WHR-G300Nでopenwrtを起動できない件

以下は、openwrtの導入を失敗した事例です。

WHR-G300N(RT3052F)にて、openwrtを起動したいのですが、
openwrt公式ページに掲載されている15.05ディレクトリのファームウェアファイルでは起動できませんでした。

openwrtのページの、RT305xのディレクトリに、WHR-G300N用のイメージが3つ、あります。
これをダウンロードして、純正ファームウェア状態のWHR-G300Nの管理画面を開き、
純正WebUIのファーム更新ページで以下のファイルを指定し、ファイルを送り込みました。

openwrt-15.05-ramips-rt305x-whr-g300n-squashfs-factory-EU.bin

「ファームウェアデータが正しくありません。再起動します。」で受け付けてもらえず。

強硬手段で、bufpy/otdpopyページのFirmwareUpgradeページから流し込んだ結果、
焼く処理自体は成功しました。しかし、再起動後、仮文鎮の状態となりました。

LANからの応答がなくなったため、シリアルケーブルで確認したところ、
「Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,4)」
ブートループにもならず、panicがでたところで、DIAG赤ランプ点灯で沈黙です。
沈黙するまでのログは、このページ下部へ転記しています。

dd-wrt14896をTFTPで焼き直して、とりあえず復旧しました。

dd-wrt14896で起動できる状態まで復旧できました。
この状態で、dd-wrt上のFirmwareUpgrade機能を使用して、
openwrtを焼くことを試みました。

openwrt-15.05-ramips-rt305x-whr-g300n-squashfs-sysupgrade.bin

を指定してUpgradeボタンを押しました。
Upgrade failed.で終わりました。
アップデート処理中にシリアルケーブルでログを記録していたので、
このページの末尾に貼っています。

dd-wrt上ではopenwrtのファームを流し込むことができないようです。

TFTPをつかった送り付け方式で、公式サイトで掲載されている3つのイメージを
焼けるか試しました。結果は、すべてNGでした。
(ファームを受け取るが、焼く処理に移行せず、既存のファームが立ち上がる)

TFTPで送り付けて、受付してもらえなかった、ファームウェア ファイルは以下

openwrt-15.05-ramips-rt305x-whr-g300n-squashfs-factory-EU.bin
3266400byte

openwrt-15.05-ramips-rt305x-whr-g300n-initramfs-uImage.bin
3154648byte

openwrt-15.05-ramips-rt305x-whr-g300n-squashfs-sysupgrade.bin
3407876byte

最後に、そもそも自分のTFTPの送受信環境が正常に動いてるかどうかの確認のため、
同様のTFTP環境でdd-wrt14896を送り付けました。焼きこみが正常に完了しました。
なので、TFTP環境は正常ということに。

掲載されているファイルが、機種違いか、なんらかの問題を抱えているのではないかという結論に。

以上で検証終わり。WHR-G300Nは、dd-wrtはOKだが、openwrtを入れる方法は、わからず。
掲載ファームのファイル名の末尾に「-EU」と記述があるので、海外で出荷されたもの専用のイメージなのかも。
インストール実績情報の「失敗事例あり 14.07」に、同機種が書いてあった。15.05もむりっぽい。


作業時に記録していた、各種ログを、張り付けておきます。



openwrtを焼いて、起動できない時のログ


 U-Boot 1.1.3 for BUFFALO AIRSTATION (Aug 26 2008 - 13:08:44)
 
 Board: Ralink APSoC DRAM:  32 MB
 Top of RAM usable for U-Boot at: 82000000
 Stack Pointer at: 81f4ff98
 relocate_code Pointer at: 81fa0000
 Now running in RAM - U-Boot at: 81fa0000
 
 FLASH ID : 00h=[0xc2], 01h=[0x22a8], 0Eh=[0x0], 0Fh=[0x19]
 
  Set info->start[0]=BF000000
 flash_protect ON: from 0xBF000000 to 0xBF02B84F
 protect on 0
 protect on 1
 protect on 2
 protect on 3
 protect on 4
 protect on 5
 protect on 6
 protect on 7
 protect on 8
 protect on 9
 flash_protect ON: from 0xBF030000 to 0xBF03FFFF
 protect on 10
 flash_protect ON: from 0xBF040000 to 0xBF04FFFF
 protect on 11
 uboot use  81F4FFB0 - 82000000
 Memory Test start(80000000) end(81F00000) size(01F00000)
 Pattern 55555555  Writing...            Reading...
 Pattern AAAAAAAA  Writing...            Reading...
 Pattern 00000000  Writing...            Reading...
 Memory Test OK
 ### buf_ver=[1.09] U-Boot Ver.=[1.09]
 ### build_date(env)=[Aug 26 2008 - 13:08:44] build_date(bin)=[Aug 26 2008 - 13:08:44]
 ============================================ 
 Ralink UBoot Version: 3.1
 -------------------------------------------- 
 ASIC 3052_MP2 (MAC to GigaMAC Mode)
 DRAM COMPONENT: 256Mbits 
 DRAM BUS: 32BIT 
 Total memory: 64 MBytes
 Date:Aug 26 2008  Time:13:08:44
 ============================================ 
 icache: sets:256, ways:4, linesz:32 ,total:32768
 dcache: sets:128, ways:4, linesz:32 ,total:16384 
 
