Support for DLink M32 Mesh System and R32 Router

s_2 · August 24, 2023, 7:40pm

Awesome, I think my last state of progress was only tested successfully when using initramfs, I didn't have much time / nerves afterwards to look deeper into this, but great to see that some progress is made here I probably can't help much either in terms of factory image, but I will build this by the start of next week and try it on my device, thanks for your work!

When your PR gets merged, I can also try to add R32 which should be very similar (technically just a few more Gigabit ports), we could have a shared .dtsi for both devices eventually.

RolandoMagico · August 26, 2023, 9:45pm

I'm no able to decrypt an OEM image which results in an image which can be used in recovery mode.
Other way around, I'm also able to create the OEM image from the factory image again.
Source: https://github.com/RolandoMagico/openwrt/blob/D-Link_EAGLE_PRO_AI_M32/m32-firmware-util.c
The code is still messy and needs some cleanup, but it's working in general.

s_2 · August 27, 2023, 7:45am

Awesome, so they left the private key in the GPL release again?
Last thing I remember is, I was able to AES decrypt it, but would have needed the private key to actually create an image, also the inner format (DLK6E...) was unknown to me, but later turned out to be the same as in some DGS-1210 switches if I recall correctly (though those are made by Cameo, not AMIT).

I have been thinking about making a standalone encryption/decryption tool (with a user-friendly GUI) for D-Link devices for a while now, since many users cannot even recover their devices with firmware provided by D-Link, when the bootloader requires the unencrypted recovery image.

Great to see we now have another range of D-Link devices solved here, not sure if it would ever make it into OpenWrt though.

I will dig out my R32 next week, they can probably share a .dtsi.
Besides, I own a few of the Realtek based ones, especially the M15 (which I only purchased to have a look at the encryption, while waiting for M32 to be delivered, which was delayed again and again )
The realtek ones also have the ODM partition (even made a little parser in Python for the TLV-like format, starting somewhere at 0x20 in the file), but I think these chips will not be relevant for OpenWrt anytime soon.

Besides, I'm also thrilled about the Bluetooth capabilities, someone in our Freifunk community mentioned the idea of using the Apple Find My Network as a telemetry backup for gluon nodes that are offline for unknown reasons (e.g. trigger a reboot etc.), but we need more MT7622 based devices inthe market first

RolandoMagico · August 27, 2023, 8:03am

Yes,
the private key for signing the images including the pass phrase are included in the GPL sources.

See also Support for DLink M32 Mesh System - #48 by RolandoMagico

Update: I compared the keys for M32 and R32, they are the same. So the tool should also work with R32. I tried decrypting R32A1_FW103B01.bin which worked without any errors. The resulting file also look valid.

Usage:

Compile the sources (there migth be some deprecated warnings depending on the used OpenSSL version):
gcc m32-firmware-util.c -lcrypto -o m32-firmware-util
Decrypt the image:
./m32-firmware-util M32 --DecryptFactoryImage R32A1_FW103B01.bin R32A1_FW103B01_decrypted.bin
Encrypt the image:
./m32-firmware-util M32 --CreateFactoryImage R32A1_FW103B01_decrypted.bin R32A1_FW103B01_encrypted.bin

Not that the re-encrypted image will differ from the original image because of the used IV and Salt (currently I'm using a fixed values for testing)

RolandoMagico · August 27, 2023, 9:53am

A web interface where this can be done would be great, but no clue how to implement somthing like that.

RolandoMagico · August 27, 2023, 2:20pm

Strange behavior today after flashing a new image to the device. In the wireless settings, all modules are shown as "Generic Unknown":

Scanning for networks is also not possible. But after enabling the AP, the correct devices are shown again:

Also did a factory reset and downgraded to previous versions. Same result. Not sure whats wrong here.

RolandoMagico · August 27, 2023, 2:47pm

Also tried building an OpenWrt factory image. Building the image works but flashing does not yet work:

process_method_post_file: total_length 14025897, BUFF_SIZE_1 16384
Upload filename="openwrt-mediatek-mt7622-dlink_eagle-pro-ai-m32-a1-squashfs-factory.bin" (Stage: 4)
Save BIN files to /tmp/fw.bin
open /tmp/fw.bin for write data
Enter GetFirmwareValidation_put
FW(/tmp/fw.bin) is checking, please wait...
open_upgbuf: flags.secid=0x0
check_upgbuf: System build on Apr 14 2023 03:35:25
checking header!
check_upgbuf: get full upgrade header!
header_id mis-match: (0x530a: 0x4842)
1397:HEADER boot=0x0000, atf=0x0000, p_section=0x0000, kernel=0x0000, ui=0x0000, roootfs=0x0000, config=0x0000, mydlink=0x0000, signature=0x0000
1401:FW boot=0x0000, atf=0x0000, p_section=0x0000, kernel=0x0000, ui=0x0000, roootfs=0x0000, config=0x0000, mydlink=0x0000, signature=0x0000
Firmware checking result: failed
check_file:189:Check firmware error(-101)
[  221.989644] sh (10308): drop_caches: 1
===========================
==      Pre-Check        ==
===========================
Found input file, continue.
Found public Key, continue.
Found Firmware Key, continue.
===========================
== Split FW.enc and Sig2 ==
===========================
Output: /tmp/IV_and_FWenc.bin, /tmp/Sig2.bin
===========================
==  Verify Signature2    ==
===========================
Output: /tmp/FWencdgst.bin
verify sinature....
verify failed in Sig2
[dlink_led][ERROR] : SIGTERM
process_GetFirmwareValidation_action:174, dec fw failed

I also cannot decrypt the created factory image:

