OpenWrt Forum Archive

Topic: Bricked WAG160Nv2 - bootloader says Download mode1111 ... press enter

The content of this topic has been archived between 2 Oct 2014 and 30 Mar 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Is there a way to force a reboot via JTAG? The router is in the office with the serial and JTAG interfaces hooked up, and if I could issue a reboot remotely I can continue tinkering.

Thanks, this provides more info:

james.harper wrote:
...
get pid2 at0xbffbd00b
...
Creating 5 MTD partitions on "bcm963xx":
0x000000000000-0x000000010000 : "CFE"
0x000000010100-0x0000000f0000 : "kernel"
mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
0x0000000f0000-0x0000003e0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=2A0000, len=140000
0x0000002a0000-0x0000003e0000 : "rootfs_data"
0x0000003e0000-0x0000003f0000 : "ath_data"
0x0000003f0000-0x000000400000 : "nvram"
...
no pid2
WARNING!! - FIRMWARE HAD BEEN DESTORYED!!
            YOU NEED RE-DOWNLOAD FIRMWARE!!

Some bytes in CFE were definitely changed but I don't know yet when that happened.

According to the print above pid2 is in the flash at offset 0x3bd00b, i.e. in the rootfs_data, where the jffs2 is created - as you expected it.
I don't know the best solution - removing the pid2 check from the CFE is a bit tricky as th CFE is compressed in order to fit into 64kB.
Shrinking the rootfs_data area isn't nice either. Maybe some other CFE (e.g. from the DG834NB, same SoC and ethernet switch) would help?  But the nvram layout might be different.
compatible between both.

looked again into this firmware.

It contains identical blocks of data (each 0x46 bytes) at flash offset 0xff80 (end of the bootloader) and 0x3be040 (after the kernel area)

000000  73  45  72  43  6f  4d  6d  00  00  00  00  59  50  58  00  00
         s   E   r   C   o   M   m nul nul nul nul   Y   P   X nul nul
000010  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
       nul nul nul nul nul nul nul nul nul nul nul nul nul nul nul nul
000020  00  00  00  00  00  00  00  00  00  00  00  00  00  41  00  30
       nul nul nul nul nul nul nul nul nul nul nul nul nul   A nul   0
000030  38  00  00  00  00  00  00  00  00  20  14  00  00  00  00  73
         8 nul nul nul nul nul nul nul nul  sp dc4 nul nul nul nul   s
000040  45  72  43  6f  4d  6d
         E   r   C   o   M   m

Maybe pid2 refers to the second block and the CFE just checks if there is such a block after the last area specified in the header at flash offset 0x10100?
I.e. the location of pid2 isn't at a fixed address but determined by the firmware loaded?

I dumped the header of the openwrt image from this thread  (openwrt-96358GW-squashfs-bc310-cfe.bin) and dumped the header at offset 0 (as it doesn't contain a CFE opposite to the vendor firmware image):

    vendor: Broadcom Corporatio
   version: ver. 2.0
  board_id: 6358
 router_id: 96358GW
 data size: 0x0028ff04
  data_crc: 0xb9e756f0 (calc. 0xb9e756f0)
header_crc: 0x5510d5ec (calc. 0x5510d5ec)
  0. area: size 0x00000000  addr 0x00000000
  1. area: size 0x001b0004  addr 0xbfc10100
  2. area: size 0x000dff00  addr 0xbfc10100
  3. area: size 0x00000000  addr 0x00000000
  4. area: size 0xbfcf0000  addr 0x00000000
  5. area: size 0x00000000  addr 0x00000000

Looks like this one occupies 0xbfc10000..0xbfe9ff04 only, i.e. any pid2 at 0xbffbd00b would be left from a previous image.

