IPQ4019: Adding Support For Tp Link Deco M9 Plus

Yes - your comments are appreciated :smiley: I've tried with 8 pins before, but the TP-Link original dtsi only has four. They also define the ts_0_ pins without referencing them as well.

I'm guessing the sd_ldo_gpios in qcom-ipq4019-whw03.dts isn't picked up during boot. It's the exact same as in TP-Links dts and they have code in sdhc-mmc.c that reads it and that code isn't in the regular kernel driver. I have added it and it "works" (gets the wrong pin number for some reason, but I've also hardcoded 33 to see if that made a difference and it didn't).

Where I lack knowledge is how come adding these mmc definitions got the eMMC detected, with the correct partitions and sizes etc, but a strange (read lots of discussions) cache reset error and then I/O errors. I'm thinking DMA maybe - there is a printout in the bootlog that I should track down the cause of:

[ 0.547751] qcom-pcie 40000000.pci: Invalid eDMA IRQs found

TP-Link original bootlog:

[    0.460849] pci_bus 0000:00: root bus resource [io  0x40200000-0x402fffff]
[    0.460865] pci_bus 0000:00: root bus resource [mem 0x40300000-0x40ffffff]
[    0.460880] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.460965] msm_pcie_oper_conf: msm_pcie_oper_conf: Read of RC0 0:0x00 + 0x0014[4] is all FFs
[    0.461397] PCI: bus0: Fast back to back transfers disabled
[    0.461417] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.461693] msm_pcie_oper_conf: msm_pcie_oper_conf: Read of RC0 1:0x00 + 0x0014[4] is all FFs
[    0.462253] PCI: bus1: Fast back to back transfers disabled
[    0.462346] msm_pcie_oper_conf: msm_pcie_oper_conf: Read of RC0 0:0x00 + 0x0028[4] is all FFs
[    0.462382] pci 0000:00:00.0: BAR 8: assigned [mem 0x40400000-0x405fffff]
[    0.462400] pci 0000:00:00.0: BAR 0: assigned [mem 0x40300000-0x40300fff 64bit]
[    0.462432] pci 0000:01:00.0: BAR 0: assigned [mem 0x40400000-0x405fffff 64bit]
[    0.462472] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.462493] pci 0000:00:00.0:   bridge window [mem 0x40400000-0x405fffff]

Take note of the memory ranges above. This is the definition of PCIe in the current top parent qcom-ipq4019.dts:

ranges = <0x81000000 0x0 0x00000000 0x40200000 0x0 0x00100000>,
		<0x82000000 0x0 0x40300000 0x40300000 0x0 0x00d00000>;

... and this is (my current) OpenWRT bootlog:

[    1.514180] qcom-pcie 40000000.pci: PCI host bridge to bus 0000:00
[    1.518249] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.524446] pci_bus 0000:00: root bus resource [io  0x0000-0xfffff]
[    1.529874] pci_bus 0000:00: root bus resource [mem 0x40300000-0x40ffffff]
[    1.536094] pci 0000:00:00.0: [17cb:1001] type 01 class 0x060400
[    1.542993] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x00000fff]
[    1.549224] pci 0000:00:00.0: PME# supported from D0 D3hot
[    1.557137] PCI: bus0: Fast back to back transfers disabled
[    1.560900] PCI: bus1: Fast back to back transfers enabled
[    1.566237] pci 0000:00:00.0: BAR 0: assigned [mem 0x40300000-0x40300fff]
[    1.571722] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    1.589548] pci_bus 0000:00: resource 4 [io  0x0000-0xfffff]
[    1.594473] pci_bus 0000:00: resource 5 [mem 0x40300000-0x40ffffff]

With the changes from old kernel to new kernel in mind, this is what I'm looking at right now - the differences here like the missing (?) memory range, BAR 8 etc. But it's of course all shots in the dark since I don't know how that would effect my eMMC issue.

edit: Well that was surprising, this is from another boot where I had not made any changes to PCIe:

[    0.816102] pci 0000:00:00.0: BAR 8: assigned [mem 0x40400000-0x405fffff]
[    0.832275] pci 0000:00:00.0: BAR 0: assigned [mem 0x40300000-0x40300fff]
[    0.847055] pci 0000:01:00.0: BAR 0: assigned [mem 0x40400000-0x405fffff 64bit]
[    0.860595] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    0.873862] pci 0000:00:00.0:   bridge window [mem 0x40400000-0x405fffff]

But even seeing these I still had the same eMMC issue so I'll skip this line of thought again.

Trivia: qcom-ipq4019-r619ac.dtsi also has the same four-pin SD config as the TP-Link (and copying their muxes doesn't make a difference).

I've tried figuring out what, if anything, TP-Link has changed in their mmc driver. sdhci-msm doesn't exist in the Linux kernel until 3.15, and that version of mmc is also close to the TP-Link one - but they're not the same. The one in the Linux kernel then progressively deviates more and more from the one TP-Link have in their GPL tarball.

Since the Decos run Linux 3.14 I can only assume they pulled in a driver from the vendor back then and have then kept updating it since. Or, this is a pure third party driver and I should look elsewhere than in the Linux kernel of course.

I will assume the error -84 thus is "SDHCI_ADMA_ERROR 0x54". Best would be that they've just hard coded something that's nowadays a quirk that can be enabled.

One of the files that only exist in TP-Links source is gpiommc.c. It's Michael Buesch' code, and when trying to submit it to Linux the comment was that it's been in OpenWRT for a long time.

afaik it's the kernel module "kmod-mmc-over-gpio" - but I can't find it in the latest OpenWRT menuconfig. It seems others have said the same - 6 years ago.

Anyone who's better at finding that module or functionality than me? :smiley:

I was bored ... i took the makefile from here --> https://gitlab.westhousefarm.com/abraha2d/openwrt/-/blob/5403c776333a30c2b3810ee9b25b501eb11a2230/package/mmc_over_gpio/Makefile

I had to remove the menu section ... its not in the correct foirmat and throws errors. But after removing it entirely it compiles fine on 6.6.72. Just create the folder for it in

package/kernel/mmc-over-gpio

and the following makefile

package/kernel/mmc-over-gpio/Makefile

#
# Copyright (C) 2008 OpenWrt.org
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.

include $(TOPDIR)/rules.mk
include $(INCLUDE_DIR)/kernel.mk

PKG_NAME:=mmc-over-gpio
PKG_RELEASE:=4

include $(INCLUDE_DIR)/package.mk

define KernelPackage/mmc-over-gpio
  SUBMENU:=Other modules
  DEPENDS:=@GPIO_SUPPORT +kmod-mmc-spi
  KCONFIG:=CONFIG_GPIOMMC \
	CONFIG_CONFIGFS_FS=y
  TITLE:=MMC/SD card over GPIO support
  FILES:=$(LINUX_DIR)/drivers/mmc/host/gpiommc.ko
  AUTOLOAD:=$(call AutoLoad,93,gpiommc)
  MENU:=1
endef

define Package/kmod-mmc-over-gpio/config

endef

define KernelPackage/mmc-over-gpio/description
	Support for driving an MMC/SD card over GPIO pins via SPI.
endef

define KernelPackage/mmc-over-gpio/conffiles
	/etc/config/mmc_over_gpio
endef

define Build/Prepare
	mkdir -p $(PKG_BUILD_DIR)
endef

define Build/Compile
endef

define KernelPackage/mmc-over-gpio/install
	$(INSTALL_DIR) $(1)/etc/config
	$(INSTALL_DATA) ./files/mmc_over_gpio.config $(1)/etc/config/mmc_over_gpio
	$(INSTALL_DIR) $(1)/etc/init.d
	$(INSTALL_BIN) ./files/mmc_over_gpio.init $(1)/etc/init.d/mmc_over_gpio

	$(SED) 's,@GPIO_DI_PIN@,$(CONFIG_KMOD_MMC_OVER_GPIO_DI_PIN),g' \
		-e 's,@GPIO_DO_PIN@,$(CONFIG_KMOD_MMC_OVER_GPIO_DO_PIN),g' \
		-e 's,@GPIO_CLK_PIN@,$(CONFIG_KMOD_MMC_OVER_GPIO_CLK_PIN),g' \
		-e 's,@GPIO_CS_PIN@,$(CONFIG_KMOD_MMC_OVER_GPIO_CS_PIN),g' \
		$(1)/etc/config/mmc_over_gpio
endef
$(eval $(call KernelPackage,mmc-over-gpio))
make package/mmc-over-gpio/compile V=s

Its untested beyond compiling, it may or may not work beyond that. Should be enough to get you going in any case

2 Likes

I tried to fix the sysupgrade but I am still unsuccessfull.
This is the log of the serial port from my last attempt:

