] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248)
[    0.100204] qcom-pcie 40000000.pci: host bridge /soc/pci@40000000 ranges:
[    0.100254] qcom-pcie 40000000.pci:    IO 0x40200000..0x402fffff -> 0x40200000
[    0.100292] qcom-pcie 40000000.pci:   MEM 0x40300000..0x40ffffff -> 0x40300000
[    0.379571] qcom-pcie 40000000.pci: Link up
[    0.379732] qcom-pcie 40000000.pci: PCI host bridge to bus 0000:00
[    0.379753] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.379771] pci_bus 0000:00: root bus resource [io  0x0000-0xfffff] (bus address [0x40200000-0x402fffff])
[    0.379786] pci_bus 0000:00: root bus resource [mem 0x40300000-0x40ffffff]
[    0.379827] pci 0000:00:00.0: [17cb:1001] type 01 class 0x060400
[    0.379865] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x00000fff]
[    0.379936] pci 0000:00:00.0: PME# supported from D0 D3hot
[    0.381362] PCI: bus0: Fast back to back transfers disabled
[    0.381563] pci 0000:01:00.0: [8086:09a9] type 00 class 0x028000
[    0.381688] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x007fffff]
[    0.382177] pci 0000:01:00.0: supports D1 D2
[    0.382191] pci 0000:01:00.0: PME# supported from D0 D1 D3hot D3cold
[    0.383721] PCI: bus1: Fast back to back transfers disabled
[    0.383770] pci 0000:00:00.0: BAR 8: assigned [mem 0x40800000-0x40ffffff]
[    0.383789] pci 0000:00:00.0: BAR 0: assigned [mem 0x40300000-0x40300fff]
[    0.383810] pci 0000:01:00.0: BAR 0: assigned [mem 0x40800000-0x40ffffff]
[    0.383840] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    0.383857] pci 0000:00:00.0:   bridge window [mem 0x40800000-0x40ffffff]
[    0.386599] pcieport 0000:00:00.0: AER: enabled with IRQ 94
[    0.388347] bam-dma-engine 8e04000.dma: num-channels unspecified in dt
[    0.388366] bam-dma-engine 8e04000.dma: num-ees unspecified in dt
[    0.389629] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000
[    0.389721] tcsr 194b000.tcsr: setting usb hs phy mode select = e700e7
[    0.389802] tcsr 1953000.ess_tcsr: setting ess interface select = 0
[    0.389887] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222
[    0.390205] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.391997] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.392043] msm_serial 78af000.serial: uartclk = 1843200
[    0.392100] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 24, base_baud = 115200) is a MSM
[    0.392128] msm_serial: console setup on port #0
[    1.032432] printk: console [ttyMSM0] enabled
[    1.037344] msm_serial: driver initialized
[    1.046187] loop: module loaded
[    1.047586] nand: device found, Manufacturer ID: 0x98, Chip ID: 0xf1
[    1.048431] nand: Toshiba NAND 128MiB 3,3V 8-bit
[    1.054971] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.059683] 11 fixed-partitions partitions found on MTD device qcom_nand.0
[    1.066949] Creating 11 MTD partitions on "qcom_nand.0":
[    1.073838] 0x000000000000-0x000000080000 : "SBL1"
[    1.080716] 0x000000080000-0x000000100000 : "MIBIB"
[    1.085203] 0x000000100000-0x000000180000 : "QSEE"
[    1.090071] 0x000000180000-0x0000001c0000 : "CDT"
[    1.094643] 0x0000001c0000-0x000000240000 : "QSEE_B"
[    1.099673] 0x000000240000-0x000000280000 : "urlader0"
[    1.104389] 0x000000280000-0x0000002c0000 : "urlader1"
[    1.109414] 0x0000002c0000-0x000000b00000 : "nand-tffs"
[    1.122196] 0x000000b00000-0x000000f00000 : "uboot0"
[    1.126899] 0x000000f00000-0x000001300000 : "uboot1"
[    1.128263] random: fast init done
