Patch bumping kernel 4.14.91 to 4.14.93 breaks normal work! (Breed bootloader)

Hi there!
My device is Xiaomi Mi Wifi Router 3G, and I regularly build pre-configured OpenWRT firmware with some additional software (kernel modules, packages) built-in, for my own use. And all updates before 14.01.2019 were OK. But from 14.01.2019, after this patch: https://github.com/openwrt/openwrt/commit/8c6f00ef4f17999c5110166764773e40b9a934de
kernel/Linux not working as expected. While some parts of kernel thinks that kernel version is 4.14.93, some other kernel parts (and Linux at all) thinks that kernel version 4.14.91 (dmesg log and uname, for example). But all the kernel modules are located in /lib/modules/4.14.93 but none is loaded nor at boot time, nor later with modprobe/insmod. lsmod gives blank output

 -----------------------------------------------------
 OpenWrt SNAPSHOT, r9069-f4ebd1ead0
 -----------------------------------------------------
root@OpenWrt:~# dmesg
[    0.000000] Linux version 4.14.91 (user@D6-AUX1) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r9019-0e8d5ff0fc)) #0 SMP Fri Jan 11 16:23:29 2019
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is Xiaomi Mi Router 3G
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 10000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] On node 0 totalpages: 65536
[    0.000000] free_area_init_node: node 0, pgdat 805be420, node_mem_map 81003000
[    0.000000]   Normal zone: 512 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 65536 pages, LIFO batch:15
[    0.000000] random: get_random_bytes called from start_kernel+0x90/0x4a0 with crng_init=0
[    0.000000] percpu: Embedded 14 pages/cpu @81211000 s26704 r8192 d22448 u57344
[    0.000000] pcpu-alloc: s26704 r8192 d22448 u57344 alloc=14*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 65024
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Writing ErrCtl register=00044100
[    0.000000] Readback ErrCtl register=00044100
[    0.000000] Memory: 253168K/262144K available (4625K kernel code, 238K rwdata, 1020K rodata, 248K init, 249K bss, 8976K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 1000MHz
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 3822520893 ns
[    0.000009] sched_clock: 32 bits at 500MHz, resolution 2ns, wraps every 4294967295ns
[    0.007805] Calibrating delay loop... 666.41 BogoMIPS (lpj=3332096)
[    0.073975] pid_max: default: 32768 minimum: 301
[    0.078733] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.085240] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.093905] Hierarchical SRCU implementation.
[    0.099034] smp: Bringing up secondary CPUs ...
[    3.563803] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    3.563811] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    3.563822] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    3.563950] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.163771] Synchronize counters for CPU 1: done.
[    3.600618] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    3.600625] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    3.600632] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    3.600697] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.254799] Synchronize counters for CPU 2: done.
[    3.689845] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    3.689852] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    3.689858] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    3.689927] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.339968] Synchronize counters for CPU 3: done.
[    0.369811] smp: Brought up 1 node, 4 CPUs
[    0.377391] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.387170] futex hash table entries: 1024 (order: 3, 32768 bytes)
[    0.393457] pinctrl core: initialized pinctrl subsystem
[    0.399957] NET: Registered protocol family 16
[    0.412799] FPU Affinity set after 13320 emulations
[    0.414301] pull PCIe RST: RALINK_RSTCTRL = 0
[    0.719062] release PCIe RST: RALINK_RSTCTRL = 7000000
[    0.724107] ***** Xtal 40MHz *****
