Spectrum SAX1V1K (Askey RT5010W) OpenWrt Support

For Developers
169

Late to the party here

I stupidly flashed the wrong firmware (tried it from here as they have the same model name in sysinfo)

  1. Interrupting boot by pressing space, "root" and "router serial number" no longer work for logging in (no idea why that broke it)?

I can still get to the IPQ807x# CLI, but I can't run that open.sh script as I'm not exactly in a Linux shell. Have been trying to run the commands piecemeal but it's not quite working out.

So I'm stuck in this uboot console and wondering if there is any way out? Trying tftboot doesn't seem to do anything (though i can tftpput successfully to my computer). Is this thing bricked?

printenv:

IPQ807x# printenv
baudrate=115200
bootargs=console=ttyMSM0,115200n8 mmc_mid=0x15 boot_signedimg mmc_mid=0x15 boot_signedimg mmc_mid=0x15 boot_signedimg root=/dev/mmcblk0p20 rootwait
bootcmd=usbboot
bootdelay=2
dump_to_flash=0x00e7afe2
eth1addr=88:de:7c:cb:be:5c
eth2addr=88:de:7c:cb:be:5c
eth3addr=88:de:7c:cb:be:5c
eth4addr=88:de:7c:cb:be:5c
ethact=eth0
ethaddr=88:de:7c:cb:be:5b
fdt_high=0x4A200000
fdtcontroladdr=4a9884a0
fileaddr=44000000
filesize=1a0
fix_uboot=mw 4a9115c8 0a000007 1;mw 4a91e534 0a000006 1;setenv loadaddr 44000000;setenv ipaddr 192.168.1.222;setenv serverip 192.168.1.210;
flash_type=5
ipaddr=192.168.1.222
loadaddr=44000000
machid=8750106
mmcargs=mmc_mid=0x15
netmask=255.255.255.0
read_hlos_emmc=mmc read 44000000 0x8A22 0x4000
reboot-reason=rea=ffffffff
reboot-time=time=ffffffff
serverip=192.168.1.111
set_custom_bootargs=setenv bootargs console=ttyMSM0,115200n8 mmc_mid=0x15 boot_signedimg mmc_mid=0x15 boot_signedimg mmc_mid=0x15 boot_signedimg root=/dev/mmcblk0p20 rootwait
setup_and_boot=run set_custom_bootargs;run fix_uboot; run read_hlos_emmc; bootm
soc_hw_version=200d0200
soc_version_major=2
soc_version_minor=0
stderr=serial@78B3000
stdin=serial@78B3000
stdout=serial@78B3000

and then here's the boot seq output:

Environment size: 1264/262140 bytes
IPQ807x#
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAASANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e3
B -       201 - PBL, Start
B -      2735 - bootable_media_detect_entry, Start
B -    125728 - bootable_media_detect_success, Start
B -    125733 - elf_loader_entry, Start
B -    127165 - auth_hash_seg_entry, Start
B -    165230 - auth_hash_seg_exit, Start
B -    179657 - elf_segs_hash_verify_entry, Start
B -    242290 - PBL, End
B -    249978 - SBL1, Start
B -    301126 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B -    307501 - pm_device_init, Start
B -    431758 - PM_SET_VAL:Skip
D -    123891 - pm_device_init, Delta
B -    434198 - pm_driver_init, Start
D -      5215 - pm_driver_init, Delta
B -    440328 - clock_init, Start
D -      2165 - clock_init, Delta
B -    444507 - boot_flash_init, Start
D -      7869 - boot_flash_init, Delta
B -    456188 - boot_config_data_table_init, Start
D -      1067 - boot_config_data_table_init, Delta - (575 Bytes)
B -    463783 - Boot Setting :  0x00000618
B -    467534 - CDT version:2,Platform ID:8,Major ID:117,Minor ID:1,Subtype:6
B -    474641 - sbl1_ddr_set_params, Start
B -    478453 - CPR configuration: 0x30c
B -    481930 - cpr_init, Start
B -    484706 - Rail:0 Mode: 5 Voltage: 832000
B -    489921 - CL CPR settled at 784000mV
B -    492727 - Rail:1 Mode: 5 Voltage: 896000
B -    496906 - Rail:1 Mode: 7 Voltage: 936000
D -     16531 - cpr_init, Delta
B -    503707 - Pre_DDR_clock_init, Start
B -    507825 - Pre_DDR_clock_init, End
B -    511119 - DDR Type : PCDDR4
B -    518164 - do ddr sanity test, Start
D -      1067 - do ddr sanity test, Delta
B -    521611 - DDR: Start of HAL DDR Boot Training
B -    526338 - DDR: End of HAL DDR Boot Training
B -    532103 - DDR: Checksum to be stored on flash is -270238469
B -    542412 - Image Load, Start
D -    345077 - QSEE Image Loaded, Delta - (1380872 Bytes)
B -    887550 - Image Load, Start
D -       457 - SEC Image Loaded, Delta - (0 Bytes)
B -    895083 - Image Load, Start
D -    287859 - DEVCFG Image Loaded, Delta - (32468 Bytes)
B -   1183034 - Image Load, Start
D -    292800 - RPM Image Loaded, Delta - (93060 Bytes)
B -   1475925 - Image Load, Start
D -    313388 - APPSBL Image Loaded, Delta - (628336 Bytes)
B -   1789404 - QSEE Execution, Start
D -        61 - QSEE Execution, Delta
B -   1795230 - USB D+ check, Start
D -         0 - USB D+ check, Delta
B -   1801604 - SBL1, End
D -   1553944 - SBL1, Delta
S - Flash Throughput, 34368 KB/s  (2135983 Bytes,  62150 us)
S - DDR Frequency, 600 MHz
S - Core 0 Frequency, 1651 MHz


