I will blow some dust off the old Windows computer and try the ASUS Rescue Tool later tonight 
2 Likes
Results from the Windows Asus restore tool loading BT8 ubi-cleaner.trx
F0: 102B 0000
FA: 1042 0000
FA: 1042 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0600 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
MK: 0000 0000 [0000]
T0: 0000 019F [0101]
Jump to BL
NOTICE: BL2: v2.10.0(release):
NOTICE: BL2: Built : 14:59:39, May 28 2024
NOTICE: WDT: Cold boot
NOTICE: WDT: disabled
NOTICE: CPU: MT7988
NOTICE: EMI: Using DDR4 settings
NOTICE: EMI: Detected DRAM size: 1024 MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0xef
NOTICE: Page size 2048, Block size 131072, size 134217728
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.10.0(release):
NOTICE: BL31: Built : 14:59:48, May 28 2024
U-Boot 2024.04 (May 30 2024 - 18:58:13 +0800)
BT8 bootloader version: 1.0.0.2
CPU: MediaTek MT7988
Model: mt7988-rfb
DRAM: 1 GiB
Core: 44 devices, 12 uclasses, devicetree: separate
Loading Environment from MTD...
SPINAND raw ID: EF AE 21
spi-nand: spi_nand spi_nand@0: Winbond W25N01KV SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 94, ECC strength 4/512, custom ECC status.
OK
In: serial@11000000
Out: serial@11000000
Err: serial@11000000
ASUS BT8 gpio/led init
Net: eth0: ethernet@15100000
ubi0: attaching mtd4
ubi0: scanning is finished
ubi0: attached mtd4 (name "UBI_DEV", size 124 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 992, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 7, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 9/5, WL threshold: 4096, image sequence number: 1694403399
ubi0: available PEBs: 10, total reserved PEBs: 982, PEBs reserved for bad PEB handling: 20
UBI: vol_id reserved_pebs alignment data_pad vol_type usable_leb_size used_ebs used_bytes last_eb_bytes corrupted upd_marker name_len name
UBI: 0 1 1 0 dynamic 1f000 1 1f000 1f000 0 0 5 nvram
UBI: 1 b 1 0 dynamic 1f000 b 155000 1f000 0 0 7 Factory
UBI: 2 b 1 0 dynamic 1f000 b 155000 1f000 0 0 8 Factory2
UBI: 3 30 1 0 dynamic 1f000 30 5d0000 1f000 0 0 5 linux
UBI: 4 2 1 0 dynamic 1f000 2 3e000 1f000 0 0 5 jffs2
UBI: 5 12a 1 0 dynamic 1f000 12a 2416000 1f000 0 0 6 rootfs
UBI: 6 24b 1 0 dynamic 1f000 24b 4715000 1f000 0 0 b rootfs_data
UBI: 7fffefff 2 1 0 dynamic 1f000 2 3e000 2 0 0 d layout volume
UBI volume [linux] size 5d0000 smaller than 40e8000!
Read 1396736 bytes from volume Factory to 000000007f6a7ff0
EEPROM set 0: OK (version 108)
Read 1396736 bytes from volume Factory2 to 000000007f6a7ff0
EEPROM set 1: OK (version 108)
Read 1396736 bytes from volume Factory to 000000007fb3fbf0
Select EEPROM set 0 at offset 0x0.
BT8 bootloader version: 1.0.0.2
MAC Address: BC:FC:E7:24:A1:18
Please choose the operation:
1: Load System code to SDRAM via TFTP.
2: Load System code then write to Flash via TFTP.
3: Boot System code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
reset button pressed!
3: Boot System code via Flash (default).
HwID B
reset button pressed!
## Enter Rescue Mode ##
switch prereq:0
tftpd start
Our IP address is:(192.168.1.1)
Wait for TFTP request...
tftpd open
URL: http://192.168.1.1/
D Got ARP REQUEST, return our IP
Got ARP REQUEST, return our IP
D "Synchronous Abort" handler, esr 0x8600000d, far 0x0
elr: ffffffffc1eca000 lr : 0000000041e679e8 (reloc)
elr: 0000000000000000 lr : 000000007ff9d9e8
x0 : 000000007fb27f36 x1 : 0000000000005000
x2 : 000000000101a8c0 x3 : 00000000000078fe
x4 : 00000000a890ffab x5 : 00000000d1d83540
x6 : 0000000000000000 x7 : 0000000000000001
x8 : 0000000000000000 x9 : 0000000000000050
x10: 0000000000000001 x11: 0000000000000078
x12: 00000000ffffffff x13: 000000007f7fca73
x14: 00000000ffffffff x15: 000000007f7fcb46
x16: 0000000000000000 x17: 0000000000000000
x18: 000000007f7ffdb0 x19: 000000007fb27f0e
x20: 0000000000000029 x21: 000000007fb27f00
x22: 000000004601a8c0 x23: 000000007fb27f1a
x24: 0000000000000003 x25: 000000007ffef6e8
x26: 000000007ffef6c4 x27: 000000007ffef000
x28: 000000007ffef6e0 x29: 000000007f7fcf70
Code: "Synchronous Abort" handler, esr 0x96000004, far 0xfffffffffffffff0
elr: 0000000041e02360 lr : 0000000041e02340 (reloc)
elr: 000000007ff38360 lr : 000000007ff38340
x0 : 000000007ffb8f3b x1 : 0000000000000000
x2 : 000000007ff774a0 x3 : 000000007f7fc8d0
x4 : 000000007f7fc910 x5 : 0000000000000030
x6 : 000000007ffb8548 x7 : 000000000000000f
x8 : 0000000000000001 x9 : 000000007f7fc956
x10: 0000000000000021 x11: 0000000000000010
x12: 00000000ffffffff x13: 000000007f7fca73
x14: 0000000000000010 x15: 000000007f7fc973
x16: 0000000000000000 x17: 0000000000000000
x18: 000000007f7ffdb0 x19: fffffffffffffff0
x20: 000000007ffb5027 x21: 00000000fffffffc
x22: 000000007ffc13e8 x23: 000000007ffb8f3b
x24: 0000000000000003 x25: 000000007ffef6e8
x26: 000000007ffef6c4 x27: 000000007ffef000
x28: 000000007ffef6e0 x29: 000000007f7fce00
Code: d1004273 910fa2d6 aa0003f7 12800075 (b9400261)
Resetting CPU ...
resetting ...
Then it is in bootloop again.
1 Like
Well, this shouldn't happen.