[    1.134542] 0x000001300000-0x000008000000 : "ubi"
[    1.241431] libphy: ipq4019_mdio: probed
[    1.266443] ESS reset ok!
[    1.290585] ESS reset ok!
[    1.710495] libphy: Fixed MDIO Bus: probed
[    1.718948] i2c /dev entries driver
[    1.720838] sdhci: Secure Digital Host Controller Interface driver
[    1.721243] sdhci: Copyright(c) Pierre Ossman
[    1.727489] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.735269] NET: Registered protocol family 10
[    1.738896] Segment Routing with IPv6
[    1.741982] NET: Registered protocol family 17
[    1.745686] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.750027] 8021q: 802.1Q VLAN Support v1.8
[    1.763144] Registering SWP/SWPB emulation handler
[    1.776794] UBI: auto-attach mtd10
[    1.776833] ubi0: attaching mtd10
[    2.552709] ubi0: scanning is finished
[    2.569872] ubi0: attached mtd10 (name "ubi", size 109 MiB)
[    2.569911] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    2.574258] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    2.581254] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    2.588107] ubi0: good PEBs: 871, bad PEBs: 1, corrupted PEBs: 0
[    2.594831] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[    2.601112] ubi0: max/mean erase counter: 29/16, WL threshold: 4096, image sequence number: 359334324
[    2.608140] ubi0: available PEBs: 0, total reserved PEBs: 871, PEBs reserved for bad PEB handling: 19
[    2.617437] ubi0: background thread "ubi_bgt0d" started, PID 104
[    2.618730] block ubiblock0_1: created from ubi0:1(rootfs)
[    2.632708] ubiblock: device ubiblock0_1 (rootfs) set to be root filesystem
[    2.638013] hctosys: unable to open rtc device (rtc0)
[    2.650830] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    2.652435] Freeing unused kernel memory: 1024K
[    2.678237] Run /sbin/init as init process
[    3.108754] init: Console is alive
[    3.108978] init: - watchdog -
[    3.376327] random: crng init done
[    3.732807] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.994280] dwc3-qcom 8af8800.usb3: IRQ hs_phy_irq not found
[    3.994319] dwc3-qcom 8af8800.usb3: IRQ dp_hs_phy_irq not found
[    3.999050] dwc3-qcom 8af8800.usb3: IRQ dm_hs_phy_irq not found
[    4.004671] dwc3-qcom 8af8800.usb3: IRQ ss_phy_irq not found
[    4.012630] dwc3 8a00000.dwc3: Failed to get clk 'ref': -2
[    4.143281] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    4.143445] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
[    4.148385] xhci-hcd xhci-hcd.0.auto: hcc params 0x0228f665 hci version 0x100 quirks 0x0000000002010010
[    4.155473] xhci-hcd xhci-hcd.0.auto: irq 98, io mem 0x08a00000
[    4.165526] hub 1-0:1.0: USB hub found
[    4.170598] hub 1-0:1.0: 1 port detected
[    4.174679] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    4.178483] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
[    4.183725] xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0 SuperSpeed
[    4.193915] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    4.198453] hub 2-0:1.0: USB hub found
[    4.206151] hub 2-0:1.0: 1 port detected
[    4.211865] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.224186] init: - preinit -
[    8.661687] UBIFS (ubi0:2): Mounting in unauthenticated mode
[    8.661900] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 191
[    8.704769] UBIFS (ubi0:2): recovery needed
[    8.854646] UBIFS (ubi0:2): recovery completed
[    8.855050] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data"
[    8.858160] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    8.865947] UBIFS (ubi0:2): FS size: 99803136 bytes (95 MiB, 786 LEBs), journal size 4952064 bytes (4 MiB, 39 LEBs)
[    8.875935] UBIFS (ubi0:2): reserved for root: 4713948 bytes (4603 KiB)
[    8.886139] UBIFS (ubi0:2): media format: w5/r0 (latest is w5/r0), UUID 4D69C5C8-4D36-4DB0-9D37-108BB66C783D, small LPT model
[    8.902490] mount_root: switching to ubifs overlay
[    8.922243] urandom-seed: Seeding with /etc/urandom.seed
[    9.004693] procd: - early -
[    9.004804] procd: - watchdog -
[    9.599801] procd: - watchdog -
[    9.609244] procd: - ubus -
[    9.695798] procd: - init -
[   10.440301] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.483978] urngd: v1.0.2 started.
[   10.515151] Loading modules backported from Linux version v5.10.34-0-g0aa66717f684
[   10.515190] Backport generated by backports.git v5.10.34-1-0-g7b5533e1
[   10.532812] xt_time: kernel timezone is -0000
[   10.561634] PPP generic driver version 2.4.2
[   10.562489] NET: Registered protocol family 24
[   11.718545] ath10k_ahb a000000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[   11.718595] ath10k_ahb a000000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   11.730071] ath10k_ahb a000000.wifi: firmware ver 10.4b-ct-4019-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 6b2b5c5b
[   11.811611] ath10k_ahb a000000.wifi: board_file api 2 bmi_id 0:20 crc32 e2dfaa91
[   13.099032] ath10k_ahb a000000.wifi: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   13.099083] ath10k_ahb a000000.wifi: msdu-desc: 2500  skid: 32
[   13.134531] ath10k_ahb a000000.wifi: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   13.135516] ath10k_ahb a000000.wifi: wmi print 'free: 53252 iram: 13432 sram: 35752'
[   13.320414] ath10k_ahb a000000.wifi: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1
[   13.571893] ath: EEPROM regdomain sanitized
[   13.571905] ath: EEPROM regdomain: 0x64
[   13.571911] ath: EEPROM indicates we should expect a direct regpair map
[   13.571922] ath: Country alpha2 being used: 00
[   13.571926] ath: Regpair used: 0x64
[   13.998520] ath10k_ahb a800000.wifi: loading /lib/firmware/ath10k/pre-cal-ahb-a800000.wifi.bin failed with error -22
[   14.506995] ath10k_ahb a800000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[   14.507051] ath10k_ahb a800000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   14.519894] ath10k_ahb a800000.wifi: firmware ver 10.4b-ct-4019-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 6b2b5c5b
[   14.547368] ath10k_ahb a800000.wifi: failed to fetch board data for bus=ahb,vendor=0000,device=0000,subsystem-vendor=0000,subsystem-device=0000,variant=AVM-FRITZBox-75 from ath10k/QCA4019/hw1.0/board-2.bin
[   14.618990] ath10k_ahb a800000.wifi: failed to fetch board-2.bin or board.bin from ath10k/QCA4019/hw1.0
[   14.619038] ath10k_ahb a800000.wifi: failed to fetch board file: -12
[   14.627222] ath10k_ahb a800000.wifi: could not probe fw (-12)
[   14.638381] kmodloader: done loading kernel modules from /etc/modules.d/*
[   19.510255] br-lan: port 1(eth0) entered blocking state
[   19.510301] br-lan: port 1(eth0) entered disabled state
[   19.514720] device eth0 entered promiscuous mode
[   20.568174] br-lan: port 1(eth0) entered blocking state
[   20.568219] br-lan: port 1(eth0) entered forwarding state
[   20.572753] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

