- Beeline Smartbox Flash
- Supported Versions
- Experimental firmware
- Hardware Highlights
- Backup
- Installation
- OpenWrt installation (Original U-Boot bootloader)
- OpenWrt installation (Breed bootloader)
- OEM easy installation
- OEM installation using the TFTP method
- Return to stock firmware
- Return to stock (Original U-Boot bootloader)
- Return to stock(Breed bootloader)
- Flash Layout
- OEM firmware trx format
- Original bootloader
- Upgrading OpenWrt
- LuCI Web Upgrade Process
- Terminal Upgrade Process
- sysupgrade
- Debricking
- Failsafe mode
- Basic configuration
- Buttons
- Hardware
- Photos
- Opening the case
- Serial
- Bootloader mods
- Breed bootloader
- Hardware mods
- Bootlogs
- OEM bootlog
- XTAL-40Mhz === DDR-1200Mhz
- XTAL-40Mhz === DDR-1200Mhz
Beeline Smartbox Flash
The Beeline Smartbox Flash is a wireless router based on the MT7621 platform with USB 3.0 port. While it can be acquired for relatively low cost compared to other units with similar specifications. Also known as Arcadyan WG443223.
Supported Versions
Experimental firmware
Hardware Highlights
Model | Version | SoC | CPU MHz | Flash MB | RAM MB | WLAN Hardware | WLAN2.4 | WLAN5.0 | 100M ports | Gbit ports | Modem | USB |
---|---|---|---|---|---|---|---|---|---|---|---|---|
Smartbox Flash | MediaTek MT7621A | 880 | 128NAND | 256 | MediaTek MT7615DN | b/g/n | a/n/ac | — | 3 | — | 1x 3.0 |
Backup
It’s strongly recommended to make a backup before you start:
* Set up a tftp server (e.g. tftpd64 for windows)
* Connect to a router using Telnet and run the following commands:
* Check backups in your tftp root folder.
Installation
CAUTION:
If you have any third-party firmware (e.g. Padavan, Keenetic, AsusWrt, non-official OpenWrt community builds (especially for Breed bootloader) etc.) installed on your device it’s strongly recommended to restore original OEM firmware (including bootloader, EEPROM, partition map etc.) from your backup before you start the OpenWrt installation on your device.
OpenWrt installation (Original U-Boot bootloader)
1. Login via telnet on 192.168.1.1 (no password). Note: If telnet is unavailable then downgrade to OEM firmware v1.0.13 (it would be better to make it twice to have this version in both slots) and perform the Factory reset.
2. Check the bootpartition:
If the result is 1 then go to the next step, otherwise () — change the boot partition and reboot:
3. Install OpenWrt image:
4. Set 1st boot partition and reboot:
OpenWrt installation (Breed bootloader)
1. Place OpenWrt factory.trx on any web server (192.168.1.2 in this example)
2. Activate Breed recovery console by pressing reset on power on or using Breedenter utility
3. Login via telnet into Breed console on 192.168.1.1, then enter the following commands:
9437184 — the size of your factory.trx in bytes
Note: U-Boot env should contain correct MAC addresses data (eth2macaddr, eth2macaddr, ra0macaddr, rax0macaddr variables).
OEM easy installation
OEM installation using the TFTP method
Return to stock firmware
Return to stock (Original U-Boot bootloader)
* Optional step. Upgrade the stock firmware with any version to overwrite the OpenWrt in Slot 1.
Return to stock(Breed bootloader)
* Copy OEM firmware firmware.trx to the /tmp dir of the router using SCP
Flash Layout
mtd | partition | start | size |
---|---|---|---|
mtd0 | u-boot | 0x0 | 0x100000 |
mtd1 | u-boot-env | 0x100000 | 0x200000 |
mtd2 | Factory | 0x200000 | 0x100000 |
mtd3 | firmware | 0x300000 | 0x2000000 |
mtd4 | kernel | 0x300000 | 0x440000 |
mtd5 | ubiconcat0 | 0x740000 | 0x1bc0000 |
mtd6 | Firmware2 | 0x2300000 | 0x2000000 |
mtd7 | glbcfg | 0x4300000 | 0x200000 |
mtd8 | board_data | 0x4500000 | 0x100000 |
mtd9 | glbcfg2 | 0x4600000 | 0x200000 |
mtd10 | board_data2 | 0x4800000 | 0x100000 |
mtd11 | ubiconcat1 | 0x4900000 | 0x3680000 |
* MAC addresses hasn’t been found neither in factory nor in other places
* /tmp/etc/config/.glbcfg contains serial number, WiFi preshared keys etc.
