Modify

Opened 2 years ago

Last modified 18 months ago

#20982 new defect

jffs2-error / nanostation M5 xw / r47658

Reported by: bittorf@… Owned by: developers
Priority: normal Milestone:
Component: packages Version: Trunk
Keywords: Cc:

Description

i have 4 new devices here, after flashing with factory-image (build was done executing 'make clean; make') and even after sysupgrading i see these lines in dmesg/klog and cannot persistent safe anything:

jffs2-error / [   62.971900] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0 [   62.979006] jffs2_build_filesystem(): unlocking the mtd device... done. [   62.985758] jffs2_build_filesystem(): erasing all blocks after the end marker...  [   63.013822] jffs2: Newly-erased block contained word 0x19852003 at offset 0x002b0000 [   63.023540] jffs2: Newly-erased block contained word 0x19852003 at offset 0x002a0000 [   63.033414] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00290000 [   63.042948] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00280000 [   63.052457] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00270000 [   63.073839] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00260000 [   63.083354] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00250000 [   63.103857] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00240000 [   63.113378] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00230000 [   63.123164] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00220000 [   63.132697] jffs2: Newly-erased block contained word 0x0 at offset 0x00210000 [   63.141558] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x00200000 [   63.173880] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x001f0000 [   63.183418] jffs2: Newly-erased block contained word 0x46 at offset 0x001e0000 [   63.192685] jffs2: Newly-erased block contained word 0xcaedce37 at offset 0x001d0000 [   63.202219] jffs2: Newly-erased block contained word 0xc347704f at offset 0x001c0000 [   63.223840] jffs2: Newly-erased block contained word 0x1d1920ac at offset 0x001b0000 [   63.233366] jffs2: Newly-erased block contained word 0xa40fb0fb at offset 0x001a0000 [   63.243188] jffs2: Newly-erased block contained word 0x3660cd82 at offset 0x00190000 [   63.252723] jffs2: Newly-erased block contained word 0x72fec1bb at offset 0x00180000 [   63.262232] jffs2: Newly-erased block contained word 0x6c69ae0f at offset 0x00170000 [   63.293852] jffs2: Newly-erased block contained word 0xe793bd5e at offset 0x00160000 [   63.303384] jffs2: Newly-erased block contained word 0xa0c57928 at offset 0x00150000 [   63.313186] jffs2: Newly-erased block contained word 0xe97bea46 at offset 0x00140000 [   63.322716] jffs2: Newly-erased block contained word 0x6f959d1a at offset 0x00130000 [   63.332219] jffs2: Newly-erased block contained word 0x3c8d9e58 at offset 0x00120000 [   63.353837] jffs2: Newly-erased block contained word 0x7e0c5020 at offset 0x00110000 [   63.363351] jffs2: Newly-erased block contained word 0x5ca0590e at offset 0x00100000 [   63.383862] jffs2: Newly-erased block contained word 0x5d6fc542 at offset 0x000f0000 [   63.393386] jffs2: Newly-erased block contained word 0x7421b52d at offset 0x000e0000 [   63.403175] jffs2: Newly-erased block contained word 0x549c7d74 at offset 0x000d0000 [   63.412713] jffs2: Newly-erased block contained word 0xf9ee8e53 at offset 0x000c0000 [   63.422217] jffs2: Newly-erased block contained word 0xb01b9a7f at offset 0x000b0000 [   63.434177] jffs2: Newly-erased block contained word 0xb1778c87 at offset 0x000a0000 [   63.443712] jffs2: Newly-erased block contained word 0xe6e855c0 at offset 0x00090000 [   63.453487] jffs2: Newly-erased block contained word 0xe9395666 at offset 0x00080000 [   63.473805] jffs2: Newly-erased block contained word 0x71dc97f5 at offset 0x00070000 [   63.483310] jffs2: Newly-erased block contained word 0x8db4d5dd at offset 0x00060000 [   63.503854] jffs2: Newly-erased block contained word 0x7d067c92 at offset 0x00050000 [   63.513379] jffs2: Newly-erased block contained word 0xa6cd63ac at offset 0x00040000 [   63.523172] jffs2: Newly-erased block contained word 0xc22a2438 at offset 0x00030000 [   63.543874] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x00020000 [   63.607132] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x00000000 [   63.622355] done. [   63.624345] jffs2: notice: (1787) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [   71.392222] random: nonblocking pool is initialized
root@OpenWrt:~ df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 3.4M      3.4M         0 100% /rom
tmpfs                    29.7M    328.0K     29.4M   1% /tmp
tmpfs                    29.7M     72.0K     29.6M   0% /tmp/root
overlayfs:/tmp/root      29.7M     72.0K     29.6M   0% /
tmpfs                   512.0K         0    512.0K   0% /dev
/dev/mtdblock5            2.8M      2.8M         0 100% /rom/overlay

Attachments (0)

Change History (41)

comment:1 Changed 2 years ago by bittorf@…

i must add, that this is a 'Ubiquiti Nanostation Loco M5 XW'. Now i tried all variants if TFTP, but it always refuses after fileend with:

`
sent DATA <block: 6653, size: 512>
tftp: error received from server <Firmware check failed>
tftp: aborting
`

so maybe this is a new variant of the Loco XW?

comment:2 Changed 2 years ago by bittorf@…

here the full klog:

