[SOLVED] Fritz!Box 7362 SL fail to boot

[naf71]

Hi everyone, Is two days I'm trying to restore this fritz with official recovery and is successful but the problems of boot persists.
Env is affixed:

Eva_AVM >printenv                 

HWRevision            203                         
HWSubRevision         1                       
ProductID             Fritz_Box_HW203                                     
SerialNumber          0000000000000000                                      
annex                 B                       
autoload              yes                         
bootloaderVersion     1.1904                            
bootserport           tty0                          
cpufrequency          500000000                               
firstfreeaddress      0x81114144                                
firmware_info         131.06.30                               
firmware_version      avm                         
flashsize             nor_size=0MB sflash_size=1024KB nand_size=128MB                                                                     
linux_fs_start        0                       
maca                  xx:xx:xx:xx:xx:00                                       
macb                  xx:xx:xx:xx:xx:01                                       
macwlan               xx:xx:xx:xx:xx:02                                       
macdsl                xx:xx:xx:xx:xx:03                                       
memsize               0x08000000
modetty0              38400,n,8,1,hw
modetty1              38400,n,8,1,hw
mtd0                  0x400000,0x3400000
mtd1                  0x0,0x400000
mtd2                  0x0,0x40000
mtd3                  0x40000,0xA0000
mtd4                  0xA0000,0x100000
mtd5                  0x0,0x200000
my_ipaddress          192.168.178.1
prompt                Eva_AVM
ptest
req_fullrate_freq     250000000
sysfrequency          250000000
urlader-version       2904
usb_board_mac         xx:xx:xx:xx:xx:04
usb_device_id         0x0000
usb_device_name       USB DSL Device
usb_manufacturer_name  AVM
usb_revision_id       0x0000
usb_rndis_mac         xx:xx:xx:xx:xx:05
wlan_key              01234567891234567890

I connected the serial cable and this is what comes out:

(AVM) EVA Revision: 1.1904 Version: 2904

(C) Copyright 2005 AVM Date: Oct 15 2013 Time: 13:57:18 (0) 3 0x0-0x740D

[FLASH:] WINBOND Uniform-Flash 1MB 256 Bytes WriteBuffer
[FLASH:](Eraseregion [0] 16 sectors a 64kB) 
[NAND:] 128MB MICRON 2048 Pagesize 128k Blocksize 1024 Blocks 8Bit 1 CS HW
[SYSTEM:] VR9 on 500MHz/250MHz/250MHz