  ##### The CPU freq = 384 MHZ #### 
 
  SDRAM bus set to 32 bit 
  SDRAM size =32 Mbytes
 
 Please choose the operation: 
    1: Load system code to SDRAM via TFTP. 
    2: Load system code then write to Flash via TFTP. 
    3: Boot system code via Flash (default).
    4: Entr boot command line interface.
    9: Load Boot Loader code then write to Flash via TFTP. 
  0 
 Net:   
  eth_register  
 Eth0 (10/100-M)
  enetvar=ethaddr,Eth addr:00:AA:BB:CC:DD:19
  00:AA:BB:CC:DD:19:
 
  eth_current->name = Eth0 (10/100-M)
 
    
 6: System Load Linux Kernel then write to Flash via TFTP Server. 
 
  netboot_common, argc= 2 
  *************buf = 0x81fcb9e0
  **********NexTxPacket = 81fe3ac0
 
  NetTxPacket = 0x81FE3AC0 
 
  NetRxPackets[0] = 0x81FE40C0
 
  NetRxPackets[1] = 0x81FE46C0
 
  NetRxPackets[2] = 0x81FE4CC0
 
  NetRxPackets[3] = 0x81FE52C0
 
  NetRxPackets[4] = 0x81FE58C0
 
  NetRxPackets[5] = 0x81FE5EC0
 
  NetRxPackets[6] = 0x81FE64C0
 
  NetRxPackets[7] = 0x81FE6AC0
 
  NetRxPackets[8] = 0x81FE70C0
 
  NetRxPackets[9] = 0x81FE76C0
 
  NetRxPackets[10] = 0x81FE7CC0
 
  NetRxPackets[11] = 0x81FE82C0
 
  NetRxPackets[12] = 0x81FE88C0
 
  NetRxPackets[13] = 0x81FE8EC0
 
  NetRxPackets[14] = 0x81FE94C0
 
  NetRxPackets[15] = 0x81FE9AC0
 
  NetRxPackets[16] = 0x81FEA0C0
 
  NetRxPackets[17] = 0x81FEA6C0
 
  NetRxPackets[18] = 0x81FEACC0
 
  NetRxPackets[19] = 0x81FEB2C0
 
  KSEG1ADDR(NetTxPacket) = 0xA1FE3AC0 
 
  NetLoop,call eth_halt ! 
 
  NetLoop,call eth_init ! 
 Trying Eth0 (10/100-M)
 
  Waitting for RX_DMA_BUSY status Start... done
 
  Mac to giga Mac mode  
 
  rx_ring = A1FCBE00, tx_ring0 = A1FCBCC0
 
  Header Payload scatter function is Disable !! 
 
  RT2880_PDMA_GLO_CFG=00000020 
 
  ************************************************* 
 
  RX_CALC_IDX0=19 
 
  RX_DRX_IDX0 = 0 
 
  ************************************************* 
 
  ETH_STATE_ACTIVE!! 
 
 tftp server(receive) go, waiting:4[sec]
 Trying Eth0 (10/100-M)
 
  ETH_STATE_ACTIVE!! 
 Load address: 0x81000000
 Got ARP REPLY, set server/gtwy eth addr (**:**:**:**:**:**)
 ↑作業者注:dd-wrtをTFTPで送ろうと試みたが、
  送り側PCのarp設定の不備でタイムアウトになった。
  再度やり直したので、ここは無視してください。
 Got it
 checksum bad
 checksum bad
 checksum bad
 O O O O O 
 TFTPserver error: 'timeout on receive' (0)
 Starting again
 
 Trying Eth0 (10/100-M)
 
  ETH_STATE_ACTIVE!! 
 
 tftp server(receive) go, waiting:4[sec]
 Load address: 0x81000000
 no file was loaded.
    
 3: System Boot system code via Flash.
 ## Booting image at bf050000 ...
    Image Name:   Linux Kernel Image
    Created:      2010-02-08   9:47:05 UTC
 
  System Control Status = 0x20440000 
    Image Type:   MIPS Linux Kernel Image (lzma compressed)
    Data Size:    895917 Bytes = 874.9 kB
    Load Address: 80000000
    Entry Point:  8029b000
    Verifying Checksum ... OK
    Uncompressing Kernel Image ... OK
 No initrd
 ## Transferring control to Linux (at address 8029b000) ...
 ## Giving linux memsize in MB, 32
 
 Starting kernel ...
 