[    0.000000] Linux version 4.1.11 (bastian@gcc20) (gcc version 5.2.0 (OpenWrt GCC 5.2.0 r47492) ) #25 Thu Nov 26 14:31:10 CET 2015
[    0.000000] MyLoader: sysp=76bfabfb, boardp=23d35171, parts=d731bd75
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[    0.000000] SoC: Atheros AR9342 rev 2
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] On node 0 totalpages: 16384
[    0.000000] free_area_init_node: node 0, pgdat 803b7de0, node_mem_map 81000000
[    0.000000]   Normal zone: 128 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16384 pages, LIFO batch:3
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  board=UBNT-LOCO-XW mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,7552k(firmware),256k(cfg)ro,64k(EEPROM)ro  oops=panic panic=10  console=ttyS0,115200 rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 60556K/65536K available (2812K kernel code, 133K rwdata, 576K rodata, 244K init, 195K bss, 4980K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:83
[    0.000000] Clocks: CPU:535.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:40.000MHz
[    0.000000] clocksource MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7144898866 ns
[    0.000010] sched_clock: 32 bits at 267MHz, resolution 3ns, wraps every 8027976190ns
[    0.007510] Calibrating delay loop... 266.64 BogoMIPS (lpj=1333248)
[    0.090021] pid_max: default: 32768 minimum: 301
[    0.094606] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.100944] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.110832] clocksource jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.120983] NET: Registered protocol family 16
[    0.126740] MIPS: machine is Ubiquiti Loco M XW
[    0.362154] Switched to clocksource MIPS
[    0.367352] NET: Registered protocol family 2
[    0.372591] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.379279] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.385460] TCP: Hash tables configured (established 1024 bind 1024)
[    0.391632] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.397258] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.403603] NET: Registered protocol family 1
[    0.407833] PCI: CLS 0 bytes, default 32
[    0.409007] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.434052] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.439637] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.452437] io scheduler noop registered
[    0.456175] io scheduler deadline registered (default)
[    0.461363] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.468004] console [ttyS0] disabled
[    0.491498] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 2500000) is a 16550A
[    0.499787] console [ttyS0] enabled
[    0.506810] bootconsole [early0] disabled
[    0.518041] m25p80 spi0.0: found mx25l6405d, expected m25p80
[    0.523877] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    0.528849] 5 cmdlinepart partitions found on MTD device spi0.0
[    0.534865] Creating 5 MTD partitions on "spi0.0":
[    0.539733] 0x000000000000-0x000000040000 : "u-boot"
[    0.545792] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.552075] 0x000000050000-0x0000007b0000 : "firmware"
[    0.570846] 2 uimage-fw partitions found on MTD device firmware
[    0.576908] 0x000000050000-0x000000190000 : "kernel"
[    0.582920] 0x000000190000-0x0000007b0000 : "rootfs"
[    0.588817] mtd: device 4 (rootfs) set to be root filesystem
[    0.594668] 1 squashfs-split partitions found on MTD device rootfs
[    0.600949] 0x0000004f0000-0x0000007b0000 : "rootfs_data"
[    0.607387] 0x0000007b0000-0x0000007f0000 : "cfg"
[    0.613134] 0x0000007f0000-0x000000800000 : "EEPROM"
[    0.630677] libphy: ag71xx_mdio: probed
[    1.223698] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:01 [uid=004dd023, driver=Generic PHY]
[    1.233763] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[    1.242113] NET: Registered protocol family 10
[    1.250666] NET: Registered protocol family 17
[    1.255347] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    1.268342] 8021q: 802.1Q VLAN Support v1.8
[    1.279315] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    1.288158] Freeing unused kernel memory: 244K (803d3000 - 80410000)
[    2.106555] init: Console is alive
[    2.110277] init: - watchdog -
[    3.594823] usbcore: registered new interface driver usbfs
[    3.600488] usbcore: registered new interface driver hub
[    3.606067] usbcore: registered new device driver usb
[    3.701612] SCSI subsystem initialized
[    3.712517] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    3.720795] ehci-platform: EHCI generic platform driver
[    3.729471] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    3.737252] ohci-platform: OHCI generic platform driver
[    3.747594] usbcore: registered new interface driver usb-storage
[    4.120219] init: - preinit -
[    4.408619] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    4.438614] random: procd urandom read with 6 bits of entropy available
[    6.609107] mount_root: loading kmods from internal overlay
[    6.857541] block: attempting to load /etc/config/fstab
[    6.865269] block: unable to load configuration (fstab: Entry not found)
[    6.872284] block: no usable configuration
[    6.877212] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    6.932024] procd: - early -
[    6.935822] procd: - watchdog -
[    7.565383] procd: - ubus -
[    8.603874] procd: - init -
[    9.143880] zram: Unknown symbol lz4_compress (err 0)
[    9.149114] zram: Unknown symbol lz4_decompress_unknownoutputsize (err 0)
[   13.925623] zram: Created 1 device(s)
[   13.963198] tun: Universal TUN/TAP device driver, 1.6
[   13.968333] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[   14.002408] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   14.055957] u32 classifier
[   14.058715]     input device check on
[   14.062487]     Actions configured
[   14.088903] Mirror/redirect action on
[   14.167818] Loading modules backported from Linux version master-2015-10-26-0-g28c26cb
[   14.175937] Backport generated by backports.git backports-20150903-4-g12cf266
[   14.207588] ip_tables: (C) 2000-2006 Netfilter Core Team
[   14.255881] nf_conntrack version 0.5.0 (950 buckets, 3800 max)
[   14.319677] usbcore: registered new interface driver ums-alauda
[   14.343987] usbcore: registered new interface driver ums-cypress
[   14.358588] usbcore: registered new interface driver ums-datafab
[   14.373105] usbcore: registered new interface driver ums-freecom
[   14.398514] usbcore: registered new interface driver ums-isd200
[   14.425820] usbcore: registered new interface driver ums-jumpshot
[   14.442636] usbcore: registered new interface driver ums-karma
[   14.457385] usbcore: registered new interface driver ums-sddr09
[   14.472368] usbcore: registered new interface driver ums-sddr55
[   14.483551] usbcore: registered new interface driver ums-usbat
[   14.529318] xt_time: kernel timezone is -0000
[   14.560667] cfg80211: World regulatory domain updated:
[   14.565950] cfg80211:  DFS Master region: unset
[   14.570367] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   14.580285] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   14.588422] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   14.596551] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   14.604686] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (N/A)
[   14.614313] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)
[   14.623938] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   14.632156] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   14.640277] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   14.778129] PPP generic driver version 2.4.2
[   14.785829] NET: Registered protocol family 24
[   14.898056] ath: EEPROM regdomain: 0x0
[   14.898081] ath: EEPROM indicates default country code should be used
[   14.898091] ath: doing EEPROM country->regdmn map search
[   14.898114] ath: country maps to regdmn code: 0x3a
[   14.898126] ath: Country alpha2 being used: US
[   14.898136] ath: Regpair used: 0x3a
[   14.910712] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[   14.914643] ieee80211 phy0: Atheros AR9340 Rev:2 mem=0xb8100000, irq=47
[   14.924578] cfg80211: Regulatory domain changed to country: US
[   14.930516] cfg80211:  DFS Master region: FCC
[   14.934816] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   14.944723] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 3000 mBm), (N/A)
[   14.952857] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2300 mBm), (N/A)
[   14.962485] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2300 mBm), (0 s)
[   14.972099] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2300 mBm), (0 s)
[   14.980326] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 3000 mBm), (N/A)
[   14.988462] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 4000 mBm), (N/A)
[   18.668844] zram0: detected capacity change from 0 to 30408704
[   18.686839] Adding 29692k swap on /dev/zram0.  Priority:0 extents:1 across:29692k SS
[   21.675606] device eth0 entered promiscuous mode
[   21.693250] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   22.243677] eth0: link up (100Mbps/Full duplex)
[   22.248337] br-lan: port 1(eth0) entered forwarding state
[   22.253897] br-lan: port 1(eth0) entered forwarding state
[   22.282233] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   24.252165] br-lan: port 1(eth0) entered forwarding state
[   61.932591] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   61.939623] jffs2_build_filesystem(): unlocking the mtd device... done.
[   61.946387] jffs2_build_filesystem(): erasing all blocks after the end marker... 
[   61.973819] jffs2: Newly-erased block contained word 0x19852003 at offset 0x002b0000
[   61.983539] jffs2: Newly-erased block contained word 0x19852003 at offset 0x002a0000
[   61.993416] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00290000
[   62.002954] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00280000
[   62.012465] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00270000
[   62.033826] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00260000
[   62.043343] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00250000
[   62.063854] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00240000
[   62.073390] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00230000
[   62.083199] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00220000
[   62.092717] jffs2: Newly-erased block contained word 0x0 at offset 0x00210000
[   62.113848] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x00200000
[   62.123377] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x001f0000
[   62.143833] jffs2: Newly-erased block contained word 0x46 at offset 0x001e0000
[   62.152833] jffs2: Newly-erased block contained word 0xcaedce37 at offset 0x001d0000
[   62.162633] jffs2: Newly-erased block contained word 0xc347704f at offset 0x001c0000
[   62.172116] jffs2: Newly-erased block contained word 0x1d1920ac at offset 0x001b0000
[   62.203856] jffs2: Newly-erased block contained word 0xa40fb0fb at offset 0x001a0000
[   62.213389] jffs2: Newly-erased block contained word 0x3660cd82 at offset 0x00190000
[   62.223203] jffs2: Newly-erased block contained word 0x72fec1bb at offset 0x00180000
[   62.232719] jffs2: Newly-erased block contained word 0x6c69ae0f at offset 0x00170000
[   62.254398] jffs2: Newly-erased block contained word 0xe793bd5e at offset 0x00160000
[   62.274007] jffs2: Newly-erased block contained word 0xa0c57928 at offset 0x00150000
[   62.283538] jffs2: Newly-erased block contained word 0xe97bea46 at offset 0x00140000
[   62.293322] jffs2: Newly-erased block contained word 0x6f959d1a at offset 0x00130000
[   62.302859] jffs2: Newly-erased block contained word 0x3c8d9e58 at offset 0x00120000
[   62.312368] jffs2: Newly-erased block contained word 0x7e0c5020 at offset 0x00110000
[   62.324157] jffs2: Newly-erased block contained word 0x5ca0590e at offset 0x00100000
[   62.333688] jffs2: Newly-erased block contained word 0x5d6fc542 at offset 0x000f0000
[   62.343467] jffs2: Newly-erased block contained word 0x7421b52d at offset 0x000e0000
[   62.363791] jffs2: Newly-erased block contained word 0x549c7d74 at offset 0x000d0000
[   62.373300] jffs2: Newly-erased block contained word 0xf9ee8e53 at offset 0x000c0000
[   62.393840] jffs2: Newly-erased block contained word 0xb01b9a7f at offset 0x000b0000
[   62.403364] jffs2: Newly-erased block contained word 0xb1778c87 at offset 0x000a0000
[   62.413158] jffs2: Newly-erased block contained word 0xe6e855c0 at offset 0x00090000
[   62.433792] jffs2: Newly-erased block contained word 0xe9395666 at offset 0x00080000
[   62.443299] jffs2: Newly-erased block contained word 0x71dc97f5 at offset 0x00070000
[   62.463838] jffs2: Newly-erased block contained word 0x8db4d5dd at offset 0x00060000
[   62.473361] jffs2: Newly-erased block contained word 0x7d067c92 at offset 0x00050000
[   62.483151] jffs2: Newly-erased block contained word 0xa6cd63ac at offset 0x00040000
[   62.503790] jffs2: Newly-erased block contained word 0xc22a2438 at offset 0x00030000
[   62.513293] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x00020000
[   62.585497] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x00000000
[   62.602358] done.
[   62.604353] jffs2: notice: (1780) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   72.482209] random: nonblocking pool is initialized

comment:3 Changed 2 years ago by bittorf@…

what is also interesting: sysupgrade does not work, it stop after the first write-symbol "[w]" and
reboots with the old firmware:

root@OpenWrt:~ sysupgrade -n -v /tmp/openwrt-15.05-ar71xx-generic-ubnt-loco-m-xw-squashfs-sysupgrade.bin 
killall: watchdog: no process killed
Sending TERM to remaining processes ... logd netifd odhcpd dnsmasq uhttpd crond sh apply_profile.w apply_profile sleep sleep ubusd askfirst 
Sending KILL to remaining processes ... askfirst 
Switching to ramdisk...
Performing system upgrade...
Unlocking firmware ...

Writing from <stdin> to firmware ...     
Upgrade completed
Rebooting system...

comment:4 Changed 2 years ago by bittorf@…

it's the same when flashing official openwrt-15.05-ar71xx-generic-ubnt-loco-m-xw-squashfs-factory.bin = 'CHAOS CALMER (15.05, r46767)', i tried several *new* devices:

