Hello,
TLDR: Router stuck at Waiting for root device /dev/ubiblock0_0... after sysupgrade AND/OR clean install for the 2 last snapshots & latest robimarko's release.
I had a working Redmi AX6 running robimarko's version for the past year and found out it was kinda officially supported on the snapshot branch so I decided to migrate.
The first sysupgrade went well a month ago (tho I ran into an issue with WAN port being limited to 100MBps).
Yesterday I tried sysupgrading to the latest snapshot of the 1X april.
This caused the router to be completely unable to boot by being stuck on
Waiting for root device /dev/ubiblock0_0...
At first I thought it was due to me upgrading from robimarko to the official version.
So I unbricked my router with the guide I wrote a few months ago and tried to flash OpenWRT's latest snapshot (and robimarko's latest version on another try) from Xiaomi's OEM firmware as described in the official guide.
BusyBox v1.25.1 (2020-07-10 06:27:39 UTC) built-in shell (ash)
-----------------------------------------------------
Welcome to XiaoQiang!
-----------------------------------------------------
$$$$$$\ $$$$$$$\ $$$$$$$$\ $$\ $$\ $$$$$$\ $$\ $$\
$$ __$$\ $$ __$$\ $$ _____| $$ | $$ | $$ __$$\ $$ | $$ |
$$ / $$ |$$ | $$ |$$ | $$ | $$ | $$ / $$ |$$ |$$ /
$$$$$$$$ |$$$$$$$ |$$$$$\ $$ | $$ | $$ | $$ |$$$$$ /
$$ __$$ |$$ __$$< $$ __| $$ | $$ | $$ | $$ |$$ $$<
$$ | $$ |$$ | $$ |$$ | $$ | $$ | $$ | $$ |$$ |\$$\
$$ | $$ |$$ | $$ |$$$$$$$$\ $$$$$$$$$ | $$$$$$ |$$ | \$$\
\__| \__|\__| \__|\________| \_________/ \______/ \__| \__|
root@XiaoQiang:/# nvram get flag_boot_rootfs
1
root@XiaoQiang:/# curl -k -o /tmp/factory.ubi https://downloads.openwrt.org/snapshots/targets/ipq807x/generic/openwrt-ipq807x-generic-redmi_ax6-squashfs-factory.ubi
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 11.2M 100 11.2M 0 0 16.9M 0 --:--:-- --:--:-- --:--:-- 17.2M
root@XiaoQiang:/# md5sum /tmp/factory.ubi
36d0dacbbb9994e068c52c3c3a26c690 /tmp/factory.ubi
root@XiaoQiang:/# ubiformat -s 2048 -O 2048 /dev/mtd12 -f /tmp/factory.ubi
ubiformat: mtd12 (nand), size 37486592 bytes (35.7 MiB), 286 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 285 -- 100 % complete
ubiformat: 224 eraseblocks have valid erase counter, mean value is 0
ubiformat: 62 eraseblocks are supposedly empty
ubiformat: warning!: only 224 of 286 eraseblocks have valid erase counter
ubiformat: mean erase counter 0 will be used for the rest of eraseblock
ubiformat: continue? (y/N) y
ubiformat: use erase counter 0 for all eraseblocks
ubiformat: flashing eraseblock 89 -- 100 % complete
ubiformat: formatting eraseblock 285 -- 100 % complete
root@XiaoQiang:/# nvram set uart_en=1
root@XiaoQiang:/# nvram set boot_wait=on
root@XiaoQiang:/# nvram set telnet_en=1
root@XiaoQiang:/# nvram set ssh_en=1
root@XiaoQiang:/# nvram set flag_last_success=0
root@XiaoQiang:/# nvram set flag_boot_rootfs=0
root@XiaoQiang:/# nvram commit
root@XiaoQiang:/# reboot
Upon reboot, the router outputs
write phy_id=1, reg(0x8074):0x0670
write phy_id=2, reg(0x8074):0x0670
write phy_id=3, reg(0x8074):0x0670
write phy_id=4, reg(0x8074):0x0670
bootwait is on, bootdelay=5
Hit any key to stop autoboot: 0
trigger button release!
boot from rootfs 0
miwifi: check crash in rmem !
