Adding OpenWrt support for Arcadyan WE420223-99 (KPN Experia WiFi)

walterav · October 10, 2022, 5:06pm

Great work both wiki and code, can't wait till a SOIP/SOIC16 clip arives and can test both from Raspberry and CH341.

As I understand there are 2 revisions of this model, which each a different kind of SPI flash chip both 16pins. For further completion could you also post/hint on the wiki which spi pins on the flashchips needs to be connected or a link to the datasheets for the chips?

PS: also have 3 of these devices 2 with older Firmware, but I wasn't able to get a root shell with the linked exploit in the past, could be pebcak...

Harm · October 11, 2022, 8:14pm

There are indeed two revisions with different chips but they have the same pinout.

So this is the flash chip, the physical package also has a clear marking of pin 1 with a dot:

You can find the Winbond datasheet here: https://www.winbond.com/hq/support/documentation/levelOne.jsp?__locale=en&DocNo=DA00-W25Q256JV

The raspberry pi pins are documented at https://pinout.xyz/pinout/spi# . I used SPI0. That means that:

Flash Chip -- Raspberry Pi

/HOLD -- 3v3 or not connected
VCC -- 3v3 Power
/RESET -- 3v3 Power
NC -- Nothing
/CS -- GPIO 8 (SPI0 CE0)
DO -- GPIO 9 (SPI0 MISO)

CLK -- GPIO11 (SPI0 SCLK)
DI -- GPIO 10 (SPI0 MOSI)
GND -- Ground
/WP -- 3v3 or not connected

I don't remember whether I connected /HOLD and /WP to the pi at all. Could you try and report back? I'll update the wiki later

I can't help you with the exploit, my devices all had newer firmware. You could ask Habbie in the #openwrt-devel chat for more information.

walterav · October 23, 2022, 9:41am

Thanks for the pinout details. In the mean time received the 16pin clip, but will will do some experimenting somewhere end of this month.

If I'm not mistaken I have access to at least 2 or maybe 3 experia devices with dated firmware versions (exploitable). If I'm able to backup these flashchips are you interested in the files to see if a easier exploit can be used for flashing OpenWrt without opening the device?

Harm · January 2, 2023, 5:23pm

@walterav I'm interested!

I received some feedback on my patches on the mailing list and I've updated my repo on GitHub accordingly. Users who are already run a build and are going to upgrade need to rename their network ports in the configuration. This can be done by renaming lan0 and lan1 to sw0 and sw1 in the /etc/config files. After renaming, do not restart/reload anything and directly flash the new build.

Goossens · February 25, 2023, 9:18pm

Since snapshots have moved to kernel 5.15, Wifi no longer works properly on my device. Seems to be related to this?

csharper2005 · February 26, 2023, 1:55pm

Need to apply the similar fix:

Goossens · February 26, 2023, 5:59pm

Even though that patch has been committed to master, today's SNAPSHOT only recognizes the MT7615E 2G interface.

Kernel log:

