How to fix device firmware with a microSD card



  • Good day to everyone, my dear Omega fans!

    Today I've faced with a problem when my device got corrupted after an attempt to perform a restore. Unfortunately, the restore bricked my device and it was almost unrecoverable.

    Let's start with what i had:

    [   27.629441] =====================================================
    [   27.635625] Channel 1 : Dirty = 780, False CCA = 0, Busy Time = 3909, Skip Channel = FALSE
    [   27.644023] Channel 2 : Dirty = 652, False CCA = 0, Busy Time = 1623, Skip Channel = FALSE
    [   27.652419] Channel 3 : Dirty = 668, False CCA = 0, Busy Time = 1426, Skip Channel = FALSE
    [   27.660815] Channel 4 : Dirty = 684, False CCA = 0, Busy Time = 1454, Skip Channel = FALSE
    [   27.669205] Channel 5 : Dirty = 700, False CCA = 0, Busy Time = 3033, Skip Channel = FALSE
    [   27.677583] Channel 6 : Dirty = 1150, False CCA = 0, Busy Time = 3913, Skip Channel = FALSE
    [   27.686065] Channel 7 : Dirty = 760, False CCA = 0, Busy Time = 1967, Skip Channel = FALSE
    [   27.694461] Channel 8 : Dirty = 756, False CCA = 0, Busy Time = 1824, Skip Channel = FALSE
    [   27.702857] Channel 9 : Dirty = 752, False CCA = 0, Busy Time = 316, Skip Channel = FALSE
    [   27.711165] Channel 10 : Dirty = 748, False CCA = 0, Busy Time = 995, Skip Channel = FALSE
    [   27.719554] Channel 11 : Dirty = 1000, False CCA = 0, Busy Time = 4141, Skip Channel = FALSE
    [   27.728105] =====================================================
    [   27.734296] Rule 1 CCA value : Min Dirtiness (Include extension channel) ==> Select Channel 2
    [   27.743036] Min Dirty = 652
    [   27.745865] ExChannel = 0 , 0
    [   27.748879] BW        = 20
    [   28.551976] device eth0.1 entered promiscuous mode
    [   28.556855] device eth0 entered promiscuous mode
    [   28.588837] br-wlan: port 1(eth0.1) entered forwarding state
    [   28.594681] br-wlan: port 1(eth0.1) entered forwarding state
    [   30.588807] br-wlan: port 1(eth0.1) entered forwarding state
    [   32.028929] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: 8701d944
    [   32.028929]
    [   32.042988] Rebooting in 3 seconds..
    

    After the last line have shown up the device was dead already, LED indicator wasn't flashing. I've figured out that somehow the restore wasn't complete and left certain files that made kernel boot broken and subsequently it left the device half-broken.

    So, I was quite desperate because Google told me that most of such problems led to a purchase of a new chip because somehow the device remained to be broken and totally unrecoverable.

    I decided to go through standard recovery steps to see if it helps. The first step was to attempt to connect to the device using a serial port because there was no chance to make the device's networking work. This where I get logs from, this is how I figured out why the device doesn't boot. So, serial port communication ability is a killer feature when your device is broken.

    Okay, so, I knew that device is not functioning and there has to be a way to fix the filesystem and OS itself. So, the official manuals recommend the following ways:

    • restoring firmware from a USB storage device - yeah, quite a useful feature, but really, how many of us keep the USB storage device in FAT?
    • web recovery - I found this recommendation the most useless because you need to have an Ethernet extension, you need to have an RJ45 cord. I'm a person with latest MacBook Pro, you implicitly recommend to buy an Ethernet adapter for Mac? Ugh, I'd better buy new Omega 2 chips rather than that.

    Unfortunately, at the cursory glance, I found out that none of these methods really can help me restore a device. You are probably aware that Omega 2+ does have a microSD slot on a chip. So, I starting researching how a microSD card would be recognised by the OpenWRT on MIPS and it appeared that there is no difference between a USB storage device mounted through USB port and mounted microSD card onto card slot.