Try to transmit the any TRX-image (named as BT8.trx) via TFTPD64 (Windows) or tftp (Linux).
- Example for TFTPD64: Asus TUF AX4200 support - #189 by remittor
- Example for tftp: Asus TUF AX4200 support - #193 by remittor
2 Likes
I have a tftp server in linux, but Im not sure I did what you wanted - I booted with tftboot and got this result:
MT7988> tftpboot 0x46000000 BT8.trx; fdt addr $(fdtcontroladdr)
switch prereq:0
Using ethernet@15100000 device
TFTP from server 192.168.1.70; our IP address is 192.168.1.1
Filename 'BT8.trx'.
Load address: 0x46000000
Loading: Got ARP REPLY, set eth addr (00:e0:4c:68:01:bb)
#################################################################
#################################################################
#################################################
12.5 MiB/s
done
Bytes transferred = 2625536 (281000 hex)
Working FDT set to 7f7fd2f0
MT7988> fdt rm /signature; bootm
libfdt fdt_path_offset() returned FDT_ERR_NOTFOUND
## Booting kernel from Legacy Image at 46000000 ...
Image Name:
Image Type: AArch64 Linux Kernel Image (uncompressed)
Data Size: 417792 Bytes = 408 KiB
Load Address: 00000000
Entry Point: 00000000
Verifying Checksum ... OK
Working FDT set to 0
Loading Kernel Image to 0
Bad Linux ARM64 Image magic!
Failed to prep arm64 kernel (err=1)
Resetting the board...
1 Like
This is not a good idea.
I want the bootloader to load the image from NAND into memory itself.
Use choose 2 to install the image to NAND.
Example: Asus TUF AX4200 support - #189 by remittor
1 Like
btw I tried your sysypgrade file (24.10.0) but the wan interface is broken (thought I would try it until I can get back to stock firmware).
Sorry for the delay, but unfortunately this not work either.
MT7988> gomenu
Please choose the operation:
1: Load System code to SDRAM via TFTP.
2: Load System code then write to Flash via TFTP.
3: Boot System code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
1
You choosed 2
2: Load System code then write to Flash via TFTP.
Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
Please Input new ones /or Ctrl-C to discard
Input device IP (192.168.1.1) ==:
Input server IP (192.168.1.70) ==:
Input Linux Kernel filename (BT8.trx) ==:
switch prereq:0
Using ethernet@15100000 device
TFTP from server 192.168.1.70; our IP address is 192.168.1.1
Filename 'BT8.trx'.
Load address: 0x46000000
Loading: Got ARP REPLY, set eth addr (00:e0:4c:68:01:bb)
T #################################################################
#################################################################
#################################################
2.2 MiB/s
done
Bytes transferred = 2625536 (281000 hex)
0x280fc0 bytes written to volume linux
HwID B
## Loading kernel from FIT Image at 46000040 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-u-boot
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x46000128
Data Size: 371640 Bytes = 362.9 KiB
Architecture: AArch64
OS: Linux
Load Address: 0x41e00000
Entry Point: 0x41e00000
Hash algo: crc32
Hash value: e3f88ac2
Hash algo: sha1
Hash value: 9bf6e80d802e7b14702c390f82523aefc9cf8cc7
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000040 ...
Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt asus_zenwifi-bt8 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x4605ae20
Data Size: 44224 Bytes = 43.2 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 4446ad00
Hash algo: sha1
Hash value: 2648b3296d1d0fb0baf349ea93e25ec4ee3f53e8
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x4605ae20
Working FDT set to 4605ae20
Uncompressing Kernel Image to 41e00000
Bad Linux ARM64 Image magic!
Failed to prep arm64 kernel (err=1)
Resetting the board...
lets just see to make sure i have not misunderstood you - its the ubi-clean.trx file that I renamed to BT8.trx - correct ?
1 Like
maybe the stock firmware trx file renamed to BT8.trx?
It still might have something to do with the fact that this router is flashed with Daniels version of OpenWRT.
I still have one BT8 that is running asus original firmware and it would be interesting to try it with remittors version of OpenWRT for BT8 and see if it is possible to go back to asus original firmware again.
For me its mostly a matter of being able to continue testing
1 Like
Well, at least the log is an interesting read I guess:
MT7988> gomenu
Please choose the operation:
1: Load System code to SDRAM via TFTP.
2: Load System code then write to Flash via TFTP.
3: Boot System code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
1
You choosed 2
2: Load System code then write to Flash via TFTP.
Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
Please Input new ones /or Ctrl-C to discard
Input device IP (192.168.1.1) ==:
Input server IP (192.168.1.70) ==:
Input Linux Kernel filename (BT8.trx) ==:
switch prereq:0
Using ethernet@15100000 device
TFTP from server 192.168.1.70; our IP address is 192.168.1.1
Filename 'BT8.trx'.
Load address: 0x46000000
Loading: Got ARP REPLY, set eth addr (00:e0:4c:68:01:bb)
T #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##############################
11.2 MiB/s
done
Bytes transferred = 65315788 (3e4a3cc hex)
size > volume size! Aborting!
ra_flash_erase_write: write volume [linux] fail. (r = 22)
HwID B
## Loading kernel from FIT Image at 46000040 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-3.0
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x46000124
Data Size: 3500736 Bytes = 3.3 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x48080000
Entry Point: 0x48080000
Hash algo: crc32
Hash value: 494b8690
Hash algo: sha1
Hash value: c8fd45327284ac6110920498124cc440b6d5a658
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 46000040 ...
Using 'config-1' configuration
Trying 'rootfs-1' ramdisk subimage
Description: Root File System
Type: RAMDisk Image
Compression: uncompressed
Data Start: 0x4635e924
Data Size: 61781364 Bytes = 58.9 MiB
Architecture: Unknown Architecture
OS: Unknown OS
Load Address: 0x00000000
Entry Point: 0x00000000
Hash algo: crc32
Hash value: 2d7dcb2a
Hash algo: sha1
Hash value: 588dbff7c2798a09f5059518bf277e29896bdb59
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000040 ...
Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt mt7986d-bt8 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x46356d20
Data Size: 31504 Bytes = 30.8 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 426a11c3
Hash algo: sha1
Hash value: b0afd0b38a381b8a17436994cb9b0b1ae4ff48c6
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x46356d20
Working FDT set to 46356d20
Uncompressing Kernel Image to 48080000
Loading Device Tree to 000000007f7ed000, end 000000007f7f7b0f ... OK
Working FDT set to 7f7ed000
Starting kernel ...