 
 LINUX started...
 
  THIS IS ASIC
 Linux version 2.6.21 (vc03021@mkitec-xen) (gcc version 3.3.6) #1 Mon Feb 8 18:38:13 JST 2010
 
  The CPU feqenuce set to 384 MHz
 CPU revision is: 0001964c
 Determined physical RAM map:
  memory: 02000000 @ 00000000 (usable)
 Built 1 zonelists.  Total pages: 8128
 Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4
 Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
 Primary data cache 16kB, 4-way, linesize 32 bytes.
 Synthesized TLB refill handler (20 instructions).
 Synthesized TLB load handler fastpath (32 instructions).
 Synthesized TLB store handler fastpath (32 instructions).
 Synthesized TLB modify handler fastpath (31 instructions).
 Cache parity protection disabled
 cause = 80800000, status = 1100ff00
 PID hash table entries: 128 (order: 7, 512 bytes)
 calculating r4koff... 00177000(1536000)
 CPU frequency 384.00 MHz
 Using 192.000 MHz high precision timer.
 Console: colour dummy device 80x25
 Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
 Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
 Memory: 29456k/32768k available (2201k kernel code, 3312k reserved, 462k data, 116k init, 0k highmem)
 Mount-cache hash table entries: 512
 NET: Registered protocol family 16
 SCSI subsystem initialized
 NET: Registered protocol family 2
 Time: MIPS clocksource has been installed.
 IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
 TCP established hash table entries: 1024 (order: 1, 8192 bytes)
 TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
 TCP: Hash tables configured (established 1024 bind 1024)
 TCP reno registered
 squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
 squashfs: LZMA suppport for slax.org by jro
 io scheduler noop registered (default)
 FLASH_API: MAN_ID=C2 DEV_ID=22A8 SIZE=4MB
 Ralink gpio driver initialized
 HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
 N_HDLC line discipline registered.
 mel_initsw initialized. 
 ++ RALINK_REG_PIODATA = B0000620
 Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
 serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
 serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
 loop: loaded (max 8 devices)
 rdm_major = 254
 PPP generic driver version 2.4.2
 PPP Deflate Compression module registered
 PPP BSD Compression module registered
 NET: Registered protocol family 24
 physmap flash device: bfc00000 at 400000
 RT2880 SOC Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
  Amd/Fujitsu Extended Query Table at 0x0040
 number of CFI chips: 1
 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
 Creating 6 MTD partitions on "RT2880 SOC Physically mapped flash":
 0x00000000-0x00030000 : "uboot"
 0x00030000-0x00040000 : "uboot_environ"
 0x00040000-0x00050000 : "factory_default"
 0x00050000-0x00140000 : "linux"
 0x00140000-0x003f0000 : "rootfs"
 0x003f0000-0x00400000 : "user_property"
 block2mtd: version $Revision: 1.1.1.1 $
 u32 classifier
 nf_conntrack version 0.5.0 (256 buckets, 2048 max)
 ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
 ipt_time loading
 TCP cubic registered
 NET: Registered protocol family 1
 NET: Registered protocol family 17
 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
 All bugs added by David S. Miller <davem@redhat.com>
 No filesystem could mount root, tried:  squashfs
 Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,4)



上記でopenwrt15.05を起動できない状態で電源を再投入し、dd-wrt 14896を、TFTPで送り付けて、焼きこんだ瞬間のログ


U-Boot 1.1.3 for BUFFALO AIRSTATION (Aug 26 2008 - 13:08:44)

Board: Ralink APSoC DRAM:  32 MB
Top of RAM usable for U-Boot at: 82000000
Stack Pointer at: 81f4ff98
relocate_code Pointer at: 81fa0000
Now running in RAM - U-Boot at: 81fa0000

FLASH ID : 00h=[0xc2], 01h=[0x22a8], 0Eh=[0x0], 0Fh=[0x19]

 Set info->start[0]=BF000000
flash_protect ON: from 0xBF000000 to 0xBF02B84F
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
flash_protect ON: from 0xBF040000 to 0xBF04FFFF
protect on 11
uboot use  81F4FFB0 - 82000000
Memory Test start(80000000) end(81F00000) size(01F00000)
Pattern 55555555  Writing...            Reading...
Pattern AAAAAAAA  Writing...            Reading...
Pattern 00000000  Writing...            Reading...
Memory Test OK
### buf_ver=[1.09] U-Boot Ver.=[1.09]
### build_date(env)=[Aug 26 2008 - 13:08:44] build_date(bin)=[Aug 26 2008 - 13:08:44]
============================================ 
Ralink UBoot Version: 3.1
-------------------------------------------- 
ASIC 3052_MP2 (MAC to GigaMAC Mode)
DRAM COMPONENT: 256Mbits 
DRAM BUS: 32BIT 
Total memory: 64 MBytes
Date:Aug 26 2008  Time:13:08:44
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 384 MHZ #### 

 SDRAM bus set to 32 bit 
 SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 
 0 
Net:   
 eth_register  
Eth0 (10/100-M)
 enetvar=ethaddr,Eth addr:00:AA:BB:CC:DD:19
 00:AA:BB:CC:DD:19:

 eth_current->name = Eth0 (10/100-M)

   
6: System Load Linux Kernel then write to Flash via TFTP Server. 

 netboot_common, argc= 2 
 *************buf = 0x81fcb9e0
 **********NexTxPacket = 81fe3ac0

 NetTxPacket = 0x81FE3AC0 

 NetRxPackets[0] = 0x81FE40C0

 NetRxPackets[1] = 0x81FE46C0

 NetRxPackets[2] = 0x81FE4CC0

 NetRxPackets[3] = 0x81FE52C0

 NetRxPackets[4] = 0x81FE58C0

 NetRxPackets[5] = 0x81FE5EC0

 NetRxPackets[6] = 0x81FE64C0

 NetRxPackets[7] = 0x81FE6AC0

 NetRxPackets[8] = 0x81FE70C0

 NetRxPackets[9] = 0x81FE76C0

 NetRxPackets[10] = 0x81FE7CC0

 NetRxPackets[11] = 0x81FE82C0

 NetRxPackets[12] = 0x81FE88C0

 NetRxPackets[13] = 0x81FE8EC0

 NetRxPackets[14] = 0x81FE94C0

 NetRxPackets[15] = 0x81FE9AC0

 NetRxPackets[16] = 0x81FEA0C0

 NetRxPackets[17] = 0x81FEA6C0

 NetRxPackets[18] = 0x81FEACC0

 NetRxPackets[19] = 0x81FEB2C0

 KSEG1ADDR(NetTxPacket) = 0xA1FE3AC0 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done

 Mac to giga Mac mode  

 rx_ring = A1FCBE00, tx_ring0 = A1FCBCC0

 Header Payload scatter function is Disable !! 

 RT2880_PDMA_GLO_CFG=00000020 

 ************************************************* 

 RX_CALC_IDX0=19 

 RX_DRX_IDX0 = 0 

 ************************************************* 

 ETH_STATE_ACTIVE!! 

tftp server(receive) go, waiting:4[sec]
Trying Eth0 (10/100-M)

 ETH_STATE_ACTIVE!! 
Load address: 0x81000000
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REQUEST, return our IP
Got ARP REPLY, set server/gtwy eth addr (**:**:**:**:**:**) ← 作業者注:送ったPCのMACアドレス
Got it
O $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
tftp server done
Bytes transferred = 3537021 (35f87d hex)
NetBootFileXferSize= 0035f87d
tftp server received buffalo F/W.
buf="# Airstation FirmWare
run u_fw
r"
Encript Airstation FirmWare header
begin commands
cmd:# Airstation FirmWare
cmd:run u_fw

 b_end =BF3FFFFF
Erase Flash from 0xbf050000 to 0xbf3fffff in Bank # 1 

 erase sector  = 12 
sect = 12,s_last = 70,erase poll = 1005007

 erase sector  = 13 
sect = 13,s_last = 70,erase poll = 989357

 erase sector  = 14 
*sect = 14,s_last = 70,erase poll = 989642

 erase sector  = 15 
sect = 15,s_last = 70,erase poll = 998835

 erase sector  = 16 
*sect = 16,s_last = 70,erase poll = 966750

 erase sector  = 17 
sect = 17,s_last = 70,erase poll = 965967

 erase sector  = 18 
*sect = 18,s_last = 70,erase poll = 1018824

 erase sector  = 19 
sect = 19,s_last = 70,erase poll = 954678

 erase sector  = 20 
*sect = 20,s_last = 70,erase poll = 975354

 erase sector  = 21 
sect = 21,s_last = 70,erase poll = 970696

 erase sector  = 22 
*sect = 22,s_last = 70,erase poll = 1025903

 erase sector  = 23 
sect = 23,s_last = 70,erase poll = 955441

 erase sector  = 24 
*sect = 24,s_last = 70,erase poll = 985875

 erase sector  = 25 
sect = 25,s_last = 70,erase poll = 984439

 erase sector  = 26 
*sect = 26,s_last = 70,erase poll = 982246

 erase sector  = 27 
sect = 27,s_last = 70,erase poll = 982159

 erase sector  = 28 
*sect = 28,s_last = 70,erase poll = 969250

 erase sector  = 29 
sect = 29,s_last = 70,erase poll = 978681

 erase sector  = 30 
*sect = 30,s_last = 70,erase poll = 966485

 erase sector  = 31 
sect = 31,s_last = 70,erase poll = 971367

 erase sector  = 32 
*sect = 32,s_last = 70,erase poll = 973716

 erase sector  = 33 
sect = 33,s_last = 70,erase poll = 954776

 erase sector  = 34 
*sect = 34,s_last = 70,erase poll = 1006261

 erase sector  = 35 
sect = 35,s_last = 70,erase poll = 954937

 erase sector  = 36 
*sect = 36,s_last = 70,erase poll = 969689

 erase sector  = 37 
sect = 37,s_last = 70,erase poll = 987266

 erase sector  = 38 
*sect = 38,s_last = 70,erase poll = 1021661

 erase sector  = 39 
sect = 39,s_last = 70,erase poll = 958328

 erase sector  = 40 
*sect = 40,s_last = 70,erase poll = 983041

 erase sector  = 41 
sect = 41,s_last = 70,erase poll = 1012771

 erase sector  = 42 
*sect = 42,s_last = 70,erase poll = 988130

 erase sector  = 43 
sect = 43,s_last = 70,erase poll = 987110

 erase sector  = 44 
sect = 44,s_last = 70,erase poll = 967968

 erase sector  = 45 
*sect = 45,s_last = 70,erase poll = 983966

 erase sector  = 46 
sect = 46,s_last = 70,erase poll = 976187

 erase sector  = 47 
*sect = 47,s_last = 70,erase poll = 967002

 erase sector  = 48 
sect = 48,s_last = 70,erase poll = 992403

 erase sector  = 49 
*sect = 49,s_last = 70,erase poll = 1014151

 erase sector  = 50 
sect = 50,s_last = 70,erase poll = 993465

 erase sector  = 51 
*sect = 51,s_last = 70,erase poll = 958915

 erase sector  = 52 
sect = 52,s_last = 70,erase poll = 955803

 erase sector  = 53 
*sect = 53,s_last = 70,erase poll = 987580

 erase sector  = 54 
sect = 54,s_last = 70,erase poll = 985339

 erase sector  = 55 
*sect = 55,s_last = 70,erase poll = 978522

 erase sector  = 56 
sect = 56,s_last = 70,erase poll = 1002727

 erase sector  = 57 
*sect = 57,s_last = 70,erase poll = 980578

 erase sector  = 58 
sect = 58,s_last = 70,erase poll = 1062311

 erase sector  = 59 
*sect = 59,s_last = 70,erase poll = 988150

 erase sector  = 60 
sect = 60,s_last = 70,erase poll = 993863

 erase sector  = 61 
*sect = 61,s_last = 70,erase poll = 980643

 erase sector  = 62 
sect = 62,s_last = 70,erase poll = 1018499

 erase sector  = 63 
*sect = 63,s_last = 70,erase poll = 979122

 erase sector  = 64 
sect = 64,s_last = 70,erase poll = 967590

 erase sector  = 65 
*sect = 65,s_last = 70,erase poll = 979204

 erase sector  = 66 
sect = 66,s_last = 70,erase poll = 1002134

 erase sector  = 67 
*sect = 67,s_last = 70,erase poll = 947577

 erase sector  = 68 
sect = 68,s_last = 70,erase poll = 967706

 erase sector  = 69 
*sect = 69,s_last = 70,erase poll = 968583

 erase sector  = 70 
sect = 70,s_last = 70,erase poll = 1004974
 done
Erased 59 sectors

 Copy linux image[3537021 byte] to Flash[0xBF050000].... 
Copy to Flash... 
 Copy 3537021 byte to Flash... 
 addr = 0xBF0A34F8 ,cnt=3195781 
 addr = 0xBF0F69F2 ,cnt=2854539 
 addr = 0xBF149EEC ,cnt=2513297 
 addr = 0xBF19D3E6 ,cnt=2172055 
 addr = 0xBF1F08DE ,cnt=1830815 
 addr = 0xBF243DD8 ,cnt=1489573 
 addr = 0xBF2972D2 ,cnt=1148331 
 addr = 0xBF2EA7CC ,cnt=807089 
 addr = 0xBF33DCC6 ,cnt=465847 
 addr = 0xBF3911C0 ,cnt=124605 done
cmd:reset



dd-wrt14896を焼きおわり、正常に起動できたときのログ


U-Boot 1.1.3 for BUFFALO AIRSTATION (Aug 26 2008 - 13:08:44)