James, could you check what is at offset 0x3bd00b in the original firmware binaries? [s]Or would you mind sending me the original firmware binaries per email?[/s] (just saw your pm)

(Last edited by jal2 on 27 Dec 2010, 10:16)

I had a look into James' binary dumps of the original (vendor) firmware.
It contains this binary block

000000  73  45  72  43  6f  4d  6d  00  00  00  00  59  50  58  00  00
         s   E   r   C   o   M   m nul nul nul nul   Y   P   X nul nul
000010  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
       nul nul nul nul nul nul nul nul nul nul nul nul nul nul nul nul
000020  00  00  00  00  00  00  00  00  00  00  00  00  00  41  00  30
       nul nul nul nul nul nul nul nul nul nul nul nul nul   A nul   0
000030  38  00  00  00  00  00  00  00  00  20  11  00  00  00  00  73
         8 nul nul nul nul nul nul nul nul  sp dc1 nul nul nul nul   s
000040  45  72  43  6f  4d  6d
         E   r   C   o   M   m

twice at flash offset 0xff80 (end of CFE) and 0x3bd00c (just after the kernel). I guess that's what the CFE refers to as pid and pid2.
As the CFE boots once successfully after flashing the openwrt image, which contains a different header at offset 0x10000, it cannot
determine the location of pid2 from the header. I guess CFE just scans the flash, which makes life easier for us.

Next step is to enhance the openwrt firmware image to contain the above block (preferably at the end of the kernel).

fyi wrote:

In order to strip off the necessary part from the Linksys firmware, you need to understand the firmware format.

BTW, the source code of the imagetag tool at tools/firmware-utils/src gives a detailed picture of the header (bcm_tag.h).

I tried the firmware that jal2 provided, and now it does this:

CFE version 1.0.37-5.4 for BCM96358 (32bit,SP,BE)
Build Date: 2009å¹´ 03æ 31æ¥ ææäº 17:07:55 CST (root@localhost.localdomain)
Copyright (C) 2000-2005 Broadcom Corporation.

Boot Address 0xbfc00000

Initializing Arena.
Initializing Devices.
Parallel flash device: name MX29LV320AB, id 0x22a8, size 4096KB
798
875
0x6:0x11f
0x6:0x108
0x6:0x108
CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz
Total memory: 33554432 bytes (32MB)

Total memory used by CFE:  0x80401000 - 0x80533000 (1253376)
Initialized Data:          0x8041C0E0 - 0x8041CDD0 (3312)
BSS Area:                  0x8041CDD0 - 0x80431000 (82480)
Local Heap:                0x80431000 - 0x80531000 (1048576)
Stack Area:                0x80531000 - 0x80533000 (8192)
Text (code) segment:       0x80401000 - 0x8041C0D8 (110808)
Boot area (physical):      0x00533000 - 0x00573000
Relocation Factor:         I:00000000 - D:00000000

Board IP address                  : 192.168.1.1
Host IP address                   : 192.168.1.100
Gateway IP address                :
Run from flash/host (f/h)         : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 1
Board Id Name                     : 96358GW
Psi size in KB                    : 24
Number of MAC Addresses (1-32)    : 10
Base MAC Address                  : 00:22:6b:ff:8c:f1
Ethernet PHY Type                 : Internal
Memory size in MB                 : 32
CMT Thread Number                 : 0