* arccfg util unencrypts (cipher aes-128-cbc + some obfuscation) the configuration from mtd8(10) at every boot
* mtd9(11): board_data or board_data2 also contain MAC address (only *base* MAC). Other addresses should be calculated
* @abyrga & @r3d5ky from telegram group Beeline SmarBox Giga found a way how to decrypt a partition. Issue
OEM firmware trx format
Original bootloader
* Ralink UBoot Version: 5.0.0.2
* U-boot protected by unknown password (hash 95f9f8f58a972c3bb653854cc54e85b4). Therefore, it isn’t possible to load initramfs image or choose boot option except “3: Boot system code via Flash (default).”.
* There is no any bootcounters
Upgrading OpenWrt
LuCI Web Upgrade Process
Terminal Upgrade Process
Note: It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
sysupgrade
Debricking
Failsafe mode
Basic configuration
→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.
Buttons
The Beeline Smartbox Flash has the following buttons:
BUTTON | Event |
---|---|
Reset / WPS | reset |
Hardware
General | |
---|---|
Brand | Beeline |
Model | Smartbox Flash |
Versions | |
Device Type | WiFi Router |
Availability | Available 2022 |
Comments — general | |
OpenWrt Support | |
Supported Since Commit | https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=f8b02130d2cd3b919c1292bc8ee8870f66794536 |
Supported Since Release | 22.03.0 |
Supported Current Release | 22.03.0 |
Unsupported | |
Hardware | |
Bootloader | U-Boot |
Target | ramips |
System-On-Chip | MediaTek MT7621A |
CPU MHz | 880 |
Flash MB | 128NAND |
RAM MB | 256 |
Network | |
Ethernet 100M ports | — |
Ethernet Gbit ports | 3 |
Switch | MediaTek MTK7530 |
Modem | — |
VLAN | Yes |
Comments — network ports |
Wireless | |
---|---|
WLAN 2.4GHz | b/g/n |
WLAN 5.0GHz | a/n/ac |
WLAN Hardware | MediaTek MT7615DN |
Detachable Antennas | — |
Comments — WLAN | DBDC, MIMO 2×2 2.4 and 5 GHz |
Interfaces | |
USB ports | 1x 3.0 |
SATA ports | — |
Serial | Yes |
JTAG | No |
Comments — USB & SATA ports | |
Misc | |
LED count | 3 |
Button count | 1 |
Power supply | 12 VDC, 1.5 A |
Links | |
Forum Topic URL | |
WikiDevi URL | https://wikidevi.wi-cat.ru/Beeline_SmartBox_Flash |
OEM device homepage URL | https://moskva.beeline.ru/customers/pomosh/home/domashnij-internet/nastrojki-s-routerom/smart-box-flash/ |
Firmware OEM Stock URL | https://static.beeline.ru/upload/images/sbflash10016.trx |
Firmware OpenWrt Install URL | https://downloads.openwrt.org/releases/22.03.0/targets/ramips/mt7621/openwrt-22.03.0-ramips-mt7621-beeline_smartbox-flash-squashfs-factory.trx |
Firmware OpenWrt Upgrade URL | https://downloads.openwrt.org/releases/22.03.0/targets/ramips/mt7621/openwrt-22.03.0-ramips-mt7621-beeline_smartbox-flash-squashfs-sysupgrade.bin |
Edit the underlying data | View/Edit data |
Photos
Back and backside label:
Opening the case
Note: This will void your warranty!
There is 4 screws on the backplate. There are also clips around the edge of the case you will need to prize open, using, for example, a plastic card.
Main PCB (top):
Main PCB (bottom):
Serial
→ port.serial general information about the serial port, serial port cable, etc.
This is how to connect to the Serial Port. There are no serial pins on the PCB out-a-box. You need to solder them by yourself.
Serial connection parameters for Beeline Smartbox Flash | 57600, 8N1 |
---|
→ port.jtag general information about the JTAG port, JTAG cable, etc.
Bootloader mods
Breed bootloader
Warning!
This section describes actions that might damage your device or firmware. Proceed with care!