Board: Ralink APSoC DRAM:  32 MB
Top of RAM usable for U-Boot at: 82000000
Stack Pointer at: 81f4ff98
relocate_code Pointer at: 81fa0000
Now running in RAM - U-Boot at: 81fa0000

FLASH ID : 00h=[0xc2], 01h=[0x22a8], 0Eh=[0x0], 0Fh=[0x19]

 Set info->start[0]=BF000000
flash_protect ON: from 0xBF000000 to 0xBF02B84F
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
flash_protect ON: from 0xBF040000 to 0xBF04FFFF
protect on 11
uboot use  81F4FFB0 - 82000000
Memory Test start(80000000) end(81F00000) size(01F00000)
Pattern 55555555  Writing...            Reading...
Pattern AAAAAAAA  Writing...            Reading...
Pattern 00000000  Writing...            Reading...
Memory Test OK
### buf_ver=[1.09] U-Boot Ver.=[1.09]
### build_date(env)=[Aug 26 2008 - 13:08:44] build_date(bin)=[Aug 26 2008 - 13:08:44]
============================================ 
Ralink UBoot Version: 3.1
-------------------------------------------- 
ASIC 3052_MP2 (MAC to GigaMAC Mode)
DRAM COMPONENT: 256Mbits 
DRAM BUS: 32BIT 
Total memory: 64 MBytes
Date:Aug 26 2008  Time:13:08:44
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 384 MHZ #### 

 SDRAM bus set to 32 bit 
 SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 
 0 
Net:   
 eth_register  
Eth0 (10/100-M)
 enetvar=ethaddr,Eth addr:00:AA:BB:CC:DD:19
 00:AA:BB:CC:DD:19:

 eth_current->name = Eth0 (10/100-M)

   
6: System Load Linux Kernel then write to Flash via TFTP Server. 

 netboot_common, argc= 2 
 *************buf = 0x81fcb9e0
 **********NexTxPacket = 81fe3ac0

 NetTxPacket = 0x81FE3AC0 

 NetRxPackets[0] = 0x81FE40C0

 NetRxPackets[1] = 0x81FE46C0

 NetRxPackets[2] = 0x81FE4CC0

 NetRxPackets[3] = 0x81FE52C0

 NetRxPackets[4] = 0x81FE58C0

 NetRxPackets[5] = 0x81FE5EC0

 NetRxPackets[6] = 0x81FE64C0

 NetRxPackets[7] = 0x81FE6AC0

 NetRxPackets[8] = 0x81FE70C0

 NetRxPackets[9] = 0x81FE76C0

 NetRxPackets[10] = 0x81FE7CC0

 NetRxPackets[11] = 0x81FE82C0

 NetRxPackets[12] = 0x81FE88C0

 NetRxPackets[13] = 0x81FE8EC0

 NetRxPackets[14] = 0x81FE94C0

 NetRxPackets[15] = 0x81FE9AC0

 NetRxPackets[16] = 0x81FEA0C0

 NetRxPackets[17] = 0x81FEA6C0

 NetRxPackets[18] = 0x81FEACC0

 NetRxPackets[19] = 0x81FEB2C0

 KSEG1ADDR(NetTxPacket) = 0xA1FE3AC0 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done

 Mac to giga Mac mode  

 rx_ring = A1FCBE00, tx_ring0 = A1FCBCC0

 Header Payload scatter function is Disable !! 

 RT2880_PDMA_GLO_CFG=00000020 

 ************************************************* 

 RX_CALC_IDX0=19 

 RX_DRX_IDX0 = 0 

 ************************************************* 

 ETH_STATE_ACTIVE!! 

tftp server(receive) go, waiting:4[sec]
Trying Eth0 (10/100-M)

 ETH_STATE_ACTIVE!! 
Load address: 0x81000000

TftpServer Timeout;
Trying Eth0 (10/100-M)

 ETH_STATE_ACTIVE!! 
no file was loaded.
   
3: System Boot system code via Flash.
## Booting image at bf050000 ...
   Image Name:   DD-WRT v24 Linux Kernel Image
   Created:      2010-08-07   7:03:16 UTC

 System Control Status = 0x20440000 
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    785254 Bytes = 766.8 kB
   Load Address: 80000000
   Entry Point:  80243000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80243000) ...
## Giving linux memsize in MB, 32

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.23.17 (root@dd-wrt) (gcc version 4.1.2) #3577 Sat Aug 7 09:01:19 CEST 2010

 The CPU frequency set to 384 MHz
32M RAM Detected!
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Built 1 zonelists in Zone order.  Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4 rootfstype=squashfs noinitrd
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 80800000, status = 1100ff00
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 003a9800(3840000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
console [ttyS1] enabled
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 29656k/32768k available (2002k kernel code, 3112k reserved, 309k data, 112k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Generic PHY: Registered new driver
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
Load RT2880 Timer Module(Wdg/Soft)
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
rt3052 access driver initialization.
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V1.0
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ralink flash device: 0x1000000 at 0xbf000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.

