If we have a reproducible root access (and can re-use after a factory reset?), is there any benefit to hardware (UART) access?
1 Like
Only to unbrick a bad flash.
1 Like
Hey everyone, just an update to OpenWRT on ER605.
Thanks to the awesome work of kolya,
The profile for support has been accepted by OpenWRT and they now make sysupgrade images and initramfs images.
Factory images need a bit of work to get going so if anyone is interested in putting in the work, have a look at tplink-safeloader.c, it needs magic number info as per @frollic above and rthe partition setup, all of which is beyond my skillset/knowedge.
The initramfs and sysupgrade can be compiled yourself or downloaded from the OpenWRT buildbot at https://downloads.openwrt.org/snapshots/targets/ramips/mt7621/
I have not found a way to flash the devices yet. I have tried both the "mtd" and "sysupgrade" method both of which result in a strange semi brick where the router now thinks its a WVR450G. Ill keep on playing around and hopfully if I figure it out ill let you know how to get it working.
3 Likes
So for now looks like there is a strange bug with the bootloader that I didn't notice before and sysupgrade will do the flashing, but then bootloader will provide nonsensical bootargs...
So currently the process that would work:
- Boot into initramfs image
- scp sysupgrade image and run sysupgrade on it
- After the reboot kernel panic is likely
- Boot again into initramfs and see what is the id of rootfs volume
- Update dts for the board adding
root=/dev/ubiblock0_X- where X is the id form the above step - Rebuild image and flash that via initramfs like above
- Now board should boot.
A little bit of the detail:
During boot (with as close to the factory image as I can now get) I get this:
Read 16 bytes from volume extra-para to 8fe5e148
Read 79 bytes from volume extra-para to 80010000
Read 16 bytes from volume extra-para.b to 8fe5e148
Read 79 bytes from volume extra-para.b to 8001009e
the fwFlag0/1 is GOOD
the score0 is 4
the score1 is 3
UBI volume is ok[bootloader].
UBI volume is ok[kernel].
UBI volume is ok[rootfs].
And then at kernel boot:
[ 0.000000] Kernel command line: console=ttyS0,115200 noinitrd ubi.mtd=3,2048 ubi.block=0,rootfs root=/dev/ubiblock0_8 DKMGT_IMAGE_ID=0 DKMGT_IMAGE_TYPE=ubi rootfstype=squashfs,jffs2
Note /dev/ubiblock0_8 is passed by u-boot (as far as I can figure) and it is wrong id of the rootfs volume. As a matter of fact this happens to me after I do 'reset' to factory image - I have to go and manually rename volumes to make things boot into factory image. Unfortunately renaming volumes doesn't work with openwrt because it removes and recreates volumes.
So the root cause of the problem is that somehow u-boot provides wrong volume id, even for factory image - which makes no sense.
Also, just in case anyone needs this: in order to restore (close) to factory image I use the follofing process:
- boot into initramfs image
- scp
ubi_*files (thanks @Darbness for providing that) into/tmp/ - run this:
for i in `seq 0 19`; do echo $i; ubirmvol /dev/ubi0 -n $i; done
ubimkvol /dev/ubi0 -S 2 -N partition-table -t dynamic
ubimkvol /dev/ubi0 -S 2 -N support-list -t dynamic
ubimkvol /dev/ubi0 -S 2 -N device-info -t static
ubimkvol /dev/ubi0 -S 2 -N device-info.b -t static
ubimkvol /dev/ubi0 -S 2 -N tddp -t dynamic
ubimkvol /dev/ubi0 -S 2 -N tddp.b -t dynamic
ubimkvol /dev/ubi0 -S 9 -N bootloader.b -t static
ubimkvol /dev/ubi0 -S 42 -N kernel.b -t static
ubimkvol /dev/ubi0 -S 149 -N rootfs.b -t static
ubimkvol /dev/ubi0 -S 3 -N firmware-info.b -t static
ubimkvol /dev/ubi0 -S 3 -N extra-para.b -t dynamic
ubimkvol /dev/ubi0 -S 17 -N log.b -t dynamic
ubimkvol /dev/ubi0 -S 83 -N rootfs_data.b -t dynamic
ubimkvol /dev/ubi0 -S 9 -N bootloader -t static
ubimkvol /dev/ubi0 -S 42 -N kernel -t static
ubimkvol /dev/ubi0 -S 149 -N rootfs -t static
ubimkvol /dev/ubi0 -S 3 -N firmware-info -t static
ubimkvol /dev/ubi0 -S 3 -N extra-para -t dynamic
ubimkvol /dev/ubi0 -S 17 -N log -t dynamic
ubimkvol /dev/ubi0 -S 83 -N rootfs_data -t dynamic
for i in `seq 0 19`; do echo $i; ubiupdatevol /dev/ubi0_$i /tmp/ubi0_$i; done
Sorry for garbled comments and for flashing not working out of the box... but I'm really puzzled by the fact that as far as I can see it doesn't work even for factory image which obviously makes no sense.