root@OpenWrt:~# sysupgrade -n -v /tmp/openwrt-ipq40xx-generic-tplink_deco-m9plus

-v2-squashfs-sysupgrade.bin e[J
Mon Feb  3 07:22:17 GMT 2025 upgrade: Commencing upgrade. Closing all shell sessions.
Command failed: Connection failecat $ubivoldir/name )" = "$2" ]; thene[35;17H        basename $ubivoldir                   e[36;25Hubi_mknod "$ubivoldir"e[37;25Hreturn 0              e[38;17Hfi              e[39;9Hdone      e[40;1H}           e[41;1H e[42;1Hnand_find_ubi() {e[43;1H        local ubidevdir ubidev mtdnum cmtdnume[44;9Hmtdnum="$( find_mtd_index $1 )"      e[45;9H[ ! "$mtdnum" ] && return 1    e[46;9Hfor ubidevdir in /sys/class/ubi/ubi*; doe[47;9H        [ ! -e "$ubidevdir/mtd_num" ] && continuee[48;17Hcmtdnum="$( cat $ubidevdir/mtd_num )"    e[49;17Hif [ "$mtdnum" = "$cmtdnum" ]; then  e[50;17H        ubidev=$( basename $ubidevdir )e[51;28H_mknod "$ubidevdir"         e[52;25Hecho $ubidev          e[53;25Hreturn 0    e[54;17Hfi              e[55;9Hdone      e[56;1H}           e[57;1H e[58;1Hnand_get_magic_long() {e[59;1H        ($2 < "$1" | dd bs=4 "skip=${3:-0}" count=1 | hexdump -v -n 4 -e '1/1 "%02x"') 2> /dev/nulle[60;1H}                                                                                                  e[61;1H e[62;1Hget_magic_long_tar() {e[63;1H        ($2 < "$1" | tar xOf - "$3" | dd bs=4 count=1 | hexdump -v -n 4 -e '1/1 "%02x"') 2> /dev/nulle[64;1H}                                                                                                    e[65;1H e[66;1Hidentify() {e[67;1H        identify_magic_long $(nand_get_magic_long "$@")e[68;1H}                                                      e[69;1H e[70;1Hidentify_tar() {e[71;1H        identify_magic_long $(get_magic_long_tar "$@")e[72;1H}                                                     e[73;1H e[74;1Hidentify_if_gzip() {e[75;1H        if [ "$(identify "$1" "cat")" = gzip ]; then echo -n z; fie[76;1H}                                                                 e[77;1H e[78;1Hnand_restore_config() {e[79;1H        local ubidev=$( nand_find_ubi "${CI_ROOT_UBIPART:-$CI_UBIPART}" )e[80;18Hvol="$( nand_find_volume $ubidev rootfs_data )"         e[81;9Hif [ ! "$ubivol" ]; then                                e[82;9H        ubivol="$( nand_find_volume $ubidev "$CI_ROOTPART" )"e[83;17Hif [ ! "$ubivol" ]; then                             e[84;17H        echo "cannot find ubifs data volume"e[85;25Hreturn 1                            e[86;17Hfi              e[87;9Hfi        e[88;9Hmkdir /tmp/new_roote[89;9Hif ! mount -t ubifs /dev/$ubivol /tmp/new_root; thene[90;9H        echo "cannot mount ubifs volume $ubivol"    e[91;17Hrmdir /tmp/new_root                     e[5;1He[92;1He[K- /lib/upgrade/nand.sh [Modified] 5/498 1%e[5;1Hae[92;1He[K- /lib/upgrade/nand.sh [Modified] 5/498 1%e[5;1He[92;1He[K:wqe[5;1He[5;1He[92;1He[K'/lib/upgrade/nand.sh' 498L, 13660Ce[5;1He[92;1He[Ke[?1049lroot@OpenWrt:~# 
root@OpenWrt:~# vim /lib/upgrade/nand.sh e[J
root@OpenWrt:~# ifconfige[Jaae[Je[Je[Je[Je[Je[Je[Je[Jsysupgrade -n -v /tm
root@OpenWrt:~# sysupgrade -n -v /tmp/e[Jop
root@OpenWrt:~# sysupgrade -n -v /tmp/openwrt-ipq40xx-generic-tplink_deco-m9plus

-v2-squashfs-sysupgrade.bin e[J
Mon Feb  3 07:22:17 GMT 2025 upgrade: Commencing upgrade. Closing all shell sessions.
Command failed: Connection failed
ontains UBIe[9;3HThere are also CI_KERN_UBIPART and CI_ROOT_UBIPART if kernele[10;3Hand rootfs are on separated UBIs.                           e[11;1HCI_UBIPART="${CI_UBIPART:-ubi}"    e[12;1H                               e[13;1H# 'rootfs' UBI volume on NAND contains the rootfse[14;1HCI_ROOTPART="${CI_ROOTPART:-rootfs}"             e[15;1H                                    e[16;1Hubi_mknod() {e[17;1H        local dir="$1"e[18;16Hev="/dev/$(basename $dir)"e[19;9H                                 e[20;9H[ -e "$dev" ] && return 0e[21;9H                         e[22;9Hlocal devid="$(cat $dir/dev)"e[23;15Hmajor="${devid%%:*}"   e[24;16Hinor="${devid##*:e[25;9Hmknod "$dev" c $major $minore[26;1H}                                   e[27;1H e[28;1Hnand_find_volume() {e[29;1H        local ubidevdir ubivoldire[30;9Hubidevdir="/sys/class/ubi/"e[31;9H[ ! -d "$ubidevdir" ] && return 1e[32;9Hfor ubivoldir in $ubidevdir/${1}_*; doe[33;9H        [ ! -d "$ubivoldirWatchdog handover: fd=3
- watcMon Feb  3 07:22:18 GMT 2025 upgrade: Sending TERM to remaining processes ...
Mon Feb  3 07:22:18 GMT 2025 upgrade: Sending signal TERM to netifd (1104)
Mon Feb  3 07:22:22 GMT 2025 upgrade: Sending KILL to remaining processes ...
Mon Feb  3 07:22:22 GMT 2025 upgrade: Sending signal KILL to netifd (1104)
[  189.534642] stage2 (2506): drop_caches: 3
Mon Feb  3 07:22:31 GMT 2025 upgrade: Switching to ramdisk...
[  192.709522] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" stops
[  192.722223] UBIFS (ubi0:2): un-mount UBI device 0
Mon Feb  3 07:22:34 UTC 2025 upgrade: Performing system upgrade...
umount: can't unmount /dev/ubi0_0: Invalid argument
[  194.082310] block ubiblock0_1: released
umount: can't unmount /dev/ubi0_1: Invalid argument
umount: can't unmount /dev/ubi0_2: Invalid argument
[  194.096867] ubi0: detaching mtd10
[  194.097661] ubi0: mtd10 is detached
ubiformat: mtd10 (nand), size 47185920 bytes (45.0 MiB), 360 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes

libscan: scanning eraseblock 0 --  0 % complete  
libscan: scanning eraseblock 1 --  0 % complete  
libscan: scanning eraseblock 2 --  0 % complete  
libscan: scanning eraseblock 3 --  1 % complete  
libscan: scanning eraseblock 4 --  1 % complete  
libscan: scanning eraseblock 5 --  1 % complete  
libscan: scanning eraseblock 6 --  1 % complete  
libscan: scanning eraseblock 7 --  2 % complete  
libscan: scanning eraseblock 8 --  2 % complete  
libscan: scanning eraseblock 9 --  2 % complete  
libscan: scanning eraseblock 10 --  3 % complete  
libscan: scanning eraseblock 11 --  3 % complete  
libscan: scanning eraseblock 12 --  3 % complete  
libscan: scanning eraseblock 13 --  3 % complete  
libscan: scanning eraseblock 14 --  4 % complete  
libscan: scanning eraseblock 15 --  4 % complete  
libscan: scanning eraseblock 16 --  4 % complete  
libscan: scanning eraseblock 17 --  5 % complete  
libscan: scanning eraseblock 18 --  5 % complete  
libscan: scanning eraseblock 19 --  5 % complete  
libscan: scanning eraseblock 20 --  5 % complete  
libscan: scanning eraseblock 21 --  6 % complete  
libscan: scanning eraseblock 22 --  6 % complete  
libscan: scanning eraseblock 23 --  6 % complete  
libscan: scanning eraseblock 24 --  6 % complete  
libscan: scanning eraseblock 25 --  7 % complete  
libscan: scanning eraseblock 26 --  7 % complete  
libscan: scanning eraseblock 27 --  7 % complete  
libscan: scanning eraseblock 28 --  8 % complete  
libscan: scanning eraseblock 29 --  8 % complete  
libscan: scanning eraseblock 30 --  8 % complete  
libscan: scanning eraseblock 31 --  8 % complete  
libscan: scanning eraseblock 32 --  9 % complete  
libscan: scanning eraseblock 33 --  9 % complete  
libscan: scanning eraseblock 34 --  9 % complete  
libscan: scanning eraseblock 35 -- 10 % complete  
libscan: scanning eraseblock 36 -- 10 % complete  
libscan: scanning eraseblock 37 -- 10 % complete  
libscan: scanning eraseblock 38 -- 10 % complete  
libscan: scanning eraseblock 39 -- 11 % complete  
libscan: scanning eraseblock 40 -- 11 % complete  
libscan: scanning eraseblock 41 -- 11 % complete  
libscan: scanning eraseblock 42 -- 11 % complete  
libscan: scanning eraseblock 43 -- 12 % complete  
libscan: scanning eraseblock 44 -- 12 % complete  
libscan: scanning eraseblock 45 -- 12 % complete  
libscan: scanning eraseblock 46 -- 13 % complete  
libscan: scanning eraseblock 47 -- 13 % complete  
libscan: scanning eraseblock 48 -- 13 % complete  
libscan: scanning eraseblock 49 -- 13 % complete  
libscan: scanning eraseblock 50 -- 14 % complete  
libscan: scanning eraseblock 51 -- 14 % complete  
libscan: scanning eraseblock 52 -- 14 % complete  
libscan: scanning eraseblock 53 -- 15 % complete  
libscan: scanning eraseblock 54 -- 15 % complete  
libscan: scanning eraseblock 55 -- 15 % complete  
libscan: scanning eraseblock 56 -- 15 % complete  
libscan: scanning eraseblock 57 -- 16 % complete  
libscan: scanning eraseblock 58 -- 16 % complete  
libscan: scanning eraseblock 59 -- 16 % complete  
libscan: scanning eraseblock 60 -- 16 % complete  
libscan: scanning eraseblock 61 -- 17 % complete  
libscan: scanning eraseblock 62 -- 17 % complete  
libscan: scanning eraseblock 63 -- 17 % complete  
libscan: scanning eraseblock 64 -- 18 % complete  
libscan: scanning eraseblock 65 -- 18 % complete  
libscan: scanning eraseblock 66 -- 18 % complete  
libscan: scanning eraseblock 67 -- 18 % complete  
libscan: scanning eraseblock 68 -- 19 % complete  
libscan: scanning eraseblock 69 -- 19 % complete  
libscan: scanning eraseblock 70 -- 19 % complete  
libscan: scanning eraseblock 71 -- 20 % complete  
libscan: scanning eraseblock 72 -- 20 % complete  
libscan: scanning eraseblock 73 -- 20 % complete  
libscan: scanning eraseblock 74 -- 20 % complete  
libscan: scanning eraseblock 75 -- 21 % complete  
libscan: scanning eraseblock 76 -- 21 % complete  
