Help me please to understand mtd command
For study purposes, I trying to reinstall openwrt using mtd command.
I already read about MTD and flash layout.
Understud that it's not a block and not a character device.
But behave mostly like block device but requered erase operation.
I have many TP-Link devices, but now to study use TP-Link WR-1043N HW ver. 5.0
root@OpenWrt:/# cat /proc/mtd
dev: size erasesize name
mtd0: 00020000 00010000 "factory-uboot"
mtd1: 00020000 00010000 "u-boot"
mtd2: 00ec0000 00010000 "firmware"
mtd3: 00180000 00010000 "kernel"
mtd4: 00d40000 00010000 "rootfs"
mtd5: 00b10000 00010000 "rootfs_data"
mtd6: 00020000 00010000 "product-info"
mtd7: 000a0000 00010000 "config"
mtd8: 00010000 00010000 "partition-table"
mtd9: 00020000 00010000 "logs"
mtd10: 00010000 00010000 "art"
From UART boot log:
[ 0.551941] 8 cmdlinepart partitions found on MTD device spi0.0
[ 0.558051] Creating 8 MTD partitions on "spi0.0":
[ 0.563021] 0x000000000000-0x000000020000 : "factory-uboot"
[ 0.569969] 0x000000020000-0x000000040000 : "u-boot"
[ 0.576462] 0x000000040000-0x000000f00000 : "firmware"
[ 0.607347] 2 uimage-fw partitions found on MTD device firmware
[ 0.613506] 0x000000040000-0x0000001c0000 : "kernel"
[ 0.619735] 0x0000001c0000-0x000000f00000 : "rootfs"
[ 0.626228] mtd: device 4 (rootfs) set to be root filesystem
[ 0.632159] 1 squashfs-split partitions found on MTD device rootfs
[ 0.638549] 0x0000003f0000-0x000000f00000 : "rootfs_data"
[ 0.645439] 0x000000f00000-0x000000f20000 : "product-info"
[ 0.652473] 0x000000f20000-0x000000fc0000 : "config"
[ 0.658898] 0x000000fc0000-0x000000fd0000 : "partition-table"
[ 0.666209] 0x000000fd0000-0x000000ff0000 : "logs"
[ 0.672495] 0x000000ff0000-0x000001000000 : "art"
But this command make my device in a brick:
mtd -r write /tmp/openwrt-18.06.0-ar71xx-generic-tl-wr1043n-v5-squashfs-factory.bin firmware
In UART console output:
...
## Booting image at 9f040000 ...
Bad Magic Number
ath>
Now I restore device using TFTP.
binwalk openwrt-18.06.0-ar71xx-generic-tl-wr1043n-v5-squashfs-factory.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
8387 0x20C3 uImage header, header size: 64 bytes, header CRC: 0x3D4019D4, created: 2018-07-30 16:25:17, image size: 1366635 bytes, Data Address: 0x80060000, Entry Point: 0x80060000, data CRC: 0x2CFF486F, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt Linux-4.9.111"
8451 0x2103 LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 4355724 bytes
1375086 0x14FB6E Squashfs filesystem, little endian, version 4.0, compression:xz, size: 2278574 bytes, 1134 inodes, blocksize: 262144 bytes, created: 2018-07-30 16:25:17
As I understood 'decimal 8387' is offset in bin file where uImage is begin, am I right?
Trying to skip first 8386, minus one from offset:
tail -c +8386 openwrt-18.06.0-ar71xx-generic-tl-wr1043n-v5-squashfs-factory.bin>firmware.bin
And now:
mtd -r write /tmp/firmware.bin firmware
The same result in UART console:
...
## Booting image at 9f040000 ...
Bad Magic Number
ath>
Where is my mistake?