[    0.000000] Linux version 5.15.94 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.2.0 r22149-c9df2d5c64) 12.2.0, GNU ld (GNU Binutils) 2.39) #0 SMP Sat Feb 25 20:49:47 2023
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is Arcadyan WE420223-99
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] percpu: Embedded 11 pages/cpu s15856 r8192 d21008 u45056
[    0.000000] pcpu-alloc: s15856 r8192 d21008 u45056 alloc=11*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,57600 ubi.mtd=5 root=/dev/ubiblock0_0 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=0000b500
[    0.000000] Readback ErrCtl register=0000b500
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 118492K/131072K available (7414K kernel code, 632K rwdata, 1496K rodata, 1260K init, 251K bss, 12580K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 256
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns
[    0.000004] sched_clock: 64 bits at 880MHz, resolution 1ns, wraps every 4398046511103ns
[    0.016043] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[    0.088333] pid_max: default: 32768 minimum: 301
[    0.097697] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.112110] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.130543] rcu: Hierarchical SRCU implementation.
[    0.140336] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.155902] smp: Bringing up secondary CPUs ...
[    0.165602] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.165625] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.165640] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.165684] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.225710] Synchronize counters for CPU 1: done.
[    0.287371] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.287392] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.287402] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.287432] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.346561] Synchronize counters for CPU 2: done.
[    0.406907] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.406927] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.406938] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.406971] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.466143] Synchronize counters for CPU 3: done.
[    0.525741] smp: Brought up 1 node, 4 CPUs
[    0.537983] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.557466] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[    0.571304] pinctrl core: initialized pinctrl subsystem
[    0.583013] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.595325] thermal_sys: Registered thermal governor 'step_wise'
[    0.595879] cpuidle: using governor teo
[    0.617639] rt2880-pinmux pinctrl: there is not valid maps for state default
[    0.639839] FPU Affinity set after 11720 emulations
[    0.651621] clocksource: Switched to clocksource GIC
[    0.662290] NET: Registered PF_INET protocol family
[    0.672092] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.687079] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.703629] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.718963] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.734190] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.748164] TCP: Hash tables configured (established 1024 bind 1024)
[    0.760895] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.773799] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.787871] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.799043] PCI: CLS 0 bytes, default 32
[    0.809452] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.826507] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.838021] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.858466] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.876574] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.887955] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.899329] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.910837] mt7621-pci 1e140000.pcie: host bridge /pcie@1e140000 ranges:
[    0.924106] mt7621-pci 1e140000.pcie:   No bus range found for /pcie@1e140000, using [bus 00-ff]
[    0.941586] mt7621-pci 1e140000.pcie:      MEM 0x0060000000..0x006fffffff -> 0x0060000000
[    0.957801] mt7621-pci 1e140000.pcie:       IO 0x001e160000..0x001e16ffff -> 0x0000000000
[    1.331556] mt7621-pci 1e140000.pcie: pcie0 no card, disable it (RST & CLK)
[    1.345299] mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK)
[    1.359116] mt7621-pci 1e140000.pcie: PCIE1 enabled
[    1.368814] PCI coherence region base: 0x60000000, mask/settings: 0xf0000002
[    1.382945] mt7621-pci 1e140000.pcie: PCI host bridge to bus 0000:00
[    1.395469] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.406328] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    1.419981] pci_bus 0000:00: root bus resource [io  0x0000-0xffff]