EVP_DigestVerifyFinal failed
4097A986E27F0000:error:0200006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:../crypto/rsa/rsa_pk1.c:82:
4097A986E27F0000:error:02000072:rsa routines:rsa_ossl_public_decrypt:padding check failed:../crypto/rsa/rsa_ossl.c:598:
4097A986E27F0000:error:1C880004:Provider routines:rsa_verify:RSA lib:../providers/implementations/signature/rsa_sig.c:774:
Verification of IVandFWenc failed

Seems like my tool doesn't do something as expected

RolandoMagico · August 27, 2023, 4:13pm

Appending 4 bytes to the image before encryption seems to fix the poblem, maybe something related to padding implementation. With the new image, there is a new issue during flashing:

FW(/tmp/FW.bin) is checking, please wait...
open_upgbuf: flags.secid=0x0
check_upgbuf: System build on Apr 14 2023 03:35:25
checking header!
check_upgbuf: get full upgrade header!
 enter icksum UPGHEADER_HLEN=80
 chksum=0xffff headerchk=0x6362
 header: major_version = 0x02,minjor_version = 0x00
 family_member = (F)6E60 vs (T)6E60
 ROM_ID = (F)DLK6E6010001 vs (T)DLK6E6010001
upg_check_header:image info: ichksum=0x33cf es=0x002c0000 el=0x02d00000 do=0x002c0000 dl=0x00d60000 io=0x00000000, s_id=0x08
check_upgbuf:image info: ichksum=0x33cf es=0x002c0000 el=0x02d00000 do=0x002c0000 dl=0x00d60000 io=0x00000000, s_id=0x08
image check ERROR! checksum=0x89b2
1397:HEADER boot=0x0000, atf=0x0000, p_section=0x0000, kernel=0x0000, ui=0x0000, roootfs=0x33cf, config=0x0000, mydlink=0x0000, signature=0x0000
1401:FW boot=0x0000, atf=0x0000, p_section=0x0000, kernel=0x0000, ui=0x0000, roootfs=0x89b2, config=0x0000, mydlink=0x0000, signature=0x0000
Image Rootfs check failed
Firmware checking result: failed

s_2 · August 29, 2023, 9:52pm

Awesome, thanks I couldn't find it at first, was probably looking at a different path.
I'm not sure these are all devices built by AMIT, e.g. the DAP series business access points could be either from Alpha Networks or Edimax. So this really looks like there should be a tool for all of them, I had started something in Python a while ago, but not much to show yet (it was intended to be more like a library for working with binary images and header components, like an abstract model for a firmware format, which is then evaluated by a composer or parser to generate / analyze an image, respectively).

But first, I hope the M32 PR will go well

s_2 · August 31, 2023, 8:07pm

Flashed your release (2023-07-20) to my M32, both wifis are working after manually enabling them, i.e. also scanning would not work right away (while the radios are still shown as a generic wifi). Has this been addresses in the meantime? Otherwise I would build an image manually and compare it to the last state of my branch, as far as I can recall it was working right away on my branch, after flashing with settings discarded.
R32 would be next (hopefully next week, eventually was too busy with my LoRa gateway -.-)
I thought I could at least post a serial bootlog for now, but it seems I hadn't even made one yet... Not sure if we need a separate forum thread for that device.

RolandoMagico · September 1, 2023, 5:41am

No, this problem was not addressed anywhere until now. I didn't have time to investigate it furhter. I only tried a build from the latest master, same problem.

RolandoMagico · September 1, 2023, 2:32pm

By default, both wifis are disabled in /etc/config/wireless
After changing option disabled '1' to option disabled '0' in the wifi-device sections, wifi works directly after startup and the correct names are shown in LuCi.

For me, it's not yet clear where these settings come from. Any ideas @s_2 ?

s_2 · September 1, 2023, 6:39pm

All wifis are disabled in OpenWrt by default, these are the uci default settings applied on first installation or when wiping overlay (this has caused much discussion regarding devices with no ethernet port; currently these can't be supported).

So the question is, why is the name not shown (and scanning not working) until after the radio has been enabled for the first time. I will try to build my old branch against latest master to see if this is just some regression, maybe related to LuCI.

RolandoMagico · September 2, 2023, 9:34am

I ported the device to v23.05.0-rc3 (commit 94cd25cb69805ec9b3ecd5a86ab39196c51e5a2e), there Wifi is working out of the box after restart. Device names are shown correctly and scanning is working.

Maybe you can check on your device:

RolandoMagico · September 2, 2023, 11:31am

Git bisect gave me this information:
b993a00b82b1bdd682199e44eb81a70dee78e5c9 is the first bad commit

Link: https://github.com/openwrt/openwrt/commit/b993a00b82b1bdd682199e44eb81a70dee78e5c9

Tried this in my branch:
git revert b993a00b82b1bdd682199e44eb81a70dee78e5c9

And wifi is working again as expected.
Question: Do I have to change something in my environment or is it a problem of the commit?

RolandoMagico · September 3, 2023, 12:55pm

Some thoughts about the memory layout:
I think the whole Kernel1 partition (0x002c0000-0x02fc0000, 45 MB) can be used by OpenWrt. In the factory images, 2944 KB are reserved for the kernel, followed by 43136 KB for rootfs (33280 KB) and rootfs_data (9856 KB). Not quite sure how this works because rootfs and rootfs_data are overlapping partitions in the OEM bootlog.
Theoretically the Mydlink partition (2 MB) can be used for OpenWrt as well because it's also included in the OEM firmware images and will be restored when reverting back to OEM firmware.
There is also a "Kernel2" partition with the same size as the "Kernel1" partition which seems to be empty initially but is written during one of the firmware updates. Maybe for recovery if a firmware update fails.

As far as I saw in other devices, 8 MB are recommended for the kernel partition. That's what I am also using at the moment, the remaining 37 MB are one UBI block.
From my understanding, UBIFS has some advantages over SquashFS and it is used in similar devices (Linksys E8450, Belkin RT3200) as well. On the other hand, there are also entries in mt7622.mk for these devices without UBI.