4 Likes
Additionally, I have figured out the network boot recovery mode.
Hold in the reset button and turn on the router and wait until the network port starts flashing.
Then you can access the firmware recovery page on 192.168.0.10. you will have to set a static IP on your computer becuase DHCP isnt enabled on the router in recovery mode.
1 Like
Anyone working on the er605 v1, or is this just for the er605 v2 at present?
1 Like
Once we get one working well it will be very easy to port it to similar hardware because the only real difference is the firmware layout becuase of the space differences.
1 Like
One more small patch: https://github.com/openwrt/openwrt/pull/11715
This should (finally!) make this thing boot after sysupgrade from initramfs assuming 'first' set of volumes is used.
That uboot bug is really something...
1 Like
This is great, thanks everyone. I have a new v1 that has only been powered on, never connected to public internet, never even logged in yet, if that is of any help. (But I would probably need, if not hand holding, some orientation/guidance.)
Just to be clear: at this point the only way to flash is using initramfs. Also there is very much non zero chance to break stuff so I would not recommend doing anything with this unless you have a equipment and experience to solder UART to it.
2 Likes
I'll wait for any easy way to flash it!! 
1 Like
Hi
I've been following you for a while and I think it's great how you crack it step by step. 
Because I find ER605 hardware simple but strong.
And pity held back and demoted by software.
I have ER605 v2.
I soldered pins. Connected via UART.
Did openwrt-ramips-mt7621-tplink_er605-v2-initramfs-kernel.bin via TFTP upgrade. OK
then after login
sysupgrade -n openwrt-ramips-mt7621-tplink_er605-v2-squashfs-sysupgrade.bin
root@ER605:/tmp# sysupgrade -F openwrt-ramips-mt7621-tplink_er605-v2-squashfs-sy
supgrade.bin
Saving config files...
killall: watchdog: no process killed
/sbin/sysupgrade: eval: line 272: status_led_blink_preinit_regular: not found
Sending TERM to remaining processes ... ntpd arpreq speedtest sys_monitor sleep omadad cloud-brd crond loggerd klogd sleep sleep sleep sleep netifd tddpd tmngtd ippoold dnsmasq improxy dnsproxyd
Sending KILL to remaining processes ... ntpd sleep
Switching to ramdisk...
/lib/ld-musl-mipsel.so.1: /sbin/snapshot: Not a valid dynamic program
Performing system upgrade...
Unlocking firmware ...
Writing from <stdin> to firmware ...
Upgrade completed
Rebooting system...
[ 305.719799] reboot: Restarting system
boot.......................... ..................... ............
to end:
"software-version": "2.0.1 Build 20220223 Rel.68551",
"firmware-id": "123AAAABBBBAAAABBBBAAAABBBBAAAABBBB321"
"software-version": "2.0.1 Build 20220223 Rel.68551",
"firmware-id": "123AAAABBBBAAAABBBBAAAABBBBAAAABBBB321"
/tmp/device-info.json: No such file or directory
/tmp/device-info.json: No such file or directory
/tmp/device-info.json: No such file or directory
/tmp/device-info.json: No such file or directory
/tmp/device-info.json: No such file or directory
/tmp/device-info.json: No such file or directory
ER605 login:
then lan is dead. login only via UART
I certainly didn't do everything right there.