[    0.000000] Linux version 3.18.20 (buildbot@builder1) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r46450) ) #1 Fri Sep 4 21:55:57 CEST 2015
[    0.000000] MyLoader: sysp=77331b33, boardp=a4031231, parts=f32fb342
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[    0.000000] SoC: Atheros AR9342 rev 2
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Initmem setup node 0 [mem 0x00000000-0x03ffffff]
[    0.000000] On node 0 totalpages: 16384
[    0.000000] free_area_init_node: node 0, pgdat 8034e2b0, node_mem_map 81000000
[    0.000000]   Normal zone: 128 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16384 pages, LIFO batch:3
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  board=UBNT-LOCO-XW console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,7552k(firmware),256k(cfg)ro,64k(EEPROM)ro rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 61004K/65536K available (2621K kernel code, 129K rwdata, 344K rodata, 224K init, 194K bss, 4532K reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Clocks: CPU:535.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:40.000MHz
[    0.000000] Calibrating delay loop... 266.64 BogoMIPS (lpj=1333248)
[    0.080000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.090000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.100000] NET: Registered protocol family 16
[    0.100000] MIPS: machine is Ubiquiti Loco M XW
[    0.330000] Switched to clocksource MIPS
[    0.340000] NET: Registered protocol family 2
[    0.340000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.340000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.350000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.350000] TCP: reno registered
[    0.360000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.360000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.370000] NET: Registered protocol family 1
[    0.370000] PCI: CLS 0 bytes, default 32
[    0.370000] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.390000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.390000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.400000] msgmni has been set to 119
[    0.410000] io scheduler noop registered
[    0.410000] io scheduler deadline registered (default)
[    0.420000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.430000] console [ttyS0] disabled
[    0.450000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 2500000) is a 16550A
[    0.460000] console [ttyS0] enabled
[    0.470000] bootconsole [early0] disabled
[    0.480000] m25p80 spi0.0: found mx25l6405d, expected m25p80
[    0.480000] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    0.490000] 5 cmdlinepart partitions found on MTD device spi0.0
[    0.490000] Creating 5 MTD partitions on "spi0.0":
[    0.500000] 0x000000000000-0x000000040000 : "u-boot"
[    0.500000] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.510000] 0x000000050000-0x0000007b0000 : "firmware"
[    0.540000] 2 uimage-fw partitions found on MTD device firmware
[    0.550000] 0x000000050000-0x00000015c35f : "kernel"
[    0.550000] 0x00000015c35f-0x0000007b0000 : "rootfs"
[    0.560000] mtd: device 4 (rootfs) set to be root filesystem
[    0.570000] 1 squashfs-split partitions found on MTD device rootfs
[    0.570000] 0x000000390000-0x0000007b0000 : "rootfs_data"
[    0.580000] 0x0000007b0000-0x0000007f0000 : "cfg"
[    0.580000] 0x0000007f0000-0x000000800000 : "EEPROM"
[    0.610000] libphy: ag71xx_mdio: probed
[    1.200000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:01 [uid=004dd023, driver=Generic PHY]
[    1.210000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[    1.210000] TCP: cubic registered
[    1.220000] NET: Registered protocol family 17
[    1.220000] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    1.230000] Bridge firewalling registered
[    1.240000] 8021q: 802.1Q VLAN Support v1.8
[    1.250000] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    1.260000] Freeing unused kernel memory: 224K (80368000 - 803a0000)
[    2.340000] init: Console is alive
[    2.350000] init: - watchdog -
[    3.660000] usbcore: registered new interface driver usbfs
[    3.670000] usbcore: registered new interface driver hub
[    3.670000] usbcore: registered new device driver usb
[    3.680000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    3.690000] ehci-platform: EHCI generic platform driver
[    3.700000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    3.710000] ohci-platform: OHCI generic platform driver
[    4.360000] init: - preinit -
[    4.920000] random: procd urandom read with 7 bits of entropy available
[    7.270000] eth0: link up (100Mbps/Full duplex)
[    8.220000] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    8.260000] eth0: link down
[    8.270000] procd: - early -
[    8.280000] procd: - watchdog -
[    8.930000] procd: - ubus -
[    9.950000] procd: - init -
[   10.810000] NET: Registered protocol family 10
[   10.820000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   10.840000] Loading modules backported from Linux version master-2015-03-09-0-g141f155
[   10.850000] Backport generated by backports.git backports-20150129-0-gdd4a670
[   10.860000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   10.870000] nf_conntrack version 0.5.0 (956 buckets, 3824 max)
[   10.920000] xt_time: kernel timezone is -0000
[   10.940000] cfg80211: Calling CRDA to update world regulatory domain
[   10.970000] cfg80211: World regulatory domain updated:
[   10.970000] cfg80211:  DFS Master region: unset
[   10.980000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   10.990000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   10.990000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   11.000000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   11.010000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   11.020000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)
[   11.030000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   11.040000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   11.040000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   11.120000] PPP generic driver version 2.4.2
[   11.130000] NET: Registered protocol family 24
[   11.180000] ath: EEPROM regdomain: 0x0
[   11.180000] ath: EEPROM indicates default country code should be used
[   11.180000] ath: doing EEPROM country->regdmn map search
[   11.180000] ath: country maps to regdmn code: 0x3a
[   11.180000] ath: Country alpha2 being used: US
[   11.180000] ath: Regpair used: 0x3a
[   11.190000] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[   11.190000] ieee80211 phy0: Atheros AR9340 Rev:2 mem=0xb8100000, irq=47
[   11.200000] cfg80211: Calling CRDA for country: US
[   11.220000] cfg80211: Regulatory domain changed to country: US
[   11.220000] cfg80211:  DFS Master region: FCC
[   11.230000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   11.240000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 3000 mBm), (N/A)
[   11.250000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 1700 mBm), (N/A)
[   11.250000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2300 mBm), (0 s)
[   11.260000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 3000 mBm), (N/A)
[   11.270000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 4000 mBm), (N/A)
[   20.140000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   20.170000] jffs2_build_filesystem(): unlocking the mtd device... done.
[   20.170000] jffs2_build_filesystem(): erasing all blocks after the end marker... 
[   20.200000] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00410000
[   20.210000] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00400000
[   20.230000] jffs2: Newly-erased block contained word 0x19852003 at offset 0x003f0000
[   20.240000] jffs2: Newly-erased block contained word 0x19852003 at offset 0x003e0000
[   20.260000] jffs2: Newly-erased block contained word 0x19852003 at offset 0x003d0000
[   20.270000] jffs2: Newly-erased block contained word 0x19852003 at offset 0x003c0000
[   20.290000] jffs2: Newly-erased block contained word 0x19852003 at offset 0x003b0000
[   20.300000] jffs2: Newly-erased block contained word 0x19852003 at offset 0x003a0000
[   20.320000] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00390000
[   20.330000] jffs2: Newly-erased block contained word 0x19852003 at offset 0x00380000
[   20.360000] jffs2: Newly-erased block contained word 0x0 at offset 0x00370000
[   20.370000] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x00360000
[   20.400000] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x00350000
[   20.410000] jffs2: Newly-erased block contained word 0x46 at offset 0x00340000
[   20.440000] jffs2: Newly-erased block contained word 0xcaedce37 at offset 0x00330000
[   20.450000] jffs2: Newly-erased block contained word 0xc347704f at offset 0x00320000
[   20.480000] jffs2: Newly-erased block contained word 0x1d1920ac at offset 0x00310000
[   20.490000] jffs2: Newly-erased block contained word 0xa40fb0fb at offset 0x00300000
[   20.510000] jffs2: Newly-erased block contained word 0x3660cd82 at offset 0x002f0000
[   20.520000] jffs2: Newly-erased block contained word 0x72fec1bb at offset 0x002e0000
[   20.540000] jffs2: Newly-erased block contained word 0x6c69ae0f at offset 0x002d0000
[   20.550000] jffs2: Newly-erased block contained word 0xe793bd5e at offset 0x002c0000
[   20.570000] jffs2: Newly-erased block contained word 0xa0c57928 at offset 0x002b0000
[   20.580000] jffs2: Newly-erased block contained word 0xe97bea46 at offset 0x002a0000
[   20.600000] jffs2: Newly-erased block contained word 0x6f959d1a at offset 0x00290000
[   20.610000] jffs2: Newly-erased block contained word 0x3c8d9e58 at offset 0x00280000
[   20.630000] jffs2: Newly-erased block contained word 0x7e0c5020 at offset 0x00270000
[   20.640000] jffs2: Newly-erased block contained word 0x5ca0590e at offset 0x00260000
[   20.660000] jffs2: Newly-erased block contained word 0x5d6fc542 at offset 0x00250000
[   20.670000] jffs2: Newly-erased block contained word 0x7421b52d at offset 0x00240000
[   20.690000] jffs2: Newly-erased block contained word 0x549c7d74 at offset 0x00230000
[   20.700000] jffs2: Newly-erased block contained word 0xf9ee8e53 at offset 0x00220000
[   20.720000] jffs2: Newly-erased block contained word 0xb01b9a7f at offset 0x00210000
[   20.730000] jffs2: Newly-erased block contained word 0xb1778c87 at offset 0x00200000
[   20.750000] jffs2: Newly-erased block contained word 0xe6e855c0 at offset 0x001f0000
[   20.760000] jffs2: Newly-erased block contained word 0xe9395666 at offset 0x001e0000
[   20.780000] jffs2: Newly-erased block contained word 0x71dc97f5 at offset 0x001d0000
[   20.790000] jffs2: Newly-erased block contained word 0x8db4d5dd at offset 0x001c0000
[   20.810000] jffs2: Newly-erased block contained word 0x7d067c92 at offset 0x001b0000
[   20.820000] jffs2: Newly-erased block contained word 0xa6cd63ac at offset 0x001a0000
[   20.840000] jffs2: Newly-erased block contained word 0xc22a2438 at offset 0x00190000
[   20.850000] jffs2: Newly-erased block contained word 0x5a4c4732 at offset 0x00180000
[   20.870000] jffs2: Newly-erased block contained word 0x3b250a08 at offset 0x00170000
[   20.880000] jffs2: Newly-erased block contained word 0x33e8cf14 at offset 0x00160000
[   20.900000] jffs2: Newly-erased block contained word 0x2617930a at offset 0x00150000
[   20.910000] jffs2: Newly-erased block contained word 0xf0a1104d at offset 0x00140000
[   20.930000] jffs2: Newly-erased block contained word 0x7f3b3389 at offset 0x00130000
[   20.940000] jffs2: Newly-erased block contained word 0x8f743231 at offset 0x00120000
[   20.960000] jffs2: Newly-erased block contained word 0x9a52296 at offset 0x00110000
[   20.970000] jffs2: Newly-erased block contained word 0x26d6fb5c at offset 0x00100000
[   20.990000] jffs2: Newly-erased block contained word 0x8a402ad at offset 0x000f0000
[   21.000000] jffs2: Newly-erased block contained word 0xfd3d1dce at offset 0x000e0000
[   21.020000] jffs2: Newly-erased block contained word 0x7f5a25a6 at offset 0x000d0000
[   21.030000] jffs2: Newly-erased block contained word 0xd474384d at offset 0x000c0000
[   21.050000] jffs2: Newly-erased block contained word 0xb5ca9322 at offset 0x000b0000
[   21.060000] jffs2: Newly-erased block contained word 0x4cbc8cde at offset 0x000a0000
[   21.080000] jffs2: Newly-erased block contained word 0xbc5ae97 at offset 0x00090000
[   21.090000] jffs2: Newly-erased block contained word 0x8ed3b0b7 at offset 0x00080000
[   21.110000] jffs2: Newly-erased block contained word 0x5bcc5dcf at offset 0x00070000
[   21.120000] jffs2: Newly-erased block contained word 0x215a19fb at offset 0x00060000
[   21.140000] jffs2: Newly-erased block contained word 0xcf97b701 at offset 0x00050000
[   21.150000] jffs2: Newly-erased block contained word 0x7bd44967 at offset 0x00040000
[   21.170000] jffs2: Newly-erased block contained word 0x9cc0dd4e at offset 0x00030000
[   21.180000] jffs2: Newly-erased block contained word 0x77cde34d at offset 0x00020000
[   21.200000] jffs2: Newly-erased block contained word 0xbaec36ba at offset 0x00010000
[   21.210000] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x00000000
[   21.210000] done.
[   21.220000] jffs2: notice: (963) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   23.320000] device eth0 entered promiscuous mode
[   23.350000] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   23.450000] eth0: link up (100Mbps/Full duplex)
[   23.450000] br-lan: port 1(eth0) entered forwarding state
[   23.460000] br-lan: port 1(eth0) entered forwarding state
[   23.470000] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   25.450000] eth0: link down
[   25.450000] br-lan: port 1(eth0) entered disabled state
[   27.450000] eth0: link up (100Mbps/Full duplex)
[   27.450000] br-lan: port 1(eth0) entered forwarding state
[   27.460000] br-lan: port 1(eth0) entered forwarding state
[   29.460000] br-lan: port 1(eth0) entered forwarding state
[   79.320000] random: nonblocking pool is initialized
[  625.450000] eth0: link down
[  625.450000] br-lan: port 1(eth0) entered disabled state
[  636.450000] eth0: link up (100Mbps/Full duplex)
[  636.450000] br-lan: port 1(eth0) entered forwarding state
[  636.460000] br-lan: port 1(eth0) entered forwarding state
[  638.460000] br-lan: port 1(eth0) entered forwarding state