Questions from my side:

Is there any need to keep the memory layout of the factory image?
Why are there UBI and non-UBI entries for Linksys E8450?
Seems like the OEM firware does some rootfs checks in the new firmware during firmware update. This would be a reason for not using UBI. Is the idea to flash from factory to OpenWrt with non-UBI and switch to UBI afterwards?

RolandoMagico · September 5, 2023, 4:58pm

I updated the title of the thread to include R32 as well. As far as I see, the memory layout is the same, GPIO for WPS and Reset are the same.
Differences: R32 has 4 LAN ports instead of two and there are 4 LEDs (Power, Internet, Wireless 2.4GHz and Wireless 5GHz). M32 can turn its one LED white, orange or red, R32 can switch power/internet to either orange or white but not red. The wireless LEDs seems to be directly controlled by the pyh, they are white only.

RolandoMagico · September 9, 2023, 4:17pm

My current assumption regarding the error "Image Rootfs check failed":
The stock firmware expects a vailid rootfs after the kernel. As the kernel partition size is 2944k in the factory images, the search for a rootfs partition will be started after the kernel partition.
The current OpenWrt kernel is bigger than 2944k, which means it's not possible to have the same firmware structure as the factory images from D-Link.
If this would be correct, flashing from the stock firmware to OpenWrt won't be possible. But maybe someone has an idea how to handle this case.

The error message itself is raised in the function check_firmware in the file /usr/lib/libupgbuf.so. I didn't investigate the function in detail, maybe some more research will result in a solution.

s_2 · September 10, 2023, 5:02pm

Oh wow, finally back to the device and so much happened in between

First of all, I had rebased my branch to master and rebuilt, and wifi was only working after manual enabling, so this is a regression, but in the meantime you even found the commit already that breaks it

Also dumped a bootlog from R32, running OEM (shortened):


......


NAND read: device 0 offset 0x2c0000, size 0x2000
 8192 bytes read: OK
[do_read_image_blks]This is a FIT image,img_size = 0x2d9128
[do_read_image_blks]img_blks = 0x5b3
[do_read_image_blks]img_align_size = 0x2d9800

NAND read: device 0 offset 0x2c0000, size 0x2d9800
 2988032 bytes read: OK
bootm flag=0, states=70f
## Loading kernel from FIT Image at 4007ff28 ...
   Using 'config@1' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM64 mt7622-covr326x Linux-4.4.124
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x40080018
     Data Size:    2956165 Bytes = 2.8 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41080000
     Entry Point:  0x41080000
     Hash algo:    crc32
     Hash value:   5b9a0f52
     Hash algo:    sha1
     Hash value:   d7aaeb0340b7d753e9e4a58179ce0578120bd8a6
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 4007ff28 ...
   Using 'config@1' configuration
   Trying 'fdt@1' fdt subimage
     Description:  ARM64 mt7622-covr326x device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x40351cd8
     Data Size:    28749 Bytes = 28.1 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   bc180f0b
     Hash algo:    sha1
     Hash value:   6983b73f0bfa717b27f7105c4a2effce77a98cc9
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x40351cd8
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 5cd9c000, end 5cda604c ... OK
bootargs:(console=ttyS0,115200n1 loglevel=8 swiotlb=512 rootfstype=squashfs boot_part=Kernel1)

Starting kernel ...