libscan: scanning eraseblock 77 -- 21 % complete  
libscan: scanning eraseblock 78 -- 21 % complete  
libscan: scanning eraseblock 79 -- 22 % complete  
libscan: scanning eraseblock 80 -- 22 % complete  
libscan: scanning eraseblock 81 -- 22 % complete  
libscan: scanning eraseblock 82 -- 23 % complete  
libscan: scanning eraseblock 83 -- 23 % complete  
libscan: scanning eraseblock 84 -- 23 % complete  
libscan: scanning eraseblock 85 -- 23 % complete  
libscan: scanning eraseblock 86 -- 24 % complete  
libscan: scanning eraseblock 87 -- 24 % complete  
libscan: scanning eraseblock 88 -- 24 % complete  
libscan: scanning eraseblock 89 -- 25 % complete  
libscan: scanning eraseblock 90 -- 25 % complete  
libscan: scanning eraseblock 91 -- 25 % complete  
libscan: scanning eraseblock 92 -- 25 % complete  
libscan: scanning eraseblock 93 -- 26 % complete  
libscan: scanning eraseblock 94 -- 26 % complete  
libscan: scanning eraseblock 95 -- 26 % complete  
libscan: scanning eraseblock 96 -- 26 % complete  
libscan: scanning eraseblock 97 -- 27 % complete  
libscan: scanning eraseblock 98 -- 27 % complete  
libscan: scanning eraseblock 99 -- 27 % complete  
libscan: scanning eraseblock 100 -- 28 % complete  
libscan: scanning eraseblock 101 -- 28 % complete  
libscan: scanning eraseblock 102 -- 28 % complete  
libscan: scanning eraseblock 103 -- 28 % complete  
libscan: scanning eraseblock 104 -- 29 % complete  
libscan: scanning eraseblock 105 -- 29 % complete  
libscan: scanning eraseblock 106 -- 29 % complete  
libscan: scanning eraseblock 107 -- 30 % complete  
libscan: scanning eraseblock 108 -- 30 % complete  
libscan: scanning eraseblock 109 -- 30 % complete  
libscan: scanning eraseblock 110 -- 30 % complete  
libscan: scanning eraseblock 111 -- 31 % complete  
libscan: scanning eraseblock 112 -- 31 % complete  
libscan: scanning eraseblock 113 -- 31 % complete  
libscan: scanning eraseblock 114 -- 31 % complete  
libscan: scanning eraseblock 115 -- 32 % complete  
libscan: scanning eraseblock 116 -- 32 % complete  
libscan: scanning eraseblock 117 -- 32 % complete  
libscan: scanning eraseblock 118 -- 33 % complete  
libscan: scanning eraseblock 119 -- 33 % complete  
libscan: scanning eraseblock 120 -- 33 % complete  
libscan: scanning eraseblock 121 -- 33 % complete  
libscan: scanning eraseblock 122 -- 34 % complete  
libscan: scanning eraseblock 123 -- 34 % complete  
libscan: scanning eraseblock 124 -- 34 % complete  
libscan: scanning eraseblock 125 -- 35 % complete  
libscan: scanning eraseblock 126 -- 35 % complete  
libscan: scanning eraseblock 127 -- 35 % complete  
libscan: scanning eraseblock 128 -- 35 % complete  
libscan: scanning eraseblock 129 -- 36 % complete  
libscan: scanning eraseblock 130 -- 36 % complete  
libscan: scanning eraseblock 131 -- 36 % complete  
libscan: scanning eraseblock 132 -- 36 % complete  
libscan: scanning eraseblock 133 -- 37 % complete  
libscan: scanning eraseblock 134 -- 37 % complete  
libscan: scanning eraseblock 135 -- 37 % complete  
libscan: scanning eraseblock 136 -- 38 % complete  
libscan: scanning eraseblock 137 -- 38 % complete  
libscan: scanning eraseblock 138 -- 38 % complete  
libscan: scanning eraseblock 139 -- 38 % complete  
libscan: scanning eraseblock 140 -- 39 % complete  
libscan: scanning eraseblock 141 -- 39 % complete  
libscan: scanning eraseblock 142 -- 39 % complete  
libscan: scanning eraseblock 143 -- 40 % complete  
libscan: scanning eraseblock 144 -- 40 % complete  
libscan: scanning eraseblock 145 -- 40 % complete  
libscan: scanning eraseblock 146 -- 40 % complete  
libscan: scanning eraseblock 147 -- 41 % complete  
libscan: scanning eraseblock 148 -- 41 % complete  
libscan: scanning eraseblock 149 -- 41 % complete  
libscan: scanning eraseblock 150 -- 41 % complete  
libscan: scanning eraseblock 151 -- 42 % complete  