comment:5 Changed 2 years ago by bittorf@…

maybe this is it?

[    0.518041] m25p80 spi0.0: found mx25l6405d, expected m25p80
[    0.523877] m25p80 spi0.0: mx25l6405d (8192 Kbytes)

comment:6 Changed 2 years ago by bittorf@…

can this be the reason why?:

"spi-nor: mx25l3205d/mx25l6405d: append SECT_4K

according datasheet both chips can erase 4kByte sectors individually"

(from http://comments.gmane.org/gmane.linux.drivers.mtd/62852)

or is this "cosmetic".

comment:7 Changed 2 years ago by mdeneen

Bastian,

We have experienced the same thing here with the Ubiquiti AirRouter, but on AA. Here's some debug output from our end:

[    0.720000] m25p80 spi0.0: found mx25l6405d, expected m25p80
[    0.720000] m25p80 spi0.0: mx25l6405d (8192 Kbytes)


[   37.070000] Newly-erased block contained word 0x19852003 at offset 0x00190000
[   37.080000] Newly-erased block contained word 0x19852003 at offset 0x00180000
[   37.090000] Newly-erased block contained word 0x19852003 at offset 0x00170000
[   37.100000] Newly-erased block contained word 0x19852003 at offset 0x00160000
[   37.110000] Newly-erased block contained word 0x19852003 at offset 0x00150000
[   37.120000] Newly-erased block contained word 0x19852003 at offset 0x00140000
[   37.130000] Newly-erased block contained word 0x19852003 at offset 0x00130000
[   37.140000] Newly-erased block contained word 0x19852003 at offset 0x00120000
[   37.150000] Newly-erased block contained word 0x0 at offset 0x00110000
[   37.160000] Newly-erased block contained word 0xdeadc0de at offset 0x00100000
[   37.170000] Newly-erased block contained word 0xdeadc0de at offset 0x000f0000
[   37.170000] Newly-erased block contained word 0x4a75fa8e at offset 0x000e0000
[   37.180000] Newly-erased block contained word 0x529688b3 at offset 0x000d0000
[   37.190000] Newly-erased block contained word 0x72c5c469 at offset 0x000c0000
[   37.200000] Newly-erased block contained word 0x37d3b7b1 at offset 0x000b0000
[   37.210000] Newly-erased block contained word 0x3701cf35 at offset 0x000a0000
[   37.220000] Newly-erased block contained word 0xe92b7c18 at offset 0x00090000
[   37.230000] Newly-erased block contained word 0x9509712e at offset 0x00080000
[   37.240000] Newly-erased block contained word 0x60acb07d at offset 0x00070000
[   37.250000] Newly-erased block contained word 0x47a1a3d9 at offset 0x00060000
[   37.260000] Newly-erased block contained word 0xe212a57b at offset 0x00050000
[   37.270000] Newly-erased block contained word 0x503dddd7 at offset 0x00040000
[   37.280000] Newly-erased block contained word 0xdab1df97 at offset 0x00030000
[   37.290000] Newly-erased block contained word 0xcfb10ba9 at offset 0x00020000
[   37.300000] Newly-erased block contained word 0x3ce9160b at offset 0x00010000
[   37.310000] Newly-erased block contained word 0xdeadc0de at offset 0x00000000

Filesystem                Size      Used Available Use% Mounted on
rootfs                    1.6M      1.6M         0 100% /
/dev/root                 4.8M      4.8M         0 100% /rom
tmpfs                    14.3M    100.0K     14.2M   1% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev
root                     14.3M     64.0K     14.2M   0% /tmp/root
overlayfs:/tmp/root      14.3M     64.0K     14.2M   0% /tmp/root
/dev/mtdblock4            1.6M      1.6M         0 100% /overlay
overlayfs:/overlay        1.6M      1.6M         0 100% /

^^^--- /overlay is 100% full but is empty.

Changing to SECT_4K results in a working boot, but still not quite right:

[    0.720000] m25p80 spi0.0: found mx25l6405d, expected m25p80
[    0.720000] m25p80 spi0.0: mx25l6405d (8192 Kbytes)

[   37.360000] Newly-erased block contained word 0x0 at offset 0x00110000
[   37.370000] Newly-erased block contained word 0xdeadc0de at offset 0x00100000
[   37.380000] Newly-erased block contained word 0xdeadc0de at offset 0x000f0000
[   37.390000] Newly-erased block contained word 0x4a75fa8e at offset 0x000e0000
[   37.400000] Newly-erased block contained word 0x529688b3 at offset 0x000d0000
[   37.410000] Newly-erased block contained word 0x72c5c469 at offset 0x000c0000
[   37.420000] Newly-erased block contained word 0x37d3b7b1 at offset 0x000b0000
[   37.430000] Newly-erased block contained word 0x3701cf35 at offset 0x000a0000
[   37.440000] Newly-erased block contained word 0xe92b7c18 at offset 0x00090000
[   37.440000] Newly-erased block contained word 0x9509712e at offset 0x00080000
[   37.450000] Newly-erased block contained word 0x60acb07d at offset 0x00070000
[   37.460000] Newly-erased block contained word 0x47a1a3d9 at offset 0x00060000
[   37.470000] Newly-erased block contained word 0xe212a57b at offset 0x00050000
[   37.480000] Newly-erased block contained word 0x503dddd7 at offset 0x00040000
[   37.490000] Newly-erased block contained word 0xdab1df97 at offset 0x00030000
[   37.500000] Newly-erased block contained word 0xcfb10ba9 at offset 0x00020000
[   37.510000] Newly-erased block contained word 0x3ce9160b at offset 0x00010000
[   37.520000] Newly-erased block contained word 0xdeadc0de at offset 0x00000000
[   37.530000] done.
[   37.530000] JFFS2 notice: (1140) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   37.830000] Node CRC ffffffff != calculated CRC f09e7845 for node at 00183e5c
[   37.840000] Node CRC ffffffff != calculated CRC f09e7845 for node at 00183ee4
[   37.840000] Node CRC ffffffff != calculated CRC f09e7845 for node at 00183f74
[   37.850000] Node CRC ffffffff != calculated CRC f09e7845 for node at 00184004
[   37.860000] Node CRC ffffffff != calculated CRC f09e7845 for node at 0018408c
[   37.870000] Node CRC ffffffff != calculated CRC f09e7845 for node at 0018411c
[   37.880000] Node CRC ffffffff != calculated CRC f09e7845 for node at 001841ac
[   37.890000] Node CRC ffffffff != calculated CRC f09e7845 for node at 00184230
[   37.890000] Node CRC ffffffff != calculated CRC f09e7845 for node at 001842c8

Filesystem                Size      Used Available Use% Mounted on
rootfs                    1.6M      1.3M    300.0K  82% /
/dev/root                 4.8M      4.8M         0 100% /rom
tmpfs                    14.3M    100.0K     14.2M   1% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev
root                     14.3M     64.0K     14.2M   0% /tmp/root
overlayfs:/tmp/root      14.3M     64.0K     14.2M   0% /tmp/root
/dev/mtdblock4            1.6M      1.3M    300.0K  82% /overlay
overlayfs:/overlay        1.6M      1.3M    300.0K  82% /

Nothing is in /overlay in either situation.

comment:8 Changed 2 years ago by mdeneen

It appears that we are unable to return to AirOS by tftp-flashing the stock firmware. It gets into a boot loop.

I've not had a chance to connect a serial cable to see what it is doing.

comment:9 Changed 2 years ago by mdeneen

The following is the boot log from the AirOS firmware.

