小米路由器3的刷机
小米路由器3的刷机
原始启动log
root@XiaoQiang:/# reboot -f
[ 148.430000] MT7612E cleanup
[ 148.440000] RtmpOSNetDevDetach(): RtmpOSNetDeviceDetach(), dev->name=wl0!
[ 148.500000] br-lan: port 2(wl0) entering forwarding state
[ 148.500000] device wl0 left promiscuous mode
[ 148.510000] br-lan: port 2(wl0) entering disabled state
[ 148.520000] Restarting system.
[ 148.520000] RALINK_REG_PIO7140DATA b0000670 = fdf00000
U-Boot 1.1.3 (Jun 23 2016 - 17:54:24)
Board: Ralink APSoC DRAM: 128 MB
Power on memory test. Memory size= 128 MB...OK!
relocate_code Pointer at: 87fb8000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
******************************
Software System Reset Occurred
******************************
!!! nand page size = 2048, addr len=4
..============================================
Ralink UBoot Version: 4.2.S.1
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM_CONF_FROM: Auto-detection
DRAM_TYPE: DDR2
DRAM component: 1024 Mbits
DRAM bus: 16 bit
Total memory: 128 MBytes
Flash component: NAND Flash
Date:Jun 23 2016 Time:17:54:24
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 580 MHZ ####
estimate memory size =128 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
0
3: System Boot system code via Flash.
Booting System 2
..ranand_erase_write: offs:40000, count:20000
.Done!
done
## Booting image at bc600000 ...
Image Name: MIPS OpenWrt Linux-2.6.36
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 2244708 Bytes = 2.1 MB
Load Address: 80000000
Entry Point: 80000000
................................... Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
commandline uart_en=1 factory_mode=0 mem=128m
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 128
Starting kernel ...
LINUX started...
THIS IS ASIC
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Linux version 2.6.36 (jenkins@JenkinsServer) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 MiWiFi-R3-2.21.166 Tue Sep 19 20:33:58 CST 2017
[ 0.000000]
[ 0.000000] The CPU feqenuce set to 580 MHz
[ 0.000000] PCIE: bypass PCIe DLL.
[ 0.000000] PCIE: Elastic buffer control: Addr:0x68 -> 0xB4
[ 0.000000] disable all power about PCIe
[ 0.000000] CPU revision is: 00019650 (MIPS 24Kc)
[ 0.000000] Software DMA cache coherency
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone PFN ranges:
[ 0.000000] Normal 0x00000000 -> 0x00008000
[ 0.000000] Movable zone start PFN for each node
[ 0.000000] early_node_map[1] active PFN ranges
[ 0.000000] 0: 0x00000000 -> 0x00008000
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
[ 0.000000] Kernel command line: console=ttyS1,115200n8 root=/dev/ram0 uart_en=1 factory_mode=0 mem=128m
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] Writing ErrCtl register=00004270
[ 0.000000] Readback ErrCtl register=00004270
[ 0.000000] allocated 655360 bytes of page_cgroup
[ 0.000000] please try 'cgroup_disable=memory' option if you don't want memory cgroups
[ 0.000000] Memory: 123920k/131072k available (3290k kernel code, 7152k reserved, 938k data, 860k init, 0k highmem)
[ 0.000000] SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:128
[ 0.000000] console [ttyS1] enabled
[ 0.010000] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[ 0.220000] pid_max: default: 32768 minimum: 301
[ 0.220000] Mount-cache hash table entries: 512
[ 0.220000] Initializing cgroup subsys memory
[ 0.230000] Initializing cgroup subsys net_cls
[ 0.230000] devtmpfs: initialized
[ 0.230000] NET: Registered protocol family 16
[ 0.240000] RALINK_GPIOMODE = 121b1c
[ 0.240000] RALINK_GPIOMODE = 101b1c
[ 0.440000] PPLL_CFG1=0xe7c000
[ 0.450000] MT7620 PPLL lock
[ 0.450000] PPLL_DRV =0x80080504
[ 0.650000] Deassert the PCIE0 RESET.