Booting Linux on physical CPU 0x0000000000 [0x411fd090]
Linux version 5.4.271 (root@asus) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r0-febaa0c8)) #1 SMP Thu Feb 20 16:22:18 CST 2025
Machine model: ASUS BT8
earlycon: uart8250 at MMIO32 0x0000000011000000 (options '')
printk: bootconsole [uart8250] enabled
On node 0 totalpages: 259256
DMA32 zone: 4096 pages used for memmap
DMA32 zone: 0 pages reserved
DMA32 zone: 259256 pages, LIFO batch:63
psci: probing for conduit method from DT.
psci: PSCIv1.1 detected in firmware.
psci: Using standard PSCI v0.2 function IDs
psci: MIGRATE_INFO_TYPE not supported.
psci: SMC Calling Convention v1.0
percpu: Embedded 23 pages/cpu s56024 r8192 d29992 u94208
pcpu-alloc: s56024 r8192 d29992 u94208 alloc=23*4096
pcpu-alloc: [0] 0 [0] 1 [0] 2
Detected VIPT I-cache on CPU0
CPU features: detected: GIC system register CPU interface
CPU features: kernel page table isolation disabled by kernel configuration
CPU features: detected: Spectre-BHB
Built 1 zonelists, mobility grouping on. Total pages: 255160
Kernel command line: root_rfs=0x35e8e4 rootfstype=squashfs ubi.mtd=UBI_DEV console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11000000 pci=pcie_bus_perf root=/dev/mtdblock4
Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
mem auto-init: stack:off, heap alloc:off, heap free:off
Memory: 1006336K/1037024K available (7230K kernel code, 474K rwdata, 1756K rodata, 448K init, 310K bss, 30688K reserved, 0K cma-reserved)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=3, Nodes=1
Invalid signature of oopsbuf: FF-FF-FF-FF-FF-FF-FF-FF (len -1)
rcu: Hierarchical RCU implementation.
rcu: CONFIG_RCU_FANOUT set to non-default value of 32.
rcu: RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=3.
rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=3
NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
GICv3: GIC: Using split EOI/Deactivate mode
GICv3: 416 SPIs implemented
GICv3: 0 Extended SPIs implemented
GICv3: Distributor has no Range Selector support
GICv3: 16 PPIs implemented
GICv3: no VLPI support, no direct LPI support
GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
arch_timer: cp15 timer(s) running at 13.00MHz (phys).
clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=52000)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
ASID allocator initialised with 65536 entries
rcu: Hierarchical SRCU implementation.
smp: Bringing up secondary CPUs ...
Detected VIPT I-cache on CPU1
GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
CPU1: Booted secondary processor 0x0000000001 [0x411fd090]
Detected VIPT I-cache on CPU2
GICv3: CPU2: found redistributor 2 region 0:0x000000000c0c0000
CPU2: Booted secondary processor 0x0000000002 [0x411fd090]
smp: Brought up 1 node, 3 CPUs
SMP: Total of 3 processors activated.
CPU features: detected: 32-bit EL0 Support
CPU features: detected: CRC32 instructions
CPU: All CPU(s) started at EL2
alternatives: patching kernel code
devtmpfs: initialized
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic allocations
SCSI subsystem initialized
libata version 3.00 loaded.
rbus 18000000.wbsys: PCI host bridge to bus 0004:00
pci_bus 0004:00: root bus resource [mem 0x18000000-0x18ffffff]
pci_bus 0004:00: root bus resource [bus 00-ff]
pci_bus 0004:00: scanning bus
pci 0004:00:00.0: [14c3:7981] type 00 class 0x000280
pci 0004:00:00.0: reg 0x10: [mem 0x18000000-0x1800000f 64bit]
pci 0004:00:00.0: reg 0x18: [mem 0x00000000-0x0000000f]
pci 0004:00:00.0: reg 0x1c: [mem 0x00000000-0x0000000f]
pci 0004:00:00.0: reg 0x20: [mem 0x00000000-0x0000000f]
pci 0004:00:00.0: reg 0x24: [mem 0x00000000-0x0000000f]
pci_bus 0004:00: fixups for bus
pci_bus 0004:00: bus scan returning with max=00
clocksource: Switched to clocksource arch_sys_counter
thermal_sys: Registered thermal governor 'step_wise'
thermal_sys: Registered thermal governor 'user_space'
NET: Registered protocol family 2
IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes, linear)
TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
TCP bind hash table entries: 8192 (order: 5, 131072 bytes, linear)
TCP: Hash tables configured (established 8192 bind 8192)
UDP hash table entries: 512 (order: 2, 16384 bytes, linear)
UDP-Lite hash table entries: 512 (order: 2, 16384 bytes, linear)
NET: Registered protocol family 1
PCI: CLS 0 bytes, default 64
workingset: timestamp_bits=62 max_order=18 bucket_order=0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
ntfs3: Read-only LZX/Xpress compression included
Debug interface error
phy phy-usb-phy@11e10000.3: type_sw - reg 0x218, index 0
mtk-pcie 11300000.pcie: host bridge /pcie@11300000 ranges:
mtk-pcie 11300000.pcie: Parsing ranges property...
mtk-pcie 11300000.pcie: IO 0x30000000..0x301fffff -> 0x30000000
mtk-pcie 11300000.pcie: MEM 0x30200000..0x37ffffff -> 0x30200000
mtk-pcie 11300000.pcie: failed to get max link width
mtk-pcie 11300000.pcie: PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [bus 00-ff]
pci_bus 0000:00: root bus resource [io 0x0000-0x1fffff] (bus address [0x30000000-0x301fffff])
pci_bus 0000:00: root bus resource [mem 0x30200000-0x37ffffff]
pci_bus 0000:00: scanning bus
pci 0000:00:00.0: [14c3:7988] type 01 class 0x060400
pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x00007fff 64bit]
pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
pci 0000:00:00.0: PME# disabled
pci_bus 0000:00: fixups for bus
pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 0
pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 1
pci_bus 0000:01: scanning bus
pci 0000:01:00.0: [14c3:7990] type 00 class 0x028000
pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit pref]
pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00007fff 64bit]
pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
pci 0000:01:00.0: PME# disabled
pci_bus 0000:01: fixups for bus
pci_bus 0000:01: bus scan returning with max=01
pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
pci_bus 0000:00: bus scan returning with max=01
pci 0000:00:00.0: BAR 9: assigned [mem 0x30200000-0x303fffff 64bit pref]
pci 0000:00:00.0: BAR 8: assigned [mem 0x30400000-0x304fffff]
pci 0000:00:00.0: BAR 0: assigned [mem 0x30500000-0x30507fff 64bit]
pci 0000:01:00.0: BAR 0: assigned [mem 0x30200000-0x303fffff 64bit pref]
pci 0000:01:00.0: BAR 2: assigned [mem 0x30400000-0x30407fff 64bit]
pci 0000:00:00.0: PCI bridge to [bus 01]
pci 0000:00:00.0: bridge window [mem 0x30400000-0x304fffff]
pci 0000:00:00.0: bridge window [mem 0x30200000-0x303fffff 64bit pref]
pci 0000:00:00.0: Max Payload Size set to 256/ 256 (was 128), Max Read Rq 256
pci 0000:01:00.0: Max Payload Size set to 256/ 256 (was 128), Max Read Rq 256
mtk-pcie 11290000.pcie: host bridge /pcie@11290000 ranges:
mtk-pcie 11290000.pcie: Parsing ranges property...