    What a miracle! Once I followed the steps from USB storage device recovery Omega 2+ started to boot:

    [  110.473667] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
    [  110.480886] jffs2_build_filesystem(): unlocking the mtd device... done.
    [  110.487600] jffs2_build_filesystem(): erasing all blocks after the end marker...  done.
    [  227.207528] jffs2: notice: (1755) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    
    
    
    BusyBox v1.26.2 () built-in shell (ash)
    
       ____       _             ____
      / __ \___  (_)__  ___    / __ \__ _  ___ ___ ____ _
     / /_/ / _ \/ / _ \/ _ \  / /_/ /  ' \/ -_) _ `/ _ `/
     \____/_//_/_/\___/_//_/  \____/_/_/_/\__/\_, /\_,_/
     W H A T  W I L L  Y O U  I N V E N T ? /___/
     -----------------------------------------------------
       Ω-ware: 0.1.10 b160
     -----------------------------------------------------
    
    

    It took about 8 minutes to make the device functional. A Miracle! The key takeaway here is that tutorials are always incomplete, especially those ones about the recovery from a "brick-like" mode. If you’d ask if that is possible to restore Omega 2+ from a microSD — yes, you can. If you’d ask where can i read about that — nowhere, but starting this moment you can find here, in my blog.



  • @Denys-Makogon said in How to fix device firmware with a microSD card:

    What a miracle! Once I followed the steps from USB storage device recovery Omega 2+ started to boot:
    ...
    It took about 8 minutes to make the device functional. A Miracle! The key takeaway here is that tutorials are always incomplete, especially those ones about the recovery from a "brick-like" mode. If you’d ask if that is possible to restore Omega 2+ from a microSD — yes, you can.

    Sorry I'm afraid you are wrong.

    Omega2+ (v0.2.0 b190) Onion Omega2 UBoot Version: 4.3.0.3

       ____       _             ____
      / __ \___  (_)__  ___    / __ \__ _  ___ ___ ____ _
     / /_/ / _ \/ / _ \/ _ \  / /_/ /  ' \/ -_) _ `/ _ `/
     \____/_//_/_/\___/_//_/  \____/_/_/_/\__/\_, /\_,_/
     W H A T  W I L L  Y O U  I N V E N T ? /___/"
    
    Board: Onion Omega2 APSoC DRAM:  128 MB
    relocate_code Pointer at: 87f60000
    flash manufacture id: c2, device id 20 19
    find flash: MX25L25635E
    ============================================
    Onion Omega2 UBoot Version: 4.3.0.3
    --------------------------------------------
    ASIC 7628_MP (Port5<->None)
    DRAM component: 1024 Mbits DDR, width 16
    DRAM bus: 16 bit
    Total memory: 128 MBytes
    Flash component: SPI Flash
    Date:Oct 18 2016  Time:17:29:05
    ============================================
    icache: sets:512, ways:4, linesz:32 ,total:65536
    dcache: sets:256, ways:4, linesz:32 ,total:32768
    CPU freq = 575 MHZ
    Estimated memory size = 128 Mbytes
    Resetting MT7628 PHY.
    Initializing MT7688 GPIO system.
    
    
    **************************************
    * Hold Reset button for more options *
    **************************************
    
    
    You have 40 seconds left to select a menu option...
    
    
    Please select option: 
       [ Enter ]: Boot Omega2.
       [ 0 ]: Start Web recovery mode.
       [ 1 ]: Start command line mode.
       [ 2 ]: Flash firmware from USB storage. 
    
    Option [2] selected.
    System Load Linux then write to Flash via USB Storage.
    Looking for a USB Storage.
    If suitable image is found on USB Storage writing to Flash will be attempted.
    U-Boot will look for a FAT file system.
    (Re)start USB...   
    LOW LEVEL INIT USB0:
    Scanning bus 0 for devices...
    New Device 0
    usb_control_msg: request: 0x6, requesttype: 0x80
    value 0x100 index 0x0 length 0x8
    usb_control_msg: status = success?
    
     INSIDE USB INIT   
    
     INSIDE USB INIT: Device responded.
    set address 1
    usb_control_msg: request: 0x5, requesttype: 0x0
    value 0x1 index 0x0 length 0x0
    usb_control_msg: status = success?
    usb_control_msg: request: 0x6, requesttype: 0x80
    value 0x100 index 0x0 length 0x12
    usb_control_msg: status = success?
    usb_control_msg: request: 0x6, requesttype: 0x80
    value 0x200 index 0x0 length 0x9
    usb_control_msg: status = success?
    usb_control_msg: request: 0x6, requesttype: 0x80
    value 0x200 index 0x0 length 0x19
    usb_control_msg: status = success?
    get_conf_no 0 Result 25, wLength 25
    if 0, ep 0
    ##EP epmaxpacketin[1] = 2
    set configuration 1
    usb_control_msg: request: 0x9, requesttype: 0x0
    value 0x1 index 0x0 length 0x0
    usb_control_msg: status = success?
    new device strings: Mfr=0, Product=1, SerialNumber=0
    usb_control_msg: request: 0x6, requesttype: 0x80
    value 0x300 index 0x0 length 0xFF
    usb_control_msg: status = success?
    USB device number 1 default language ID 0x409
    usb_control_msg: request: 0x6, requesttype: 0x80
    value 0x301 index 0x409 length 0xFF
    usb_control_msg: status = success?
    Manufacturer
    Product      OHCI Root Hub
    SerialNumber
    Device is a hub?   
    usb_control_msg: request: 0x6, requesttype: 0xA0
    value 0x2900 index 0x0 length 0x4
    usb_control_msg: status = success?
    usb_control_msg: request: 0x6, requesttype: 0xA0
    value 0x2900 index 0x0 length 0x9
    usb_control_msg: status = success?
    usb_control_msg: request: 0x0, requesttype: 0xA0
    value 0x0 index 0x0 length 0x4
    usb_control_msg: status = success?
    usb_control_msg: request: 0x1, requesttype: 0x23
    value 0x8 index 0x1 length 0x0
    usb_control_msg: status = success?
    usb_control_msg: request: 0x0, requesttype: 0xA3
    value 0x0 index 0x1 length 0x4
    usb_control_msg: status = success?
    usb_control_msg: request: 0x3, requesttype: 0x23
    value 0x8 index 0x1 length 0x0
    usb_control_msg: status = success?
    usb_control_msg: request: 0x0, requesttype: 0xA3
    value 0x0 index 0x1 length 0x4
    usb_control_msg: status = success?
    usb_control_msg: request: 0x0, requesttype: 0xA3
    value 0x0 index 0x1 length 0x4
    usb_control_msg: status = success?
    usb_control_msg: request: 0x1, requesttype: 0x23
    value 0x10 index 0x1 length 0x0
    usb_control_msg: status = success?
    usb_control_msg: request: 0x3, requesttype: 0x23
    value 0x4 index 0x1 length 0x0
    usb_control_msg: status = success?
    usb_control_msg: request: 0x0, requesttype: 0xA3
    value 0x0 index 0x1 length 0x4
    usb_control_msg: status = success?
    cannot reset port 1!?
    1 USB Device(s) found
    scan end
           Scanning bus for storage devices...
    
    =================================================
    1: Hub,  USB Revision 1.10
     -  OHCI Root Hub  
     - Class: Hub
     - PacketSize: 8  Configurations: 1
     - Vendor: 0x0000  Product 0x0000 Version 0.0
    USB_STORAGE: 0 Storage Device(s) found
    No USB Storage found. No F/W upgrade from USB Storage will be attempted.
    

    The essence of the above log:

    Option [2] selected.
    System Load Linux then write to Flash via USB Storage.
    Looking for a USB Storage.
    If suitable image is found on USB Storage writing to Flash will be attempted.

    USB_STORAGE: 0 Storage Device(s) found
    No USB Storage found. No F/W upgrade from USB Storage will be attempted.

    After this message your Omega2+ performed a normal boot.
    I think you did not rewrite the flash at all.
    Probably your kernel was not corrupted or you could fix it fully accidentally... ;-)

    So if you’d ask if that is possible to restore Omega 2+ from a microSD — no, you can't — at least not with this method.



Looks like your connection to Community was lost, please wait while we try to reconnect.