.Atheros 8030/35 detected

Eva_AVM >##....................................
Lantiq xDSL CPE VR9
[    0.000000] Linux version 2.6.32.61 (hjortmann@EmbeddedVM) (gcc version 4.8.1 (Buildroot 2013.05) ) #1 SMP Tue May 5 11:31:15 CEST 2015
[    0.000000] phym = 08000000, mem = 08000000, max_pfn = 00008000
[    0.000000] Reserving memory for CP1 @0xa8000000, size 0x00000000
[    0.000000] [init_avm_kernel_config] AVM Kernel Config (ptr 806c6000)
[    0.000000] [init_avm_kernel_config] AVM Kernel Config: module memory entry
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019556 (MIPS 34Kc)
[    0.000000] Determined physical RAM map:
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00008000
[    0.000000] Movable zone start PFN for each node
[    0.000000] early_node_map[1] active PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00008000
[    0.000000] [module-alloc-by-name] 'modulemem' not in use, use AVM Kernel Config (8675328 bytes, reserved for module mem)
[    0.000000] [module-alloc] use 0x846000 bytes at 0x81101000
[    0.000000] 1 available secondary CPU TC(s)
[    0.000000] PERCPU: Embedded 7 pages/cpu @8194b000 s5760 r8192 d14720 u65536
[    0.000000] pcpu-alloc: s5760 r8192 d14720 u65536 alloc=16*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,115200n8r nor_size=0MB sflash_size=1024KB nand_size=128MB ethaddr=34:81:C4:2F:27:00 
[    0.000000] [NAND] nand_size = 0x8000000
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] wait instruction: r4k_wait_irqoff
[    0.000000] [avm_cache_set_coherency]: setting cache coherency for HWRevision=203 to write back allocate 
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00031864
[    0.000000] Readback ErrCtl register=00031864
[    0.000000] Memory: 113548k/131072k available (4744k kernel code, 17340k reserved, 2187k data, 212k init, 0k highmem)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:181
[    0.000000] [mips_cpu_irq_init] irq_base 0
[    0.000000] SRSConf0 0x3feffbfe: SRS1: 0xffffffff, SRS2 0xffffffff, SRS3 0xffffffff
[    0.000000] Console: colour dummy device 80x25
[    0.000000] console [ttyS0] enabled, bootconsole disabled
[    0.000000] console [ttyS0] enabled, bootconsole disabled
[    0.020000] Calibrating delay loop... 332.59 BogoMIPS (lpj=1662976)
[    0.240000] Security Framework initialized
[    0.240000] Mount-cache hash table entries: 512
[    0.250000] kernel_init: started
[    0.250000] kernel_init: kernel locked
[    0.250000] Limit of 2 TCs set
[    0.250000] TLB of 32 entry pairs shared by 2 VPEs
[    0.250000] VPE 0: TC 0, VPE 1: TC 1
[    0.250000] IPI buffer pool of 8 buffers
[    0.260000] CPU revision is: 00019556 (MIPS 34Kc)
[    0.490000] TC 1 going on-line as CPU 1
[    0.500000] Brought up 2 CPUs
[    0.510000] [yield_context_init] cpu=1 tc=2 mask=300
[    0.510000] [yield_context_init] cpu=0 tc=3 mask=410
[power_managment_setup] reset 'DSL, DFE, AFE, VOICE, DSLTC, ARC'
[power_managment_setup] reset 'LDO'
[power_managment_setup] power down 'PPE TC, PPE EMA, LEDC, DFEV1, DFEV0'
[power_managment_setup] power down 'MSI1, PDI1 PCIE1 PCIE1_PHY'
[power_managment_setup] power down 'USB CTRL'
[power_managment_setup] power down 'GPHY'
[power_managment_setup] disable power domain 'DSL + DFE'
[final_setup_dcdc] start
*((volatile unsigned char *)0xBF106A17) = 0x5A;
*((volatile unsigned char *)0xBF106A18) = 0x46;
*((volatile unsigned char *)0xBF106A11) = 0x13;
*((volatile unsigned char *)0xBf106a00) = 0;
*((volatile unsigned char *)0xBf106a01) = 0;
*((volatile unsigned char *)0xBf106a02) = 0xFF;
*((volatile unsigned char *)0xBf106a03) = 0xE6;
*((volatile unsigned char *)0xBf106a04) = 0;
*((volatile unsigned char *)0xBf106a05) = 0x1B;
*((volatile unsigned char *)0xBf106a15) = 0x8b;
*((volatile unsigned char *)0xBf106a17) = 0x80;
*((volatile unsigned char *)0xBf106a18) = 0x28;
*((volatile unsigned char *)0xBf106a06) = 0x52;
[final_setup_dcdc] done
[    0.620000] NET: Registered protocol family 16
[    0.620000] Lantiq GPIO driver, version 1.3.2, (c) 2001-2013 Lantiq Deutschland GmbH
[    0.630000] Reboot Status is: Power-On
[    0.630000] [avmnet] [avmnet_cfg_init] Driver version: 6.136  -  Revision 1496:2706  -  Di 5. Mai 11:30:48 CEST 2015
[    1.250000] ifx_pcie_wait_phy_link_up port 0 timeout
[    1.860000] ifx_pcie_wait_phy_link_up port 0 timeout
[    2.470000] ifx_pcie_wait_phy_link_up port 0 timeout
[    3.090000] ifx_pcie_wait_phy_link_up port 0 timeout
[    3.700000] ifx_pcie_wait_phy_link_up port 0 timeout
[    3.700000] pcie_rc_initialize port 0 link up failed!!!!!
[    3.710000] Lantiq PCIe Root Complex driver, version 2.0.0, (c) 2001-2013 Lantiq Deutschland GmbH
[    3.720000] bio: create slab <bio-0> at 0
[    3.730000] NET: Registered protocol family 8
[    3.730000] NET: Registered protocol family 20
[    3.740000] NET: Registered protocol family 2
[    3.740000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    3.740000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    3.740000] TCP bind hash table entries: 4096 (order: 4, 81920 bytes)
[    3.750000] TCP: Hash tables configured (established 4096 bind 4096)
[    3.760000] TCP reno registered
[    3.760000] NET: Registered protocol family 1
[    3.770000] IFX DMA driver, version ifxmips_dma_core.c:v1.0.17 ,(c)2009 Infineon Technologies AG
[    3.770000]  skb_shared_size:344
[    3.780000] Lantiq CGU driver, version 1.1.32, (c) 2001-2013 Lantiq Deutschland GmbH
[    3.790000] squashfs: version 3.4 (2008/08/26) Phillip Lougher
[    3.790000] fuse init (API version 7.13)
[    3.800000] msgmni has been set to 222
[    3.800000] io scheduler noop registered (default)
[    3.810000] [avm_membench_init]
[    4.060000] avm_net_trace: Up and running.
[    4.060000] [loadcontrol] set auto - scale=1
[    4.070000] [avm] configured: watchdog event debug 
[    4.070000] AVM_WATCHDOG: Watchdog Driver for AR7 Hardware (Version 1.0, build: May  5 2015 11:30:17)
[    4.090000] ifx_pmu_init: Major 247
[    4.090000] Lantiq PMU driver, version 1.2.6, (c) 2001-2013 Lantiq Deutschland GmbH
[    4.100000] Infineon Technologies RCU driver version 1.0.7 
[    4.100000] Lantiq Thermal Sensor driver, version 1.0.3, (c) 2001-2013 Lantiq Deutschland GmbH
[    4.110000] ttyS0 at MMIO 0x1e100c00 (irq = 107) is a PORT_IFX_ASC
[    4.120000] loop: module loaded
[    4.130000] nbd: registered device at major 43
[    4.140000] Generic platform RAM MTD, (c) 2004 Simtec Electronics
[    4.150000] Platform NOR MTD, (c) AVM 2010
[    4.150000] [HSNAND] Hardware-ECC activated
[    4.150000] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xf1 (Micron NAND 128MiB 3,3V 8-bit)
[    4.160000] Scanning device for bad blocks
[    4.250000] Creating 6 MTD partitions on "ifx_hsnand":
[    4.250000] 0x000000000000-0x000000400000 : "kernel"
[    4.260000] {ifx_mtd_add_notifier} name kernel
[    4.270000] 0x000000400000-0x000003400000 : "filesystem"
[    4.270000] {ifx_mtd_add_notifier} name filesystem
[    4.280000] 0x000003400000-0x000003800000 : "reserved-kernel"
[    4.280000] {ifx_mtd_add_notifier} name reserved-kernel
[    4.290000] 0x000003800000-0x000006800000 : "reserved-filesystem"
[    4.300000] {ifx_mtd_add_notifier} name reserved-filesystem
[    4.300000] 0x000006800000-0x000006a00000 : "config"
[    4.310000] {ifx_mtd_add_notifier} name config
[    4.310000] 0x000006a00000-0x000008000000 : "nand-filesystem"
[    4.320000] {ifx_mtd_add_notifier} name nand-filesystem
[    4.320000] Lantiq SSC driver, version 2.4.1, (c) 2001-2013 Lantiq Deutschland GmbH
[    4.330000] Creating 3 MTD partitions on "ifx_sflash":
[    4.330000] 0x000000000000-0x000000040000 : "urlader"
[    4.340000] {ifx_mtd_add_notifier} name urlader
[    4.340000] 0x000000040000-0x0000000a0000 : "tffs (1)"
[    4.350000] {ifx_mtd_add_notifier} name tffs (1)
[    4.350000] 0x0000000a0000-0x000000100000 : "tffs (2)"
[    4.360000] {ifx_mtd_add_notifier} name tffs (2)
[    4.360000] Lantiq SPI flash driver, version 1.1.9, (c) 2001-2013 Lantiq Deutschland GmbH
[    4.370000] tun: Universal TUN/TAP device driver, 1.6
[    4.370000] tun: (C) 1999-2004 Max Krasnyansky <[email protected]>
[    4.380000] IFX SWITCH API, Version 1.1.8.5
[    4.380000] SWAPI: Registered character device [switch_api] with major no [81]
[    4.390000] Switch API: PCE MicroCode loaded !!
[    4.400000] res = 87926500
[    4.400000] i2c /dev entries driver
[    4.400000] CAPI Subsystem Rev 1.1.2.8
[    4.410000] AVM PA 4.3.10 2014-09-21
[    4.410000] AVM PA skb pktinfo at offset 128 size 196
[    4.420000] [loadcontrol]module avm_pa registered
[    4.420000] IPv4 over IPv4 tunneling driver
[    4.430000] TCP cubic registered
[    4.430000] mcfw: IGMPv3 fast forwarding
[    4.430000] NET: Registered protocol family 10
[    4.440000] IPv6 over IPv4 tunneling driver
[    4.440000] NET: Registered protocol family 17
[    4.440000] NET: Registered protocol family 8
[    4.450000] atmpvc_init() failed with -17
[    4.450000] KOAM is loaded successfully.
[    4.460000] l2tp_core: L2TP core driver, V2.0
[    4.460000] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[    4.460000] l2tp_netlink: L2TP netlink interface
[    4.470000] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[    4.480000] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[    4.480000] 802.1Q VLAN Support v1.8 Ben Greear <[email protected]>
[    4.490000] All bugs added by David S. Miller <[email protected]>
[    4.490000] <ifx_fix_timing>
[    4.500000] TFFS: tiny flash file system driver. GPL (c) AVM Berlin (Version 2.0)
[    4.510000]       mount on mtd7 and mtd8 (double buffering)
[    4.510000] Adam2 environment variables API installed.
[    4.520000] [simple-profiling]: 2 performance counters implemented, NEW_34K
[    4.520000] Enable Performance Counter 0 for Data cache load/stores (User-Mode enabled Supervisor-Mode enabled Kernel-Mode enabled Exeption-Mode disable)
[    4.540000] Setup tcs=0x1 current_tc_mask=0x1, reg=0
[    4.540000] [simple-profiling]: 2 performance counters implemented, NEW_34K
[    4.550000] Enable Performance Counter 1 for Data cache load/store misses (User-Mode enabled Supervisor-Mode enabled Kernel-Mode enabled Exeption-Mode disable)
[    4.560000] Setup tcs=0x1 current_tc_mask=0x1, reg=1
[    4.570000] AVM Simple Profiling enabled Version 3.0
[    4.570000] {avmnet_cfg_netinit}
[    4.580000] [avmnet] No config found for HWRev 203, HWSubRev 1, Profile-ID 0, trying base config for HWSubRev
[    4.590000] [avmnet] No config found for HWRev 203, HWSubRev 1, trying base config for HWRev
[    4.600000] [avmnet] [avmnet_swi_7port_init] Init on module swi_vr9 called.
[    5.020000] Loading AVM Net Common Datapath Driver for 7Port Switch...... 
[    5.030000] [ppe_eth_init] init_hw()
[    5.030000] [init_hw] ppe_hw_init=0xff successful
[    5.040000] [ppe_eth_init] ifx_proc_file_create()
[    5.040000] [ppe_eth_init] dma_setup_init()
[    5.050000] [avmnet] [avmnet_swi_7port_disable_learning] Configuring CPU-port to receive all unknown unicast frames 0x68
[    5.060000] [avmnet] [avmnet_swi_7port_disable_learning] Configuring CPU-port to receive all unknown multicast frames 0x68
[    5.170000] [avmnet] [avmnet_links_port_update] Maximum port number 0 exceeded with 2!
[    5.170000] [avm_event_source_trigger]: not registered
[    5.180000] [avmnet] [avmnet_links_port_update] Maximum port number 0 exceeded with 2!
[    7.840000] [avm_pa_multiplexer_init] start 
[    7.840000] [avm_pa_multiplexer_init] init complete 
[    7.850000] [avm_pa_multiplexer_register_instance] 
[    7.850000]     add:avmnet_7port_pce_add_session+0x0/0x5a0 
[    7.850000]     remove:avmnet_7port_pce_remove_session+0x0/0x80
[    7.870000] kernel_init: basic setup done
[    7.870000] SQUASHFS error: Can't find a SQUASHFS superblock on mtdblock1
[    7.880000] yaffs: dev is 32505857 name is "mtdblock1" ro
[    7.880000] yaffs: passed flags ""
[    7.910000] VFS: Mounted root (yaffs filesystem) readonly on device 31:1.
[    7.920000] Freeing unused kernel memory: 212k freed
[    7.970000] trying /sbin/init
[    8.170000] [squashfs] use zip compression 
[VR9-flash] -- Test --