mtk-pcie 11290000.pcie: IO 0x28000000..0x281fffff -> 0x28000000
mtk-pcie 11290000.pcie: MEM 0x28200000..0x2fffffff -> 0x28200000
mtk-pcie 11290000.pcie: failed to get max link width
mtk-pcie 11290000.pcie: PCI host bridge to bus 0002:00
pci_bus 0002:00: root bus resource [bus 00-ff]
pci_bus 0002:00: root bus resource [io 0x200000-0x3fffff] (bus address [0x28000000-0x281fffff])
pci_bus 0002:00: root bus resource [mem 0x28200000-0x2fffffff]
pci_bus 0002:00: scanning bus
pci 0002:00:00.0: [14c3:7988] type 01 class 0x060400
pci 0002:00:00.0: reg 0x10: [mem 0x00000000-0x00007fff 64bit]
pci 0002:00:00.0: PME# supported from D0 D3hot D3cold
pci 0002:00:00.0: PME# disabled
pci_bus 0002:00: fixups for bus
pci 0002:00:00.0: scanning [bus 00-00] behind bridge, pass 0
pci 0002:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0002:00:00.0: scanning [bus 00-00] behind bridge, pass 1
pci_bus 0002:01: scanning bus
pci 0002:01:00.0: [14c3:7991] type 00 class 0x028000
pci 0002:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit pref]
pci 0002:01:00.0: reg 0x18: [mem 0x00000000-0x00007fff 64bit]
pci 0002:01:00.0: PME# supported from D0 D3hot D3cold
pci 0002:01:00.0: PME# disabled
pci 0002:01:00.0: 7.876 Gb/s available PCIe bandwidth, limited by 8 GT/s x1 link at 0002:00:00.0 (capable of 15.752 Gb/s with 8 GT/s x2 link)
pci_bus 0002:01: fixups for bus
pci_bus 0002:01: bus scan returning with max=01
pci_bus 0002:01: busn_res: [bus 01-ff] end is updated to 01
pci_bus 0002:00: bus scan returning with max=01
pci 0002:00:00.0: BAR 9: assigned [mem 0x28200000-0x283fffff 64bit pref]
pci 0002:00:00.0: BAR 8: assigned [mem 0x28400000-0x284fffff]
pci 0002:00:00.0: BAR 0: assigned [mem 0x28500000-0x28507fff 64bit]
pci 0002:01:00.0: BAR 0: assigned [mem 0x28200000-0x283fffff 64bit pref]
pci 0002:01:00.0: BAR 2: assigned [mem 0x28400000-0x28407fff 64bit]
pci 0002:00:00.0: PCI bridge to [bus 01]
pci 0002:00:00.0: bridge window [mem 0x28400000-0x284fffff]
pci 0002:00:00.0: bridge window [mem 0x28200000-0x283fffff 64bit pref]
pci 0002:00:00.0: Max Payload Size set to 256/ 256 (was 128), Max Read Rq 256
pci 0002:01:00.0: Max Payload Size set to 256/ 256 (was 128), Max Read Rq 256
mtk-power-controller 11d10000.topmisc: /topmisc@11d10000/eth2p5@2: A default off power domain has been ON
Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
printk: console [ttyS0] disabled
11000000.serial: ttyS0 at MMIO 0x11000000 (irq = 16, base_baud = 2500000) is a ST16650V2
printk: console [ttyS0] enabled
printk: console [ttyS0] enabled
printk: bootconsole [uart8250] disabled
printk: bootconsole [uart8250] disabled
mtk_rng trng@1020f000: registered RNG driver
random: crng init done
spi-nand spi0.0: calibration result: 0x2
spi-nand spi0.0: Winbond W25N01KVxxIR SPI NAND was found. (ID: efae2100)
spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 96, ECC strength 4/512, custom ECC status.
2 fixed-partitions partitions found on MTD device spi0.0
Creating 2 MTD partitions on "spi0.0":
0x000000000000-0x000000400000 : "Bootloader"
0x000000400000-0x000008000000 : "UBI_DEV"
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
IMQ driver loaded successfully. (numdevs = 8, numqueues = 1, imq_dev_accurate_stats = 1)
Hooking IMQ after NAT on PREROUTING.
Hooking IMQ before NAT on POSTROUTING.