[ 0.650000] start PCIe register access
[ 1.150000] RALINK_RSTCTRL = 2400000
[ 1.160000] RALINK_CLKCFG1 = 75afffc0
[ 1.160000]
[ 1.160000] *************** MT7620 PCIe RC mode *************
[ 1.660000] PCIE0 enabled
[ 1.670000] init_rt2880pci done
[ 1.670000] bio: create slab <bio-0> at 0
[ 1.670000] SCSI subsystem initialized
[ 1.680000] usbcore: registered new interface driver usbfs
[ 1.680000] usbcore: registered new interface driver hub
[ 1.690000] usbcore: registered new device driver usb
[ 1.690000] pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
[ 1.700000] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[ 1.700000] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[ 1.710000] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[ 1.710000] pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff]
[ 1.720000] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[ 1.720000] pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff 64bit] (PCI address [0x20000000-0x200fffff]
[ 1.730000] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[ 1.730000] pci 0000:00:00.0: PCI bridge to [bus 01-01]
[ 1.740000] pci 0000:00:00.0: bridge window [io disabled]
[ 1.740000] pci 0000:00:00.0: bridge window [mem 0x20000000-0x200fffff]
[ 1.750000] pci 0000:00:00.0: bridge window [mem 0x20100000-0x201fffff pref]
[ 1.750000] BAR0 at slot 0 = 0
[ 1.760000] bus=0x0, slot = 0x0
[ 1.760000] res[0]->start = 0
[ 1.760000] res[0]->end = 0
[ 1.760000] res[1]->start = 20200000
[ 1.770000] res[1]->end = 2020ffff
[ 1.770000] res[2]->start = 0
[ 1.770000] res[2]->end = 0
[ 1.770000] res[3]->start = 0
[ 1.780000] res[3]->end = 0
[ 1.780000] res[4]->start = 0
[ 1.780000] res[4]->end = 0
[ 1.780000] res[5]->start = 0
[ 1.790000] res[5]->end = 0
[ 1.790000] bus=0x1, slot = 0x0
[ 1.790000] res[0]->start = 20000000
[ 1.790000] res[0]->end = 200fffff
[ 1.800000] res[1]->start = 0
[ 1.800000] res[1]->end = 0
[ 1.800000] res[2]->start = 0
[ 1.800000] res[2]->end = 0
[ 1.810000] res[3]->start = 0
[ 1.810000] res[3]->end = 0
[ 1.810000] res[4]->start = 0
[ 1.810000] res[4]->end = 0
[ 1.820000] res[5]->start = 0
[ 1.820000] res[5]->end = 0
[ 1.820000] Switching to clocksource MIPS
[ 1.830000] NET: Registered protocol family 2
[ 1.830000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 1.840000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[ 1.850000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[ 1.850000] TCP: Hash tables configured (established 4096 bind 4096)
[ 1.860000] TCP reno registered
[ 1.860000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 1.870000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 1.870000] NET: Registered protocol family 1
[ 2.570000] RT3xxx EHCI/OHCI init.
[ 2.570000] msgmni has been set to 242
[ 2.580000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
[ 2.580000] io scheduler noop registered (default)
[ 2.590000] RALINK_REG_PIO7140DATA b0000670 = 0
[ 2.690000] RALINK_REG_PIO7140DATA b0000670 = 2000000
[ 2.700000] Ralink gpio driver initialized
[ 2.700000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 2.710000] serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
[ 2.720000] serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
[ 2.720000] init reset module!
[ 2.730000] !!! nand page size = 2048, addr len=4
[ 2.730000] ra_nand_init: alloc 1354, at 87d92000 , btt(87d930c4, 100), ranfc_mtd:87d931c4
[ 2.740000] NAND device: Manufacturer ID: 0xc8, Chip ID: 0xd1
[ 2.750000] NAND ECC: Controller
[ 2.750000] Creating 13 MTD partitions on "ra_nfc":
[ 2.760000] 0x000000000000-0x000008000000 : "ALL"
[ 2.790000] 0x000000000000-0x000000040000 : "Bootloader"
[ 2.790000] 0x000000040000-0x000000080000 : "Config"
[ 2.800000] 0x000000080000-0x0000000c0000 : "Bdata"
[ 2.810000] 0x0000000c0000-0x000000100000 : "Factory"
[ 2.810000] 0x000000100000-0x000000140000 : "crash"
[ 2.820000] 0x000000140000-0x000000180000 : "crash_syslog"
[ 2.820000] 0x000000180000-0x000000200000 : "reserved0"
[ 2.830000] 0x000000200000-0x000000600000 : "kernel0"
[ 2.840000] 0x000000600000-0x000000a00000 : "kernel1"
[ 2.840000] 0x000000a00000-0x000002a00000 : "rootfs0"
[ 2.850000] 0x000002a00000-0x000004a00000 : "rootfs1"
[ 2.850000] 0x000004a00000-0x000008000000 : "overlay"
[ 2.860000] rdm_major = 253
[ 2.860000] SMACCR1 -- : 0x0000286c
[ 2.870000] SMACCR0 -- : 0x074dbf30
[ 2.870000] Ralink APSoC Ethernet Driver Initilization. v3.0 256 rx/tx descriptors allocated, mtu = 1500!
[ 2.880000] SMACCR1 -- : 0x0000286c
[ 2.880000] SMACCR0 -- : 0x074dbf30
[ 2.890000] PROC INIT OK!
[ 2.890000] PPP generic driver version 2.4.2
[ 2.900000] PPP MPPE Compression module registered
[ 2.900000] NET: Registered protocol family 24
[ 2.910000] PPTP driver version 0.8.5
[ 2.910000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 3.040000] rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
[ 3.040000] rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
[ 3.080000] rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
[ 3.100000] rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
[ 3.100000] hub 1-0:1.0: USB hub found
[ 3.110000] hub 1-0:1.0: 1 port detected
[ 3.110000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 3.140000] rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
[ 3.140000] rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
[ 3.150000] rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
[ 3.220000] hub 2-0:1.0: USB hub found
[ 3.220000] hub 2-0:1.0: 1 port detected
[ 3.230000] Initializing USB Mass Storage driver...
[ 3.230000] usbcore: registered new interface driver usb-storage
[ 3.240000] USB Mass Storage support registered.
[ 3.240000] u32 classifier
[ 3.250000] input device check on
[ 3.250000] Actions configured
[ 3.250000] Netfilter messages via NETLINK v0.30 with ipset netlink.patch.