starting pid 140, tty '/dev/ttyS0': '/etc/init.d/rc.S'
mount: mounting proc on /proc failed: Device or resource busy
tar: removing leading '/' from member names
source files in group 0 ...
/etc/init.d/S00-signal    /etc/init.d/S05-watchdog  /etc/init.d/S09-rtc
/etc/init.d/S01-head      /etc/init.d/S08-tffs
/etc/init.d/S02-led       /etc/init.d/S09-config
[    8.690000] TFFS Name Table K
[config-space] detected mtdmtd4: size '2097152'
modprobe: module nand not found in modules.dep
[config-space][yaffs] driver is loaded
[config-space] using mtd4 for /var/flash
[    8.790000] yaffs: dev is 32505860 name is "mtdblock4" rw
[    8.790000] yaffs: passed flags ""
[config-space] /var/flash assigned @ /dev/mtdblock4
[    9.760000] [ifx_hsnand_command] read block is critical (status: 0xe8, column: 0x0 page: 0xecb)
[    9.770000] {ifx_hsnand_read_page_hwecc} page 0xecb Sector 2 1 Biterror 0 OOB-Biterror 0 ECC-Biterror
[   10.010000] [module-alloc-by-name] give 0x1a000 bytes at 0x81101000 to module 'led_modul_Fritz_Box_HW203' (0x82c000 bytes left)
[   10.020000] led_modul_Fritz_Box_HW203: module license '
[   10.020000] (C) Copyright 2012 by AVM
[   10.020000] ' taints kernel.
[   10.040000] Disabling lock debugging due to kernel taint
[   10.070000] [LED] use GPIO 32 for 'gpio_avm_led_power'
[   10.070000] [LED] use GPIO 38 for 'gpio_avm_led_internet'
[   10.070000] [LED] use GPIO 35 for 'gpio_avm_led_dect'
[   10.080000] [LED] use GPIO 36 for 'gpio_avm_led_wlan'
[   10.080000] [LED] use GPIO 47 for 'gpio_avm_led_info'
[   10.090000] [LED] use GPIO 34 for 'gpio_avm_led_info_red'
[   10.100000] [BUTTON] use GPIO 29 for 'gpio_avm_button_wlan'
[   10.100000] [BUTTON] use GPIO 1 for 'gpio_avm_button_dect'
[   10.110000] [register_bug_debug_table] name='led-modul' 0x8110de24 - 0x8110de38
[   10.120000] AVM_WATCHDOG: System Init UEberwachung 120 Sekunden
P-Defaults: not configured - skip.
[   10.670000] [module-alloc-by-name] give 0x2000 bytes at 0x8111b000 to module 'rtc_avm' (0x82a000 bytes left)
[   10.700000] rtc-avm rtc-avm.0: rtc core: registered avm as rtc0
[   10.700000] [avm-rtc]: avm_rtc_probe: register: ret=0x87343a00
[   10.710000] [avm-rtc]: avm_rtc_probe: success
exceute files in group 0 ...
/etc/init.d/E05-basemodules
group 0 done ...
source files in group 1 ...
/etc/init.d/S10-html        /etc/init.d/S12-default
/etc/init.d/S10-vm          /etc/init.d/S15-filesys
/etc/init.d/S11-config_def  /etc/init.d/S17-capi
/etc/init.d/S11-piglet      /etc/init.d/S17-tam
[   10.900000] 
[   10.900000] [avm_debug] redirecting kernel-messages (/dev/debug)

