@kirschjoghurt Thanks for the steps! I followed them and worked perfectly!
1 Like
Could you share your image with luci please
Not sure anybody is working on that.
Needs volunteers.
I can provide a stock firmware image, if anybody wants to go exploit hunting.
People that know how to do this can be found at https://github.com/acecilia/OpenWRTInvasion
1 Like
I can share my experience with RA75 - obtaining of a factory image without SPI programmer and desoldering the Flash chip, just using the serial console (USB-UART). The process is similar to the OpenWRT flashing described above, read that instruction carefully for details. I will describe mostly the difference.
- Open the case, solder the UART header, connect the USB-UART, open the terminal with 115200 8N1 on PC, connect the RA75 and the PC with Ethernet cable, set static IP 192.168.31.100 on PC.
- Set up a TFTP server on PC, enable the write access in its settings, put the OpenWRT firmware snapshot to the server's root.
- Power on the router and watch the terminal output. When the U-Boot menu "select 1,2,3 or 9" appears, select 1 (not 2!).
- Select/confirm the device and server IP and the file name of the firmware you put on TFTP server.
- After entering of the filename it will be loaded by TFTP to RAM, not to flash, and will start.
- Wait for the line "Press the [f] key and hit [enter] to enter failsafe mode" and press 'f' and then 'Enter'. You will get "ARE U OK" banner and the emergency root shell.
- Use following commands to download the original firmware and configuration images:
ifconfig eth0 192.168.31.1
dd bs=64k if=/dev/mtdblock0 of=/tmp/mtd0.bin
tftp -p -l /tmp/mtd0.bin -r mtd0.bin 192.168.31.100
... (repeat for mtd1-mtd5)
dd bs=64k if=/dev/mtdblock6 of=/tmp/mtd6.bin
tftp -p -l /tmp/mtd6.bin -r mtd6.bin 192.168.31.100
At this point you will have 7 files of size 128k,64k,64k,64k,64k,1M,15M in your server root on PC. To get the full 16M flash image, just concat them together. If you get 'timeout' errors, check IP addresses and netmasks. If you have 'access denied' errors, check TFTP server settings - it must allow writing to its root.
Now to flash OpenWRT you can reboot the router and repeat the instruction, but press '2' in U-Boot bootloader menu. It will write the firmware to flash.
To revert the device to the original firmware - use the same instruction for flashing via U-Boot, but flash the mtd6.bin file from backup.
Possibly I will try to experiment a little with the original firmware.
@jdeisenh, could you please give me a hint, how to enable the full console on the stock firmware? When I boot OpenWRT, the serial console is r/w, I can execute commands there. But when booting stock, it is r/o, just dumps the kernel log, but ignores my keyboard input.
@jdeisenh , and thank you very much for your RA75 patch. I have a RA75 device now, also I have a stock firmware and I'll try to investigate it further.
Also, there's a question about LEDs. Your patch suggests that both System and Signal leds are blue+amber. System is OK (GPIO 0 and 2). But my board has red+green+blue signal leds soldered, stock boot log says about GPIO 37,44 and 46 (unaware on color-gpio correspondence, I'm building the image with changed dts right now, will update here on results).
So, does it mean that there are different versions of RA75?
P.S. I was wrong, signal leds are red+amber+blue. I've added a block to dts similar to other ones (sorry for name, I thought it is green):
led_signal_green: signal_green {
label = "green:signal";
gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
};
The led green:signal appeared in the selection in luci's leds config, but it doesn't light anything. Blue and amber work well, so the red must be on GPIO46. It works in the stock FW. Why 46? Because of these logs from stock FW (it blinks red when unconfigured):
[ 41.180000] led=2, on=1, off=4000, blinks,=1, reset=1, time=4000
[ 41.210000] led=0, on=1, off=4000, blinks,=1, reset=1, time=4000
[ 41.210000] led=2, on=1, off=4000, blinks,=1, reset=1, time=4000
[ 41.240000] led=0, on=4000, off=1, blinks,=1, reset=1, time=4000
/etc/rc.d/S99boot_check: <btnd> main(),L146:
/etc/rc.d/S99boot_check: <btnd> hook_gpio(),L47: <btnd> main(),L146:
Tue Oct 26 19:39:46 CST 2021 boot_check[2525]: Booting up finished.
[ 42.790000] led=37, on=1, off=4000, blinks,=1, reset=1, time=1
[ 42.810000] led=44, on=1, off=4000, blinks,=1, reset=1, time=1
[ 42.830000] led=46, on=1, off=4000, blinks,=1, reset=1, time=1
[ 42.860000] led=46, on=10, off=10, blinks,=4000, reset=1, time=4000
So, could you please check if I missed something? I am not a kernel professional dev, maybe that gpio 46 should be enabled somewhere else to work?