It refuses to boot normally though, and for some reason it doesn't recognise the 5Ghz radio. Perhaps this LM variant is unsupported?

The above is from 21.02rc2, but I've tried various versions including 19.07.8 (none see the second radio)

Hi

Not shure wheter you would have to install the extra package
https://openwrt.org/packages/pkgdata/ipq-wifi-avm_fritzbox-7530?

Neither I do know how it would be to install. Background: I am reluctant to flash an AVM Repeater 3000, also maybe needing such a similar extra file. Nobody herre seems to mention the install procedure in more detail, and if it is needed any longer for 21-02 ... ???

Thanks daihedz, that looks like it'll probably fix my 5g radio not being recognized :slight_smile:

Now I just need it to boot without manually providing uboot :confused:

If you are referring to the name printed on the bottom of the device, that is not a separate device variant. It is just the default name for the wireless network on stock firmware.

Thanks @janh - my mistake :slight_smile:

In which case, why won't it boot??? Grrrrrr. Everything is installed on the flash, but it refuses to load uboot from flash. If I don't catch the FTP server at start up it goes into a failure mode with the Info led flashing red.

So I soldered some pins onto the serial header on the board.

When I run the sysupgrade I see the following in the console:

[   20.169092] br-lan: port 1(eth0) entered blocking state
[   20.169133] br-lan: port 1(eth0) entered forwarding state
[   20.173499] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
Watchdog handover: fd=3
- watchdog -
killall: telnetd: no process killed
killall: ash: no process killed
Sending TERM to remaining processes ... ntpd dnsmasq ubusd askfirst urngd logd rpcd netifd odhcpd uhttpd 
Sending KILL to remaining processes ... ntpd  
Performing system upgrade...
[  138.472011] ubi0: attaching mtd10 
[  138.472592] ubi0 warning: 0xc05b1ec8: error -74 (ECC error) while reading 64 bytes from PEB 0:0, read only 64 bytes, retry 
[  138.474631] ubi0 warning: 0xc05b1ec8: error -74 (ECC error) while reading 64 bytes from PEB 0:0, read only 64 bytes, retry 
[  138.485706] ubi0 warning: 0xc05b1ec8: error -74 (ECC error) while reading 64 bytes from PEB 0:0, read only 64 bytes, retry 
[  138.496612] ubi0 error: 0xc05b1eec: error -74 (ECC error) while reading 64 bytes from PEB 0:0, read 64 bytes 
[  138.507347] CPU: 1 PID: 1565 Comm: ubiattach Not tainted 4.14.241 #0
[  138.517280] Hardware name: Generic DT based system
[  138.523622] Function entered at [<c030e2a8>] from [<c030a7b8>]
[  138.528218] Function entered at [<c030a7b8>] from [<c0742714>]
[  138.534034] Function entered at [<c0742714>] from [<c05b1ef0>]
[  138.539850] Function entered at [<c05b1ef0>] from [<c05b21e8>]
[  138.545664] Function entered at [<c05b21e8>] from [<c05b6ecc>]
[  138.551482] Function entered at [<c05b6ecc>] from [<c05ac5b4>]
[  138.557297] Function entered at [<c05ac5b4>] from [<c05ad09c>]
[  138.563113] Function entered at [<c05ad09c>] from [<c03f8b30>]
[  138.568930] Function entered at [<c03f8b30>] from [<c03f8bd4>]
[  138.574744] Function entered at [<c03f8bd4>] from [<c03073c0>]
[  138.581363] ubi0 warning: 0xc05b1ec8: error -74 (ECC error) while reading 64 bytes from PEB 1:0, read only 64 bytes, retry 
[  138.586662] ubi0 warning: 0xc05b1ec8: error -74 (ECC error) while reading 64 bytes from PEB 1:0, read only 64 bytes, retry 
[  138.597700] ubi0 warning: 0xc05b1ec8: error -74 (ECC error) while reading 64 bytes from PEB 1:0, read only 64 bytes, retry 
[  138.608750] ubi0 error: 0xc05b1eec: error -74 (ECC error) while reading 64 bytes from PEB 1:0, read 64 bytes 
[  138.619486] CPU: 1 PID: 1565 Comm: ubiattach Not tainted 4.14.241 #0
[  138.629434] Hardware name: Generic DT based system
[  138.635776] Function entered at [<c030e2a8>] from [<c030a7b8>]
[  138.640372] Function entered at [<c030a7b8>] from [<c0742714>]
[  138.646189] Function entered at [<c0742714>] from [<c05b1ef0>]
[  138.652115] Function entered at [<c05b1ef0>] from [<c05b21e8>]
[  138.657928] Function entered at [<c05b21e8>] from [<c05b6ecc>]
[  138.663746] Function entered at [<c05b6ecc>] from [<c05ac5b4>]
[  138.669560] Function entered at [<c05ac5b4>] from [<c05ad09c>]
[  138.675376] Function entered at [<c05ad09c>] from [<c03f8b30>]
[  138.681192] Function entered at [<c03f8b30>] from [<c03f8bd4>]
[  138.687005] Function entered at [<c03f8bd4>] from [<c03073c0>]

That goes on for a long time, then...