get pid2 at0xbfe9ff7f
pid checked!
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Code Address: 0x80010000, Entry Address: 0x80010000
Decompression OK!
Entry at 0x80010000
Closing network.
Starting program at 0x80010000
Linux version 2.6.32.9 (virus@Virion) (gcc version 4.3.3 (GCC) ) #18 Mon Mar 15 16:16:55 CET 2010
Detected Broadcom 0x6358 CPU revision a1
CPU frequency is 300 MHz
32MB of RAM installed
registering 40 GPIOs
board_bcm963xx: CFE version: 1.0.37-5.4
bootconsole [early0] enabled
CPU revision is: 0002a010 (Broadcom BCM6358)
board_bcm963xx: board name: 96358GW
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 32kB, VIPT, 2-way, linesize 16 bytes.
Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Memory: 29724k/32768k available (2050k kernel code, 3044k reserved, 363k data, 136k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:128
Calibrating delay loop... 299.00 BogoMIPS (lpj=598016)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
ath: Register ath_data_device at address 0x1ffe1000
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
audit: initializing netlink socket (disabled)
type=2000 audit(0.197:1): initialized
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
msgmni has been set to 58
io scheduler noop registered
io scheduler deadline registered (default)
gpiodev: gpio device registered with major 254
gpiodev: gpio platform device registered with access mask FFFFFFFF
bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0100 (irq = 10) is a bcm63xx_uart
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
bcm963xx_flash: 0x00400000 at 0x1fc00000
bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
bcm963xx_flash: Read Signature value of CFE1CFE1
bcm963xx_flash: CFE bootloader detected
bcm963xx_flash: CFE boot tag found with version 6, board type 96358GW, and tagid bcram.
bcm963xx_flash: Partition 0 is CFE offset 81ce1e48 and length 0
bcm963xx_flash: Partition 1 is kernel offset d2b and length 0
bcm963xx_flash: Partition 2 is rootfs offset d6c and length 0
bcm963xx_flash: Partition 3 is ath_data offset dad and length 0
bcm963xx_flash: Partition 4 is nvram offset df0 and length 0
bcm963xx_flash: Spare partition is 2a0000 offset and length 150000
Creating 5 MTD partitions on "bcm963xx":
0x000000000000-0x000000010000 : "CFE"
0x000000010100-0x0000000f0000 : "kernel"
mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
0x000000010100-0x000000300104 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs" set to be root filesystem
split_squashfs: no squashfs found in "bcm963xx"
0x0000003e0000-0x0000003f0000 : "ath_data"
0x0000003f0000-0x000000400000 : "nvram"
bcm63xx_enet MII bus: probed
bcm63xx_wdt started, timer margin: 30 sec
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
jffs2: Flash size not aligned to erasesize, reducing to 3008KiB
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x8001 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x8001 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000008: 0x000d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000000c: 0x5d00 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000014: 0x081c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0xe9db instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000001c: 0x433e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000020: 0xd5cb instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000024: 0x1ef1 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000028: 0xe010 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0xcd5f instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0xc74d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010008: 0x1846 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001000c: 0x1086 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010010: 0x9fc5 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010014: 0x6171 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0xece3 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001001c: 0x762c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010020: 0x47e1 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010024: 0xaff5 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020000: 0x5f74 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020004: 0xaa3f instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020008: 0x7462 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0002000c: 0x2dc9 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020010: 0x14a6 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020014: 0xef9f instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020018: 0x8bb0 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0002001c: 0x5f6e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020020: 0x9b8d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020024: 0xc00c instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00030000: 0xfe87 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00030004: 0x5ffd instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00030008: 0xc3a6 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0003000c: 0x5f9a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00030010: 0xb902 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00030014: 0xa170 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00030018: 0xa511 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0003001c: 0x343d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00030020: 0xbdc4 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00030024: 0xf7b6 instead
Further such events for this erase block will not be printed
Old JFFS2 bitmask found at 0x000371c8
You cannot use older JFFS2 filesystems with newer kernels
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040000: 0x24fa instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040004: 0xf616 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040008: 0x9fda instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0004000c: 0x1310 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040010: 0x275f instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040014: 0xcc35 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040018: 0x8ba5 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0004001c: 0xf37c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040020: 0x7268 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00040024: 0x9877 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00050000: 0xaa26 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00050004: 0xd6c7 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00050008: 0x21fe instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0005000c: 0x065e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00050010: 0xe178 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00050014: 0x3632 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00050018: 0x8dd8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0005001c: 0x4ab6 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00050020: 0x0f11 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00050024: 0x1e2e instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060000: 0x7a4a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060004: 0x18b4 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060008: 0x6748 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0006000c: 0xa5d6 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060010: 0x4e1d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060014: 0x2939 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060018: 0xa032 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0006001c: 0xe25a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060020: 0x427d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00060024: 0x6852 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00070000: 0xa2e2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00070004: 0x2747 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00070008: 0x05f2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0007000c: 0xe019 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00070010: 0xdeae instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00070014: 0x11a1 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00070018: 0xc771 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0007001c: 0xdf3c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00070020: 0x00ec instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00070024: 0x91ef instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00080000: 0x0c56 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00080004: 0xec12 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00080008: 0x2ae8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0008000c: 0xfd9b instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00080010: 0xbddd instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00080014: 0x6d2d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00080018: 0xfcec instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0008001c: 0x5c40 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00080020: 0xce08 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00080024: 0x9158 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00090000: 0xfa34 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00090004: 0x51bb instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00090008: 0xeb2e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0009000c: 0xc1bf instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00090010: 0x95cb instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00090014: 0x74d1 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00090018: 0xd8c2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0009001c: 0x0e2b instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00090020: 0x8ec4 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00090024: 0xe3f9 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000a0000: 0xcfc1 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000a0004: 0xb2a8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000a0008: 0x716c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000a000c: 0xfa21 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000a0010: 0xc607 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000a0014: 0x4781 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000a0018: 0xbbce instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000a001c: 0x040e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000a0020: 0x67e3 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000a0024: 0xa00a instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000b0000: 0x52ee instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000b0004: 0x7a72 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000b0008: 0x40fc instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000b000c: 0xd5b3 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000b0010: 0x8396 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000b0014: 0x4150 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000b0018: 0x55ee instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000b001c: 0x1879 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000b0020: 0x8710 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000b0024: 0xf61a instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0000: 0xebc9 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0004: 0xfd04 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0008: 0xaaac instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c000c: 0x9079 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0010: 0x8c16 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0014: 0x9b6c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0018: 0x95a5 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c001c: 0xd9c8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0020: 0x12e7 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000c0024: 0xc5a6 instead