[ATF][    13.575060]save kernel info
[ATF][    13.578092]Kernel_EL2
[ATF][    13.580848]Kernel is 64Bit
[ATF][    13.584036]pc=0x41080000, r0=0x5cd9c000, r1=0x0
INFO:    BL3-1: Preparing for EL3 exit to normal world, Kernel
INFO:    BL3-1: Next image address = 0x41080000
INFO:    BL3-1: Next image spsr = 0x3c9
[ATF][    13.602304]el3_exit
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.4.124 (oe-user@oe-host) (gcc version 7.3.0 (GCC) ) #1 SMP PREEMPT Wed Dec 21 12:11:03 UTC 2022
[    0.000000] Boot CPU: AArch64 Processor [410fd034]
[    0.000000] On node 0 totalpages: 131024
[    0.000000]   DMA zone: 2048 pages used for memmap
[    0.000000]   DMA zone: 0 pages reserved
[    0.000000]   DMA zone: 131024 pages, LIFO batch:31
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv0.2 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: Trusted OS migration not required
[    0.000000] PERCPU: Embedded 19 pages/cpu @ffffffc01ffa6000 s39320 r8192 d30312 u77824
[    0.000000] pcpu-alloc: s39320 r8192 d30312 u77824 alloc=19*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: enabling workaround for ARM erratum 845719
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 128976
[    0.000000] Kernel command line: console=ttyS0,115200n1 loglevel=8 swiotlb=512 rootfstype=squashfs boot_part=Kernel1
[    0.000000] PID hash table entries: 2048 (order: 2, 16384 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes)
[    0.000000] software IO TLB [mem 0x5fcf4000-0x5fdf4000] (1MB) mapped at [ffffffc01fcf4000-ffffffc01fdf3fff]
[    0.000000] Memory: 496880K/524096K available (5620K kernel code, 446K rwdata, 1712K rodata, 360K init, 406K bss, 27216K reserved, 0K cma-reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     modules : 0xffffff8000000000 - 0xffffff8008000000   (   128 MB)
[    0.000000]     vmalloc : 0xffffff8008000000 - 0xffffffbdbfff0000   (   246 GB)
[    0.000000]       .init : 0xffffff80087ad000 - 0xffffff8008807000   (   360 KB)
[    0.000000]       .text : 0xffffff8008080000 - 0xffffff80085fe000   (  5624 KB)
[    0.000000]     .rodata : 0xffffff80085fe000 - 0xffffff80087ad000   (  1724 KB)
[    0.000000]       .data : 0xffffff8008807000 - 0xffffff8008876b38   (   447 KB)
[    0.000000]     vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000   (     8 GB maximum)
[    0.000000]               0xffffffbdc0000000 - 0xffffffbdc0800000   (     8 MB actual)
[    0.000000]     fixed   : 0xffffffbffe7fb000 - 0xffffffbffec00000   (  4116 KB)
[    0.000000]     PCI I/O : 0xffffffbffee00000 - 0xffffffbfffe00000   (    16 MB)
[    0.000000]     memory  : 0xffffffc000000000 - 0xffffffc020000000   (   512 MB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000]  Build-time adjustment of leaf fanout to 64.
[    0.000000] NR_IRQS:64 nr_irqs:64 0
[    0.000000] Architected cp15 timer(s) running at 12.50MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2e2049cda, max_idle_ns: 440795202628 ns
[    0.000003] sched_clock: 56 bits at 12MHz, resolution 80ns, wraps every 4398046511080ns
[    0.000056] clocksource: timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 191126102035 ns
[    0.000223] Console: colour dummy device 80x25
[    0.000239] Calibrating delay loop (skipped), value calculated using timer frequency.. 25.00 BogoMIPS (lpj=50000)
[    0.000246] pid_max: default: 32768 minimum: 301
[    0.000294] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)
[    0.000300] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes)
[    0.000762] sched-energy: CPU device node has no sched-energy-costs
[    0.000770] Invalid sched_group_energy for CPU0
[    0.000774] CPU0: update cpu_capacity 1024
[    0.000802] ASID allocator initialised with 32768 entries
[    0.032100] Detected VIPT I-cache on CPU1
[    0.032128] Invalid sched_group_energy for CPU1
[    0.032130] CPU1: update cpu_capacity 1024
[    0.032132] CPU1: Booted secondary processor [410fd034]
[    0.032168] Brought up 2 CPUs
[    0.032181] SMP: Total of 2 processors activated.
[    0.032188] CPU: All CPU(s) started at EL2
[    0.032200] alternatives: patching kernel code
[    0.032280] Invalid sched_group_energy for CPU1
[    0.032286] Invalid sched_group_energy for Cluster1
[    0.032289] Invalid sched_group_energy for CPU0
[    0.032292] Invalid sched_group_energy for Cluster0
[    0.032535] devtmpfs: initialized
[    0.036744] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.036762] futex hash table entries: 512 (order: 4, 65536 bytes)
[    0.036871] pinctrl core: initialized pinctrl subsystem
[    0.037383] NET: Registered protocol family 16
[    0.037822] [SPM] spm_base = ffffff8008026000
[    0.037826] [SPM] spm_irq_0 = 6, spm_irq_1 = 7
[    0.037830] [SPM] spm_irq_2 = 8, spm_irq_3 = 9
[    0.037833] [SPM] set spm as wakeup devcie.
[    0.037838] [SPM] spm_rtc cnt: 24414.
[    0.052080] cpuidle: using governor menu
[    0.052141] vdso: 2 pages (1 code @ ffffff8008603000, 1 data @ ffffff800880c000)
[    0.052296] DMA: preallocated 256 KiB pool for atomic allocations
[    0.052381] Serial: AMBA PL011 UART driver
[    0.052432] [SPM] PWAKE_EN:1, PCMWDT_EN:0, BYPASS_SYSPWREQ:0, I2C_CHANNEL:2
[    0.052437] [SLP] SLEEP_DPIDLE_EN:1, REPLACE_DEF_WAKESRC:0, SUSPEND_LOG_EN:1
[    0.085163] vgaarb: loaded
[    0.085363] SCSI subsystem initialized
[    0.085566] usbcore: registered new interface driver usbfs
[    0.085607] usbcore: registered new interface driver hub
[    0.085644] usbcore: registered new device driver usb
[    0.087074] rbus 18000000.wbsys: PCI host bridge to bus 0000:00
[    0.087089] pci_bus 0000:00: root bus resource [mem 0x18000000-0x180fffff]
[    0.087096] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.087115] pci 0000:00:00.0: [14c3:7622] type 00 class 0x000280
[    0.087131] pci 0000:00:00.0: reg 0x10: [mem 0x18000000-0x1800000f 64bit]
[    0.087138] pci 0000:00:00.0: reg 0x18: [mem 0x00000000-0x0000000f]
[    0.087144] pci 0000:00:00.0: reg 0x1c: [mem 0x00000000-0x0000000f]
[    0.087150] pci 0000:00:00.0: reg 0x20: [mem 0x00000000-0x0000000f]
[    0.087157] pci 0000:00:00.0: reg 0x24: [mem 0x00000000-0x0000000f]
[    0.087187] pci 0000:00:00.0: of_irq_parse_pci() failed with rc=-22
[    0.087506] clocksource: Switched to clocksource arch_sys_counter
[    0.093373] NET: Registered protocol family 2
[    0.093744] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.093775] TCP bind hash table entries: 4096 (order: 4, 65536 bytes)
[    0.093831] TCP: Hash tables configured (established 4096 bind 4096)
[    0.093876] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.093889] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.093994] NET: Registered protocol family 1
[    0.094032] PCI: CLS 0 bytes, default 128
[    0.101226] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.101408] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.101847] fuse init (API version 7.23)
[    0.104955] NET: Registered protocol family 38
[    0.104994] io scheduler noop registered
[    0.105228] io scheduler cfq registered (default)
[    0.133235] mtk-pcie 1a140000.pcie: pcie rc 0 linkup success
[    0.233277] mtk-pcie 1a140000.pcie: Port1 link down
[    0.233480] mtk-pcie 1a140000.pcie: PCI host bridge to bus 0001:00
[    0.233490] pci_bus 0001:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.233496] pci_bus 0001:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.233503] pci_bus 0001:00: root bus resource [bus 00-ff]