[ 3.260000] nf_conntrack version 0.5.0 (1936 buckets, 7744 max)
[ 3.270000] xt_time: kernel timezone is -0000
[ 3.270000] GRE over IPv4 demultiplexor driver
[ 3.280000] ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
[ 3.280000] TCP cubic registered
[ 3.290000] NET: Registered protocol family 10
[ 3.290000] lo: Disabled Privacy Extensions
[ 3.300000] NET: Registered protocol family 17
[ 3.300000] L2TP core driver, V2.0
[ 3.310000] PPPoL2TP kernel driver, V2.0
[ 3.310000] L2TP netlink interface
[ 3.310000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[ 3.320000] All bugs added by David S. Miller <davem@redhat.com>
[ 3.330000] otp found flash : 0x9580d1c8
[ 3.340000] Freeing unused kernel memory: 860k freed
[ 3.440000] Loading essential drivers...
[ 3.440000] Press Ctrl+C to enter RAMFS...
[ 4.460000] Check for USB recovery...
[ 4.500000] Bringup the system...
[ 4.510000] flag_boot_rootfs=1 mounting /dev/mtd11
[ 4.520000] UBI: attaching mtd11 to ubi0
[ 4.520000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 4.530000] UBI: logical eraseblock size: 126976 bytes
[ 4.530000] UBI: smallest flash I/O unit: 2048
[ 4.540000] UBI: VID header offset: 2048 (aligned 2048)
[ 4.540000] UBI: data offset: 4096
[ 4.690000] UBI: max. sequence number: 2
[ 4.710000] UBI: attached mtd11 to ubi0
[ 4.710000] UBI: MTD device name: "rootfs1"
[ 4.720000] UBI: MTD device size: 32 MiB
[ 4.720000] UBI: number of good PEBs: 256
[ 4.730000] UBI: number of bad PEBs: 0
[ 4.730000] UBI: max. allowed volumes: 128
[ 4.740000] UBI: wear-leveling threshold: 4096
[ 4.740000] UBI: number of internal volumes: 1
[ 4.750000] UBI: number of user volumes: 1
[ 4.750000] UBI: available PEBs: 0
[ 4.750000] UBI: total number of reserved PEBs: 256
[ 4.760000] UBI: number of PEBs reserved for bad PEB handling: 4
[ 4.770000] UBI: max/mean erase counter: 6/3
[ 4.770000] UBI: image sequence number: 986027147
[ 4.770000] UBI: background thread "ubi_bgt0d" started, PID 83
UBI device number 0, total 256 LEBs (32505856 bytes, 31.0 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
[ 4.870000] UBIFS: mounted UBI device 0, volume 0, name "system"
[ 4.870000] UBIFS: mounted read-only
[ 4.880000] UBIFS: file system size: 30093312 bytes (29388 KiB, 28 MiB, 237 LEBs)
[ 4.880000] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
[ 4.890000] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 4.900000] UBIFS: default compressor: zlib
[ 4.900000] UBIFS: reserved for root: 0 bytes (0 KiB)
config core 'version'
# ROM ver
option ROM '2.21.166'
# channel
option CHANNEL 'stable'
# hardware platform R1AC or R1N etc.
option HARDWARE 'R3'
# CFE ver
option UBOOT '1.0.2'
# Linux Kernel ver
option LINUX '0.1.12'
# RAMFS ver
option RAMFS '0.1.12'
# SQUASHFS ver
option SQAFS '0.1.12'
# ROOTFS ver
option ROOTFS '0.1.12'
#build time
option BUILDTIME 'Tue, 19 Sep 2017 20:19:51 +0800'
#build timestamp
option BUILDTS '1505823591'
#build git tag
option GTAG 'commit 8a8604157b71902fb6326be612d2a4cbb5caef00'
mount: mounting proc on /proc failed: Device or resource busy
mount: mounting sysfs on /sys failed: Device or resource busy
[ 5.640000] Raeth v3.0 (Tasklet,SkbRecycle)
[ 5.650000]
[ 5.650000] phy_tx_ring = 0x0740d000, tx_ring = 0xa740d000
[ 5.650000]
[ 5.650000] phy_rx_ring0 = 0x074e8000, rx_ring0 = 0xa74e8000
[ 5.650000] SMACCR1 -- : 0x0000286c
[ 5.650000] SMACCR0 -- : 0x074dbf30
[ 5.670000] ESW: Link Status Changed - Port1 Link UP
[ 5.670000] CDMA_CSG_CFG = 81000000
[ 5.680000] GDMA1_FWD_CFG = 20710000
- preinit -
Tue Sep 19 20:33:58 UTC 2017
- regular preinit -
/lib/preinit.sh: line 1: pi_indicate_led: not found
[ 5.830000] UBI: attaching mtd12 to ubi1
[ 5.830000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 5.840000] UBI: logical eraseblock size: 126976 bytes
[ 5.850000] UBI: smallest flash I/O unit: 2048
[ 5.850000] UBI: VID header offset: 2048 (aligned 2048)
[ 5.860000] UBI: data offset: 4096
[ 6.110000] UBI: max. sequence number: 2790
[ 6.120000] UBI: attached mtd12 to ubi1
[ 6.130000] UBI: MTD device name: "overlay"
[ 6.130000] UBI: MTD device size: 54 MiB
[ 6.140000] UBI: number of good PEBs: 432
[ 6.140000] UBI: number of bad PEBs: 0
[ 6.150000] UBI: max. allowed volumes: 128
[ 6.150000] UBI: wear-leveling threshold: 4096
[ 6.160000] UBI: number of internal volumes: 1
[ 6.160000] UBI: number of user volumes: 1
[ 6.160000] UBI: available PEBs: 0
[ 6.170000] UBI: total number of reserved PEBs: 432
[ 6.170000] UBI: number of PEBs reserved for bad PEB handling: 8
[ 6.180000] UBI: max/mean erase counter: 8/6
[ 6.180000] UBI: image sequence number: 193015254
[ 6.190000] UBI: background thread "ubi_bgt1d" started, PID 151
UBI device number 1, total 432 LEBs (54853632 bytes, 52.3 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
[ 6.240000] UBIFS: recovery needed
[ 6.290000] UBIFS: recovery completed
[ 6.300000] UBIFS: mounted UBI device 1, volume 0, name "data"
[ 6.300000] UBIFS: file system size: 52187136 bytes (50964 KiB, 49 MiB, 411 LEBs)
[ 6.310000] UBIFS: journal size: 2666496 bytes (2604 KiB, 2 MiB, 21 LEBs)
[ 6.320000] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 6.320000] UBIFS: default compressor: lzo
[ 6.330000] UBIFS: reserved for root: 2464926 bytes (2407 KiB)
/lib/preinit.sh: line 1: jffs2_not_mounted: not found
- init -
[ 7.350000] ra2880stop()...Done
[ 7.360000] Free TX/RX Ring Memory!