found squashfs at 110000
Creating 6 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00030000 : "uboot"
0x00030000-0x00040000 : "uboot-config"
0x00040000-0x00050000 : "factory-defaults"
0x00050000-0x003f0000 : "linux"
0x00110000-0x003f0000 : "rootfs"
0x003f0000-0x00400000 : "nvram"
u32 classifier
    Actions configured 
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
ctnetlink v0.93: registering with nfnetlink.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
IPP2P v0.8.2 loading
ClusterIP Version 0.8 loaded successfully
TCP bic registered
TCP cubic registered
TCP westwood registered
TCP highspeed registered
TCP hybla registered
TCP htcp registered
TCP vegas registered
TCP scalable registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Welcome to PF_RING 3.2.1
(C) 2004-06 L.Deri <deri@ntop.org>
NET: Registered protocol family 27
PF_RING: bucket length    128 bytes
PF_RING: ring slots       4096
PF_RING: sample rate      1 [1=no sampling]
PF_RING: capture TX       No [RX only]
PF_RING: transparent mode Yes
PF_RING initialized correctly.
PF_RING: registered /proc/net/pf_ring/
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v2.00  256 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 0, Tx Ring = 256, Rx Ring = 256
GDMA1_MAC_ADRH -- : 0x0000001d
GDMA1_MAC_ADRL -- : 0x73111112
PROC INIT OK!
decode /dev/mtdblock4
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 112k freed
start service
starting Architecture code for rt2880
rt2860v2_ap: module license 'unspecified' taints kernel.

phy_tx_ring = 0x01c17000, tx_ring = 0xa1c17000, size: 16 bytes

phy_rx_ring = 0x01c18000, rx_ring = 0xa1c18000, size: 16 bytes
RT305x_ESW: Link Status Changed
GDMA1_FWD_CFG = 10000
switch reg write offset=14, value=405555
switch reg write offset=50, value=2001
switch reg write offset=98, value=7f3f
switch reg write offset=e4, value=3f
switch reg write offset=40, value=1001
switch reg write offset=44, value=1001
switch reg write offset=48, value=1002
switch reg write offset=70, value=ffff506f
br0: Dropping NETIF_F_UFO since no NETIF_F_HW_CSUM feature.
device br0 entered promiscuous mode
Algorithmics/MIPS FPU Emulator v1.5
device vlan1 entered promiscuous mode
device eth2 entered promiscuous mode
sh: ead: not found
RtmpOSNetDevDetach(): RtmpOSNetDeviceDetach(), dev->name=ra0!
0x1300 = 00064380
0x1300 = 00064380
device ra0 entered promiscuous mode
br0: port 2(ra0) entering learning state
br0: port 1(vlan1) entering learning state
device br0 left promiscuous mode
device br0 entered promiscuous mode
device br0 left promiscuous mode
device br0 entered promiscuous mode
wland: No such file or directory
device vlan2 entered promiscuous mode
device vlan2 left promiscuous mode
SIOCGIFFLAGS: No such device
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(vlan1) entering forwarding state
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
etherip: Ethernet over IPv4 tunneling driver
connect: Network is unreachable
connect: Network is unreachable
connect: Network is unreachable
gethostbyname: Network is unreachable
RT305x_ESW: Link Status Changed
submit_button=[index] submit_type=[changepass]
name=[index] type=[changepass] service=[] sleep=[1] action=[5]
function ej_show_voltage not found 
function ej_show_cpu_temperature not found 
function ej_get_cputemp not found 
function ej_get_voltage not found 
function ej_get_cputemp not found 
function ej_get_voltage not found 
function ej_get_cputemp not found 
function ej_get_voltage not found 
function ej_get_cputemp not found 
function ej_get_voltage not found 
function ej_get_cputemp not found 
function ej_get_voltage not found 
function ej_get_cputemp not found 
function ej_get_voltage not found 
function ej_get_cputemp not found 
function ej_get_voltage not found 
function ej_get_cputemp not found 
function ej_get_voltage not found 
function ej_get_cputemp not found 
function ej_get_voltage not found 
function ej_get_cputemp not found 
function ej_get_voltage not found 
function ej_get_cputemp not found 
function ej_get_voltage not found 


dd-wrt14896を正常起動時、FirmwareUpgrade画面からopenwrtをアップロードして、「/tmp/uploadBCf6vd: Bad trx header」とログに出て書き込みに失敗するまでのログ


openwrtのイメージファイルは、電源投入時にTFTPで送り付けることで、書き込むことができます。しかし、書き込みが終わると、このページの最初のようにブートできずに終わります。