[   10.930000][1] [module-alloc-by-name] give 0xd000 bytes at 0x8111d000 to module 'Piglet_noemif' (0x81d000 bytes left)
[   10.930000][1] [module-alloc-by-name] 0xd000 bytes used, 0xeb80 bytes expected
[   10.950000][1] [piglet]use default-settings (1 gpio from hw_config)
[   11.030000][1] patch_dectfw: c0193000, totallen = 44879(af4f)
[   11.030000][1] patch_dectfw: patch_adress: a0 max_len: 26 with Version 2 Len: 17
[   11.030000][1] patch_dectfw: dectmode 1
[   11.030000][1] dect_loader: slow-bootmode
[   12.080000][1] [1]system-load 2  loadavg 0.23 0.5 0.2 - 38 tasks:79 % curr:modprobe(8 %) max:init(65 %, pid:1), readytorun: 3, pgfault 1447/s (max 2 avg 1.0)
[   13.000000][0] dect_loader: slow-bootmode
[   14.040000][0] [0]system-load 5  loadavg 0.23 0.5 0.2 - 38 tasks:14 % curr:modprobe(14 %) max:modprobe(14 %, pid:348), readytorun: 2, pgfault 846/s (max 1 avg 0.9)
[   15.600000][1] dect_loader: slow-bootmode
[   17.570000][0] dect_loader: slow-bootmode
[   20.170000][1] dect_loader: slow-bootmode
[   22.140000][0] dect_loader: slow-bootmode
[   24.190000][0] [0]system-load 5  loadavg 0.89 0.20 0.6 - 39 tasks:98 % curr:modprobe(98 %) max:modprobe(98 %, pid:348), readytorun: 3, pgfault 0/s (max 0 avg 0.0)
[   24.740000][1] dect_loader: fast-bootmode
[   25.790000][1] [1]system-load 3  loadavg 1.13 0.26 0.8 - 39 tasks:11 % curr:modprobe(11 %) max:modprobe(11 %, pid:348), readytorun: 3, pgfault 0/s (max 0 avg 0.0)
[   26.710000][0] dect_loader: fast-bootmode
[   29.310000][1] dect_loader: fast-bootmode
[   31.280000][0] dect_loader: fast-bootmode
[   33.880000][1] dect_loader: fast-bootmode
[   35.850000][0] dect_loader: fast-bootmode
[   36.890000][0] [0]system-load 5  loadavg 1.57 0.38 0.13 - 39 tasks:85 % curr:modprobe(85 %) max:modprobe(85 %, pid:348), readytorun: 3, pgfault 0/s (max 0 avg 0.0)
[   38.450000][1] dect_loader: fast-bootmode
[   39.500000][1] [1]system-load 3  loadavg 1.57 0.38 0.13 - 39 tasks:18 % curr:modprobe(18 %) max:modprobe(18 %, pid:348), readytorun: 3, pgfault 0/s (max 0 avg 0.0)
[   40.420000][0] dect_loader: fast-bootmode
[   43.020000][1] dect_loader: fast-bootmode
[   44.990000][0] dect_loader: fast-bootmode
[   45.040000] 
[   45.040000] ---- start avmdebug(suppress 0 bytes) ----
[   45.040000] [   45.040000][0] dect144xx_file_process: error on upload firstloader '/lib/modules/dectfw_firstlevel_441.hex'
[   45.040000] 
[   45.040000] ---- eof avmdebug ----
[   45.060000] Call Trace:
[   45.060000] [<800296a8>] dump_stack+0x8/0x40
[   45.060000] [<80060024>] panic+0x64/0x1a0
[   45.070000] [<c00f8228>] init_module+0x228/0x900 [Piglet_noemif]
[   45.070000] [<80011a9c>] do_one_initcall+0x3c/0x260
[   45.080000] [<800a2b78>] sys_init_module+0xd8/0x280
[   45.080000] [<800059dc>] stack_done+0x20/0x40
[   45.090000] 
[   45.090000] Kernel panic - not syncing: [piglet]bye bye - can't load dect-fw!
[   45.090000] 
[   45.100000] Rebooting in 5 seconds..
[   47.040000] [0]system-load 5  loadavg 1.95 0.50 0.17 - 39 tasks:73 % curr:modprobe(72 %) max:modprobe(72 %, pid:348), readytorun: 8, pgfault 0/s (max 0 avg 0.0)