init started: BusyBox v1.19.4 (2017-09-19 20:13:42 CST)
Please press Enter to activate this console. rcS S boot: INFO: rc script run time limit to 65 seconds.
[ 8.210000] tun: Universal TUN/TAP device driver, 1.6
[ 8.210000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[ 8.240000] Mirror/redirect action on
[ 8.520000] GRE over IPv4 tunneling driver
[ 8.760000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 9.090000] nf_nat_amanda: Unknown symbol nf_nat_amanda_hook (err 0)
[ 9.270000] ipt: xt_cgroup_MARK installed ok.
[ 9.400000] ip_set: protocol 6
[ 9.720000] Traffic lan port is eth0
[ 9.730000] dstack: module license 'BSD/GPL' taints kernel.
[ 9.740000] Disabling lock debugging due to kernel taint
[ 9.740000] sstack_init
[ 9.770000] dev_redirect load success.
[ 11.060000] <-- RTMPAllocTxRxRingMemory, Status=0
[ 11.070000] <-- RTMPAllocAdapterBlock, Status=0
[ 12.570000] <-- RTMPAllocTxRxRingMemory, Status=0
[ 12.590000] <-- RTMPAllocAdapterBlock, Status=0
[ 12.600000] pAd->CSRBaseAddress =0xc1100000, csr_addr=0xc1100000!
[ 12.600000] <dbg> MAC_CSR0=1986146304, RtmpChipOpsHook
[ 12.610000] <dbg> dev idx = 1!
[ 12.610000] <dbg> get_dev_config_idx pAd->MACVersion = 76623000, pAd->ChipID = 76120044
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: INFO: loading exist /etc/config/network.
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: config interface 'loopback'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option ifname 'lo'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option proto 'static'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option ipaddr '127.0.0.1'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option netmask '255.0.0.0'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: config interface 'lan'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option ifname 'eth0.1'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option type 'bridge'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option proto 'static'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option ipaddr '192.168.31.1'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option netmask '255.255.255.0'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option ip6assign '64'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: list ip6class 'ifb'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: list ip6class 'ipv66'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: config interface 'wan'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option ifname 'eth0.2'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option proto 'dhcp'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: config interface 'wan6'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option ifname '@wan'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option proto 'dhcpv6'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: config interface 'ifb'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option ifname 'ifb0'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: config interface 'ready'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option proto 'static'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option ipaddr '169.254.29.1'
Wed Sep 20 04:34:05 CST 2017 netconfig[505]: option netmask '255.255.255.0'
[ 15.440000] Raeth v3.0 (Tasklet,SkbRecycle)
[ 15.450000]
[ 15.450000] phy_tx_ring = 0x0603f000, tx_ring = 0xa603f000
[ 15.450000]
[ 15.450000] phy_rx_ring0 = 0x05e70000, rx_ring0 = 0xa5e70000
[ 15.450000] SMACCR1 -- : 0x0000286c
[ 15.450000] SMACCR0 -- : 0x074dbf30
[ 15.470000] CDMA_CSG_CFG = 81000000
[ 15.470000] GDMA1_FWD_CFG = 20710000
[ 15.540000] device eth0.1 entered promiscuous mode
[ 15.540000] device eth0 entered promiscuous mode
[ 15.560000] br-lan: port 1(eth0.1) entering learning state
[ 15.560000] br-lan: port 1(eth0.1) entering learning state
[ 17.080000] <dbg> MAC_CSR0=1986146304, rtmp_asic_top_init
[ 17.180000] Set defult RDRegion value: CountryCode=CN , RDRegion=0
[ 17.560000] br-lan: port 1(eth0.1) entering forwarding state
[ 21.190000] <==== rt28xx_init, Status=0
^[[5~^[[5~^[[5~[ 26.510000] dev_redirect: add(+) dev redirect mapping: src:eth0.2->dst:ifb0
[ 26.690000] device wl0 entered promiscuous mode
[ 26.700000] br-lan: port 2(wl0) entering learning state
[ 26.700000] br-lan: port 2(wl0) entering learning state
[ 28.700000] br-lan: port 2(wl0) entering forwarding state
[ 29.820000] <==== rt28xx_init, Status=0
[ 29.830000] 0x1300 = 00064320
[ 32.880000] device wl1 entered promiscuous mode
[ 32.880000] br-lan: port 3(wl1) entering learning state
[ 32.890000] br-lan: port 3(wl1) entering learning state
[ 34.220000] tcpproxy_init, succeed!