XM.v5.6.2# dmesg
[    0.000000] Linux version 2.6.32.65 (buildd@builder) (gcc version 4.1.2) #1 Thu Jul 16 12:01:49 EEST 2015
[    0.000000] flash_size passed from bootloader = 0
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00002000
[    0.000000] Movable zone start PFN for each node
[    0.000000] early_node_map[1] active PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00002000
[    0.000000] On node 0 totalpages: 8192
[    0.000000] free_area_init_node: node 0, pgdat 802a6ec0, node_mem_map 81000000
[    0.000000]   Normal zone: 64 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 8128 pages, LIFO batch:0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line: console=tty0 root=31:03 rootfstype=squashfs init=/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM) panic=3 quiet 
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 29508k/32768k available (2192k kernel code, 3260k reserved, 516k data, 136k init, 0k highmem)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:128
[    0.000000] plat_time_init: plat time init done
[    0.000000] Console: colour dummy device 80x25
[    0.000000] console [tty0] enabled
[    0.000000] Calibrating delay loop... 259.07 BogoMIPS (lpj=129536)
[    0.016000] Mount-cache hash table entries: 512
[    0.019000] NET: Registered protocol family 16
[    0.021000] ===== ar7240_platform_init: 0
[    0.021000] PCIe WLAN H/W found [tries: 1]
[    0.021000] PCI init:ar7240_pcibios_init
[    0.021000] ar7240_pcibios_init(368): PCI CMD write: 0x356
[    0.021000] registering PCI controller with io_map_base unset
[    0.030000] bio: create slab <bio-0> at 0
[    0.031000] usbcore: registered new interface driver usbfs
[    0.031000] usbcore: registered new interface driver hub
[    0.032000] usbcore: registered new device driver usb
[    0.033000] pci 0000:00:00.0: reg 10 64bit mmio: [0x10000000-0x1000ffff]
[    0.033000] pci 0000:00:00.0: supports D1
[    0.033000] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.033000] pci 0000:00:00.0: PME# disabled
[    0.034000] Returning IRQ 48
[    0.035000] Switching to clocksource MIPS
[    0.038000] NET: Registered protocol family 2
[    0.039000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.040000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    0.040000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.040000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.040000] TCP reno registered
[    0.041000] NET: Registered protocol family 1
[    0.041000] AR7240 GPIOC major 0
[    0.043000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.043000] msgmni has been set to 57
[    0.044000] io scheduler noop registered (default)
[    0.069000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.071000] serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
[    0.072000] 6 cmdlinepart partitions found on MTD device ar7240-nor0
[    0.072000] Creating 6 MTD partitions on "ar7240-nor0":
[    0.072000] 0x000000000000-0x000000040000 : "u-boot"
[    0.074000] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.075000] 0x000000050000-0x000000150000 : "kernel"
[    0.076000] 0x000000150000-0x0000007b0000 : "rootfs"
[    0.078000] mtd: partition "rootfs" set to be root filesystem
[    0.078000] 0x0000007b0000-0x0000007f0000 : "cfg"
[    0.079000] 0x0000007f0000-0x000000800000 : "EEPROM"
[    0.081000] usbmon: debugfs is not available
[    0.081000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    0.111000] Port Status c000004 
[    0.111000] ar7240-ehci ar7240-ehci.0: ATH EHCI
[    0.111000] ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1
[    0.112000] ehci_reset Intialize USB CONTROLLER in host mode: 3
[    0.113000] ehci_reset Port Status c000000 
[    0.113000] ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000
[    0.114000] ehci_reset Intialize USB CONTROLLER in host mode: 3
[    0.115000] ehci_reset Port Status c000000 
[    0.121000] ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00
[    0.121000] usb usb1: configuration #1 chosen from 1 choice
[    0.122000] hub 1-0:1.0: USB hub found
[    0.122000] hub 1-0:1.0: 1 port detected
[    0.123000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    0.123000] u32 classifier
[    0.123000]     Performance counters on
[    0.123000]     input device check on 
[    0.123000]     Actions configured 
[    0.125000] TCP westwood registered
[    0.126000] NET: Registered protocol family 10
[    0.130000] NET: Registered protocol family 17
[    0.130000] Bridge firewalling registered
[    0.130000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[    0.130000] All bugs added by David S. Miller <davem@redhat.com>
[    0.130000] ar7240wdt_init: Registering WDT success
[    0.138000] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[    0.139000] Freeing unused kernel memory: 136k freed
[    0.148000] Please be patient, while AirOS loads ...
[    1.342000] Algorithmics/MIPS FPU Emulator v1.5
[    1.728000] ubnthal: module license 'Proprietary' taints kernel.
[    1.728000] Disabling lock debugging due to kernel taint
[    1.773000] ath-gpio 2.0 initialised
[    1.773000] ubnthal initialised
[    7.558000] AG7240: Length per segment 1536
[    7.558000] AG7240: skb_overhead 64, shinfo: 344
[    7.558000] AG7240: RX sizes - 2k_fit: 1614, reserve: 0
[    7.558000] AG7240: Max segments per packet 1
[    7.558000] AG7240: Max tx descriptor count    80
[    7.558000] AG7240: Max rx descriptor count    252
[    7.558000] AG7240: fifo cfg 3 01f00140
[    7.558000] AG7240CHH: Mac address for unit 0
[    7.558000] AG7240CHH: 68:72:51:45:46:bc 
[    7.764000] AG7240CHH: Mac address for unit 1
[    7.764000] AG7240CHH: 6a:72:51:45:46:bc 
[    8.349000] SCSI subsystem initialized
[    9.175000] PPP generic driver version 2.4.2
[    9.372000] PPP MPPE Compression module registered
[    9.408000] NET: Registered protocol family 24
[    9.814000] URD Init
[   10.869000] ath_hal: 0.9.17.1 (AR5416, DEBUG, REGOPS_FUNC, 11D)
[   11.371000] wlan: 0.8.4.2 (Atheros/multi-bss)
[   11.519000] wlan: mac acl policy registered
[   11.687000] wlan_me: Version 0.1
[   11.687000] Copyright (c) 2008 Atheros Communications, Inc. All Rights Reserved
[   11.812000] usbcore: registered new interface driver cdc_acm
[   11.812000] cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters
[   12.048000] usbcore: registered new interface driver usbserial
[   12.049000] USB Serial support registered for generic
[   12.049000] usbcore: registered new interface driver usbserial_generic
[   12.049000] usbserial: USB Serial Driver core
[   12.219000] Initializing USB Mass Storage driver...
[   12.219000] usbcore: registered new interface driver usb-storage
[   12.219000] USB Mass Storage support registered.
[   12.323000] USB Serial support registered for GSM modem (1-port)
[   12.323000] usbcore: registered new interface driver option
[   12.324000] option: v0.7.2:USB Driver for GSM modems
[   12.518000] USB Serial support registered for Sierra USB modem
[   12.518000] usbcore: registered new interface driver sierra
[   12.519000] sierra: v.1.3.8:USB Driver for Sierra Wireless USB modems
[   12.667000] fuse init (API version 7.13)
[   12.987000] ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
[   14.561000] ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
[   15.266000] ath_pci: 0.9.4.5 (Atheros/multi-bss)
[   15.266000] PCI: Setting latency timer of device 0000:00:00.0 to 64
[   15.271000] ar5416Attach: Mac Chip.Rev 0xc0.2 PCI devid 0x2b
[   15.274000] ath_hal: Ubiquiti Merlin (0777:e4a2)
[   15.274000] ANT_DIV_COMB === Check for capability  modal version 4 
[   15.274000] ANT_DIV_COMB === Check for capability ant_div_control1 11 ant_div_control2 6
[   15.274000] ANT_DIV_COMB === halAntDivCombSupport 
[   15.274000] ath_hal: NF adjust values: EEP map NOT DEFAULT
[   15.312000] ANT_DIV_COMB: ath_ant_div_comb_init Called 
[   15.312000] HAL supports ANTENNA_DIVERSITY
[   15.332000] wifi0: Atheros 9285: mem=0x10000000, irq=48 hw_base=0xb0000000
[   16.268000] ubnt_poll: Initializing polling module...
[   16.268000] ubnt_poll: Initializing packet classifier...
[   16.268000] ubnt_poll: OS timer frequency 1000 Hz
[   16.342000] rssi-leds 1.2 loaded
[   16.430000] ubnt_poll: Clearing hooks...
[   16.430000] ubnt_poll: ack_mode set to 0
[   16.430000] ubnt_poll: Using antenna array type: None, ports=1, default=1
[   16.596000] ubnt_poll_set_noack_rate: was set auto_rate 1 mcs_index 0
[   17.078000] nf_conntrack version 0.5.0 (463 buckets, 1852 max)
[   17.205000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   18.441000] nf_conntrack_rtsp v0.6.21 loading
[   18.464000] nf_nat_rtsp v0.6.21 loading
[   19.055000] Ebtables v2.0 registered
[   19.291000] device ath0 entered promiscuous mode
[   19.297000] device eth1 entered promiscuous mode
[   19.329000] ag7240_ring_alloc Allocated 1920 at 0x80a28000
[   19.329000] ag7240_ring_alloc Allocated 6048 at 0x80a46000
[   19.331000] Virian MDC CFG Value ==> 6
[   19.331000] Setting PHY...
[   22.358000] ADDRCONF(NETDEV_UP): eth0: link is not ready
[   22.364000] device eth0 entered promiscuous mode
[   27.486000] device wifi0 entered promiscuous mode
[   27.487000] ADDRCONF(NETDEV_UP): ath0: link is not ready
[   27.512000] ag7240_ring_alloc Allocated 1920 at 0x80a4e800
[   27.512000] ag7240_ring_alloc Allocated 6048 at 0x809fc000
[   27.514000] Virian MDC CFG Value ==> 6
[   27.514000] ATHRS26: resetting s26
[   27.615000] ATHRS26: s26 reset done
[   27.622000] Setting PHY...
[   28.654000] ADDRCONF(NETDEV_UP): eth1: link is not ready
[   29.302000] AG7240: enet unit:1 phy:3 is up...GMii 100Mbps full duplex
[   29.302000] AG7240: done cfg2 0x7235 ifctl 0x0 miictrl  
[   29.302000] Virian MDC CFG Value ==> 6
[   29.302000] AG7240: enet unit 1 phy 3 mode 0x4c04
[   29.327000] ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[   29.327000] br0: port 2(eth1) entering learning state
[   30.327000] br0: port 2(eth1) entering forwarding state
[   30.667000] ADDRCONF(NETDEV_CHANGE): ath0: link becomes ready
[   30.667000] br0: port 1(ath0) entering learning state
[   31.667000] br0: port 1(ath0) entering forwarding state


dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00100000 00010000 "kernel"
mtd3: 00660000 00010000 "rootfs"
mtd4: 00040000 00010000 "cfg"
mtd5: 00010000 00010000 "EEPROM"