mt7988-pinctrl 1001f000.pinctrl: invalid function mdio in map table
[mtk_hw_init] reset_lock:0, force:0
[mtk_hw_init] execute fe cold reset
mtk_soc_eth 15100000.ethernet: MDC is running on 8333333 Hz
Maxlinear Ethernet GPY211C mdio-bus:05: Firmware Version: 0x886F (release)
mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc010e80000, irq 13
mtk_soc_eth 15100000.ethernet eth1: mediatek frame engine at 0xffffffc010e80000, irq 13
mtk_soc_eth 15100000.ethernet eth2: mediatek frame engine at 0xffffffc010e80000, irq 13
(unnamed net_device) (dummy): netif_napi_add() called with weight 256
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
i2c /dev entries driver
vcore: supplied by rt5190a-buck1
proc: supplied by rt5190a-buck1
rt5190a-buck4: supplied by rt5190a-buck1
rt5190a-ldo: supplied by regulator-dummy
mtk-soc-temp-lvts 1100a000.lvts: [lvts_cal] golden_temp = 60
mtk-soc-temp-lvts 1100a000.lvts: [lvts_cal] num:g_count:g_count_rc 0:19517:5092 1:19512:0 2:19539:0 3:19550:0 4:19375:5098 5:19412:0 6:19391:0 7:19424:0
mtk-soc-temp-lvts 1100a000.lvts: [COUNT_RC_NOW] 0:5100 1:5102 2:5098 3:5100 4:5105 5:5103 6:5103 7:5102
mtk-soc-temp-lvts 1100a000.lvts: set_polling_speed 0, LVTSMONCTL1_0= 0x10000c,LVTSMONCTL2_0= 0x10001
mtk-soc-temp-lvts 1100a000.lvts: set_hw_filter 0, LVTSMSRCTL0_0= 0xb6d
mtk-soc-temp-lvts 1100a000.lvts: lvts0: read all 4 sensors in 10080 us, one in 2404 us
mtk-soc-temp-lvts 1100a000.lvts: set_polling_speed 1, LVTSMONCTL1_0= 0x10000c,LVTSMONCTL2_0= 0x10001
mtk-soc-temp-lvts 1100a000.lvts: set_hw_filter 1, LVTSMSRCTL0_0= 0xb6d
mtk-soc-temp-lvts 1100a000.lvts: lvts1: read all 4 sensors in 10080 us, one in 2404 us
mtk-soc-temp-lvts 1100a000.lvts: set_tc_hw_reboot_threshold: LVTS0, the dominator sensing point= 0
mtk-soc-temp-lvts 1100a000.lvts: set_tc_hw_reboot_threshold: LVTS1, the dominator sensing point= 0
cpu cpu0: dummy supplies not allowed for exclusive requests
icp201xx 1-0063: init chip error -6
init chip error -6
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 1 at refcount_warn_saturate+0xf0/0x140
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.4.271 #1
Hardware name: ASUS BT8 (DT)
pstate: 60000005 (nZCv daif -PAN -UAO)
pc : refcount_warn_saturate+0xf0/0x140
lr : refcount_warn_saturate+0xf0/0x140
sp : ffffff800c8abb30
x29: ffffff800c8abb30 x28: 0000000000000000
x27: 0000000000000000 x26: ffffffc010950484
x25: ffffffc010944c48 x24: 0000000000000000
x23: 0000000000000001 x22: ffffff800c8abbd0
x21: ffffff80033aa020 x20: ffffff800c8abbd0
x19: ffffff80033b1018 x18: 0000000000020000
x17: 000000000000003c x16: 000000000000003c
x15: 00000000fffffff0 x14: ffffffc0109ddf58
x13: 0000000000000000 x12: ffffffc010a3e000
x11: ffffffc0109dd000 x10: ffffffc010a3e710
x9 : 0000000000000000 x8 : ffffffc0103c2af0
x7 : 00000000000000ea x6 : ffffffc010a3eca6
x5 : 0000000000000007 x4 : 0000000000000000
x3 : 0000000000000000 x2 : 00000000ffffffff
x1 : ffffffc0109ddfd0 x0 : 0000000000000026
Call trace:
refcount_warn_saturate+0xf0/0x140
kobject_put+0xec/0x110
put_device+0x10/0x20
devm_iio_device_release+0x18/0x28
release_nodes+0x1a0/0x1f8
devres_release_all+0x5c/0x158
really_probe+0x1c0/0x300
driver_probe_device+0x54/0xe8
device_driver_attach+0x6c/0x78
__driver_attach+0x60/0xe8
bus_for_each_dev+0x60/0x98
driver_attach+0x20/0x28
bus_add_driver+0x180/0x1f0
driver_register+0x60/0x110
i2c_register_driver+0x44/0x88
icp201xx_driver_init+0x18/0x20
do_one_initcall+0x74/0x1d0
kernel_init_freeable+0x17c/0x234
kernel_init+0x10/0xfc
ret_from_fork+0x10/0x1c
---[ end trace ee4092a4a545707e ]---
u32 classifier
Performance counters on
input device check on
xt_time: kernel timezone is -0000
gre: GRE over IPv4 demultiplexor driver
IPv4 over IPsec tunneling driver
NET: Registered protocol family 10
Segment Routing with IPv6
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
l2tp_core: L2TP core driver, V2.0
l2tp_ppp: PPPoL2TP kernel driver, V2.0
l2tp_netlink: L2TP netlink interface
8021q: 802.1Q VLAN Support v1.8
MediaTek MT7988 PHY dsa-0.0:00: TX-VCM SW cal result: 0x2
MediaTek MT7988 PHY dsa-0.0:01: TX-VCM SW cal result: 0x3
MediaTek MT7988 PHY dsa-0.0:02: TX-VCM SW cal result: 0x2
MediaTek MT7988 PHY dsa-0.0:03: TX-VCM SW cal result: 0x2
mt7530 mdio-bus:1f lan2 (uninitialized): PHY [dsa-0.0:01] driver [MediaTek MT7988 PHY]
mt7530 mdio-bus:1f lan1 (uninitialized): PHY [dsa-0.0:02] driver [MediaTek MT7988 PHY]
mt7530 mdio-bus:1f: configuring for fixed/10gbase-kr link mode
DSA: tree 0 setup
mt7530 mdio-bus:1f: Link is Up - 10Gbps/Full - flow control rx/tx
mt7530-nl: genl_register_family_with_ops
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "UBI_DEV", size 124 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 992, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 7, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 9/5, WL threshold: 4096, image sequence number: 1694403399
ubi0: available PEBs: 10, total reserved PEBs: 982, PEBs reserved for bad PEB handling: 20
ubi0: background thread "ubi_bgt0d" started, PID 878
gluebi_create: Hook read/write method of Factory.
gluebi_create: Hook read/write method of Factory2.
[Factory-0]: OK (ver: 108)
[Factory2-0]: OK (ver: 108)
Select [Factory-0]
volume linux rfs_offset 35e8e4 mtd->size 5d0000
Creating 1 MTD partitions on "linux":
0x00000035e8e4-0x0000005d0000 : "rootfs"
mtd: device 6 (rootfs) set to be root filesystem
gluebi_create: skip jffs2 volume
block ubiblock0_5: created from ubi0:5(rootfs)
Override root device as 31:6
ubi0 error: ubi_open_volume: cannot open device 0, volume 5, error -16
List of all partitions:
1f00 4096 mtdblock0
(driver?)
1f01 126976 mtdblock1
(driver?)
1f02 124 mtdblock2
(driver?)
1f03 1364 mtdblock3
(driver?)
1f04 1364 mtdblock4
(driver?)
1f05 5952 mtdblock5
(driver?)
1f06 2501 mtdblock6
(driver?)