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: volume 2 ("rootfs_data") re-sized from 9 to 174 LEBs
ubi0: attached mtd1 (name "mtd=0", size 35 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 286, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 1039267357
ubi0: available PEBs: 0, total reserved PEBs: 286, PEBs reserved for bad PEB handling: 20
Read 0 bytes from volume kernel to 44000000
No size specified -> Using max size (4952064)
Could not find PCI in device tree
## Loading kernel from FIT Image at 44000000 ...
Using 'config@ac04' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-5.15.108
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x440000ec
Data Size: 4796040 Bytes = 4.6 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x41000000
Entry Point: 0x41000000
Hash algo: crc32
Hash value: 25223133
Hash algo: sha1
Hash value: c2c874b101e237ab007fc3ffa1ddba93d343aab5
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
Using 'config@ac04' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt redmi_ax6 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x444930b0
Data Size: 42220 Bytes = 41.2 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: d1c219ab
Hash algo: sha1
Hash value: 313775bdb4287d5d6a0014908b07239b865691e4
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x444930b0
Uncompressing Kernel Image ... OK
Loading Device Tree to 4a3f2000, end 4a3ff4eb ... OK
Using machid 0x8010010 from environment
Starting kernel ...
Jumping to AARCH64 kernel via monitor
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[ 0.000000] Linux version 5.15.108 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.2.0 r22649-1129b226f7) 12.2.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Mon Apr 24 19:02:29 2023
[ 0.000000] Machine model: Redmi AX6
[ 0.000000] Zone ranges:
[ 0.000000] DMA [mem 0x0000000040000000-0x000000005fffffff]
[ 0.000000] DMA32 empty
[ 0.000000] Normal empty
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000040000000-0x0000000040ffffff]
[ 0.000000] node 0: [mem 0x0000000041000000-0x000000004a3fffff]
[ 0.000000] node 0: [mem 0x000000004a400000-0x000000004a4fffff]
[ 0.000000] node 0: [mem 0x000000004a500000-0x000000004a5fffff]
[ 0.000000] node 0: [mem 0x000000004a600000-0x000000004e8fffff]
[ 0.000000] node 0: [mem 0x000000004e900000-0x000000005fffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[ 0.000000] psci: probing for conduit method from DT.
[ 0.000000] psci: PSCIv1.0 detected in firmware.
[ 0.000000] psci: Using standard PSCI v0.2 function IDs
[ 0.000000] psci: MIGRATE_INFO_TYPE not supported.
[ 0.000000] psci: SMC Calling Convention v1.0
[ 0.000000] psci: OSI mode supported.
[ 0.000000] percpu: Embedded 17 pages/cpu s30808 r8192 d30632 u69632
[ 0.000000] Detected VIPT I-cache on CPU0
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 129024
[ 0.000000] Kernel command line: ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait uart_en=1 root=/dev/ubiblock0_0
[ 0.000000] Unknown kernel command line parameters "uart_en=1", will be passed to user space.
[ 0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 415352K/524288K available (7808K kernel code, 860K rwdata, 2136K rodata, 1280K init, 289K bss, 108936K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] Tracing variant of Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[ 0.000000] Root IRQ handler: gic_handle_irq
[ 0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479]
[ 0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[ 0.000001] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[ 0.000119] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000)
[ 0.000136] pid_max: default: 32768 minimum: 301
[ 0.000286] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.000302] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.001977] rcu: Hierarchical SRCU implementation.
[ 0.002149] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[ 0.002689] smp: Bringing up secondary CPUs ...
[ 0.003310] Detected VIPT I-cache on CPU1
[ 0.003376] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[ 0.004011] Detected VIPT I-cache on CPU2
[ 0.004051] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[ 0.004641] Detected VIPT I-cache on CPU3
[ 0.004678] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[ 0.004745] smp: Brought up 1 node, 4 CPUs
[ 0.004772] SMP: Total of 4 processors activated.