U-Boot 1.5.1 [spf11.4_csu2] (Jun 15 2022 - 09:05:59 +0000)

DRAM:  smem ram ptable found: ver: 1 len: 4
2 GiB
[Askey] Led init ...
NAND:  Could not find nand_gpio in dts, using defaults
Not an ONFI device
ONFI probe failed
ID = ffffffff
Vendor = ff
Device = ff
qpic_nand: unknown NAND device manufacturer: ff device: ff
U-Boot BUG at drivers/mtd/mtdcore.c:420!
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC:   <NULL>: 0 (eMMC)
In:    serial@78B3000
Out:   serial@78B3000
Err:   serial@78B3000
machid: 8750106
eth5 MAC Address from ART is not valid
Hit space key to stop autoboot:  0
** No device specified **

Net:   MAC0 addr:88:de:7c:cb:be:5b
PHY ID1: 0x4d
PHY ID2: 0xd0b1
PHY ID1: 0x4d
PHY ID2: 0xd101
EDMA ver 1 hw init
Num rings - TxDesc:1 (0-0) TxCmpl:1 (7-7)
RxDesc:1 (15-15) RxFill:1 (7-7)
ipq807x_edma_alloc_rings: successfull
ipq807x_edma_setup_ring_resources: successfull
ipq807x_edma_configure_rings: successfull
ipq807x_edma_hw_init: successfull
eth0
IPQ807x#

Much obliged if anyone can help. Really perplexed why the root / serial number login doesn't work any more.

170

@dangerweenie - It seems that you have two threads about your issues. This is highly discouraged since it will lead to confusion (lack of context, potentially contradictory advice, etc.).

At this point, please stop posting in this thread and focus on your other one here:

171

Sorry about that, won't do it again.

That thread is irrelevant now as the router is not functioning - is there a community protocol to close out and migrate? Happy to delete the messages.

172

have you been able to sysupgrade to the latest snapshot?

it's working for me but using any firmware besides the one on github that Meister posted results in WAN not being able grab a DHCP address.

Would you mind terribly linking me to what FW you are using on this unit? There are a few options floating around in the wiki, the only thing I can find on the openwrt firmware selector is SAX1VK, and as I mentioned I can't get a WAN link when upgrading to that.

Thanks so much!

173

Hello!

I'm trying to upgrade my Spectrum SAX1V1K (which is also an Askey RT5010W).

This unit has no USB port, and NAND memory.

I'm a bit new to OpenWRT but gaining competency quickly - does anyone know if it might be a bad idea to flash this given the differences?

(There is a thread for the SAX1V1K, but it seems to be dead rn. The SAX1V1K firmware on the firmware selector as results in no WAN link).

TIA!

174

I had this exact same issue btw (I'm on a different unit - SAX1V1K, but it's based on the same board). I believe I used ssh sysupgrade -F -n -v, should be same as Luci.