[    0.727464] release PCIe RST: RALINK_RSTCTRL = 7000000
[    0.732562] Port 0 N_FTS = 1b105000
[    0.736027] Port 1 N_FTS = 1b105000
[    0.739475] Port 2 N_FTS = 1b102800
[    1.894803] PCIE2 no card, disable it(RST&CLK)
[    1.899160]  -> 21007f2
[    1.901567] PCIE0 enabled
[    1.904157] PCIE1 enabled
[    1.906761] PCI host bridge /pcie@1e140000 ranges:
[    1.911532]  MEM 0x0000000060000000..0x000000006fffffff
[    1.916689]   IO 0x000000001e160000..0x000000001e16ffff
[    1.921891] PCI coherence region base: 0xbfbf8000, mask/settings: 0x60000000
[    1.936403] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    1.942219] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    1.947875] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    1.955181] PCI host bridge to bus 0000:00
[    1.959222] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    1.966056] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    1.971909] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    1.978666] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.986554] pci 0000:00:00.0: [0e8d:0801] type 01 class 0x060400
[    1.986592] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    1.986603] pci 0000:00:00.0: reg 0x14: [mem 0x60300000-0x6030ffff]
[    1.986662] pci 0000:00:00.0: supports D1
[    1.986670] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    1.986899] pci 0000:00:01.0: [0e8d:0801] type 01 class 0x060400
[    1.986926] pci 0000:00:01.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    1.986940] pci 0000:00:01.0: reg 0x14: [mem 0x60310000-0x6031ffff]
[    1.986986] pci 0000:00:01.0: supports D1
[    1.986993] pci 0000:00:01.0: PME# supported from D0 D1 D3hot
[    1.987361] pci 0000:01:00.0: [14c3:7603] type 00 class 0x028000
[    1.987403] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff]
[    1.987523] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[    1.987681] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    1.987834] pci 0000:02:00.0: [14c3:7662] type 00 class 0x028000
[    1.987884] pci 0000:02:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit]
[    1.987928] pci 0000:02:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    1.988014] pci 0000:02:00.0: PME# supported from D0 D3hot D3cold
[    1.988178] pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 02
[    1.988193] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 02
[    1.988250] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    1.994778] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    2.001673] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000]
[    2.008253] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000]
[    2.015155] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    2.021902] pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff]
[    2.028635] pci 0000:00:01.0: BAR 9: assigned [mem 0x60200000-0x602fffff pref]
[    2.035815] pci 0000:00:00.0: BAR 1: assigned [mem 0x60300000-0x6030ffff]
[    2.042554] pci 0000:00:01.0: BAR 1: assigned [mem 0x60310000-0x6031ffff]
[    2.049305] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff]
[    2.056023] pci 0000:00:00.0: PCI bridge to [bus 01]
[    2.060957] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    2.067694] pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff 64bit]
[    2.074964] pci 0000:02:00.0: BAR 6: assigned [mem 0x60200000-0x6020ffff pref]
[    2.082108] pci 0000:00:01.0: PCI bridge to [bus 02]
[    2.087051] pci 0000:00:01.0:   bridge window [mem 0x60100000-0x601fffff]
[    2.093775] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff pref]
[    2.102143] clocksource: Switched to clocksource GIC
[    2.108396] NET: Registered protocol family 2
[    2.113413] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[    2.120294] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[    2.126724] TCP: Hash tables configured (established 2048 bind 2048)
[    2.133126] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    2.138887] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    2.145332] NET: Registered protocol family 1