[ 34.890000] br-lan: port 3(wl1) entering forwarding state
rcS S calling: /etc/rc.d/S20network boot: WARNING: EXITCODE=0, execute too slow, 21 >= 15: /etc/rc.d/S20network boot
[ 40.060000] dev_redirect: add(+) dev redirect mapping: src:eth0.2->dst:ifb0
Wed Sep 20 04:34:36 CST 2017 boot_check[4153]: INFO: Wireless OK
[ 48.510000] Enabling Ralink HW NAT Module ...
[ 48.520000] Ralink HW NAT Module Enabled!
rcS S boot: INFO: rcS S boot timing 50 seconds.
Wed Sep 20 04:34:53 CST 2017 INFO: rcS S boot timing 50 seconds.
rcS S boot: system type(R3/2): SQUASH/3
Wed Sep 20 04:34:53 CST 2017 system type(R3/2): SQUASH/3
rcS S boot: ROOTFS: ubi0_0 on / type ubifs (ro,noatime,bulk_read,no_chk_data_crc,compr=zlib)
Wed Sep 20 04:34:53 CST 2017 ROOTFS: ubi0_0 on / type ubifs (ro,noatime,bulk_read,no_chk_data_crc,compr=zlib)
mknod: /dev/gpio: File exists
Wed Sep 20 04:34:54 CST 2017 boot_check[5979]: Booting up finished.
mtd分区
Creating 13 MTD partitions on "ra_nfc":
0x000000000000-0x000008000000 : "ALL"
0x000000000000-0x000000040000 : "Bootloader"
0x000000040000-0x000000080000 : "Config"
0x000000080000-0x0000000c0000 : "Bdata"
0x0000000c0000-0x000000100000 : "Factory"
0x000000100000-0x000000140000 : "crash"
0x000000140000-0x000000180000 : "crash_syslog"
0x000000180000-0x000000200000 : "reserved0"
0x000000200000-0x000000600000 : "kernel0"
0x000000600000-0x000000a00000 : "kernel1"
0x000000a00000-0x000002a00000 : "rootfs0"
0x000002a00000-0x000004a00000 : "rootfs1"
0x000004a00000-0x000008000000 : "overlay"
RAMFS下的/init分析
/ # cat init
#!/bin/sh
# Copyright (C) 2006-2012 OpenWrt.org
#
#
klogger() {
local msg="$@"
test -z "$msg" && return 1
echo "$msg" >> /dev/kmsg 2>/dev/null
}
root_image_corrupt() {
klogger "Compressed RootFS image is corrupted. Error code $1."
klogger "Check NAND flash or do USB recovery."
gpio l 24 0 1 0 0 0 # blue: off
gpio l 26 0 1 0 0 0 # yellow: off
gpio l 29 1 0 0 0 0 # red: on
while true; do
sleep 1
done
}
enter_ramfs() {
export BOOT=RAMFS
export MODE=NORMAL
exec /sbin/init
}
enter_recovery() {
export BOOT=RAMFS
export MODE=RECOVERY
if [ $1 -eq 1 ]; then
export RECOVERY_WAIT=1
fi
exec /sbin/init
}
check_recovery_flashdrive() {
local REC_DEV="/dev/sda"
local REC_PART="/dev/sda1"
local flag=`nvram get auto_recovery`
local ft_mode=`cat /proc/xiaoqiang/ft_mode`
#skip if factory mode
[ "$ft_mode" = "1" ] && return 1
#auto recovery in progress?
[ "$flag" = "1" ] && {
nvram set auto_recovery=0
nvram commit
return 1
}
# usb block device may not be ready yet. see we if have scsi device attached
[ -e /proc/scsi/usb-storage/0 ] && {
klogger "Found usb storage, wait for ready"
for loop in 1 2 3 4 5 6 7 8 9
do
[ -e "$REC_DEV" ] && break;
sleep 1
done
}
#not usb block device
[ -e "$REC_DEV" ] || return 1
#no partition 1
[ -e "$REC_PART" ] || return 2
#more than one partition. not usb recovery disk
[ -e "$REC_DEV"2 ] && return 3
#check "OEM manufacture" field in FAT16 header at offset 3
dd if="$REC_PART" of=/tmp/fat16_oem bs=1 count=8 skip=3 2>/dev/null
[ "$?" = "0" ] || return 4
[ `cat /tmp/fat16_oem` = "miusbkit" ] && {
export AUTO_RECOVERY=1
return 0
}
return 5
}
check_reset_button() {
local gpiobtn=`cat /proc/xiaoqiang/reset`
local rst=`gpio $gpiobtn | awk -F : '{print $2}'`
if [ "$rst" = "<0>" ]; then
return 0
else
return 1
fi
}
reboot() {
exec /sbin/reboot -f
}
upmount() {
mount -n -o move /tmp /mnt/tmp
mount -n -o move /sys /mnt/sys
mount -n -o move /proc /mnt/proc
mount -n -o move /dev /mnt/dev
}
factory_image_burn() {
# check if we need to extract the ubifs image from nandflash
# dd if=/dev/mtd10 of=/tmp/hdr.bin bs=1 count=4 > /dev/null 2>&1
# read first page
nanddump --bb=skipbad --omitoob --length=2048 -f /tmp/firstpage.bin /dev/mtd12 > /dev/null 2>&1