Because of that, I also ask for an exact step-by-step guide.
You're welcome
Can I learn something there too?
Cheers
please excuse my englisch
is via google translator
okay,
Firstly download the images with the patch for the incorrect boot args.
I had a bit of trouble getting the lan ports to work in uboot. but port 4 seemed to work most times.
boot into the initramfs, then run sysupgrade to the squash file.
1 Like
I think
have broken .
then nothing works. firmware flash (192.168.0.10) also not.
web is there but flash doesn't work.
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=3", size 124 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 512
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 998, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1740612857
ubi0: available PEBs: 742, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 20
Volume extra-para not found!
Volume extra-para.b not found!
the fwFlag0/1 is BAD
Failed to open volume for check image[device-info].
Failed to open volume for check image[device-info.b].
run command list
Web failsafe UI started
GET /
GET /
POST /flashing
Content-Length: 14160747
upload_ptr 800102da,hdr_size 730,uploadsize 14160017
Upgrade to ImageId : 1
up.bin buf = 800102da
up.bin size = 808989491 (0x30383333)
Failed to parse up_ptn_table json.Failed to parse up_ptn_table.
If I'm reading this correctly you run sysupgrade from stock firmware. The host name of openwrt firmware would have been different. Running sysupgrade from stock firmware is expected to not work properly
So I think this resulted in firmware partition being wiped out - which is not good.
You would need to restore this somehow. If you have backups of ubi volumes than you can use process I've outlined above to just reflash all of them back - this should be good enough to try initramfs again.
Now, assuming you have restored original state the process that should work should be as following:
- Setup tftp server on 192.168.0.146 IP (any 192.168.0.X should work)
- Place initramfs image as 'firmware.bin' in tftp server
- Boot with UART connected and press any key to stop autoboot. After that the process is as following (ethernet ports 4 and 5 should work, maybe others too - didn't try):
Warning: eth@1e100000 (eth0) using random MAC address - aa:3c:9a:28:84:1b
eth0: eth@1e100000
gpio: pin 7 (gpio 7) value is 1
gpio: pin 11 (gpio 11) value is 1
gpio: pin 12 (gpio 12) value is 0
gpio: pin 7 (gpio 7) value is 0
gpio: pin 11 (gpio 11) value is 0
gpio: pin 12 (gpio 12) value is 1
gpio: pin 12 (gpio 12) value is 0
Hit any key to stop autoboot: 0
=>
=>
=>
=> run enphy
=> mtkload
*** Loading image ***
Input load address: 0x80010000
Available load methods:
0 - TFTP client (Default)
1 - Xmodem
2 - Ymodem
3 - Kermit
4 - S-Record
Select (enter for default):
Input U-Boot's IP address: 192.168.0.10
Input TFTP server's IP address: 192.168.0.146
Input IP netmask: 255.255.255.0
Input file name: firmware.bin
Using eth@1e100000 device
TFTP from server 192.168.0.146; our IP address is 192.168.0.10
Filename 'firmware.bin'.
Load address: 0x80010000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
####################################################
11.8 MiB/s
done
Bytes transferred = 5520504 (543c78 hex)
*** Loaded 5520504 (0x543c78) bytes at 0x80010000 ***
Run loaded data now? (Y/n):
## Loading kernel from FIT Image at 80010000 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: MIPS OpenWrt Linux-5.10.162
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x800100e4
Data Size: 5507828 Bytes = 5.3 MiB
Architecture: MIPS
OS: Linux
Load Address: 0x82000000
Entry Point: 0x82000000
Hash algo: crc32
Hash value: 076bbbdf
Hash algo: sha1
Hash value: 39609c8c27c1752714c864b027eead75e4f8f0f1
Verifying Hash Integrity ... crc32+ sha1+ OK
Once in new initramfs image you can use sysupgrade and that should work (assuming your system is using 'main' volumes - I'm still working on making it work regardless of that, but 'usually' that works).
Also, FWIW, I experience same issue with web recovery function - but I think @Darbness got it working - it is still unclear to me what is missing there.
