Hi everyone,
I was trying to flash the fullimage.bin from post #280 to my 904 LTE box via TFTP,
curiously it was accepting the image and starting to erase the flash, only to figure out that something is wrong with the expected image size / offset:
ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK
ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK
nand_read_page - 00000008
DDR autotuning Rev 0.3c
DDR size from 0xa0000000 - 0xa7ffffff
DDR check ok... start booting...
U-Boot 2010.06-Lv2.0.40-A0.3 (Jul 12 2012 - 22:00:12)
CLOCK CPU 500M RAM 250M
DRAM: 128 MiB
NAND: NAND device: Manufacturer ID: 0xec, Chip ID: 0xdc (Samsung NAND 512MiB 3,
3V 8-bit)
512 MiB
Bad block table found at page 262080, version 0x01
Bad block table found at page 262016, version 0x01
nand_read_bbt: Bad block at 0x0000002e0000
nand_read_bbt: Bad block at 0x00001e680000
In: serial
Out: serial
Err: serial
Net: Internal phy(GE) firmware version: 0x040b
vr9 Switch
Type "run flash_nfs" to mount root filesystem over NFS
reset button pressed --> 1
reset button pressed --> 2
reset button pressed --> 3
reset button pressed --> 4
reset button pressed --> 5
reset button pressed --> 6
reset button pressed --> 7
enter rescue process ...
Uncompressing LCD bootup images ...............
NAND read: device 0 offset 0x0000000004700000, size 0x0000000000300000
0x300000 bytes read: OK
Using vr9 Switch device
TFTP from server 192.168.2.100; our IP address is 192.168.2.1
Filename 'fullimage.img'.
Load address: 0x80800000
Loading: T T #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#########################
done
Bytes transferred = 5127544 (4e3d78 hex)
verify firmware validation: loadaddr = 0x80800000, filesize = 5127544
firmware is ok !
NAND erase: device 0 offset 0x0000000004440000, size 0x0000000000100000
Erasing at 0x4520000 -- 100% complete.
OK
NAND erase: device 0 offset 0x0000000002240000, size 0x0000000001e00000
Erasing at 0x4020000 -- 100% complete.
OK
NAND erase: device 0 offset 0x0000000004040000, size 0x0000000000400000
Erasing at 0x4420000 -- 100% complete.
OK
Saving Environment to NAND...
Erasing at 0x4560000 -- 100% complete.
done
Image contains header with name [MIPS LEDE fakeroot]
erasing 0x00040000 size 0x01e00000
Skipping bad block at 0x002e0000
Erasing at 0x1e20000 -- 100% complete. Cleanmarker written at 0x1e20000.
erase OK
writing to 0x00040000 size 0x00000000
write 0x00000000 bytes: OK
Erasing at 0x4560000 -- 100% complete.
done
Image contains header with name [MIPS LEDE Linux-4.9.14]
Cannot upgrade image f_kernel_addr.
Error : From start address 0x01e40000, the new size 5127408 is bigger than begi
ning of next image/end of the partition 0x02240000
Can not upgrade the image kernel
Could the stock flash layout be different between xDSL and LTE variants?
Upon power-cycling the box, I assumed the kernel image must have been erased already, but curiously it was still there and trying to boot:
(...)
Hit any key to stop autoboot: 0
Uncompressing LCD bootup images ...............
NAND read: device 0 offset 0x0000000004700000, size 0x0000000000300000
0x300000 bytes read: OK
1. bootid : 0, bootnum : 0
Erasing at 0x4560000 -- 100% complete.
done
2. bootid : 0, bootnum : 1
NAND read: device 0 offset 0x0000000001e40000, size 0x0000000000400000
0x400000 bytes read: OK
## Booting kernel from Legacy Image at 80800000 ...
Image Name: MIPS LTQCPE Linux-2.6.32.32
Created: 2014-09-05 4:30:35 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1441728 Bytes = 1.4 MiB
Load Address: 80002000
Entry Point: 800061b0
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
Lantiq xDSL CPE VR9
mips_hpt_frequency = 250000000, counter_resolution = 2
I was actually expecting kernel panic (could not mount rootfs) but it was now stuck in a bootloop after "... counter_resolution = 2"
So it seems the bootloop might be due to a suppressed kernel panic when no valid rootfs was found!? (...and there is no console output or system halt, but the manufacturer rather chose to perform a reset immediately...)
The latest LTE stock firmware from the vodafone website was not accepted via tftp recovery...
Bytes transferred = 31383681 (1dee081 hex)
verify firmware validation: loadaddr = 0x80800000, filesize = 31383681
0x81af5040 magic number not found
...flashing the xDSL stock firmware worked but also results in a bootloop.
Has anyone figured out how to enable UART mode for the LTE variant yet? The board layout is quite different from xDSL (the resistor labeled R148 is actually populated on the LTE board, so the naming is definetly not related)
In any case - I will try to build and flash some recovery fullimages tomorrow as described earlier in this thread, maybe I can get back to stock firmware for a while and try getting dropbear access for a start...