dd if=/tmp/firstpage.bin of=/tmp/hdr.bin bs=1 count=4 > /dev/null 2>&1
hdr=`hexdump -e '1/4 "%.8x"' /tmp/hdr.bin`
if [ "$hdr" = "31524448" ]; then
# Found a valid trx header.
dd if=/tmp/firstpage.bin of=/tmp/len.bin bs=1 count=4 skip=4 > /dev/null 2>&1
len=`hexdump -e '1/4 "%d"' /tmp/len.bin`
len=$(($len+272))
align_len=$((($len+2048)/2048*2048))
klogger "Found TRX image... $len bytes"
nanddump --bb=skipbad --omitoob --length=$align_len -f /tmp/image.bin /dev/mtd12
dd if=/tmp/image.bin of=/tmp/root.ubi.lzma.trx bs=$len count=1 > /dev/null 2>&1
rm -f /tmp/image.bin /tmp/hdr.bin /tmp/firstpage.bin
cd /tmp
mkxqimage -r -x root.ubi.lzma.trx
if [ "$?" != "0" ]; then
# image is corrupt
klogger "TRX image is corrupted."
root_image_corrupt 4
fi
rm -f root.ubi.lzma.trx
[ -f /tmp/root.ubi.lzma ] || root_image_corrupt 1
klogger "TRX image verify pass. Decompressing..."
gpio l 24 0 1 0 0 0 # blue: off
gpio l 26 10 10 1 0 1 # yellow: blink
gpio l 29 0 1 0 0 0 # red: off
unlzma /tmp/root.ubi.lzma
if [ "$?" = "0" ]; then
klogger "Done"
else
root_image_corrupt 2
fi
if [ -f /tmp/root.ubi ]; then
ubiformat /dev/mtd10 -s 2048 -O 2048 -y -f /tmp/root.ubi
ubiformat /dev/mtd11 -s 2048 -O 2048 -y -f /tmp/root.ubi
# In case we missed the flags
nvram set restore_defaults=1
nvram commit
gpio l 24 0 1 0 0 0 # blue: off
gpio l 26 1 0 0 0 0 # yellow: on
gpio l 29 0 1 0 0 0 # red: off
else
klogger "Root.ubi is missing."
root_image_corrupt 4
fi
rm -f /tmp/root.ubi
fi
}
[ -d /dev ] || mkdir -m 0755 /dev
[ -d /mnt ] || mkdir -m 0700 /mnt
[ -d /sys ] || mkdir /sys
[ -d /proc ] || mkdir /proc
[ -d /tmp ] || mkdir /tmp
mkdir -p /var/lock
mount -t sysfs -o nodev,noexec,nosuid none /sys
mount -t proc -o nodev,noexec,nosuid none /proc
kernel0_mtd_dev=$(grep kernel0 /proc/mtd | awk -F: '{print substr($1,4)}')
kernel1_mtd_dev=$(grep kernel1 /proc/mtd | awk -F: '{print substr($1,4)}')
rootfs0_mtd_dev=$(grep rootfs0 /proc/mtd | awk -F: '{print substr($1,4)}')
rootfs1_mtd_dev=$(grep rootfs1 /proc/mtd | awk -F: '{print substr($1,4)}')
data_mtd_dev=$(grep overlay /proc/mtd | awk -F: '{print substr($1,4)}')
ubi_rootfs_devn=0
ubi_rootfs_vol_id=0
klogger "Loading, please wait..."
# Note that this only becomes /dev on the real filesystem if udev's scripts
# are used; which they will be, but it's worth pointing out
if ! mount -t devtmpfs -o mode=0755 none /dev; then
mount -t tmpfs -o mode=0755 none /dev
mknod -m 0600 /dev/console c 5 1
mknod /dev/null c 1 3
fi
mount -t tmpfs -o "nosuid,size=90%,mode=0755" tmpfs /tmp
klogger "Loading essential drivers..."
klogger "Press Ctrl+C to enter RAMFS..."
rd -w 1
if [ $? -eq 0 ]; then
enter_ramfs
fi
# Check for USB recovery
klogger "Check for USB recovery..."
check_recovery_flashdrive
if [ $? -eq 0 ]; then
enter_recovery 0
fi
check_reset_button
if [ $? -eq 0 ]; then
enter_recovery 0
fi
ft_mode=`cat /proc/xiaoqiang/ft_mode`
[ "$ft_mode" = "1" ] && factory_image_burn
try_sys1_failed=`nvram get flag_try_sys1_failed`
try_sys2_failed=`nvram get flag_try_sys2_failed`
if [ "$try_sys1_failed" == "1" -a "$try_sys2_failed" == "1" ]; then
klogger "Both systems are corrupted... Entering recovery mode"
enter_recovery 1
fi
klogger "Bringup the system..."