[    2.149645] PCI: CLS 0 bytes, default 32
[    2.372140] 4 CPUs re-calibrate udelay(lpj = 3325952)
[    2.378251] Crashlog allocated RAM at address 0x3f00000
[    2.383667] workingset: timestamp_bits=30 max_order=16 bucket_order=0
[    2.395737] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.401481] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    2.413945] random: fast init done
[    2.417693] io scheduler noop registered
[    2.421517] io scheduler deadline registered (default)
[    2.427596] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    2.434999] console [ttyS0] disabled
[    2.438533] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 18, base_baud = 3125000) is a 16550A
[    2.447575] console [ttyS0] enabled
[    2.454483] bootconsole [early0] disabled
[    2.463101] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    2.469781] MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
[    2.476883] Enable NFI Clock
[    2.479751] # MTK NAND # : Use HW ECC
[    2.483450] Device found in MTK table, ID: c8d1, EXT_ID: 809540
[    2.489344] Support this Device in MTK table! c8d1
[    2.494320] [NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
[    2.500774] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0xd1
[    2.507108] nand: ESMT NAND 128MiB 3,3V 8-bit
[    2.511442] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    2.518999] Scanning device for bad blocks
[    2.664422] 10 fixed-partitions partitions found on MTD device MT7621-NAND
[    2.671261] Creating 10 MTD partitions on "MT7621-NAND":
[    2.676566] 0x000000000000-0x000000080000 : "Bootloader"
[    2.682819] 0x000000080000-0x0000000c0000 : "Config"
[    2.688538] 0x0000000c0000-0x000000100000 : "Bdata"
[    2.694195] 0x000000100000-0x000000140000 : "Factory"
[    2.699970] 0x000000140000-0x000000180000 : "crash"
[    2.705656] 0x000000180000-0x0000001c0000 : "crash_syslog"
[    2.711872] 0x0000001c0000-0x000000200000 : "reserved0"
[    2.717884] 0x000000200000-0x000000600000 : "kernel_stock"
[    2.724191] 0x000000600000-0x000000a00000 : "kernel"
[    2.729960] 0x000000a00000-0x000007f80000 : "ubi"
[    2.736273] [mtk_nand] probe successfully!
[    2.741077] Signature matched and data read!
[    2.745344] load_fact_bbt success 1023
[    2.749634] libphy: Fixed MDIO Bus: probed
[    2.824676] libphy: mdio: probed
[    4.228156] mtk_soc_eth 1e100000.ethernet: loaded mt7530 driver
[    4.234688] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 20
[    4.243431] i2c /dev entries driver
[    4.248464] NET: Registered protocol family 10
[    4.254132] Segment Routing with IPv6
[    4.257861] NET: Registered protocol family 17
[    4.262356] 8021q: 802.1Q VLAN Support v1.8
[    4.269167] UBI: auto-attach mtd9
[    4.272541] ubi0: attaching mtd9
[    5.261680] mtk_soc_eth 1e100000.ethernet eth0: port 3 link up
[    5.383293] ubi0: scanning is finished
[    5.402802] ubi0: attached mtd9 (name "ubi", size 117 MiB)
[    5.408277] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    5.415136] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    5.421889] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    5.428824] ubi0: good PEBs: 940, bad PEBs: 0, corrupted PEBs: 0
[    5.434812] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    5.442000] ubi0: max/mean erase counter: 5/2, WL threshold: 4096, image sequence number: 1136273717
[    5.451096] ubi0: available PEBs: 0, total reserved PEBs: 940, PEBs reserved for bad PEB handling: 20
[    5.460304] ubi0: background thread "ubi_bgt0d" started, PID 378
[    5.462307] block ubiblock0_0: created from ubi0:0(rootfs)
[    5.471750] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem
[    5.478700] hctosys: unable to open rtc device (rtc0)
[    5.483966] usb_vbus: disabling
[    5.493343] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    5.500990] Freeing unused kernel memory: 248K
[    5.505480] This architecture does not have kernel memory protection.
[    6.015595] init: Console is alive