[    1.432428] pci 0000:00:01.0: [0e8d:0801] type 01 class 0x060400
[    1.444255] pci 0000:00:01.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    1.456695] pci 0000:00:01.0: reg 0x14: [mem 0x60200000-0x6020ffff]
[    1.469186] pci 0000:00:01.0: supports D1
[    1.477071] pci 0000:00:01.0: PME# supported from D0 D1 D3hot
[    1.490519] pci 0000:01:00.0: [14c3:7615] type 00 class 0x000280
[    1.502401] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit]
[    1.516005] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:01.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    1.546766] pci 0000:00:01.0: PCI bridge to [bus 01-ff]
[    1.557045] pci 0000:00:01.0:   bridge window [io  0x0000-0x0fff]
[    1.569128] pci 0000:00:01.0:   bridge window [mem 0x60000000-0x600fffff]
[    1.582618] pci 0000:00:01.0:   bridge window [mem 0x60100000-0x601fffff pref]
[    1.596954] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    1.610120] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000]
[    1.623216] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000]
[    1.637043] pci 0000:00:01.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    1.650523] pci 0000:00:01.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref]
[    1.664864] pci 0000:00:01.0: BAR 1: assigned [mem 0x60200000-0x6020ffff]
[    1.678373] pci 0000:00:01.0: BAR 7: assigned [io  0x0000-0x0fff]
[    1.690441] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
[    1.704969] pci 0000:00:01.0: PCI bridge to [bus 01]
[    1.714801] pci 0000:00:01.0:   bridge window [io  0x0000-0x0fff]
[    1.726894] pci 0000:00:01.0:   bridge window [mem 0x60000000-0x600fffff]
[    1.740375] pci 0000:00:01.0:   bridge window [mem 0x60100000-0x601fffff pref]
[    1.756931] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    1.773784] printk: console [ttyS0] disabled
[    1.782282] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 19, base_baud = 3125000) is a 16550A
[    1.800191] printk: console [ttyS0] enabled
[    1.816742] printk: bootconsole [early0] disabled
[    1.838737] spi-mt7621 1e000b00.spi: sys_freq: 220000000
[    1.850716] spi-nor spi0.0: mx25l25635e (32768 Kbytes)
[    1.861122] 12 fixed-partitions partitions found on MTD device spi0.0
[    1.873966] Creating 12 MTD partitions on "spi0.0":
[    1.883683] 0x000000000000-0x000002000000 : "ALL"
[    1.894158] 0x000000000000-0x000000030000 : "Bootloader"
[    1.905709] 0x000000030000-0x000000040000 : "Config"
[    1.916599] 0x000000040000-0x000000050000 : "Factory"
[    1.927662] 0x000000050000-0x000001fb0000 : "kernel"
[    1.938518] 0x000000490000-0x000001fb0000 : "rootfs"
[    1.949377] mtd: setting mtd5 (rootfs) as root device
[    1.959570] mtdsplit: no squashfs found in "rootfs"
[    1.969331] 0x000001000000-0x000001fb0000 : "Kernel2"
[    1.980365] 0x000001440000-0x000001fb0000 : "RootFS2"
[    1.991474] 0x000001fb0000-0x000001fc0000 : "glbcfg"
[    2.002791] 0x000001fc0000-0x000001fd0000 : "board_data"
[    2.014251] 0x000001fd0000-0x000001fe0000 : "glbcfg2"
[    2.025373] 0x000001fe0000-0x000001ff0000 : "board_data2"
[    2.183000] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    2.199067] mtk_soc_eth 1e100000.ethernet: generated random MAC address ea:5c:11:ed:ed:7d
[    2.218434] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 20
[    2.235332] mtk_soc_eth 1e100000.ethernet: generated random MAC address 6a:5e:70:d9:7a:f5
[    2.254655] mtk_soc_eth 1e100000.ethernet swp0: mediatek frame engine at 0xbe100000, irq 20
[    2.273009] i2c_dev: i2c /dev entries driver
[    2.284836] NET: Registered PF_INET6 protocol family
[    2.296891] Segment Routing with IPv6
[    2.304313] In-situ OAM (IOAM) with IPv6
[    2.312235] NET: Registered PF_PACKET protocol family
[    2.322414] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.348577] 8021q: 802.1Q VLAN Support v1.8
[    2.362770] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    2.394064] mt7530 mdio-bus:1f: configuring for fixed/rgmii link mode
[    2.410825] mt7530 mdio-bus:1f: Link is Up - 1Gbps/Full - flow control rx/tx
[    2.412695] mt7530 mdio-bus:1f swp1 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7530 PHY] (irq=22)
[    2.448391] DSA: tree 0 setup
[    2.455320] ubi0: attaching mtd5
[    2.492644] ubi0: scanning is finished
[    2.512676] ubi0: attached mtd5 (name "rootfs", size 27 MiB)
[    2.524044] ubi0: PEB size: 65536 bytes (64 KiB), LEB size: 65408 bytes
[    2.537238] ubi0: min./max. I/O unit sizes: 1/256, sub-page size 1
[    2.549555] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[    2.562563] ubi0: good PEBs: 434, bad PEBs: 0, corrupted PEBs: 0
[    2.574537] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    2.588922] ubi0: max/mean erase counter: 3/1, WL threshold: 4096, image sequence number: 14579864