Further such events for this erase block will not be printed
Old JFFS2 bitmask found at 0x000c30e4
You cannot use older JFFS2 filesystems with newer kernels
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000d0000: 0xa1b2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000d0004: 0xcd2a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000d0008: 0xc4a1 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000d000c: 0x8f41 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000d0010: 0xa7e1 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000d0014: 0xa4cb instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000d0018: 0xd7a0 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000d001c: 0x053d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000d0020: 0x439e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000d0024: 0x3f44 instead
Further such events for this erase block will not be printed
Empty flash at 0x000dff38 ends at 0x000dff40
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000e0000: 0x44a6 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000e0004: 0x5cf0 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000e0008: 0xe0ed instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000e000c: 0xacbc instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000e0010: 0xbd75 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000e0014: 0x1734 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000e0018: 0x2ded instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000e001c: 0x4b61 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000e0020: 0x4167 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000e0024: 0x16c7 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000f0000: 0x654f instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000f0004: 0xf31d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000f0008: 0x59dc instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000f000c: 0x72ae instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000f0010: 0x92a4 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000f0014: 0x6e54 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000f0018: 0xdd2b instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000f001c: 0x34ed instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000f0020: 0xf00a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000f0024: 0x61e0 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00100000: 0x7ce8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00100004: 0x12ea instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00100008: 0x30bd instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0010000c: 0x652d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00100010: 0x4f2d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00100014: 0xbfd9 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00100018: 0x2e24 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0010001c: 0x2ab8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00100020: 0x364c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00100024: 0x1b0a instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00110000: 0x9893 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00110004: 0x3998 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00110008: 0x5d9c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0011000c: 0xda22 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00110010: 0x3886 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00110014: 0x4e69 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00110018: 0x4ca8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0011001c: 0xfca0 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00110020: 0x175b instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00110024: 0x6f4e instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00120000: 0x5c99 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00120004: 0x9194 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00120008: 0x8488 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0012000c: 0x8ef4 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00120010: 0x6f2c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00120014: 0x9f03 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00120018: 0xa2f4 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0012001c: 0x7cf8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00120020: 0xed87 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00120024: 0xeed6 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00130000: 0xf3f8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00130004: 0xb156 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00130008: 0x3c9f instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0013000c: 0x2ef6 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00130010: 0x8c88 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00130014: 0xd21f instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00130018: 0x4faa instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0013001c: 0xf13d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00130020: 0xb77a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00130024: 0xcbd0 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00140000: 0x70c7 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00140004: 0x8b70 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00140008: 0x58d4 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0014000c: 0xd9de instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00140010: 0x2d53 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00140014: 0x1b96 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00140018: 0xb47c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0014001c: 0x20cf instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00140020: 0xb997 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00140024: 0x2bd6 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00150000: 0xcc56 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00150004: 0x2e6e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00150008: 0x00ab instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0015000c: 0x4a79 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00150010: 0x41bf instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00150014: 0x9bfe instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00150018: 0x03fa instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0015001c: 0xd588 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00150020: 0xa086 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00150024: 0x7913 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00160000: 0x39a3 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00160004: 0x9f2d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00160008: 0xf25d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0016000c: 0x70a9 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00160010: 0x7531 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00160014: 0x69b9 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00160018: 0xb177 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0016001c: 0x6c80 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00160020: 0x09d9 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00160024: 0x7db9 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00170000: 0x57d0 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00170004: 0x9732 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00170008: 0x714b instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0017000c: 0xd98e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00170010: 0x870e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00170014: 0x2a87 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00170018: 0x935b instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0017001c: 0xc1c0 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00170020: 0x539a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00170024: 0x92fa instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00180000: 0x2dca instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00180004: 0x6ebb instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00180008: 0xf1a4 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0018000c: 0xad41 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00180010: 0x0af3 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00180014: 0x9095 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00180018: 0x6641 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0018001c: 0x6fbf instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00180020: 0xe732 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00180024: 0x1c54 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00190000: 0x2555 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00190004: 0xffca instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00190008: 0xa703 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0019000c: 0x4688 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00190010: 0xfa47 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00190014: 0x70b7 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00190018: 0x6fbf instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0019001c: 0xbc88 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00190020: 0xdc69 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00190024: 0x627a instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001a0000: 0x55e8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001a0004: 0xd53b instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001a0008: 0xd597 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001a000c: 0x3a80 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001a0010: 0x33f2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001a0014: 0x0bd1 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001a0018: 0xddd5 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001a001c: 0x4096 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001a0020: 0x9eba instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001a0024: 0x3269 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001b0000: 0xd23c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001b0004: 0x5a82 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001b0008: 0xe10c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001b000c: 0x9770 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001b0010: 0x2c0c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001b0014: 0xf167 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001b0018: 0x50da instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001b001c: 0x99b0 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001b0020: 0x325c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001b0024: 0xcc94 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001c0000: 0x7886 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001c0004: 0x4eec instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001c0008: 0xafda instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001c000c: 0x40aa instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001c0010: 0xffc9 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001c0014: 0xaaa6 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001c0018: 0xcc00 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001c001c: 0xd4fe instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001c0020: 0x6afb instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001c0024: 0xb808 instead