ROM VER: 1.1.4
CFG 05
** START 

RVEC bf200000

[-][\][|][/][-][\][|][/][-][\][|][/][-][\][|][

Do you have any idea?
Thanks in advance

 

[informerex]

problem with: "can't load dect-fw!"

new recover: http://download.avm.de/fritz.box/fritzbox.7362_sl/x_misc/deutsch/

 

[PeterPawn]

Looks like a (DECT) hardware defect ... you could try to overwrite CONFIG_DECT and CONFIG_DECT2 via featovl.cfg. I'm not really sure, if these settings are important ... but it's worth a try to set both values to "N".

BTW: Your MAC address values in the "urlader" environment are a little bit strange ... they should consist of hexadecimal digits and never contain the character "X".

 

[naf71]

I try that recovery more than 10 times and is successful but the problem persists.

@ PerterPawn: I hid the real mac for privacy. I will try to edit the DECT COFIG as you said but I think it is a hardware problem because the fritz was given to me with the same symptoms.

 

[PeterPawn]

It's surely a hardware problem ... my suggestion should point you to a possible solution. If you set the mentioned values to "N", the components could stop trying to initialize the hardware (aka loadiing the firmware blobs).

 

[naf71]

Is possible perform this operation via serial or adam2 and what is the procedure

 

[PeterPawn]

You have to build an own TFFS image and store it via EVA in MTD3 and MTD4.

I've written some scripts to create such an image ... you may have a look at my GitHub repositories (https://github.com/PeterPawn/YourFritz/tree/master/tffs and https://github.com/PeterPawn/YourFritz/tree/master/eva_tools).

If you're not already familiar with FRITZ!Box devices and their software (aka FRITZ!OS), you have to read some larger sources first ... I'm in doubt, if this is a project with perspective - there's no "10 minutes to become a FRITZ!Box repair geek" solution available and if you consider the "real value" of a device with known defects (there may be others after you got a solution for the DECT problem), it may be not worth the efforts (if your skills need to be improved first).

My previous hint in #3 didn't consider a possible "knowledge gap" there ... only your question in #6 had drawn my attention to this problem.