Original Breed for Xiaomi R3G can be used with Beeline Smartbox Flash, but breedenter utility is required to enter the Breed. Breed web interface shouldn’t be used for flashing firmware or EEPROM backup or recovery. Telnet should be used instead.
See Notes → Breed bootloader section for links
Breed settings for Beeline Smartbox Flash:
Setting | Value |
---|---|
autoboot.command | boot flash 0x30001c |
Hardware mods
Bootlogs
OEM bootlog
MT7621 stage1 code 10:33:11 (ASIC) CPU=50000000 HZ BUS=16666666 HZ
Change MPLL source from XTAL to CR… do MEMPLL setting..
MT7621 stage1 code 10:33:11 (ASIC) CPU=50000000 HZ BUS=16666666 HZ
Change MPLL source from XTAL to CR… do MEMPLL setting.. MEMPLL Config : 0x11100000 3PLL mode + External loopback
XTAL-40Mhz === DDR-1200Mhz
PLL2 FB_DL: 0xe, 1/0 = 755/269 39000000 PLL4 FB_DL: 0x13, 1/0 = 720/304 4D000000 PLL3 FB_DL: 0x15, 1/0 = 662/362 55000000 do DDR setting..[00320381] Apply DDR3 Setting…(use customer AC)
0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 000E:| 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 000F:| 0 0 0 1 1 1 1 1 1 1 1 1 1 0 0 0 0010:| 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0011:| 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 rank 0 coarse = 15 rank 0 fine = 64 B:| 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 opt_dle value:9 DRAMC_R0DELDLY[018]=00001E20
RX DQS perbit delay software calibration
1.0-15 bit dq delay value
bit| 0 1 2 3 4 5 6 7 8 9
0 | 11 10 11 12 11 11 12 9 8 10 10 | 9 11 9 13 9 12
2.dqs window x=pass dqs delay value (min
max)center y=0-7bit DQ of every group input delay:DQS0 =32 DQS1 = 30
bit DQS0 bit DQS1 0 (1
3.dq delay value last
bit| 0 1 2 3 4 5 6 7 8 9
0 | 12 12 13 13 13 11 13 9 9 11 10 | 10 13 10 14 10 12
TX perbyte calibration
DQS loop = 15, cmp_err_1 = ffff0000 dqs_perbyte_dly.last_dqsdly_pass[0]=15, finish count=1 dqs_perbyte_dly.last_dqsdly_pass[1]=15, finish count=2 DQ loop=15, cmp_err_1 = ffff00aa dqs_perbyte_dly.last_dqdly_pass[1]=15, finish count=1 DQ loop=14, cmp_err_1 = ffff0080 DQ loop=13, cmp_err_1 = ffff0080 DQ loop=12, cmp_err_1 = ffff0000 dqs_perbyte_dly.last_dqdly_pass[0]=12, finish count=2 byte:0, (DQS,DQ)=(9,8) byte:1, (DQS,DQ)=(8,8) 20,data:89 [EMI] DRAMC calibration passed
MT7621 stage1 code done CPU=50000000 HZ BUS=16666666 HZ
U-Boot 1.1.3 (Dec 31 2019 — 10:03:16) 0.00
Config XHCI 40M PLL Allocate 16 byte aligned buffer: 8ffc8030 Enable NFI Clock # MTK NAND # : Use HW ECC NAND ID [EF F1 00 95 00] Device found in MTK table, ID: eff1, EXT_ID: 9500 Support this Device in MTK table! eff1 select_chip [NAND]select ecc bit:4, sparesize :64 spare_per_sector=16 Signature matched and data read! load_fact_bbt success 1023 load fact bbt success [mtk_nand] probe successfully! mtd→writesize=2048 mtd→oobsize=64, mtd→erasesize=131072 devinfo.iowidth=8 ..