OK, answering my own question. The gpio pin 46 is shared with uart1. To use it as gpio, the following change is needed in target/linux/ramips/dts/mt7628an_xiaomi_mi-router-4.dtsi :
&state_default {
gpio {
groups = "gpio", "refclk", "wdt", "wled_an", "uart1";
function = "gpio";
};
};
After this change, I have red:signal LED controllable via /sys/class/led and LuCI. Will try to prepare a proper patch.
2 Likes
I have 1 repeater that is still stock, but when I remember right, it has no WebUI. The exploit used a command injection to upload the exploit package and activate root/telnet/ssh.
If you have the image on a shared hoster, I would love to get it and look over it and scan my repeater for open ports. At least it saves me time to extract it 
1 Like
This is the stock firmware for the EU version of the RA75:
https://drive.google.com/drive/folders/1M8ZhfuCheFa84KkLpWgI5WB7e-fbiC16?usp=share_link
If anybody can built a flashable stock firmware from the raw image, this would also help
Don't know, sorry.
But have a look here:
stock firmware boots with uart_en=0, the setenv/saveenv method described above could work
hello, could anyone share the images withluci preinstalled?
today, i see in software update and it need kernel 5.15.110 to install that software update but i find in homepage nothing change n the latest kernel i found in there be 5.15.109 so how i install the update
If you want a new kernel, do a sysupgrade to a new image. opkg cannot upgrade your kernel.
Hi guys. I'm trying to install the firmware linked in the Techdata ** openwrt-ramips-mt76x8-xiaomi_mi-ra75-squashfs-sysupgrade.bin** but there seems to be a chucksum problem. some idea?
here the log
U-Boot 1.1.3 (Apr 30 2021 - 09:18:19)
Board: Ralink APSoC DRAM: 64 MB
Power on memory test. Memory size= 64 MB...OK!
relocate_code Pointer at: 83fb0000
RT2880_RSTSTAT_REG 0xc0030204
******************************
Software System Reset Occurred
******************************
SPI-NOR flash has JEDEC ID: ef4018
Status Register 1 = 0x00
Status Register 3 = 0x68
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
env is right!
============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 30 2021 Time:09:18:19
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 575 MHZ ####
estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
You choosed 2
0
2: System Load Linux Kernel then write to Flash via TFTP.
Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
Please Input new ones /or Ctrl-C to discard
Input device IP (192.168.31.1) ==:192.168.31.1
Input server IP (192.168.31.100) ==:192.168.31.100
Input Linux Kernel filename (kernel.bin) ==:openwrt-ramips-mt76x8-xiaomi_mi-ra75-squashfs -sysupgrade.bin
netboot_common, argc= 3
NetTxPacket = 0x83FE6C40
KSEG1ADDR(NetTxPacket) = 0xA3FE6C40
NetLoop,call eth_halt !
NetLoop,call eth_init !
Trying Eth0 (10/100-M)
Waitting for RX_DMA_BUSY status Start... done
ETH_STATE_ACTIVE!!
TFTP from server 192.168.31.100; our IP address is 192.168.31.1
Filename 'openwrt-ramips-mt76x8-xiaomi_mi-ra75-squashfs-sysupgrade.bin'.
TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (b4:2e:99:84:37:85)
Got it
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
####################################
done
Bytes transferred = 5505842 (540332 hex)
NetBootFileXferSize= 00540332
Writing OS1 to 0x160000
raspi_erase_write: offs:160000, count:540332
raspi_erase: offs:160000 len:540000
....................................................................................
....................................................................................
raspi_erase: offs:6a0000 len:10000
.
.
Done!
Erasing SPI Flash...
raspi_erase: offs:20000 len:10000
.
Writing to SPI Flash...
.
done
##Booting System 2
Erasing SPI Flash...
raspi_erase: offs:20000 len:10000
.
Writing to SPI Flash...
.
done
## Booting image at bc8a0000 ...
Image Name: MIPS OpenWrt Linux-3.10.14
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1263216 Bytes = 1.2 MB
Load Address: 80000000
Entry Point: 80000000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Erasing SPI Flash...
raspi_erase: offs:20000 len:10000
.
Writing to SPI Flash...
.
done
commandline uart_en=0 factory_mode=0 mem=64m root=/dev/mtdblock9
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64
Starting kernel ...
LINUX started...
THIS IS ASIC
[ 0.000000] Linux version 3.10.14 (jenkins@70c8fd09c123) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 unknown) ) #0 Thu Jun 10 01:56:47 2021
[ 0.000000]
[ 0.000000] The CPU feqenuce set to 575 MHz
[ 0.000000]
[ 0.000000] MIPS CPU sleep mode enabled.