[    2.606773] ubi0: available PEBs: 0, total reserved PEBs: 434, PEBs reserved for bad PEB handling: 0
[    2.625001] ubi0: background thread "ubi_bgt0d" started, PID 322
[    2.625106] UBI: block: volume size is not a multiple of 512, last 384 bytes are ignored!
[    2.654249] block ubiblock0_0: created from ubi0:0(rootfs)
[    2.672099] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    2.690422] Freeing unused kernel image (initmem) memory: 1260K
[    2.702300] This architecture does not have kernel memory protection.
[    2.715144] Run /sbin/init as init process
[    2.723308]   with arguments:
[    2.723317]     /sbin/init
[    2.723323]   with environment:
[    2.723328]     HOME=/
[    2.723333]     TERM=linux
[    3.115593] init: Console is alive
[    3.122793] init: - watchdog -
[    3.739789] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.799083] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.821988] init: - preinit -
[    4.548287] random: jshn: uninitialized urandom read (4 bytes read)
[    4.670263] random: jshn: uninitialized urandom read (4 bytes read)
[    4.785561] random: jshn: uninitialized urandom read (4 bytes read)
[    5.088872] mtk_soc_eth 1e100000.ethernet swp0: PHY [mdio-bus:00] driver [MediaTek MT7530 PHY] (irq=POLL)
[    5.115606] mtk_soc_eth 1e100000.ethernet swp0: configuring for phy/rgmii link mode
[    7.320243] UBIFS (ubi0:1): default file-system created
[    7.331747] UBIFS (ubi0:1): Mounting in unauthenticated mode
[    7.343341] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 470
[    7.393243] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[    7.408870] UBIFS (ubi0:1): LEB size: 65408 bytes (63 KiB), min./max. I/O unit sizes: 8 bytes/256 bytes
[    7.427585] UBIFS (ubi0:1): FS size: 23219840 bytes (22 MiB, 355 LEBs), max 365 LEBs, journal size 1177344 bytes (1 MiB, 18 LEBs)
[    7.450792] UBIFS (ubi0:1): reserved for root: 1096730 bytes (1071 KiB)
[    7.463976] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 1EDE1043-2587-4B7B-88FE-F2CD1D8F9845, small LPT model
[    7.488921] mount_root: overlay filesystem has not been fully initialized yet
[    7.504772] mount_root: switching to ubifs overlay
[    7.529680] urandom-seed: Seed file not found (/etc/urandom.seed)
[    7.633132] procd: - early -
[    7.639101] procd: - watchdog -
[    8.251821] procd: - watchdog -
[    8.258685] procd: - ubus -
[    8.316808] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.331836] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.348961] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.366528] procd: - init -
[    8.908091] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.117837] urngd: v1.0.2 started.
[    9.149454] Loading modules backported from Linux version v6.1-rc8-0-g76dcd734eca2
[    9.164622] Backport generated by backports.git v5.15.81-1-41-g02e352527db5
[    9.307962] random: crng init done
[    9.314843] random: 31 urandom warning(s) missed due to ratelimiting
[    9.371181] pci 0000:00:01.0: enabling device (0006 -> 0007)
[    9.382525] mt7615e 0000:01:00.0: enabling device (0000 -> 0002)
[    9.396161] mt7615e 0000:01:00.0: Invalid MAC address, using random address 12:c5:b6:83:51:b6
[    9.419146] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[    9.419198] ieee80211 phy0: copying sband (band 1) due to VHT EXT NSS BW flag
[    9.442516] mt7615e 0000:01:00.0: HW/SW Version: 0x8a108a10, Build Time: 20180518100604a
[    9.668318] mt7615e 0000:01:00.0: N9 Firmware Version: _reserved_, Build Time: 20200814163649
[    9.756686] mt7615e 0000:01:00.0: CR4 Firmware Version: _reserved_, Build Time: 20190415154149
[   28.653054] mtk_soc_eth 1e100000.ethernet swp0: PHY [mdio-bus:00] driver [MediaTek MT7530 PHY] (irq=POLL)
[   28.683413] mtk_soc_eth 1e100000.ethernet swp0: configuring for phy/rgmii link mode
[   28.700477] br-lan: port 1(swp0) entered blocking state
[   28.711047] br-lan: port 1(swp0) entered disabled state
[   28.722050] device swp0 entered promiscuous mode
[   28.756912] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode
[   28.777912] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
[   28.798622] device eth0 entered promiscuous mode
[   28.809006] mt7530 mdio-bus:1f swp1: configuring for phy/gmii link mode
[   28.824213] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   28.838378] br-lan: port 2(swp1) entered blocking state
[   28.849015] br-lan: port 2(swp1) entered disabled state
[   28.862220] device swp1 entered promiscuous mode
[   30.761879] mtk_soc_eth 1e100000.ethernet swp0: Link is Up - 100Mbps/Full - flow control rx/tx
[   30.779201] br-lan: port 1(swp0) entered blocking state
[   30.789694] br-lan: port 1(swp0) entered forwarding state
[   30.801715] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