1 Like
yes the partition is probably deleted
Hello *,
I also bought an ER605 v2 with the intention of putting OpenWRT into it. I soldered pins on UART and connect via minicom.
In U-Boot I chose "5. Load Image" and upload "openwrt-ramips-mt7621-tplink_er605-v2-initramfs-kernel.bin". I have to do this via ymodem because none of my network port give me a link to the switch while in U-Boot.
Boot is OK... (some code deleted due to 32000 byte limit).
*** Loading image ***
Input load address: 0x80010000
Available load methods:
0 - TFTP client (Default)
1 - Xmodem
2 - Ymodem
3 - Kermit
4 - S-Record
Select (enter for default): 2
*** Starting Ymodem transmitting ***
C
*** Loaded 5544444 (0x5499fc) bytes at 0x80010000 ***
Run loaded data now? (Y/n):
## Loading kernel from FIT Image at 80010000 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: MIPS OpenWrt Linux-5.10.162
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x800100e4
Data Size: 5531845 Bytes = 5.3 MiB
Architecture: MIPS
OS: Linux
Load Address: 0x82000000
Entry Point: 0x82000000
Hash algo: crc32
Hash value: 2eba1d8e
Hash algo: sha1
Hash value: 80f961e0df8fba18acbf43a8b44d7d3a25a3f2ae
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 80010000 ...
Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: MIPS OpenWrt tplink_er605-v2 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x80556aec
Data Size: 10700 Bytes = 10.4 KiB
Architecture: MIPS
Hash algo: crc32
Hash value: 7c4b6833
Hash algo: sha1
Hash value: b6c074e5449cc0783733cf88d7d88335fb8104fd
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x80556aec
Uncompressing Kernel Image ... OK
Loading Device Tree to 8fe57000, end 8fe5c9cb ... OK
[ 0.000000] Linux version 5.10.162 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r21714-9ac377d0e0) 11.3.0, GNU ld (GNU Binutils) 2.39) #0 SMP Sat Jan 7 00:32:58 2023
[ 0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[ 0.000000] MIPS: machine is TP-Link ER605 v2
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] VPE topology {2,2} total 4
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[..]
[ 43.058050] mtk_soc_eth 1e100000.ethernet eth0: PHY [mdio-bus:00] driver [MediaTek MT7530 PHY] (irq=POLL)
[ 43.067729] mtk_soc_eth 1e100000.ethernet eth0: configuring for phy/rgmii link mode
[ 45.853287] mt7530 mdio-bus:1f eth4: Link is Up - 1Gbps/Full - flow control rx/tx
[ 45.860811] br-lan: port 4(eth4) entered blocking state
[ 45.866214] br-lan: port 4(eth4) entered forwarding state
[ 45.873997] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
BusyBox v1.35.0 (2023-01-07 00:32:58 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt SNAPSHOT, r21714-9ac377d0e0
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
Now I have a link on ethernet, so I add an IP address, scp the sysupgrade image into /tmp and run sysupgrade
root@OpenWrt:/tmp# sysupgrade -F openwrt-ramips-mt7621-tplink_er605-v2-squashfs-
sysupgrade.20220107.bin
Cannot save config while running from ramdisk.
Sat Jan 7 00:37:57 UTC 2023 upgrade: Commencing upgrade. Closing all shell sessions.
Watchdog handover: fd=3
- watchdog -
Watchdog does not have CARDRESET support
Sat Jan 7 00:37:58 UTC 2023 upgrade: Sending TERM to remaining processes ...
Sat Jan 7 00:38:02 UTC 2023 upgrade: Sending KILL to remaining processes ...
[ 324.622800] stage2 (2463): drop_caches: 3
Sat Jan 7 00:38:08 UTC 2023 upgrade: Switching to ramdisk...
Sat Jan 7 00:38:10 UTC 2023 upgrade: Performing system upgrade...