libscan: scanning eraseblock 152 -- 42 % complete  
libscan: scanning eraseblock 153 -- 42 % complete  
libscan: scanning eraseblock 154 -- 43 % complete  
libscan: scanning eraseblock 155 -- 43 % complete  
libscan: scanning eraseblock 156 -- 43 % complete  
libscan: scanning eraseblock 157 -- 43 % complete  
libscan: scanning eraseblock 158 -- 44 % complete  
libscan: scanning eraseblock 159 -- 44 % complete  
libscan: scanning eraseblock 160 -- 44 % complete  
libscan: scanning eraseblock 161 -- 45 % complete  
libscan: scanning eraseblock 162 -- 45 % complete  
libscan: scanning eraseblock 163 -- 45 % complete  
libscan: scanning eraseblock 164 -- 45 % complete  
libscan: scanning eraseblock 165 -- 46 % complete  
libscan: scanning eraseblock 166 -- 46 % complete  
libscan: scanning eraseblock 167 -- 46 % complete  
libscan: scanning eraseblock 168 -- 46 % complete  
libscan: scanning eraseblock 169 -- 47 % complete  
libscan: scanning eraseblock 170 -- 47 % complete  
libscan: scanning eraseblock 171 -- 47 % complete  
libscan: scanning eraseblock 172 -- 48 % complete  
libscan: scanning eraseblock 173 -- 48 % complete  
libscan: scanning eraseblock 174 -- 48 % complete  
libscan: scanning eraseblock 175 -- 48 % complete  
libscan: scanning eraseblock 176 -- 49 % complete  
libscan: scanning eraseblock 177 -- 49 % complete  
libscan: scanning eraseblock 178 -- 49 % complete  
libscan: scanning eraseblock 179 -- 50 % complete  
libscan: scanning eraseblock 180 -- 50 % complete  
libscan: scanning eraseblock 181 -- 50 % complete  
libscan: scanning eraseblock 182 -- 50 % complete  
libscan: scanning eraseblock 183 -- 51 % complete  
libscan: scanning eraseblock 184 -- 51 % complete  
libscan: scanning eraseblock 185 -- 51 % complete  
libscan: scanning eraseblock 186 -- 51 % complete  
libscan: scanning eraseblock 187 -- 52 % complete  
libscan: scanning eraseblock 188 -- 52 % complete  
libscan: scanning eraseblock 189 -- 52 % complete  
libscan: scanning eraseblock 190 -- 53 % complete  
libscan: scanning eraseblock 191 -- 53 % complete  
libscan: scanning eraseblock 192 -- 53 % complete  
libscan: scanning eraseblock 193 -- 53 % complete  
libscan: scanning eraseblock 194 -- 54 % complete  
libscan: scanning eraseblock 195 -- 54 % complete  
libscan: scanning eraseblock 196 -- 54 % complete  
libscan: scanning eraseblock 197 -- 55 % complete  
libscan: scanning eraseblock 198 -- 55 % complete  
libscan: scanning eraseblock 199 -- 55 % complete  
libscan: scanning eraseblock 200 -- 55 % complete  
libscan: scanning eraseblock 201 -- 56 % complete  
libscan: scanning eraseblock 202 -- 56 % complete  
libscan: scanning eraseblock 203 -- 56 % complete  
libscan: scanning eraseblock 204 -- 56 % complete  
libscan: scanning eraseblock 205 -- 57 % complete  
libscan: scanning eraseblock 206 -- 57 % complete  
libscan: scanning eraseblock 207 -- 57 % complete  
libscan: scanning eraseblock 208 -- 58 % complete  
libscan: scanning eraseblock 209 -- 58 % complete  
libscan: scanning eraseblock 210 -- 58 % complete  
libscan: scanning eraseblock 211 -- 58 % complete  
libscan: scanning eraseblock 212 -- 59 % complete  
libscan: scanning eraseblock 213 -- 59 % complete  
libscan: scanning eraseblock 214 -- 59 % complete  
libscan: scanning eraseblock 215 -- 60 % complete  
libscan: scanning eraseblock 216 -- 60 % complete  
libscan: scanning eraseblock 217 -- 60 % complete  
libscan: scanning eraseblock 218 -- 60 % complete  
libscan: scanning eraseblock 219 -- 61 % complete  
libscan: scanning eraseblock 220 -- 61 % complete  
libscan: scanning eraseblock 221 -- 61 % complete  
libscan: scanning eraseblock 222 -- 61 % complete  
libscan: scanning eraseblock 223 -- 62 % complete  
libscan: scanning eraseblock 224 -- 62 % complete  
libscan: scanning eraseblock 225 -- 62 % complete  
libscan: scanning eraseblock 226 -- 63 % complete  