# default: rootfs0
flag=`nvram get flag_boot_rootfs`
if [ "$flag" == "1" ]; then
mtd_dev=$rootfs1_mtd_dev
else
mtd_dev=$rootfs0_mtd_dev
fi
klogger "flag_boot_rootfs=$flag mounting /dev/mtd$mtd_dev"
ubiattach /dev/ubi_ctrl --devn=$ubi_rootfs_devn --mtdn=$mtd_dev
mount -t ubifs -o ro,no_chk_data_crc,noatime,bulk_read,compr=zlib ubi${ubi_rootfs_devn}_${ubi_rootfs_vol_id} /mnt
# flag_boot_type: 1 system in SATA version
#nvram set flag_boot_type=1
if [ -x /mnt/lib/preinit.sh ]; then
upmount
exec switch_root /mnt /lib/preinit.sh
fi
# failed to boot, switch OS
if [ "$ft_mode" = "1" ]; then
# skip failed flag setting in FT mode
root_image_corrupt 3
reboot
else
if [ "$flag" = "1" ]; then
nvram set flag_try_sys2_failed=1
else
nvram set flag_try_sys1_failed=1
fi
nvram set flag_ota_reboot=0
nvram commit
reboot
fi
流程
step
- 决定基于已有的MIWIFI-MINI来增加对MIWIFI-3的支持，首先我搜索miwifi关键字发现有如下文件包含，至少这些地方需要修改
target/linux/ramips/
base-files/lib/upgrade/platform.sh
base-files/lib/ramips.sh
base-files/etc/board.d/02_network
base-files/etc/diag.sh
dts/MIWIFI-3.dts
image/mt7620.mk
- 添加新硬件的镜像支持,在target/linux/ramips/image/mt7620.mk
diff --git a/target/linux/ramips/image/mt7620.mk b/target/linux/ramips/image/mt7620.mk
index e27c405..5e80088 100644
--- a/target/linux/ramips/image/mt7620.mk
+++ b/target/linux/ramips/image/mt7620.mk
@@ -349,6 +349,16 @@ define Device/miwifi-mini
endef
TARGET_DEVICES += miwifi-mini
+# OK_PATCH
+define Device/miwifi-3
+ DTS := MIWIFI-3
+ IMAGE_SIZE := $(ralink_default_fw_size_16M)
+ DEVICE_TITLE := Xiaomi MiWiFi 3
+ DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
+endef
+TARGET_DEVICES += miwifi-3
+#end of OK_PATCH
+
define Device/gl-mt300a
DTS := GL-MT300A
IMAGE_SIZE := $(ralink_default_fw_size_16M)
- 基于MIWIFI-MINI添加对应的dts文件，正确描述硬件信息
root@oakridge /root [#]# cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00020000 "Bootloader"
mtd1: 00040000 00020000 "Config"
mtd2: 00040000 00020000 "Bdata"
mtd3: 00040000 00020000 "Factory"
mtd4: 00040000 00020000 "crash"
mtd5: 00040000 00020000 "crash_syslog"
mtd6: 00080000 00020000 "reserved0"
mtd7: 07e00000 00020000 "firmware"
mtd8: 0013454c 00020000 "kernel"
mtd9: 07ccbab4 00020000 "rootfs"
mtd10: 077e0000 00020000 "rootfs_data"
/dts-v1/;
#include "mt7620a.dtsi"
#include <dt-bindings/input/input.h>
/ {
compatible = "xiaomi,miwifi-3", "ralink,mt7620a-soc";
model = "Xiaomi MiWiFi 3";
chosen {
bootargs = "console=ttyS0,115200";
};
gpio-leds {
compatible = "gpio-leds";
blue {
label = "miwifi-mini:blue:status";
gpios = <&gpio1 0 1>;
};
yellow {
label = "miwifi-mini:yellow:status";
gpios = <&gpio1 2 1>;
};
red {
label = "miwifi-mini:red:status";
gpios = <&gpio1 5 1>;
};
};
gpio-keys-polled {
compatible = "gpio-keys-polled";
#address-cells = <1>;
#size-cells = <0>;
poll-interval = <20>;
reset {
label = "reset";
gpios = <&gpio1 6 0>;
linux,code = <KEY_RESTART>;
};
};
};
&gpio0 {
status = "okay";
};
&gpio1 {
status = "okay";
};
&gpio2 {
status = "okay";
};
&spi0 {
status = "okay";
m25p80@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "jedec,spi-nor";
reg = <0>;
spi-max-frequency = <10000000>;
partition@0 {
label = "spi";
reg = <0x0 0x1000000>;
read-only;
};
};
};
&nand {
status = "okay";
partition@0 {
label = "Bootloader";
reg = <0x0 0x40000>;
read-only;
};
partition@40000 {
label = "Config";
reg = <0x40000 0x80000>;
read-only;
};
partition@80000 {
label = "Bdata";
reg = <0x80000 0xc0000>;
};
factory: partition@c0000 {
label = "Factory";
reg = <0xc0000 0x100000>;
};
partition@100000 {
label = "crash";
reg = <0x100000 0x140000>;
};
partition@140000 {
label = "crash_syslog";
reg = <0x140000 0x180000>;
};
partition@180000 {
label = "reserved0";
reg = <0x180000 0x200000>;
};
partition@200000 {
label = "firmware";
reg = <0x200000 0x7e00000>;
};
};
&ehci {
status = "okay";
};
&ohci {