Ralink UBoot Version: 5.0.0.2
ASIC MT7621A DualCore (MAC to MT7530 Mode) DRAM_CONF_FROM: Auto-Detection DRAM_TYPE: DDR3 DRAM bus: 16 bit Xtal Mode=3 OCP Ratio=1/3 Flash component: NAND Flash Date:Dec 31 2019 Time:10:03:16
icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 880 MHZ #### estimate memory size =256 Mbytes #Reset_MT7530 set LAN /WAN LLLLW
Please choose the operation:
3: System Boot system code via Flash[0]. ## Booting image at bc300000 …
Change MPLL source from XTAL to CR… do MEMPLL setting.. MEMPLL Config : 0x11100000 3PLL mode + External loopback
XTAL-40Mhz === DDR-1200Mhz
PLL2 FB_DL: 0xe, 1/0 = 685/339 39000000 PLL4 FB_DL: 0x13, 1/0 = 668/356 4D000000 PLL3 FB_DL: 0x15, 1/0 = 631/393 55000000 do DDR setting..[00320381] Apply DDR3 Setting…(use customer AC)
0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 000E:| 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 000F:| 0 0 0 1 1 1 1 1 1 1 1 1 1 0 0 0 0010:| 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0011:| 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001D:| 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 rank 0 coarse = 15 rank 0 fine = 64 B:| 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 opt_dle value:10 DRAMC_R0DELDLY[018]=00001E20
1.0-15 bit dq delay value
bit| 0 1 2 3 4 5 6 7 8 9
0 | 11 10 11 12 11 11 12 9 7 10 10 | 9 11 9 13 9 12
2.dqs window x=pass dqs delay value (min
max)center y=0-7bit DQ of every group input delay:DQS0 =32 DQS1 = 30
bit DQS0 bit DQS1 0 (1
3.dq delay value last
bit| 0 1 2 3 4 5 6 7 8 9
0 | 12 12 12 13 12 11 14 9 9 11 10 | 10 13 10 14 10 12
DQS loop = 15, cmp_err_1 = ffff0000 dqs_perbyte_dly.last_dqsdly_pass[0]=15, finish count=1 dqs_perbyte_dly.last_dqsdly_pass[1]=15, finish count=2 DQ loop=15, cmp_err_1 = ffff00a8 dqs_perbyte_dly.last_dqdly_pass[1]=15, finish count=1 DQ loop=14, cmp_err_1 = ffff0080 DQ loop=13, cmp_err_1 = ffff0080 DQ loop=12, cmp_err_1 = ffff0000 dqs_perbyte_dly.last_dqdly_pass[0]=12, finish count=2 byte:0, (DQS,DQ)=(9,8) byte:1, (DQS,DQ)=(8,8) 20,data:89 [EMI] DRAMC calibration passed
U-Boot 1.1.3 (Dec 31 2019 — 10:03:16) 0.00
Config XHCI 40M PLL Allocate 16 byte aligned buffer: 8ffc8030 Enable NFI Clock # MTK NAND # : Use HW ECC NAND ID [EF F1 00 95 00] Device found in MTK table, ID: eff1, EXT_ID: 9500 Support this Device in MTK table! eff1 select_chip [NAND]select ecc bit:4, sparesize :64 spare_per_sector=16 Signature matched and data read! load_fact_bbt success 1023 load fact bbt success [mtk_nand] probe successfully! mtd→writesize=2048 mtd→oobsize=64, mtd→erasesize=131072 devinfo.iowidth=8 ..
Ralink UBoot Version: 5.0.0.2
ASIC MT7621A DualCore (MAC to MT7530 Mode) DRAM_CONF_FROM: Auto-Detection DRAM_TYPE: DDR3 DRAM bus: 16 bit Xtal Mode=3 OCP Ratio=1/3 Flash component: NAND Flash Date:Dec 31 2019 Time:10:03:16
icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 880 MHZ #### estimate memory size =256 Mbytes #Reset_MT7530 set LAN /WAN LLLLW
Please choose the operation:
3: System Boot system code via Flash[0]. ## Booting image at bc300000 …
No initrd ## Transferring control to Linux (at address 817da420) … ## Giving linux memsize in MB , 256
for led test (red off) …
SDK 5.0.S.0 Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A Ralink gpio driver initialized SSFDC read-only Flash Translation layer MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error Allocate 16 byte aligned buffer: 81b444b0 Enable NFI Clock # MTK NAND # : Use HW ECC NAND ID [EF F1 00 95 00, 00009500] Device found in MTK table, ID: eff1, EXT_ID: 9500 Support this Device in MTK table! eff1 NAND device: Manufacturer ID: 0xef, Chip ID: 0xf1 (Unknown NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64 [NAND]select ecc bit:4, sparesize :64 spare_per_sector=16 Scanning device for bad blocks Signature matched and data read! load_fact_bbt success 1023 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 in find_rootfs_partitions off=0x00300000 end=0x02300000 The trx header magic offset 0x00420000 