Cześć,
W tym wątku chciałbym rozmawiać wyłącznie o nowych routerach Xiaomi AX3000T z pamięcią Winbond W25N01KVZEIR.
Chciałem przywrócić router do oryginalnego zbackupowanego softu i skończyło się to permanentnym zbrickowaniem urządzenia - dioda led nie świeci. Router rozkręcony, podłączenie pod UART. Przy włączeniu printowany jest błąd:
\n\rF0: 102B 0000\n\rFA: 1040 0000\n\rFA: 1040 0000 [0200]\n\rF9: 3903 0041\n\rF3: 1001 0000 [0200]\n\rF3: 1001 0000\n\rF6: 102C 0000\n\rF5: 480A 0031\n\r00: 1005 0000\n\rFA: 1040 0000\n\rFA: 1040 0000 [0200]\n\rF9: 3903 0041\n\rF3: 1001 0000 [0200]\n\rF3: 1001 0000\n\rF6: 102C 0000\n\r01: 102A 0001\n\r02: 1005 0000\n\rBP: 2000 00C0 [0001]\n\rEC: 0000 0000 [1000]\n\rT0: 0000 00ED [010F]\n\rSystem halt!\n\r\n\r
Próby przywrócenia routera używając mtk_uartboot jest udana:
mkt % ./mtk_uartboot -s /dev/tty.usbserial-XXXX --aarch64 -p bl2-mt7981-bga-ddr3-ram.bin -f openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip
mtk_uartboot - 0.1.1
Using serial port: /dev/tty.usbserial-XXXX
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0x8f29
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE: BL2: v2.10.0 (release):v2.10.0-mtk
NOTICE: BL2: Built : 13:17:06, Mar 1 2024
NOTICE: WDT: Cold boot
NOTICE: WDT: disabled
NOTICE: EMI: Using DDR3 settings
NOTICE: EMI: Detected DRAM size: 256MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: CPU: MT7981 (1300MHz)
NOTICE: Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE: Received FIP 0xbc351 @ 0x40400000 ...
==================================
Router wczytuje się z RAM i próbuje dalej wykonać update przez TFTP (dioda świeci na niebiesko).
Po uart printowana informacja ze poszukuje pliku openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb na adresie 192.168.1.254.
ARP Retry count exceeded; starting again
Wrong Image Type for bootm command
ERROR -91: can’t get kernel image!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename ‚openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb’.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
Load address: 0x46000000
Loading: *
Niestety po Ethernecie nie da się połączyć (całkowicie skasowana pamięć i nie fizycznie nie potrafi użyć Ethernetu?) więc TFTP nic nie prześle.
sudo dnsmasq --no-daemon --listen-address=192.168.1.254 --bind-interfaces --dhcp-range=192.168.1.2,192.168.1.254 --enable-tftp --tftp-root=. --log-dhcp --log-facility=-
Z trybu wgrywania po TFTP można wyjść wysyłając CTRL+C.
Dostępne są polecenia:
MT7981> help
? - alias for ‚help’
askenv - get environment variables from stdin
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run ‚bootcmd’
bootd - boot default, i.e., run ‚bootcmd’
bootelf - Boot from an ELF image in memory
booti - boot Linux kernel ‚Image’ format from memory
bootm - boot application image from memory
bootmenu - ANSI terminal bootmenu
bootp - boot image via network using BOOTP/TFTP protocol
bootvx - Boot vxWorks from an ELF image
button - manage buttons
cdp - Perform CDP network configuration
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
cpu - display information about CPUs
crc32 - checksum calculation
dcache - enable or disable data cache
dhcp - boot image via network using DHCP/TFTP protocol
dm - Driver model low level access
dns - lookup the IP of a hostname
echo - echo args to console
editenv - edit environment variable
env - environment handling commands
eraseenv - erase environment variables from persistent storage
exit - exit script
false - do nothing, unsuccessfully
fdt - flattened device tree utility commands
go - start application at address ‚addr’
gpio - query and control gpio pins
gpt - GUID Partition Table
guid - GUID - generate Globally Unique Identifier based on random UUID
gzwrite - unzip and write memory to block device
hash - compute hash message digest
help - print command description/usage
icache - enable or disable instruction cache
iminfo - print header information for application image
imsz - get image total size (in bytes)
imszb - get image total size (in blocks)
imxtract - extract a part of a multi-image
itest - return true/false on integer compare
led - manage LEDs
license - print GPL license text
linklocal - acquire a network IP address using the link-local protocol
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loadx - load binary file over serial line (xmodem mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
lzmadec - lzma uncompress a memory region
md - memory display
mm - memory modify (auto-incrementing address)
mtd - MTD utils
mw - memory write (fill)
nand - NAND utility
net - NET sub-system
nm - memory modify (constant address)
panic - Panic with optional message
part - disk partition related commands
ping - send ICMP ECHO_REQUEST to network host
pinmux - show pin-controller muxing
printenv - print environment variables
pstore - Manage Linux Persistent Storage
pxe - get and boot from pxe files
random - fill memory with random pattern
rarpboot - boot image via network using RARP/TFTP protocol
readmem - get environment variable from memory address
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
setexpr - set environment variable as the result of eval expression
showvar - print local hushshell variables
sleep - delay execution for some time
smc - Issue a Secure Monitor Call
sntp - synchronize RTC via network
source - run script from memory
strings - display strings
test - minimal test like /bin/sh
tftpboot - load file via network using TFTP protocol
tftpsrv - act as a TFTP server and boot the first received file
true - do nothing, successfully
ubi - ubi commands
ubifsload - load file from an UBIFS filesystem
ubifsls - list files in a directory
ubifsmount- mount UBIFS volume
ubifsumount- unmount UBIFS volume
unlz4 - lz4 uncompress a memory region
unzip - unzip a memory region
uuid - UUID - generate random Universally Unique Identifier
version - print monitor, compiler and linker version
Skoro TFTP nie działa to próba wgrania softu przez UART:
MT7981> loady 0x46000000
## Ready for binary (ymodem) download to 0x46000000 at 115200 bps…
C
sz --ymodem openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-preloader.bin < /dev/cu.usbserial > /dev/cu.usbserial
Sending: openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-preloader.bin
Bytes Sent: 226176 BPS:6275
Sending:
Ymodem sectors/kbytes sent: 0/ 0k
Transfer complete
Wgranie udane:
MT7981> md 0x46000000
46000000: 4e495053 21444e41 00000001 00000010 SPINAND!……..