libscan: scanning eraseblock 227 -- 63 % complete  
libscan: scanning eraseblock 228 -- 63 % complete  
libscan: scanning eraseblock 229 -- 63 % complete  
libscan: scanning eraseblock 230 -- 64 % complete  
libscan: scanning eraseblock 231 -- 64 % complete  
libscan: scanning eraseblock 232 -- 64 % complete  
libscan: scanning eraseblock 233 -- 65 % complete  
libscan: scanning eraseblock 234 -- 65 % complete  
libscan: scanning eraseblock 235 -- 65 % complete  
libscan: scanning eraseblock 236 -- 65 % complete  
libscan: scanning eraseblock 237 -- 66 % complete  
libscan: scanning eraseblock 238 -- 66 % complete  
libscan: scanning eraseblock 239 -- 66 % complete  
libscan: scanning eraseblock 240 -- 66 % complete  
libscan: scanning eraseblock 241 -- 67 % complete  
libscan: scanning eraseblock 242 -- 67 % complete  
libscan: scanning eraseblock 243 -- 67 % complete  
libscan: scanning eraseblock 244 -- 68 % complete  
libscan: scanning eraseblock 245 -- 68 % complete  
libscan: scanning eraseblock 246 -- 68 % complete  
libscan: scanning eraseblock 247 -- 68 % complete  
libscan: scanning eraseblock 248 -- 69 % complete  
libscan: scanning eraseblock 249 -- 69 % complete  
libscan: scanning eraseblock 250 -- 69 % complete  
libscan: scanning eraseblock 251 -- 70 % complete  
libscan: scanning eraseblock 252 -- 70 % complete  
libscan: scanning eraseblock 253 -- 70 % complete  
libscan: scanning eraseblock 254 -- 70 % complete  
libscan: scanning eraseblock 255 -- 71 % complete  
libscan: scanning eraseblock 256 -- 71 % complete  
libscan: scanning eraseblock 257 -- 71 % complete  
libscan: scanning eraseblock 258 -- 71 % complete  
libscan: scanning eraseblock 259 -- 72 % complete  
libscan: scanning eraseblock 260 -- 72 % complete  
libscan: scanning eraseblock 261 -- 72 % complete  
libscan: scanning eraseblock 262 -- 73 % complete  
libscan: scanning eraseblock 263 -- 73 % complete  
libscan: scanning eraseblock 264 -- 73 % complete  
libscan: scanning eraseblock 265 -- 73 % complete  
libscan: scanning eraseblock 266 -- 74 % complete  
libscan: scanning eraseblock 267 -- 74 % complete  
libscan: scanning eraseblock 268 -- 74 % complete  
libscan: scanning eraseblock 269 -- 75 % complete  
libscan: scanning eraseblock 270 -- 75 % complete  
libscan: scanning eraseblock 271 -- 75 % complete  
libscan: scanning eraseblock 272 -- 75 % complete  
libscan: scanning eraseblock 273 -- 76 % complete  
libscan: scanning eraseblock 274 -- 76 % complete  
libscan: scanning eraseblock 275 -- 76 % complete  
libscan: scanning eraseblock 276 -- 76 % complete  
libscan: scanning eraseblock 277 -- 77 % complete  
libscan: scanning eraseblock 278 -- 77 % complete  
libscan: scanning eraseblock 279 -- 77 % complete  
libscan: scanning eraseblock 280 -- 78 % complete  
libscan: scanning eraseblock 281 -- 78 % complete  
libscan: scanning eraseblock 282 -- 78 % complete  
libscan: scanning eraseblock 283 -- 78 % complete  
libscan: scanning eraseblock 284 -- 79 % complete  
libscan: scanning eraseblock 285 -- 79 % complete  
libscan: scanning eraseblock 286 -- 79 % complete  
libscan: scanning eraseblock 287 -- 80 % complete  
libscan: scanning eraseblock 288 -- 80 % complete  
libscan: scanning eraseblock 289 -- 80 % complete  
libscan: scanning eraseblock 290 -- 80 % complete  
libscan: scanning eraseblock 291 -- 81 % complete  
libscan: scanning eraseblock 292 -- 81 % complete  
libscan: scanning eraseblock 293 -- 81 % complete  
libscan: scanning eraseblock 294 -- 81 % complete  
libscan: scanning eraseblock 295 -- 82 % complete  
libscan: scanning eraseblock 296 -- 82 % complete  
libscan: scanning eraseblock 297 -- 82 % complete  
libscan: scanning eraseblock 298 -- 83 % complete  
libscan: scanning eraseblock 299 -- 83 % complete  
libscan: scanning eraseblock 300 -- 83 % complete  
libscan: scanning eraseblock 301 -- 83 % complete  