Filesystem                Size      Used Available Use% Mounted on
rootfs                    5.8M      5.8M         0 100% /
/dev/root                 5.8M      5.8M         0 100% /
tmpfs                     9.0M    264.0k      8.7M   3% /var
dev                      14.5M         0     14.5M   0% /dev

comment:10 Changed 2 years ago by mdeneen

One last comment. The previous boot log from an unflashed device was successfully flashed over TFTP. Perhaps there was a run of bad flash chips?

comment:11 Changed 2 years ago by jmarlin

Disregard comment 10 - I had accidentally tested an old board. The device which actually produced the logs in comment 9 did NOT successfully flash over TFTP.

I have now tested twenty boards. 100% of these failed to flash.

comment:12 Changed 2 years ago by mdeneen

If you first flash an older AirOS version, such as 5.5.10, and then flash OpenWrt, it will flash successfully. You need to flash AirOS using the web interface, as loading it over tftp fails with the same error message that OpenWrt does.

Newer Ubiquiti devices have shipped with:

U-Boot 1.1.4.2-s956 (Jun 10 2015 - 10:54:50)

and older devices had:

U-Boot 1.1.4.2-s594 (Dec 5 2012 - 15:23:07)

The MTD partition layout appears to be the same:

new:

XM.v5.6.3# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00100000 00010000 "kernel"
mtd3: 00660000 00010000 "rootfs"
mtd4: 00040000 00010000 "cfg"
mtd5: 00010000 00010000 "EEPROM"

[    0.000000] Kernel command line: console=tty0 root=31:03 rootfstype=squashfs init=/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM) panic=3 quiet 


old:

XM.v5.5.10# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00100000 00010000 "kernel"
mtd3: 00660000 00010000 "rootfs"
mtd4: 00040000 00010000 "cfg"
mtd5: 00010000 00010000 "EEPROM"

[    0.000000] Kernel command line: console=tty0 root=31:03 rootfstype=squashfs init=/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM)  

The only difference appears to be U-Boot version. I've attached a serial console to the one which is in a boot loop, and there's nothing useful printed. Since the kernel command line now has "quiet" in it, I didn't get anything useful. I'll modify the boot arguments and report back. One should be able to extract the uboot image from the AirOS firmware and replace the existing u-boot, but a serial cable is required to do this.

comment:13 Changed 2 years ago by jmarlin

https://wiki.openwrt.org/toh/ubiquiti/airmaxm notes the following:

Special Firmware Note: AirOS XM.v5.5.X images used U-Boot 1.1.4.2-s594 (Dec 5 2012 - 15:23:07). The OpenWRT image can be successfully flashed onto these versions of firmware. However, in July 2015 Ubiquiti released a new version of firmware XM.v5.6.X. With this firmware a new U-Boot version was released, U-Boot 1.1.4.2-s956 (Jun 10 2015 - 10:54:50). The newer U-Boot version changes the memory size and starting address for rootfs, cfg, and EEPROM. LOADING AN OPENWRT IMAGE ON A U-Boot 1.1.4.2-s956 WILL CAUSE THE DEVICE TO BE BRICKED!!!

If the device has XM.v5.6.X, an older version of XM firmware can be loaded from the AirOS webgui (for example XM.v5.5.10) and U-Boot will be overwritten with the older version. OpenWRT can then be loaded onto the device successfully.

U-Boot 1.1.4.2-s594 (Dec 5 2012 - 15:23:07)
#:	name	size	offset	mask_flags
0:	u-boot		0x00040000	0x00000000	0
1:	u-boot-env	0x00010000	0x00040000	0
2:	kernel		0x00100000	0x00050000	0
3:	rootfs		0x00660000	0x00150000	0
4:	cfg		0x00040000	0x007b0000	0
5:	EEPROM		0x00010000	0x007f0000	0

U-Boot 1.1.4.2-s956 (Jun 10 2015 - 10:54:50)
#:	name	size	offset	mask_flags
0:	u-boot		0x00040000	0x00000000	0
1:	u-boot-env	0x00010000	0x00040000	0
2:	kernel		0x00100000	0x00050000	0
3:	rootfs		0x005a0000	0x00150000	0
4:	cfg		0x00040000	0x006f0000	0
5:	EEPROM		0x00010000	0x00730000	0

/quote

Note that these partitions listed on this wikipage are *not* what we actually saw under 5.6.3 as mdeneen noted above.

However, the behavior is consistent with what the wiki notes - flashing OpenWRT onto a 5.6.3 Airrouter is *not* successful, while flashing OpenWRT onto a downgraded 5.5.10 Airrouter *is*.

Also note these mtdparts:

As defined in the the ar71xx Makefile:
ubntxm_mtdlayout=mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,1024k(kernel),6528k(rootfs),256k(cfg)ro,64k(EEPROM)ro,7552k@0x50000(firmware)

As seen in the serial console on a 5.6.3 AirOS platform:
mtdparts=mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),5760k(rootfs),256k(cfg),64k(EEPROM)

The new router firmware notes a rootfs size (5760k) which even doesn't match what it reports in its own '/proc/mtd' (6528k). Also, changing the rootfs size to 5760k in the ar71xx Makefile still doesn't allow us to flash.

comment:14 Changed 2 years ago by markit

well i think i found same difference on a Loco M2 too (different rootfs size)

new bootloader:

ar7240> mtdparts 

device nor0 <ar7240-nor0>, # parts = 6
 #: name			size		offset		mask_flags
 0: u-boot                	0x00040000	0x00000000	0
 1: u-boot-env            	0x00010000	0x00040000	0
 2: kernel                	0x00100000	0x00050000	0
 3: rootfs                	0x005a0000	0x00150000	0
 4: cfg                   	0x00040000	0x006f0000	0
 5: EEPROM                	0x00010000	0x00730000	0

active partition: nor0,0 - (u-boot) 0x00040000 @ 0x00000000

defaults:
mtdids  : nor0=ar7240-nor0
mtdparts: mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM)

old bootloader

ar7240> mtdparts 

device nor0 <ar7240-nor0>, # parts = 6
 #: name			size		offset		mask_flags
 0: u-boot                	0x00040000	0x00000000	0
 1: u-boot-env            	0x00010000	0x00040000	0
 2: kernel                	0x00100000	0x00050000	0
 3: rootfs                	0x00660000	0x00150000	0
 4: cfg                   	0x00040000	0x007b0000	0
 5: EEPROM                	0x00010000	0x007f0000	0

active partition: nor0,0 - (u-boot) 0x00040000 @ 0x00000000

defaults:
mtdids  : nor0=ar7240-nor0
mtdparts: mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM)
ar7240>

But what actually happens if openwrt is flashed to a device with new bootloader and partition layout

Does it (try to) overwrite the cfg and EEPROM partitions?

Last edited 2 years ago by markit (previous) (diff)

comment:15 Changed 2 years ago by andrewhodel@…

here is a lot of info on the subject

http://www.aredn.org/sites/default/files/sites/default/files/pictures/user-AE6XE/flash_mem_map.JPG - this is the real difference

http://www.aredn.org/content/ubiquiti-airos-56-alert-0 - img is from this thread

here is a fix with serial access:

A process to recover bricked devices due to the uboot AirOS v5.6.x issue has succeeded.    Thanks to Bob, W8ERD, for volunteering his node to the scalpel.   I'm working on a full write up, but to summarize the very high level process, here it is:

1) Gain access to the motherboard and attach a console to the serial port.
2) On power up, hit a key to stop the boot process and enter the command "urescue -f -e" (runs the internal tftp server and enables the downgrade of uboot)
3) Now "tftp" on the main ethernet port to upload the AirOS v5.5.x firmware  (correct uboot version now restored)
4) Repeat step 2 and 3 with out the options, "urescue" only.  With correct uboot version, flash layout, etc. is returned to normal.
5) Reassemble case and power cycle, booting to AirOS (if encountering any issues, without using the serial console access, do the normal tftp upload of AirOS v5.5.x a final time)

This process has worked on a NSM2 and a Bullet so far.
  