Further such events for this erase block will not be printed
Old JFFS2 bitmask found at 0x001c38c0
You cannot use older JFFS2 filesystems with newer kernels
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001d0000: 0x9fb2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001d0004: 0x57bc instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001d0008: 0x442a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001d000c: 0x4f10 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001d0010: 0xa92e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001d0014: 0x52d2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001d0018: 0x1cec instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001d001c: 0xe637 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001d0020: 0x8746 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001d0024: 0x8a42 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001e0000: 0xfbdd instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001e0004: 0x6c0e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001e0008: 0xf6bb instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001e000c: 0x85dd instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001e0010: 0x7cae instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001e0014: 0x18b4 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001e0018: 0x2bbc instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001e001c: 0x61b1 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001e0020: 0x71ac instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001e0024: 0xed93 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001f0000: 0x8a70 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001f0004: 0x79ff instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001f0008: 0x6b0a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001f000c: 0x9e19 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001f0010: 0x36aa instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001f0014: 0x2c1c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001f0018: 0xa870 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001f001c: 0xd30a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001f0020: 0xa40f instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001f0024: 0x7dcb instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00200000: 0x73da instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00200004: 0x2f82 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00200008: 0xa9f8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0020000c: 0x7a7d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00200010: 0xacc6 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00200014: 0x2337 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00200018: 0x3bec instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0020001c: 0x5725 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00200020: 0x84ea instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00200024: 0x3b2f instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00210000: 0x2a57 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00210004: 0xc9b2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00210008: 0x3f5f instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0021000c: 0x9372 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00210010: 0x78be instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00210014: 0x63fa instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00210018: 0x2034 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0021001c: 0xb844 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00210020: 0xb13b instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00210024: 0x569b instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00220000: 0x98c2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00220004: 0xee8c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00220008: 0x508e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0022000c: 0x2098 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00220010: 0x9f13 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00220014: 0x25a3 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00220018: 0x99b2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0022001c: 0x9ef1 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00220020: 0x1c3d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00220024: 0x07cb instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00230000: 0x4960 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00230004: 0xde62 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00230008: 0xec4c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0023000c: 0xcacd instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00230010: 0x9a0a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00230014: 0x68c2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00230018: 0x9710 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0023001c: 0x5c52 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00230020: 0x8017 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00230024: 0xb794 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00240000: 0x32e8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00240004: 0xd21d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00240008: 0xc947 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0024000c: 0x7bdd instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00240010: 0x287f instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00240014: 0x05af instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00240018: 0x3078 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0024001c: 0xed8c instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00240020: 0xa203 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00240024: 0x6af9 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00250000: 0x4279 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00250004: 0x135d instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00250008: 0x24ba instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0025000c: 0xd103 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00250010: 0x565a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00250014: 0x1fde instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00250018: 0x9a79 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0025001c: 0xc7df instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00250020: 0x9306 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00250024: 0xa9d6 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00260000: 0x1e56 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00260004: 0xdca9 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00260008: 0x79a5 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0026000c: 0x7ac1 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00260010: 0x6788 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00260014: 0x3dee instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00260018: 0xe424 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0026001c: 0x716e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00260020: 0xdd6a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00260024: 0xf4f9 instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00270000: 0x8cfe instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00270004: 0x5adb instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00270008: 0x1dc9 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0027000c: 0xfdee instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00270010: 0xff4e instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00270014: 0xb329 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00270018: 0xf112 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0027001c: 0xdfc5 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00270020: 0x7730 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00270024: 0xe77a instead
Further such events for this erase block will not be printed
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00280000: 0xf7ec instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00280004: 0x28a2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00280008: 0x005b instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0028000c: 0x4bd5 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00280010: 0x3318 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00280014: 0x4533 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00280018: 0xbb8a instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0028001c: 0xf4d8 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00280020: 0x0394 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00280024: 0x001e instead
Further such events for this erase block will not be printed
Old JFFS2 bitmask found at 0x0028157c
You cannot use older JFFS2 filesystems with newer kernels
Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes
empty_blocks 6, bad_blocks 0, c->nr_blocks 47
VFS: Cannot open root device "mtdblock2" or unknown-block(31,2)
Please append a correct "root=" boot option; here are the available partitions:
1f00              64 mtdblock0 (driver?)
1f01             895 mtdblock1 (driver?)
1f02            3008 mtdblock2 (driver?)
1f03              64 mtdblock3 (driver?)
1f04              64 mtdblock4 (driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)

Maybe the pid2 structure overwrote something? I think that was one of your concerns.

thanks

James

(Last edited by james.harper on 2 Jan 2011, 11:15)

james.harper wrote:

I tried the firmware that jal2 provided, and now it does this:

FYI: I took the firmware from here,
extracted the kernel and rootfs, stripped the last 128 byte from rootfs (just to save a flash sector, hoping these zeros were paddings),
added what I assume to be a pid2 area (see above) and created an image from kernel and modified rootfs using the imagetag tool.

james.harper wrote:
...
0x000000010100-0x000000300104 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs" set to be root filesystem
split_squashfs: no squashfs found in "bcm963xx"
...
jffs2: Flash size not aligned to erasesize, reducing to 3008KiB
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x8001 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x8001 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000008: 0x000d instead
...

Maybe the pid2 structure overwrote something? I think that was one of your concerns.

Seems like I damaged the rootfs as it wasn't recognized as squashfs anymore. I'll try again.

james.harper wrote:

I tried a 96358 image on a WAG160Nv2. The first few images linux said that the board wasn't supported on boot, but now it doesn't get that far and the bootloader says something like (yes, the spelling and grammer is exactly as printed on the serial console):

How did you flash the OpenWRT images into your WAG160Nv2? I've got a WAG160Nv2 (Annex.B) today and tried to flash the image made by Virus in this thread via the web interface. During this it complains about a wrong hw id (on the serial line). Are the *cfe* images meant to be flashed via the CFE command line only?

What's the pinout of the JTAG connector? Do I have to add the missing resistors (one array, two single Rs)?

Thanks,
Joerg

jal2 wrote:
james.harper wrote:

I tried a 96358 image on a WAG160Nv2. The first few images linux said that the board wasn't supported on boot, but now it doesn't get that far and the bootloader says something like (yes, the spelling and grammer is exactly as printed on the serial console):

How did you flash the OpenWRT images into your WAG160Nv2? I've got a WAG160Nv2 (Annex.B) today and tried to flash the image made by Virus in this thread via the web interface. During this it complains about a wrong hw id (on the serial line). Are the *cfe* images meant to be flashed via the CFE command line only?

The only way I could flash was via the serial console. Nothing else would let me do it. I wasn't watching the serial line when I tried via the web or tftp push.

jal2 wrote:

What's the pinout of the JTAG connector? Do I have to add the missing resistors (one array, two single Rs)?

Using the same pinouts as WRT54G just worked for me (once I remembered to attach to ground!). The image on the WIKI (yours?) shows that the left side is all ground except for that bottom-most pin so it's pretty straightforward to figure out which is which.s

Sorry for the long delay. I'm still trying to figure out the correct firmware format to flash an OpenWRT image via the
webinterface of the vendor firmware, as this shall be the preferred way to flash OpenWRT to this device.

Although the header looks like the one of the vendor firmware it still fails with a checksum error (on the console).
It seems like the web interface requires an CFE image in the first 64kB of the image, with a pid area at offset 0xff80.
No clue if it really flashes the CFE or just checks the pid. Maybe this pid area contains a crc as well?

Any help is appreciated!

jal2 wrote:

Although the header looks like the one of the vendor firmware it still fails with a checksum error (on the console).
It seems like the web interface requires an CFE image in the first 64kB of the image, with a pid area at offset 0xff80.
No clue if it really flashes the CFE or just checks the pid. Maybe this pid area contains a crc as well?

Any help is appreciated!

So just to clarify, you boot the router with the factory installed firmware, try and do the update, and the serial console tells you there is a checksum error, right?

Looking at the upgrade_flash.cgi file, it references /dev/mtdblock1, /dev/mtdblock2 and /dev/mtdblock5. I think the CFE was mtdblock2 wasn't it?

Does the make_PID tool in the Linksys source release help at all?

actually makeImage_4M is probably more interesting. It takes the loader, the kernel+fs, and the PID file (make by make_PID) and creates an image out of it.

Using a 32K bootloader (dd from /dev/zero) and a 2M kernel+fs (also dd from /dev/zero) it creates a file that is:
PID at ff80 (as you have already discovered)
16 bytes of data at ffd0
PID at 210000 (next flash boundary past the flash?)
unused data is all ff

The 16 bytes at ffd0 vary wildly with any change to the PID. I haven't checked anything else but I suspect they might be a hash of the image data or something?

reverse engineering makeImage would probably tell you, but maybe it's easier to figure out than that?

Definitely an MD5 hash. To calculate it the same as makeImage does, do the following (determined by a bit of tinkering):

1. pad the CFE out to 65408 bytes (64K - 128 bytes) with 0xFF
2. Insert the PID padded out with NULLs at FF80
3. Append the rest of the image
4. Calculate the MD5 on the resulting data and put it at FFD0

Is this just what openwrt already does or is this unique to the WAG160Nv2?

James,

thanks a lot for your investigations!
I completely forgot to look at the Linksys source tree, just tried to understand upgrade_flash.cgi.

james.harper wrote:

Is this just what openwrt already does or is this unique to the WAG160Nv2?

OpenWRT does not (yet) add a CFE, the images just start with the header (flash offset 0x10000).
I guess the pid/md5sum is needed in the web images of other routers as well (WAG160N, DG834NB) while
the pid/pid2 checking inside the bootloader seems to be a speciality of the WAG160Nv2.

I'll have a look at makeImage_4M and try to incorporate your algorithm into the OpenWRT build.

james.harper wrote:

Definitely an MD5 hash. To calculate it the same as makeImage does, do the following (determined by a bit of tinkering):

1. pad the CFE out to 65408 bytes (64K - 128 bytes) with 0xFF
2. Insert the PID padded out with NULLs at FF80
3. Append the rest of the image
4. Calculate the MD5 on the resulting data and put it at FFD0

Just found out that in step 3) the image must include the pid2 area.
I wonder how upgrade_flash.cgi determines the image size: either by looking for
the pid2 or from the header at file offset 0x10000.

jal2 wrote:
james.harper wrote:

Definitely an MD5 hash. To calculate it the same as makeImage does, do the following (determined by a bit of tinkering):

1. pad the CFE out to 65408 bytes (64K - 128 bytes) with 0xFF
2. Insert the PID padded out with NULLs at FF80
3. Append the rest of the image
4. Calculate the MD5 on the resulting data and put it at FFD0

Just found out that in step 3) the image must include the pid2 area.
I wonder how upgrade_flash.cgi determines the image size: either by looking for
the pid2 or from the header at file offset 0x10000.

I forgot to add that makeImage does append a PID to the kernel too.

I don't know where the ath_data fits in to all this either...

james.harper wrote:

I don't know where the ath_data fits in to all this either...

AFAIK ath_data contains WLAN calibration data. It isn't part of any firmware update, but written during production only.

jal2 wrote:
james.harper wrote:

I don't know where the ath_data fits in to all this either...

AFAIK ath_data contains WLAN calibration data. It isn't part of any firmware update, but written during production only.

That's what I thought, but the docs say that you should back it up before flashing OpenWRT so I was concerned it would be overwritten.

james.harper wrote:
jal2 wrote:
james.harper wrote:

I don't know where the ath_data fits in to all this either...

AFAIK ath_data contains WLAN calibration data. It isn't part of any firmware update, but written during production only.

That's what I thought, but the docs say that you should back it up before flashing OpenWRT so I was concerned it would be overwritten.

I don't think OpenWRT limits the rootfs size in order to protect this partition. If you compile your own image and select
enough packages you may easily overwrite it.

I've successfully tweaked OpenWRT's imagetag tool into producing a firmware which is accepted by the vendor firmware on the web interface - put the vendor cfe in front, added a pid area after the kernel (which may be wrong - see below) and calculated the md5sum as James described above.

OpenWRT started fine just once, unfortunately the bootloader still shows the pid2 error at the following boot.

I've added a pid area right at the end of the kernel. OpenWRT puts the kernel first in the flash (to allow jffs2 fs to grow), while the vendor firmware always has the read-only rootfs first and the kernel at the end (with the pid2 attached to it).
I may put the second pid area at the end of the rootfs of OpenWRT, but this will always require a read-only rootfs.

If I press the reset button during power-up, I get:

get pid at0xbfcedc81                                                            
SerialNumber53534831304a41303432383500                                          
Language:3000                                                                   
PinCode:3233333632333639                                                        
bffe1000:0                                                                      
Download mode1111 ... press enter to stop

while the power LED is flashing red/green. But the pid address printed is the second pid after the kernel ...
I currently have no soldering equipment around, so it will take some days to recover my hardware.
I'll look into the bootloader to figure out what that "Download mode" is and where it looks for the pid2.

I'm guessing that OpenWRT is overwriting the pid2 when it builds the filesystem...

Can you use the Linksys tool to build the image and see if it's any different?

james.harper wrote:

I'm guessing that OpenWRT is overwriting the pid2 when it builds the filesystem...

Yes, it does. But I don't understand how the bootloader remembers the location of the pid2. On the first, successful boot
of OpenWRT the bootloader says:

get pid2 at0xbffd688c
pid checked!

The address is the address of the second pid in the vendor image minus 1. I assumed the bootloader would either search the whole flash
for pid2 (the OpenWRT image contains one at a lower address) or calculate it from the header area at flash offset 0x10000 (which had already been overwritten by the OpenWRT image).

Can you use the Linksys tool to build the image and see if it's any different?

It certainly will be different as it puts the rootfs first (I guess this would confuse OpenWRT's mtd code)
and does not add the same paddings.

I'll take a closer look at the pid contents in the vendor and OpenWRT images, maybe it's a wrong value in the second one.

james.harper wrote:

I'm wondering if 'Download mode1111' might mean I have an opportunity to load a new firmware via the serial port.

I've looked into this Download mode while my board was broken (and I had no JTAG). Seems like this is the same protocol as used by the sercomm utility mentioned in the DD-WRT forum (binary and Windows only :-() and the upslug2 tool. The WAG160Nv2 behaves similar to the NSLU2: Press Reset, then power up and wait until the power LED flashes red/green -> Update mode.

As I wasn't sure how much NSLU2 specific stuff is contained in upslug2 (and I'm rather bad in C++) I wrote a small demo program in C sending a single GET_VERSION_INFO over ethernet to the WAG160Nv2 and it responds to it!

Does anyone else want to continue to investigate this? I'd like to look into the pid2 problem and my time is limited.
Drop me an email if you want the demo program.

Guys, I've followed this topic and remain amazed at all of your abilitys but can anyone answer the simple question re the WAG160N V1, Openwrt refers to this as supported under 10.0.3 with the name BRCM63XX, but there are a multitude of files there - which is the correct one. I have the converted CA42 connected to the serial port but have not got a clue which file to upload. I would rather not brick my router/modem but this is so obvious that I simply cannot see how to do it. Linksys Web firmware loader rejects all and if I stop the serial to enable upload firmware then it reject it too, as for TFTP no success either - AAAH, which file?
John