libscan: scanning eraseblock 302 -- 84 % complete  
libscan: scanning eraseblock 303 -- 84 % complete  
libscan: scanning eraseblock 304 -- 84 % complete  
libscan: scanning eraseblock 305 -- 85 % complete  
libscan: scanning eraseblock 306 -- 85 % complete  
libscan: scanning eraseblock 307 -- 85 % complete  
libscan: scanning eraseblock 308 -- 85 % complete  
libscan: scanning eraseblock 309 -- 86 % complete  
libscan: scanning eraseblock 310 -- 86 % complete  
libscan: scanning eraseblock 311 -- 86 % complete  
libscan: scanning eraseblock 312 -- 86 % complete  
libscan: scanning eraseblock 313 -- 87 % complete  
libscan: scanning eraseblock 314 -- 87 % complete  
libscan: scanning eraseblock 315 -- 87 % complete  
libscan: scanning eraseblock 316 -- 88 % complete  
libscan: scanning eraseblock 317 -- 88 % complete  
libscan: scanning eraseblock 318 -- 88 % complete  
libscan: scanning eraseblock 319 -- 88 % complete  
libscan: scanning eraseblock 320 -- 89 % complete  
libscan: scanning eraseblock 321 -- 89 % complete  
libscan: scanning eraseblock 322 -- 89 % complete  
libscan: scanning eraseblock 323 -- 90 % complete  
libscan: scanning eraseblock 324 -- 90 % complete  
libscan: scanning eraseblock 325 -- 90 % complete  
libscan: scanning eraseblock 326 -- 90 % complete  
libscan: scanning eraseblock 327 -- 91 % complete  
libscan: scanning eraseblock 328 -- 91 % complete  
libscan: scanning eraseblock 329 -- 91 % complete  
libscan: scanning eraseblock 330 -- 91 % complete  
libscan: scanning eraseblock 331 -- 92 % complete  
libscan: scanning eraseblock 332 -- 92 % complete  
libscan: scanning eraseblock 333 -- 92 % complete  
libscan: scanning eraseblock 334 -- 93 % complete  
libscan: scanning eraseblock 335 -- 93 % complete  
libscan: scanning eraseblock 336 -- 93 % complete  
libscan: scanning eraseblock 337 -- 93 
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00110
S - IMAGE_VARIANT_STRING=DAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000025
S - Reset status Config, 0x00000010
S - Core 0 Frequency, 0 MHz
B -       262 - PBL, Start
B -      1342 - bootable_media_detect_entry, Start
B -      2621 - bootable_media_detect_success, Start
B -      2635 - elf_loader_entry, Start
B -      4051 - auth_hash_seg_entry, Start
B -      6224 - auth_hash_seg_exit, Start
B -     71516 - elf_segs_hash_verify_entry, Start
B -    194723 - PBL, End
B -    194748 - SBL1, Start
B -    286948 - pm_device_init, Start
D -         7 - pm_device_init, Delta
B -    288449 - boot_flash_init, Start
D -     95788 - boot_flash_init, Delta

It seems that it fails on this line in nand.sh:
$cmd < "$ubi_file" | ubiformat "/dev/mtd$mtdnum" -S "$ubi_length" -y -f - && ubiattach -m "$mtdnum"
And the log suggests that it just scanned the blocks but never wrote anything and the ubiformat returned exit code 1 and which triggered a reboot and even the ubiattach -m did not execute.

Also, I had done some reading of nand.sh before and I came to the conclusion that for this device, sysupgrade also needs to do ubiformat. With that thought I had pushed https://github.com/meshing-m/openwrt/commit/cf3f238a3dc2af9c5a941668d5c969e79a12e622 which is the one I am testing.

I have obviously ubiformatted the factory.bin many times using a console from openwrt initramfs. I am thinking maybe I should try ubiformatting the sysupgrade image ? (Although I just diffed it with the factory image and it's so different that I would rather not do)

I don't really know how to debug this further.

@Hostle @naf

Well I could not wait any longer and I ran sysupgrade -F -n <factory image> and it completed ubiformat just fine and rebooted back into the freshly written openwrt image :smiley:

Is this how it's supposed to be done for ubifs devices ?

That looks a lot like a watchdog reboot. Don't know much about the HW, but might be worth checking on how to disable the watchdog first.