1f07 36952 mtdblock7
(driver?)
1f08 72788 mtdblock8
(driver?)
fe00 36952 ubiblock0_5
(driver?)
No filesystem could mount root, tried:
squashfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,6)
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x10002,20002008
Memory Limit: none
Starting Memory dump SMCC
Memory dump SMCC failed
Rebooting in 1 seconds..
PANIC at PC : 0x0000000043004cfc
1 Like
I'm also interested in this.
Now the main problem is only in the image of UBI-Cleaner.TRX.
1 Like
That's right. So the problem is in the new bootloader.
Before flashing the stock image, you need to remove volumes linux,rootfs,rootfs_data,jffs2 using bootloader commands.
ubi part UBI_DEV
ubi remove linux
ubi remove rootfs
ubi remove rootfs_data
ubi remove jffs2
ubi detach
1 Like
Will try this today.
Will try this too
1 Like
That worked like a charm - thanks!
After those commands in uboot I loaded the original firmware with tftp using option 2 in the menu and the router was flashed to asus original firmware.
The second thing was to try Remittor firmware on a router previously not flashed to OpenWRT:
I tried the option of uploading the "openwrt-initramfs-trx-for-web" file directly in asus firmware update menu - it worked
After this you will have a OpenWRT initramfs image at 192.168.1.1 - login and go to firmware update menu, select the OpenWRT sysupgrade file and update.
This worked too and I had the Remittor version of OpenWRT on the router.
I tried to go to firmware update and select the Asus original firmware again and it was regognized as a stock firmware - however, it failed exactly as before and rebooted into Remittor Firmware again.
I tried the other options from the Windows restore tool, Asus uboot recovery and the boot from tftp option (#2) but got the same results.
In the end I was able to restore asus original firmware the same way as above - but I had some problems - im posting some of the strange logs:
Our IP address is:(192.168.1.1)
Wait for TFTP request...
tftpd open
URL: http://192.168.1.1/
D D D Got ARP REQUEST, return our IP
"Synchronous Abort" handler, esr 0x8600000d, far 0x0
elr: ffffffffc1eca000 lr : 0000000041e679e8 (reloc)
elr: 0000000000000000 lr : 000000007ff9d9e8
x0 : 000000007fb25542 x1 : 0000000000005000
x2 : 000000000101a8c0 x3 : 00000000000094da
x4 : 0000000053255f61 x5 : 0000000073299768
x6 : 0000000000000000 x7 : 0000000000000462
x8 : 0000000000000000 x9 : 0000000000000050
x10: 0000000000000001 x11: 0000000000000094
x12: 00000000ffffffff x13: 000000007f7fca73
x14: 00000000ffffffff x15: 000000007f7fcb46
x16: 0000000000000000 x17: 0000000000000000
x18: 000000007f7ffdb0 x19: 000000007fb2550e
x20: 0000000000000496 x21: 000000007fb25500
x22: 000000004601a8c0 x23: 000000007fb2551a
x24: 0000000000000004 x25: 000000007ffef6e8
x26: 000000007ffef6c4 x27: 000000007ffef000
x28: 000000007ffef6e0 x29: 000000007f7fcf70
Code: "Synchronous Abort" handler, esr 0x96000004, far 0xfffffffffffffff0
elr: 0000000041e02360 lr : 0000000041e02340 (reloc)
elr: 000000007ff38360 lr : 000000007ff38340
x0 : 000000007ffb8f3b x1 : 0000000000000000
x2 : 000000007ff774a0 x3 : 000000007f7fc8d0
x4 : 000000007f7fc910 x5 : 0000000000000030
x6 : 000000007ffb8548 x7 : 000000000000000f
x8 : 0000000000000001 x9 : 000000007f7fc956
x10: 0000000000000021 x11: 0000000000000010
x12: 00000000ffffffff x13: 000000007f7fca73
x14: 0000000000000010 x15: 000000007f7fc973
x16: 0000000000000000 x17: 0000000000000000
x18: 000000007f7ffdb0 x19: fffffffffffffff0
x20: 000000007ffb5027 x21: 00000000fffffffc
x22: 000000007ffc13e8 x23: 000000007ffb8f3b
x24: 0000000000000004 x25: 000000007ffef6e8
x26: 000000007ffef6c4 x27: 000000007ffef000
x28: 000000007ffef6e0 x29: 000000007f7fce00
Code: d1004273 910fa2d6 aa0003f7 12800075 (b9400261)
Resetting CPU ...
resetting ...
reset button pressed!
3: Boot System code via Flash (default).
HwID B
reset button pressed!
## Enter Rescue Mode ##
switch prereq:0
tftpd start
Our IP address is:(192.168.1.1)
Wait for TFTP request...
tftpd open
URL: http://192.168.1.1/
D Got ARP REQUEST, return our IP
D D D D D D D
Get read request from:(192.168.1.70)
Firmware Restoration assigns IP address: 192.168.1.49
Got ARP REPLY, set eth addr (00:e0:4c:68:00:e1)
Got ARP REQUEST, return our IP
D #
First block received
################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##########################################################
done
RAMtoFLASH
Chk trx magic
Download of 0x281000 bytes completed
Check TRX and write it to FLASH
Solve TRX, ptr=0x0000000046000000
## Booting kernel from Legacy Image at 46000000 ...
Image Name:
Image Type: AArch64 Linux Kernel Image (uncompressed)
Data Size: 417792 Bytes = 408 KiB
Load Address: 00000000
Entry Point: 00000000
Verifying Checksum ... OK
Erase kernel block !!
From c06c9000 To c094a000 (2625536/h:281000)
0x280fc0 bytes written to volume linux
done. 2625536 bytes written
SYSTEM RESET!!!
resetting ...
The last one is from uploading the BT8 ubi-cleaner.trx file from Windows Asus restore tool - still it did not work and got stuck in bootloop.
Sometimes the recovery function will not start at all but you can "force" it to start by holding both buttons beneath the router when you power on.
And sometimes you cant start the asus_httpd option from uboot either - it directly starts looping again.
2 Likes
Newer versions of U-Boot check the Linux kernel image if it is specified as the operating system:
Perhaps we should try to create an image in which IH_OS_U_BOOT will be indicated instead of IH_OS_LINUX.
1 Like
Will look through the code and see if I can make those changes, compile a new image and try the ubi-cleaner again
OK, I made an attempt but im not a developer - i will leave this to the professionals.
I succusfully changed all IH_OS_LINUX to IH_OS_U_BOOT in the source code and could compile new images - flashed to openwrt and tried to use ubi-cleaner.trx but the results were the same, and it still says "Linux"
2: Load System code then write to Flash via TFTP.
Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
Please Input new ones /or Ctrl-C to discard
Input device IP (192.168.1.1) ==:
Input server IP (192.168.1.70) ==:
Input Linux Kernel filename (BT8.trx) ==:
switch prereq:0
Using ethernet@15100000 device
TFTP from server 192.168.1.70; our IP address is 192.168.1.1
Filename 'BT8.trx'.
Load address: 0x46000000
Loading: Got ARP REPLY, set eth addr (00:e0:4c:68:01:bb)
T #################################################################
#################################################################
#################################################
2.2 MiB/s
done
Bytes transferred = 2625536 (281000 hex)
0x280fc0 bytes written to volume linux
HwID B
## Loading kernel from FIT Image at 46000040 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-u-boot
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x46000128
Data Size: 371640 Bytes = 362.9 KiB
Architecture: AArch64
OS: Linux
Load Address: 0x41e00000
Entry Point: 0x41e00000
Hash algo: crc32
Hash value: e3f88ac2
Hash algo: sha1
Hash value: 9bf6e80d802e7b14702c390f82523aefc9cf8cc7
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000040 ...
Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt asus_zenwifi-bt8 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x4605ae20
Data Size: 44224 Bytes = 43.2 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 4446ad00
Hash algo: sha1
Hash value: 2648b3296d1d0fb0baf349ea93e25ec4ee3f53e8
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x4605ae20
Working FDT set to 4605ae20
Uncompressing Kernel Image to 41e00000
Bad Linux ARM64 Image magic!
Failed to prep arm64 kernel (err=1)
Resetting the board...
Obviously you need to change more than this in the code.
I update ubi-cleaner.trx on my gdrive storage.
Try flashing please.
1 Like
It seems to be working as it does not have the previous error, but there is something else wrong - and its actually bootlooping without bootwait.
reset button pressed!
## Enter Rescue Mode ##
switch prereq:0
tftpd start
Our IP address is:(192.168.1.1)
Wait for TFTP request...
tftpd open
URL: http://192.168.1.1/
D Got ARP REQUEST, return our IP
D D D D GET /
GET /style.css
GET /style.css
D D POST /upload
Content-Length: 2625769
D failsafe_validate_image: ptr(0000000046000000) copysize(0) data(00000000460000ac) size(2625536) image_load_addr(1174405120)
## Booting kernel from Legacy Image at 460000ac ...
Image Name:
Image Type: AArch64 Linux Kernel Image (uncompressed)
Data Size: 417964 Bytes = 408.2 KiB
Load Address: 00000000
Entry Point: 00000000
Verifying Checksum ... OK
failsafe_validate_image() fw_size(418028) copysize(2625536)
GET /style.css
GET /style.css
POST /flashing
Content-Length: 59
GET /style.css
GET /style.css
D GET /result
RAMtoFLASH
Chk trx magic
Download of 0x281000 bytes completed
Check TRX and write it to FLASH
Solve TRX, ptr=0x00000000460000ac
Erase kernel block !!
From c06c9000 To c094a000 (2625536/h:281000)
0x280fc0 bytes written to volume linux
done. 2625536 bytes written
resetting ...
F0: 102B 0000
FA: 1042 0000
FA: 1042 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0600 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
MK: 0000 0000 [0000]
T0: 0000 019E [0101]
Jump to BL
NOTICE: BL2: v2.10.0(release):
NOTICE: BL2: Built : 14:59:39, May 28 2024
NOTICE: WDT: [40000000] Software reset (reboot)
NOTICE: CPU: MT7988
NOTICE: EMI: Using DDR4 settings
NOTICE: EMI: Detected DRAM size: 1024 MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0xef
NOTICE: Page size 2048, Block size 131072, size 134217728
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.10.0(release):
NOTICE: BL31: Built : 14:59:48, May 28 2024
U-Boot 2024.04 (May 30 2024 - 18:58:13 +0800)
BT8 bootloader version: 1.0.0.2
CPU: MediaTek MT7988
Model: mt7988-rfb
DRAM: 1 GiB
Core: 44 devices, 12 uclasses, devicetree: separate
Loading Environment from MTD...
SPINAND raw ID: EF AE 21
spi-nand: spi_nand spi_nand@0: Winbond W25N01KV SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 94, ECC strength 4/512, custom ECC status.
OK
In: serial@11000000
Out: serial@11000000
Err: serial@11000000
ASUS BT8 gpio/led init
Net: eth0: ethernet@15100000
ubi0: attaching mtd4
ubi0: scanning is finished
ubi0: attached mtd4 (name "UBI_DEV", size 124 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 992, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 7, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 11/7, WL threshold: 4096, image sequence number: 1694403399
ubi0: available PEBs: 2, total reserved PEBs: 990, PEBs reserved for bad PEB handling: 20
UBI: vol_id reserved_pebs alignment data_pad vol_type usable_leb_size used_ebs used_bytes last_eb_bytes corrupted upd_marker name_len name
UBI: 0 1 1 0 dynamic 1f000 1 1f000 1f000 0 0 5 nvram
UBI: 1 b 1 0 dynamic 1f000 b 155000 1f000 0 0 7 Factory
UBI: 2 b 1 0 dynamic 1f000 b 155000 1f000 0 0 8 Factory2
UBI: 3 2f 1 0 dynamic 1f000 2f 5b1000 1f000 0 0 5 linux
UBI: 4 2 1 0 dynamic 1f000 2 3e000 1f000 0 0 5 jffs2
UBI: 5 5a 1 0 dynamic 1f000 5a ae6000 1f000 0 0 6 rootfs
UBI: 6 324 1 0 dynamic 1f000 324 615c000 1f000 0 0 b rootfs_data
UBI: 7fffefff 2 1 0 dynamic 1f000 2 3e000 2 0 0 d layout volume
UBI volume [linux] size 5b1000 smaller than 40e8000!
Read 1396736 bytes from volume Factory to 000000007f6a7ff0
EEPROM set 0: OK (version 108)
Read 1396736 bytes from volume Factory2 to 000000007f6a7ff0
EEPROM set 1: OK (version 108)
Read 1396736 bytes from volume Factory to 000000007fb3fbf0
Select EEPROM set 0 at offset 0x0.
BT8 bootloader version: 1.0.0.2
MAC Address: BC:FC:E7:24:A1:20
Please choose the operation:
1: Load System code to SDRAM via TFTP.