46000010: 00000800 00000040 000c0040 30200000 ….@…@….. 0
46000020: 00000001 000000ff 00000000 00000000 …………….
46000030: 00000000 00000000 00000000 00000000 …………….
46000040: 00000000 00000000 00000000 5e9a0000 ……………^
Wylistowanie adresów:
> mtd list
List of MTD devices:
* spi-nand0
- device: spi_nand@0
- parent: spi@1100a000
- driver: spi_nand
- path: /spi@1100a000/spi_nand@0
- type: NAND flash
- block size: 0x20000 bytes
- min I/O: 0x800 bytes
- OOB size: 64 bytes
- OOB available: 56 bytes
- 0x000000000000-0x000008000000 : „spi-nand0”
- 0x000000000000-0x000000100000 : „bl2”
- 0x000000100000-0x000000140000 : „Nvram”
- 0x000000140000-0x000000180000 : „Bdata”
- 0x000000180000-0x000000380000 : „factory”
- 0x000000380000-0x000000580000 : „fip”
- 0x000000580000-0x0000005c0000 : „crash”
- 0x0000005c0000-0x000000600000 : „crash_log”
- 0x000000600000-0x000007600000 : „ubi”
- 0x000007600000-0x000007640000 : „KF”
Próba wpisania danych na adres BL2 jest nieudana. Nie ma potwierdzenia. Sprawdzając dane uzywając md, są tam głupoty:
> cp.b 0x46000000 0x000000 0x100000
> md 0x000000
00000000: ea000008 eafffffe eafffffe eafffffe ................
00000010: eafffffe eafffffe eafffffe eafffffe ................
00000020: bbbbbbbb 10400038 e3a00000 e3a01000 ....8.@.........
00000030: e3a02000 e3a03000 e3a04000 e3a05000 . ...0...@...P..
00000040: e3a06000 e3a07000 e3a08000 e3a09000 .`...p..........
00000050: e3a0a000 e3a0b000 e3a0c000 e1a0d00c ................
00000060: e3a0e000 e320f000 e320f000 e320f000 ...... ... ... .
00000070: e320f000 e320f000 e320f000 e320f000 .. ... ... ... .
00000080: e320f000 eb00425c e10f0000 e3a010c0 .. .\B..........
00000090: e1800001 e12ff000 e59f20b4 e5922000 ....../.. ... ..
000000a0: e59f30b0 e5933000 e2431008 e1a0d001 .0...0....C.....
000000b0: e3a00001 eb00003c eb004267 fa0002a2 ....<...gB......
000000c0: eb0025a9 fa003135 e1a0e000 e1a04001 .%..51.......@..
000000d0: e1a05002 e59f307c e5933000 e2431008 .P..|0...0....C.
000000e0: e1a0d001 e59f0070 e5900000 e1a01000 ....p...........
000000f0: e1a02000 e1a03000 e3a06000 e3a07000 . ...0...`...p..
Skacząc md po pamięci wszystkie adresy partycji od Nvram są puste. Wygląda jakby nic nie działało.
Ostateczna próba załadowania z ram z wgranego pliku kończy się crashem i powrotem do punktu wyjścia:
MT7981> bootm 0x46000000
Wrong Image Type for bootm command
ERROR -91: can't get kernel image!
MT7981> go 0x46000000
## Starting application at 0x46000000 ...
"Synchronous Abort" handler, esr 0x02000000
elr: 0000000037ed0000 lr : 0000000041e09cd4 (reloc)
elr: 0000000046000000 lr : 000000004ff39cd4
x0 : 0000000000000001 x1 : 000000004fb58098
x2 : 000000004fb58098 x3 : 0000000046000000
x4 : 0000000000000000 x5 : 000000004f7ff655
x6 : 0000000000000030 x7 : 000000004f7ffae0
x8 : 0000000000000010 x9 : 00000000ffffffd0
x10: 000000000000000d x11: 0000000000000006
x12: 000000004f7ff988 x13: 0000000041e983e0
x14: 0000000000000008 x15: 000000004f7ff655
x16: 0000000046000000 x17: 0000000000000000
x18: 000000004f7ffda0 x19: 000000004fb58098
x20: 0000000046000000 x21: 0000000000000002
x22: 000000004fb58090 x23: 0000000000000002
x24: 000000004ffead04 x25: 0000000000000000
x26: 0000000000000000 x27: 0000000000000000
x28: 000000004fb57020 x29: 000000004f7ffae0
Code: 5571d540 5d525171 457d1556 3c45775d (4e495053)
Resetting CPU ...