[    0.233537] pci 0001:00:00.0: [14c3:5396] type 01 class 0x060400
[    0.233590] pci 0001:00:00.0: reg 0x10: [mem 0x00000000-0xffffffff 64bit pref]
[    0.233715] pci 0001:00:00.0: of_irq_parse_pci() failed with rc=-22
[    0.233843] pci 0001:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.234071] pci 0001:01:00.0: [14c3:7915] type 00 class 0x000280
[    0.234377] pci 0001:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
[    0.234490] pci 0001:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
[    0.234603] pci 0001:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
[    0.235117] pci 0001:01:00.0: supports D1 D2
[    0.235123] pci 0001:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    0.243580] pci_bus 0001:01: busn_res: [bus 01-ff] end is updated to 01
[    0.243618] pci 0001:00:00.0: BAR 0: no space for [mem size 0x100000000 64bit pref]
[    0.243624] pci 0001:00:00.0: BAR 0: failed to assign [mem size 0x100000000 64bit pref]
[    0.243631] pci 0001:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[    0.243641] pci 0001:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
[    0.243732] pci 0001:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
[    0.243822] pci 0001:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
[    0.243912] pci 0001:00:00.0: PCI bridge to [bus 01]
[    0.243923] pci 0001:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
[    0.243982] pcieport 0001:00:00.0: of_irq_parse_pci() failed with rc=-22
[    0.243997] pcieport 0001:00:00.0: enabling device (0000 -> 0002)
[    0.244157] pcieport 0001:00:00.0: Signaling PME through PCIe PME interrupt
[    0.244163] pci 0001:01:00.0: Signaling PME through PCIe PME interrupt
[    0.244172] pcie_pme 0001:00:00.0:pcie01: service driver pcie_pme loaded
[    0.248781] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
[    0.249930] console [ttyS0] disabled
[    0.270105] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 230, base_baud = 1562500) is a ST16650V2
[    1.133822] console [ttyS0] enabled
[    1.157942] 11005000.serial: ttyS1 at MMIO 0x11005000 (irq = 231, base_baud = 1562500) is a ST16650V2
[    1.167910] Unable to detect cache hierarchy for CPU 0
[    1.176156] loop: module loaded
[    1.179763] dump_power_table[0] = { .cpufreq_khz = 1350000,  .cpufreq_ncpu = 2,      .cpufreq_power = 995 }
[    1.188984] dump_power_table[1] = { .cpufreq_khz = 1262500,  .cpufreq_ncpu = 2,      .cpufreq_power = 811 }
[    1.198203] dump_power_table[2] = { .cpufreq_khz = 1137500,  .cpufreq_ncpu = 2,      .cpufreq_power = 736 }
[    1.207417] dump_power_table[3] = { .cpufreq_khz = 1025000,  .cpufreq_ncpu = 2,      .cpufreq_power = 624 }
[    1.216634] dump_power_table[4] = { .cpufreq_khz = 1350000,  .cpufreq_ncpu = 1,      .cpufreq_power = 517 }
[    1.225848] dump_power_table[5] = { .cpufreq_khz = 812500,   .cpufreq_ncpu = 2,      .cpufreq_power = 492 }
[    1.234978] dump_power_table[6] = { .cpufreq_khz = 1262500,  .cpufreq_ncpu = 1,      .cpufreq_power = 377 }
[    1.244193] dump_power_table[7] = { .cpufreq_khz = 600000,   .cpufreq_ncpu = 2,      .cpufreq_power = 376 }
[    1.253323] dump_power_table[8] = { .cpufreq_khz = 1137500,  .cpufreq_ncpu = 1,      .cpufreq_power = 333 }
[    1.262537] dump_power_table[9] = { .cpufreq_khz = 437500,   .cpufreq_ncpu = 2,      .cpufreq_power = 295 }
[    1.271666] dump_power_table[10] = { .cpufreq_khz = 1025000, .cpufreq_ncpu = 1,      .cpufreq_power = 258 }
[    1.280969] dump_power_table[11] = { .cpufreq_khz = 300000,  .cpufreq_ncpu = 2,      .cpufreq_power = 225 }
[    1.290187] dump_power_table[12] = { .cpufreq_khz = 812500,  .cpufreq_ncpu = 1,      .cpufreq_power = 204 }
[    1.299401] dump_power_table[13] = { .cpufreq_khz = 600000,  .cpufreq_ncpu = 1,      .cpufreq_power = 166 }
[    1.308616] dump_power_table[14] = { .cpufreq_khz = 437500,  .cpufreq_ncpu = 1,      .cpufreq_power = 140 }
[    1.317829] dump_power_table[15] = { .cpufreq_khz = 300000,  .cpufreq_ncpu = 1,      .cpufreq_power = 119 }
[    1.328180] [cal] calefuse1  = 0x7aaaebc0
[    1.332108] [cal] calefuse2  = 0x4b4010
[    1.335857] [cal] g_adc_ge_t = 0x2ae
[    1.339422] [cal] g_adc_oe_t = 0x1ea
[    1.342993] [cal] g_degc_cali        = 0x2f
[    1.346567] [cal] g_adc_cali_en_t    = 0x1
[    1.350398] [cal] g_o_slope  = 0x0
[    1.353711] [cal] g_o_slope_sign     = 0x0
[    1.357456] [cal] g_id               = 0x0
[    1.360422] [cal] g_o_vtsmcu1        = 0x0
[    1.363906] [cal] g_o_vtsmcu2        = 0x12d
[    1.367566] [cal] g_o_vtsmcu3        = 0x0
[    1.371044] [cal] g_o_vtsmcu4        = 0x0
[    1.374528] [cal] g_ge               = 0x1a8
[    1.377665] [cal] g_gain             = 0x28b8
[    1.381061] [cal] g_x_roomt1 = 0x1f5c
[    1.388247] mtk-snand 1100d000.snfi: mtk_snand_init_hw
[    1.393402] mtk-snand 1100d000.snfi: # MTK SNAND # : Use HW ECC
[    1.409430] Recognize NAND: ID [
[    1.412485] c2 12
[    1.414495] ], [MX35LF1GE4AB], Page[2048]B, Spare [64]B Total [128]MB
[    1.421308] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0x12
[    1.427662] nand: Macronix SNAND 128MiB 3,3V 8-bit
[    1.432451] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.440020] [NAND]select ecc bit:4, sparesize :64
[    1.446158] [BBT] BMT.v2 is found at 0x3ff
[    1.450284] 12 ofpart partitions found on MTD device MTK-SNAND
[    1.456113] Creating 12 MTD partitions on "MTK-SNAND":
[    1.461251] 0x000000000000-0x000000080000 : "Preloader"
[    1.467417] 0x000000080000-0x0000000c0000 : "ATF"
[    1.472794] 0x0000000c0000-0x000000140000 : "Bootloader"
[    1.478913] 0x000000140000-0x000000180000 : "BootConfig"
[    1.484893] 0x000000180000-0x0000001c0000 : "Odm"
[    1.490265] 0x0000001c0000-0x000000240000 : "Config1"
[    1.496154] 0x000000240000-0x0000002c0000 : "Config2"
[    1.502022] 0x0000002c0000-0x000002fc0000 : "Kernel1"
[    1.535526] 2 fit-fw partitions found on MTD device Kernel1
[    1.541101] 0x0000002c0000-0x0000005a0000 : "kernel"
[    1.548324] 0x0000005a0000-0x000002fc0000 : "rootfs"
[    1.579465] mtd: device 9 (rootfs) set to be root filesystem
[    1.585132] 1 squashfs-split partitions found on MTD device rootfs
[    1.591314] 0x000002560000-0x000002fc0000 : "rootfs_data"
[    1.603553] 0x000002fc0000-0x000005cc0000 : "Kernel2"
[    1.636547] 0x000005cc0000-0x000005dc0000 : "Factory"
[    1.642723] 0x000005dc0000-0x000005fc0000 : "Mydlink"
[    1.649511] 0x000005fc0000-0x0000062c0000 : "Storage"
[    1.656932] mtk-snand 1100d000.snfi: [mtk_snand] probe successfully!
[    1.664957] libphy: Fixed MDIO Bus: probed
[    1.669427] sean debug physpeed = 2500
[    1.706925] libphy: mdio: probed
[    1.710179] mtk_soc_eth 1b100000.ethernet: generated random MAC address 6e:25:dd:95:c3:2a
[    1.718523] mtk_soc_eth 1b100000.ethernet: connected mac 0 to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[    1.729186] mtk_soc_eth 1b100000.ethernet eth0: mediatek frame engine at 0xffffff8008980000, irq 250
[    1.738429] PPP generic driver version 2.4.2
[    1.742829] PPP BSD Compression module registered
[    1.747538] PPP Deflate Compression module registered
[    1.752608] PPP MPPE Compression module registered
[    1.757402] NET: Registered protocol family 24
[    1.761861] PPTP driver version 0.8.5
[    1.765967] 1a0c0000.usb supply vbus not found, using dummy regulator
[    1.772438] 1a0c0000.usb supply vusb33 not found, using dummy regulator
[    1.779329] xhci-mtk 1a0c0000.usb: xHCI Host Controller
[    1.784564] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 1
[    1.792051] xhci-mtk 1a0c0000.usb: hcc params 0x01403198 hci version 0x96 quirks 0x00210010
[    1.800429] xhci-mtk 1a0c0000.usb: irq 246, io mem 0x1a0c0000
[    1.806609] hub 1-0:1.0: USB hub found
[    1.810373] hub 1-0:1.0: 2 ports detected
[    1.814652] xhci-mtk 1a0c0000.usb: xHCI Host Controller
[    1.819881] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 2
[    1.827312] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    1.835761] hub 2-0:1.0: USB hub found
[    1.839522] hub 2-0:1.0: 1 port detected
[    1.843772] usbcore: registered new interface driver usb-storage
[    1.850011] rtc rtc0: alarm rollover: day
[    1.854026] rtc rtc0: invalid alarm value: 1900-1-2 2022213768:1073741856:0
[    1.861088] rtc rtc0: test: dev (254:0)
[    1.864932] rtc-test rtc-test.0: rtc core: registered test as rtc0
[    1.871203] rtc rtc1: alarm rollover: day
[    1.875213] rtc rtc1: invalid alarm value: 1900-1-2 2022213768:1073741856:0
[    1.882274] rtc rtc1: test: dev (254:1)
[    1.886111] rtc-test rtc-test.1: rtc core: registered test as rtc1
[    1.892299] i2c /dev entries driver
[    1.897217] MTK_WDT_NONRST_REG(20000000)
[    1.901360] mtk-wdt 10212000.watchdog: register restart_handler on reboot_notifier_list for psci reset
[    1.910671] mtk-wdt 10212000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    1.918687] register cpuidle driver!!!!!!!!!!!!!!!!!
[    1.923950] sdhci: Secure Digital Host Controller Interface driver
[    1.930136] sdhci: Copyright(c) Pierre Ossman
[    1.934924] msdc_drv_probe!
[    1.938110] mtk-msdc 11230000.mmc: Regulator set error -22: 3300000 - 3300000
[    1.986014] mtk-msdc 11230000.mmc: Regulator set error -22: 3300000 - 3300000
[    2.036128] mtk-msdc 11230000.mmc: Regulator set error -22: 3300000 - 3300000
[    2.088265] mtk-msdc 11230000.mmc: Regulator set error -22: 3300000 - 3300000
[    2.715519] mtk_soc_eth 1b100000.ethernet: path gmac1_sgmii in set_mux_gdm1_to_gmac1_esw updated = 1
[    2.724651] mtk_soc_eth 1b100000.ethernet: mux mux_gmac2_gmac0_to_gephy isn't present on the SoC
[    2.733433] mtk_soc_eth 1b100000.ethernet: mux mux_u3_gmac2_to_qphy isn't present on the SoC
[    2.741870] mtk_soc_eth 1b100000.ethernet: path gmac1_sgmii in set_mux_gmac1_gmac2_to_sgmii_rgmii updated = 1
[    2.751780] mtk_soc_eth 1b100000.ethernet: mux mux_gmac12_to_gephy_sgmii isn't present on the SoC
[    3.981272] u32 classifier
[    3.984010] Netfilter messages via NETLINK v0.30.
[    3.988752] nf_conntrack version 0.5.0 (3881 buckets, 15524 max)
[    3.995039] ctnetlink v0.93: registering with nfnetlink.
[    4.000492] xt_time: kernel timezone is -0000
[    4.004860] ip_set: protocol 6
[    4.008005] ipip: IPv4 over IPv4 tunneling driver
[    4.013045] gre: GRE over IPv4 demultiplexor driver
[    4.017930] ip_gre: GRE over IPv4 tunneling driver
[    4.023412] ip_tables: (C) 2000-2006 Netfilter Core Team
[    4.028862] Initializing XFRM netlink socket
[    4.033663] NET: Registered protocol family 10
[    4.038990] sit: IPv6 over IPv4 tunneling driver
[    4.044389] NET: Registered protocol family 17
[    4.048900] NET: Registered protocol family 15
[    4.053408] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    4.066077] Bridge firewalling registered
[    4.070102] Ebtables v2.0 registered
[    4.073803] l2tp_core: L2TP core driver, V2.0
[    4.078172] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[    4.082965] 8021q: 802.1Q VLAN Support v1.8
[    4.087670] registered taskstats version 1
[    4.631826] mt753x gsw@0: Switch is MediaTek MT7531BE rev 1
[    4.641853] mt753x gsw@0: HWSTRAP=0xff XTAL=25MHz
[    4.652971] libphy: mt753x_mdio: probed
[    4.908914] random: nonblocking pool is initialized
[    4.941698] mt753x gsw@0: >>>>>>>>>>>>>>>>>>>>>>>>>>>>> START CALIBRATION:
[    4.949847] mt753x gsw@0: -------- gephy-calbration (port:0) --------
[    4.966388] CALDLY = 40
[    5.030754] 0x1e-e0 = 2828
[    5.035417] 0x1f-115 = 5
 .... 
INIT: version 2.88 booting
create r/w /etc folder
create r/w /var folder
run /usr/etc/rcS (project/etc.rcS)
/etc/rcS.d/S01create-perst-part.sh:18: command not found: file
Usage: mkfs.ext4 [-c|-l filename] [-b block-size] [-C cluster-size]
        [-i bytes-per-inode] [-I inode-size] [-J journal-options]
        [-G flex-group-size] [-N number-of-inodes] [-d root-directory]
        [-m reserved-blocks-percentage] [-o creator-os]
        [-g blocks-per-group] [-L volume-label] [-M last-mounted-directory]
        [-O feature[,...]] [-r fs-revision] [-E extended-option[,...]]
        [-t fs-type] [-T usage-type ] [-U UUID] [-e errors_behavior][-z undo_file]
        [-jnqvDFSV] device [blocks-count]
Fuse filesystem already available.
Mounting fuse control filesystem.
Starting udev
[   11.381486] udevd[915]: starting version 3.2.5
[   11.423756] udevd[916]: starting eudev-3.2.5
hwclock: settimeofday: Invalid argument
cat: read error: Is a directory
cat: read error: Is a directory
cat: read error: Is a directory
Starting mount /var/config: main: do jffs2_boot
do_jffs2_mkdir: create folder /var/storage ok
[   13.021081] jffs2: CLEANMARKER node found at 0x00000000 has totlen 0xc != normal 0x0
[   13.040318] jffs2: Empty flash at 0x00000080 ends at 0x00000800
[   13.089135] jffs2: notice: (1479) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
do_jffs2_mount: 1st, mount /dev/mtdblock14 to /var/storage ok
done
Starting untar webui-dlink: done
Starting paccess: read_psec2datfile: done!
done
Starting csman: [csmsal_open]feed_csiddata (/tmp/csman/pre1.dat:5279)
[csmsal_open]feed_csiddata (/tmp/csman/pre4.dat:549)
[csmsal_open]feed_csiddata (/tmp/csman/pre7.dat:465)
[hookcs_load]cannot find c section tag
hookcs_load C section 1 address 0x00000000 return NULL
[hookcs_load]cannot find c section tag
hookcs_load C section 2 address 0x00000000 return NULL
used file csimg.dat...
flash_open: open(/var/csman/csimg.dat) failed(No such file or directory)
[hookcs_load]flash_open(/var/csman/csimg.dat:0) error(No such file or directory)!
load C section fail...
[csmsal_open]load /tmp/csman/reset.dat:19862
[csmsal_open]feed_csiddata reset
[csm_svr_init]csmsal open("/tmp/csman"), fd=171
done
Starting syslogd/klogd: done
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
mount: /sys/kernel/debug: none already mounted or mount point busy.
insmod: ERROR: could not insert module /lib/modules/4.4.124/extra/misc_gpioled.ko: File exists
Starting commander: /dev/mf_dev
Thu Dec 22 12:04:29 UTC 2022
[   19.037941] mediatek-mt7622-pinctrl 10005000.pinctrl: pin MDI_RN_P0 already requested by 10005000.pinctrl:463; cannot claim for 10005000.pinctrl:463
[   19.051265] mediatek-mt7622-pinctrl 10005000.pinctrl: pin-54 (10005000.pinctrl:463) status -22
[   19.059884] <misc>gpio_led_set: cannot get gpio54 through pinctrl_request_gpio
csm_svr_work[591]: cchg_flag=1, save to flash
hookcs_save: cur_id=1, address=0x0, len=17864
[   19.321273] mediatek-mt7622-pinctrl 10005000.pinctrl: pin MDI_RN_P0 already requested by 10005000.pinctrl:463; cannot claim for 10005000.pinctrl:463
[   19.334603] mediatek-mt7622-pinctrl 10005000.pinctrl: pin-54 (10005000.pinctrl:463) status -22
[   19.343229] <misc>gpio_led_set: cannot get gpio54 through pinctrl_request_gpio
C section 2 is out of date, save to C section 2, ts(0x1)...
write_thread[88]: id:1, section_tag cmark:0x07 secid:0x07 magic:0x2B24 ts:0x00000001 imglen:0x000045C8 imgchk:0xF3DB tagchk:0x942F

....

[   26.245847] pci 0000:00:00.0: BAR 0: assigned [mem 0x18000000-0x180fffff 64bit]
[   26.253182] pci 0000:00:00.0: BAR 0: error updating (0x18000004 != 0x000004)
[   26.260249] pci 0000:00:00.0: BAR 2: no space for [mem size 0x00000010]
[   26.266875] pci 0000:00:00.0: BAR 2: failed to assign [mem size 0x00000010]
[   26.273842] pci 0000:00:00.0: BAR 3: no space for [mem size 0x00000010]
[   26.280466] pci 0000:00:00.0: BAR 3: failed to assign [mem size 0x00000010]
[   26.287433] pci 0000:00:00.0: BAR 4: no space for [mem size 0x00000010]
[   26.294048] pci 0000:00:00.0: BAR 4: failed to assign [mem size 0x00000010]
[   26.301015] pci 0000:00:00.0: BAR 5: no space for [mem size 0x00000010]
[   26.307629] pci 0000:00:00.0: BAR 5: failed to assign [mem size 0x00000010]
[   26.314755] pci 0001:01:00.0: [14c3:7915] type 00 class 0x000280
[   26.321125] pci 0001:01:00.0: reg 0x10: [mem 0x20000000-0x200fffff 64bit pref]
[   26.328480] pci 0001:01:00.0: reg 0x18: [mem 0x20100000-0x20103fff 64bit pref]
[   26.335828] pci 0001:01:00.0: reg 0x20: [mem 0x20104000-0x20104fff 64bit pref]
[   26.343689] pci 0001:01:00.0: supports D1 D2
[   26.347963] pci 0001:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[   26.355268] pci 0001:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
[   26.363129] pci 0001:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
[   26.370979] pci 0001:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]


.....


[   27.589104] jffs2: CLEANMARKER node found at 0x00000000 has totlen 0xc != normal 0x0
[   27.609263] jffs2: CLEANMARKER node found at 0x00020000 has totlen 0xc != normal 0x0
[   27.629451] jffs2: CLEANMARKER node found at 0x00040000 has totlen 0xc != normal 0x0
[   27.677004] jffs2: notice: (1989) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of 
  
  
.......


/etc/rc5.d/S20xl2tpd:.:23: no such file or directory: /lib/lsb/init-functions
chgrp: unknown group adm
mv: can't rename 'boot.0': No such file or directory

dlinkdistro (Yocto Project Reference Distro) 2.5.1 R32-C685 /dev/ttyS0

R32-C685 login:

Tried sending the initramfs built for M32 via tftp, it boots fine, Wifi is working only for 2.4G;

...maybe different chip or mtd-eeprom offset?

[    5.988910] mt7915e 0000:01:00.0: WM Firmware Version: ____000000, Build Time: 20220929104145
[    6.012586] mt7915e 0000:01:00.0: WA Firmware Version: DEV_000000, Build Time: 20220929104205
[    6.128890] mt7915e 0000:01:00.0: eeprom load fail, use default bin
[    6.135215] mt7915e 0000:01:00.0: Direct firmware load for mediatek/mt7915_eeprom.bin failed with error -2
[    6.144869] mt7915e 0000:01:00.0: Falling back to sysfs fallback for: mediatek/mt7915_eeprom.bin
[    6.159842] mt7915e: probe of 0000:01:00.0 failed with error -12

LAN ports 1 and 2 as well as WAN are working, so it's just port 3 and 4 added here.
LEDs are all on except for 5G wifi and the orange WAN / globe one, but there's no boot flashing pattern. So this needs some more attention, otherwise devices seem to be really similar.

No idea, I would assume there should be other devices affected by this, but there are probably just not so many with MT7622 and AX by now, let's hope nbd could find something there.

Regarding kernel size and rootfs offset, I would expect the bootloader / kernel to just use the layout provided via FDT here, i.e. the one appended to the kernel, which is generated from whatever we specify in the device tree source, so this should not be an issue. The fixed size to 8 MiB on other devices was mainly due to UBI not allowing a flexible layout here (without losing UBI bad blocks information upon performing sysupgrade, which would then repartition the flash and create a new UBI, which is not how UBI is supposed to be used). I just hope the kernel won't grow beyond 8MiB so quickly, otherwise we will have to use a loader at some point...

For COVR-X1860, I simply had to place | append-fake-rootfs or something in the buildstep, which was sufficient to make the bootloader happy (although that was more about the main/backup dual partition handling, to prevent restoring the newly-flshed image with the oem image backup).

Not sure how these devices differ, as OEM firmware is apparently not even based on OpenWrt here, but seems to be built using Yocto.

I think I had started looking at libupgbuf in ghidra inititally (actually still with the Realtek-based M15), can't recall what I found, I may have another look at it

RolandoMagico · September 10, 2023, 5:55pm

Do you want to try https://github.com/RolandoMagico/openwrt-build/releases/tag/EAGLE_PRO_AI_R32_Build_20230906?
If i didn't miss anything, it should work on R32.