MT7621-NAND: squash filesystem found at offset 0x00720000 Found image1 partition off 0x00720000 size 0x01be0000 in find_rootfs_partitions off=0x02300000 end=0x04300000 The trx header magic offset 0x00420000 MT7621-NAND: squash filesystem found at offset 0x02720000 Found image2 partition off 0x02720000 size 0x01be0000 Creating 13 MTD partitions on “MT7621-NAND”: 0x000000000000-0x000007f80000 : “ALL” 0x000000000000-0x000000100000 : “Bootloader” 0x000000100000-0x000000200000 : “Config” 0x000000200000-0x000000300000 : “Factory” 0x000000300000-0x000002300000 : “Kernel” 0x000000720000-0x000002300000 : “RootFS” 0x000002300000-0x000004300000 : “Kernel2” 0x000002720000-0x000004300000 : “RootFS2” 0x000004300000-0x000004500000 : “glbcfg” 0x000004500000-0x000004600000 : “board_data” 0x000004600000-0x000004800000 : “glbcfg2” 0x000004800000-0x000004900000 : “board_data2” 0x000004900000-0x000007f80000 : “data” [mtk_nand] probe successfully! IMQ driver loaded successfully. (numdevs = 16, numqueues = 1)
PPP generic driver version 2.4.2 PPP BSD Compression module registered NET: Registered protocol family 24 PPTP driver version 0.8.5 register mt_drv
pAd = c0281000, size = 6831936, Status=0
Please press Enter to activate this console. MD5=[6a22c2ca805fe15a6cdd4c4d1558f597] 30:FFFFFFB1:FFFFFFB5:51:FFFFFFB1: 9 Raeth v3.1 (Tasklet) set CLK_CFG_0 = 0x40a00020. 1 phy_free_head is 0xc1c000. phy_free_tail_phy is 0xc1dff0. txd_pool=a0c20000 phy_txd_pool=00C20000 ei_local→skb_free start address is 0x8ec6a6cc. free_txd: 00c20010, ei_local→cpu_ptr: 00C20000 POOL HEAD_PTR | DMA_PTR | CPU_PTR —————-+———+——–
phy_qrx_ring = 0x00c1e000, qrx_ring = 0xa0c1e000
phy_rx_ring0 = 0x00c28000, rx_ring[0] = 0xa0c28000 MT7530 Reset Completed!! change HW-TRAP to 0x17c8f set LAN /WAN LLLLW
fe_sw_init[7042] …. Power Down Ether PHY »»»»»»»>
fe_sw_init[7045] …. Ether PHY End of Initialization »»»»»»»>
patch is not ready && get semaphore success EventGenericEventHandler: CMD Success MtCmdPatchFinishReq EventGenericEventHandler: CMD Success release patch semaphore WfMcuHwInit: Before NICLoadFirmware, check ICapMode = 0 Parsing CPU 0 fw tailer
Parsing tailer region 0
Parsing tailer region 1
EventGenericEventHandler: CMD Success EventGenericEventHandler: CMD Success MtCmdFwStartReq: override = 0x1, address = 0x84000 EventGenericEventHandler: CMD Success Parsing CPU 1 fw tailer
Parsing tailer region 0
EventGenericEventHandler: CMD Success MtCmdFwStartReq: override = 0x4, address = 0x0 EventGenericEventHandler: CMD Success MCU Init Done! efuse_probe: efuse = 10000212 RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5 RtmpEepromGetDefault::e2p_dafault=1 RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1 NVM is FLASH mode. dev_idx [0] FLASH OFFSET [0x0] NICReadEEPROMParameters: EEPROM 0x52 b300 NICReadEEPROMParameters: EEPROM 0x52 b300 Country Region from e2p = 101 mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4 mt7615_antenna_default_reset(): DBDC BAND0 TxPath = 2, RxPath = 2 mt7615_antenna_default_reset(): DBDC BAND1 TxPath = 2, RxPath = 2 RcRadioInit(): DbdcMode=1, ConcurrentBand=2 RcRadioInit(): pRadioCtrl=8f2cef04,Band=0,rfcap=3,channel=1,PhyMode=2 extCha=0xf RcRadioInit(): pRadioCtrl=8f2cf20c,Band=1,rfcap=2,channel=36,PhyMode=1 extCha=0xf rcUpdateBandForBFMU PhyCtrl[0].RadioCtrl.IsBfBand = 1 rcUpdateBandForBFMU PhyCtrl[1].RadioCtrl.IsBfBand = 0 TxBfModuleEnCtrl:i = 0, pRadioCtrl→IsBfBand = 1 TxBfModuleEnCtrl:i = 1, pRadioCtrl→IsBfBand = 0 TxBfModuleEnCtrl:u1BfNum = 1, u1BfBitmap = 1, u1BfSelBand[0] = 0 MtCmdSetDbdcCtrl:(ret = 0) MtSingleSkuLoadParam: RF_LOCKDOWN Feature OFF . MtBfBackOffLoadParam: RF_LOCKDOWN Feature OFF . EEPROM Init Done! mt_mac_init()–> mt7615_init_mac_cr()–> mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c ←-mt_mac_init() CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0 CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0 CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0 MAC Init Done! MT7615BBPInit():BBP Initialization…..