csharper2005 · February 26, 2023, 6:04pm

That patch is intended for another devices (also Arcadyan). I can make a new patch for Arcadyan WE420223-99 if you're ready to test it.

Goossens · February 26, 2023, 6:05pm

Ah, sorry I was confused then Sure I'm willing and able to test!

For what it's worth, kernel log for a 5.10-based image:

[    0.000000] Linux version 5.10.167 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.2.0 r22040-eeba2a67ca) 12.2.0, GNU ld (GNU Binutils) 2.39) #0 SMP Sun Feb 12 00:02:22 2023
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is Arcadyan WE420223-99
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] On node 0 totalpages: 32768
[    0.000000]   Normal zone: 288 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 32768 pages, LIFO batch:7
[    0.000000] percpu: Embedded 15 pages/cpu s30480 r8192 d22768 u61440
[    0.000000] pcpu-alloc: s30480 r8192 d22768 u61440 alloc=15*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,57600 ubi.mtd=5 root=/dev/ubiblock0_0 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00009500
[    0.000000] Readback ErrCtl register=00009500
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 118896K/131072K available (7032K kernel code, 630K rwdata, 1416K rodata, 1276K init, 243K bss, 12176K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 880MHz
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns
[    0.000012] sched_clock: 64 bits at 880MHz, resolution 1ns, wraps every 4398046511103ns
[    0.015857] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns
[    0.033811] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[    0.106130] pid_max: default: 32768 minimum: 301
[    0.115438] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.129843] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.148091] rcu: Hierarchical SRCU implementation.
[    0.157901] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.173478] smp: Bringing up secondary CPUs ...
[    0.183212] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.183223] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.183235] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.183306] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.243307] Synchronize counters for CPU 1: done.
[    0.305425] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.305434] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.305441] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.305485] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.364402] Synchronize counters for CPU 2: done.
[    0.424754] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.424763] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.424770] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.424820] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.483983] Synchronize counters for CPU 3: done.
[    0.543595] smp: Brought up 1 node, 4 CPUs
[    0.555854] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.575364] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[    0.589178] pinctrl core: initialized pinctrl subsystem
[    0.601910] NET: Registered protocol family 16
[    0.611816] thermal_sys: Registered thermal governor 'step_wise'
[    0.612927] cpuidle: using governor teo
[    0.638127] rt2880-pinmux pinctrl: there is not valid maps for state default
[    0.662241] FPU Affinity set after 11720 emulations
[    0.688794] clocksource: Switched to clocksource GIC
[    0.700479] NET: Registered protocol family 2
[    0.709455] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.724669] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.741318] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.756538] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.770450] TCP: Hash tables configured (established 1024 bind 1024)
[    0.783231] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.796122] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.810249] NET: Registered protocol family 1
[    0.818838] PCI: CLS 0 bytes, default 32
[    0.828915] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.845754] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.857289] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.877585] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.893949] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.905305] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.916558] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.928055] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.943156] printk: console [ttyS0] disabled
[    0.951721] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 19, base_baud = 3125000) is a 16550A
[    0.969706] printk: console [ttyS0] enabled
[    0.986201] printk: bootconsole [early0] disabled
[    1.008597] spi-mt7621 1e000b00.spi: sys_freq: 220000000
[    1.020825] spi-nor spi0.0: mx25l25635e (32768 Kbytes)
[    1.031196] 12 fixed-partitions partitions found on MTD device spi0.0
[    1.044036] Creating 12 MTD partitions on "spi0.0":
[    1.053754] 0x000000000000-0x000002000000 : "ALL"
[    1.064041] 0x000000000000-0x000000030000 : "Bootloader"
[    1.075516] 0x000000030000-0x000000040000 : "Config"
[    1.086273] 0x000000040000-0x000000050000 : "Factory"
[    1.097235] 0x000000050000-0x000001fb0000 : "kernel"
[    1.107995] 0x000000490000-0x000001fb0000 : "rootfs"
[    1.118762] mtd: setting mtd5 (rootfs) as root device
[    1.128954] mtdsplit: no squashfs found in "rootfs"
[    1.138704] 0x000001000000-0x000001fb0000 : "Kernel2"
[    1.149683] 0x000001440000-0x000001fb0000 : "RootFS2"
[    1.160649] 0x000001fb0000-0x000001fc0000 : "glbcfg"
[    1.171651] 0x000001fc0000-0x000001fd0000 : "board_data"
[    1.183101] 0x000001fd0000-0x000001fe0000 : "glbcfg2"
[    1.194192] 0x000001fe0000-0x000001ff0000 : "board_data2"
[    1.249918] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    1.265974] mtk_soc_eth 1e100000.ethernet: generated random MAC address 96:47:f6:5c:a5:e7
[    1.283023] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 20
[    1.299823] mtk_soc_eth 1e100000.ethernet: generated random MAC address 2e:d4:42:35:f5:e7
[    1.316826] mtk_soc_eth 1e100000.ethernet swp0: mediatek frame engine at 0xbe100000, irq 20
[    1.334747] i2c /dev entries driver
[    1.344017] mt7621-pci 1e140000.pcie: host bridge /pcie@1e140000 ranges:
[    1.357419] mt7621-pci 1e140000.pcie:   No bus range found for /pcie@1e140000, using [bus 00-ff]
[    1.374963] mt7621-pci 1e140000.pcie:      MEM 0x0060000000..0x006fffffff -> 0x0000000000
[    1.391261] mt7621-pci 1e140000.pcie:       IO 0x001e160000..0x001e16ffff -> 0x0000000000
[    1.407646] mt7621-pci 1e140000.pcie: Parsing DT failed
[    1.420172] NET: Registered protocol family 10
[    1.431010] Segment Routing with IPv6
[    1.438400] NET: Registered protocol family 17
[    1.447387] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.473572] 8021q: 802.1Q VLAN Support v1.8
[    1.485385] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    1.519086] mt7530 mdio-bus:1f swp1 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7530 PHY] (irq=25)
[    1.543048] mt7530 mdio-bus:1f: configuring for fixed/rgmii link mode
[    1.559920] DSA: tree 0 setup
[    1.566119] rt2880-pinmux pinctrl: pcie is already enabled
[    1.577151] mt7621-pci 1e140000.pcie: host bridge /pcie@1e140000 ranges:
[    1.590518] mt7621-pci 1e140000.pcie:   No bus range found for /pcie@1e140000, using [bus 00-ff]
[    1.608040] mt7621-pci 1e140000.pcie:      MEM 0x0060000000..0x006fffffff -> 0x0000000000
[    1.624348] mt7621-pci 1e140000.pcie:       IO 0x001e160000..0x001e16ffff -> 0x0000000000
[    1.640726] mt7621-pci-phy 1e149000.pcie-phy: PHY for 0xbe149000 (dual port = 1)
[    1.655797] mt7621-pci-phy 1e14a000.pcie-phy: PHY for 0xbe14a000 (dual port = 0)
[    1.670788] mt7621-pci 1e140000.pcie: failed to parse bus ranges property: -22
[    1.785412] mt7621-pci-phy 1e149000.pcie-phy: Xtal is 40MHz
[    1.796528] mt7621-pci-phy 1e14a000.pcie-phy: Xtal is 40MHz
[    1.907771] mt7621-pci 1e140000.pcie: pcie0 no card, disable it (RST & CLK)
[    1.921645] mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK)
[    1.935509] mt7621-pci 1e140000.pcie: PCIE1 enabled
[    1.945224] mt7621-pci 1e140000.pcie: PCI coherence region base: 0x60000000, mask/settings: 0xf0000002
[    1.963929] mt7621-pci 1e140000.pcie: PCI host bridge to bus 0000:00
[    1.976603] pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
[    1.990312] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    2.004004] pci_bus 0000:00: root bus resource [bus 00-ff]
[    2.014932] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff] (bus address [0x00000000-0x0fffffff])
[    2.035243] pci 0000:00:00.0: [0e8d:0801] type 01 class 0x060400
[    2.047221] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    2.059718] pci 0000:00:00.0: reg 0x14: [mem 0x60200000-0x6020ffff]
[    2.072261] pci 0000:00:00.0: supports D1
[    2.080245] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    2.093320] pci 0000:01:00.0: [14c3:7615] type 00 class 0x000280
[    2.105339] pci 0000:01:00.0: reg 0x10: initial BAR value 0x00000000 invalid
[    2.119395] pci 0000:01:00.0: reg 0x10: [mem size 0x00100000 64bit]
[    2.132042] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    2.163006] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    2.173436] pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
[    2.185580] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    2.199102] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref]
[    2.213494] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    2.226719] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    2.239910] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    2.253779] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    2.267299] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref]
[    2.281685] pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff]
[    2.295208] pci 0000:00:00.0: BAR 7: assigned [io  0x1e160000-0x1e160fff]
[    2.308759] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
[    2.323324] pci 0000:00:00.0: PCI bridge to [bus 01]
[    2.333212] pci 0000:00:00.0:   bridge window [io  0x1e160000-0x1e160fff]
[    2.346728] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    2.360254] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref]
[    2.376127] ubi0: attaching mtd5
[    2.389126] mt7530 mdio-bus:1f: Link is Up - 1Gbps/Full - flow control rx/tx
[    2.413675] ubi0: scanning is finished
[    2.433745] ubi0: attached mtd5 (name "rootfs", size 27 MiB)
[    2.445076] ubi0: PEB size: 65536 bytes (64 KiB), LEB size: 65408 bytes
[    2.458253] ubi0: min./max. I/O unit sizes: 1/256, sub-page size 1
[    2.470566] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[    2.483581] ubi0: good PEBs: 434, bad PEBs: 0, corrupted PEBs: 0
[    2.495542] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    2.509933] ubi0: max/mean erase counter: 3/1, WL threshold: 4096, image sequence number: 14579864
[    2.527770] ubi0: available PEBs: 0, total reserved PEBs: 434, PEBs reserved for bad PEB handling: 0
[    2.546005] ubi0: background thread "ubi_bgt0d" started, PID 458
[    2.546110] UBI: block: volume size is not a multiple of 512, last 384 bytes are ignored!
[    2.575404] block ubiblock0_0: created from ubi0:0(rootfs)
[    2.594136] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    2.612646] Freeing unused kernel memory: 1276K
[    2.621725] This architecture does not have kernel memory protection.
[    2.634578] Run /sbin/init as init process
[    2.642740]   with arguments:
[    2.642747]     /sbin/init
[    2.642752]   with environment:
[    2.642757]     HOME=/
[    2.642762]     TERM=linux
[    3.033094] init: Console is alive
[    3.040290] init: - watchdog -
[    3.656196] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.715054] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.739163] init: - preinit -
[    4.464068] random: jshn: uninitialized urandom read (4 bytes read)
[    4.586293] random: jshn: uninitialized urandom read (4 bytes read)
[    4.703241] random: jshn: uninitialized urandom read (4 bytes read)
[    5.006467] mtk_soc_eth 1e100000.ethernet swp0: PHY [mdio-bus:00] driver [MediaTek MT7530 PHY] (irq=POLL)
[    5.028387] mtk_soc_eth 1e100000.ethernet swp0: configuring for phy/rgmii link mode
[    7.222095] UBIFS (ubi0:1): default file-system created
[    7.233553] UBIFS (ubi0:1): Mounting in unauthenticated mode
[    7.245171] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 601
[    7.294079] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[    7.309733] UBIFS (ubi0:1): LEB size: 65408 bytes (63 KiB), min./max. I/O unit sizes: 8 bytes/256 bytes
[    7.328439] UBIFS (ubi0:1): FS size: 23219840 bytes (22 MiB, 355 LEBs), journal size 1177344 bytes (1 MiB, 18 LEBs)
[    7.349226] UBIFS (ubi0:1): reserved for root: 1096730 bytes (1071 KiB)
[    7.362398] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 3DF21DE7-170D-41A1-89DF-E71DFDA24016, small LPT model
[    7.387453] mount_root: overlay filesystem has not been fully initialized yet
[    7.403376] mount_root: switching to ubifs overlay
[    7.430339] urandom-seed: Seed file not found (/etc/urandom.seed)
[    7.529472] procd: - early -
[    7.535436] procd: - watchdog -
[    8.148958] procd: - watchdog -
[    8.155833] procd: - ubus -
[    8.214056] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.229067] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.246242] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.263655] procd: - init -
[    8.807639] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.016529] urngd: v1.0.2 started.
[    9.049727] Loading modules backported from Linux version v6.1-rc8-0-g76dcd734eca2
[    9.064876] Backport generated by backports.git v5.15.81-1-41-g02e352527db5
[    9.196213] random: crng init done
[    9.203142] random: 31 urandom warning(s) missed due to ratelimiting
[    9.246942] mt7621-pci 1e140000.pcie: bus=1 slot=0 irq=22
[    9.257828] pci 0000:00:00.0: enabling device (0006 -> 0007)
[    9.269136] mt7615e 0000:01:00.0: enabling device (0000 -> 0002)
[    9.293453] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[    9.293491] ieee80211 phy0: copying sband (band 1) due to VHT EXT NSS BW flag
[    9.298340] ieee80211 phy1: Selected rate control algorithm 'minstrel_ht'
[    9.298388] ieee80211 phy1: copying sband (band 1) due to VHT EXT NSS BW flag
[    9.310607] mt7615e 0000:01:00.0: HW/SW Version: 0x8a108a10, Build Time: 20180518100604a
[    9.537763] mt7615e 0000:01:00.0: N9 Firmware Version: _reserved_, Build Time: 20200814163649
[    9.626384] mt7615e 0000:01:00.0: CR4 Firmware Version: _reserved_, Build Time: 20190415154149
[   45.853230] mtk_soc_eth 1e100000.ethernet swp0: PHY [mdio-bus:00] driver [MediaTek MT7530 PHY] (irq=POLL)
[   45.876734] mtk_soc_eth 1e100000.ethernet swp0: configuring for phy/rgmii link mode
[   45.894227] br-lan: port 1(swp0) entered blocking state
[   45.904918] br-lan: port 1(swp0) entered disabled state
[   45.915957] device swp0 entered promiscuous mode
[   45.947315] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode
[   45.963903] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
[   45.971760] device eth0 entered promiscuous mode
[   45.990567] mt7530 mdio-bus:1f swp1: configuring for phy/gmii link mode
[   46.004373] 8021q: adding VLAN 0 to HW filter on device swp1
[   46.018836] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   46.032343] br-lan: port 2(swp1) entered blocking state
[   46.043215] br-lan: port 2(swp1) entered disabled state
[   46.054796] device swp1 entered promiscuous mode
[   47.989099] mtk_soc_eth 1e100000.ethernet swp0: Link is Up - 100Mbps/Full - flow control rx/tx
[   48.006355] br-lan: port 1(swp0) entered blocking state
[   48.016982] br-lan: port 1(swp0) entered forwarding state
[   48.028215] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

csharper2005 · February 26, 2023, 6:30pm

Great. I'll make the PR and let you know know when the image is ready for the test.

csharper2005 · February 26, 2023, 8:25pm

@Goossens here is the test build - https://mega.nz/file/Yxhg0LRY#NKbU21kwSIBrD5wtGENCg2hZUjQ4b0Ibo4OhlY0iZ0Q

Please, leave feedback after the test.

Goossens · February 26, 2023, 11:22pm

With this image both radios are indeed recognized and work as expected!

csharper2005 · February 27, 2023, 3:44am

Good news. Now we should wait until one of the OpenWrt team members merge the pull request with the master branch.

xenon205 · May 18, 2023, 7:44am

Mega expired.
can anyone sned me working openwrt firmware for this device ?
siejeje205@gmail.com

Harm · May 18, 2023, 12:00pm

You can find the latest build at https://downloads.openwrt.org/snapshots/targets/ramips/mt7621/