[ 0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[ 0.000000] Software DMA cache coherency
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 04000000 @ 00000000 (usable)
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 04000000 @ 00000000 (usable)
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x03ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x03ffffff]
[ 0.000000] Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
[ 0.000000] Kernel command line: console=ttyS1,115200n8 uart_en=0 factory_mode=0 mem=64m root=/dev/mtdblock9
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Writing ErrCtl register=0007b730
[ 0.000000] Readback ErrCtl register=0007b730
[ 0.000000] Memory: 61084k/65536k available (2871k kernel code, 4452k reserved, 659k data, 180k init, 0k highmem)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:128
[ 0.000000] console [ttyS1] enabled
[ 0.110000] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[ 0.170000] pid_max: default: 32768 minimum: 301
[ 0.170000] Mount-cache hash table entries: 512
[ 0.180000] NET: Registered protocol family 16
[ 0.180000] RALINK_GPIOMODE = 54054444
[ 0.190000] RALINK_GPIOMODE = 54044444
[ 0.290000] ***** Xtal 40MHz *****
[ 0.290000] start PCIe register access
[ 0.790000] RALINK_RSTCTRL = 2400000
[ 0.800000] RALINK_CLKCFG1 = fdbfffc0
[ 0.800000]
[ 0.800000] *************** MT7628 PCIe RC mode *************
[ 1.300000] PCIE0 enabled
[ 1.310000] Port 0 N_FTS = 1b105000
[ 1.310000] init_rt2880pci done
[ 1.330000] bio: create slab <bio-0> at 0
[ 1.340000] PCI host bridge to bus 0000:00
[ 1.340000] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[ 1.350000] pci_bus 0000:00: root bus resource [io 0x10160000-0x1016ffff]
[ 1.350000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 1.360000] pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
[ 1.360000] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[ 1.370000] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[ 1.370000] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[ 1.380000] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[ 1.380000] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[ 1.390000] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 1.390000] pci 0000:00:00.0: bridge window [mem 0x20000000-0x200fffff]
[ 1.400000] pci 0000:00:00.0: bridge window [mem 0x20100000-0x201fffff pref]
[ 1.400000] BAR0 at slot 0 = 0
[ 1.410000] bus=0x0, slot = 0x0
[ 1.410000] res[0]->start = 0
[ 1.410000] res[0]->end = 0
[ 1.410000] res[1]->start = 20200000
[ 1.420000] res[1]->end = 2020ffff
[ 1.420000] res[2]->start = 0
[ 1.420000] res[2]->end = 0
[ 1.420000] res[3]->start = 0
[ 1.430000] res[3]->end = 0
[ 1.430000] res[4]->start = 0
[ 1.430000] res[4]->end = 0
[ 1.430000] res[5]->start = 0
[ 1.440000] res[5]->end = 0
[ 1.440000] bus=0x1, slot = 0x0
[ 1.440000] res[0]->start = 20000000
[ 1.440000] res[0]->end = 200fffff
[ 1.450000] res[1]->start = 0
[ 1.450000] res[1]->end = 0
[ 1.450000] res[2]->start = 0
[ 1.450000] res[2]->end = 0
[ 1.460000] res[3]->start = 0
[ 1.460000] res[3]->end = 0
[ 1.460000] res[4]->start = 0
[ 1.460000] res[4]->end = 0
[ 1.470000] res[5]->start = 0
[ 1.470000] res[5]->end = 0
[ 1.470000] cfg80211: Calling CRDA to update world regulatory domain
[ 1.480000] Switching to clocksource Ralink Systick timer
[ 1.480000] NET: Registered protocol family 2
[ 1.490000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[ 1.490000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[ 1.500000] TCP: Hash tables configured (established 512 bind 512)
[ 1.500000] TCP: reno registered
[ 1.510000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 1.510000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 1.520000] NET: Registered protocol family 1
[ 1.540000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 1.550000] jffs2: version 2.2. (ZLIB) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 1.560000] msgmni has been set to 119