 

[naf71]

I'm back after a short break I started my tests.
To exclude the hardware problem I extract the original firmware and disabled wlan and dect in rc.conf, I uploaded by eva the kernel.image in mtd1 and filesystem.image in mtd0 as specified for NAND flash https://freetz.org/wiki/help/howtos/development/flash but the device fail boot and i have to use the Avm recovery.exe to get it back. What I did wrong during the loading firmware for this device via Eva

 

[PeterPawn]

The Wiki content is rather old ... NAND devices will be flashed/programmed in another way.

You need a kernel and a specially crafted filesystem, they will be loaded together into RAM (via EVA) and executed - the contained initialization scripts decide and execute, what's needed to write the new data to the flash partitions.

If you've changed the rc.conf file manually, I'm in doubt your new filesystem has the right structure ... please explain it a little bit further, what you've done.

Even the Freetz build system isn't capable to create the right files (yet, perhaps it will be integrated in the (near) future), you've to get them from the created tar file and to combine them yourself, as shown in https://github.com/PeterPawn/YourFritz/blob/master/eva_tools/image2ram .

Afterwards you may upload the resulting file to the device using https://github.com/PeterPawn/YourFritz/blob/master/eva_tools/eva_to_memory .

Please keep in mind, that every script is only a proof-of-concept to show the needed steps ... maybe they have to be changed a little bit to suit your needs.

 

[Pokemon20021]

you could try to overwrite CONFIG_DECT and CONFIG_DECT2 via featovl.cfg.

You have to build an own TFFS image and store it via EVA in MTD3 and MTD4.

Hallo PeterPawn,
habe ich es richtig verstanden, dass zur Lösung der ursprünglichen Aufgabenstellung

echo "CONFIG_DECT=N" > /var/tmp/featovl.cfg
echo "CONFIG_DECT2=N" >> /var/tmp/featovl.cfg

das Programm https://github.com/PeterPawn/YourFritz/blob/master/eva_tools/eva_get_environment
zu verwenden ist ?

Nur wie kann ich die Datei featovl.cfg dann dem TFFS unterschieben ?
ich habe als Referenz nur Posting http://www.ip-phone-forum.de/showthread.php?t=285810&p=2162540&viewfull=1#post2162540 gesehen,
und da gibt es kein TFFS-Name featovl.cfg

Gruß
Pokemon20021

 

[PeterPawn]

Entweder die featovl.cfg aus einem funktionierenden System heraus befüllen (dann einfach mit "cat") oder mit https://github.com/PeterPawn/YourFritz/blob/master/tffs/build_tffs_image ein passendes TFFS bauen ... das ist dann zwar "leer" (FactoryReset) bis auf diese zusätzliche "featovl.cfg", aber das spielt dann wohl keine Rolle.

Das Skript baut zusätzlich beim Aufruf angegebene Dateien (der Name ist wichtig, habe ich irgendwo mal für @kingtutt erläutert - ich denke in der "modfs"-Gegend) in das TFFS-Image mit ein, allerdings muß der Payload der Datei bereits komprimiert sein. Das geht entweder mit "openssl" (sollte es zumindest, ggf. muß man sich das noch "zurechtschneiden") oder man nimmt einfach den Payload aus einer anderen (funktionierenden) Box, den man mit einem anderen Skript (auch irgendwo im Repo) aus einem TFFS-Dump extrahiert hat.

Worauf das in diesem Thread ursprünglich mal hinauslief, hatte ich gar nicht noch einmal von Beginn an gelesen (er hat sich ja ohnehin für einen anderen Weg entschieden) ... nach so langer Pause unterstelle ich mal entsprechend minimales Interesse an einer schnellen Lösung und da war mir die Zeit dann auch wieder zu schade. Die Stichworte "kernel.image" nach MTD1 und "filesystem.image" nach MTD0 waren (für mich) hier ausreichend, um bei einer 7362SL (NAND-Modell) die Beschreibung bereits als "epic fail" einzuordnen. Da ich (selbst wenn ich die Gründe für die Unterbrechung nicht kenne) nach 4 Wochen das auch schon mehr oder weniger aus dem Gedächtnis gestrichen habe, ist mein Interesse hier auch nicht wirklich "überbordend".

- - - Aktualisiert - - -

Wobei ich gerade noch einmal über den "Code-Kasten" in #10 "gestolpert" bin (beim Entsorgen der E-Mail) ... wenn die "/var/tmp/featovl.cfg" ein char-Device sein soll, funktioniert das zweite "echo" mit dem "append mode" natürlich nicht (das lseek() hinter den aktuellen Inhalt funktioniert nicht) und wenn das ein reguläres File ist, kann man mit dessen Inhalt im TFFS-Image nichts anfangen ... insgesamt paßt da also irgendetwas nicht zueinander.

 

[naf71]

please explain it a little bit further, what you've done.

I just extract the original firmware in Freetz-trunk as:

./fwmod -u FRITZ.Box_7362_SL.131.06.30.image

Edit the 2 lines:
export CONFIG_DECT="n"
export CONFIG_DECT2="n"

Then I packed the firmware with:

./fwmod -p FRITZ.Box_7362_SL.131.06.30.image

from there i get the filesystem.image and kernel.image uploader by eva:

