[SOLVED] Preparing for U-Boot serial flash in Debian 10 - recommendations?

After semi-bricking a TEW-810DR, I've ordered a USB TTL interface cable which should arrive today. I'm trying to think through the flashing procedure.

The TEW-810DR will bring up a "Rescure" web interface which allows me to select and upload a factory firmware 5.6M image. After a "Success" message, the firmware apparently does not either get installed or does not boot.

I'm using Debian 10 with 2 different options for tftp servers (tftp-hpa or atftpd) and several terminal programs (screen, minicom, kermit)

I have the serial connection parameters:

57600, 8N1

and the total flash size

cat /proc/mtd

dev: size erasesize name
mtd0: 00800000 00010000 "ALL"

Both tftp servers have /srv/*** directories and are normally started by systemd. Any recommendations on which to choose and how to setup? How to convert 5.6MiB to hex?

My understanding is that I upload the renamed firmware image to RAM,

tftpboot 0x81000000 firm.bin

Erase the ~7.75mb flash

erase 0xbf020000 +(5.6MIB converted to hex)

Then copy from RAM -> flash

cp.b 0x81000000 0xbf020000 (5.6MIB converted to hex)

Thanks in advance for any replies

I'm having the worst experience on this forum. I try reading the documentation and when I ask questions on this forum - no one responds. Is it me or is the forum not a good place for questions?



I get the message - can someone point me how to calculate the "RIGHT ONES!"

1 Like

Those values are definitely wrong for the TEW-810 and will result in overwriting the bootloader and the factory partition, which would be a fatal mistake.

Writing directly to flash is therefore a last resort.

First thing with serial connected is to attempt to boot up, and analyze the problem. Often it can be solved without re-flashing at all. For example a wrong network configuration prevents http or ssh access, but the CLI is still operable on serial.

The safest way to re-flash is to TFTP to RAM then boot from RAM an initramfs build of OpenWrt from the snapshots directory, then use it to sysupgrade to a release build.

Sometimes those bootloader http recovery pages don't work with a modern browser, but you can use curl to directly PUT the firmware and it is accepted.

1 Like

Thanks for helping.

Per Ebay, my USB Serial TTL cable was due 3-11 to 3-17 - still has not shown up. USPS must be slowing down due to the virus. When I get the cable, I'll try seeing what it shows with screen and post it.

I read as much as I could find and some recommended a factory image. I've been building my own images and had problems after the mtd partitions were adjusted for the DIR-810 which I was using as a template. The partitions were reverted in snapshot and I have built a new image along with a initramfs. If it comes to a serial flash, would you recommend initramfs over the factory image?

My USB Serial cable finally arrived and I was able to see the boot log in screen /dev/ttyUSB0 57600.

BusyBox v1.31.1 () built-in shell (ash)

 _______                     ________        __
|       |.-----.-----.-----.|  |  |  |.----.|  |_
|   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
|_______||   __|_____|__|__||________||__|  |____|
         |__| W I R E L E S S   F R E E D O M
OpenWrt SNAPSHOT, r12380-71f3179fc8
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
root@Shepnet:/# [   74.211788] jffs2: Erase at 0x0028a000 failed immediately: errno -22
[   77.896178] random: crng init done
[   77.902967] random: 6 urandom warning(s) missed due to ratelimiting

One part that is screwed up is the my /etc/config/network is set for but I can only access the rescue interface if I have a static ip of I have the full screenlog.0 if needed.

If I go into "emergency mode" (hold reset at power on), I get messages about entering the emergency mode. Ctrl-C and the U-Boot log flashes by and enters mode 3 and boots OpenWRT. I do not have Read/Write permissions to edit anything. Can I get R/W when starting the screen command? Would scp the new initramfs firmware to /tmp and running update work?

Any pointers on recovery appreciated.

To mount root R/W mode in "emergency mode" you may use command mount_root and correct network config. If it fail (because of jffs2 errors) you need start again from loading initramfs.bin and etc.
Typical steps fro scratch:

tftpboot 81000000 initramfs.bin
bootm 81000000

Then backup all /dev/mtd* with dd and scp to Big Brother. And flash sysupgarde.bin from openwrt web interface.
Total recovery with only serial console is possible but may vary because of vendor's modification of uboot code. Usually next sequence of command:

tftpboot 81000000 sysupgrade.bin
erase bc170000 690000
cp.b 81000000 bc170000 690000

there 0x690000 is size of sysupgrade.bin rounded up to next 64k boundary.
Flash is mapped at memory address 0xbc000000 so (as site info say):

# cat /proc/mtd 
dev:    size   erasesize  name  
mtd0: 00800000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00010000 00010000 "5G_RF"
mtd5: 00010000 00010000 "Wolf_Config"
mtd6: 00080000 00010000 "MyDLink"
mtd7: 00080000 00010000 "Jffs2"
mtd8: 000f8ebc 00010000 "Kernel"
mtd9: 00597144 00010000 "RootFS"

openwrt firmware image start at 0xbc170000.
Some uboot modification ignore 1st parameter of tftpboot and load image at fixed memory address (8010000 as example). May check with uboot command:

md 81000000

Sometimes erase ignore all parameters and is used as "erase.linux" or "erase.uboot" for erasing firmware or uboot parts of flash. Or erase interpret parameters as flash adresses:

erase 170000 690000

I've seen variant there erasing flash is performed with command:

spi erase 170000 690000

So see carefully uboot commands help and check all steps with memory display command ("md").

1 Like

I started with the least complicated and set READ/WRITE permission. via the USB-serial interface, I edited the OpenWrt LAN address to match the Trendnet default With that I was able to flash my build in the emergency interface.

Did not have to venture into serial tftp flashing.

Thanks to all the helped.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.