Upgrading tplink,er605-v2
verifying sysupgrade tar file integrity
Volume ID 7, size 23 LEBs (2920448 bytes, 2.7 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
Volume ID 8, size 21 LEBs (2666496 bytes, 2.5 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 73646080
Volume ID 12, size 580 LEBs (73646080 bytes, 70.2 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
[ 331.421731] reboot: Restarting system
r
===================================================================
MT7621 stage1 code Dec 16 2019 17:45:55 (ASIC)
CPU=500000000 HZ BUS=166666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11000000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL2 FB_DL: 0x13, 1/0 = 654/370 4D000000
PLL3 FB_DL: 0x14, 1/0 = 756/268 51000000
PLL4 FB_DL: 0x17, 1/0 = 589/435 5D000000
DDR patch working
do DDR setting..[01F40000]
Apply DDR3 Setting...(use default AC)
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
--------------------------------------------------------------------------------
0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1
000E:| 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1
000F:| 0 0 0 0 1 1 1 1 1 1 1 1 1 1 0 0
0010:| 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0
0011:| 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
DRAMC_DQSCTL1[0e0]=13000000
DRAMC_DQSGCTL[124]=80000033
rank 0 coarse = 15
rank 0 fine = 72
B:| 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0
opt_dle value:11
DRAMC_DDR2CTL[07c]=C287223D
DRAMC_PADCTL4[0e4]=000022B3
DRAMC_DQIDLY1[210]=0A080909
DRAMC_DQIDLY2[214]=06070708
DRAMC_DQIDLY3[218]=0B060605
DRAMC_DQIDLY4[21c]=09050909
DRAMC_R0DELDLY[018]=00001C1D
==================================================================
RX DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 6 5 6 9 4 7 4 6 1 5
10 | 4 7 7 9 3 8
--------------------------------------
==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =29 DQS1 = 28
==================================================================
bit DQS0 bit DQS1
0 (0~53)26 8 (1~48)24
1 (1~50)25 9 (1~54)27
2 (1~53)27 10 (1~52)26
3 (2~54)28 11 (1~48)24
4 (0~50)25 12 (1~52)26
5 (1~58)29 13 (1~55)28
6 (1~52)26 14 (1~52)26
7 (1~58)29 15 (1~53)27
==================================================================
3.dq delay value last
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 9 9 8 10 8 7 7 6 5 6
10 | 6 11 9 9 5 9
==================================================================
==================================================================
TX perbyte calibration
==================================================================
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=3", size 124 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 512
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 994, bad PEBs: 4, corrupted PEBs: 0
ubi0: user volume: 20, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1740612857
ubi0: available PEBs: 0, total reserved PEBs: 994, PEBs reserved for bad PEB handling: 16
Read 16 bytes from volume extra-para to 8fe5e148
Read 90 bytes from volume extra-para to 80010000
Read 16 bytes from volume extra-para.b to 8fe5e148
Read 79 bytes from volume extra-para.b to 800100b4
the fwFlag0/1 is GOOD
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=3", size 124 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 512
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 994, bad PEBs: 4, corrupted PEBs: 0
ubi0: user volume: 20, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1740612857
ubi0: available PEBs: 0, total reserved PEBs: 994, PEBs reserved for bad PEB handling: 16
Read 16 bytes from volume extra-para to 8fe5e150
Read 90 bytes from volume extra-para to 80010000
Read 16 bytes from volume extra-para.b to 8fe5e150
Read 79 bytes from volume extra-para.b to 800100b4
the fwFlag0/1 is GOOD
the score0 is 1
the score1 is 2
UBI volume is ok[bootloader.b].
UBI volume is ok[kernel.b].
UBI volume is ok[rootfs.b].
Read 16 bytes from volume firmware-info.b to 8fe5e0a0
Read 132 bytes from volume firmware-info.b to 21000000
UBI volume is ok[firmware-info.b].
Read 16 bytes from volume device-info to 8fe5e140
Read 901 bytes from volume device-info to 80010000
UBI volume is ok[device-info].
Loading from nand0, ubi volume kernel.b, to 0x80010000
ubi0: detaching mtd1
ubi0: mtd1 is detached
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=3", size 124 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 512
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 994, bad PEBs: 4, corrupted PEBs: 0
ubi0: user volume: 20, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1740612857
ubi0: available PEBs: 0, total reserved PEBs: 994, PEBs reserved for bad PEB handling: 16
Read 2048 bytes from volume kernel.b to 80010000
Fit image detected...