Joe AE6XE

http://www.aredn.org/content/nanostation-bricked - thread which serial solution is from

and it is also mentioned on the wiki - https://wiki.openwrt.org/toh/ubiquiti/airmaxm

it would be real nice if someone was able to make an image that could be flashed to a device which is post UBNT 5.6.x firmware

comment:16 Changed 2 years ago by akyozh

The new version bootloader in UBNT device will verify the Header of firmware. If you want to flash the OpenWRT firmware, the Header in OpenWRT firmware should be modified as the same string in factory firmware Header, e.g. "UBNTXW.ar934x.v5.6.3.28591.151130.1735". We also need to update the CRC checksum of the firmware. I have flashed OpenWRT 15.05 firmware into UBNT Rocket M5 XW device with 5.6.3 factory firmware and the new bootloader.

comment:17 follow-up: Changed 2 years ago by anonymous

@akyozh did you make the uboot memory offset changes? Is that entire issue a red herring?

comment:18 follow-up: Changed 2 years ago by andrewhodel@…

I know for sure this process works if you have an arduino or something to get at the 3.3v serial on the board:

1) Gain access to the motherboard and attach a console to the serial port.
2) On power up, hit a key to stop the boot process and enter the command "urescue -f -e" (runs the internal tftp server and enables the downgrade of uboot)
3) Now "tftp" on the main ethernet port to upload the AirOS v5.5.x firmware  (correct uboot version now restored)
4) Repeat step 2 and 3 with out the options, "urescue" only.  With correct uboot version, flash layout, etc. is returned to normal.
5) Reassemble case and power cycle, booting to AirOS (if encountering any issues, without using the serial console access, do the normal tftp upload of AirOS v5.5.x a final time)

After I flashed airos v5.5.8 I had no problems with the normal tftp process to load openwrt factory.bin

comment:19 in reply to: ↑ 18 Changed 2 years ago by akyozh

Replying to andrewhodel@…:

I know for sure this process works if you have an arduino or something to get at the 3.3v serial on the board:

......

After I flashed airos v5.5.8 I had no problems with the normal tftp process to load openwrt factory.bin

U-boot section in the firmware will be skipped in TFTP flashing process. But we can downgrade the device to 5.5.10 version and got the older bootloader running in the device. That's why the device will accept OpenWRT firmware after downgraded.

comment:20 in reply to: ↑ 17 Changed 2 years ago by akyozh

Replying to anonymous:

@akyozh did you make the uboot memory offset changes? Is that entire issue a red herring?

I have not modify the flash layout. When the device loading OpenWRT in the first time, the kernel log print this error:
[ 8.210000] mount_root: jffs2 not ready yet, using temporary tmpfs overlay

You can run this command to overcome this issue:
umount /tmp/root

When the device is rebooted again, the kernel log should print this message:
[ 8.490000] mount_root: switching to jffs2 overlay

Now all settings should be saved correctly after reboot.

comment:22 Changed 2 years ago by bmoffitt

FYI - I have gotten a shipment of PicoStation M2 units with 5.6 on them. They exhibit somewhat different but similar behavior. If OpenWRT is flashed onto the units on top of 5.6, the load fails, but the device is left with 5.6 running. I can downgrade to 5.5, but still cannot load OpenWRT on them. It seems almost like a "software fuse" (like on some cell phones) is set - when trying to load OpenWRT via TFTP I get "Error code 2: Firmware Check Failed" from the unit. They still seem to work, however, running AirOS, whereas the Loco units just go into a boot loop.

I have not tested the patch referenced above.

comment:23 Changed 2 years ago by anonymous

I have gotten some more PicoStations. It seems that, if they get 5.6 through the "normal" update process (via the web form or using the "fwupdate.real" command), it corrupts something, and then they cannot be flashed back to 5.5 or to OpenWRT. If you try to "update" back to 5.5 using the web form, it appears to have succeeded (it reports it is running 5.5), but it is actually in an odd state: it won't remember your configurations, etc. Trying to flash either 5.5 or OpenWRT will fail with the "Firmware Check Failed" message.

However, if you flash 5.6 BACK on the unit USING TFTP (not using the web form or fwupdate.real - tftp ONLY), you can THEN successfully downgrade to 5.5, and then you can upgrade to OpenWRT (using either the Ubiquiti update or the tftp method).

This is probably a different (but related) issue to the NanoStation Loco problems.

comment:24 in reply to: ↑ 21 Changed 23 months ago by maxxer

Replying to jmarlin:

FYI: http://thread.gmane.org/gmane.comp.embedded.openwrt.devel/39001

does anyone know if this has been merged yet?

comment:25 Changed 23 months ago by hauke

These patches were applied: r48827, r48828, r48829 does this solve your problems?

comment:26 Changed 23 months ago by maxxer

I flashed the latest available Chaos Chalmer release. Are they only in trunk?

If so, upgrading to the latest available build is enough to have back a working router? thanks

comment:27 Changed 21 months ago by johnv

I have tried to load CC-factory with the above patches onto a BulletM2 running 5.6.4 and the same issues are still happening for me that I had when I tried to load AA onto a BulletM2 running 5.6.4. We perform a custom build, but I have confirmed the above patches are in our merged branch for CC.

OpenWrt installs and loads, but I then get the following messages in the log:

[code]
[ 12.040000] ieee80211 phy0: Atheros AR9280 Rev:2 mem=0xb0000000, irq=40
[ 22.750000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[ 22.760000] jffs2_build_filesystem(): unlocking the mtd device... done.
[ 22.760000] jffs2_build_filesystem(): erasing all blocks after the end marker...
[ 23.110000] jffs2: Newly-erased block contained word 0x0 at offset 0x003a0000
[ 23.120000] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x00390000
[ 23.150000] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x00380000
[ 23.160000] jffs2: Newly-erased block contained word 0x25e7a277 at offset 0x00370000
[ 23.170000] jffs2: Newly-erased block contained word 0xc09704b7 at offset 0x00360000
[ 23.180000] jffs2: Newly-erased block contained word 0x44f117b9 at offset 0x00350000
[ 23.190000] jffs2: Newly-erased block contained word 0xbefb05f5 at offset 0x00340000
[ 23.210000] jffs2: Newly-erased block contained word 0x1ee5d53e at offset 0x00330000
[ 23.220000] jffs2: Newly-erased block contained word 0x590a938c at offset 0x00320000
[ 23.230000] jffs2: Newly-erased block contained word 0x8252b9b8 at offset 0x00310000
[ 23.240000] jffs2: Newly-erased block contained word 0x28181a6f at offset 0x00300000
[ 23.260000] jffs2: Newly-erased block contained word 0x986c2069 at offset 0x002f0000
[ 23.270000] jffs2: Newly-erased block contained word 0xcc74087c at offset 0x002e0000
[ 23.280000] jffs2: Newly-erased block contained word 0x701f47c4 at offset 0x002d0000
[ 23.290000] jffs2: Newly-erased block contained word 0x7d942c5a at offset 0x002c0000
[ 23.300000] jffs2: Newly-erased block contained word 0x88a277e2 at offset 0x002b0000
[ 23.320000] jffs2: Newly-erased block contained word 0x61956620 at offset 0x002a0000
[ 23.330000] jffs2: Newly-erased block contained word 0xef141f20 at offset 0x00290000
[ 23.340000] jffs2: Newly-erased block contained word 0xb9ec15de at offset 0x00280000
[ 23.350000] jffs2: Newly-erased block contained word 0xa1c654fb at offset 0x00270000
[ 23.370000] jffs2: Newly-erased block contained word 0xb125da23 at offset 0x00260000
[ 23.380000] jffs2: Newly-erased block contained word 0x49b26c2d at offset 0x00250000
[ 23.390000] jffs2: Newly-erased block contained word 0xdb40753b at offset 0x00240000
[ 23.400000] jffs2: Newly-erased block contained word 0xd538fdd8 at offset 0x00230000
[ 23.410000] jffs2: Newly-erased block contained word 0xb82af884 at offset 0x00220000
[ 23.430000] jffs2: Newly-erased block contained word 0x672474fa at offset 0x00210000
[ 23.440000] jffs2: Newly-erased block contained word 0x1cd78c3b at offset 0x00200000
[ 23.450000] jffs2: Newly-erased block contained word 0xaeefe15f at offset 0x001f0000
[ 23.460000] jffs2: Newly-erased block contained word 0x4e3080c6 at offset 0x001e0000
[ 23.480000] jffs2: Newly-erased block contained word 0x77c26ac6 at offset 0x001d0000
[ 23.490000] jffs2: Newly-erased block contained word 0x5c5f35a8 at offset 0x001c0000
[ 23.500000] jffs2: Newly-erased block contained word 0xea594e47 at offset 0x001b0000
[ 23.510000] jffs2: Newly-erased block contained word 0x6be61d46 at offset 0x001a0000
[ 23.520000] jffs2: Newly-erased block contained word 0x655412e7 at offset 0x00190000
[ 23.540000] jffs2: Newly-erased block contained word 0x9a6574b5 at offset 0x00180000
[ 23.550000] jffs2: Newly-erased block contained word 0x8fcb95b2 at offset 0x00170000
[ 23.560000] jffs2: Newly-erased block contained word 0xfd38cc83 at offset 0x00160000
[ 23.570000] jffs2: Newly-erased block contained word 0x382adc86 at offset 0x00150000
[ 23.590000] jffs2: Newly-erased block contained word 0xfd86adb4 at offset 0x00140000
[ 23.600000] jffs2: Newly-erased block contained word 0x7357488f at offset 0x00130000
[ 23.610000] jffs2: Newly-erased block contained word 0x172290e at offset 0x00120000
[ 23.620000] jffs2: Newly-erased block contained word 0x3e833818 at offset 0x00110000
[ 23.620000] jffs2: Newly-erased block contained word 0x1861b9a4 at offset 0x00100000
[ 23.650000] jffs2: Newly-erased block contained word 0x859f9654 at offset 0x000f0000
[ 23.660000] jffs2: Newly-erased block contained word 0x3c20bd92 at offset 0x000e0000
[ 23.670000] jffs2: Newly-erased block contained word 0xcefbe852 at offset 0x000d0000
[ 23.680000] jffs2: Newly-erased block contained word 0x81832122 at offset 0x000c0000
[ 23.700000] jffs2: Newly-erased block contained word 0xd7bb61eb at offset 0x000b0000
[ 23.710000] jffs2: Newly-erased block contained word 0xcc841875 at offset 0x000a0000
[ 23.720000] jffs2: Newly-erased block contained word 0x8421e5cd at offset 0x00090000
[ 23.730000] jffs2: Newly-erased block contained word 0x19deccd1 at offset 0x00080000
[ 23.740000] jffs2: Newly-erased block contained word 0xb4a4d32c at offset 0x00070000
[ 23.760000] jffs2: Newly-erased block contained word 0x13df6fa0 at offset 0x00060000
[ 23.770000] jffs2: Newly-erased block contained word 0x28841d4 at offset 0x00050000
[ 23.780000] jffs2: Newly-erased block contained word 0xbefdd856 at offset 0x00040000
[ 23.790000] jffs2: Newly-erased block contained word 0x9e0885c2 at offset 0x00030000
[ 23.810000] jffs2: Newly-erased block contained word 0x53f3f06f at offset 0x00020000
[ 23.820000] jffs2: Newly-erased block contained word 0xf47ccff9 at offset 0x00010000
[ 23.830000] jffs2: Newly-erased block contained word 0xdeadc0de at offset 0x00000000
[ 23.830000] done.
[ 23.840000] jffs2: notice: (908) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[/code]

According to this thread:

https://www.mail-archive.com/openwrt-devel@lists.openwrt.org/msg38393.html

I should not get these messages and things should work OK.