I had to go to serial and do a TFTPboot to recovery, total hassle.

175 
Boot initramfs : Using serial connection
1. Boot up the device and wait till it displays "VERIFY_IB: Success. verify IB ok"
2. Once that message appears, 
    login with username 'root'
    password serial number of your router in uppercase.
3. Use vi to paste the 'open.sh' script from @MeisterLone github on your device
    https://github.com/MeisterLone/Askey-RT5010W-D187-REV6/blob/master/Patch/open.sh
4. chmod 755 open.sh
5. ./open.sh
6. Set your ip to 192.168.0.1
7. Run a TFTP server and host the initramfs image on the TFTP server and name it "recovery.img"
8. Reboot device. On boot it will try TFTP. 

It's been completed so far, but it hasn't been progressed since.
I tried to log in but got a password error.
Could the password be changed?
The log records are as follows.

U-Boot 1.3.3 [spf11.1_csu2] (Apr 22 2021 - 18:02:25 +0800)

DRAM:  smem ram ptable found: ver: 1 len: 4
2 GiB
[Askey] Led init ...
NAND:  Could not find nand_gpio in dts, using defaults
Not an ONFI device
ONFI probe failed
ID = ffffffff
Vendor = ff
Device = ff
qpic_nand: unknown NAND device manufacturer: ff device: ff
U-Boot BUG at drivers/mtd/mtdcore.c:420!
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC:   <NULL>: 0 (eMMC)
In:    serial@78B3000
Out:   serial@78B3000
Err:   serial@78B3000
machid: 8750106
eth5 MAC Address from ART is not valid
Hit space key to stop autoboot:  0 
Username#SAX1V1K
You have 2 times left to enter correct username.
Username#ROOT
You have 1 times left to enter correct username.
Username#root
Password#
You have 2 times left to enter correct password.
Password#
You have 1 times left to enter correct password.
Password#
You have 0 times left to enter correct password.
## Starting application at 0x4A9647CC ...
xJprefetch abort
pc : [<4a7808ac>]	   lr : [<4a964414>]
reloc pc : [<4a7808ac>]	   lr : [<4a964414>]
sp : 4a77f850  ip : 4a77f800	 fp : 4a910efc
r10: 00000002  r9 : 4a77fea0	 r8 : 00000000
r7 : 4a7808ac  r6 : 4a97e1a0	 r5 : 00000000  r4 : 4a78089c
r3 : 4a7808a8  r2 : 000000c9	 r1 : 000000f8  r0 : 4a78089c
Flags: nzCv  IRQs off  FIQs off  Mode SVC_32
Resetting CPU ...

resetting ...

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAASANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e3
B -       201 - PBL, Start
B -      2735 - bootable_media_detect_entry, Start
B -     46429 - bootable_media_detect_success, Start
B -     46434 - elf_loader_entry, Start
B -     47866 - auth_hash_seg_entry, Start
B -     85935 - auth_hash_seg_exit, Start
B -    100396 - elf_segs_hash_verify_entry, Start
B -    163031 - PBL, End
B -    262391 - SBL1, Start
B -    340471 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B -    350201 - pm_device_init, Start
B -    537959 - PM_SET_VAL:Skip
D -    185897 - pm_device_init, Delta
B -    540399 - pm_driver_init, Start
D -      5215 - pm_driver_init, Delta
B -    546529 - clock_init, Start
D -      2135 - clock_init, Delta
B -    550769 - boot_flash_init, Start
D -      7930 - boot_flash_init, Delta
B -    562389 - boot_config_data_table_init, Start
D -      1067 - boot_config_data_table_init, Delta - (575 Bytes)
B -    570014 - Boot Setting :  0x00000618
B -    573766 - CDT version:2,Platform ID:8,Major ID:117,Minor ID:1,Subtype:6
B -    580872 - sbl1_ddr_set_params, Start
B -    584685 - CPR configuration: 0x30c
B -    588040 - cpr_init, Start
B -    590907 - Rail:0 Mode: 5 Voltage: 800000
B -    596031 - CL CPR settled at 752000mV
B -    598867 - Rail:1 Mode: 5 Voltage: 880000
B -    603137 - Rail:1 Mode: 7 Voltage: 888000
D -     16439 - cpr_init, Delta
B -    609939 - Pre_DDR_clock_init, Start
B -    613934 - Pre_DDR_clock_init, End
B -    617320 - DDR Type : PCDDR4
B -    624426 - do ddr sanity test, Start
D -      1067 - do ddr sanity test, Delta
B -    627842 - DDR: Start of HAL DDR Boot Training
B -    632509 - DDR: End of HAL DDR Boot Training
B -    638273 - DDR: Checksum to be stored on flash is -1713091549
B -    648674 - Image Load, Start
D -    345290 - QSEE Image Loaded, Delta - (1380872 Bytes)
B -    994056 - Image Load, Start
D -       457 - SEC Image Loaded, Delta - (0 Bytes)
B -   1001589 - Image Load, Start
D -    287951 - DEVCFG Image Loaded, Delta - (32468 Bytes)
B -   1289631 - Image Load, Start
D -    292953 - RPM Image Loaded, Delta - (93060 Bytes)
B -   1582675 - Image Load, Start
D -    312717 - APPSBL Image Loaded, Delta - (617384 Bytes)
B -   1895483 - QSEE Execution, Start
D -        61 - QSEE Execution, Delta
B -   1901309 - USB D+ check, Start
D -         0 - USB D+ check, Delta
B -   1907683 - SBL1, End
D -   1647610 - SBL1, Delta
S - Flash Throughput, 34294 KB/s  (2125031 Bytes,  61965 us)
S - DDR Frequency, 600 MHz
S - Core 0 Frequency, 1651 MHz


U-Boot 1.3.3 [spf11.1_csu2] (Apr 22 2021 - 18:02:25 +0800)

DRAM:  smem ram ptable found: ver: 1 len: 4
2 GiB
[Askey] Led init ...
NAND:  Could not find nand_gpio in dts, using defaults
Not an ONFI device
ONFI probe failed
ID = ffffffff
Vendor = ff
Device = ff
qpic_nand: unknown NAND device manufacturer: ff device: ff
U-Boot BUG at drivers/mtd/mtdcore.c:420!
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC:   <NULL>: 0 (eMMC)
In:    serial@78B3000
Out:   serial@78B3000
Err:   serial@78B3000
machid: 8750106
eth5 MAC Address from ART is not valid
Hit space key to stop autoboot:  0 
Username#
176

Yup, this log is consistent with my own experience.

Initially, login root:[serial number] worked, but after flashing a few different snapshots, it stopped working.

I am no longer able to log in with those credentials, though I can get to the uboot shell (hush) by connecting the CLK transistor point to the VDFF pin on the serial breakout group (please see @MeisterLone's github instructions here for more details on that.

If you do go this route, you'll have to issue some of the commands from the end of the open.sh script (also located there) - namely the ones at the end, as you can't execute a .sh script from this particular uboot shell, and you can't upload scripts to it (as far as I know - I am a neophtye)

The commands they use are "fw_setenv", followed by the commands and arguments in quotes.

Example:

fw_setenv fix_uboot "mw 4a9115c8 0a000007 1;mw 4a91e534 0a000006 1

becomes these separate command, each one typed in and followed by enter after the semicolon that I added at the end (do not include the semicolon):

setenv fix_uboot mw 4a9115c8 0a000007 1;
set env mw 4a91e534 0a000006 1;
setenv loadaddr 44000000;
[and on and on to all the commands there in the open.sh script]

From there, I set the boot arguments and tftp config (taken out of the open.sh) with some small modifications to the memory address, and I am able to boot recovery.img to an OpenWRT kernel shell.

Be advised - this is risky and can brick your router as it does not check the uboot version (scroll up in this thread for more info), though it sounds like your router is alread kind of soft-bricked.

I know this is intimidating stuff if you are new like me, but just take your time and move slow - it's good to have a serial connection going at all time (i use an arduino).

177

First of all, thank you for answering.
I'm glad you had the same experience as me.
But the solution is difficult for beginners like me.

178

see edited reply above with updates

179

Thank you for your kind reply.
But it's not easy.
I'll try a little more and try.

180

haha yes it's not easy but if you're not into nerdy stuff like this then you probably shouldn't be trying to flash openWRT!

that said, I'm a bit stuck right now too (can't use the latest firmware) - I've spent hours and hours researching and looking on the internet and downloading and flashing different firmware. I trust that in time someone will come along and reply in here or somewhere else and I'll be able to sort things out.

In the meantime, I've learned lots and lots - and there are other projects to work on while you are truly stuck and waiting for help!

181

Just an update in here - the issue with no WAN link was patched by a kind community member (they even SSH'd into my setup and figured out what was goiing on - turns out PHY was coming out of reset too soon, so resulted in a PR and the latest snapshot works perfectly).

issue here, resolved in this commit.

thank you @robimarko

@unplugmiso - DM me if you need some help as I got out of the same situation with the bootloader and would be happy to assist.

182

Recently, I had chance to chat with the person who created PR of SAX1V1K.

He was kind enough to update open.sh to make it work on many different uboot that we found.
Also, he forked known NSS builder and made it specific for SAX1V1K

I confirmed both script and NSS build works really well.

183

I'm stuck in u-boot and it won't tftpboot openwrt kernel

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00158
S - IMAGE_VARIANT_STRING=HAASANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e3
B - 201 - PBL, Start
B - 2736 - bootable_media_detect_entry, Start
B - 58727 - bootable_media_detect_success, Start
B - 58731 - elf_loader_entry, Start
B - 60230 - auth_hash_seg_entry, Start
B - 97823 - auth_hash_seg_exit, Start
B - 114328 - elf_segs_hash_verify_entry, Start
B - 176948 - PBL, End
B - 191296 - SBL1, Start
B - 244061 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B - 250618 - pm_device_init, Start
B - 378810 - PM_SET_VAL:Skip
D - 127703 - pm_device_init, Delta
B - 381250 - pm_driver_init, Start
D - 5215 - pm_driver_init, Delta
B - 387380 - clock_init, Start
D - 2135 - clock_init, Delta
B - 391620 - boot_flash_init, Start
D - 15280 - boot_flash_init, Delta
B - 410560 - boot_config_data_table_init, Start
D - 1616 - boot_config_data_table_init, Delta - (575 Bytes)
B - 418185 - Boot Setting : 0x00000618
B - 421998 - CDT version:2,Platform ID:8,Major ID:117,Minor ID:1,Subtype:6
B - 429013 - sbl1_ddr_set_params, Start
B - 432825 - CPR configuration: 0x30c
B - 436302 - cpr_init, Start
B - 439078 - Rail:0 Mode: 5 Voltage: 816000
B - 444293 - CL CPR settled at 768000mV
B - 447130 - Rail:1 Mode: 5 Voltage: 880000
B - 451308 - Rail:1 Mode: 7 Voltage: 920000
D - 16531 - cpr_init, Delta
B - 458201 - Pre_DDR_clock_init, Start
B - 462197 - Pre_DDR_clock_init, End
B - 465491 - DDR Type : PCDDR4
B - 472536 - do ddr sanity test, Start
D - 1037 - do ddr sanity test, Delta
B - 475952 - DDR: Start of HAL DDR Boot Training
B - 480680 - DDR: End of HAL DDR Boot Training
B - 486444 - DDR: Checksum to be stored on flash is 981778790
B - 496662 - Image Load, Start
D - 357368 - QSEE Image Loaded, Delta - (1380484 Bytes)
B - 854091 - Image Load, Start
D - 457 - SEC Image Loaded, Delta - (0 Bytes)
B - 861625 - Image Load, Start
D - 293135 - DEVCFG Image Loaded, Delta - (32468 Bytes)
B - 1154852 - Image Load, Start
D - 294935 - RPM Image Loaded, Delta - (92984 Bytes)
B - 1449878 - Image Load, Start
D - 316834 - APPSBL Image Loaded, Delta - (615712 Bytes)
B - 1766834 - QSEE Execution, Start
D - 61 - QSEE Execution, Delta
B - 1772629 - USB D+ check, Start
D - 0 - USB D+ check, Delta
B - 1779034 - SBL1, End
D - 1590026 - SBL1, Delta
S - Flash Throughput, 24458 KB/s (2122895 Bytes, 86795 us)
S - DDR Frequency, 600 MHz
S - Core 0 Frequency, 1651 MHz

U-Boot 1.3.3 [spf11.1_csu2] (Dec 09 2020 - 09:39:52 +0000)

DRAM: smem ram ptable found: ver: 1 len: 4
2 GiB
[Askey] Led init ...
NAND: Could not find nand_gpio in dts, using defaults
Not an ONFI device
ONFI probe failed
ID = ffffffff
Vendor = ff
Device = ff
qpic_nand: unknown NAND device manufacturer: ff device: ff
U-Boot BUG at drivers/mtd/mtdcore.c:420!
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC: : 0 (eMMC)
In: serial@78B3000
Out: serial@78B3000
Err: serial@78B3000
machid: 8750106
eth5 MAC Address from ART is not valid
Hit space key to stop autoboot: 0
** No device specified **

Net: MAC0 addr:a4:97:33:6f:56:a3
PHY ID1: 0x4d
PHY ID2: 0xd0b1
PHY ID1: 0x4d
PHY ID2: 0xd101
EDMA ver 1 hw init
Num rings - TxDesc:1 (0-0) TxCmpl:1 (7-7)
RxDesc:1 (15-15) RxFill:1 (7-7)
ipq807x_edma_alloc_rings: successfull
ipq807x_edma_setup_ring_resources: successfull
ipq807x_edma_configure_rings: successfull
ipq807x_edma_hw_init: successfull
eth0
IPQ807x# printenv
baudrate=115200
bootargs=console=ttyMSM0,115200n8 mmc_mid=0x45 boot_signedimg
bootcmd=usbboot
bootdelay=2
eth1addr=a4:97:33:6f:56:a4
eth2addr=a4:97:33:6f:56:a4
eth3addr=a4:97:33:6f:56:a4
eth4addr=a4:97:33:6f:56:a4
ethact=eth0
ethaddr=a4:97:33:6f:56:a3
fdt_high=0x4A200000
fdtcontroladdr=4a9855e0
fileaddr=44000000
filesize=1a0
flash_type=5
ipaddr=192.168.10.10
machid=8750106
mmcargs=mmc_mid=0x45
netmask=255.255.255.0
reboot-reason=rea=ffffffff
reboot-time=time=ffffffff
secboot=1
serverip=192.168.10.1
soc_version_major=2
soc_version_minor=0
stderr=serial@78B3000
stdin=serial@78B3000
stdout=serial@78B3000

Environment size: 666/262140 bytes
IPQ807x#

184

How did you enter uboot and be able to do printenv?
Did you do tweezers method to halt uboot?

Have you ever tried to let it boot till its own firmware and login as root?

185

I did the hardware "clk" interrupt hack.. it won't boot the factory firmware on its own.. I thought I was following the correct procedure from https://github.com/MeisterLone/Askey-RT5010W-D187-REV6
after doing hardware hack, I entered "setenv bootcmd usbboot
saveenv"
now this is as far as I can get.. every time I try to do tftpboot kernel.img it just throws the secure boot message and restarts

186

"clk" interrupt will also work but its too complicate.

**Most part of the installation is performed from an initramfs image.**

Boot initramfs : Using serial connection
1. Boot up the device and wait till it displays "VERIFY_IB: Success. verify IB ok"
2. Once that message appears, 
    login with username 'root'
    password serial number of your router in uppercase.
3. Use vi to paste the 'open.sh' script from @MeisterLone github on your device
    https://github.com/gotofbi/Qualcommax_NSS_sax1v1k/blob/main/open.sh
4. chmod 755 open.sh
5. ./open.sh
6. Set your ip to 192.168.0.1
7. Run a TFTP server and host the initramfs image on the TFTP server and name it "recovery.img"
8. Reboot device. On boot it will try TFTP. 

Install OpenWrt from initramfs image:
1. Use SCP (or other way) to transfer OpenWrt factory image
2. Connect to device using SSH (on a LAN port)
3. Flash firmware: sysupgrade
   # sysupgrade -n -v /tmp/openwrt_sysupgrade.bin
4. Set U-boot env variable: bootcmd
   # fw_setenv bootcmd "run fix_uboot; run setup_and_boot"
5. Reboot the device
   # reboot
6. Once device is booted, residue of previous firmware will prevent openwrt to work properly.
    Factory Reset is MUST required
    # Once serial console is displaying to login, hold reset button for 10 sec
7. Now everything should be operational.

    Note: this PR adds only single partition support, that means sysupgrade is
          upgrading the current rootfs partition

This is proper method.

I do not see a reason you cant boot to factory firmware.
Whats the uboot log when you let it boot its own to factory firmware without "clk" interrupt?

1 Like
187

It automatically boots to u-boot prompt

188

if you dont do clk interrupt or dont press any key, it will continue to firmware,
I dont get it...