[  262.589725] ubi0 warning: 0xc05b1ec8: error -74 (ECC error) while reading 22528 bytes from PEB 150:4096, read only 22528 bytes, retry
[  262.594599] ubi0 warning: 0xc05b1ec8: error -74 (ECC error) while reading 22528 bytes from PEB 150:4096, read only 22528 bytes, retry
[  262.606677] ubi0 warning: 0xc05b1ec8: error -74 (ECC error) while reading 22528 bytes from PEB 150:4096, read only 22528 bytes, retry
[  262.618663] ubi0 error: 0xc05b1eec: error -74 (ECC error) while reading 22528 bytes from PEB 150:4096, read 22528 bytes
[  262.627676] CPU: 0 PID: 1565 Comm: ubiattach Not tainted 4.14.241 #0
[  262.638234] Hardware name: Generic DT based system
[  262.644835] Function entered at [<c030e2a8>] from [<c030a7b8>]
[  262.649433] Function entered at [<c030a7b8>] from [<c0742714>]
[  262.655249] Function entered at [<c0742714>] from [<c05b1ef0>]
[  262.661064] Function entered at [<c05b1ef0>] from [<c05a8d18>]
[  262.666880] Function entered at [<c05a8d18>] from [<c05b7fac>]
[  262.672695] Function entered at [<c05b7fac>] from [<c05ac5b4>]
[  262.678511] Function entered at [<c05ac5b4>] from [<c05ad09c>]
[  262.684327] Function entered at [<c05ad09c>] from [<c03f8b30>]
[  262.690144] Function entered at [<c03f8b30>] from [<c03f8bd4>]
[  262.695959] Function entered at [<c03f8bd4>] from [<c03073c0>]
[  262.702718] ubi0 error: 0xc05a8514: bad CRC at record 2: 0x6629f472, not 0x75c8d58
[  262.707593] Volume table record 2 dump:
[  262.715157]  reserved_pebs   17
[  262.718869]  alignment       1
[  262.722019]  data_pad        0
[  262.725119]  vol_type        1
[  262.728156]  upd_marker      0
[  262.731212]  name_len        10
[  262.734235]  name            avm_config
[  262.737273]  crc             0x75c8d58
[  262.741134] ubi0 error: 0xc05a8514: bad CRC at record 2: 0x6629f472, not 0x75c8d58
[  262.744919] Volume table record 2 dump:
[  262.752481]  reserved_pebs   17
[  262.756196]  alignment       1
[  262.759345]  data_pad        0
[  262.762446]  vol_type        1
[  262.765484]  upd_marker      0
[  262.768521]  name_len        10
[  262.771575]  name            avm_config
[  262.774601]  crc             0x75c8d58
[  262.778423] ubi0 error: 0xc05a8e10: both volume tables are corrupted
[  262.782590] ubi0 error: 0xc05ac5d4: failed to attach mtd10, error -22
ubiattach: error!: cannot attach mtd10
           error 22 (Invalid argument)
ubiformat: mtd10 (nand), size 114294784 bytes (109.0 MiB), 872 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes

followed by an erase/scan

[  271.413630] ubi0: scanning is finished
[  271.420948] ubi0: attached mtd10 (name "ubi", size 109 MiB)
[  271.420979] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[  271.425327] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[  271.432311] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[  271.439148] ubi0: good PEBs: 871, bad PEBs: 1, corrupted PEBs: 0
[  271.445903] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128 
[  271.452165] ubi0: max/mean erase counter: 40/22, WL threshold: 4096, image sequence number: 1176265960
[  271.459206] ubi0: available PEBs: 848, total reserved PEBs: 23, PEBs reserved for bad PEB handling: 19 
[  271.468491] ubi0: background thread "ubi_bgt0d" started, PID 1574
UBI device number 0, total 871 LEBs (110596096 bytes, 105.4 MiB), available 848 LEBs (107675648 bytes, 102.6 MiB), LEB size 126976 bytes (124.0 KiB) 
Volume ID 0, size 17 LEBs (2158592 bytes, 2.0 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
Volume ID 1, size 24 LEBs (3047424 bytes, 2.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 102469632
Volume ID 2, size 807 LEBs (102469632 bytes, 97.7 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
umount: can't unmount /: Invalid argument

and then it fails to boot with

[NAND:] 128MB TOSHIBA 2048 Pagesize 128k Blocksize 1024 Blocks HW
[SYSTEM:] CortexA9

Eva_AVM ><ERROR Flash Status 0xC03030>
NAND page read failed. page: 1600 status -74
<ERROR Flash Status 0xC03030>
NAND page read failed. page: 1600 status -74
<ERROR Flash Status 0xC03030>

snip

<ERROR Flash Status 0xC03030>
NAND page read failed. page: 163B status -74
<ERROR Flash Status 0xC03030>
NAND page read failed. page: 163C status -74
crc failed  build=0xDC374A0E read=0x6C55BE38

<ERROR: FIRMWARE_ILLEGAL_CONFIG>

I resurrect this thread because I'm experiencing the same problem on my FRITZ!Box 7530. In my case, the NAND chip is a Toshiba TC58NVG0S3HTA00 which is not correctly identified by U-Boot and Linux.

Could you check what markings your IC has?

The problem for my NAND is that the OOB size is detected as 64 bytes while it should be 128 bytes.