Read 1848408 bytes from volume kernel.b to 80010000
FIT description: MIPS OpenWrt FIT (Flattened Image Tree)
Image 0 (kernel@1)
Description: MIPS OpenWrt Linux-4.4.198
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x800100e4
Data Size: 1836114 Bytes = 1.8 MiB
Architecture: MIPS
OS: Linux
Load Address: 0x81001000
Entry Point: 0x81001000
Hash algo: crc32
Hash value: af8adf2e
Hash algo: sha1
Hash value: 2c1ca2f6ce5f3d0933efb7fdba0135c22754ac8d
Image 1 (fdt@1)
Description: MIPS OpenWrt vmlinux device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x801d0670
Data Size: 10943 Bytes = 10.7 KiB
Architecture: MIPS
Hash algo: crc32
Hash value: 9f639d0b
Hash algo: sha1
Hash value: 4b4bbf765d88edd0047f8b8309a241fba91c2dee
Default Configuration: 'config@1'
Configuration 0 (config@1)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@1
Automatic boot of image at addr 0x80010000 ...
## Loading kernel from FIT Image at 80010000 ...
Using 'config@1' configuration
Trying 'kernel@1' kernel subimage
Description: MIPS OpenWrt Linux-4.4.198
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x800100e4
Data Size: 1836114 Bytes = 1.8 MiB
Architecture: MIPS
OS: Linux
Load Address: 0x81001000
Entry Point: 0x81001000
Hash algo: crc32
Hash value: af8adf2e
Hash algo: sha1
Hash value: 2c1ca2f6ce5f3d0933efb7fdba0135c22754ac8d
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 80010000 ...
Using 'config@1' configuration
Trying 'fdt@1' fdt subimage
Description: MIPS OpenWrt vmlinux device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x801d0670
Data Size: 10943 Bytes = 10.7 KiB
Architecture: MIPS
Hash algo: crc32
Hash value: 9f639d0b
Hash algo: sha1
Hash value: 4b4bbf765d88edd0047f8b8309a241fba91c2dee
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x801d0670
Uncompressing Kernel Image ... OK
Loading Device Tree to 8fe57000, end 8fe5cabe ... OK
[ 0.000000] Linux version 4.4.198 (jenkins_router@sohoilinuxbuild) (gcc version 5.4.0 (OpenWrt GCC 5.4.0 unknown) ) #1 SMP Wed Feb 23 19:02:06 CST 2022
[ 0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[ 0.000000] MIPS: machine is MediaTek MT7621 RFB (NAND)
[..]
[ 16.092683] usbcore: registered new interface driver usb-storage
procd: - preinit -
16.24 48.24 preinit_main define_default_set_state
16.33 48.51 preinit_main do_ramips
16.36 48.60 preinit_main do_checksumming_disable
16.38 48.66 preinit_main preinit_set_mac_address
16.43 48.77 preinit_main ramips_set_preinit_iface
16.45 48.81 preinit_main preinit_ip
16.45 48.81 preinit_main pi_indicate_preinit
16.47 48.87 preinit_main indicate_regular_preinit
16.48 48.90 preinit_main initramfs_test
16.49 48.93 preinit_main do_mount_root
----mtdblock:/dev/mtdblock24----
[ 16.636116] jffs2: write-buffering enabled buffer (2048) erasesize (126976)
[ 16.656958] jffs2: jffs2_scan_inode_node(): CRC failed on node at 0x00234fe4: Read 0xffffffff, calculated 0xc998c849
[ 16.670000] jffs2: Empty flash at 0x00235028 ends at 0x00235800
[ 16.684280] jffs2: Empty flash at 0x00238e58 ends at 0x00239000
[ 16.737944] jffs2: notice: (629) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
=========================USERCONFIG INITIAL======================
Copy userconfig to memory
cp: can't stat '/etc/config/openvpn-mgmt': No such file or directory
cp: can't stat '/etc/config/portal-mgmt': No such file or directory
[ 17.553777] jffs2: notice: (660) check_node_data: wrong data CRC in data node at 0x0023e02c: read 0xa864b12, calculated 0xf5641d8e.