[ 0.004780] CPU features: detected: 32-bit EL0 Support
[ 0.004787] CPU features: detected: CRC32 instructions
[ 0.004841] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[ 0.004851] CPU: All CPU(s) started at EL1
[ 0.004872] alternatives: patching kernel code
[ 0.012764] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.012801] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[ 0.012969] pinctrl core: initialized pinctrl subsystem
[ 0.014264] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.014742] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[ 0.014786] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[ 0.014824] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[ 0.015162] thermal_sys: Registered thermal governor 'step_wise'
[ 0.016561] cpuidle: using governor menu
[ 0.016788] ASID allocator initialised with 65536 entries
[ 0.068783] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[ 0.077577] SCSI subsystem initialized
[ 0.077759] usbcore: registered new interface driver usbfs
[ 0.077800] usbcore: registered new interface driver hub
[ 0.077836] usbcore: registered new device driver usb
[ 0.078062] CPUidle PSCI: failed to enable OSI mode: -95
[ 0.078351] qcom_scm: convention: smc arm 64
[ 0.079744] clocksource: Switched to clocksource arch_sys_counter
[ 0.080510] NET: Registered PF_INET protocol family
[ 0.080642] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[ 0.081305] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.081331] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.081347] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.081400] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[ 0.081481] TCP: Hash tables configured (established 4096 bind 4096)
[ 0.081565] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.081594] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.081751] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.081783] PCI: CLS 0 bytes, default 64
[ 0.082896] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[ 0.086821] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.086841] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.087612] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 248)
[ 0.093104] bam-dma-engine 704000.dma-controller: num-channels unspecified in dt
[ 0.093129] bam-dma-engine 704000.dma-controller: num-ees unspecified in dt
[ 0.097007] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.098788] msm_serial 78b3000.serial: msm_serial: detected port #0
[ 0.098837] msm_serial 78b3000.serial: uartclk = 3686400
[ 0.098886] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 22, base_baud = 230400) is a MSM
[ 0.098919] msm_serial: console setup on port #0
[ 0.721656] printk: console [ttyMSM0] enabled
[ 0.726789] msm_serial: driver initialized
[ 0.734894] loop: module loaded
[ 0.734975] Loading iSCSI transport class v2.0-870.
[ 0.739550] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0x61
[ 0.742492] nand: ESMT PSR1GA30DT
[ 0.749062] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[ 0.752567] 13 fixed-partitions partitions found on MTD device qcom_nand.0
[ 0.759808] OF: Bad cell count for /soc/nand-controller@79b0000/nand@0/partitions
[ 0.766627] OF: Bad cell count for /soc/nand-controller@79b0000/nand@0/partitions
[ 0.774751] Creating 13 MTD partitions on "qcom_nand.0":
[ 0.781636] 0x000000000000-0x000000100000 : "0:sbl1"
[ 0.788414] 0x000000100000-0x000000200000 : "0:mibib"
[ 0.793322] 0x000000200000-0x000000500000 : "0:qsee"
[ 0.800098] 0x000000500000-0x000000580000 : "0:devcfg"
[ 0.802814] 0x000000580000-0x000000600000 : "0:rpm"
[ 0.807734] 0x000000600000-0x000000680000 : "0:cdt"
[ 0.812548] 0x000000680000-0x000000700000 : "0:appsblenv"
[ 0.817363] 0x000000700000-0x000000800000 : "0:appsbl"
[ 0.823441] 0x000000800000-0x000000880000 : "0:art"
[ 0.828031] 0x000000880000-0x000000900000 : "bdata"
[ 0.832771] 0x000000900000-0x000000a00000 : "pstore"
[ 0.838080] 0x000000a00000-0x000002dc0000 : "ubi_kernel"
[ 0.875287] 0x000002dc0000-0x000007fe0000 : "rootfs"
[ 0.951353] mtd: setting mtd12 (rootfs) as root device