220 ADAM2 FTP Server ready
Name (192.168.178.1:naf): adam2
331 Password required for adam2
Password: 
230 User adam2 successfully logged in
Remote system type is AVM.
ftp> bin
200 Type set to BINARY
ftp> debug
Debugging on (debug=1).
ftp> passive
Passive mode on.
ftp> quote MEDIA FLSH
---> MEDIA FLSH
200 Media set to MEDIA_FLASH
ftp> put kernel.image mtd1
---> PASV
227 Entering Passive Mode (192,168,178,1,12,8)
---> STOR mtd1
150 Opening BINARY data connection
426 Data connection closed
1961216 bytes sent in 0,83 seconds (2,25 Mbytes/s)
ftp> put filesystem.image mtd0
---> PASV
227 Entering Passive Mode (192,168,178,1,12,4)
---> STOR mtd0
150 Opening BINARY data connection
426 Data connection closed
19304448 bytes sent in 10,1 seconds (1,82 Mbytes/s)
ftp> quote REBOOT
---> REBOOT
221 Thank you for using the FTP service on ADAM2
ftp> quit

the device begins booting and then after about 5 seconds all LEDs turn off except info That continuously blink.
Also extract the original firmware without any modifications and took filesystem.image kernel.image and then loaded by eva got the same problems so I think it is the upload method that is wrong.

 

[Pokemon20021]

habe ich irgendwo mal für @kingtutt erläutert - ich denke in der "modfs"-Gegend) in das TFFS-Image mit ein

Hallo PeterPawn,
vielen Dank für die wertvollen Inputs!!!

@nachfolgende Leser: habe die Erklärungen hier gefunden: http://www.ip-phone-forum.de/showthread.php?t=284991&page=2

Gruß
Pokemon20021

 

[PeterPawn]

@naf71:
Did you realize, what I wrote? Beside the cited question?

Sure ... this is the wrong way to upload firmware to a 7362SL device and if you only "think so" instead to know this for sure now, you didn't understand, what I liked to say.

In my opinion you're in luck, if your bootloader partition remains still intact ... we had a report (for a 3490 device) short time ago, where writing MTD1 this way (probably) destroyed the bootloader code.

It's not really wise to use (again really) old code - especially if you've no idea, what happens there - and run it without any precautions or insufficient information.

If you can't get a clue, what happens in the scripts linked in #9, ask someone ... you may also ask here, but at least you should be able to read the answers. Otherwise this will be a very unpleasant and useless conversation.

Sorry for being blunt, but you better realize this now, as long as the device is still functioning (at least in parts).

 

[Pokemon20021]

ftp> put filesystem.image mtd0
...
ftp> put kernel.image mtd1

Also extract the original firmware without any modifications and took filesystem.image kernel.image and then loaded by eva got the same problems so I think it is the upload method that is wrong.

Hallo naf71,
if you compare the partition layout of a FB7362:

Bei einer FB7362SL wäre das vorhanden:

FB7362SL # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00400000 00020000 "reserved-kernel"
mtd1: 03000000 00020000 "reserved-filesystem"
mtd2: 00400000 00020000 "kernel"
mtd3: 03000000 00020000 "filesystem"
mtd4: 00200000 00020000 "config"
mtd5: 01600000 00020000 "nand-filesystem"
mtd6: 00040000 00001000 "urlader"
mtd7: 00060000 00001000 "tffs (1)"
mtd8: 00060000 00001000 "tffs (2)"
FB7362SL # 

SNIP

FB7390 #cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00d91b00 00020000 "rootfs"
mtd1: 0014e500 00020000 "kernel"
mtd2: 00020000 00020000 "urlader"
mtd3: 00080000 00020000 "tffs (1)"
mtd4: 00080000 00020000 "tffs (2)"
mtd5: 01000000 00020000 "reserved"
mtd6: 20000000 00020000 "nand-filesystem"
FB7390 #

you will see that you have mixed mtd0 vs. mtd1;
I think you have bricked your FB7362;

Please follow the solution plan as peterpawn explained #9

Best regards
Pokemon20021

 

[qwertz.asdfgh]

In my opinion you're in luck, if your bootloader partition remains still intact ... we had a report (for a 3490 device) short time ago, where writing MTD1 this way (probably) destroyed the bootloader code.

Hmm, die 7362 SL gibt es ja noch nicht so lange und die 3370 war ja sogar die erste FritzBox mit dem NAND-Konzept (und hat zudem auch nur 256kB Serial-Flash, 7362 SL = 1MB), scheint mir also so als wäre die auf der 7362SL eingesetzte Version von EVA etwas "intelligenter". Ich denke mal wir hätten auch schon von mehr Fällen zerstörter Bootloader gehört/gelesen wenn alle Bootloader auf den NAND-Modellen so arbeiten würden wie vermutlich bei der einen 3370 von neulich.

Ist aber jedenfalls durchaus spannend (beim lesen von Beitrag #8 blieb mir mal kurz das Herz stehen), nur leider lässt sich das eben nicht einfach mal so ausprobieren ohne evtl. doch ein paar FritzBoxen zu riskieren... :mrgreen:

 

[PeterPawn]

@Pokemon20021:
The views of EVA and a running system on "MTD" devices are (at least can be) completely different.

The runnung system uses the full "memory technology device" support of the linux kernel, MTD devices are numbered in order of their appearance - and their registration is (mostly) the result of scanning flash chip content or (sometimes) reading a predefined setting, containing start address and size. MTD devices are in the end something like a "device class" containing unique names (starting with "mtd", but (for example) using different interfaces (API) for character and block oriented I/O), assembling different (hardware) sources into this one class as long as they're using the same interfaces to read/write data.

EVA uses only the predefined borders (start and end address) of flash partitions and the name "mtdX" is exactly what it's called: only a name of a range of flash cells.

You shouldn't mix (and as a result mix up) these names - they MAY address the same partitions, but that's not guaranteed. Especially for devices with more than one flash storage technology or more than one chip for the same tech, these names are finally different. EVA on NAND based devices with a SPI/NAND combination still uses "mtd3" and "mtd4" as the "address" of the two TFFS partitions in the SPI flash, the running system (on 7490 - remember, the order is the result of the registration) uses "mtd7" and "mtd8" for the same partitions (the NAND partitions are registered earlier).

As far as we (the community) know, the EVA code (closed source) on most VR9 models (they're the majority of AVM devices with only NAND and SPI flash) is able to write to the SPI flash, but not to the NAND based storage spaces. The SPI contains the bootloader partition (usually called "mtd2") and the non-volatile storage for user settings (the TFFS partitions). Some devices have extra partitions here, but that are special cases.

As long as the EVA code distinguishes between NAND and SPI borders or properly validates the provided values (an entry for "mtd1" with a start address of 0x0 and an end address of 0x400000 (4 MB) can't be valid, the device has only 1 MB SPI flash due to the "flash_size" settings), it shouldn't write any data to such an extent.

The real "damage" in the loader code doesn't occur while writing the new content ... it starts immediately, if the loader decides to accept the access and attempts to erase the flash cells, before the transmission of the new content starts. The longer break watched after an accepted "STOR MTDx" command is the time needed to execute these erase commands ... as far as my own test results have shown. There's no "buffering" of the new content in memory first ... if you issue a "STOR" command and do not provide the needed data (this may occur, if the FTP client "dies" while waiting or if the (impatient) user kills it), the flash is "cleaned" already.

The reported incident (maybe I'm in error and it was a 3370 device - I trust in @qwertz.asdfgh) wasn't really validated as far as I know ... but a bug validating flash borders could lead to the situation described above - the report had specifically mentioned the long break after issuing the "put MTD1" command (on client side) and the abort of FTP client operation prior to the now "unresponsive device" after a restart.

There are some other devices in the wild, which do not use SPI flash (maybe to minimize the costs of production) and contain only NAND flash. The EVA code of these devices is able to access the NAND space - but it uses other "internal" names to address the partitions.

A 7412 has the following environment settings:

# cat /proc/sys/urlader/environment
HWRevision      209
HWSubRevision   1
ProductID       Fritz_Box_HW209
SerialNumber    0000000000000000
annex   B
autoload        yes
bootloaderVersion       1.2605
bootserport     tty0
cpufrequency    500000000
crash   [0]db6596bf,57742690,7[1]0,0,0[2]0,0,0[3]0,0,0
firstfreeaddress        0x811FB68C
firmware_info   137.06.50
firmware_version        avm
flashsize       nor_size=0MB sflash_size=0KB nand_size=128MB
kernel_args1    SECRET
linux_fs_start  0
maca    5C:49:79:57:47:5A
macb    5C:49:79:57:47:5B
macwlan 5C:49:79:57:47:5C
macwlan2        5C:49:79:57:47:5D
macdsl  5C:49:79:57:47:5E
memsize 0x08000000
modetty0        38400,n,8,1,hw
modetty1        38400,n,8,1,hw
mtd0    0x840000,0x3840000
mtd1    0x440000,0x840000
mtd2    0x0,0x40000
mtd3    0x40000,0x440000
mtd4    0x0,0x200000
my_ipaddress    192.168.178.1
prompt  Eva_AVM
ptest         4YEO
req_fullrate_freq       250000000
sysfrequency    250000000
urlader-version 3605
usb_board_mac   5C:49:79:57:47:5F
usb_device_id   0x0000
usb_device_name USB DSL Device
usb_manufacturer_name   AVM
usb_revision_id 0x0000
usb_rndis_mac   5C:49:79:57:47:60
wlan_key        4YEO

, but if you want to store a new TFFS content there (it has a different structure, do not try to do this with the output of my "tffs" scripts), you have to issue a "STOR mtdnand" command (and only a single one, while other TFFS images are stored twice) - as you can see, there's no such name in the environment above.

 

[naf71]

@naf71:
Did you realize, what I wrote? Beside the cited question?
If you can't get a clue, what happens in the scripts linked in #9, ask someone ... you may also ask here, but at least you should be able to read the answers. Otherwise this will be a very unpleasant and useless conversation.
.

At this point the only salvation are your scripts but i have difficult about the commands to use for both image2ram and eva_to-memory. I kindly need a help about commands to use.

 

[PeterPawn]

Which command don't you understand?

How would you grade your own skills on a Linux terminal?

The first script extracts two files from a tarball, shortens them if needed and combines them into a single one - containing both the kernel and the filesystem image.

The 2nd script can load such an image into the memory of a FRITZ!Box device via its bootloader (EVA) and start the execution ... that's too not really complicated (maybe the internal processes of "eva_to_memory" are a little bit harder to see).

If you mean (as an alternative), you haven't an idea, how to load and execute the scripts from GitHub ... that's "Linux basics" and there are many good tutorials in the wild.

I'm somewhat irritated ... and not really sure, what's your problem ... pls explain.

 

[naf71]

To obtain env for example:
eva_get_environment 192.168.178.1 env> ~ / env.txt and i get env.txt in my home.
I know that the script image2ram works in tmp and i put kernel.tar and filesystem.tar in my tmp directory but when I type ./image2ram i receave:
I'm a filter, give me an image file on STDIN and I'll put out an in-memory image on STDOUT. I do not know what I'm missing or perhaps 24 hours of no sleep to other commitments it makes me clumsy