dd-wrtのFirmwareUpgrade画面では、そもそもopenwrtのファイルを受け付けてくれませんでした。
受付してくれなかった時のログが以下です。

function ej_get_cputemp not found 
function ej_get_voltage not found 
upgrade_ver[v8.0.16] upgrade_ver[80016] intel_ver[14108] 4712_ver[15000]
uploading [4096]
uploading [8192]
uploading [12288]
略
uploading [65536]
uploading [69632]
function stop_pppoeserver not found 
function stop_olsrd not found 
function stop_openvpn not found 
function stop_openvpnserver not found 
function stop_freeradius not found 
/tmp/uploadBCf6vd: Bad trx header
uploading [73728]
uploading [77824]
uploading [81920]
uploading [86016]
略
uploading [3407923]
uploading [3407923]
connect: Network is unreachable
connect: Network is unreachable
connect: Network is unreachable


openwrtを起動するための対処法


いまのところ不明です。



追記 20151220に掲載していただいたファームを試してみました


ビルドしていただいたファームを掲載してくださってる方のページ
https://大破.net/contents/openwrt/15.05/ramips/whr-g300n/

結論は、当方のWHR-G300Nに焼き込めず、すべて失敗です。

TFTPで焼きこみを実行すると「FTPS buf: unknown firmware」とでて、スルーされます。
すでに書き込んであるdd-wrtのFirmwareUpgrade機能をつかいますが、
あいかわらずすべてのファームで、アップ後すぐに Update Successful が出てしまい、
コンソールで確認すると「bad trx header」でスルーされています。

ubootenvの状態
シリアルポート経由で接続して、ubootのメニューでコンソールに降りて、
Please choose the operation: 
1: Load system code to SDRAM via TFTP. 
2: Load system code then write to Flash via TFTP. 
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP. 
ここで4を押し、ubootのコンソールに入ります。
printenv
で現在のubootenvの状況を確認します。
そのあと、以下の書き込みコマンドを実行 
setenv accept_open_rt_fmt 1
setenv tftp_wait 10
saveenv
再度pintenvをして、値が書き込めていることを確認しました。
念のためリブート後も確認しましたが、書いた値は残っていることを確認しました。
類似した型番で、CPU違いの機種「WHR-G301N」では、これを施すことで
dd-wrtがいれてある状態から、TFTP経由で純正ファームに戻せることを確認しました。
openwrtもTFTPで12.09~15.05を3種類すべて焼けました。
しかし、自分の手持ちのWHR-G300Nは、この方法で純正に戻すことができないようです。



焼いてみた openwrt-ramips-rt305x-whr-g300n-squashfs-sysupgrade_20151220-1951.bin 3670020byte

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
tftp server done
Bytes transferred = 3670020 (380004 hex)
NetBootFileXferSize= 00380004
tftp server received buffalo F/W.
buf="'X燿?XD
FTPS buf: unknown firmware ###

3: System Boot system code via Flash.
## Booting image at bf050000 ...
   Image Name:   DD-WRT v24 Linux Kernel Image
   Created:      2015-02-24   7:42:03 UTC
以降、いれてあるdd-wrtが通常通りに起動する

焼いてみた openwrt-ramips-rt305x-whr-g300n-initramfs-uImage_20151220-1947.bin 3478099byte

Bytes transferred = 3478099 (351253 hex)
NetBootFileXferSize= 00351253
tftp server received buffalo F/W.
buf="'X・f,XDr"
 ### TFTPS buf: unknown firmware ###
上に同じ

焼いてみた 純正ファーム

factory-EUは純正ファームからアップデートを実行するファイルであると理解し、純正ファームに戻せばよいのだろうと、純正ファームを焼くが、純正ファームも焼けずに跳ねられる

tftp server done
Bytes transferred = 3603652 (36fcc4 hex)
NetBootFileXferSize= 0036fcc4
tftp server received buffalo F/W.
buf="Lhz-Kgddn"
 ### TFTPS buf: unknown firmware ###

なお、念のため、20151220掲載の、factory-EU
「openwrt-ramips-rt305x-whr-g300n-squashfs-factory-EU_20151220-1951.bin 3603652」
をTFTPで送ってみましたが、同じ症状「### TFTPS buf: unknown firmware ###」で焼けませんでした。

まさに八方ふさがり。この状態でも、dd-wrtは、いつも正常に起動します。
現状、どうやっても、dd-wrtから抜け出すことができません。泣きたい。

残る手段は、ubootのmenuから焼く手段が考えられますが、
3つ掲載されているファームウェアのうち、どのファームウェアイメージを
どのように使えばよいのかわからないため、現在はチャレンジしていません。