status = "okay";
};
ðernet {
pinctrl-names = "default";
pinctrl-0 = <&ephy_pins>;
mtd-mac-address = <&factory 0x28>;
mediatek,portmap = "llllw";
};
&wmac {
ralink,mtd-eeprom = <&factory 0>;
};
&pcie {
status = "okay";
pcie-bridge {
mt76@0,0 {
reg = <0x0000 0 0 0 0>;
device_type = "pci";
mediatek,mtd-eeprom = <&factory 0x8000>;
ieee80211-freq-limit = <5000000 6000000>;
};
};
};
&pinctrl {
state_default: pinctrl0 {
gpio {
ralink,group = "i2c", "rgmii1";
ralink,function = "gpio";
};
pa {
ralink,group = "pa";
ralink,function = "pa";
};
};
};
- 添加设备名称到./lib/ramips.sh
diff --git a/ok_base-files/lib/ramips.sh b/ok_base-files/lib/ramips.sh
index 17ada64..8bf181e 100755
--- a/ok_base-files/lib/ramips.sh
+++ b/ok_base-files/lib/ramips.sh
@@ -286,6 +286,11 @@ ramips_board_detect() {
*"MiWiFi Mini")
name="miwifi-mini"
;;
+ # OK_PATCH
+ *"MiWiFi 3")
+ name="miwifi-3"
+ ;;
+ #end of OK_PATCH
*"MiWiFi Nano")
name="miwifi-nano"
;;
- 设置默认网络相关的
diff --git a/ok_base-files/etc/board.d/02_network b/ok_base-files/etc/board.d/02_network
index 49b7982..187e473 100755
--- a/ok_base-files/etc/board.d/02_network
+++ b/ok_base-files/etc/board.d/02_network
@@ -110,6 +110,12 @@ ramips_setup_interfaces()
ucidef_add_switch "switch0" \
"0:lan" "1:lan" "2:lan" "3:lan" "4:wan" "6@eth0"
;;
+ # OK_PATCH
+ miwifi-3)
+ ucidef_add_switch "switch0" \
+ "0:wan" "1:lan" "2:lan" "3:lan" "4:lan" "6@eth0"
+ ;;
+ # end of OK_PATCH
whr-300hp2|\
whr-600d|\
wsr-1166|\
@@ -372,7 +378,8 @@ ramips_setup_macs()
lan_mac=$(mtd_get_mac_binary factory_info 13)
wan_mac=$(macaddr_add "$lan_mac" 1)
;;
- miwifi-mini)
+ #OK_PATCH
+ miwifi-mini | miwifi-3)
wan_mac=$(cat /sys/class/net/eth0/address)
lan_mac=$(macaddr_setbit_la "$wan_mac")
;;
- 设置led相关
etc/board.d/01_led
+ # OK_PATCH
+ miwifi-3)
+ ucidef_set_led_default "power" "power" "$board:red:status" "1"
+ ;;
+ # end of OK_PATCH
etc/diag.sh
+ #OK_PATCH
+ miwifi-mini|\
+ miwifi-3 |\
+ zte-q7)
+ #end of OK_PATCH
+ status_led="$board:red:status"
+ ;;
升级过程
- 首先通过小米路由器升级界面，升级到开发版本ROM，2.11.20
- 通过访问4个一系列的URL，破解进入SSH
http://192.168.31.1/cgi-bin/luci/;stok=【你的stok，登录路由器管理界面在地址栏可以看到】/api/xqnetwork/set_wifi_ap?ssid=tianbao&encryption=NONE&enctype=NONE&channel=1%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit
http://192.168.31.1/cgi-bin/luci/;stok=【你的stok，登录路由器管理界面在地址栏可以看到】/api/xqnetwork/set_wifi_ap?ssid=tianbao&encryption=NONE&enctype=NONE&channel=1%3Bsed%20%2Di%20%22%3Ax%3AN%3As%2Fif%20%5C%5B%2E%2A%5C%3B%20then%5Cn%2E%2Areturn%200%5Cn%2E%2Afi%2F%23tb%2F%3Bb%20x%22%20%2Fetc%2Finit.d%2Fdropbear
http://192.168.31.1/cgi-bin/luci/;stok=【你的stok，登录路由器管理界面在地址栏可以看到】/api/xqnetwork/set_wifi_ap?ssid=tianbao&encryption=NONE&enctype=NONE&channel=1%3B%2Fetc%2Finit.d%2Fdropbear%20start
http://192.168.31.1/cgi-bin/luci/;stok=【你的stok，登录路由器管理界面在地址栏可以看到】/api/xqsystem/set_name_password?oldPwd=路由器管理密码&newPwd=路由器管理密码
前三个返回错误如下：
{
"msg": "未能连接到指定WiFi(Probe timeout)",
"code": 1616
}
最后一个应该返回成功：
{
"code": 0
}
- LEDE下基于MIWIFI-MINI生成的IMAGE如下
bin/targets/ramips/mt7620/lede-ramips-mt7620-miwifi-3-initramfs-kernel.bin
bin/targets/ramips/mt7620/lede-ramips-mt7620-miwifi-3-squashfs-sysupgrade.bin
其中initramfs，可以通过uboot下的SDRAM启动，直接启动到内核
然后通过sysupgrade -n sysupgrade.bin写入image到FLASH中
不需要串口的升级方案
- 将squashfs-sysupgrade.bin分解为kernel0,kernel1,rootfs0,rootfs1
dd if=lede-ramips-mt7620-miwifi-3-squashfs-sysupgrade.bin of=kernel0 bs=$((0x400000)) count=1
dd if=lede-ramips-mt7620-miwifi-3-squashfs-sysupgrade.bin of=kernel1 bs=$((0x400000)) count=1 skip=1
mtd write kernel0.bin kernel0
mtd write kernel1.bin kernel1
不需要串口恢复方案
- 将备份的分区kernel0,kernel1,rootfs0组合起来
cat kernel0.bin kernel1.bin rootfs0.bin > firmware.bin
mtd write firmware.bin firmware
- 重启后再将rootfs0,备份到rootfs1分区中
dd if=/dev/mtd10 of=/tmp/rootfs1.bin
mtd write /tmp/rootfs1.bin rootfs1
参考
nicephil@gmail.com – 2017-12-10
