User Tools

Site Tools


toh:linksys:linksys_ea8300

Linksys EA8300

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

The Linksys EA8300 is a MU-MIMO Tri-Band WiFi router, which has one 2.4GHz and two 5GHz WiFi Interfaces, making it an interesting choice for wireless backhaul or repeater applications. The radios support MCS 0-9 (up through 256 QAM) for devices and paths that are compatible with those high-density modulations.

Note: The first 5 GHz radio (IPQ4019) is limited to ch. 64 and below. The second 5 GHz radio (QCA9888), is limited to ch. 100 and above. This is consistent with OEM firmware and is a result of the ART data and the data in the OEM firmware's cal data. This is perhaps due to RF design optimization and/or interoperation with 2.4 GHz, such as the two, shared antennas.

It has four 1G LAN ports, one 1G WAN port, a USB 3.0 interface and four external antennas.

The device is equipped with a Bluetooth chip. It is powered by an external 12V, 2A power adapter and supports DFS and 256QAM.

Supported Versions

Hardware Highlights

ModelVersionSoCCPU MHzFlash MBRAM MBWLAN HardwareWLAN2.4WLAN5.0100M portsGbit portsModemUSB
EA8300Qualcomm IPQ4019717256NAND256Qualcomm Atheros IPQ4019, Qualcomm Atheros QCA9886b/g/na/n/ac-5-1x 3.0

Installation

Preparation for OEM GUI-Based Install

Build or download from the OpenWrt site a factory.bin image.

If the device has already been configured, you may wish to preserve the settings in both the form that the OEM firmware provides, as well as notes on what you may wish to configure under OpenWrt. The OEM settings are not compatible with OpenWrt and cannot be transferred directly.

If you have previously configured the device with a Linksys account, you may need to reset it to factory-default settings to gain access to the screens required. From https://www.linksys.com/us/support-article?articleNum=226167

1. How can I reset my router to factory defaults?

There are two ways to reset the Linksys EA8300 to factory defaults:
* Hardware Reset – Press and hold the Reset button on the back panel of the Linksys EA8300 for about 10 seconds.
* Software Reset – Log in to your Linksys cloud account. Under Router Settings, click Troubleshooting > Diagnostics. Click Reset under Factory reset.

Only the hardware-reset technique has been confirmed by the author.

Connect an Ethernet cable to one of the “LAN” ports. Do not connect the “Internet” port.

Connect the other end of the Ethernet cable to an interface configured on the 192.168.1.0/24 network. While DHCP may work for this, a fixed IP address may ease configuration under OpenWrt when the device reboots.

Installation Through OEM GUI

The Linksys GUI makes it challenging to navigate past their “helpful” cloud service and to find how to upload firmware. If you get totally lost and can't get there, a reset to factory defaults, as described just above, can be helpful.

These screenshots and directions for OEM v1.1.3, as shipped in early 2019.

Power up the router and wait for it to boot, The white, LINKSYS light will be on solid when the router is booted and ready.

Open a browser and navigate to http://192.168.1.1/

Do not hit “Next” but instead proceed to “Manual configuration”

On the “Internet connection is down” screen, after confirming that the “Login” button is to “log in to your router without Internet access”, click the “Login” button.

On the “Sign In” screen, enter the password, then click “Sign In”. At this time (early 2019), the default is admin

On the “Smart Wi-Fi Tools” screen, select “Connectivity”

On the “Connectivity” screen, in the “Manual” section, choose the OpenWrt factory.bin file using the file-picker window.

Once you have confirmed you have selected the proper OpenWrt factory.bin file, click “Start”

You're given one more warning

The firmware will upload, the router will reboot, and likely when the browser refreshes, will tell you that the router was not found. This may occur even if you have LuCI installed, as the URL is not one that LuCI recognizes. OpenWrt should be running at this point with default “LAN” address, 192.168.1.1/24 in early 2019.

Note: “snapshot” builds do not have LuCI pre-installed. Once you have SSH access and Internet access, it can be installed with

opkg update
opkg install luci-ssl-nginx

If you believe that you may want to return to OEM firmware, do not flash twice at this time to make return to OEM simple.

The OEM firmware will remain on the “other” firmware of the two that this device keeps. This device, with OEM or with OpenWrt, “see-saws” between the two sets with every flash. As a result, if you flash from the just-installed OpenWrt, it will overwrite your previous OEM version.

Hardware

Info

Brand Linksys
Model EA8300
Versions V1.0
Device-Type WiFi-Router MU-MIMO Tri-Band
FCC-ID Q87-EA8300
User guide Linksys user guide (PDF)
Stock-Firmware Ver. 1.1.3.184925 - 11/15/2017 - 47.4 MB
Ver. 1.1.4.191539 - 11/8/2018 - 49.0 MB
SoC Qualcomm IPQ4019
CPU-Cores 4x ARM Cortex A7
CPU-Freq 717 MHz
Flash-Size 256 MB
Flash-Type Macronix MX30LF2G18AC-TI or Winbond W29N02GV
256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
RAM-Size 256 MB
RAM-Type Nanya NT5CC128M16IP-DI
Power 12V, 2A
WLAN1 type Qualcomm IPQ4019
WLAN1 protocols abgn+ac
WLAN1 antenna non-detachable
WLAN1 MIMO conf. 2×2:2
WLAN1 2.4 GHz 400 Mbps (802.11n @ 40 MHz ch., 256QAM)
WLAN1 5 GHz 867 Mbps (802.11ac @ 80 MHz ch.) (only ch. 64 and below)
WLAN2 type Qualcomm Atheros QCA9888
WLAN2 protocols an+ac
WLAN2 antenna non-detachable
WLAN2 MIMO conf. 2×2:2
WLAN2 5 GHz 867 Mbps (802.11ac @ 80 MHz ch.) (only ch. 100 and above)
ETH chip Qualcomm IPQ4019
Switch Qualcomm Atheros QCA8075 (Integrated)
LAN ports 4x 10/100/1000
WAN ports 1x 10/100/1000
Bluetooth Vers. 4.1
Bluetooth Chip Qualcomm CSR8811
Power Amplifier SKY85408-11 for 5 GHz WiFi
USB 1x 3.0

Flash Layout

Linksys EA8300 (NAND): OEM Layout
raw NAND flash memory chip (Winbond W29N02GV) 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
mtd0 mtd1 mtd2 mtd3 mtd4 mtd5 mtd6 mtd7 mtd8 mtd9 mtd10
(overlaps mtd11)
mtd11 mtd12
(overlaps mtd13)
mtd13 mtd14 mtd15
Size 1 MiB 1 MiB 1 MiB 512 kiB 512 kiB 512 kiB 2 MiB 512 kiB 256 kiB 256 kiB 88 MiB 85 MiB 88 MiB 85 MiB 1 MiB 70.5 MiB
Start Addr 0x00000000 0x00100000 0x00200000 0x00300000 0x00380000 0x00400000 0x00480000 0x00680000 0x00700000 0x00740000 0x00780000 0x00a80000 0x05f80000 0x06280000 0x0b780000 0x0b880000
Name (OEM) 0:SBL1 0:MBIB 0:QSEE 0:CDT 0:APPSBLENV 0:ART 0:APPSBL u_env s_env devinfo kernel rootfs alt_kernel alt_rootfs sysdiag syscfg
Mountpoint (OEM) (kernel) / (kernel) / /tmp/var/config
Name (OpenWrt) sbl1 mbib qsee cdt appsblenv ART appsbl u_env s_env devinfo kernel rootfs alt_kernel alt_rootfs sysdiag syscfg
File System (raw) (raw) (raw/text) (bootcount
records)
(raw/text) (raw)
(3 MiB)
UBIFS
69.3 M
(raw)
(3 MiB)
UBIFS
69.3 M
UBIFS
56.4 M
OpenWrt
read-only?
r/o r/o r/o r/o r/o r/o r/o r/o r/o r/o

(255 of 256 MiB used)

Note that the boot loader, by default, erases for flashing an 88 MiB (0x05800000) image size.

See also Flash layout

Photos

Opening the case

Tools Needed:

  • Small, flat bladed screwdriver, 3-5 mm, for prying off the feet
  • Torx TR10 (security) driver or key
  • Stiff, plastic spatula for prying apart the case top from bottom (slightly smaller than thickness of groove is good)

To open the case, carefully remove the four round rubbers on the back side of EA8300. They are mounted with sticky adhesive. With the label readable, the two upper feet have their screw holes at the 6 o'clock position. The two lower feet have the holes at the 9 o'clock on the left, the 3 o'clock on the right, though not as close to the edge as the upper holes. Knowing the location of these holes may ease the removal of the feet.

Yes, really, use a key made for the security Torx screws. Bondhus makes good sets of keys (such as the 32432, TR6-TR25) that sell for ~US$15. Wiha likely has something similar for European users. Carefully remove the four Torx TR10 (security) screws, revealed by the removal of the feet.

Now, you need to rotate the EA8300 again, to the upper side. It is good to have a little and stable plastic spatula, to open the head cover. Take the spatula and put it carefully between the slot, holding EA8300's body and head cover together. Move the spatula against the head cover, so that you can leverage the body from it. and turn the spatula all around the EA8300's slot (360 degree), while leveraging as described before. Be careful, the clips are thin plastic and can be broken. Now, you should can remove the head cover very easily, without significant force.

The PCB can be carefully rotated up from the front for additional access. If you would like to fully remove the PCB, just remove the antenna plugs on the frontside of the PCB. (Note that u.FL-style plugs have a limited number of cycles, and are very fragile.) Lift up the PCB a little bit, on the antenna-plug-side. Now, pull it carefully to get it removed and beware of the WPS switch on the right side of the case.

Serial

port.serial general information about the serial port, serial port cable, etc.

Serial connection was made to J3 on the right edge of the PCB, viewed from above and the front of the router.

3.3 V levels seen. Pin 1 is closest to the rear (Ethernet ports) of the device

J3
PIN 1 PIN 2 PIN 3 PIN 4 PIN 5
TXD RXD GND
Serial connection parameters
for Linksys EA8300 V1
115200, 8N1

OEM Firmware

https://www.linksys.com/us/support-article?articleNum=226202

FIRMWARE (as of 2019-02-05) Ver. 1.1.4.191539 Latest Date: 11/8/2018 Download 49.0 MB

Release Notes

GPL distribution http://downloads.linksys.com/downloads/gpl/EA8300_v1.1.3.184925_GPL.tar.gz includes linux-3.4.103.tar.xz

Boot log for “firmware version 1.1.3.184925” indicates 3.14.77

Revert to Stock

To revert to stock, the OEM firmware should be available on the device. For the purposes of this description, it is at /tmp/FW_EA8300_1.1.4.191539_prod.img

Realize that any time you are writing to flash using low-level commands, there is the chance of unrecoverable corruption. Make sure that you understand what these commands are doing and ensure that the power to the device is not interruptible.

The first step is to determine which firmware you wish to flash. The currently mounted OpenWrt firmware can usually be determined by

root@test:~# cat /sys/devices/virtual/ubi/ubi0/mtd_num 
13

11 indicates that kernel is mounted, 13, that alt_kernel is mounted.

In most cases people should overwrite the “other” firmware.

Erase the other firmware partition and flash the firmware

  mtd erase kernel
  mtd write /tmp/FW_EA8300_1.1.4.191539_prod.img kernel

After confirming success, you can set the next-boot partition with

  fw_setenv boot_part 1  # to set for kernel
  fw_setenv boot_part 2  # to set for alt_kernel

TFTP Recovery

U-Boot

Serial access is required.

The about-to-be booted partition is selected by boot_part. This can be used to decide which of the two firmware areas to flash.

The default addresses and file names involved are

image=dallas.img
imgsize=5800000
ipaddr=192.168.1.1
netmask=255.255.255.0
serverip=192.168.1.254

The U-Boot commands run flashimg and run flashimg2 will retrieve the file referenced by $image from the TFTP server and flash it to part 1 or part2, respectively. Changing the next-boot partition is suggested, remember to saveenv if it has been changed. run bootpart1 or run bootpart2 “ignores” boot_part. reset will reboot, and then begin the boot sequence with the persisted environment.

Linksys Utility

Linksys provides a page that appears to describe some kind of Windows utility for flashing firmware. It is untested. https://www.linksys.com/us/support-article/?articleNum=137928

FIXME: Determine if/how the Linksys utility works. (fyi: it does not work for EA6350v3 which is very similar to EA8300)

Recovery (Automatic)

The EA8300 is a dual firmware device. ie. There are 2 partitions and Linksys firmware is copied to both partitions at the factory. When you install/update the Linksys firmware, or install/update OpenWrt, the new firmware is always written to the other partition. Upon restarting the EA6350v3, it will subsequently try to boot from the newly installed firmware image from other partition.

If the device fails to boot after install or upgrade, whilst the unit is turned on:

  1. Wait 15 seconds
  2. Switch Off and Wait 10 seconds
  3. Switch on
  4. Repeat steps 1 to 3, 3 times then go to 5.
  5. U-boot will switch back to the last working firmware - you should be able to access your router on LAN.

The above method can be used to toggle between the two firmwares.

Warning: If you install/update OpenWrt more than once, both partitions will be overwritten with OpenWrt firmwares, and you won't be able to revert back to Linksys OEM firmware using above method.

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

Boot Loader

U-Boot 2012.07 [Chaos Calmer 15.05.1,r35193] (Nov 02 2017 - 16:33:09)

CBT U-Boot ver: 1.2.9

smem ram ptable found: ver: 1 len: 3
DRAM:  256 MiB
machid : 0x8010006
NAND:  ID = 9590daef
Vendor = ef
Device = da
ONFI device found
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC:   qca_mmc: 0
PCI0 Link Intialized
In:    serial
Out:   serial
Err:   serial
machid: 8010006
flash_type: 2
Net:   MAC0 addr:0:3:7f:ba:db:ad
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0

Updating boot_count ... done

Hit any key to stop autoboot:  0 
(IPQ40xx) # version

U-Boot 2012.07 [Chaos Calmer 15.05.1,r35193] (Nov 02 2017 - 16:33:09)
arm-openwrt-linux-uclibcgnueabi-gcc (OpenWrt/Linaro GCC 4.8-2014.04 r35193) 4.8.3
GNU ld (GNU Binutils) 2.24.0
(IPQ40xx) # printenv
altkern=5f80000
auto_recovery=yes
baudrate=115200
boot_part=1
boot_part_ready=3
boot_ver=1.2.9
bootcmd=if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi
bootdelay=2
bootpart1=set bootargs $partbootargs && nand read $loadaddr $prikern $kernsize && bootm $loadaddr
bootpart2=set bootargs $partbootargs2 && nand read $loadaddr $altkern $kernsize && bootm $loadaddr
ethact=eth0
ethaddr=00:03:7f:ba:db:ad
flash_type=2
flashimg=tftp $loadaddr $image && nand erase $prikern $imgsize && nand write $loadaddr $prikern $filesize
flashimg2=tftp $loadaddr $image && nand erase $altkern $imgsize && nand write $loadaddr $altkern $filesize
image=dallas.img
imgsize=5800000
ipaddr=192.168.1.1
kernsize=300000
loadaddr=84000000
machid=8010006
netmask=255.255.255.0
partbootargs=init=/sbin/init rootfstype=ubifs ubi.mtd=11,2048 root=ubi0:ubifs rootwait rw
partbootargs2=init=/sbin/init rootfstype=ubifs ubi.mtd=13,2048 root=ubi0:ubifs rootwait rw
prikern=780000
serverip=192.168.1.254
stderr=serial
stdin=serial
stdout=serial

Environment size: 1130/262140 bytes
(IPQ40xx) # tftp
eth0 PHY0 up Speed :1000 Full duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
*** Warning: no boot file name; using 'C0A80101.img'
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'C0A80101.img'.
Load address: 0x84000000

Flash Layouts

OEM

“firmware version 1.1.3.184925”

Creating 16 MTD partitions on "7980000.qcom,nand":
0x000000000000-0x000000100000 : "0:SBL1"
0x000000100000-0x000000200000 : "0:MIBIB"
0x000000200000-0x000000300000 : "0:QSEE"
0x000000300000-0x000000380000 : "0:CDT"
0x000000380000-0x000000400000 : "0:APPSBLENV"
0x000000400000-0x000000480000 : "0:ART"
0x000000480000-0x000000680000 : "0:APPSBL"
0x000000680000-0x000000700000 : "u_env"
0x000000700000-0x000000740000 : "s_env"
0x000000740000-0x000000780000 : "devinfo"
0x000000780000-0x000005f80000 : "kernel"
0x000000a80000-0x000005f80000 : "rootfs"
0x000005f80000-0x00000b780000 : "alt_kernel"
0x000006280000-0x00000b780000 : "alt_rootfs"
0x00000b780000-0x00000b880000 : "sysdiag"
0x00000b880000-0x00000ff00000 : "syscfg"

