Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Next revisionBoth sides next revision
inbox:toh:arris:tr4400_v2 [2022/03/12 17:09] – add intro lanchoninbox:toh:arris:tr4400_v2 [2022/09/16 21:32] – add link to stock firmware lanchon
Line 1: Line 1:
 ====== Arris TR4400 v2 / RAC2V1A ====== ====== Arris TR4400 v2 / RAC2V1A ======
  
-{{page>meta:infobox:construction&noheader&nofooter&noeditbtn}}+/* {{page>meta:infobox:construction&noheader&nofooter&noeditbtn}} */
  
-{{media:askey:rac2v1k.png?100|Arris TR4400}}+{{media:arris:tr4400_v2:rac2v1a.png?100|Arris TR4400}}
  
 /*****/ /*****/
-/* How to add images ========> https://openwrt.org/meta/adding_images_to_openwrt_wiki */+/* Add images ========> https://openwrt.org/meta/adding_images_to_openwrt_wiki */
 /*****/ /*****/
  
-The Arris TR4400 v2 is a dual band router provided by Spectrum to subscribers under the model number RAC2V1A.+The Arris TR4400 v2 is a dual band router provided by Spectrum to subscribers under the model number RAC2V1A. It is based on an Qualcomm IPQ8065 SoC and has 512 MB of RAM and 256 MB of flash.
  
-It is based on an Qualcomm IPQ806x SoC and has 256 MB of NAND flash and 512 MB of RAM. The device is not vulnerable to a settings restore attack +The device does not allow the user to flash firmware, does not support settings backup and restore, and does not provide access via SSH. The SSH server (dropbear) cannot start due to misconfiguration. And even if it could, the admin user shell has been replaced with a limited router configuration tool. Accessing the serial port seems to be the only way to root the device, but this is an extremely painful process. Once the hardware issues are sorted out, the device is not protected: the bootloader can be interrupted, and also once the router has booted up, pressing enter drops you to a root shell. [[https://github.com/Lanchon/tr4400-v2-stock-firmware/tree/master/r1418-2018-03-01|Stock firmware]] is an OpenWrt Barrier Breaker r1121 build.
  
  
 ===== OpenWrt support ===== ===== OpenWrt support =====
  
-<color red>**Not supported.**</color>+<color green>**Supported via official firmware.**</color>
  
 +First stable release: 22.03.0
  
-/*** if info availableuncomment and fill in +Unsupported featuresNone
-===== Supporting activities ===== +
-//Describe if there are any ongoing activities that might lead to OpenWrt support.//+
  
-  * OpenWrt forum thread: (add link+<WRAP BOX> 
-***/+<color red>**WARNING:**</color> Obtaining root access on this device (required to install OpenWrt) is an extremely painful process involving delicate hardware modifications. The process is detailed on this page. 
 +</WRAP> 
 + 
 + 
 +==== OpenWrt Installation ==== 
 + 
 +Official firmware[[https://firmware-selector.openwrt.org/?target=ipq806x%2Fgeneric&id=arris_tr4400-v2|https://firmware-selector.openwrt.org]] 
 + 
 +Installation instructions: https://github.com/Lanchon/openwrt-tr4400-v2 
 + 
 +(Old beta firmware is available [[https://github.com/Lanchon/openwrt-tr4400-v2/tree/beta-firmware|here]].
 + 
 + 
 +==== Performance tuning ==== 
 + 
 +Enable **Software flow offloading** in **Network > Firewall > General Settings**. 
 + 
 +Paste the following lines into **System > Startup > Local Startup**: 
 +<code> 
 +echo 35 > /sys/devices/system/cpu/cpufreq/ondemand/up_threshold 
 +echo 10 > /sys/devices/system/cpu/cpufreq/ondemand/sampling_down_factor     
 +</code> 
 + 
 +(Source: [[:inbox:toh:askey:rt4230w_rev6#tuning|RT4230W REV6]].) 
 + 
 + 
 +==== Supporting activities ==== 
 + 
 +OpenWrt forum thread: https://forum.openwrt.org/t/arris-tr4400-v2-rac2v1a-support/122585
  
  
Line 41: Line 68:
  
 ===== Hardware highlights ===== ===== Hardware highlights =====
-^ CPU                        Ram     ^ Flash   ^ Network        ^ WLAN       ^ USB    ^ Serial ^ JTAG ^ +^ CPU                          RAM     ^ NAND Flash ^ NOR Flash ^ Network        ^ WLAN       ^ USB    ^ Serial          ^ JTAG            
-| Qualcomm IPQ806x (2 cores) | 512 MiB | 256 MiB | 5x 10/100/1000 | a/b/g/n/ac | 1x 3.x | Yes    ?    |+| Qualcomm IPQ8065 (dual core) | 512 MiB | 256 MiB    | 32 KiB    | 5x 10/100/1000 | a/b/g/n/ac | 1x 3.x | [[#Serial|Yes]] [[#JTAG|Maybe]] |
  
  
Line 75: Line 102:
 /*** if info available: uncomment and fill in /*** if info available: uncomment and fill in
 ===== Specific configuration ===== ===== Specific configuration =====
 +***/
  
-<WRAP BOX 600px> 
-FIXME Please fill in real values for this device, then remove the EXAMPLEs and the WRAP that encloses this text. 
  
 ==== Network interfaces ==== ==== Network interfaces ====
 The default network configuration is: The default network configuration is:
-^ Interface Name   ^ Description                  ^ Default configuration    +^ Interface Name ^ Description        ^ Default configuration ^ 
-| br-lan           EXAMPLE LAN & WiFi           EXAMPLE 192.168.1.1/24   +| br-lan         | LAN & WiFi         | 192.168.1.1/24        
-vlan0 (eth0.0)   EXAMPLE LAN ports (1 to 4)   EXAMPLE None             +| eth0           | Disabled           | None                  | 
-vlan1 (eth0.1)   EXAMPLE WAN port             EXAMPLE DHCP             +| eth1           | LAN ports (1 to 4) | None                  
-wl0              EXAMPLE WiFi                 EXAMPLE Disabled         +eth2           | WAN port           | DHCP                  
-</WRAP> +ath0           | WiFi 5 GHz         | Disabled              
-***/+| ath1           | WiFi 2.4 GHz       | Disabled              |
  
  
Line 93: Line 119:
 -> [[docs:guide-user:hardware:hardware.button]] on howto use and configure the hardware button(s). -> [[docs:guide-user:hardware:hardware.button]] on howto use and configure the hardware button(s).
  
-<WRAP BOX 600px> 
 The Arris TR4400 has the following buttons: The Arris TR4400 has the following buttons:
  
Line 99: Line 124:
 | Reset                |    ?    | | Reset                |    ?    |
 | WPS                  |    ?    | | WPS                  |    ?    |
-</WRAP> 
  
  
 ===== Hardware ===== ===== Hardware =====
 ==== Info ==== ==== Info ====
-^ Architecture     | ARMv7 Processor rev 0 (v7l)      |+^ Architecture     | ARMv7 Processor rev 0 (v7l) (cortex-a15+neon-vfpv4) |
 ^ Vendor           | Arris                            | ^ Vendor           | Arris                            |
 ^ Bootloader       | U-Boot                           | ^ Bootloader       | U-Boot                           |
-^ System-On-Chip   | Qualcomm IPQ806x                 +^ System-On-Chip   | Qualcomm IPQ8065 (dual core)     
-^ CPU/Speed        | unkown                           | +^ CPU/Speed        | Unknown                          |
-^ Flash-Chip       | NAND                             | +
-^ Flash size       | 256 MiB                          |+
 ^ RAM              | 512 MiB                          | ^ RAM              | 512 MiB                          |
-^ Wireless         AR900B 2.4 GHz b/g/n 3x3, QCA9984 5 GHz a/n/ac 4x4 |+^ Flash size       | 256 MiB NAND, 32 KiB NOR         | 
 +^ Wireless         QCA9983 2.4 GHz b/g/n 3x3, QCA9984 5 GHz a/n/ac 4x4 |
 ^ Ethernet         | 5x 10/100/1000 Mbit/           | ^ Ethernet         | 5x 10/100/1000 Mbit/           |
-^ Switch           unkown                           +^ Switch           QCA8337                          
-^ USB              | 1x 3.x                           |+^ USB              | 1x 3.x Type-A                    |
 ^ Serial           | [[#Serial|Yes]]                  | ^ Serial           | [[#Serial|Yes]]                  |
-^ JTAG             | [[#JTAG|unkown]]                 |+^ JTAG             | [[#JTAG|Maybe]]                  |
  
  
Line 132: Line 155:
 ==== Photos ==== ==== Photos ====
  
-{{media::arris:tr4400_v2:back.jpeg?400}}+{{media:arris:tr4400_v2:back.jpeg?400}}
  
  
 ==== Opening the case ==== ==== Opening the case ====
  
-<WRAP BOX> +1. Removing the top cover is the hardest part of the teardown. The cover is held by clips. Wedge a spudge tool vertically between the cover and the walls and go in deep. Do not use the spudge as a lever, it will break! Insert a stronger tool in the opening created by the spudge. (I used the lever of a big metallic toe nail clipper: it is strong and rounded.) Use the tool as a lever to pry up the cover; you will need significant force but the clips should not break. 
-FIXME //Describe what needs to be done to open the devicee.g. remove rubber feetadhesive labels, screws, ...// + 
-</WRAP>+{{media:arris:tr4400_v2:d1.jpeg?400|Top cover}} 
 + 
 +2. Remove the rubber feet, unscrew the 4 hidden screws, and remove the bottom cover. 
 + 
 +{{media:arris:tr4400_v2:d2.jpeg?400|Bottom cover}} 
 + 
 +3. Remove the LED light guide by removing its screw. 
 + 
 +{{media:arris:tr4400_v2:d3.jpeg?400|Light guide}} 
 + 
 +4. Remove the two screws shown here (bottom end): 
 + 
 +{{media:arris:tr4400_v2:d4.jpeg?400}} 
 + 
 +5. Remove the two screws shown here (top end): 
 + 
 +{{media:arris:tr4400_v2:d5.jpeg?400}} 
 + 
 +6. Slide out the core of the device. 
 + 
 +{{media:arris:tr4400_v2:d6.jpeg?400}} 
 + 
 +The core is made of a main board and a PCIe wireless board. The boards are mounted back to back, and the front sides of both boards are mostly covered by heatsinks. 
 + 
 +{{media:arris:tr4400_v2:d7.jpeg?400|Main board (front, with heatsink)}} 
 +{{media:arris:tr4400_v2:d8.jpeg?400}} 
 +{{media:arris:tr4400_v2:d9.jpeg?400|Wireless board (front, with heatsinks)}} 
 + 
 +7. Unclip the two antenna wires from the sides of the black plastic antenna support structure at the top end of the core. Remove the screw holding the structure to the coreshown here: 
 + 
 +{{media:arris:tr4400_v2:d10.jpeg?400}} 
 + 
 +8The four antenna wires are too short to allow lifting the wireless board from the main board completely, but i was able to remove and reinstall the wireless board without disconnecting any of the antennas. Gently pull out the antenna support structure a little bit to give the wireless board some wiggle room; it will come out only slightly due to the antenna wires holding it back. Nextpartially lift the wireless board and then rotate it to towards the antenna structure; it should slide out of the connector. Finally remove the wireless board and antenna structure simultaneouslyas they are still connected by the four wires. 
 + 
 +The back side of the main board is now revealed. 
 + 
 +{{media:arris:tr4400_v2:d11.jpeg?400|Main board (back, without wireless board)}} 
 + 
 +9. Remove the four screws on the back of the main board holding the main board heatsink in place. Note that two of these screws actually are the two hexagonal metalic standoffs where the screws removed in step 4 were attached. After removing the four screws, the board and heatsink will still be held together by a large heat-conducting soft material with adhesive on both sidesIf possible, gently peel the adhesive material from the main board so that it stays attached to the heatsinkUse a spudge to peal the material as you lightly separate the heatsink; avoid bending the main board as much as possible. Once the heatsink is separated, immediately cover the sticky material with some clean kitchen foil; any impurities gathered there will hinder its heat conductivity. 
 + 
 +The front side of the main board is now revealed. 
 + 
 +{{media:arris:tr4400_v2:d12.jpeg?400}} 
 +{{media:arris:tr4400_v2:d13.jpeg?400|Main board (front, without heatsink)}} 
 + 
 +Before reattaching the heatsink, use an alcohol swab to remove any residue in the contact areas not covered by sticky material. Note that in my router, the small chip on the board was not making contact with the heatsink: there was a slight airgap between them. The chip does not produce a lot of heat, so the manufacturer probably chose not to add a bit of sticky heat-conductive material there. You can harvest a bit of the existing sticky material hanging out from the sides of the contact area and put it on top of the chip if you want
  
 ==== Serial ==== ==== Serial ====
 -> [[docs:techref:hardware:port.serial]] general information about the serial port, serial port cable, etc. -> [[docs:techref:hardware:port.serial]] general information about the serial port, serial port cable, etc.
  
-How to connect to the Serial Port of this specific device:\\ +Accessing the serial port on this device is a real pain, but it seems to be the only way to root it and flash it. 
-**Insert photo of PCB with markings for serial port**+ 
 +The serial port is a 4-pin 0.1"-pitch unpopulated connector on the main board named JP2. The pinout is: 
 + 
 +^ JP2 Pin ^ Function         ^ 
 +| 1       | +3.3 VDC         | 
 +| 2       | TX (from router) | 
 +| 3       | RX (to router)   | 
 +| 4       | GND              | 
 + 
 +^ Serial connection parameters\\ for Arris TR4400 v2 | 115200, 8N1 | 
 + 
 +The connector is located under the heatsink: 
 + 
 +{{media:arris:tr4400_v2:serial-front-heatsink.jpeg?400}} 
 +{{media:arris:tr4400_v2:serial-back.jpeg?400}} 
 + 
 +The SoC uses 1.8 V signals, but the serial port is level-converted to 3.3 V. The level conversion on TX and RX signals is done using two identical bidirectional level shifter circuits made of discreet components. Each level shifter is made of a low-threshold N-channel MOSFET and a few resistors. This kind of level shifter is fairly common; here is a typical implementation (3.3 V to/from 5 V): 
 + 
 +{{media:arris:tr4400_v2:level-shifter.png?400}} 
 + 
 +The problem is: the whole circuit is unpopulated. And the components are minuscule and thus almost impossible to hand solder: the resistors are 0.5mm pitch, 5 times the density of the usual 0.1" pitch configuration. In the following picture you can see that Q10 (TX signal) and Q11 (RX signal) are missing, as well as the 8 supporting resistors. With these components missing, the TX and RX lines in JP2 are disconnected. 
 + 
 +{{media:arris:tr4400_v2:serial-detail.jpeg?400}} 
 + 
 +A solution is to mod the board to bridge the level shifters and bring out the 1.8 V signals directly.
  
 <WRAP BOX> <WRAP BOX>
-FIXME //Replace EXAMPLE by real values.//+**WARNING:** This mod implements a 1.8 V serial port on the board. Connecting a 3.3 V or 5 V serial adapter to this port will instantly fry the SoC. Also, the serial signals from the SoC will be brought straight out without any kind of ESD (electrostatic discharge) protection. An ESD event can easily fry the port. Observe strict ESD avoidance and grounding practices when handling the port (search the web). Always (1) disconnect all wires from the router (power brick, ethernet, etc), (2) disconnect the USB end of your serial adapter, and (3) touch the router heatsink and the adapter USB connector with your bare hands, before connecting a serial adapter to the port or otherwise handling the port. If possible avoid carpets, excessively dry ambient air, and air conditioning.
 </WRAP> </WRAP>
  
-^ Serial connection parameters\\ for Arris TR4400 v2 | 1152008N1\\ 1.8 V |+The objective of the mod is to bridge the 6 connections shown in blue below: 
 + 
 +{{media:arris:tr4400_v2:serial-mod.jpeg?400}} 
 + 
 +1. The pads marked in red above are 1.8 V or 3.3 V supply rails. Short-circuiting the serial signals to these pads can fry the SoC. Use some kind of paint or lacquer, such as nail polish, to completely cover the 6 pads marked in red above and let the substance cure. 
 + 
 +2. Next, bridge the 6 blue connections shown above. The easiest way to do this is to cut and apply bits of conductive adhesive copper tape, but not everybody has that. Second best is to apply big solder blobs to the 4 small bridge locations, then use 2 bits of very fine wire to bridge the 2 larger locations. Use a bit of adhesive tape on one end of the wire to lock it in place to the board while your work on the other end. Be careful: due to their small size, you can easily rip out the pads with very little force. 
 + 
 +3. Use a multimeter to test your work. Set it to measure resistance (ohm meter mode). Keep the black lead touching ground (the EMI shielding of the board, or else JP2 pin 4). Touch the red lead on JP2 pin 2 (TX) and pin 3 (RX) and you should meassure around 8K and 12K ohm respectively. For each of those signals: if you do not meassure anything, you have an open circuit (badly made blue bridge); if you meassure 0 ohm, you have a short to ground; if you meassure non-zero but less than 4K ohm, you have a short to the 1.8 or 3.3 V supply rails (short circuit to red pad). Do not power up the board if you suspect any issues! 
 + 
 +4. Apply electrical tape over the modded area of the board. 
 + 
 +5. Solder a row of 90-degree pins in JP2, in this fashion: 
 + 
 +{{media:arris:tr4400_v2:serial-populated.jpeg?400}} 
 + 
 +Now you have an electrically frail, 1.8 V serial port on your board. You will need a 1.8 V serial adapter, and more than likely you will not find it: you will have to build a 3.3/1.8 V level shifter yourself. 
 + 
 +Next is the level shifter I made. Note that the TX pin is still 1.8 V: I just happened to have a 3.3 V USB serial adapter that reliably received 1.8 V signals, so all I needed was to step down the adapter's TX signal and provide some current limiting for protection. 
 + 
 +{{media:arris:tr4400_v2:adapter-1.jpeg?400}} 
 +{{media:arris:tr4400_v2:adapter-2.jpeg?400}} 
 +{{media:arris:tr4400_v2:adapter-3.jpeg?400}} 
 + 
 +I used 3 protoboard-style10 cm, dual-female jumper wires to bring the 1.8 V signals out of the router core: 
 + 
 +{{media:arris:tr4400_v2:adapter-4.jpeg?400}} 
 +{{media:arris:tr4400_v2:adapter-5.jpeg?400}} 
 +{{media:arris:tr4400_v2:adapter-6.jpeg?400}} 
 + 
 +I will keep the level shifter always connected, hidden inside the base of the router, for easy access in case I ever need it again. 
 + 
 +{{media:arris:tr4400_v2:adapter-7.jpeg?400}} 
  
 ==== JTAG ==== ==== JTAG ====
 -> [[docs:techref:hardware:port.jtag]] general information about the JTAG port, JTAG cable, etc. -> [[docs:techref:hardware:port.jtag]] general information about the JTAG port, JTAG cable, etc.
  
-How to connect to the JTAG Port of this specific device:\\ +The main board has a 6-pin 0.1"-pitch unpopulated connector named J7 that could be JTAG
-**Insert photo of PCB with markings for JTAG port**+ 
 +Signals in this port are 1.8 V logic. The pinout is
 + 
 +^ J7 Pin ^ Function ^ 
 +| 1      | +3.3 VDC | 
 +| 2      | ? (logic low) | 
 +| 3      | ? (logic low) | 
 +| 4      | ? (logic high in early boot, then low) | 
 +| 5      | GND | 
 +| 6      | ? (logic high) | 
 + 
 +The connector is just under the heatsink: 
 + 
 +{{media:arris:tr4400_v2:jtag-front-heatsink.jpeg?400}} 
 +{{media:arris:tr4400_v2:jtag-back.jpeg?400}} 
 + 
 +With the heatsink removed: 
 + 
 +{{media:arris:tr4400_v2:jtag-front.jpeg?400}} 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
  
 ===== Bootlogs ===== ===== Bootlogs =====
Line 2355: Line 2615:
 </nowiki> </nowiki>
 </WRAP>\\ </WRAP>\\
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
  
 ==== OpenWrt bootlog ==== ==== OpenWrt bootlog ====
 <WRAP bootlog> <WRAP bootlog>
-<nowiki>COPY HERE THE BOOTLOG ONCE OPENWRT IS INSTALLED AND RUNNING</nowiki>+U-Boot 2012.07 [Barrier Breaker r1121,r1121] (Mar 01 2018 - 13:57:32) 
 + 
 +smem ram ptable found: ver: 0 len: 5 
 +DRAM:  491 MiB 
 +NAND:  SF: Unsupported manufacturer 00 
 +ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0) 
 +256 MiB 
 +MMC:    
 +PCI0 Link Intialized 
 +PCI1 Link Intialized 
 +In:    serial 
 +Out:   serial 
 +Err:   serial 
 +MMC Device 0 not found 
 +cdp: get part failed for 0:HLOS 
 +Net:   MAC0 addr:0:3:7f:ba:db:
 +athrs17_reg_init: complete 
 +athrs17_vlan_config: Sercomm modify vlan config 
 +athrs17_vlan_config ...done 
 +S17c init  done 
 +MAC1 addr:0:3:7f:ba:db:
 +MAC2 addr:0:3:7f:ba:db:
 +Port:2 speed 10Mbps 
 +MAC3 addr:0:3:7f:ba:db:
 +Port:3 speed 10Mbps 
 +eth0, eth1, eth2, eth3 
 +Done! 
 + Index Name                Offset      Length      Real_Offs   Real_Size    
 +     0 SBL1                0           40000                 40000        
 +     1 MIBIB               40000       140000      40000       140000       
 +     2 SBL2                180000      140000      180000      140000       
 +     3 SBL3                2c0000      280000      2c0000      280000       
 +     4 DDRCONFIG           540000      120000      540000      120000       
 +     5 SSD                 660000      120000      660000      120000       
 +     6 TZ                  780000      280000      780000      280000       
 +     7 RPM                 a00000      280000      a00000      280000       
 +     8 APPSBL              c80000      500000      c80000      500000       
 +     9 APPSBLENV           1180000     80000       1180000     80000        
 +    10 ART                 1200000     140000      1200000     140000       
 +    11 rootfs              1340000     4000000     1340000     4000000      
 +    12 BOOTCONFIG          5340000     60000       5340000     60000        
 +    13 SBL2_1              53a0000     140000      53a0000     140000       
 +    14 SBL3_1              54e0000     280000      54e0000     280000       
 +    15 DDRCONFIG_1         5760000     120000      5760000     120000       
 +    16 SSD_1               5880000     120000      5880000     120000       
 +    17 TZ_1                59a0000     280000      59a0000     280000       
 +    18 RPM_1               5c20000     280000      5c20000     280000       
 +    19 BOOTCONFIG_1        5ea0000     60000       5ea0000     60000        
 +    20 APPSBL_1            5f00000     500000      5f00000     500000       
 +    21 rootfs_1            6400000     4000000     6400000     4000000      
 +    22 fw_env              a400000     100000      a400000     100000       
 +    23 config              a500000     800000      a500000     800000       
 +    24 PKI                 ad00000     200000      ad00000     200000       
 +    25 scfgmgr             af00000     100000      af00000     100000       
 +Hit any key to stop autoboot:  2  1  0  
 +Creating 1 MTD partitions on "nand0": 
 +0x000006500000-0x000010000000 : "mtd=0" 
 +UBI: attaching mtd1 to ubi0 
 +UBI: physical eraseblock size:   131072 bytes (128 KiB) 
 +UBI: logical eraseblock size:    126976 bytes 
 +UBI: smallest flash I/O unit:    2048 
 +UBI: VID header offset:          2048 (aligned 2048) 
 +UBI: data offset:                4096 
 +UBI: attached mtd1 to ubi0 
 +UBI: MTD device name:            "mtd=0" 
 +UBI: MTD device size:            155 MiB 
 +UBI: number of good PEBs:        1240 
 +UBI: number of bad PEBs:         0 
 +UBI: max. allowed volumes:       128 
 +UBI: wear-leveling threshold:    4096 
 +UBI: number of internal volumes: 1 
 +UBI: number of user volumes:     3 
 +UBI: available PEBs:             28 
 +UBI: total number of reserved PEBs: 1212 
 +UBI: number of PEBs reserved for bad PEB handling: 12 
 +UBI: max/mean erase counter: 6/3 
 +Read 0 bytes from volume kernel to 44000000 
 +No size specified -> Using max size (3174400) 
 +   Image Name:   ARM OpenWrt Linux-5.10.108 
 +   Image Type:   ARM Linux Kernel Image (uncompressed) 
 +   Data Size:    3060473 Bytes = 2.9 MiB 
 +   Load Address: 42208000 
 +   Entry Point:  42208000 
 +   Verifying Checksum ... OK 
 +   Loading Kernel Image ... OK 
 +OK 
 + 
 +device nand0 <nand0>, # parts = 1 
 + #: name size offset mask_flags 
 + 0: mtd_ubi             0x09b00000 0x06500000 0 
 + 
 +active partition: nand0,0 - (mtd_ubi) 0x09b00000 @ 0x06500000 
 + 
 +defaults: 
 +mtdids  : none 
 +mtdparts: none 
 +Setting up atags for msm partition: mtd_ubi 
 +Using machid 0x1260 from environment 
 + 
 +Starting kernel ... 
 + 
 +[    0.000000] Booting Linux on physical CPU 0x0 
 +[    0.000000] Linux version 5.10.108 (rod@rod-latitude) (arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 11.2.0 r19347-2825c1bbe8) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Wed Apr 6 00:08:11 2022 
 +[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5787d 
 +[    0.000000] CPU: div instructions available: patching division code 
 +[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache 
 +[    0.000000] OF: fdt: Machine model: Arris TR4400 v2 
 +[    0.000000] Memory policy: Data cache writealloc 
 +[    0.000000] Zone ranges: 
 +[    0.000000]   Normal   [mem 0x0000000042000000-0x000000005fffffff] 
 +[    0.000000]   HighMem  empty 
 +[    0.000000] Movable zone start for each node 
 +[    0.000000] Early memory node ranges 
 +[    0.000000]   node   0: [mem 0x0000000042000000-0x000000005fffffff] 
 +[    0.000000] Initmem setup node 0 [mem 0x0000000042000000-0x000000005fffffff] 
 +[    0.000000] percpu: Embedded 15 pages/cpu s30796 r8192 d22452 u61440 
 +[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 121800 
 +[    0.000000] Kernel command line: rootfstype=squashfs noinitrd 
 +[    0.000000] Bootloader command line (ignored): console=ttyMSM0,115200n8 
 +[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes, linear) 
 +[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes, linear) 
 +[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off 
 +[    0.000000] Memory: 475436K/491520K available (6754K kernel code, 612K rwdata, 1648K rodata, 1024K init, 236K bss, 16084K reserved, 0K cma-reserved, 0K highmem) 
 +[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1 
 +[    0.000000] rcu: Hierarchical RCU implementation. 
 +[    0.000000] Tracing variant of Tasks RCU enabled. 
 +[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies. 
 +[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16 
 +[    0.000000] random: get_random_bytes called from start_kernel+0x3a0/0x54c with crng_init=0 
 +[    0.000000] clocksource: dg_timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 305801671480 ns 
 +[    0.000008] sched_clock: 32 bits at 6MHz, resolution 160ns, wraps every 343597383600ns 
 +[    0.000026] Switching to timer-based delay loop, resolution 160ns 
 +[    0.000288] Calibrating delay loop (skipped), value calculated using timer frequency.. 12.50 BogoMIPS (lpj=62500) 
 +[    0.000321] pid_max: default: 32768 minimum: 301 
 +[    0.000516] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) 
 +[    0.000540] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) 
 +[    0.001632] CPU: Testing write buffer coherency: ok 
 +[    0.001915] qcom_scm: convention: smc legacy 
 +[    0.002859] Setting up static identity map for 0x42300000 - 0x42300060 
 +[    0.003035] rcu: Hierarchical SRCU implementation. 
 +[    0.003323] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build 
 +[    0.003563] smp: Bringing up secondary CPUs ... 
 +[    0.005516] smp: Brought up 1 node, 2 CPUs 
 +[    0.005536] SMP: Total of 2 processors activated (25.00 BogoMIPS). 
 +[    0.005550] CPU: All CPU(s) started in SVC mode. 
 +[    0.016445] VFP support v0.3: implementor 51 architecture 64 part 4d variant 2 rev 0 
 +[    0.016615] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns 
 +[    0.016649] futex hash table entries: 512 (order: 3, 32768 bytes, linear) 
 +[    0.016801] pinctrl core: initialized pinctrl subsystem 
 +[    0.018081] NET: Registered protocol family 16 
 +[    0.018444] DMA: preallocated 256 KiB pool for atomic coherent allocations 
 +[    0.019786] thermal_sys: Registered thermal governor 'step_wise' 
 +[    0.021965] cpuidle: using governor ladder 
 +[    0.022043] cpuidle: using governor menu 
 +[    0.067976] usbcore: registered new interface driver usbfs 
 +[    0.068065] usbcore: registered new interface driver hub 
 +[    0.068138] usbcore: registered new device driver usb 
 +[    0.068205] pps_core: LinuxPPS API ver. 1 registered 
 +[    0.068223] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it> 
 +[    0.068259] PTP clock support registered 
 +[    0.070419] clocksource: Switched to clocksource dg_timer 
 +[    0.071494] NET: Registered protocol family 2 
 +[    0.071655] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear) 
 +[    0.072518] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear) 
 +[    0.072577] TCP established hash table entries: 4096 (order: 2, 16384 bytes, linear) 
 +[    0.072623] TCP bind hash table entries: 4096 (order: 3, 32768 bytes, linear) 
 +[    0.072776] TCP: Hash tables configured (established 4096 bind 4096) 
 +[    0.072884] UDP hash table entries: 256 (order: 1, 8192 bytes, linear) 
 +[    0.072920] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear) 
 +[    0.073160] NET: Registered protocol family 1 
 +[    0.073219] PCI: CLS 0 bytes, default 64 
 +[    0.074680] workingset: timestamp_bits=14 max_order=17 bucket_order=3 
 +[    0.080258] squashfs: version 4.0 (2009/01/31) Phillip Lougher 
 +[    0.080281] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. 
 +[    0.187047] qcom-pcie 1b500000.pci: supply vdda not found, using dummy regulator 
 +[    0.187299] qcom-pcie 1b500000.pci: supply vdda_phy not found, using dummy regulator 
 +[    0.187423] qcom-pcie 1b500000.pci: supply vdda_refclk not found, using dummy regulator 
 +[    0.187735] qcom-pcie 1b500000.pci: host bridge /soc/pci@1b500000 ranges: 
 +[    0.187820] qcom-pcie 1b500000.pci:       IO 0x000fe00000..0x000fe0ffff -0x000fe00000 
 +[    0.187865] qcom-pcie 1b500000.pci:      MEM 0x0008000000..0x000fdfffff -> 0x0008000000 
 +[    0.416345] qcom-pcie 1b500000.pci: Link up 
 +[    0.416522] qcom-pcie 1b500000.pci: PCI host bridge to bus 0000:00 
 +[    0.416552] pci_bus 0000:00: root bus resource [bus 00-ff] 
 +[    0.416578] pci_bus 0000:00: root bus resource [io  0x0000-0xffff] (bus address [0xfe00000-0xfe0ffff]) 
 +[    0.416599] pci_bus 0000:00: root bus resource [mem 0x08000000-0x0fdfffff] 
 +[    0.416683] pci 0000:00:00.0: [17cb:0101] type 01 class 0x060400 
 +[    0.416841] pci 0000:00:00.0: supports D1 
 +[    0.416861] pci 0000:00:00.0: PME# supported from D0 D1 D3hot 
 +[    0.421705] PCI: bus0: Fast back to back transfers disabled 
 +[    0.422244] pci 0000:01:00.0: [168c:0046] type 00 class 0x028000 
 +[    0.422542] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit] 
 +[    0.423916] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold 
 +[    0.428940] PCI: bus1: Fast back to back transfers disabled 
 +[    0.429044] pci 0000:00:00.0: BAR 8: assigned [mem 0x08000000-0x081fffff] 
 +[    0.429072] pci 0000:01:00.0: BAR 0: assigned [mem 0x08000000-0x081fffff 64bit] 
 +[    0.429229] pci 0000:00:00.0: PCI bridge to [bus 01-ff] 
 +[    0.429256] pci 0000:00:00.0:   bridge window [mem 0x08000000-0x081fffff] 
 +[    0.430230] pcieport 0000:00:00.0: AER: enabled with IRQ 44 
 +[    0.431367] qcom-pcie 1b700000.pci: supply vdda not found, using dummy regulator 
 +[    0.431612] qcom-pcie 1b700000.pci: supply vdda_phy not found, using dummy regulator 
 +[    0.431741] qcom-pcie 1b700000.pci: supply vdda_refclk not found, using dummy regulator 
 +[    0.432024] qcom-pcie 1b700000.pci: host bridge /soc/pci@1b700000 ranges: 
 +[    0.432101] qcom-pcie 1b700000.pci:       IO 0x0031e00000..0x0031e0ffff -> 0x0031e00000 
 +[    0.432141] qcom-pcie 1b700000.pci:      MEM 0x002e000000..0x0031dfffff -> 0x002e000000 
 +[    0.657765] qcom-pcie 1b700000.pci: Link up 
 +[    0.657922] qcom-pcie 1b700000.pci: PCI host bridge to bus 0001:00 
 +[    0.657949] pci_bus 0001:00: root bus resource [bus 00-ff] 
 +[    0.657971] pci_bus 0001:00: root bus resource [io  0x10000-0x1ffff] (bus address [0x31e00000-0x31e0ffff]) 
 +[    0.657991] pci_bus 0001:00: root bus resource [mem 0x2e000000-0x31dfffff] 
 +[    0.658072] pci 0001:00:00.0: [17cb:0101] type 01 class 0x060400 
 +[    0.658213] pci 0001:00:00.0: supports D1 
 +[    0.658232] pci 0001:00:00.0: PME# supported from D0 D1 D3hot 
 +[    0.662768] PCI: bus0: Fast back to back transfers disabled 
 +[    0.663298] pci 0001:01:00.0: [168c:0040] type 00 class 0x028000 
 +[    0.663612] pci 0001:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit] 
 +[    0.665087] pci 0001:01:00.0: PME# supported from D0 D3hot D3cold 
 +[    0.665542] pci 0001:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0001:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link) 
 +[    0.670035] PCI: bus1: Fast back to back transfers disabled 
 +[    0.670122] pci 0001:00:00.0: BAR 8: assigned [mem 0x2e000000-0x2e1fffff] 
 +[    0.670150] pci 0001:01:00.0: BAR 0: assigned [mem 0x2e000000-0x2e1fffff 64bit] 
 +[    0.670308] pci 0001:00:00.0: PCI bridge to [bus 01-ff] 
 +[    0.670332] pci 0001:00:00.0:   bridge window [mem 0x2e000000-0x2e1fffff] 
 +[    0.671289] pcieport 0001:00:00.0: AER: enabled with IRQ 46 
 +[    0.674463] L2 @ QSB rate. Forcing new rate. 
 +[    0.674702] L2 @ 384000 KHz 
 +[    0.674902] CPU0 @ 800000 KHz 
 +[    0.674920] CPU1 @ QSB rate. Forcing new rate. 
 +[    0.675055] CPU1 @ 384000 KHz 
 +[    0.679291] gsbi 16300000.gsbi: GSBI port protocol: 6 crci: 0 
 +[    0.681502] gsbi 1a200000.gsbi: GSBI port protocol: 3 crci: 0 
 +[    0.683653] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled 
 +[    0.684488] msm_serial 16340000.serial: msm_serial: detected port #0 
 +[    0.684546] msm_serial 16340000.serial: uartclk = 7372800 
 +[    0.684623] 16340000.serial: ttyMSM0 at MMIO 0x16340000 (irq = 47, base_baud = 460800) is a MSM 
 +[    0.684664] msm_serial: console setup on port #0 
 +[    1.526188] printk: console [ttyMSM0] enabled 
 +[    1.531416] msm_serial: driver initialized 
 +[    1.541017] loop: module loaded 
 +[    1.542684] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xaa 
 +[    1.542976] nand: Macronix MX30UF2G18AC 
 +[    1.549573] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 
 +[    1.553229] Block protection check failed 
 +[    1.561150] 29 fixed-partitions partitions found on MTD device qcom_nand.0 
 +[    1.564851] Creating 29 MTD partitions on "qcom_nand.0": 
 +[    1.571720] 0x000000000000-0x000000040000 : "0:SBL1" 
 +[    1.578116] 0x000000040000-0x000000180000 : "0:MIBIB" 
 +[    1.584708] 0x000000180000-0x0000002c0000 : "0:SBL2" 
 +[    1.589532] 0x0000002c0000-0x000000540000 : "0:SBL3" 
 +[    1.592837] random: fast init done 
 +[    1.600927] 0x000000540000-0x000000660000 : "0:DDRCONFIG" 
 +[    1.603380] 0x000000660000-0x000000780000 : "0:SSD" 
 +[    1.608006] 0x000000780000-0x000000a00000 : "0:TZ" 
 +[    1.615071] 0x000000a00000-0x000000c80000 : "0:RPM" 
 +[    1.619812] 0x000000c80000-0x000001180000 : "0:APPSBL" 
 +[    1.628757] 0x000001180000-0x000001200000 : "0:APPSBLENV" 
 +[    1.630136] 0x000001200000-0x000001340000 : "0:ART" 
 +[    1.635854] 0x000001340000-0x000005340000 : "stock_rootfs" 
 +[    1.743548] 0x000005340000-0x0000053a0000 : "0:BOOTCONFIG" 
 +[    1.745265] 0x0000053a0000-0x0000054e0000 : "0:SBL2_1" 
 +[    1.751268] 0x0000054e0000-0x000005760000 : "0:SBL3_1" 
 +[    1.758519] 0x000005760000-0x000005880000 : "0:DDRCONFIG_1" 
 +[    1.761596] 0x000005880000-0x0000059a0000 : "0:SSD_1" 
 +[    1.766558] 0x0000059a0000-0x000005c20000 : "0:TZ_1" 
 +[    1.774432] 0x000005c20000-0x000005ea0000 : "0:RPM_1" 
 +[    1.779866] 0x000005ea0000-0x000005f00000 : "0:BOOTCONFIG1" 
 +[    1.781601] 0x000005f00000-0x000006400000 : "0:APPSBL_1" 
 +[    1.794369] 0x000006400000-0x00000a400000 : "stock_rootfs_1" 
 +[    1.912824] 0x00000a400000-0x00000a500000 : "stock_fw_env" 
 +[    1.915076] 0x00000a500000-0x00000ad00000 : "stock_config" 
 +[    1.930996] 0x00000ad00000-0x00000af00000 : "stock_PKI" 
 +[    1.934857] 0x00000af00000-0x00000b000000 : "stock_scfgmgr" 
 +[    1.937266] 0x000006400000-0x000006500000 : "fw_env" 
 +[    1.942962] 0x000006500000-0x000010000000 : "ubi" 
 +[    1.959765] random: crng init done 
 +[    2.201595] 0x000001340000-0x000005340000 : "extra" 
 +[    2.342399] spi_qup 1a280000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64 
 +[    2.344701] spi-nor spi0.0: mr25h256 (32 Kbytes) 
 +[    2.371344] switch0: Atheros AR8337 rev. 2 switch registered on 37000000.mdio-mii 
 +[    3.143103] ipq806x-gmac-dwmac 37000000.ethernet: IRQ eth_wake_irq not found 
 +[    3.143164] ipq806x-gmac-dwmac 37000000.ethernet: IRQ eth_lpi not found 
 +[    3.150401] ipq806x-gmac-dwmac 37000000.ethernet: PTP uses main clock 
 +[    3.156867] ipq806x-gmac-dwmac 37000000.ethernet: User ID: 0x10, Synopsys ID: 0x37 
 +[    3.162317] ipq806x-gmac-dwmac 37000000.ethernet: DWMAC1000 
 +[    3.169645] ipq806x-gmac-dwmac 37000000.ethernet: DMA HW capability register supported 
 +[    3.175594] ipq806x-gmac-dwmac 37000000.ethernet: RX Checksum Offload Engine supported 
 +[    3.183283] ipq806x-gmac-dwmac 37000000.ethernet: COE Type 2 
 +[    3.191174] ipq806x-gmac-dwmac 37000000.ethernet: TX Checksum insertion supported 
 +[    3.196900] ipq806x-gmac-dwmac 37000000.ethernet: Wake-Up On Lan supported 
 +[    3.204376] ipq806x-gmac-dwmac 37000000.ethernet: Enhanced/Alternate descriptors 
 +[    3.211135] ipq806x-gmac-dwmac 37000000.ethernet: Enabled extended descriptors 
 +[    3.218602] ipq806x-gmac-dwmac 37000000.ethernet: Ring mode enabled 
 +[    3.225726] ipq806x-gmac-dwmac 37000000.ethernet: Enable RX Mitigation via HW Watchdog Timer 
 +[    3.234783] ipq806x-gmac-dwmac 37200000.ethernet: IRQ eth_wake_irq not found 
 +[    3.240482] ipq806x-gmac-dwmac 37200000.ethernet: IRQ eth_lpi not found 
 +[    3.248077] ipq806x-gmac-dwmac 37200000.ethernet: PTP uses main clock 
 +[    3.254567] ipq806x-gmac-dwmac 37200000.ethernet: User ID: 0x10, Synopsys ID: 0x37 
 +[    3.260451] ipq806x-gmac-dwmac 37200000.ethernet: DWMAC1000 
 +[    3.268042] ipq806x-gmac-dwmac 37200000.ethernet: DMA HW capability register supported 
 +[    3.273807] ipq806x-gmac-dwmac 37200000.ethernet: RX Checksum Offload Engine supported 
 +[    3.281551] ipq806x-gmac-dwmac 37200000.ethernet: COE Type 2 
 +[    3.289344] ipq806x-gmac-dwmac 37200000.ethernet: TX Checksum insertion supported 
 +[    3.295268] ipq806x-gmac-dwmac 37200000.ethernet: Wake-Up On Lan supported 
 +[    3.302637] ipq806x-gmac-dwmac 37200000.ethernet: Enhanced/Alternate descriptors 
 +[    3.309314] ipq806x-gmac-dwmac 37200000.ethernet: Enabled extended descriptors 
 +[    3.316944] ipq806x-gmac-dwmac 37200000.ethernet: Ring mode enabled 
 +[    3.323989] ipq806x-gmac-dwmac 37200000.ethernet: Enable RX Mitigation via HW Watchdog Timer 
 +[    3.332797] ipq806x-gmac-dwmac 37600000.ethernet: IRQ eth_wake_irq not found 
 +[    3.338745] ipq806x-gmac-dwmac 37600000.ethernet: IRQ eth_lpi not found 
 +[    3.346312] ipq806x-gmac-dwmac 37600000.ethernet: PTP uses main clock 
 +[    3.352766] ipq806x-gmac-dwmac 37600000.ethernet: User ID: 0x10, Synopsys ID: 0x37 
 +[    3.358714] ipq806x-gmac-dwmac 37600000.ethernet: DWMAC1000 
 +[    3.366300] ipq806x-gmac-dwmac 37600000.ethernet: DMA HW capability register supported 
 +[    3.372087] ipq806x-gmac-dwmac 37600000.ethernet: RX Checksum Offload Engine supported 
 +[    3.379717] ipq806x-gmac-dwmac 37600000.ethernet: COE Type 2 
 +[    3.387722] ipq806x-gmac-dwmac 37600000.ethernet: TX Checksum insertion supported 
 +[    3.393514] ipq806x-gmac-dwmac 37600000.ethernet: Wake-Up On Lan supported 
 +[    3.400887] ipq806x-gmac-dwmac 37600000.ethernet: Enhanced/Alternate descriptors 