Channel 1 : Busy Time = 3704, Skip Channel = FALSE, BwCap = TRUE Channel 2 : Busy Time = 1595, Skip Channel = FALSE, BwCap = TRUE Channel 3 : Busy Time = 1067, Skip Channel = FALSE, BwCap = TRUE Channel 4 : Busy Time = 114, Skip Channel = FALSE, BwCap = TRUE Channel 5 : Busy Time = 0, Skip Channel = FALSE, BwCap = TRUE Channel 6 : Busy Time = 1256, Skip Channel = FALSE, BwCap = TRUE Channel 7 : Busy Time = 0, Skip Channel = FALSE, BwCap = TRUE Channel 8 : Busy Time = 0, Skip Channel = FALSE, BwCap = TRUE Channel 9 : Busy Time = 0, Skip Channel = FALSE, BwCap = TRUE Channel 10 : Busy Time = 1256, Skip Channel = FALSE, BwCap = TRUE Channel 11 : Busy Time = 6, Skip Channel = FALSE, BwCap = TRUE
Rule 3 Channel Busy time value : Select Primary Channel 5 Rule 3 Channel Busy time value : Min Channel Busy = 0 Rule 3 Channel Busy time value : BW = 20 [SelectClearChannelBusyTime] — band0 END ApAutoChannelAtBootUp : Auto channel selection: Selected channel = 5, IsAband = 0 AutoChSelUpdateChannel(): Update channel for wdev for this band PhyMode = 14, Channel = 5 [RadarStateCheck] RD_NORMAL_MODE mt7615_apply_cal_data() : eeprom 0x52 bit 1 is 0, do runtime cal , skip RX reload mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload MtCmdChannelSwitch: control_chl = 5,control_ch2=0, central_chl = 3 DBDCIdx= 0, Band= 0 BW = 1,TXStream = 2, RXStream = 2, scan(0) [DfsCacNormalStart] Normal start. Enable MAC TX ApAutoChannelAtBootUp←—————- [PMF]APPMFInit:: apidx=0, MFPC=0, MFPR=0, SHA256=0 wifi_sys_linkup(), wdev idx = 0 wtc_acquire_groupkey_wcid: Found a non-occupied wtbl_idx:127 for WDEV_TYPE:1 LinkToOmacIdx = 0, LinkToWdevType = 1 bssUpdateBmcMngRate (BSS_INFO_BROADCAST_INFO), CmdBssInfoBmcRate.u2BcTransmit= 0, CmdBssInfoBmcRate.u2McTransmit = 128 MtCmdSetDbdcCtrl:(ret = 0) UpdateBeaconHandler, BCN_UPDATE_INIT, OmacIdx = 0 APStartUpForMbss: BssIndex = 0 channel = 5 MtCmdTxPowerDropCtrl: ucPowerDrop: 100, BandIdx: 0 [update_mgmt_frame_power] disable mgmt pwr ctrl Enable 20/40 BSSCoex Channel Scan(BssCoex=1) ExtEventBeaconLostHandler::FW LOG, Beacon lost (30:pr:iv:at:e0:07), Reason 0x10
patch is ready, continue to ILM/DLM DL WfMcuHwInit: Before NICLoadFirmware, check ICapMode = 0 Parsing CPU 0 fw tailer
Parsing tailer region 0
Parsing tailer region 1
EventGenericEventHandler: CMD Success EventGenericEventHandler: CMD Success MtCmdFwStartReq: override = 0x1, address = 0x84000 EventGenericEventHandler: CMD Success Parsing CPU 1 fw tailer
Parsing tailer region 0
EventGenericEventHandler: CMD Success MtCmdFwStartReq: override = 0x4, address = 0x0 EventGenericEventHandler: CMD Success MCU Init Done! efuse_probe: efuse = 10000212 RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5 RtmpEepromGetDefault::e2p_dafault=1 RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1 NVM is FLASH mode. dev_idx [0] FLASH OFFSET [0x0] NICReadEEPROMParameters: EEPROM 0x52 b300 NICReadEEPROMParameters: EEPROM 0x52 