Bootlogs

OEM bootlog

Format: Log Type - Time(microsec) - Message - Optional Info Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00108 S - IMAGE_VARIANT_STRING=DAACANAZA S - OEM_IMAGE_VERSION_STRING=CRM S - Boot Config, 0x00000025 S - Reset status Config, 0x00000010 S - Core 0 Frequency, 0 MHz B - 261 - PBL, Start B - 1338 - bootable_media_detect_entry, Start B - 2609 - bootable_media_detect_success, Start B - 2623 - elf_loader_entry, Start B - 4030 - auth_hash_seg_entry, Start B - 6181 - auth_hash_seg_exit, Start B - 74262 - elf_segs_hash_verify_entry, Start B - 196333 - PBL, End B - 196357 - SBL1, Start B - 288383 - pm_device_init, Start D - 7 - pm_device_init, Delta B - 289873 - boot_flash_init, Start D - 87133 - boot_flash_init, Delta B - 381308 - boot_config_data_table_init, Start D - 13973 - boot_config_data_table_init, Delta - (419 Bytes) B - 398033 - clock_init, Start D - 7550 - clock_init, Delta B - 409019 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:6 B - 412432 - sbl1_ddr_set_params, Start B - 417527 - cpr_init, Start D - 2 - cpr_init, Delta B - 421909 - Pre_DDR_clock_init, Start D - 4 - Pre_DDR_clock_init, Delta D - 13170 - sbl1_ddr_set_params, Delta B - 435214 - pm_driver_init, Start D - 2 - pm_driver_init, Delta B - 505015 - sbl1_wait_for_ddr_training, Start D - 28 - sbl1_wait_for_ddr_training, Delta B - 520486 - Image Load, Start D - 144019 - QSEE Image Loaded, Delta - (269176 Bytes) B - 664931 - Image Load, Start D - 2121 - SEC Image Loaded, Delta - (2048 Bytes) B - 675076 - Image Load, Start D - 187408 - APPSBL Image Loaded, Delta - (444319 Bytes) B - 862879 - QSEE Execution, Start D - 56 - QSEE Execution, Delta B - 869115 - SBL1, End D - 674760 - SBL1, Delta S - Flash Throughput, 2085 KB/s (715962 Bytes, 343263 us) S - DDR Frequency, 672 MHz U-Boot 2012.07 [Chaos Calmer 15.05.1,r35193] (Jan 23 2017 - 14:17:23) CBT U-Boot ver: 1.2.9 smem ram ptable found: ver: 1 len: 3 DRAM: 256 MiB machid : 0x8010006 NAND: ID = 9590dac2 Vendor = c2 Device = da ONFI device found SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0) 256 MiB MMC: qca_mmc: 0 PCI0 Link Intialized In: serial Out: serial Err: serial machid: 8010006 flash_type: 2 Net: MAC0 addr:0:3:7f:ba:db:ad PHY ID1: 0x4d PHY ID2: 0xd0b1 ipq40xx_ess_sw_init done eth0 Updating boot_count ... done Hit any key to stop autoboot: 0 Memory test start, banksize=0x2000000, data size=0x8000, test count per bank=64 Memory test end, lapsed time = 3 seconds The test result is success NAND read: device 0 offset 0x5f80000, size 0x300000 3145728 bytes read: OK ## Booting kernel from FIT Image at 84000000 ... Using 'config@1' configuration Trying 'kernel@1' kernel subimage Description: ARM Linksys Linux-3.14.77 Type: Kernel Image Compression: uncompressed Data Start: 0x840000e4 Data Size: 2545240 Bytes = 2.4 MiB Architecture: ARM OS: Linux Load Address: 0x80208000 Entry Point: 0x80208000 Hash algo: crc32 Hash value: c68b2f21 Hash algo: sha1 Hash value: f62811ae861b055c3d62e863d52edb504d6a003c Verifying Hash Integrity ... crc32+ sha1+ OK ## Flattened Device Tree from FIT Image at 84000000 Using 'config@1' configuration Trying 'fdt@1' FDT blob subimage Description: ARM Linksys Dallas device tree blob Type: Flat Device Tree Compression: uncompressed Data Start: 0x8426d86c Data Size: 38318 Bytes = 37.4 KiB Architecture: ARM Hash algo: crc32 Hash value: 49f16ad6 Hash algo: sha1 Hash value: 8cf30d490b6467bc83d0fff6fbe26973d15b23e2 Verifying Hash Integrity ... crc32+ sha1+ OK Booting using the fdt blob at 0x8426d86c Loading Kernel Image ... OK OK Loading Device Tree to 871e3000, end 871ef5ad ... OK Device nand2 not found! eth0 MAC Address from ART is not valid eth1 MAC Address from ART is not valid Using machid 0x8010006 from environment Starting kernel ... [ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 3.14.77 (root@build-vm) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r35193) ) #1 SMP PREEMPT Mon Nov 6 00:45:28 PST 2017 [ 0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d [ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache [ 0.000000] Machine model: Linksys Dallas WiFi AP router based on Qualcomm AP DK07.1-c1 [ 0.000000] Reserved memory: failed to reserve memory for node 'rsvd1@87000000': base 0x87000000, size 5 MiB [ 0.000000] Memory policy: Data cache writealloc [ 0.000000] PERCPU: Embedded 8 pages/cpu @cfdc8000 s8448 r8192 d16128 u32768 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 62208 [ 0.000000] Kernel command line: init=/sbin/init rootfstype=ubifs ubi.mtd=13,2048 root=ubi0:ubifs rootwait rw clk_ignore_unused [ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes) [ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) [ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Memory: 240764K/250880K available (4962K kernel code, 415K rwdata, 1664K rodata, 208K init, 325K bss, 10116K reserved, 0K highmem) [ 0.000000] Virtual kernel memory layout: [ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB) [ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB) [ 0.000000] vmalloc : 0xd0800000 - 0xff000000 ( 744 MB) [ 0.000000] lowmem : 0xc0000000 - 0xd0000000 ( 256 MB) [ 0.000000] pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB) [ 0.000000] modules : 0xbf000000 - 0xbfe00000 ( 14 MB) [ 0.000000] .text : 0xc0208000 - 0xc0880d1c (6628 kB) [ 0.000000] .init : 0xc0881000 - 0xc08b5100 ( 209 kB) [ 0.000000] .data : 0xc08b6000 - 0xc091df34 ( 416 kB) [ 0.000000] .bss : 0xc091df34 - 0xc096f5dc ( 326 kB) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 [ 0.000000] Preemptible hierarchical RCU implementation. [ 0.000000] NR_IRQS:16 nr_irqs:16 16 [ 0.000000] Architected cp15 timer(s) running at 48.00MHz (virt). [ 0.000008] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 2863311552512ns [ 0.000018] Switching to timer-based delay loop [ 0.000340] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=480000) [ 0.000359] pid_max: default: 32768 minimum: 301 [ 0.000628] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.000642] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.012216] CPU: Testing write buffer coherency: ok [ 0.012566] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.012634] Setting up static identity map for 0x802137b0 - 0x80213808 [ 0.090613] CPU1: Booted secondary processor [ 0.090658] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001 [ 0.110630] CPU2: Booted secondary processor [ 0.110670] CPU2: thread -1, cpu 2, socket 0, mpidr 80000002 [ 0.130644] CPU3: Booted secondary processor [ 0.130680] CPU3: thread -1, cpu 3, socket 0, mpidr 80000003 [ 0.130816] Brought up 4 CPUs [ 0.130858] SMP: Total of 4 processors activated (384.00 BogoMIPS). [ 0.130868] CPU: All CPU(s) started in SVC mode. [ 0.141053] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5 [ 0.141426] pinctrl core: initialized pinctrl subsystem [ 0.141858] regulator-dummy: no parameters [ 0.142521] NET: Registered protocol family 16 [ 0.144083] DMA: preallocated 2048 KiB pool for atomic coherent allocations [ 0.144607] cpuidle: using governor ladder [ 0.144619] cpuidle: using governor menu [ 0.154962] hw-breakpoint: Debug register access (0xee003e17) caused undefined instruction on CPU 1 [ 0.154970] hw-breakpoint: Debug register access (0xee003e17) caused undefined instruction on CPU 2 [ 0.154978] hw-breakpoint: Debug register access (0xee003e17) caused undefined instruction on CPU 3 [ 0.154982] hw-breakpoint: CPU 2 failed to disable vector catch [ 0.155014] hw-breakpoint: Debug register access (0xee003e17) caused undefined instruction on CPU 0 [ 0.155100] [ 0.155100] Version Rollback Feature Disabled [ 0.158514] i2c-msm-v2 78b7000.i2c: probing driver i2c-msm-v2 [ 0.159298] sps:sps is ready. [ 0.165682] bio: create slab <bio-0> at 0 [ 0.167354] SD0 VccQ: 1800 <--> 3000 mV [ 0.167849] SCSI subsystem initialized [ 0.168539] msm_bus_fabric_init_driver [ 0.168698] msm_bus_device 580000.ad-hoc-bus: Util-fact is missing, default to 100 [ 0.168715] msm_bus_device 580000.ad-hoc-bus: Vrail-comp is missing, default to 100 [ 0.168734] msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus4096 ctx1 [ 0.168776] msm_bus_device 580000.ad-hoc-bus: Util-fact is missing, default to 100 [ 0.168791] msm_bus_device 580000.ad-hoc-bus: Vrail-comp is missing, default to 100 [ 0.168808] msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus1024 ctx1 [ 0.194797] Bluetooth: Core ver 2.18 [ 0.194869] NET: Registered protocol family 31 [ 0.194879] Bluetooth: HCI device and connection manager initialized [ 0.194896] Bluetooth: HCI socket layer initialized [ 0.194911] Bluetooth: L2CAP socket layer initialized [ 0.194979] Bluetooth: SCO socket layer initialized [ 0.195179] 80000.qcom,pcie supply vreg-3.3 not found, using dummy regulator [ 0.195243] 80000.qcom,pcie supply vreg-1.8 not found, using dummy regulator [ 0.195302] 80000.qcom,pcie supply vreg-0.9 not found, using dummy regulator [ 0.195363] 80000.qcom,pcie supply gdsc-vdd not found, using dummy regulator [ 0.290519] msm_pcie_enable: msm_pcie_enable: PCIe: trigger the reset of endpoint of RC0. [ 0.300473] msm_pcie_enable: msm_pcie_enable: PCIe RC0 PHY is ready! [ 0.320474] msm_pcie_enable: msm_pcie_enable: PCIe: Release the reset of endpoint of RC0. [ 0.460611] msm_pcie_enable: msm_pcie_enable: PCIe RC0 link initialized [ 0.460870] PCI host bridge to bus 0000:00 [ 0.460894] pci_bus 0000:00: root bus resource [io 0x40200000-0x402fffff] [ 0.460910] pci_bus 0000:00: root bus resource [mem 0x40300000-0x40ffffff] [ 0.460925] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 0.461006] msm_pcie_oper_conf: msm_pcie_oper_conf: Read of RC0 0:0x00 + 0x0014[4] is all FFs [ 0.461426] PCI: bus0: Fast back to back transfers disabled [ 0.461444] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring [ 0.461714] msm_pcie_oper_conf: msm_pcie_oper_conf: Read of RC0 1:0x00 + 0x0014[4] is all FFs [ 0.462269] PCI: bus1: Fast back to back transfers disabled [ 0.462363] msm_pcie_oper_conf: msm_pcie_oper_conf: Read of RC0 0:0x00 + 0x0028[4] is all FFs [ 0.462398] pci 0000:00:00.0: BAR 8: assigned [mem 0x40400000-0x405fffff] [ 0.462417] pci 0000:00:00.0: BAR 0: assigned [mem 0x40300000-0x40300fff 64bit] [ 0.462448] pci 0000:01:00.0: BAR 0: assigned [mem 0x40400000-0x405fffff 64bit] [ 0.462488] pci 0000:00:00.0: PCI bridge to [bus 01] [ 0.462509] pci 0000:00:00.0: bridge window [mem 0x40400000-0x405fffff] [ 0.462532] msm_pcie_probe: msm_pcie_probe: RC0 is enabled in bootup [ 0.462824] Switched to clocksource arch_sys_counter [ 0.464641] NET: Registered protocol family 2 [ 0.465885] TCP established hash table entries: 2048 (order: 1, 8192 bytes) [ 0.465933] TCP bind hash table entries: 2048 (order: 2, 16384 bytes) [ 0.465983] TCP: Hash tables configured (established 2048 bind 2048) [ 0.466041] TCP: reno registered [ 0.466058] UDP hash table entries: 256 (order: 1, 8192 bytes) [ 0.466088] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) [ 0.466431] NET: Registered protocol family 1 [ 0.467224] hw perfevents: enabled with ARMv7 Cortex-A7 PMU driver, 5 counters available [ 0.468642] futex hash table entries: 1024 (order: 4, 65536 bytes) [ 0.478162] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.478177] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.479142] msgmni has been set to 470 [ 0.480801] Key type asymmetric registered [ 0.480817] Asymmetric key parser 'x509' registered [ 0.480853] io scheduler noop registered [ 0.480863] io scheduler deadline registered (default) [ 0.481782] tcsr 194b000.tcsr: setting usb hs phy mode select = e700e7 [ 0.481851] tcsr 1953000.ess_tcsr: setting ess interface select = 0 [ 0.481922] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000 [ 0.481979] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222 [ 0.482415] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled [ 0.483522] msm_serial_hsl_probe: detected port #0 (ttyMSM0) [ 0.483563] msm_serial_hsl_probe: Bus scaling is disabled [ 0.483714] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 139, base_baud = 115200) is a MSM [ 0.483788] msm_hsl_console_setup: console setup on port #0 [ 1.288005] console [ttyMSM0] enabled [ 1.292089] msm_serial_hsl_init: driver initialized [ 1.297069] uart_tx_gpio is not available [ 1.300494] uart_rx_gpio is not available [ 1.304528] uart_cts_gpio is not available [ 1.308565] uart_rfr_gpio is not available [ 1.312648] Wakeup irq not specified. [ 1.316316] BLSP UART: Bus scaling is disabled. [ 1.320998] sps: BAM device 0x07884000 is not registered yet. [ 1.326562] sps:BAM 0x07884000 is registered. [ 1.331015] 78b0000.uart: ttyQHS0 at MMIO 0x78b0000 (irq = 140, base_baud = 460800) is a MSM HS UART [ 1.340358] qca_serial_hs module loaded [ 1.345948] sps: BAM device 0x07984000 is not registered yet. [ 1.350669] sps:BAM 0x07984000 is registered. [ 1.354871] msm_nand_bam_init: msm_nand_bam_init: BAM device registered: bam_handle 0xcf0b4e00 [ 1.363746] sps:BAM 0x07984000 (va:0xd0a60000) enabled: ver:0x19, number of pipes:7 [ 1.371450] msm_nand_version_check: nand_major:1, nand_minor:4, qpic_major:1, qpic_minor:4 [ 1.379532] msm_nand_scan: missing page size info - extract from NAND ID [ 1.386183] msm_nand_scan: NAND Id: 0x9590dac2 Buswidth: 8Bits Density: 256 MByte [ 1.393646] msm_nand_scan: pagesize: 2048 Erasesize: 131072 oobsize: 64 (in Bytes) [ 1.401180] msm_nand_scan: BCH ECC: 4 Bit [ 1.405198] msm_nand_scan: CFG0: 0x2a0408c0, CFG1: 0x0804745c [ 1.405198] RAWCFG0: 0x280420c0, RAWCFG1: 0x0005045d [ 1.405198] ECCBUFCFG: 0x00000203, ECCBCHCFG: 0x42040700 [ 1.405198] BAD BLOCK BYTE: 0x000001d1 [ 1.427927] 16 ofpart partitions found on MTD device 7980000.qcom,nand [ 1.434358] Creating 16 MTD partitions on "7980000.qcom,nand": [ 1.440170] 0x000000000000-0x000000100000 : "0:SBL1" [ 1.446988] 0x000000100000-0x000000200000 : "0:MIBIB" [ 1.452767] 0x000000200000-0x000000300000 : "0:QSEE" [ 1.458501] 0x000000300000-0x000000380000 : "0:CDT" [ 1.463790] 0x000000380000-0x000000400000 : "0:APPSBLENV" [ 1.469587] 0x000000400000-0x000000480000 : "0:ART" [ 1.474916] 0x000000480000-0x000000680000 : "0:APPSBL" [ 1.481401] 0x000000680000-0x000000700000 : "u_env" [ 1.486637] 0x000000700000-0x000000740000 : "s_env" [ 1.491668] 0x000000740000-0x000000780000 : "devinfo" [ 1.496942] 0x000000780000-0x000005f80000 : "kernel" [ 1.562686] 0x000000a80000-0x000005f80000 : "rootfs" [ 1.626376] mtd: device 11 (rootfs) set to be root filesystem [ 1.631092] 0x000005f80000-0x00000b780000 : "alt_kernel" [ 1.698280] 0x000006280000-0x00000b780000 : "alt_rootfs" [ 1.762369] 0x00000b780000-0x00000b880000 : "sysdiag" [ 1.768244] 0x00000b880000-0x00000ff00000 : "syscfg" [ 1.821806] msm_nand_probe: NANDc phys addr 0x7980000, BAM phys addr 0x7984000, BAM IRQ 133 [ 1.829151] msm_nand_probe: Allocated DMA buffer at virt_addr 0xd0a7b000, phys_addr 0x8f0ba000 [ 1.839739] sps:BAM 0x07884000 (va:0xd0b40000) enabled: ver:0x19, number of pipes:12 [ 1.846758] m25p80 spi0.0: Failed to find sector-size [ 1.863725] libphy: ipq40xx_mdio: probed [ 1.870098] ipq40xx-mdio 90000.mdio: ipq40xx-mdio driver was registered [ 1.875772] tun: Universal TUN/TAP device driver, 1.6 [ 1.880712] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> [ 1.887028] PPP generic driver version 2.4.2 [ 1.891297] PPP BSD Compression module registered [ 1.895838] PPP Deflate Compression module registered [ 1.900854] NET: Registered protocol family 24 [ 1.905296] i2c /dev entries driver [ 1.910332] Bluetooth: HCI UART driver ver 2.2 [ 1.913769] Bluetooth: HCI H4 protocol initialized [ 1.918514] Bluetooth: HCI BCSP protocol initialized [ 1.925468] hidraw: raw HID events driver (C) Jiri Kosina [ 1.930896] u32 classifier [ 1.932567] input device check on [ 1.936256] Netfilter messages via NETLINK v0.30. [ 1.940917] nfnl_acct: registering with nfnetlink. [ 1.945761] nf_conntrack version 0.5.0 (3761 buckets, 15044 max) [ 1.952248] ctnetlink v0.93: registering with nfnetlink. [ 1.957010] nf_conntrack_rtsp v0.7 loading [ 1.961116] ip_set: protocol 6 [ 1.964280] gre: GRE over IPv4 demultiplexor driver [ 1.968941] ip_gre: GRE over IPv4 tunneling driver [ 1.975287] nf_nat_rtsp v0.7 loading [ 1.977866] ip_tables: (C) 2000-2006 Netfilter Core Team [ 1.983408] TCP: cubic registered [ 1.987170] NET: Registered protocol family 10 [ 1.992517] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 1.997270] sit: IPv6 over IPv4 tunneling driver [ 2.003447] NET: Registered protocol family 17 [ 2.006988] Bridge firewalling registered [ 2.010858] Ebtables v2.0 registered [ 2.014688] Bluetooth: RFCOMM TTY layer initialized [ 2.019291] Bluetooth: RFCOMM socket layer initialized [ 2.024449] Bluetooth: RFCOMM ver 1.11 [ 2.028135] Bluetooth: BNEP (Ethernet Emulation) ver 1.3 [ 2.033440] Bluetooth: BNEP filters: protocol multicast [ 2.038641] Bluetooth: BNEP socket layer initialized [ 2.043633] Bluetooth: HIDP (Human Interface Emulation) ver 1.2 [ 2.049491] Bluetooth: HIDP socket layer initialized [ 2.054498] l2tp_core: L2TP core driver, V2.0 [ 2.058783] l2tp_ppp: PPPoL2TP kernel driver, V2.0 [ 2.063560] l2tp_netlink: L2TP netlink interface [ 2.068170] 8021q: 802.1Q VLAN Support v1.8 [ 2.072476] Registering SWP/SWPB emulation handler [ 2.078444] SD0 VccQ: disabling [ 2.080553] regulator-dummy: disabling [ 2.084699] UBI: attaching mtd13 to ubi0 [ 2.441084] UBI: scanning is finished [ 2.450701] UBI: attached mtd13 (name "alt_rootfs", size 85 MiB) to ubi0 [ 2.456404] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 2.463155] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 2.469821] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 2.476696] UBI: good PEBs: 680, bad PEBs: 0, corrupted PEBs: 0 [ 2.482582] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128 [ 2.489717] UBI: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 2086578551 [ 2.498745] UBI: available PEBs: 0, total reserved PEBs: 680, PEBs reserved for bad PEB handling: 40 [ 2.507881] UBI: background thread "ubi_bgt0d" started, PID 73 [ 2.508698] input: gpio_keys.7 as /devices/soc.0/gpio_keys.7/input/input0 [ 2.508946] drivers/rtc/hctosys.c: unable to open rtc device (rtc0) [ 2.512477] clk: Not disabling unused clocks [ 2.532370] UBIFS: background thread "ubifs_bgt0_0" started, PID 75 [ 2.578568] UBIFS: mounted UBI device 0, volume 0, name "ubifs" [ 2.583498] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 2.592575] UBIFS: FS size: 79360000 bytes (75 MiB, 625 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs) [ 2.602223] UBIFS: reserved for root: 0 bytes (0 KiB) [ 2.607262] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 2EAC459E-9655-4413-B027-D3005B5F5761, small LPT model [ 2.619597] VFS: Mounted root (ubifs filesystem) on device 0:11. [ 2.624905] Freeing unused kernel memory: 208K (c0881000 - c08b5000) ********************************************************************************* _ _ __ _ __ _____ __ __ _____ | | | || \ | | / // ____]\ \ / // ____]TM | | | || \ | | / /| (___ \ V /| (____ | | | || |\ \| |\ \ \____ \ \ / \____ \ | |_____ | || | \ | \ \ ____) | | | ____) | |_______||_||_| \__| \_\[____ / |_| [_____/ (c) 2013 Belkin International, Inc. and/or its affiliates. All rights reserved. Booting dallas (firmware version 1.1.3.184925) ********************************************************************************* [utopia][init] System Initialization [utopia][init] Creating /proc [utopia][init] Creating /sys [utopia][init] Creating /dev [utopia][init] Creating /tmp [utopia][init] Allocating 60M for /tmp [utopia][init] Prepairing /dev/pts [utopia][init] Setting /tmp and /var permissions [utopia][init] Starting udev.. [ 3.002265] UBIFS: background thread "ubifs_bgt0_0" stops Attempting mount of ubifs syscfg partition UBI device number 1, total 564 LEBs (71614464 bytes, 68.3 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB) [utopia][init] Using persistent syscfg data from /var/config/syscfg [utopia][init] Starting system logging [utopia][init] Starting sysevent subsystem [utopia][init] Enabling DesignWare USB3 DRD Core drivers [utopia][init] Loading QCA Ethernet, NSS and GMAC drivers net.netfilter.nf_conntrack_acct = 1 [utopia][init] Late loading usb drivers [utopia][init] Setting any unset system values to default [utopia][init] no persistence config file (/var/config/pstcfg) found setting up MAC addresses for all interface based on 24:F5:A2:06:5B:80 NTP Servers do not need to be updated checking for interactive script start up... Updating BootCount Page[40]:14000 ... Done attempting to sync sysinfo.cgi auth credentials [utopia][init] Loading Buttons drivers [utopia][init] Load WiFi cal data from MTD(mtd5) to FS. [utopia][init] Setup link to WiFi firmware and board data (EU) [utopia][init] Using EU region for WiFi firmware and board data NSS Auto scaling disabled inserting fpbypass.ko for QCA Sat Jul 28 20:50:00 UTC 2018 dallas login: wan, sysevent received: wan-start=NULL Guest access control is up Usage: link_aggregation [ link_aggregation-start | link_aggregation-stop | link_aggregation-restart ] SSDK Init OK! operate done. wifi, sysevent received: lan-started (Sat Jul 28 21:50:05 CET 2018) Lighttpd Model Base: EA8300 Generating Rainier lighttpd config Build temporary www configuration directory: wifi, service_start() $1$1bxubP3Z$zhSRiG0zO74sDlifh1FgQ/ Registering Service myrouter._http._tcp.local port 80 Power cycle Ethernet ports. Got a reply for myrouter._http._tcp.local.: Name now registered and active [utopia][init] Loading GMAC and WLAN drivers [utopia][init] Creating wifi devices ath0 ath1 ath10 wifi, wifi_physical_start(ath0) wifi, setting obss rssi threshold (ath0) Invalid command : obss_rx_rssi_th Auto channel Invalid command : acs_2g_allchan wifi, wifi_virtual_start(ath0) wifi, wifi_user_start(ath0) Not ready for JNAP. Sleeping for 15 seconds... wifi_user, ath0 TxBF enabled wifi, primary AP: ath0 is up wifi, wifi_guest_start(ath0) ath2 wifi_user, ath2 TxBF enabled wifi, guest AP: ath2 is up wifi, wifi_physical_start(ath1) [utopia] Not setting ppp_clamp_mtu wifi, setting obss rssi threshold (ath1) Invalid command : obss_rx_rssi_th Auto channel Following channels are blocked from Channel selection algorithm [52] [56] [60] [64] wifi, wifi_virtual_start(ath1) wifi, wifi_user_start(ath1) wifi_user, ath1 TxBF enabled wifi_user, ath1 MU-MIMO enabled wifi, primary AP: ath1 is up SSDK Init OK! operate done. wifi, wifi_guest_start(ath1) RTNETLINK answers: Device or resource busy ath3 wifi_user, ath3 TxBF enabled wifi_user, ath3 MU-MIMO enabled wifi, guest AP: ath3 is up wifi, wifi_physical_start(ath10) wifi, setting obss rssi threshold (ath10) Invalid command : obss_rx_rssi_th Auto channel wifi, wifi_virtual_start(ath10) wifi, wifi_user_start(ath10) wifi_user, ath10 TxBF enabled wifi_user, ath10 MU-MIMO enabled wifi, primary AP: ath10 is up wifi, wifi_guest_start(ath10) wifi, guest ath6 is disabled, do not start wifi guest wifi, start_hostapd() Configuration file: /tmp/hostapd-ath0.conf Configuration file: /tmp/hostapd-ath1.conf Configuration file: /tmp/hostapd-ath10.conf ath0: Could not connect to kernel driver Using interface ath0 with hwaddr 24:f5:a2:06:5b:81 and ssid "Linksys13295" random: Cannot read from /dev/random: Resource temporarily unavailable random: Only 0/20 bytes of strong random data available from /dev/random random: Not enough entropy pool available for secure operations WPA: Not enough entropy in random pool for secure operations - update keys later when the first station connects ath0: interface state UNINITIALIZED->ENABLED ath0: AP-ENABLED ath1: Could not connect to kernel driver Using interface ath1 with hwaddr 24:f5:a2:06:5b:82 and ssid "Linksys13295" random: Cannot read from /dev/random: Resource temporarily unavailable random: Only 0/20 bytes of strong random data available from /dev/random random: Not enough entropy pool available for secure operations WPA: Not enough entropy in random pool for secure operations - update keys later when the first station connects ath1: interface state UNINITIALIZED->ENABLED ath1: AP-ENABLED ath10: Could not connect to kernel driver Using interface ath10 with hwaddr 24:f5:a2:06:5b:83 and ssid "Linksys13295" ===>RESET dallas usb power random: Cannot read from /dev/random: Resource temporarily unavailable random: Only 0/20 bytes of strong random data available from /dev/random random: Not enough entropy pool available for secure operations WPA: Not enough entropy in random pool for secure operations - update keys later when the first station connects ath10: interface state UNINITIALIZED->ENABLED ath10: AP-ENABLED Restarting nfqrecv service... fastpath, sysevent received: qos_enabled wifi, start_lbd() starting daemon [utopia] Not setting ppp_clamp_mtu on dslite protocol wan, sysevent received: phylink_wan_state=down [fw.sh] fwup_checked_after_boot: 0 [fwupd] status details:"ERROR: Connecting server" [fw.sh] fwup_forced_update: 0 Starting smbd ... [fw.sh] fwup_checked_after_boot: 0 [fwupd] status details:"ERROR: Connecting server" [fw.sh] fwup_forced_update: 0


OpenWrt Boot Log (Based on PR of 2019-04-10)

Format: Log Type - Time(microsec) - Message - Optional Info Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00108 S - IMAGE_VARIANT_STRING=DAACANAZA S - OEM_IMAGE_VERSION_STRING=CRM S - Boot Config, 0x00000025 S - Reset status Config, 0x00000010 S - Core 0 Frequency, 0 MHz B - 261 - PBL, Start B - 1339 - bootable_media_detect_entry, Start B - 2608 - bootable_media_detect_success, Start B - 2622 - elf_loader_entry, Start B - 4028 - auth_hash_seg_entry, Start B - 6177 - auth_hash_seg_exit, Start B - 74191 - elf_segs_hash_verify_entry, Start B - 195979 - PBL, End B - 196003 - SBL1, Start B - 288018 - pm_device_init, Start D - 7 - pm_device_init, Delta B - 289507 - boot_flash_init, Start D - 87187 - boot_flash_init, Delta B - 380998 - boot_config_data_table_init, Start D - 13978 - boot_config_data_table_init, Delta - (419 Bytes) B - 397727 - clock_init, Start D - 7576 - clock_init, Delta B - 408737 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:6 B - 412150 - sbl1_ddr_set_params, Start B - 417244 - cpr_init, Start D - 2 - cpr_init, Delta B - 421627 - Pre_DDR_clock_init, Start D - 4 - Pre_DDR_clock_init, Delta D - 13172 - sbl1_ddr_set_params, Delta B - 434932 - pm_driver_init, Start D - 2 - pm_driver_init, Delta B - 504692 - sbl1_wait_for_ddr_training, Start D - 28 - sbl1_wait_for_ddr_training, Delta B - 520019 - Image Load, Start D - 143793 - QSEE Image Loaded, Delta - (269176 Bytes) B - 664236 - Image Load, Start D - 2115 - SEC Image Loaded, Delta - (2048 Bytes) B - 674448 - Image Load, Start D - 186993 - APPSBL Image Loaded, Delta - (444263 Bytes) B - 861837 - QSEE Execution, Start D - 56 - QSEE Execution, Delta B - 868050 - SBL1, End D - 674156 - SBL1, Delta S - Flash Throughput, 2089 KB/s (715906 Bytes, 342621 us) S - DDR Frequency, 672 MHz U-Boot 2012.07 [Chaos Calmer 15.05.1,r35193] (Nov 02 2017 - 16:33:09) CBT U-Boot ver: 1.2.9 smem ram ptable found: ver: 1 len: 3 DRAM: 256 MiB machid : 0x8010006 NAND: ID = 9590daef Vendor = ef Device = da ONFI device found SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0) 256 MiB MMC: qca_mmc: 0 PCI0 Link Intialized In: serial Out: serial Err: serial machid: 8010006 flash_type: 2 Net: MAC0 addr:0:3:7f:ba:db:ad PHY ID1: 0x4d PHY ID2: 0xd0b1 ipq40xx_ess_sw_init done eth0 Updating boot_count ... done Hit any key to stop autoboot: 0 ^MMemory test start, banksize=0x2000000, data size=0x8000, test count per bank=64 ^MMemory test end, lapsed time = 3 seconds ^MThe test result is success NAND read: device 0 offset 0x5f80000, size 0x300000 3145728 bytes read: OK ## Booting kernel from FIT Image at 84000000 ... Using 'config@1' configuration Trying 'kernel@1' kernel subimage Description: ARM OpenWrt Linux-4.14.111 Type: Kernel Image Compression: uncompressed Data Start: 0x840000e4 Data Size: 2118440 Bytes = 2 MiB Architecture: ARM OS: Linux Load Address: 0x80208000 Entry Point: 0x80208000 Hash algo: crc32 Hash value: 3e33b8cb Hash algo: sha1 Hash value: 3316c61f9394eb27e689554b6566cf2dd526aaa9 Verifying Hash Integrity ... crc32+ sha1+ OK ## Flattened Device Tree from FIT Image at 84000000 Using 'config@1' configuration Trying 'fdt@1' FDT blob subimage Description: ARM OpenWrt linksys_ea8300 device tree blob Type: Flat Device Tree Compression: uncompressed Data Start: 0x84205544 Data Size: 16979 Bytes = 16.6 KiB Architecture: ARM Hash algo: crc32 Hash value: 5b4d9f5c Hash algo: sha1 Hash value: da0b457475f7e641e79d6371e0e17a0b00461322 Verifying Hash Integrity ... crc32+ sha1+ OK Booting using the fdt blob at 0x84205544 Loading Kernel Image ... OK OK Loading Device Tree to 871e8000, end 871ef252 ... OK Device nand2 not found! eth0 MAC Address from ART is not valid eth1 MAC Address from ART is not valid Using machid 0x8010006 from environment Starting kernel ... [ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 4.14.111 (jeff@deb-devel) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r9844+3-1f839c8584)) #0 SMP Wed Apr 10 15:39:29 2019 [ 0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d [ 0.000000] CPU: div instructions available: patching division code [ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache [ 0.000000] OF: fdt: Machine model: Linksys EA8300 (Dallas) [ 0.000000] Memory policy: Data cache writealloc [ 0.000000] random: get_random_bytes called from start_kernel+0x88/0x3c0 with crng_init=0 [ 0.000000] percpu: Embedded 15 pages/cpu @cfdaf000 s29324 r8192 d23924 u61440 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 64512 [ 0.000000] Kernel command line: init=/sbin/init rootfstype=ubifs ubi.mtd=13,2048 root=ubi0:ubifs rootwait rw root=/dev/ubiblock0_0 rootfstype=squashfs ro clk_ignore_unused [ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes) [ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) [ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Memory: 249940K/260096K available (4267K kernel code, 138K rwdata, 1176K rodata, 1024K init, 228K bss, 10156K reserved, 0K cma-reserved, 0K highmem) [ 0.000000] Virtual kernel memory layout: [ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB) [ 0.000000] fixmap : 0xffc00000 - 0xfff00000 (3072 kB) [ 0.000000] vmalloc : 0xd0800000 - 0xff800000 ( 752 MB) [ 0.000000] lowmem : 0xc0000000 - 0xd0000000 ( 256 MB) [ 0.000000] pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB) [ 0.000000] modules : 0xbf000000 - 0xbfe00000 ( 14 MB) [ 0.000000] .text : 0xc0208000 - 0xc072acf8 (5260 kB) [ 0.000000] .init : 0xc0900000 - 0xc0a00000 (1024 kB) [ 0.000000] .data : 0xc0a00000 - 0xc0a22940 ( 139 kB) [ 0.000000] .bss : 0xc0a24000 - 0xc0a5d258 ( 229 kB) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 [ 0.000000] Hierarchical RCU implementation. [ 0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16 [ 0.000000] arch_timer: cp15 timer(s) running at 48.00MHz (virt). [ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb11fd3bfb, max_idle_ns: 440795203732 ns [ 0.000008] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 4398046511096ns [ 0.000021] Switching to timer-based delay loop, resolution 20ns [ 0.000245] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=480000) [ 0.000264] pid_max: default: 32768 minimum: 301 [ 0.000396] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.000413] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.000926] CPU: Testing write buffer coherency: ok [ 0.001586] Setting up static identity map for 0x80300000 - 0x80300060 [ 0.001725] Hierarchical SRCU implementation. [ 0.002352] smp: Bringing up secondary CPUs ... [ 0.004971] smp: Brought up 1 node, 4 CPUs [ 0.004992] SMP: Total of 4 processors activated (384.00 BogoMIPS). [ 0.005001] CPU: All CPU(s) started in SVC mode. [ 0.009343] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5 [ 0.009499] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.009523] futex hash table entries: 1024 (order: 4, 65536 bytes) [ 0.009697] pinctrl core: initialized pinctrl subsystem [ 0.010611] NET: Registered protocol family 16 [ 0.010966] DMA: preallocated 256 KiB pool for atomic coherent allocations [ 0.011978] cpuidle: using governor ladder [ 0.012024] cpuidle: using governor menu [ 0.030084] usbcore: registered new interface driver usbfs [ 0.030163] usbcore: registered new interface driver hub [ 0.030238] usbcore: registered new device driver usb [ 0.030292] pps_core: LinuxPPS API ver. 1 registered [ 0.030303] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it> [ 0.030329] PTP clock support registered [ 0.031534] clocksource: Switched to clocksource arch_sys_counter [ 0.032317] NET: Registered protocol family 2 [ 0.032906] TCP established hash table entries: 2048 (order: 1, 8192 bytes) [ 0.032949] TCP bind hash table entries: 2048 (order: 2, 16384 bytes) [ 0.033000] TCP: Hash tables configured (established 2048 bind 2048) [ 0.033106] UDP hash table entries: 256 (order: 1, 8192 bytes) [ 0.033142] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) [ 0.033352] NET: Registered protocol family 1 [ 0.034416] No memory allocated for crashlog [ 0.034615] workingset: timestamp_bits=30 max_order=16 bucket_order=0 [ 0.037798] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.037814] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.042999] io scheduler noop registered [ 0.043019] io scheduler deadline registered (default) [ 0.044770] OF: PCI: host bridge /soc/pci@40000000 ranges: [ 0.044804] OF: PCI: IO 0x40200000..0x402fffff -> 0x40200000 [ 0.044824] OF: PCI: MEM 0x40300000..0x40ffffff -> 0x40300000 [ 0.261544] qcom-pcie 40000000.pci: link up [ 0.261687] qcom-pcie 40000000.pci: PCI host bridge to bus 0000:00 [ 0.261709] pci_bus 0000:00: root bus resource [bus 00-ff] [ 0.261726] pci_bus 0000:00: root bus resource [io 0x0000-0xfffff] (bus address [0x40200000-0x402fffff]) [ 0.261740] pci_bus 0000:00: root bus resource [mem 0x40300000-0x40ffffff] [ 0.262069] PCI: bus0: Fast back to back transfers disabled [ 0.263432] PCI: bus1: Fast back to back transfers disabled [ 0.263484] pci 0000:00:00.0: BAR 8: assigned [mem 0x40400000-0x405fffff] [ 0.263502] pci 0000:00:00.0: BAR 0: assigned [mem 0x40300000-0x40300fff 64bit] [ 0.263527] pci 0000:01:00.0: BAR 0: assigned [mem 0x40400000-0x405fffff 64bit] [ 0.263604] pci 0000:00:00.0: PCI bridge to [bus 01-ff] [ 0.263620] pci 0000:00:00.0: bridge window [mem 0x40400000-0x405fffff] [ 0.264378] pcieport 0000:00:00.0: AER enabled with IRQ 96 [ 0.265889] bam-dma-engine 8e04000.dma: num-channels unspecified in dt [ 0.265907] bam-dma-engine 8e04000.dma: num-ees unspecified in dt [ 0.267149] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000 [ 0.267231] tcsr 194b000.tcsr: setting usb hs phy mode select = e700e7 [ 0.267305] tcsr 1953000.ess_tcsr: setting ess interface select = 0 [ 0.267379] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222 [ 0.267623] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled [ 0.268154] msm_serial 78af000.serial: msm_serial: detected port #0 [ 0.268198] msm_serial 78af000.serial: uartclk = 1843200 [ 0.268248] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 27, base_baud = 115200) is a MSM [ 0.268273] msm_serial: console setup on port #0 [ 0.886176] console [ttyMSM0] enabled [ 0.891073] msm_serial: driver initialized [ 0.898589] loop: module loaded [ 0.899981] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xda [ 0.901421] nand: Winbond W29N02GV [ 0.908060] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 [ 0.911324] 16 fixed-partitions partitions found on MTD device qcom_nand.0 [ 0.918804] Creating 16 MTD partitions on "qcom_nand.0": [ 0.925671] 0x000000000000-0x000000100000 : "0:SBL1" [ 0.932613] 0x000000100000-0x000000200000 : "0:MIBIB" [ 0.937421] 0x000000200000-0x000000300000 : "0:QSEE" [ 0.942406] 0x000000300000-0x000000380000 : "0:CDT" [ 0.946986] 0x000000380000-0x000000400000 : "0:APPSBLENV" [ 0.951637] 0x000000400000-0x000000480000 : "0:ART" [ 0.957164] 0x000000480000-0x000000680000 : "0:APPSBL" [ 0.963036] 0x000000680000-0x000000700000 : "u_env" [ 0.967046] 0x000000700000-0x000000740000 : "s_env" [ 0.971663] 0x000000740000-0x000000780000 : "devinfo" [ 0.976510] 0x000000780000-0x000005f80000 : "kernel" [ 0.987454] random: fast init done [ 1.050940] 0x000000a80000-0x000005f80000 : "rootfs" [ 1.118566] mtd: device 11 (rootfs) set to be root filesystem [ 1.118874] mtdsplit: no squashfs found in "rootfs" [ 1.123339] 0x000005f80000-0x00000b780000 : "alt_kernel" [ 1.197969] 0x000006280000-0x00000b780000 : "alt_rootfs" [ 1.265585] 0x00000b780000-0x00000b880000 : "sysdiag" [ 1.266980] 0x00000b880000-0x00000ff00000 : "syscfg" [ 1.326424] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64 [ 1.327156] spi_qup 78b6000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64 [ 1.333546] libphy: ipq40xx_mdio: probed [ 1.370368] ESS reset ok! [ 1.403349] ESS reset ok! [ 1.831924] libphy: Fixed MDIO Bus: probed [ 1.833513] EDMA using MAC@ - using [ 1.833527] 52:b3:e6:19:25:6d [ 1.931680] i2c /dev entries driver [ 1.931936] i2c_qup 78b7000.i2c: using default clock-frequency 100000 [ 1.968140] NET: Registered protocol family 10 [ 1.976439] Segment Routing with IPv6 [ 1.976573] NET: Registered protocol family 17 [ 1.979497] 8021q: 802.1Q VLAN Support v1.8 [ 1.983698] Registering SWP/SWPB emulation handler [ 1.991718] ubi0: attaching mtd13 [ 2.310700] random: crng init done [ 2.387479] ubi0: scanning is finished [ 2.394749] ubi0: attached mtd13 (name "alt_rootfs", size 85 MiB) [ 2.394783] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 2.399826] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 2.406616] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 2.413473] ubi0: good PEBs: 680, bad PEBs: 0, corrupted PEBs: 0 [ 2.420226] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128 [ 2.426496] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1789438110 [ 2.433520] ubi0: available PEBs: 0, total reserved PEBs: 680, PEBs reserved for bad PEB handling: 40 [ 2.442827] ubi0: background thread "ubi_bgt0d" started, PID 87 [ 2.443748] block ubiblock0_0: created from ubi0:0(rootfs) [ 2.457644] hctosys: unable to open rtc device <FF>[ 2.472493] VFS: Mounted root (squashfs filesystem) readonly on device 254:0. [ 2.474074] Freeing unused kernel memory: 1024K [ 2.837380] init: Console is alive [ 2.837606] init: - watchdog - [ 3.294083] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 3.664999] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller [ 3.665063] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1 [ 3.669615] xhci-hcd xhci-hcd.0.auto: hcc params 0x0228f665 hci version 0x100 quirks 0x0000000002010010 [ 3.677033] xhci-hcd xhci-hcd.0.auto: irq 131, io mem 0x08a00000 [ 3.686996] hub 1-0:1.0: USB hub found [ 3.692627] hub 1-0:1.0: 1 port detected [ 3.696435] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller [ 3.700212] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2 [ 3.705540] xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0 SuperSpeed [ 3.713225] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM. [ 3.720362] hub 2-0:1.0: USB hub found [ 3.728064] hub 2-0:1.0: 1 port detected [ 3.732167] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller [ 3.735647] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 3 [ 3.741197] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220f665 hci version 0x100 quirks 0x0000000002010010 [ 3.748588] xhci-hcd xhci-hcd.1.auto: irq 132, io mem 0x06000000 [ 3.758657] hub 3-0:1.0: USB hub found [ 3.764170] hub 3-0:1.0: 1 port detected [ 3.768059] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller [ 3.771763] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 4 [ 3.777035] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed [ 3.784702] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM. [ 3.791697] hub 4-0:1.0: USB hub found [ 3.799538] hub 4-0:1.0: config failed, hub doesn't have any ports! (err -19) [ 3.805107] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 3.811797] init: - preinit - [ 4.061609] usb 1-1: new high-speed USB device number 2 using xhci-hcd [ 4.555229] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 4.555315] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 7.806412] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 165 [ 7.839184] UBIFS (ubi0:1): recovery needed [ 7.923518] UBIFS (ubi0:1): recovery completed [ 7.923652] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data" [ 7.926864] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 7.934789] UBIFS (ubi0:1): FS size: 76439552 bytes (72 MiB, 602 LEBs), journal size 3809280 bytes (3 MiB, 30 LEBs) [ 7.944684] UBIFS (ubi0:1): reserved for root: 3610428 bytes (3525 KiB) [ 7.954923] UBIFS (ubi0:1): media format: w4/r0 (latest is w5/r0), UUID 6A863550-8B26-46EE-BE1B-9BF3D7F21616, small LPT model [ 7.964947] mount_root: switching to ubifs overlay [ 7.993374] urandom-seed: Seeding with /etc/urandom.seed [ 8.089157] procd: - early - [ 8.089291] procd: - watchdog - [ 8.772669] procd: - watchdog - [ 8.775487] procd: - ubus - [ 8.849541] procd: - init - Please press Enter to activate this console. [ 9.101799] kmodloader: loading kernel modules from /etc/modules.d/* [ 9.105593] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 9.112818] Loading modules backported from Linux version v4.19.32-0-g3a2156c839c7 [ 9.112856] Backport generated by backports.git v4.19.32-1-0-g1c4f7569 [ 9.122382] ip_tables: (C) 2000-2006 Netfilter Core Team [ 9.131062] nf_conntrack version 0.5.0 (4096 buckets, 16384 max) [ 9.160520] xt_time: kernel timezone is -0000 [ 9.190333] PPP generic driver version 2.4.2 [ 9.191924] NET: Registered protocol family 24 [ 9.206138] ath10k 4.19 driver, optimized for CT firmware, probing pci device: 0x56. [ 9.206893] ath10k_pci 0000:01:00.0: enabling device (0140 -> 0142) [ 9.213588] ath10k_pci 0000:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0 [ 9.389479] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/fwcfg-pci-0000:01:00.0.txt failed with error -2 [ 9.389798] ath10k_pci 0000:01:00.0: Falling back to user helper [ 9.482128] firmware ath10k!fwcfg-pci-0000:01:00.0.txt: firmware_loading_store: map pages failed [ 9.484836] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/QCA9888/hw2.0/ct-firmware-5.bin failed with error -2 [ 9.490009] ath10k_pci 0000:01:00.0: Falling back to user helper [ 9.554134] firmware ath10k!QCA9888!hw2.0!ct-firmware-5.bin: firmware_loading_store: map pages failed [ 9.554502] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/QCA9888/hw2.0/ct-firmware-2.bin failed with error -2 [ 9.562418] ath10k_pci 0000:01:00.0: Falling back to user helper [ 9.625045] firmware ath10k!QCA9888!hw2.0!ct-firmware-2.bin: firmware_loading_store: map pages failed [ 9.625515] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/QCA9888/hw2.0/firmware-6.bin failed with error -2 [ 9.633356] ath10k_pci 0000:01:00.0: Falling back to user helper [ 9.715038] firmware ath10k!QCA9888!hw2.0!firmware-6.bin: firmware_loading_store: map pages failed [ 9.985702] ath10k_pci 0000:01:00.0: qca9888 hw2.0 target 0x01000000 chip_id 0x00000000 sub 0000:0000 [ 9.985750] ath10k_pci 0000:01:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0 [ 9.997769] ath10k_pci 0000:01:00.0: firmware ver 10.4b-ct-9888-fW-012-604ef8d6 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT crc32 b1e5658d [ 10.324081] ath10k_pci 0000:01:00.0: board_file api 2 bmi_id 0:23 crc32 b050e9d6 [ 12.343990] ath10k_pci 0000:01:00.0: 10.4 wmi init: vdevs: 16 peers: 48 tid: 96 [ 12.344033] ath10k_pci 0000:01:00.0: msdu-desc: 2500 skid: 32 [ 12.398457] ath10k_pci 0000:01:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186 msdu-desc: 2500 sw-crypt: 0 ct-sta: 0' [ 12.399516] ath10k_pci 0000:01:00.0: wmi print 'free: 121760 iram: 26004 sram: 30092' [ 12.621457] ath10k_pci 0000:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1 [ 12.913560] ath10k_ahb a000000.wifi: Direct firmware load for ath10k/fwcfg-ahb-a000000.wifi.txt failed with error -2 [ 12.913612] ath10k_ahb a000000.wifi: Falling back to user helper [ 13.263716] firmware ath10k!fwcfg-ahb-a000000.wifi.txt: firmware_loading_store: map pages failed [ 13.265744] ath10k_ahb a000000.wifi: Direct firmware load for ath10k/QCA4019/hw1.0/ct-firmware-5.bin failed with error -2 [ 13.271651] ath10k_ahb a000000.wifi: Falling back to user helper [ 13.368119] firmware ath10k!QCA4019!hw1.0!ct-firmware-5.bin: firmware_loading_store: map pages failed [ 13.368569] ath10k_ahb a000000.wifi: Direct firmware load for ath10k/QCA4019/hw1.0/ct-firmware-2.bin failed with error -2 [ 13.376421] ath10k_ahb a000000.wifi: Falling back to user helper [ 13.449354] firmware ath10k!QCA4019!hw1.0!ct-firmware-2.bin: firmware_loading_store: map pages failed [ 13.449670] ath10k_ahb a000000.wifi: Direct firmware load for ath10k/QCA4019/hw1.0/firmware-6.bin failed with error -2 [ 13.457646] ath10k_ahb a000000.wifi: Falling back to user helper [ 13.525319] firmware ath10k!QCA4019!hw1.0!firmware-6.bin: firmware_loading_store: map pages failed [ 13.819841] ath10k_ahb a000000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000 [ 13.819889] ath10k_ahb a000000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0 [ 13.831453] ath10k_ahb a000000.wifi: firmware ver 10.4b-ct-4019-fW-012-604ef8d6 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT crc32 b195c9be [ 13.882026] ath10k_ahb a000000.wifi: board_file api 2 bmi_id 0:20 crc32 8fda7e22 [ 15.195521] ath10k_ahb a000000.wifi: 10.4 wmi init: vdevs: 16 peers: 48 tid: 96 [ 15.195564] ath10k_ahb a000000.wifi: msdu-desc: 2500 skid: 32 [ 15.242177] ath10k_ahb a000000.wifi: wmi print 'P 48/48 V 16 K 144 PH 176 T 186 msdu-desc: 2500 sw-crypt: 0 ct-sta: 0' [ 15.243254] ath10k_ahb a000000.wifi: wmi print 'free: 56696 iram: 22328 sram: 35968' [ 15.406740] ath10k_ahb a000000.wifi: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1 [ 15.672051] ath10k_ahb a800000.wifi: Direct firmware load for ath10k/fwcfg-ahb-a800000.wifi.txt failed with error -2 [ 15.672096] ath10k_ahb a800000.wifi: Falling back to user helper [ 15.928166] firmware ath10k!fwcfg-ahb-a800000.wifi.txt: firmware_loading_store: map pages failed [ 15.930133] ath10k_ahb a800000.wifi: Direct firmware load for ath10k/QCA4019/hw1.0/ct-firmware-5.bin failed with error -2 [ 15.936096] ath10k_ahb a800000.wifi: Falling back to user helper [ 16.039413] firmware ath10k!QCA4019!hw1.0!ct-firmware-5.bin: firmware_loading_store: map pages failed [ 16.039801] ath10k_ahb a800000.wifi: Direct firmware load for ath10k/QCA4019/hw1.0/ct-firmware-2.bin failed with error -2 [ 16.047743] ath10k_ahb a800000.wifi: Falling back to user helper [ 16.122059] firmware ath10k!QCA4019!hw1.0!ct-firmware-2.bin: firmware_loading_store: map pages failed [ 16.122381] ath10k_ahb a800000.wifi: Direct firmware load for ath10k/QCA4019/hw1.0/firmware-6.bin failed with error -2 [ 16.130296] ath10k_ahb a800000.wifi: Falling back to user helper [ 16.212829] firmware ath10k!QCA4019!hw1.0!firmware-6.bin: firmware_loading_store: map pages failed [ 16.213159] ath10k_ahb a800000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000 [ 16.220724] ath10k_ahb a800000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0 [ 16.235164] ath10k_ahb a800000.wifi: firmware ver 10.4b-ct-4019-fW-012-604ef8d6 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT crc32 b195c9be [ 16.283253] ath10k_ahb a800000.wifi: board_file api 2 bmi_id 0:21 crc32 8fda7e22 [ 17.596660] ath10k_ahb a800000.wifi: 10.4 wmi init: vdevs: 16 peers: 48 tid: 96 [ 17.596714] ath10k_ahb a800000.wifi: msdu-desc: 2500 skid: 32 [ 17.644252] ath10k_ahb a800000.wifi: wmi print 'P 48/48 V 16 K 144 PH 176 T 186 msdu-desc: 2500 sw-crypt: 0 ct-sta: 0' [ 17.645639] ath10k_ahb a800000.wifi: wmi print 'free: 56696 iram: 22328 sram: 35968' [ 17.809834] ath10k_ahb a800000.wifi: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1 [ 17.959371] kmodloader: done loading kernel modules from /etc/modules.d/* [ 21.398560] br-lan: port 1(eth0) entered blocking state [ 21.398606] br-lan: port 1(eth0) entered disabled state [ 21.403024] device eth0 entered promiscuous mode [ 21.410479] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 21.425500] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready [ 21.426806] ess_edma c080000.edma: eth1: GMAC Link is up with phy_speed=1000 [ 21.430287] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready [ 22.402174] br-lan: port 1(eth0) entered blocking state [ 22.402488] br-lan: port 1(eth0) entered forwarding state [ 22.411208] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready BusyBox v1.30.1 () built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt SNAPSHOT, r9844+3-1f839c8584 ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- root@OpenWrt:/#


Notes

Upstream Support

Device appears to be a derivative of qcom-ipq4019-ap.dk07.1-c1

Machine model: Linksys Dallas WiFi AP router based on Qualcomm AP DK07.1-c1

Support of the “reference design” is present in Kernel 4.19 linux/arch/arm/boot/dts/

  • qcom-ipq4019-ap.dk07.1-c1.dts
  • qcom-ipq4019-ap.dk07.1.dtsi

Ref: https://patchwork.kernel.org/patch/10426401/ and related

Shell Access; OEM Over Serial

During the boot process, dallas login: wan, sysevent received: wan-start=NULL appears over serial, “hiding” the option to log in. Later, [return] may give Linksys13546 login: The password on the device is unchanged from default and root/admin provided a root shell on the device.

There is an extensive set of binaries available.

nandwrite is available, however nanddump is not.

/proc/device-tree is present.

/www/sysinfo.cgi can be executed from the command line, or at http://192.168.1.1/sysinfo.cgi (admin/admin), yielding extensive information about the device

An ext4-formatted USB drive was mounted automatically on insertion (several mount points under /tmp/) and can be used to transfer files from the device. It is possible that the device's in-built file-sharing capabilities could also be used.

Building from GPL Sources

GPL sources are 32-bit, so a VM running “ubuntu 12.10 LTS desktop edition (32 bit)” is one way to achieve the goal. Build directions in publication/README.txt (unsuccessful, as of yet)

Note that a 10 GB virtual drive is not sufficient the way that Ubuntu partitions it during install (2 GB RAM chosen in VirtualBox, 4 GB swap partition created). A 16 GB VDI seems to be sufficient.

Starting to work here, though at this time unable to build a kernel

sudo apt-get install flex bison patch autoconf libncurses5-dev

sudo apt-get install gettext  # resolve "FATAL ERROR: msgfmt does not seem to be installed."
sudo apt-get install tcl      # resolve "/bin/sh: 1: tclsh: not found"
sudo apt-get install gawk     # resolve "configure: error: GNU awk is required for lib/memtype.h made by memtypes.awk."

tar jxvf publication/src/arm-cortex-a7-qca-gcc483-linaro/toolchain-arm_cortex-a7_gcc-4.8-linaro.tar.bz2 -C /opt

STAGING_DIR=/opt/qsdk/staging_dir
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$STAGING_DIR/toolchain-arm_v7-a_gcc-4.6-linaro_uClibc-0.9.33.2_eabi/bin:$STAGING_DIR/host/bin"
export PATH STAGING_DIR

rm -rf /opt/qsdk/*
sudo mkdir /opt/qsdk
sudo chown jeff:jeff /opt/qsdk

cd publication/
make

Note that make clean after a build, followed by make may result in Too many levels of symbolic links
rm -rf /opt/qsdk/* is one way to resolve. (This suggests the extraction of the toolchain with tar may not be needed, not tested.)

Full build fails at

arm-openwrt-linux-uclibcgnueabi-gcc -rdynamic -L/home/jeff/EA8300/publication/src/iproute2/../db/extracted/db-4.7.25/build_unix  ip.o ipaddress.o ipaddrlabel.o iproute.o iprule.o ipnetns.o rtm_map.o iptunnel.o ip6tunnel.o tunnel.o ipneigh.o ipntable.o iplink.o ipmaddr.o ipmonitor.o ipmroute.o ipprefix.o iptuntap.o iptoken.o ipxfrm.o xfrm_state.o xfrm_policy.o xfrm_monitor.o iplink_vlan.o link_veth.o link_gre.o iplink_can.o iplink_macvlan.o iplink_macvtap.o ipl2tp.o link_vti.o iplink_vxlan.o tcp_metrics.o iplink_ipoib.o ipnetconf.o link_ip6tnl.o link_iptnl.o ../lib/libnetlink.a ../lib/libutil.a  ../lib/libnetlink.a ../lib/libutil.a -ldl -o ip
ipnetns.o: In function `netns_exec':
ipnetns.c:(.text+0x58c): undefined reference to `setns'
collect2: error: ld returned 1 exit status
make[3]: *** [ip] Error 1
make[3]: Leaving directory `/home/jeff/EA8300/publication/src/iproute2/extracted/iproute2-3.11.0/ip'
make[2]: *** [all] Error 2
make[2]: Leaving directory `/home/jeff/EA8300/publication/src/iproute2/extracted/iproute2-3.11.0'
make[1]: *** [.built] Error 2
make[1]: Leaving directory `/home/jeff/EA8300/publication/src/iproute2'

by executing make in extracted/iproute2-3.11.0/ a host version will be built (that will not run on the target), but allows the build to continue.

Building Kernel / DTB

The kernel can be built by entering publication/src/linux/ and executing make .configured to download, patch, and configure the sources. Once done, with the proper PATH from make env executed from publication/src/linux/, kernel artifacts can be generated with, for example:

publication/src/linux/extracted/linux-3.14.77$ make ARCH=arm CROSS_COMPILE="arm-openwrt-linux-uclibcgnueabi-" zImage
publication/src/linux/extracted/linux-3.14.77$ make ARCH=arm CROSS_COMPILE="arm-openwrt-linux-uclibcgnueabi-" dtbs

ART

The ART partition is mtd5 and is labeled 0:ART. Partition size is 512 kB (0x80000)

If 0x2f20 (12064) is the “magic” for the start of an ART segment, it is found at offsets of (with OEM DTS references)

  • 0x1000 – wifi@a000000 – qcom,cal-offset = <0x1000>; qcom,cal-len = <12064>;
  • 0x5000 – wifi@a800000 – qcom,cal-offset = <0x5000>; qcom,cal-len = <12064>;
  • 0x9000

devinfo

Contains many “interesting” key=value pairs (redacted here)

root@OpenWrt:~# strings /dev/mtd9ro | cut -d = -f 1
admin1_passphrase
admin2_passphrase
cert_region
default_passphrase
default_ssid
deviceType
devinfo_version
hw_mac_addr
hw_revision
hw_version
manufacturer
manufacturerURL
manufacturer_date
mfg_data_version
modelDescription
modelNumber
recovery_key
serial_number
sw_version
tc_passphrase
tc_ssid
uuid_key
wps_device_pin

OEM Firmware Format

./scripts/linksys-image.sh provides insight into how Linksys “signs” firmware, at least for the “Civic” EA6350 v3

# Write Linksys signature for factory image
# This is appended to the factory image and is tested by the Linksys Upgrader - as observed in civic.
# The footer is 256 bytes. The format is:
#  .LINKSYS.        This is detected by the Linksys upgrader before continuing with upgrade. (9 bytes)
#  <VERSION>        The version number of upgrade. Not checked so use arbitary value (8 bytes)
#  <TYPE>           Model of target device, padded (0x20) to (15 bytes)
#  <CRC>            CRC checksum of the image to flash (8 byte)
#  <padding>        Padding (0x20) (7 bytes)
#  <signature>      Signature of signer. Not checked so use Arbitary value (16 bytes)
#  <padding>        Padding (0x00) (192 bytes)
#  0x0A             (1 byte)
jeff@deb-devel:~/devel/ea8300$ tail -c 256 FW_EA6350v3_3.1.10.191322_prod.img | hexdump -C
00000000  2e 4c 49 4e 4b 53 59 53  2e 30 31 30 30 30 34 30  |.LINKSYS.0100040|
00000010  39 45 41 36 33 35 30 76  33 20 20 20 20 20 20 20  |9EA6350v3       |
00000020  37 44 44 33 32 34 39 38  30 20 20 20 20 20 20 20  |7DD324980       |
00000030  4b 30 30 30 30 30 30 30  46 30 32 34 36 41 39 43  |K0000000F0246A9C|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000100
jeff@deb-devel:~/devel/ea8300$ tail -c 256 FW_EA8300_1.1.4.191539_prod.img | hexdump -C
00000000  2e 4c 49 4e 4b 53 59 53  2e 30 31 30 30 30 34 30  |.LINKSYS.0100040|
00000010  37 45 41 38 33 30 30 20  20 20 20 20 20 20 20 20  |7EA8300         |
00000020  32 44 45 32 33 45 46 44  30 20 20 20 20 20 20 20  |2DE23EFD0       |
00000030  4b 30 30 30 30 30 30 30  46 30 32 37 37 32 37 43  |K0000000F027727C|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000100

So it appears that the “signature” is similar enough to try the approach derived for the EA6350 v3.

Tags

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
toh/linksys/linksys_ea8300.txt · Last modified: 2019/10/21 16:53 by tmomas