 +[    3.407577] ipq806x-gmac-dwmac 37600000.ethernet: Enabled extended descriptors 
 +[    3.415226] ipq806x-gmac-dwmac 37600000.ethernet: Ring mode enabled 
 +[    3.422255] ipq806x-gmac-dwmac 37600000.ethernet: Enable RX Mitigation via HW Watchdog Timer 
 +[    3.471705] i2c /dev entries driver 
 +[    3.478655] sdhci: Secure Digital Host Controller Interface driver 
 +[    3.478703] sdhci: Copyright(c) Pierre Ossman 
 +[    3.483868] sdhci-pltfm: SDHCI platform and OF driver helper 
 +[    3.492161] NET: Registered protocol family 10 
 +[    3.496875] Segment Routing with IPv6 
 +[    3.498304] NET: Registered protocol family 17 
 +[    3.502656] 8021q: 802.1Q VLAN Support v1.8 
 +[    3.506355] Registering SWP/SWPB emulation handler 
 +[    3.548644] qcom_rpm 108000.rpm: RPM firmware 3.0.16777372 
 +[    3.566605] s1a: Bringing 0uV into 1050000-1050000uV 
 +[    3.567053] s1a: supplied by regulator-dummy 
 +[    3.570964] s1b: Bringing 0uV into 1050000-1050000uV 
 +[    3.575242] s1b: supplied by regulator-dummy 
 +[    3.580053] s2a: Bringing 0uV into 775000-775000uV 
 +[    3.584535] s2a: supplied by regulator-dummy 
 +[    3.588911] s2b: Bringing 0uV into 775000-775000uV 
 +[    3.593556] s2b: supplied by regulator-dummy 
 +[    3.600732] thermal thermal_zone0: failed to read out thermal zone (-110) 
 +[    3.620185] UBI: auto-attach mtd27 
 +[    3.620209] ubi0: attaching mtd27 
 +[    4.925052] ubi0: scanning is finished 
 +[    4.935887] ubi0: attached mtd27 (name "ubi", size 155 MiB) 
 +[    4.935909] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes 
 +[    4.940257] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 
 +[    4.947289] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096 
 +[    4.954131] ubi0: good PEBs: 1240, bad PEBs: 0, corrupted PEBs: 0 
 +[    4.960902] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128 
 +[    4.967084] ubi0: max/mean erase counter: 6/3, WL threshold: 4096, image sequence number: 844703907 
 +[    4.974279] ubi0: available PEBs: 0, total reserved PEBs: 1240, PEBs reserved for bad PEB handling: 40 
 +[    5.020931] ubi0: background thread "ubi_bgt0d" started, PID 120 
 +[    5.021369] block ubiblock0_1: created from ubi0:1(roo[    5.035495] VFS: Mounted root (squashfs filesystem) readonly on device 254:0. 
 +[    5.036470] Freeing unused kernel memory: 1024K 
 +[    5.071431] Run /sbin/init as init process 
 +[    5.513983] init: Console is alive 
 +[    5.514132] init: - watchdog - 
 +[    5.516339] init: Watchdog has previously reset the system 
 +[    6.413076] kmodloader: loading kernel modules from /etc/modules-boot.d/
 +[    6.499924] genirq: irq_chip msmgpio did not update eff. affinity mask of irq 49 
 +[    6.501489] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver 
 +[    6.510380] SCSI subsystem initialized 
 +[    6.523404] ehci-fsl: Freescale EHCI Host controller driver 
 +[    6.524350] ehci-platform: EHCI generic platform driver 
 +[    6.534206] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver 
 +[    6.535006] ohci-platform: OHCI generic platform driver 
 +[    6.540963] dwc3-qcom 110f8800.usb3: IRQ hs_phy_irq not found 
 +[    6.544408] dwc3-qcom 110f8800.usb3: IRQ dp_hs_phy_irq not found 
 +[    6.550308] dwc3-qcom 110f8800.usb3: IRQ dm_hs_phy_irq not found 
 +[    6.556511] dwc3-qcom 110f8800.usb3: IRQ ss_phy_irq not found 
 +[    6.564821] dwc3-qcom 100f8800.usb3: IRQ hs_phy_irq not found 
 +[    6.568016] dwc3-qcom 100f8800.usb3: IRQ dp_hs_phy_irq not found 
 +[    6.573839] dwc3-qcom 100f8800.usb3: IRQ dm_hs_phy_irq not found 
 +[    6.579820] dwc3-qcom 100f8800.usb3: IRQ ss_phy_irq not found 
 +[    6.724518] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller 
 +[    6.724575] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1 
 +[    6.729081] xhci-hcd xhci-hcd.0.auto: hcc params 0x0228f065 hci version 0x100 quirks 0x0000000002010010 
 +[    6.736631] xhci-hcd xhci-hcd.0.auto: irq 51, io mem 0x11000000 
 +[    6.746882] hub 1-0:1.0: USB hub found 
 +[    6.751878] hub 1-0:1.0: 1 port detected 
 +[    6.755876] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller 
 +[    6.759637] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2 
 +[    6.765014] xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0 SuperSpeed 
 +[    6.783289] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM. 
 +[    6.784287] hub 2-0:1.0: USB hub found 
 +[    6.790516] hub 2-0:1.0: 1 port detected 
 +[    6.795071] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller 
 +[    6.798131] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 3 
 +[    6.803784] xhci-hcd xhci-hcd.1.auto: hcc params 0x0228f065 hci version 0x100 quirks 0x0000000002010010 
 +[    6.811141] xhci-hcd xhci-hcd.1.auto: irq 52, io mem 0x10000000 
 +[    6.821992] hub 3-0:1.0: USB hub found 
 +[    6.826525] hub 3-0:1.0: 1 port detected 
 +[    6.830656] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller 
 +[    6.834250] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 4 
 +[    6.839436] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed 
 +[    6.847418] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM. 
 +[    6.854827] hub 4-0:1.0: USB hub found 
 +[    6.861987] hub 4-0:1.0: 1 port detected 
 +[    6.868677] kmodloader: done loading kernel modules from /etc/modules-boot.d/
 +[    6.876058] init: - preinit - 
 +[    8.533882] dwmac1000: Master AXI performs any burst length 
 +[    8.533922] ipq806x-gmac-dwmac 37200000.ethernet eth1: No Safety Features support found 
 +[    8.548274] ipq806x-gmac-dwmac 37200000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported 
 +[    8.548429] ipq806x-gmac-dwmac 37200000.ethernet eth1: registered PTP clock 
 +[    8.567364] ipq806x-gmac-dwmac 37200000.ethernet eth1: configuring for fixed/sgmii link mode 
 +[    8.567673] ipq806x-gmac-dwmac 37200000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off 
 +[    8.575257] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready 
 +Press the [f] key and hit [enter] to enter failsafe mode 
 +Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level 
 +[   12.810822] UBIFS (ubi0:2): Mounting in unauthenticated mode 
 +[   12.813104] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 204 
 +[   12.869796] UBIFS (ubi0:2): recovery needed 
 +[   13.001439] UBIFS (ubi0:2): recovery completed 
 +[   13.001549] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data" 
 +[   13.004818] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes 
 +[   13.012758] UBIFS (ubi0:2): FS size: 142594048 bytes (135 MiB, 1123 LEBs), journal size 7110656 bytes (6 MiB, 56 LEBs) 
