go into the uboot cli
run tftpboot
then bootm
I wrote that a week ago already.
No guarantee it'll succeed.
1 Like
with kernel renamed to 0A0A0A7B.img
** no problem OpenWrt run fine **
i do not understand, is it running in ram now?
fw_printenv
root@(none):/# fw_printenv
bootcmd=mtkautoboot
bootmenu_0=Startup system (Default)=mtkboardboot
bootmenu_1=Upgrade firmware=mtkupgrade fw
bootmenu_2=Upgrade bootloader=mtkupgrade bl
bootmenu_3=Upgrade bootloader (advanced mode)=mtkupgrade bladv
bootmenu_4=Load image=mtkload
bootmenu_5=Upgrade mtkfirmware=mtkupgrade mtkfw
fdtcontroladdr=8ffeb890
ipaddr=10.10.10.123
serverip=10.10.10.3
stdin=serial
stdout=serial
stderr=serial
serialnum=S220Y461
countrycode=E1
ethaddr=D4:1A:D1:D4
wifiwpapsk=R4N3FAJREX
root@(none):/#
posted before
with OEM firmware -> f -> safe mode
and if you now ll use sysupgrade.bin will it softbrick? or it will go back to zyxel firmware?
it's complicated the sysupgrade because I don't have the ssh or the console login & password
I tried tftp 2 -> and it doesn't work
it takes a little time for the tests don't be in a hurry
No hurry, currently awaiting @SirLouen to get up and running as then there's a comparison to how far you have got.
no i'm not, just litlle warry if you brick it. make sure uou are able to recover.
so boot initram.bin, and try sysupgrade.bin
with kernel initram -> web sysupgrade ->
bootnum =1
Checking FW1 combo magic and checksum ...Attempt to read outside the flash area
Fail.
Default combo magic is 5a4e4554, FW1 combo magic is dc984e5a
Checking FW2 combo magic and checksum ... Fail.
Default combo magic is 5a4e4554, FW2 combo magic is 55424923
******ALL image are broken******
Loading from nand0, offset 0x2c00000
** Unknown image type
=>
you get this when running initram and try to upgrade from web?
at this point the device reboot or still openwrt in ram?
I removed keys 3 and 4 from the numeric keypad so as not to flash the bootloader by mistake !!!
sysupgrade
Writing from <stdin> to kernel ...
[ 154.574198] ubi0: attaching mtd4
[ 156.744248] ubi0: scanning is finished
[ 156.748315] ubi0 error: ubi_read_volume_table: the layout volume was not found
[ 156.755747] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd4, error -22
ubiattach: error!: cannot attach mtd4
error 22 (Invalid argument)
ubiformat: mtd4 (nand), size 119013376 bytes (113.5 MiB), 908 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 907 -- 100 % complete
ubiformat: 280 eraseblocks have valid erase counter, mean value is 0
ubiformat: 301 eraseblocks are supposedly empty
ubiformat: 1 bad eraseblocks found, numbers: 724
ubiformat: warning!: 326 of 907 eraseblocks contain non-UBI data
ubiformat: warning!: only 280 of 907 eraseblocks have valid erase counter
ubiformat: erase counter 0 will be used for all eraseblocks
ubiformat: note, arbitrary erase counter value may be specified using -e option
ubiformat: use erase counter 0 for all eraseblocks
ubiformat: formatting erasebloc[ 165.082165] ubi0: attaching mtd4
ubiformat: formatting eraseblock 907 -- 100 % complete
[ 167.450543] ubi0: scanning is finished
[ 167.471649] ubi0: attached mtd4 (name "ubi", size 113 MiB)
[ 167.477231] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 167.484076] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 167.490853] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 167.497804] ubi0: good PEBs: 907, bad PEBs: 1, corrupted PEBs: 0
[ 167.503782] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[ 167.510990] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 974110724
[ 167.520023] ubi0: available PEBs: 884, total reserved PEBs: 23, PEBs reserved for bad PEB handling: 19
[ 167.529338] ubi0: background thread "ubi_bgt0d" started, PID 3799
UBI device number 0, total 907 LEBs (115167232 bytes, 109.8 MiB), available 884 LEBs (112246784 bytes, 107.0 MiB), LEB size 126976 bytes (124.0 KiB)
Volume ID 0, size 33 LEBs (4190208 bytes, 3.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 108056576
Volume ID 1, size 851 LEBs (108056576 bytes, 103.0 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
[ 169.736973] reboot: Restarting system
===================================================================
MT7621 stage1 code Dec 16 2019 17:45:55 (ASIC)
CPU=500000000 HZ BUS=166666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
and aftter restart
*** U-Boot Boot Menu ***
1. Startup system (Default)
2. Upgrade firmware
3. Upgrade bootloader
4. Upgrade bootloader (advanced mode)
5. Load image
6. Upgrade mtkfirmware
0. U-Boot console
Press UP/DOWN to move, ENTER to select
bootnum =1
bootnum =1
Checking FW1 combo magic and checksum ...Attempt to read outside the flash area
Fail.
Default combo magic is 5a4e4554, FW1 combo magic is dc984e5a
Checking FW2 combo magic and checksum ... Fail.
Default combo magic is 5a4e4554, FW2 combo magic is 55424923
******ALL image are broken******
Loading from nand0, offset 0x2c00000
** Unknown image type
=> 0<INTERRUPT>
=>
...More images of the board
3 solder points to remove the heat sink
The only visible chip I've found
The Kioxia TC58BVG0S3HBAI4 128MB NAND Flash.
These are the pins according to Annick
Now its time to solder
serial port is at the post beginning !!!
for partitions with 2 firmware exist a similar poduct in snapshot
also in x-wrt
that's the u-boot variable ipaddr in hex 
yes , i know ... i rename bin with this name
problem is:
with another boorloader ( huasifei ) no problem
with oem hangup
similar product: