FS#3656 - DGND3700 v2 - Boot loop

[openwrt-bot]

prommy:

Boot

[openwrt-bot]

prommy:

HELO
CPUI
L1CI
HELO
CPUI
L1CI
DRAM

PHYS
ZQDN
PHYE
DINT
LASY
USYN
MSYN
LMBE
PASS

ZBSS
CODE
DATA
L12F
MAIN
NAN0
BT31
0001
NAN9
NAN3
RFS0
NAN5

CFE version 1.0.38-112.14 for BCM96362 (32bit,SP,BE)
Build Date: 2011年 12月 21日 星期三 18:16:05 CST (sunny@localhost)
Copyright (C) 2000-2011 Broadcom Corporation.

NAND flash device: name , id 0x2075 block 16KB size 32768KB
External switch id = 53125
SC Debug: Setting RGMII TX_CLK DELAY at SWITCH IMP PORT!
SC Debug: Setting RGMII RX_CLK DELAY at SWITCH IMP PORT!
Chip ID: BCM6362B0, MIPS: 400MHz, DDR: 333MHz, Bus: 166MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000

Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-5) : 96362ADVN2xh
Number of MAC Addresses (1-32) : 11
Base MAC Address : 4c:60:de:88:0c:fc
PSI Size (1-64) KBytes : 24
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Main Thread Number [0|1] : 0

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1#1#0
Enter NMRP_main
Scanning Flash Section 0...
Scanning Flash Section 1...
Scanning Flash Section 2...
Scanning Flash Section 3...
Scanning Flash Section 4...
Scanning Flash Section 5...
Scanning Flash Section 6...
Scanning Flash Section 7...
Scanning Flash Section 8...
Scanning Flash Section 9...
Scanning Flash Section 10...
Scanning Flash Section 11...
Scanning Flash Section 12...
NMRP:LISTENING

No NMRP Server found

Scanning Flash Section 0...
Scanning Flash Section 1...
Scanning Flash Section 2...
Scanning Flash Section 3...
Scanning Flash Section 4...
Scanning Flash Section 5...
Scanning Flash Section 6...
Scanning Flash Section 7...
Scanning Flash Section 8...
Scanning Flash Section 9...
Scanning Flash Section 10...
Scanning Flash Section 11...
Scanning Flash Section 12...

---

Sercomm Boot Version 1...0.6

---

0 Block in Flag Section Find Sercomm Sign!
Entering Firmware : Everything is OK.

Booting from Primary image (0xb8080000) ...
Decompression OK!
Entry at 0x80a00000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
22 buffers found.
Closing DMA Channels.
Starting program at 0x80a00000
[ 0.000000] Linux version 5.4.91 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r15556-20a0d435d8)) #0 SMP Wed Jan 20 06:47:29 2021
[ 0.000000] Detected Broadcom 0x6362 CPU revision b0
[ 0.000000] CPU frequency is 400 MHz
[ 0.000000] 64MB of RAM installed
[ 0.000000] board_bcm963xx: Boot address 0xb8000000
[ 0.000000] board_bcm963xx: CFE version: 1.0.38-112.14
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0002a070 (Broadcom BMIPS4350)
[ 0.000000] board: board name: 96362ADVN2xh
[ 0.000000] MIPS: machine is Netgear DGND3700v2
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] percpu: Embedded 14 pages/cpu s26192 r8192 d22960 u57344
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16240
[ 0.000000] Kernel command line: rootfstype=squashfs,ubifs noinitrd console=ttyS0,115200
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 55460K/65536K available (6236K kernel code, 220K rwdata, 1308K rodata, 1316K init, 209K bss, 10076K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=16, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[ 0.000000] NR_IRQS: 256
[ 0.000000] random: get_random_bytes called from start_kernel+0x338/0x56c with crng_init=0
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns
[ 0.000014] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns
[ 0.008145] Calibrating delay loop... 397.82 BogoMIPS (lpj=795648)
[ 0.046449] pid_max: default: 32768 minimum: 301
[ 0.051588] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.059146] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.072908] rcu: Hierarchical SRCU implementation.
[ 0.079274] smp: Bringing up secondary CPUs ...
[ 0.085790] SMP: Booting CPU1...
[ 9.628460] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[ 9.628479] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[ 9.628734] CPU1 revision is: 0002a070 (Broadcom BMIPS4350)
[ 0.121332] Synchronize counters for CPU 1:
[ 0.121354] SMP: CPU1 is running
[ 0.121378] done.
[ 0.151929] smp: Brought up 1 node, 2 CPUs
[ 0.165469] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[ 0.175544] futex hash table entries: 512 (order: 1, 8192 bytes, linear)
[ 0.182724] pinctrl core: initialized pinctrl subsystem
[ 0.190151] NET: Registered protocol family 16
[ 0.435757] registering PCI controller with io_map_base unset
[ 0.494368] PCI host bridge to bus 0000:00
[ 0.498241] random: fast init done
[ 0.499093] pci_bus 0000:00: root bus resource [mem 0x10f00000-0x10ffffff]
[ 0.509172] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 0.516141] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 0.523143] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.531323] pci 0000:00:00.0: [14e4:6362] type 01 class 0x060400
[ 0.537601] pci 0000:00:00.0: PME# supported from D0 D3hot
[ 0.545222] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 0.555186] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[ 0.562016] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[ 0.568806] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 0.574192] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[ 0.588280] clocksource: Switched to clocksource MIPS
[ 0.597704] NET: Registered protocol family 2
[ 0.605807] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[ 0.614619] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.622632] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.629975] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.637062] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.643918] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.651798] NET: Registered protocol family 1
[ 0.656429] PCI: CLS 0 bytes, default 16
[ 0.664853] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[ 0.697989] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.704103] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.718973] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[ 0.734339] bcm6362-pinctrl 10000080.pin-controller: registered at mmio (ptrval)
[ 0.743842] 10000100.serial: ttyS0 at MMIO 0x10000100 (irq = 11, base_baud = 1562500) is a bcm63xx_uart
[ 0.753604] printk: console [ttyS0] enabled
[ 0.753604] printk: console [ttyS0] enabled
[ 0.762202] printk: bootconsole [early0] disabled
[ 0.762202] printk: bootconsole [early0] disabled
[ 0.785534] nand: device found, Manufacturer ID: 0x20, Chip ID: 0x75
[ 0.792307] nand: ST Micro NAND 32MiB 3,3V 8-bit
[ 0.797040] nand: 32 MiB, SLC, erase size: 16 KiB, page size: 512, OOB size: 16
[ 0.804591] bcm6368_nand 10000200.nand: detected 32MiB total, 16KiB blocks, 512B pages, 16B OOB, 8-bit, Hamming ECC
[ 0.815737] Bad block table found at page 65504, version 0x01
[ 0.821916] Bad block table found at page 65472, version 0x01
[ 0.829326] 7 fixed-partitions partitions found on MTD device brcmnand.0
[ 0.836262] Creating 7 MTD partitions on "brcmnand.0":
[ 0.841556] 0x000000000000-0x000000004000 : "cferom"
[ 0.849723] 0x000000004000-0x000001c80000 : "wfi"
[ 2.224728] 0x000001c80000-0x000001cc0000 : "flag"
[ 2.233010] 0x000001cc0000-0x000001d00000 : "pcbasn"
[ 2.241181] 0x000001d00000-0x000001d80000 : "xxx"
[ 2.249263] 0x000001d80000-0x000001dc0000 : "language_dev"
[ 2.258113] 0x000001dc0000-0x000001ec0000 : "scnvram"
[ 2.269844] bcm63xx-spi 10000800.spi: at [mem 0x10000800-0x10000f0b flags 0x200] (irq 10, FIFOs size 542)
[ 2.285342] libphy: Fixed MDIO Bus: probed
[ 2.290701] bcm63xx_enetsw bcm63xx_enetsw.0: IRQ index 1 not found
[ 2.340686] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec
[ 2.353745] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 2.360979] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 2.368133] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 2.375286] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 2.382450] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 2.394327] NET: Registered protocol family 10
[ 2.402859] Segment Routing with IPv6
[ 2.406917] NET: Registered protocol family 17
[ 2.411599] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 2.424939] 8021q: 802.1Q VLAN Support v1.8
[ 2.457667] /dev/root: Can't open blockdev
[ 2.461957] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[ 2.469623] Please append a correct "root=" boot option; here are the available partitions:
[ 2.478236] 1f00 16 mtdblock0
[ 2.478242] (driver?)
[ 2.484948] 1f01 29168 mtdblock1
[ 2.484953] (driver?)
[ 2.491651] 1f02 256 mtdblock2
[ 2.491655] (driver?)
[ 2.498388] 1f03 256 mtdblock3
[ 2.498393] (driver?)
[ 2.505114] 1f04 512 mtdblock4
[ 2.505120] (driver?)
[ 2.511808] 1f05 256 mtdblock5
[ 2.511813] (driver?)
[ 2.518530] 1f06 1024 mtdblock6
[ 2.518535] (driver?)
[ 2.525266] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 2.533778] Rebooting in 1 seconds..


[ynezz]

OpenWrt 19.07 release is EOL, try to reproduce the issue with latest supported release and feel free to ask for issue reopening if the problem is still present, thanks.

[infrastation]

This bug still steadily occurs using current OpenWrt releases exactly as described here and elsewhere for the earlier releases. The steps to reproduce are as follows:

1. Take a DGND3700v2 with the vendor's firmware 1.1.0.26.
2. Replace the firmware with openwrt-22.03.3-bcm63xx-smp-netgear_dgnd3700-v2-squashfs-cfe.bin using the "CFE" method as documented.
3. Boot and use OpenWrt 22.03.3 as usual, everything works except the WAN Ethernet port (which is a known problem), reboots work fine.
4. Upgrade OpenWrt using LuCi and openwrt-22.03.4-bcm63xx-smp-netgear_dgnd3700-v2-squashfs-sysupgrade.bin and watch it reboot the device afterwards.
5. The device is stuck in the boot loop because of the failure to find the root filesystem, as can be observed on the serial console.

If after that you break into the bootloader and start the TFTP server (sc_tftpd y, AFAIR), this allows to flash the device back into the vendor's 1.1.0.26 firmware. However, after that any attempts to flash OpenWrt using the "CFE" method will flash the image, but it will not boot because of the same boot loop. So the root cause is likely related to effects that survive on the flash, possibly MTD partitioning.