b300 Country Region from e2p = 101 mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4 mt7615_antenna_default_reset(): DBDC BAND0 TxPath = 2, RxPath = 2 mt7615_antenna_default_reset(): DBDC BAND1 TxPath = 2, RxPath = 2 RcRadioInit(): DbdcMode=1, ConcurrentBand=2 RcRadioInit(): pRadioCtrl=8f2cef04,Band=0,rfcap=3,channel=1,PhyMode=2 extCha=0xf RcRadioInit(): pRadioCtrl=8f2cf20c,Band=1,rfcap=2,channel=36,PhyMode=1 extCha=0xf rcUpdateBandForBFMU PhyCtrl[0].RadioCtrl.IsBfBand = 1 rcUpdateBandForBFMU PhyCtrl[1].RadioCtrl.IsBfBand = 0 TxBfModuleEnCtrl:i = 0, pRadioCtrl→IsBfBand = 1 TxBfModuleEnCtrl:i = 1, pRadioCtrl→IsBfBand = 0 TxBfModuleEnCtrl:u1BfNum = 1, u1BfBitmap = 1, u1BfSelBand[0] = 0 MtCmdSetDbdcCtrl:(ret = 0) MtSingleSkuLoadParam: RF_LOCKDOWN Feature OFF . MtBfBackOffLoadParam: RF_LOCKDOWN Feature OFF . EEPROM Init Done! mt_mac_init()–> mt7615_init_mac_cr()–> mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c ←-mt_mac_init() CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0 CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0 CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0 MAC Init Done! MT7615BBPInit():BBP Initialization…..
Channel 1 : Busy Time = 4740, Skip Channel = FALSE, BwCap = TRUE Channel 2 : Busy Time = 633, Skip Channel = FALSE, BwCap = TRUE Channel 3 : Busy Time = 1066, Skip Channel = FALSE, BwCap = TRUE Channel 4 : Busy Time = 13, Skip Channel = FALSE, BwCap = TRUE Channel 5 : Busy Time = 0, Skip Channel = FALSE, BwCap = TRUE Channel 6 : Busy Time = 1256, Skip Channel = FALSE, BwCap = TRUE Channel 7 : Busy Time = 0, Skip Channel = FALSE, BwCap = TRUE Channel 8 : Busy Time = 0, Skip Channel = FALSE, BwCap = TRUE Channel 9 : Busy Time = 0, Skip Channel = FALSE, BwCap = TRUE Channel 10 : Busy Time = 1256, Skip Channel = FALSE, BwCap = TRUE Channel 11 : Busy Time = 0, Skip Channel = FALSE, BwCap = TRUE
Rule 3 Channel Busy time value : Select Primary Channel 5 Rule 3 Channel Busy time value : Min Channel Busy = 0 Rule 3 Channel Busy time value : BW = 20 [SelectClearChannelBusyTime] — band0 END ApAutoChannelAtBootUp : Auto channel selection: Selected channel = 5, IsAband = 0 AutoChSelUpdateChannel(): Update channel for wdev for this band PhyMode = 14, Channel = 5 [RadarStateCheck] RD_NORMAL_MODE mt7615_apply_cal_data() : eeprom 0x52 bit 1 is 0, do runtime cal , skip RX reload mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload MtCmdChannelSwitch: control_chl = 5,control_ch2=0, central_chl = 3 DBDCIdx= 0, Band= 0 BW = 1,TXStream = 2, RXStream = 2, scan(0) [DfsCacNormalStart] Normal start. Enable MAC TX ApAutoChannelAtBootUp←—————- [PMF]APPMFInit:: apidx=0, MFPC=0, MFPR=0, SHA256=0 wifi_sys_linkup(), wdev idx = 0 wtc_acquire_groupkey_wcid: Found a non-occupied wtbl_idx:127 for WDEV_TYPE:1 LinkToOmacIdx = 0, LinkToWdevType = 1 bssUpdateBmcMngRate (BSS_INFO_BROADCAST_INFO), CmdBssInfoBmcRate.u2BcTransmit= 0, CmdBssInfoBmcRate.u2McTransmit = 128 MtCmdSetDbdcCtrl:(ret = 0) UpdateBeaconHandler, BCN_UPDATE_INIT, OmacIdx = 0 APStartUpForMbss: BssIndex = 0 channel = 5 MtCmdTxPowerDropCtrl: ucPowerDrop: 100, BandIdx: 0 [update_mgmt_frame_power] disable mgmt pwr ctrl Enable 20/40 BSSCoex Channel Scan(BssCoex=1) ExtEventBeaconLostHandler::FW LOG, Beacon lost (30:pr:iv:at:e0:07), Reason 0x10
start syslog-ng… Port 4’s link state is changed from up to down! The parameteres wan_stop needs. [wan_idx=0 ] [as_load_key_cert] load CERT/KEY files OK [as_load_key_cert] load CERT/KEY files OK [as_load_key_cert] load CERT/KEY files OK [as_load_key_cert] load CERT/KEY files OK [as_load_key_cert] load CERT/KEY files OK [as_load_key_cert] load CERT/KEY files OK [as_load_key_cert] load CERT/KEY files OK [as_load_key_cert] load CERT/KEY files OK [as_load_key_cert] load CERT/KEY files OK [as_load_key_cert] load CERT/KEY files OK : cmd =arc_usbapp_accountmgr boot : cmd =arc_usbapp_accountmgr set try to start samba daemon nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead. start miniupnpd Call Update Tr69 Rule. MtCmdGetThermalSensorResult:(ret = 0) UBI: attaching mtd12 to ubi0 UBI: scanning is finished UBI: attached mtd12 (name “data”, size 54 MiB) to ubi0 UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 UBI: VID header offset: 2048 (aligned 2048), data offset: 4096 UBI: good PEBs: 436, bad PEBs: 0, corrupted PEBs: 0 UBI: user volume: 2, internal volumes: 1, max. volumes count: 128 UBI: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1641389745 UBI: available PEBs: 0, total reserved PEBs: 436, PEBs reserved for bad PEB handling: 20 UBI: background thread “ubi_bgt0d” started, PID 1241 UBIFS error (pid 1267): ubifs_read_node: bad node type (4 but expected 6) UBIFS error (pid 1267): ubifs_read_node: bad node at LEB 0:0, LEB mapping status 1 Not a node, first 24 bytes: 00000000: 68 73 71 73 30 05 00 00 b1 9e d5 61 00 00 04 00 1b 00 00 00 04 00 12 00 hsqs0……a………… CPU: 1 PID: 1267 Comm: mount Tainted: P 3.10.14 #1 Stack : 81b37e72 0000003e 00000000 81a20000 00000000 000004f3 81927fdc 81b33ddc
Call Trace: [ ] show_stack+0x64/0x7c [ ] ubifs_read_node+0x1a4/0x2b8 [ ] ubifs_read_sb_node+0x50/0xb4 [ ] ubifs_read_superblock+0x7b0/0xf78 [ ] ubifs_mount+0x878/0x18ac [ ] mount_fs+0x1c/0xf4 [ ] vfs_kern_mount+0x5c/0xe8 [ ] do_mount+0x1ec/0x908 [ ] SyS_mount+0x84/0xe8 [ ] stack_done+0x20/0x40
killall: updatedd: no process killed killall: updatedd-wrapper: no process killed multi-wan stop wan_idx=0 killall: pppd: no process killed killall: pptp: no process killed killall: listen: no process killed wan_idx=0 stop bridge qos [as_client_init_tlsv1] as_client_init_tlsv1: done! [as_setup_verify] Load trusted CA: [/etc/Verisign_Class3.pem][(null)] wan_idx=0 stop bridge mode wanx enable, should not downbr the iface 0 brdel start brdel start brdel all Get signal 16! It took more than 9 seconds! Call Update Tr69 Rule. MtCmdGetThermalSensorResult:(ret = 0)