[ 0.951706] mtdsplit: no squashfs found in "rootfs"
[ 0.959921] spmi spmi-0: PMIC arbiter version v2 (0x20010000)
[ 0.963181] s1: supplied by regulator-dummy
[ 0.966224] s2: supplied by regulator-dummy
[ 0.970235] vdd_s3: supplied by regulator-dummy
[ 0.974529] vdd_s4: supplied by regulator-dummy
[ 0.979031] s5: supplied by regulator-dummy
[ 0.983462] l1: supplied by regulator-dummy
[ 0.987573] l2: supplied by regulator-dummy
[ 0.991754] l3: supplied by regulator-dummy
[ 0.995922] l4: supplied by regulator-dummy
[ 1.000092] l5: supplied by regulator-dummy
[ 1.004243] l6: supplied by regulator-dummy
[ 1.008428] l7: supplied by regulator-dummy
[ 1.012598] l8: supplied by regulator-dummy
[ 1.016744] l9: supplied by regulator-dummy
[ 1.021056] l11: supplied by regulator-dummy
[ 1.025073] l12: supplied by regulator-dummy
[ 1.029594] l13: supplied by regulator-dummy
[ 1.047051] i2c_dev: i2c /dev entries driver
[ 1.051105] sdhci: Secure Digital Host Controller Interface driver
[ 1.051149] sdhci: Copyright(c) Pierre Ossman
[ 1.056381] sdhci-pltfm: SDHCI platform and OF driver helper
[ 1.064294] remoteproc remoteproc0: releasing cd00000.q6v5_wcss
[ 1.068672] NET: Registered PF_INET6 protocol family
[ 1.073112] Segment Routing with IPv6
[ 1.077425] In-situ OAM (IOAM) with IPv6
[ 1.081067] NET: Registered PF_PACKET protocol family
[ 1.084986] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 1.089922] 8021q: 802.1Q VLAN Support v1.8
[ 1.119071] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[ 1.119380] cpr4_ipq807x_apss_read_fuse_data: apc_corner: speed bin = 0
[ 1.125228] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR fusing revision = 1
[ 1.131806] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR misc fuse value = 0
[ 1.139457] cpr4_ipq807x_apss_read_fuse_data: apc_corner: Voltage boost fuse config = 0 boost = disable
[ 1.146983] cpr3_mem_acc_init: apc: not using memory accelerator regulator
[ 1.156112] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused SVS: open-loop= 704000 uV
[ 1.163059] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused NOM: open-loop= 808000 uV
[ 1.173041] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused TURBO: open-loop= 864000 uV
[ 1.182849] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused STURBO: open-loop= 944000 uV
[ 1.192707] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused SVS: quot[ 7]= 742, quot_offset[ 7]= 0
[ 1.202471] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused NOM: quot[ 7]= 944, quot_offset[ 7]= 200
[ 1.213320] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused TURBO: quot[ 7]=1042, quot_offset[ 7]= 95
[ 1.224257] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused STURBO: quot[ 7]=1194, quot_offset[ 7]= 150
[ 1.235337] cpr3_regulator_init_ctrl: apc: Default CPR mode = closed-loop
[ 1.237506] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 19200 KHz, changing to: 1017600 KHz
[ 1.253993] remoteproc remoteproc0: cd00000.q6v5_wcss is available
[ 1.264032] ubi0: attaching mtd12
[ 1.466936] ubi0 error: ubi_attach: bad image sequence number 1943801236 in PEB 286, expected 1310101186
[ 1.466997] Erase counter header dump:
[ 1.475511] magic 0x55424923
[ 1.479054] version 1
[ 1.482794] ec 1
[ 1.485824] vid_hdr_offset 2048
[ 1.488776] data_offset 4096
[ 1.492081] image_seq 1943801236
[ 1.495287] hdr_crc 0x18155c1e
[ 1.498845] erase counter header hexdump:
[ 1.502652] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd12, error -22
[ �[ 1.515094] Waiting for root device /dev/ubiblock0_0...
[ 31.849772] l11: disabling
From what I could find the issue could be the same as here
Or it may be related to the
ubiformat: 224 eraseblocks have valid erase counter, mean value is 0
ubiformat: 62 eraseblocks are supposedly empty
ubiformat: warning!: only 224 of 286 eraseblocks have valid erase counter
ubiformat: mean erase counter 0 will be used for the rest of eraseblock
ubiformat: continue? (y/N) y
But I'm not experienced enough to find a proper solution or to adapt the first one.
Can someone help me?
Thanks
.