[    6.019204] init: - watchdog -
[    6.042567] init: - preinit -
[    6.205483] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up
[    6.251457] mtk_soc_eth 1e100000.ethernet eth0: port 2 link up
[    6.805043] mtk_soc_eth 1e100000.ethernet: PPE started
[    9.973503] mount_root: loading kmods from internal overlay
[    9.985278] mount_root: failed to launch kmodloader from internal overlay
[   10.518312] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 443
[   10.521148] random: procd: uninitialized urandom read (4 bytes read)
[   10.592669] UBIFS (ubi0:1): recovery needed
[   10.782051] UBIFS (ubi0:1): recovery completed
[   10.786671] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[   10.794481] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   10.804368] UBIFS (ubi0:1): FS size: 89264128 bytes (85 MiB, 703 LEBs), journal size 4444160 bytes (4 MiB, 35 LEBs)
[   10.814767] UBIFS (ubi0:1): reserved for root: 4216165 bytes (4117 KiB)
[   10.821352] UBIFS (ubi0:1): media format: w4/r0 (latest is w5/r0), UUID 9D3F4B11-6D55-44AE-95EA-A32C5E2956F2, small LPT model
[   10.834111] block: attempting to load /tmp/ubifs_cfg/upper/etc/config/fstab
[   10.841191] block: unable to load configuration (fstab: Entry not found)
[   10.847985] block: attempting to load /tmp/ubifs_cfg/etc/config/fstab
[   10.854648] block: unable to load configuration (fstab: Entry not found)
[   10.861377] block: attempting to load /etc/config/fstab
[   10.868838] block: unable to load configuration (fstab: Entry not found)
[   10.875608] block: no usable configuration
[   10.912317] UBIFS (ubi0:1): un-mount UBI device 0
[   10.917020] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" stops
[   10.928905] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 446
[   11.043188] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[   11.051007] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   11.060890] UBIFS (ubi0:1): FS size: 89264128 bytes (85 MiB, 703 LEBs), journal size 4444160 bytes (4 MiB, 35 LEBs)
[   11.071288] UBIFS (ubi0:1): reserved for root: 4216165 bytes (4117 KiB)
[   11.077884] UBIFS (ubi0:1): media format: w4/r0 (latest is w5/r0), UUID 9D3F4B11-6D55-44AE-95EA-A32C5E2956F2, small LPT model
[   11.452961] block: attempting to load /tmp/ubifs_cfg/upper/etc/config/fstab
[   11.460009] block: unable to load configuration (fstab: Entry not found)
[   11.466758] block: attempting to load /tmp/ubifs_cfg/etc/config/fstab
[   11.473299] block: unable to load configuration (fstab: Entry not found)
[   11.480024] block: attempting to load /etc/config/fstab
[   11.485316] block: unable to load configuration (fstab: Entry not found)
[   11.492032] block: no usable configuration
[   11.535668] mount_root: overlay filesystem has not been fully initialized yet
[   11.547230] mount_root: switching to ubifs overlay
[   11.564183] urandom-seed: Seed file not found (/etc/urandom.seed)
[   11.648155] mtk_soc_eth 1e100000.ethernet: 0x100 = 0x6060000c, 0x10c = 0x80818
[   11.662249] procd: - early -
[   11.665222] procd: - watchdog -
[   12.282305] procd: - watchdog -
[   12.285721] procd: - ubus -
[   12.303850] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.347043] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.353800] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.360872] procd: - init -
[   14.090008] urandom_read: 5 callbacks suppressed
[   14.090020] random: jshn: uninitialized urandom read (4 bytes read)
[   27.032262] random: crng init done
[   33.094634] mtk_soc_eth 1e100000.ethernet: PPE started
[   33.098925] device eth0 entered promiscuous mode
[   33.100252] br-lan: port 1(eth0.1) entered blocking state
[   33.100267] br-lan: port 1(eth0.1) entered disabled state
[   33.100720] device eth0.1 entered promiscuous mode
[   33.103630] br-lan: port 1(eth0.1) entered blocking state
[   33.103653] br-lan: port 1(eth0.1) entered forwarding state
[   33.103940] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   34.219639] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

I tried to reconfigure from scratch (deleting everything, then git clone ... make menuconfig ... and so on) but it didn't help. Moreover, I downloaded automatically built snapshot from here: https://downloads.openwrt.org/snapshots/targets/ramips/mt7621/openwrt-ramips-mt7621-mir3g-squashfs-sysupgrade.bin
and result is the same: none of modules are loaded, even pre-installed in snapshot (for example, pppoe - because my internet connection type is PPPoE).
Then I tried to make necessary dir: /lib/modules/4.14.91 (making a symlink to /lib/modules/4.14.93 or simply making the dir and copying everything from 4.14.93 to 4.14.91). The result is - device immediately hangs and then, after reset, cannot boot (hangs on boot) anymore.
Of couse, many times I restored to my previous OpenWRT firmware (r9019, updated and built on 13.01.2019) with restoring of all my settings, and it worked as if nothing had happened. Many times I erased all my settings (with firstboot) and then upgrading to new firmware with "half-working" kernel... But nothing helps.

Please, fix this! I cannot fix because I don't know where to look and even from where to start investigating. Searching for "4.14.91" or "14.91" in all OpenWRT files did not give any valuable result.
Or please tell me how to fix, where to look.

Thanks!

Try latest master 4.14.94

1 Like

I had the same issue. I just remove "bin" directory so all modules from kernel version 91 was deleted and only 93 was created.

I investigated deeper and it turned out that actually the problem is in sysupgrade, not in kernel. I made full *.bin file for Breed bootloader - and now all OK: kernel version 4.14.94 showing everywhere and loads all the modules as expected. For now I don't know - maybe it was needed to sysupgrade the same *sysupgrade.bin twice?
Thanks for answers, it gave me a hunch about the root of the problem: sysupgrade.

can you explain how you made your "full *.bin" for breed? Would be very interested in using breed for flashing OpenWRT! :slight_smile:

1 Like

@Ykidia , @thorsten97 , please share your ideas on how to create valid *.bin files for BREED.
Do you know the .bin file of the stock firmware can be deconstructed to generate *.bin files for BREED?

Thanks a million!

Got from 4pda.ru/forum, Windows cmd/bat-file with following contents:

@echo off

if "%~1" neq "" (echo %~1) else (goto help)
del /q /f openwrt_for_breed.bin >nul
del /q /f ~tempfile >nul
del /q /f ~kernel* >nul
set size=0
for %%I in (%1) do set/A size=4194304-%%~zI
fsutil file createnew ~tempfile %size%
copy /b %1+~tempfile ~kernel
del /q /f ~tempfile >nul
copy /b ~kernel+~kernel ~kernel1
copy /b ~kernel1+%2 openwrt_for_breed.bin
del /q /f ~kernel* >nul
exit
:help
echo.
echo.This will make OpenWrt binary file for using with Breed for Mi Router 3G.
echo.
echo Usage:
echo create_openwrt_for_breed.cmd {kernel1 file} {rootfs0 file}
echo.
echo Example: %0
echo create_openwrt_for_breed.cmd openwrt-18.06.0-ramips-mt7621-mir3g-squashfs-kernel1.bin openwrt-18.06.0-ramips-mt7621-mir3g-squashfs-rootfs0.bin
echo.

pause

I.e. we adding bytes to kernel1 up to 4MB then: kernel1(4MB)+rootfs0 = full breed image. Then flashing this via Breed to 2nd part.

Great thanks a lot!
Can someone translate it to working linux commands?

Thanks for the windows script.
Ok, what you are basically saying is: Given you selected "firmware section 2", BREED takes any file and flashes it to either (if you are on stock firmware)
mtd9: 00400000 00020000 "kernel1" (4 MiB)
mtd10: 02000000 00020000 "rootfs0" (32 MiB)

or to (if you are on OpenWRT)

mtd8: 00400000 00020000 "kernel" (4 MiB)
mtd9: 07580000 00020000 “ubi” (120 MiB)

right? So BREED does not uncompress any .bin file, right?
If you intend to flash padavan, for instance, then you want BREED to flash a .trx file, which, AFAIK, is a compressed image ... This BREED thing is just a big ball of unknown mud. Nobody knows, except Hackpascal, what it is doing and what not.

Ok, do you know if these .bin files from Xiaomi containing stock firmware have the same layout and no compression als the .bin files that are generated by this script?

Thanks and best wishes!

Should this work on linux?

truncate -s 4M kernel1.bin   ### to make the kernel1 4Megs in size
cat kernel1 rootfs0 > full.bin ### combine both into one

would be fantastic as I hate this extra stepp of flashing stock first ...

@thorsten97
You can try this three lines here .. However, I don't provide any warranty for them. Do it on your own risk!!! If your router doesn't start anymore, be sure to have a fallback solution to bring it back to life!
I'm not responsible for any damage whatsoever!

But I do think, this three-liner works as intended:

tr '\0' '\377' < /dev/zero | dd of=mir3g_kernel1_rootfs0_breed.bin ibs=1k count=36k
dd if=kernel1.bin of=mir3g_kernel1_rootfs0_breed.bin seek=0 obs=1k conv=notrunc
dd if=rootfs0.bin of=mir3g_kernel1_rootfs0_breed.bin seek=4k obs=1k conv=notrunc

You need two files:

  1. a kernel1.bin which denotes a kernel partition saved to a file that should be flashed to firmware section 2. Please do not touch firmware section 1, because that's your recovery partition. Please notice that the script @Ykidia has posted here, generates .bin files suitable for flashing section 1 and 2. Have a look at line 12 of that script to see what I mean ... Frankly speaking I would advise against its use ...

  2. rootfs0.bin which denotes a root file system partion, which should go to mtd partition "rootfs0".

So what my script basically does is write a file that is 36MiB long, that is the size of the kernel0 plus the rootfs0 partition. Then it writes the contents of file "kernel1.bin" to the aforementioned file at offset 0. Then it takes the "rootfs0.bin" and writes its contents to the generated file at position 4MiB. The first, generated file is not truncated during these operations. So it maintains its size and only contents of the other files are filled in.

Please give it a shot and report back if it works. Thanks for your testing!

Cheers, DFahren

Thanks a lot for your efforts!

Unfortunately it doesn't work for me. Did you try it?

Hmmm, that's bad news. No, I didn't try yet. What's the output on the serial console?

That really, really puzzles me ... Did you set "autoboot.command boot flash 0x600000" in BREED?
Other idea would be, use the windows script and see if that works.

under Windows this works:

for /f %%i in ("openwrt-18.06-4.14.93-ramips-mt7621-mir3g-squashfs-kernel1.bin") do ( set /a size = 4194304 - %%~zi >nul )
fsutil file createnew dummy.bin %size% >nul
copy /y /b openwrt-18.06-4.14.93-ramips-mt7621-mir3g-squashfs-kernel1.bin + /b dummy.bin + /b openwrt-18.06-4.14.93-ramips-mt7621-mir3g-squashfs-rootfs0.bin breed-firmware.bin >nul
del dummy.bin

if I interpret it correctly, it is exactly what your linux command should do, right?

I used the autobood.command boot flash 0x600000 and it did not work, but the windows one did.

Really, that's interesting. Taking your script and trying to run it from Windows 7 Enterprise shows the error "missing operand" in line 1. But, yes, your script should in fact does the same as mine, but no idea why mine does not work. Have to check the resulting output from both.

The following script seems to create the correct bin file for Breed:

#!/bin/bash
if [ $# -ne 2 ]; then
    echo Usage: $0 "kernel1.bin" "rootfs0.bin"
    exit 1
fi
kernel1="$1"
rootfs0="$2"
[ -f "$kernel1" ] || { echo "kernel1 file doesn't exist, aborting: $kernel1"; exit 1; }
[ -f "$rootfs0" ] || { echo "rootfs0 file doesn't exist, aborting: $rootfs0"; exit 1; }
[[ ${kernel1##*/} =~ .*kernel1\.bin ]] || echo "first parameter must be kernel1.bin, aborting"
[[ ${rootfs0##*/} =~ .*rootfs0\.bin ]] || echo "second parameter must be rootfs0.bin, aborting"
tmpfile=$(mktemp tmp.XXXXXX)
truncate -s 8M "$tmpfile"
dd if="$kernel1" of="$tmpfile" conv=nocreat,notrunc status=none oflag=seek_bytes seek=0
dd if="$kernel1" of="$tmpfile" conv=nocreat,notrunc status=none oflag=seek_bytes seek=4M
cat "$rootfs0" >> "$tmpfile"
mv "$tmpfile" openwrt_for_breed.bin
echo "openwrt_for_breed.bin successfully created."
1 Like

fantastic, its working for me!! May I ask you were you found it?

Thanks a lot @eg15 . I think this is worth to put it on the Device page. Do you mind ?

Aboslutely @targa I'm happy to make a contribution.
Also, feel free to refer to my Git repository: https://github.com/eg15/mir3g-breed-image-maker
There's a readme with a few screenshots there to make things easier.
Thanks!

1 Like