cp: can't stat '/tmp/userconfig/etc/config/openvpn-mgmt': No such file or directory
cp: can't stat '/tmp/userconfig/etc/config/portal-mgmt': No such file or directory
=========================USERCONFIG DONE======================
[setDftMac,2812]: readMac[14:EB:B6:XX:XX:XX]
cp: can't stat '/etc/config/openvpn-mgmt': No such file or directory
cp: can't stat '/etc/config/portal-mgmt': No such file or directory
[ 19.998790] [[MTD(firmware)]] doing write at addr(0x033d2000), len(0x00000000)
[ 20.021408] [[MTD(firmware)]] doing write at addr(0x033d2800), len(0x00000000)
Saved
cp: can't stat '/etc/config/openvpn-mgmt': No such file or directory
cp: can't stat '/etc/config/portal-mgmt': No such file or directory
[ 20.318751] random: nonblocking pool is initialized
[ 20.513442] [[MTD(firmware)]] doing write at addr(0x033d3000), len(0x00000000)
[ 20.522733] [[MTD(firmware)]] doing write at addr(0x033d3800), len(0x00000000)
[ 20.563915] [[MTD(firmware)]] doing write at addr(0x033d4000), len(0x00000000)
Saved
20.54 60.48 preinit_main run_init
procd: - early -
procd: - watchdog -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
cd /tmp && dkmgt_firmware_make -R -f /dev/mtdblock3 -p 0x0 -n firmware-info -o firmware-info.json -w ubi
{
"software-version": "2.0.1 Build 20220223 Rel.68551",
"firmware-id": "123AAAABBBBAAAABBBBAAAABBBBAAAABBBB321"
}######: Init Firmware version *SUCCESS* !!
cd /tmp && dkmgt_firmware_make -R -f /dev/mtdblock3 -p 0x0 -n device-info -o device-info.json -w ubi
######: Init model version *SUCCESS* !!
[ 22.501321] mtdoops: Attached to MTD device 4
[ 22.638614] liblogger: module license 'unspecified' taints kernel.
[..]
[ 86.105010] init special_route module finish, nf_conntrack_max=[150000].
[ 86.124534] special route target init success!
generate ipsec_check_dns time:t2 - t1 is [ 0.0006108283996582 ]
ipsec_reload.lua time=[ 0.0068209171295166 ]
session_limits_enabled_rule_num = 0,rmmod xt_tpconnlimit
{
"software-version": "2.0.1 Build 20220223 Rel.68551",
"firmware-id": "123AAAABBBBAAAABBBBAAAABBBBAAAABBBB321"
}{
"software-version": "2.0.1 Build 20220223 Rel.68551",
"firmware-id": "123AAAABBBBAAAABBBBAAAABBBBAAAABBBB321"
}[ 95.303310] Speedtest (info) Initializing Device Driver.
[ 95.308827] Speedtest (info) Registered character device with major number 248.
[ 95.316409] Speedtest (info) Device class registered.
[ 95.322074] Speedtest (info) Device class created correctly.
procd: - init complete -
[ 100.287408] [[MTD(firmware)]] doing write at addr(0x033d5000), len(0x00000000)
[ 100.297165] [[MTD(firmware)]] doing erase at addr(0x033a0000), len(0x00000000)
[ 100.307117] [[MTD(firmware)]] doing write at addr(0x033a0000), len(0x00000000)
[ 100.427185] mt753x gsw: Port 4 Link is Up - 1Gbps/Full
[ 100.479787] [[MTD(firmware)]] doing write at addr(0x033d5800), len(0x00000000)
[ 100.489592] [[MTD(firmware)]] doing write at addr(0x033d6000), len(0x00000000)
[ 100.508148] [[MTD(firmware)]] doing write at addr(0x033d6800), len(0x00000000)
Login timed out Please press Enter to activate this console.
As you see, it boot into OLD firmware.
At least, it's not (yet) a brick 
Something I did wrong?
Something someone wants me to try?
Regards from Germany,
Thorsten