Roborock S5 Max soft-briked, then recovered

[Lanchon]

@dgiese

hi Dennis,

after years of using valetudo on it, i soft-bricked my S5 max a few days ago. i recovered the unit but lost all my data (maps, configs, etc). so this issue is not about recovering, but about understanding what went wrong.

as customary, i had ssh and adb access. i also had sftp access, which is less common. scp is not and cannot be a remote file system protocol, and that really gets on my nerve: i always need sftp to work with stuff. i added sftp for the S5 max and published how here.

so sftp had also been working for years. the linked tgz includes this readme:

SFTP support for Roborock firmwares based on Ubuntu 14.04
=========================================================

1) Extract these files into: /mnt/data/sftp
2) Run /mnt/data/sftp/install after every reboot to enable SFTP.

The sftp-server binary was extracted verbatim from:
https://old-releases.ubuntu.com/ubuntu/pool/main/o/openssh/openssh-sftp-server_6.6p1-8_armhf.deb

Lanchon

/mnt/data/sftp/install just bind-mounts stuff so that sftp-server is found where expected. as stated, install must be manually ran after each reboot, and this is the way it has been.

i grew tired of that and tried to have install ran on boot, so i edited _root.sh as follows:

#!/bin/bash
if [[ -f /mnt/data/valetudo ]]; then
	mkdir -p /mnt/data/miio/

	if grep -q -e "cfg_by=tuya" -e "cfg_by=rriot" /mnt/data/miio/wifi.conf; then
		sed -i "s/cfg_by=tuya/cfg_by=miot/g" /mnt/data/miio/wifi.conf
		sed -i "s/cfg_by=rriot/cfg_by=miot/g" /mnt/data/miio/wifi.conf
		echo region=de >> /mnt/data/miio/wifi.conf
		echo 0 > /mnt/data/miio/device.uid
		echo "de" > /mnt/data/miio/device.country
	fi


	# Delete useless cleanup logs on each boot to enable Valetudo to update itself
	rm -r /mnt/data/rockrobo/rrlog/*REL

	VALETUDO_CONFIG_PATH=/mnt/data/valetudo_config.json /mnt/data/valetudo >> /dev/null 2>&1 &
fi

if [[ -f /mnt/data/sftp/install ]]; then
	{ sleep 60; /mnt/data/sftp/install; } &
fi

### It is strongly recommended that you put your changes inside the IF-statement above. In case your changes cause a problem, a factory reset will clean the data partition and disable your chances.
### Keep in mind that your robot model does not have a recovery partition. A bad script can brick your device!

i added the second main if with some safeguards:

• if a factory reset is done, mnt/data/sftp/install will be deleted and the code will be disabled.
• it sleeps for a minute fore installing the server, so that potential race issues of bind-mounting during boot should not happen.
• the sleep and install are backgrounded, that _root.sh finishes immediately and no watchdogs are triggered.
• and if something went wrong, on the next boot 60 seconds would be enough time for me to log in and kill the pending install before it messes up.

however something unexpected happened: after the boot "song" a short time passed, then suddenly the robot said something in the way of: "boot failed. the factory firmware will now be restored. this will take about 5 minutes". (i immediately forced-powered off the device -as i did not want to loose my data- and bricked it... good thinking on my part! :-p later i recovered, but my data was lost anyway.) i think this restore message was played way before 60 seconds passed from when the boot song was played, but i could be wrong: i was not paying much attention.

my question is: how on earth did the boot failure happen? any guesses?

thanks!