2: Load System code then write to Flash via TFTP.
3: Boot System code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
0
3: Boot System code via Flash (default).
HwID B
Read 40 bytes from volume linux to 0000000046000000
FIT/FDT format image found at 0x46000000,size 0x6606c
Read 417940 bytes from volume linux to 0000000046000000
## Loading kernel from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-u-boot
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x460000e8
Data Size: 371810 Bytes = 363.1 KiB
Architecture: AArch64
OS: U-Boot
Load Address: 0x48080000
Entry Point: 0x48080000
Hash algo: crc32
Hash value: 22a3f451
Hash algo: sha1
Hash value: 0a91a39196e87aafc0f81586068a68a9ba9ef445
Verifying Hash Integrity ... crc32+ sha1+ OK
Uncompressing Kernel Image to 48080000
Resetting the board...
But it might be something wrong with my setup...
Im going to doublecheck with another router.
Edit:
No its the same thing:
reset button pressed!
## Enter Rescue Mode ##
switch prereq:0
tftpd start
Our IP address is:(192.168.1.1)
Wait for TFTP request...
tftpd open
URL: http://192.168.1.1/
D Got ARP REQUEST, return our IP
D D D D GET /
GET /style.css
GET /style.css
D D POST /upload
Content-Length: 2625769
failsafe_validate_image: ptr(0000000046000000) copysize(0) data(00000000460000ac) size(2625536) image_load_addr(1174405120)
## Booting kernel from Legacy Image at 460000ac ...
Image Name:
Image Type: AArch64 Linux Kernel Image (uncompressed)
Data Size: 417964 Bytes = 408.2 KiB
Load Address: 00000000
Entry Point: 00000000
Verifying Checksum ... OK
failsafe_validate_image() fw_size(418028) copysize(2625536)
GET /style.css
GET /style.css
D POST /flashing
Content-Length: 59
GET /style.css
GET /style.css
D GET /result
RAMtoFLASH
Chk trx magic
Download of 0x281000 bytes completed
Check TRX and write it to FLASH
Solve TRX, ptr=0x00000000460000ac
Erase kernel block !!
From c06c9000 To c094a000 (2625536/h:281000)
0x280fc0 bytes written to volume linux
done. 2625536 bytes written
resetting ...
F0: 102B 0000
FA: 1042 0000
FA: 1042 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0600 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
MK: 0000 0000 [0000]
T0: 0000 019E [0101]
Jump to BL
NOTICE: BL2: v2.10.0(release):
NOTICE: BL2: Built : 14:59:39, May 28 2024
NOTICE: WDT: [40000000] Software reset (reboot)
NOTICE: CPU: MT7988
NOTICE: EMI: Using DDR4 settings
NOTICE: EMI: Detected DRAM size: 1024 MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0xef
NOTICE: Page size 2048, Block size 131072, size 134217728
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.10.0(release):
NOTICE: BL31: Built : 14:59:48, May 28 2024
U-Boot 2024.04 (May 30 2024 - 18:58:13 +0800)
BT8 bootloader version: 1.0.0.2
CPU: MediaTek MT7988
Model: mt7988-rfb
DRAM: 1 GiB
Core: 44 devices, 12 uclasses, devicetree: separate
Loading Environment from MTD...
SPINAND raw ID: EF AE 21
spi-nand: spi_nand spi_nand@0: Winbond W25N01KV SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 94, ECC strength 4/512, custom ECC status.
OK
In: serial@11000000
Out: serial@11000000
Err: serial@11000000
ASUS BT8 gpio/led init
Net: eth0: ethernet@15100000
ubi0: attaching mtd4
ubi0: scanning is finished
ubi0: attached mtd4 (name "UBI_DEV", size 124 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 992, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 7, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 7/4, WL threshold: 4096, image sequence number: 1694403399
ubi0: available PEBs: 10, total reserved PEBs: 982, PEBs reserved for bad PEB handling: 20
UBI: vol_id reserved_pebs alignment data_pad vol_type usable_leb_size used_ebs used_bytes last_eb_bytes corrupted upd_marker name_len name
UBI: 0 1 1 0 dynamic 1f000 1 1f000 1f000 0 0 5 nvram
UBI: 1 b 1 0 dynamic 1f000 b 155000 1f000 0 0 7 Factory
UBI: 2 b 1 0 dynamic 1f000 b 155000 1f000 0 0 8 Factory2
UBI: 3 2f 1 0 dynamic 1f000 2f 5b1000 1f000 0 0 5 linux
UBI: 4 2 1 0 dynamic 1f000 2 3e000 1f000 0 0 5 jffs2
UBI: 5 3b 1 0 dynamic 1f000 3b 725000 1f000 0 0 6 rootfs
UBI: 6 33b 1 0 dynamic 1f000 33b 6425000 1f000 0 0 b rootfs_data
UBI: 7fffefff 2 1 0 dynamic 1f000 2 3e000 2 0 0 d layout volume
UBI volume [linux] size 5b1000 smaller than 40e8000!
Read 1396736 bytes from volume Factory to 000000007f6a7ff0
EEPROM set 0: OK (version 109)
Read 1396736 bytes from volume Factory2 to 000000007f6a7ff0
EEPROM set 1: OK (version 109)
Read 1396736 bytes from volume Factory to 000000007fb3fcb0
Select EEPROM set 0 at offset 0x0.
BT8 bootloader version: 1.0.0.2
MAC Address: CC:28:AA:6E:40:5C
Please choose the operation:
1: Load System code to SDRAM via TFTP.
2: Load System code then write to Flash via TFTP.
3: Boot System code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
0
3: Boot System code via Flash (default).
HwID B
Read 40 bytes from volume linux to 0000000046000000
FIT/FDT format image found at 0x46000000,size 0x6606c
Read 417940 bytes from volume linux to 0000000046000000
## Loading kernel from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-u-boot
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x460000e8
Data Size: 371810 Bytes = 363.1 KiB
Architecture: AArch64
OS: U-Boot
Load Address: 0x48080000
Entry Point: 0x48080000
Hash algo: crc32
Hash value: 22a3f451
Hash algo: sha1
Hash value: 0a91a39196e87aafc0f81586068a68a9ba9ef445
Verifying Hash Integrity ... crc32+ sha1+ OK
Uncompressing Kernel Image to 48080000
Resetting the board...
I guess this is the problem ?
UBI volume [linux] size 5b1000 smaller than 40e8000!
No.
The whole problem is here: