The SamKnows SK-WB8 has a new successor: the SamKnows SK-WB8+

AdibSadman · May 3, 2023, 2:21pm

Joined the SamKnows broadband data collection thing here in Australia and recieved my Whitebox. Opening the box, I noticed that it is NOT the SK-WB8 which we already have a firmware for. This new Whitebox has four external antennas.

SamKnows claims that the internals are EXACTLY the same as the WB8 but with the new external antennas.

Gonna try and flash the existing firmware once I get my USB UART cable but I don't know if we need hardware support for the external antennas if nothing has indeed changed.

Whitebox 8+ | Blog (samknows.com)

numloxx · May 11, 2023, 1:12pm

I've tried accessing it, using serial ttl, but it won't accept any keyboard commands. First time doing this, so don't know if I'm doing something wrong or not.

How did you go?

AdibSadman · May 16, 2023, 10:05am

Did you run any specific command?

BJReplay · June 24, 2023, 5:53am

I've tried accessing it using serial TTL as well, but it doesn't seem to accept any keyboard commands.

On booting up the bootlog that displays on the serial console is different to that shown on the (SamKnows SK-WB8 wiki page)

According to the wiki page, the bootlog shows

[    7.280000] hub 2-0:1.0: USB hub found
[    7.290000] hub 2-0:1.0: 1 port detected
[    7.440000] init: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   10.970000] mount_root: loading kmods from internal overlay
[   11.570000] jffs2: notice: (347) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.

The prompt

Press the [f] key and hit [enter] to enter failsafe mode

is never displayed.

The wiki talks about recovering from a failed boot by hitting 2 on powerup, and I've tried to force that - corresponding to option 2 on this menu shown very early in the boot

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP. 
 4  3  2  1  0 
bootcount: 0

However the system displays

3: System Boot system code via Flash.
Erasing SPI Flash...

Almost immediately afterwards as if the response is hard coded.

Has anyone had any luck getting access to the WB8+?

amirulandalib · July 8, 2023, 6:49am

can you send the encrypted code in a gist and share with me. You probably need to decrypt it.

frollic · July 8, 2023, 6:49am

What encrypted code ?

amirulandalib · July 8, 2023, 7:03am

the responses should be encrypted (hardcoded) as he said its giving some unknown text format. that's what I guess. So you need to decrypt it but first we need to look at the output. But if he went to failsafe and used the TTL it should be normal I think

frollic · July 8, 2023, 7:07am

not what he said, read it again.

amirulandalib · July 8, 2023, 7:08am

Almost immediately afterwards as if the response is hard coded.

Has anyone had any luck getting access to the WB8+?

frollic · July 8, 2023, 7:09am

hard coded <> encrypted
the latter would mean it's unreadable.

this is what this thread is about, innit ?

amirulandalib · July 8, 2023, 7:11am

yes my english is bad, sorry

mk24 · July 8, 2023, 3:44pm

It will probably require using a SPI programmer to replace the locked bootloader directly in the flash chip. Either with the bootloader from a non plus WB8, or a third party.

mateusz-plociennik · December 4, 2023, 3:20am

It seems that you haven't hooked your TX - device RX correctly. I have managed to flash my WB8+ using bootloader's TFTP without any issues.

BJReplay · December 4, 2023, 3:35am

Nope, definitely have. I know that, because I did have them hooked back to front, and didn't get any console output when they were back to front.

The issue isn't TX-RX, it is that the prompt

Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level

is never displayed.

I'm guessing it's too late to get you to dump the console now that you've flashed, but I got a different bootlog as noted above (and, as noted above, I did have the TX-RX hooked correctly as I was able to capture the bootlog )

mateusz-plociennik · December 4, 2023, 3:40am

Actually, I have:

===================================================================
     		MT7621   stage1 code Mar 12 2015 14:43:30 (ASIC)
     		CPU=500000000 HZ BUS=125000000 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x31100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-800Mhz ===
PLL3 FB_DL: 0xc, 1/0 = 635/389 31000000
PLL4 FB_DL: 0xc, 1/0 = 615/409 31000000
PLL2 FB_DL: 0xd, 1/0 = 525/499 35000000
do DDR setting..[01F40000]
Apply DDR2 Setting...(use customer AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
      --------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    1    1    1    1
0007:|    0    0    0    0    0    1    1    1    1    1    1    1    1    1    1    1
0008:|    1    1    1    1    1    1    1    1    1    1    1    1    0    0    0    0
0009:|    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0010:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0011:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
DRAMC_DQSCTL1[0e0]=1A000000
DRAMC_DQSGCTL[124]=80000000
rank 0 coarse = 8
rank 0 fine = 48
B:|    0    0    0    0    0    1    1    1    0    0    0    0    0    0    0    0
opt_dle value:6
DRAMC_DDR2CTL[07c]=40001263
DRAMC_PADCTL4[0e4]=00000005
DRAMC_DQIDLY1[210]=0C0A090D
DRAMC_DQIDLY2[214]=07080909
DRAMC_DQIDLY3[218]=0D0B0A09
DRAMC_DQIDLY4[21c]=0B090C08
DRAMC_R0DELDLY[018]=00002B2B
==================================================================
		RX	DQS perbit delay software calibration 
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    11 9 10 10 7 6 7 6 8 8 
10 |    10 13 7 10 9 9 
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center 
y=0-7bit DQ of every group
input delay:DQS0 =43 DQS1 = 43
==================================================================
bit	DQS0	 bit      DQS1
0  (1~82)41  8  (1~84)42
1  (2~85)43  9  (1~82)41
2  (1~85)43  10  (1~84)42
3  (1~81)41  11  (2~84)43
4  (0~83)41  12  (1~84)42
5  (1~80)40  13  (1~81)41
6  (1~83)42  14  (1~85)43
7  (1~83)42  15  (1~82)41
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    13 9 10 12 9 9 8 7 9 10 
10 |    11 13 8 12 9 11 
==================================================================
==================================================================
     TX  perbyte calibration 
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000 
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 
DQ loop=15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1 
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2 
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
DRAMC_DQODLY1[200]=88888888
DRAMC_DQODLY2[204]=88888888
20,data:88
[EMI] DRAMC calibration passed

===================================================================
     		MT7621   stage1 code done 
     		CPU=500000000 HZ BUS=125000000 HZ
===================================================================


U-Boot 1.1.3 (Jan 15 2016 - 09:47:18)

Board: Ralink APSoC DRAM:  128 MB
relocate_code Pointer at: 87fb8000

Config XHCI 40M PLL 
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
============================================ 
Ralink UBoot Version: 4.3.0.0
-------------------------------------------- 
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection 
DRAM_TYPE: DDR2 
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/4
Flash component: SPI Flash
Date:Jan 15 2016  Time:09:47:18
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 880 MHZ #### 
 estimate memory size =128 Mbytes
#Reset_MT7530

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP. 
 0 
bootcount: 0
   
3: System Boot system code via Flash.
Erasing SPI Flash...
.
Writing to SPI Flash...
.
done
## Booting image at bc050000 ...
   Image Name:   MIPS LEDE Linux-4.4.79
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1666235 Bytes =  1.6 MB
   Load Address: 80001000
   Entry Point:  80001000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80001000) ...
## Giving linux memsize in MB, 128

Starting kernel ...

[    0.000000] Linux version 4.4.79 (salvatore@sk-prog2) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3531-88f72090c9) ) #0 SMP Thu Feb 11 14:43:56 2021
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is SamKnows Whitebox 8
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] PERCPU: Embedded 11 pages/cpu @8110c000 s13664 r8192 d23200 u45056
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=0007b804
[    0.000000] Readback ErrCtl register=0007b804
[    0.000000] Memory: 123972K/131072K available (3959K kernel code, 268K rwdata, 940K rodata, 260K init, 261K bss, 7100K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:256
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns
[    0.000009] sched_clock: 32 bits at 440MHz, resolution 2ns, wraps every 4880645118ns
[    0.015511] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[    0.080738] pid_max: default: 32768 minimum: 301
[    0.090058] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.103075] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.118243] Performance counters: mips/1004K PMU enabled, 2 32-bit counters available to each CPU, irq 9
[    0.139923] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.139936] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.139950] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.140129] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.248268] Synchronize counters for CPU 1: done.
[    0.268370] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.268377] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.268384] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.268462] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.368477] Synchronize counters for CPU 2: done.
[    0.379256] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.379263] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.379269] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.379357] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.488088] Synchronize counters for CPU 3: done.
[    0.497516] Brought up 4 CPUs
[    0.506827] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.526331] futex hash table entries: 1024 (order: 3, 32768 bytes)
[    0.539028] pinctrl core: initialized pinctrl subsystem
[    0.549951] NET: Registered protocol family 16
[    0.589586] pull PCIe RST: RALINK_RSTCTRL = 0
[    0.898298] release PCIe RST: RALINK_RSTCTRL = 7000000
[    0.908360] ***** Xtal 40MHz *****
[    0.915091] release PCIe RST: RALINK_RSTCTRL = 7000000
[    0.925296] Port 0 N_FTS = 1b102800
[    0.932196] Port 1 N_FTS = 1b102800
[    0.939119] Port 2 N_FTS = 1b102800
[    2.096745] PCIE2 no card, disable it(RST&CLK)
[    2.105427]  -> 21007f2
[    2.110252] PCIE0 enabled
[    2.115447] PCIE1 enabled
[    2.120625] PCI host bridge /pcie@1e140000 ranges:
[    2.130150]  MEM 0x0000000060000000..0x000000006fffffff
[    2.140511]   IO 0x000000001e160000..0x000000001e16ffff
[    2.150881] PCI coherence region base: 0x60000000, mask/settings: 0xf0000002
[    2.196391] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    2.207575] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    2.218629] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    2.230965] PCI host bridge to bus 0000:00
[    2.238980] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    2.252648] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    2.264380] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    2.277859] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    2.294375] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    2.310169] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    2.327416] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    2.340433] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    2.354255] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000]
[    2.367382] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000]
[    2.381211] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    2.394689] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref]
[    2.409031] pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff]
[    2.422511] pci 0000:00:01.0: BAR 9: assigned [mem 0x60300000-0x603fffff pref]
[    2.436852] pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff]
[    2.450338] pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff]
[    2.463822] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
[    2.478334] pci 0000:01:00.0: BAR 6: assigned [mem 0x60100000-0x6010ffff pref]
[    2.492664] pci 0000:00:00.0: PCI bridge to [bus 01]
[    2.502504] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    2.515993] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref]
[    2.530342] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff 64bit]
[    2.544862] pci 0000:02:00.0: BAR 6: assigned [mem 0x60300000-0x6030ffff pref]
[    2.559190] pci 0000:00:01.0: PCI bridge to [bus 02]
[    2.569030] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
[    2.582521] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff pref]
[    2.596875] BAR0 at slot 0 = 0
[    2.602888] bus=0x0, slot = 0x0
[    2.609129] BAR0 at slot 1 = 0
[    2.615156] bus=0x0, slot = 0x1
[    2.621400] bus=0x1, slot = 0x0, irq=0xff
[    2.629339] bus=0x2, slot = 0x1, irq=0xff
[    2.638609] clocksource: Switched to clocksource GIC
[    2.662631] NET: Registered protocol family 2
[    2.671963] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    2.685700] TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
[    2.698305] TCP: Hash tables configured (established 1024 bind 1024)
[    2.710996] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    2.722515] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    2.735232] NET: Registered protocol family 1
[    2.978548] 4 CPUs re-calibrate udelay(lpj = 2924544)
[    2.990004] Crashlog allocated RAM at address 0x3f00000
[    3.009631] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    3.021136] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    3.043090] io scheduler noop registered
[    3.050771] io scheduler deadline registered (default)
[    3.061470] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    3.075025] console [ttyS0] disabled
[    3.082055] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 33, base_baud = 3125000) is a 16550A
[    3.100023] console [ttyS0] enabled
[    3.100023] console [ttyS0] enabled
[    3.113789] bootconsole [early0] disabled
[    3.113789] bootconsole [early0] disabled
[    3.130860] MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
[    3.145098] spi-mt7621 1e000b00.spi: sys_freq: 50000000
[    3.156410] m25p80 spi32766.0: using chunked io (size=32)
[    3.167219] m25p80 spi32766.0: w25q128 (16384 Kbytes)
[    3.177317] 5 ofpart partitions found on MTD device spi32766.0
[    3.188926] Creating 5 MTD partitions on "spi32766.0":
[    3.199171] 0x000000000000-0x000000030000 : "u-boot"
[    3.210390] 0x000000030000-0x000000040000 : "u-boot-env"
[    3.222248] 0x000000040000-0x000000050000 : "factory"
[    3.233513] 0x000000050000-0x000000e30000 : "firmware"
[    3.267407] 2 uimage-fw partitions found on MTD device firmware
[    3.279295] 0x000000050000-0x0000001e6cfb : "kernel"
[    3.290384] 0x0000001e6cfb-0x000000e30000 : "rootfs"
[    3.301453] mtd: device 5 (rootfs) set to be root filesystem
[    3.312824] 1 squashfs-split partitions found on MTD device rootfs
[    3.325146] 0x000000bd0000-0x000000e30000 : "rootfs_data"
[    3.337251] 0x000000e30000-0x000001000000 : "recovery"
[    3.349616] netif_napi_add() called with weight 128 on device eth%d
[    3.430637] libphy: mdio: probed
[    4.836598] mtk_soc_eth 1e100000.ethernet: loaded mt7530 driver
[    4.849117] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 10
[    4.866612] mt7621_wdt 1e000100.wdt: Initialized
[    4.877349] NET: Registered protocol family 10
[    4.887551] NET: Registered protocol family 17
[    4.896504] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    4.921617] 8021q: 802.1Q VLAN Support v1.8
[    4.932415] hctosys: unable to open rtc device (rtc0)
[    4.949307] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    4.964021] Freeing unused kernel memory: 260K (8050f000 - 80550000)
[    5.174177] random: nonblocking pool is initialized
[    7.051975] init: Console is alive
[    7.059015] init: - watchdog -
[    8.524335] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    8.614075] usbcore: registered new interface driver usbfs
[    8.625162] usbcore: registered new interface driver hub
[    8.635905] usbcore: registered new device driver usb
[    8.656117] xhci-mtk 1e1c0000.xhci: xHCI Host Controller
[    8.666792] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus number 1
[    8.688762] xhci-mtk 1e1c0000.xhci: hcc params 0x01401198 hci version 0x96 quirks 0x00210010
[    8.705646] xhci-mtk 1e1c0000.xhci: irq 29, io mem 0x1e1c0000
[    8.718102] hub 1-0:1.0: USB hub found
[    8.725694] hub 1-0:1.0: 2 ports detected
[    8.734128] xhci-mtk 1e1c0000.xhci: xHCI Host Controller
[    8.744722] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus number 2
[    8.759782] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    8.776748] hub 2-0:1.0: USB hub found
[    8.784305] hub 2-0:1.0: 1 port detected
[    8.794372] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    8.818912] init: - preinit -
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   12.352110] mount_root: loading kmods from internal overlay
[   12.390771] kmodloader: loading kernel modules from //etc/modules-boot.d/*
[   12.407453] kmodloader: done loading kernel modules from //etc/modules-boot.d/*
[   12.849461] jffs2: notice: (404) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   12.880767] block: attempting to load /tmp/jffs_cfg/upper/etc/config/fstab
[   12.900496] block: extroot: not configured
[   13.021220] jffs2: notice: (401) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   13.326360] block: attempting to load /tmp/jffs_cfg/upper/etc/config/fstab
[   13.345033] block: extroot: not configured
[   13.379941] mount_root: switching to jffs2 overlay
[   13.399826] urandom-seed: Seeding with /etc/urandom.seed
[   13.510439] procd: - early -
[   13.516310] procd: - watchdog -
Failed to connect to ubus
[   14.188959] procd: - watchdog -
[   14.195670] procd: - ubus -
[   14.616007] procd: - init -
[   14.953033] kmodloader: loading kernel modules from /etc/modules.d/*
[   14.967337] Loading modules backported from Linux version wt-2017-01-31-0-ge882dff19e7f
[   14.983308] Backport generated by backports.git backports-20160324-13-g24da7d3c
[   15.078207] mt76x2e 0000:01:00.0: ASIC revision: 76120044
[   15.108627] mt76x2e 0000:01:00.0: ROM patch already applied
[   15.188331] mt76x2e 0000:01:00.0: Firmware Version: 0.0.00
[   15.199319] mt76x2e 0000:01:00.0: Build: 1
[   15.207457] mt76x2e 0000:01:00.0: Build Time: 201507311614____
[   15.238614] mt76x2e 0000:01:00.0: Firmware running!
[   15.253364] mt76x2e 0000:02:00.0: ASIC revision: 76020044
[   15.288691] mt76x2e 0000:02:00.0: ROM patch already applied
[   15.300815] mt76x2e 0000:02:00.0: Firmware Version: 0.0.00
[   15.311796] mt76x2e 0000:02:00.0: Build: 1
[   15.319977] mt76x2e 0000:02:00.0: Build Time: 201507311614____
[   15.348679] mt76x2e 0000:02:00.0: Firmware running!
[   15.363702] kmodloader: done loading kernel modules from /etc/modules.d/*

mateusz-plociennik · December 4, 2023, 3:49am

I meant to check your RX connection once again. You definitely have hooked device TX correctly, because you can dump bootlog, but maybe RX is not? AFAIR the device replays what it got, so when you hit "f", you should receive "f" printed on the console. If that is not happening you might have issues with your serial adapter. You can short TX and RX lines on the adapter and see if the data you send is looped back.

BJReplay · December 4, 2023, 3:53am

Thanks!

And thanks for the hint re RX.

That's basically what mine did too, from memory (it's in a box now, but I should dig it out).

Can I ask you how you got it into TFTP mode?

I can't see the prompt for f for failsafe in your dump - when did you hit that to get it into TFTP mode, or did you simply hit 2 on another boot cycle at the prompt?

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP.

mateusz-plociennik · December 4, 2023, 3:57am

Sure, I hit 2 while in bootloader and followed the recovery mode as described in ToH: https://openwrt.org/toh/samknows/sk-wb8#debricking

BJReplay · December 4, 2023, 4:59am

Thanks. I've definitely got it responding - but the first 2 that the terminal shows is about five seconds after powering up. My bootlog is almost identical to yours, except for timestamps.

Timing and DQS calibration came up with different values, unsuprisingly.

===================================================================
                MT7621   stage1 code Mar 12 2015 14:43:30 (ASIC)
                CPU=500000000 HZ BUS=125000000 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x31100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-800Mhz ===
PLL2 FB_DL: 0x0, 1/0 = 524/500 01000000
PLL3 FB_DL: 0x4, 1/0 = 663/361 11000000
PLL4 FB_DL: 0xf, 1/0 = 523/501 3D000000
do DDR setting..[01F40000]
Apply DDR2 Setting...(use customer AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
      --------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    1    1    1    1
0007:|    0    0    0    0    0    1    1    1    1    1    1    1    1    1    1    1
0008:|    1    1    1    1    1    1    1    1    1    1    1    0    0    0    0    0
0009:|    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0010:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0011:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
DRAMC_DQSCTL1[0e0]=1A000000
DRAMC_DQSGCTL[124]=80000000
rank 0 coarse = 8
rank 0 fine = 40
B:|    0    0    0    0    0    1    1    1    0    0    0    0    0    0    0    0
opt_dle value:6
DRAMC_DDR2CTL[07c]=40001263
DRAMC_PADCTL4[0e4]=00000005
DRAMC_DQIDLY1[210]=0B09090A
DRAMC_DQIDLY2[214]=06080707
DRAMC_DQIDLY3[218]=0A080906
DRAMC_DQIDLY4[21c]=09060908
DRAMC_R0DELDLY[018]=00002929
==================================================================
                RX      DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    9 8 9 11 7 7 6 6 6 7
10 |    8 9 7 9 6 7
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =41 DQS1 = 41
==================================================================
bit     DQS0     bit      DQS1
0  (1~80)40  8  (1~82)41
1  (1~80)40  9  (0~78)39
2  (1~81)41  10  (1~81)41
3  (1~81)41  11  (1~80)40
4  (1~81)41  12  (1~79)40
5  (2~81)41  13  (1~81)41
6  (0~79)39  14  (1~81)41
7  (1~81)41  15  (0~79)39
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    10 9 9 11 7 7 8 6 6 9
10 |    8 10 8 9 6 9
==================================================================
==================================================================
     TX  perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2
DQ loop=15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
DRAMC_DQODLY1[200]=88888888
DRAMC_DQODLY2[204]=88888888
20,data:88
[EMI] DRAMC calibration passed

BJReplay · December 4, 2023, 7:54am

One last question, if I may (and thanks again for your help so far):

In your bootlog, I can see what looks like the last digit of a countdown (the 0).

 ##### The CPU freq = 880 MHZ #### 
 estimate memory size =128 Mbytes
#Reset_MT7530

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP. 
 0

In my bootlog, I can't see a countdown after the menu to choose an option that is described in the main ToH:

#Reset_MT7530

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.

bootcount: 0

3: System Boot system code via Flash.
Erasing SPI Flash...
.
Writing to SPI Flash...
.
done

I think that's always been my problem (and the problem others have faced) - the firmware seems to ignore input in the bootloader stage, it immediately jumps to option 3 boot via flash.

Even if I power on the device with my finger on the 2 key, the first 2 doesn't appear on the console until

[    7.024476] init: Console is alive