Ipq5018 U-boot

For Developers
1

Hi First of all im Persian so sorry for bad English
I have a router base of ipq508
I got serial connected to modem when i interrupt u boot
In bootcmd:bootipq
I researched and got its a function that handle changing u boot and run modem but when i like to write a partition in mtd partition
Three is 21 mtd partition i backuped all but my problem is even if u write nand the own stock MTD like 15 that is rootf contain 5 ubi the modem on first start will come online and its ok after even one restart the modem will fail to start and give me some uart error about squashfs error any here got any experience with this kinda u-boot?
The modem use an old version of custom made of Openwrt for stock fraimware
when i got log from serial the mtd that will defined are this ones

[     4.156610] 21 ofpart partitions found on MTD device qcom_nand.0
[    4.163522] Creating 21 MTD partitions on "qcom_nand.0":
[    4.169819] 0x000000000000-0x000000080000 : "0:SBL1"
[    4.176774] 0x000000080000-0x000000100000 : "0:MIBIB"
[    4.181585] 0x000000100000-0x000000140000 : "0:BOOTCONFIG"
[    4.186429] 0x000000140000-0x000000180000 : "0:BOOTCONFIG1"
[    4.191791] 0x000000180000-0x000000280000 : "0:QSEE_1"
[    4.197789] 0x000000280000-0x000000380000 : "0:QSEE"
[    4.202910] 0x000000380000-0x0000003c0000 : "0:DEVCFG_1"
[    4.207553] 0x0000003c0000-0x000000400000 : "0:DEVCFG"
[    4.212776] 0x000000400000-0x000000440000 : "0:CDT_1"
[    4.217832] 0x000000440000-0x000000480000 : "0:CDT"
[    4.222862] 0x000000480000-0x000000500000 : "0:APPSBLENV"
[    4.227871] 0x000000500000-0x000000640000 : "0:APPSBL_1"
[    4.233939] 0x000000640000-0x000000780000 : "0:APPSBL"
[    4.239410] 0x000000780000-0x000000880000 : "0:ART"
[    4.243973] 0x000000880000-0x000000900000 : "0:TRAINING"
[    4.248478] 0x000000900000-0x000004200000 : "rootfs_1"
[    4.296986] 0x000004200000-0x000007b00000 : "rootfs"
[    4.340824] mtd: device 16 (rootfs) set to be root filesystem
[    4.341072] mtdsplit: no squashfs found in "rootfs"
[    4.345571] 0x000007b00000-0x000007c00000 : "Factory"
[    4.352281] 0x000007c00000-0x000007d00000 : "hwsw_cfg"
[    4.357437] 0x000007d00000-0x000007e00000 : "user_cfg"
[    4.362429] 0x000007e00000-0x000007f00000 : "zone"
[    4.368549] libphy: Fixed MDIO Bus: probed

but i got into shell and i got accesses when i there type cat /proc/mtd i will get this

root@mycpe:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00020000 "0:SBL1"
mtd1: 00080000 00020000 "0:MIBIB"
mtd2: 00040000 00020000 "0:BOOTCONFIG"
mtd3: 00040000 00020000 "0:BOOTCONFIG1"
mtd4: 00100000 00020000 "0:QSEE"
mtd5: 00100000 00020000 "0:QSEE_1"
mtd6: 00040000 00020000 "0:DEVCFG"
mtd7: 00040000 00020000 "0:DEVCFG_1"
mtd8: 00040000 00020000 "0:CDT"
mtd9: 00040000 00020000 "0:CDT_1"
mtd10: 00080000 00020000 "0:APPSBLENV"
mtd11: 00140000 00020000 "0:APPSBL"
mtd12: 00140000 00020000 "0:APPSBL_1"
mtd13: 00100000 00020000 "0:ART"
mtd14: 00080000 00020000 "0:TRAINING"
mtd15: 03900000 00020000 "rootfs"
mtd16: 03900000 00020000 "rootfs_1"
mtd17: 00100000 00020000 "Factory"
mtd18: 00100000 00020000 "hwsw_cfg"
mtd19: 00100000 00020000 "user_cfg"
mtd20: 00100000 00020000 "zone"
mtd21: 004314ac 0001f000 "kernel"
mtd22: 00369000 0001f000 "wifi_fw"
mtd23: 00004800 0001f000 "bt_fw"
mtd24: 013dc000 0001f000 "ubi_rootfs"
mtd25: 00cb7000 0001f000 "rootfs_data"

my Goal is to modify a .txt in rootfs than flash it again but every time im doing this the modem will brick
even if flash them modem stock mtd part it will brick than i need to unbrick it by another way !
the modem U-Boot intrupt give me this info

IPQ5018# printenv
baudrate=115200
boardid=5625
bootargs=console=ttyMSM0,115200n8
bootcmd=bootipq
bootdelay=1
eth1addr=0:1e:a8:66:67:7
ethact=eth0
ethaddr=0:1e:a8:66:67:6
fdt_high=0x4A400000
fdtcontroladdr=4a9c4004
flash_type=11
ipaddr=192.168.1.1
machid=8040003
moduleid=fm160
netmask=255.255.255.0
serverip=192.168.1.100
soc_hw_version=20180101
soc_version_major=1
soc_version_minor=1
stderr=serial@78AF000
stdin=serial@78AF000
stdout=serial@78AF000
Environment size: 478/262140 bytes
2

There is no open ipq5018 bootloader. You can always try to non-destructively boot initramfs kernel of similar device via bootm and tftpboot. ANd use that to dump flash if no such option is provided in same bootm....
What is the device in question?

3

i edited and share more info u can examine them :smiley:

4

It has TFTP server IP in environment.
Type help into uboot - anything about mtd and ubi should help back up the partitions
combo of tftpboot and bootm helps boot OpenWrt kernel.

5

@mortezakhan002 This is ZTE 5G device?

Check out this thread, maybe you will find some helpful information there: https://forum.openwrt.org/t/openwrt-support-for-linksys-mx6200/231179/67

6

most devices share some pre defined profiles like 'mp03.5-c1'. Locale profile of your device and pick device that use the same 'target/linux/qualcommax/image/ipq50xx.mk'
then get it's initramfs boot it via tftp, enter recovery 'f' and mount oem rootfs . Edit and restart = done

7

The u boot on default dont config any MTD part or anything it just use bootipq to handle and automatic everything

8

It's not a ZTE device ita a router the use 4g-5g the company that made that called fiberhome

9

How i can mount oem after using initfs?
Cause when i used a sample of initfs that i writed on ram the bootm fram ram
But dont know how to mount the OEM rootfs

10

Likely you need to compile your own image with particular knobs maybe even patches used to make OEM partition.

11

There is password called super admin on /www
But when I changing it it seems it changes on overlay
After reset factory it re write orginal read online on overlay that's my problem

12

Back it up and binwalk. It is not expected to bear any function on real OpenWrt.

13

I mean if i use another device initfs that has failsafe mode can i mount the modem oem mtd parts?

14

If secure boot is enabled, the system will not boot after modification to the partition.

1 Like
15

How i can identify is it on or off?

16

It should show secure boot enabled somewhere in u-boot before kernel load up.