Main issue I have is the config changes I make in OpenWrt are not retained after a reboot, so something still seems incorrect. Also can't reflash unless I use serial.

Anyone else test these patches to see if they work?

comment:28 Changed 21 months ago by johnv

To add more info, I just tried the standard build openwrt-15.05.1-ar71xx-generic-ubnt-bullet-m-squashfs-factory.bin on an install via the UI with AirOS 5.6.4

and have the same issue. Changes are not saved, and lots of those newly-erased messages in the log.

Anyone else care to test and see what their results are. This is on a BulletM2.

comment:29 Changed 21 months ago by johnv

More info I received from Matt, who wrote the above patches:

"I've gotten similar reports about the PicoStation. It seems that UBNT has switched to a different flash chip vendor some time ago, so depending on the time and place you obtained your device, it may or may not work...

The kernel log will show which flash chip is used. One patch I backported to CC fixes the locked flash issue with Macronix flash chip (model name starts with "mx"), but we've found out that UBNT also uses Winbond flash chips (which are detected as "s25fl064k" in the kernel log, which is actually the name of a Spansion chip, but Winbond and Spansion share the JEDEC identifier). I've tried to fix this up in the same way as the Macronix flash was fixed (see [1]), but this fix was not effective."

All the BulletM2's we checked contain this s25fl064k chip, and in turn, these patches do not solve the issue for now, for us. Perhaps some BulletM2's use the chip that works with the above patch.

So the patches may work from some UBNT devices, but not all.

comment:30 Changed 21 months ago by LeSpocky

According to https://github.com/freifunk-gluon/gluon/issues/687 the linux kernel driver for spi-nor does not correctly remove the write protection of the Winbond 25Q64FVIG on the PicoStation M2 XM. When flashed from Air OS 5.5.x the older U-Boot seemed to do this, while when coming from Air OS 5.6.x the newer U-Boot does not. Matthias said, it would be best to solve this upstream and there has been some discussion already on the linux-mtd list, but no solution yet. I have a PicoStation M2 XM at hand, and could reproduce the problem with OpenWRT trunk, but did not have time to further investigate. Still reading the flash chip datasheets and trying to understand the driver. O:-)

Last edited 21 months ago by LeSpocky (previous) (diff)

comment:31 follow-up: Changed 21 months ago by bmoffitt

Hmmm... I have been messing with the PicoStations for the last few weeks, trying to find a "foolproof" way to RELIABLY flash OpenWRT Barrier Breaker onto them (without opening them and attaching a serial cable). What I came up with was the following:

1.) Recovery (tftp) flash AirOS 5.6.3 onto the radio; then
2.) Using the fwupdate command in AirOS, flash AirOS 5.5.11 onto the radio; then
3.) Again using the fwupdate command, flash OpenWRT onto the radio.

This sequence seems to work on every PicoStation and NanoStation Loco M2 XM I have gotten SO FAR. Oddly, downgrading a radio that came with AirOS 5.6 running on it to AirOS 5.5 DID NOT WORK - it appears that it is necessary to do the recovery (tftp) flash of AirOS 5.6 before you downgrade to 5.5. I honestly cannot explain it, but, so far, this sequence seems the only way to reliably flash OpenWRT onto a PicoStation, Bullet, or NanoStation Loco M2 that comes running AirOS 5.6.

I report this in the hope that someone smarter than I will spot something that makes some sense.

-Bill

comment:32 in reply to: ↑ 31 Changed 21 months ago by johnv

Replying to bmoffitt:

1.) Recovery (tftp) flash AirOS 5.6.3 onto the radio; then
2.) Using the fwupdate command in AirOS, flash AirOS 5.5.11 onto the radio; then
3.) Again using the fwupdate command, flash OpenWRT onto the radio.

This sequence seems to work on every PicoStation and NanoStation Loco M2 XM I have gotten SO FAR. Oddly, downgrading a radio that came with AirOS 5.6 running on it to AirOS 5.5 DID NOT WORK - it appears that it is necessary to do the recovery (tftp) flash of AirOS 5.6 before you downgrade to 5.5. I honestly cannot explain it, but, so far, this sequence seems the only way to reliably flash OpenWRT onto a PicoStation, Bullet, or NanoStation Loco M2 that comes running AirOS 5.6.

Can you confirm the 5.6.X version that was installed on the units when you received them? There is a Fix in the UBNT changelog for 5.6.4:

  • Fix: After FW downgrade to 5.5.6 device goes to read-only state (TFTP recovery to previous airOS version is required to restore normal operation)

So wondering if the ones that you have that you are unable to simply downgrade back to 5.5.11, are prior to 5.6.4 or not. And if so, if you could upgrade to 5.6.4, then downgrade to 5.5.11, and the OpenWRT. Getting messier but still might be easier then tftp.

comment:33 follow-up: Changed 21 months ago by gareth41@…

I have a bunch of Picostations here purchased about a month ago, all had 5.6.2 on them and I downgraded AirOS using the web gui to 5.5.11, then I could load openwrt CC.

The u-boot version changed in 5.6.x, the flash layout is the same from what I can see in the stock firmware contrary to what other people have said.

I tried loading trunk over 5.6.2 and could not save any settings. It's something to do with this new u-boot version. I think someone needs to get hold of the source code of new u-boot from UBNT and analyze it, shouldn't be too difficult given its GPL licensed and providing that UBNT comply.

comment:34 in reply to: ↑ 33 Changed 21 months ago by LeSpocky

Replying to gareth41@…:

I tried loading trunk over 5.6.2 and could not save any settings. It's something to do with this new u-boot version. I think someone needs to get hold of the source code of new u-boot from UBNT and analyze it, shouldn't be too difficult given its GPL licensed and providing that UBNT comply.

I sent a mail to Ubiquiti support today requesting those sources, but after reading http://libertybsd.net/ubiquiti/ and http://community.ubnt.com/t5/Business-Talk/Any-update-on-GPL-licence-violation/m-p/1428448#M47832 I'm not so sure if this will work out. :-/

comment:35 Changed 21 months ago by johnv

Based on the log, and what Matt says above, the issue is U-Boot used to unlock the flash memory in 5.5.X. In 5.6.X U-Boot no longer does this (presumably AirOS does it now).

The issue seems to be how to make OpenWrt also unlock the flash across all UBNT flash chips since it assumes the U-Boot did this already, which is no longer does.

Based on this, getting a hold of the new U-Boot doesn't seem like it will provide much information since the unlocking of the flash was removed from the U-Boot. But I fully admit I do not know everything about this, just using logic, which could be flawed.

"One patch I backported to CC fixes the locked flash issue with Macronix flash chip (model name starts with "mx"), but we've found out that UBNT also uses Winbond flash chips (which are detected as "s25fl064k" in the kernel log, which is actually the name of a Spansion chip, but Winbond and Spansion share the JEDEC identifier). I've tried to fix this up in the same way as the Macronix flash was fixed (see [1]), but this fix was not effective."

comment:36 Changed 21 months ago by johnv

Just to keep adding to this. DD-WRT seems to have fixed the issue for them. However no indication if this was for all flash, or the same one Matt fixed for OpenWRT.

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=285332&sid=aeec8655af7967577eb42f124be1f61f

Anyone have a friend at DD-WRT that could point us to a solution?

comment:37 follow-up: Changed 20 months ago by johnv

Just wanted to update that Matthias has a patch to fix the problem. I have tested on CC on Bullet M2's and can now install OpenWrt onto the new U-Boot without any flash issues. It also installs onto the old U-Boot.

He had to backport a number of files to CC. Thank you Matthias for the work on this.

Because of the LEDE/OpenWrt discussions, he is waiting to release a patch to CC.

comment:38 Changed 20 months ago by johnv

Here is a link to the commit, but this is not directly for CC.

https://github.com/freifunk-gluon/gluon/issues/687#ref-commit-dd0535c

comment:39 in reply to: ↑ 37 Changed 18 months ago by KelieT

Hi,

I wondered if anyone had Matthias's contact information. We would like to either get a copy of the code or hire him to assist us with a similar problem we are having with our ubiquities.

Thank you,
Kelie

comment:40 Changed 18 months ago by joseph.a.marlin@…

Matthias Schiffer <mschiffer@…> is the email he signs his commits with.

comment:41 Changed 18 months ago by anonymous

Yeah, I guess that's not going to work. Here's a link to a commit:

https://lists.openwrt.org/pipermail/openwrt-devel/2016-February/039997.html

Add Comment

Modify Ticket

Action
as new .
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.