 +[   13.022657] UBIFS (ubi0:2): reserved for root: 4952683 bytes (4836 KiB) 
 +[   13.033248] UBIFS (ubi0:2): media format: w5/r0 (latest is w5/r0), UUID 9987FD54-6DCF-4D5C-A5E1-C411B7B216B2, small LPT model 
 +[   13.044087] mount_root: switching to ubifs overlay 
 +[   13.062241] urandom-seed: Seeding with /etc/urandom.seed 
 +[   13.212960] ipq806x-gmac-dwmac 37200000.ethernet eth1: Link is Down 
 +[   13.218326] procd: - early - 
 +[   13.218422] procd: - watchdog - 
 +[   13.221318] procd: Watchdog has previously reset the system 
 +[   13.908679] procd: - watchdog - 
 +[   13.908936] procd: Watchdog has previously reset the system 
 +[   13.915378] procd: - ubus - 
 +[   13.984023] procd: - init - 
 +Please press Enter to activate this console. 
 +[   14.426638] urngd: v1.0.2 started. 
 +[   14.447336] kmodloader: loading kernel modules from /etc/modules.d/
 +[   14.507565] Loading modules backported from Linux version v5.15.8-0-g43e577d7a2cb 
 +[   14.507602] Backport generated by backports.git v5.15.8-1-0-g83f664bb 
 +[   14.848857] PPP generic driver version 2.4.2 
 +[   14.849471] NET: Registered protocol family 24 
 +[   14.865188] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x46. 
 +[   14.865779] ath10k_pci 0000:01:00.0: enabling device (0140 -> 0142) 
 +[   14.872740] ath10k_pci 0000:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0 
 +[   16.025000] ath10k_pci 0000:01:00.0: qca9984/qca9994 hw1.0 target 0x01000000 chip_id 0x00000000 sub 168c:cafe 
 +[   16.025116] ath10k_pci 0000:01:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0 
 +[   16.040317] ath10k_pci 0000:01:00.0: firmware ver 10.4b-ct-9984-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 7ea63dc5 
 +[   18.395108] ath10k_pci 0000:01:00.0: board_file api 2 bmi_id 0:1 crc32 85498734 
 +[   21.943700] ath10k_pci 0000:01:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96 
 +[   21.943740] ath10k_pci 0000:01:00.0: msdu-desc: 2500  skid: 32 
 +[   22.026205] ath10k_pci 0000:01:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0' 
 +[   22.027062] ath10k_pci 0000:01:00.0: wmi print 'free: 84920 iram: 13156 sram: 11224' 
 +[   22.316200] ath10k_pci 0000:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-nvmem max-sta 32 raw 0 hwcrypto 1 
 +[   22.419148] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x40. 
 +[   22.420568] ath10k_pci 0001:01:00.0: enabling device (0140 -> 0142) 
 +[   22.427153] ath10k_pci 0001:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0 
 +[   23.679652] ath10k_pci 0001:01:00.0: qca99x0 hw2.0 target 0x01000000 chip_id 0x003b01ff sub 168c:0002 
 +[   23.679716] ath10k_pci 0001:01:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0 
 +[   23.693328] ath10k_pci 0001:01:00.0: firmware ver 10.4b-ct-9980-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 b36a12bf 
 +[   23.781162] ath10k_pci 0001:01:00.0: board_file api 2 bmi_id 1:2 crc32 e4a0f655 
 +[   24.935862] ath10k_pci 0001:01:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96 
 +[   24.935897] ath10k_pci 0001:01:00.0: msdu-desc: 2500  skid: 32 
 +[   25.014636] ath10k_pci 0001:01:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0' 
 +[   25.015426] ath10k_pci 0001:01:00.0: wmi print 'free: 31080 iram: 23028 sram: 9596' 
 +[   25.356923] ath10k_pci 0001:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-nvmem max-sta 32 raw 0 hwcrypto 1 
 +[   25.470279] kmodloader: done loading kernel modules from /etc/modules.d/
 +[   29.418694] dwmac1000: Master AXI performs any burst length 
 +[   29.418727] ipq806x-gmac-dwmac 37200000.ethernet eth1: No Safety Features support found 
 +[   29.433158] ipq806x-gmac-dwmac 37200000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported 
 +[   29.433280] ipq806x-gmac-dwmac 37200000.ethernet eth1: registered PTP clock 
 +[   29.441081] ipq806x-gmac-dwmac 37200000.ethernet eth1: configuring for fixed/sgmii link mode 
 +[   29.448942] ipq806x-gmac-dwmac 37200000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off 
 +[   29.457835] br-lan: port 1(eth1) entered blocking state 
 +[   29.465394] br-lan: port 1(eth1) entered disabled state 
 +[   29.470516] device eth1 entered promiscuous mode 
 +[   29.479752] br-lan: port 1(eth1) entered blocking state 
 +[   29.480412] br-lan: port 1(eth1) entered forwarding state 
 +[   29.585538] ipq806x-gmac-dwmac 37600000.ethernet eth2: PHY [37000000.mdio-mii:07] driver [Qualcomm Atheros AR8031/AR8033] (irq=POLL) 
 +[   29.590721] dwmac1000: Master AXI performs any burst length 
 +[   29.596519] ipq806x-gmac-dwmac 37600000.ethernet eth2: No Safety Features support found 
 +[   29.611969] ipq806x-gmac-dwmac 37600000.ethernet eth2: IEEE 1588-2008 Advanced Timestamp supported 
 +[   29.612097] ipq806x-gmac-dwmac 37600000.ethernet eth2: registered PTP clock 
 +[   29.621259] ipq806x-gmac-dwmac 37600000.ethernet eth2: configuring for phy/sgmii link mode 
 +[   31.395293] ath10k_pci 0001:01:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96 
 +[   31.395327] ath10k_pci 0001:01:00.0: msdu-desc: 2500  skid: 32 
 +[   31.474247] ath10k_pci 0001:01:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0' 
 +[   31.475015] ath10k_pci 0001:01:00.0: wmi print 'free: 31080 iram: 23028 sram: 9596' 
 +[   31.909007] ath10k_pci 0001:01:00.0: rts threshold -1 
 +[   31.911267] ath10k_pci 0001:01:00.0: Firmware lacks feature flag indicating a retry limit of > 2 is OK, requested limit: 4 
 +[   31.913306] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready 
 +[   32.214822] ath10k_pci 0001:01:00.0: NOTE:  Firmware DBGLOG output disabled in debug_mask: 0x10000000 
 +[   33.196481] wlan1: authenticate with [...mac-addr...] 
 +[   33.541081] wlan1: send auth to [...mac-addr...] (try 1/3) 
 +[   33.544571] wlan1: authenticated 
 +[   33.551010] wlan1: associate with [...mac-addr...] (try 1/3) 
 +[   33.951793] wlan1: associate with [...mac-addr...] (try 2/3) 
 +[   34.218473] wlan1: RX AssocResp from [...mac-addr...] (capab=0x1431 status=0 aid=1) 
 +[   34.219534] ath10k_pci 0001:01:00.0: pdev param 0 not supported by firmware 
 +[   34.225403] ath10k_pci 0001:01:00.0: failed to enable peer stats info: -95 
 +[   34.232107] wlan1: associated 
 +[   34.401669] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
 </WRAP>\\ </WRAP>\\
  
-===== Notes =====+ 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 + 
 +/* ===== Notes ===== */ 
  
 ===== Tags ===== ===== Tags =====
-[[meta:tags|How to add tags]] +{{tag>ipq806x ipq8065 256NAND 512ram 5port GigabitEthernet 802.11abgnac QCA9983 QCA9984 MU-MIMO TxBF VHT160 3x3 4x4 1USB USB3.0 wave2 dual_firmware}}
-{{tag>EXAMPLETAG unsupported}}+
  • Last modified: 2023/10/18 02:53
  • by lanchon