[ 1.560000] io scheduler noop registered
[ 1.570000] io scheduler deadline registered (default)
[ 1.570000] MIWIFI panic notifier registered
[ 1.580000] pcieport 0000:00:00.0: device [14c3:0801] has invalid IRQ; check vendor BIOS
[ 1.590000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 1.600000] serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
[ 1.600000] serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
[ 1.610000] led=2, on=4000, off=1, blinks,=1, reset=1, time=4000
[ 1.620000] Ralink gpio driver initialized
[ 1.620000] flash manufacture id: ef, device id 40 18
[ 1.630000] W25Q128BV(ef 40180000) (16384 Kbytes)
[ 1.630000] mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
[ 1.640000] Creating 9 MTD partitions on "raspi":
[ 1.650000] 0x000000000000-0x000001000000 : "ALL"
[ 1.650000] 0x000000000000-0x000000020000 : "Bootloader"
[ 1.660000] 0x000000020000-0x000000030000 : "Config"
[ 1.670000] 0x000000030000-0x000000040000 : "Factory"
[ 1.670000] 0x000000040000-0x000000050000 : "crash"
[ 1.680000] 0x000000050000-0x000000060000 : "cfg_bak"
[ 1.690000] 0x000000060000-0x000000160000 : "overlay"
[ 1.690000] 0x000000160000-0x0000008a0000 : "OS1"
[ 1.700000] 0x0000008a0000-0x000000fe0000 : "OS2"
[ 1.710000] mtd: try split OS2 partition
[ 1.710000] mtd: split_firmware
[ 1.710000] mtd: firmware_partition->size 0x740000
[ 1.720000] mtd: firmware_partition->offset 0x8a0000
[ 1.720000] mtd: uimage_len 1263280
[ 1.730000] mtd: uimage_len 1310720
[ 1.730000] mtd: rootfs_partition->size 0x600000
[ 1.740000] mtd: rootfs_partition->offset 0x9e0000
[ 1.740000] mtd: partition "rootfs" created automatically, ofs=9E0000, len=600000
[ 1.750000] 0x0000009e0000-0x000000fe0000 : "rootfs"
[ 1.750000] PPP generic driver version 2.4.2
[ 1.760000] PPP MPPE Compression module registered
[ 1.760000] NET: Registered protocol family 24
[ 1.770000] GMAC1_MAC_ADRH -- : 0x00003ccd
[ 1.770000] GMAC1_MAC_ADRL -- : 0x5714f1ef
[ 1.780000] Ralink APSoC Ethernet Driver Initilization. v3.1 256 rx/tx descriptors allocated, mtu = 1500!
[ 1.790000] GMAC1_MAC_ADRH -- : 0x00003ccd
[ 1.790000] GMAC1_MAC_ADRL -- : 0x5714f1ef
[ 1.800000] PROC INIT OK!
[ 1.800000] Ralink APSoC Hardware Watchdog Timer
[ 1.800000] TCP: cubic registered
[ 1.810000] NET: Registered protocol family 10
[ 1.820000] NET: Registered protocol family 17
[ 1.820000] 8021q: 802.1Q VLAN Support v1.8
[ 1.840000] **** dump comp_opts cpue, flags=0x90014, bit_opts 90, fb 40, dictionary_size 40000
[ 1.850000] squashfs_xz_init-73, dict_size 262144, dictionary size 262144 , len 12, size 12
[ 1.860000] squashfs_xz_init-83, size 40000 vs 40000
[ 1.860000] squashfs_xz_init-87, dict_size 262144. n 18
[ 1.870000] VFS: Mounted root (squashfs filesystem) readonly on device 31:9.
[ 1.880000] Freeing unused kernel memory: 180K (80373000 - 803a0000)
[ 3.100000] init: Console is alive
[ 4.290000] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 4.350000] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 4.370000] init: - preinit -
/etc/preinit: line 1: swconfig: not found
/etc/preinit: line 1: swconfig: not found
/etc/preinit: line 1: swconfig: not found
[ 4.670000] Raeth v3.1 (Tasklet,SkbRecycle)
[ 4.670000]
[ 4.670000] phy_tx_ring = 0x03f4e000, tx_ring = 0xa3f4e000
[ 4.680000]
[ 4.680000] phy_rx_ring0 = 0x03f4f000, rx_ring0 = 0xa3f4f000
[ 4.700000] config 7628 esw as LLLLW
[ 4.780000] GMAC1_MAC_ADRH -- : 0x00003ccd
[ 4.780000] GMAC1_MAC_ADRL -- : 0x5714f1ef
[ 4.790000] Link Status Changed: Port 6 linked Up.
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 7.830000] Link Status Changed: Port 0 linked Up.
Unlocking overlay ...
Erasing overlay ...
Unlocking cfg_bak ...
Erasing cfg_bak ...
start nvram clear.....
nvram clear...Done!
/etc/preinit: line 1: arithmetic syntax error
[ 12.940000] mount_root: mounting /dev/root
overlay_head ffffffff
[ 13.280000] urandom-seed: Seed file not found (/etc/urandom.seed)
-----------------------------do_data_mount_fail_recover
1+0 records in
1+0 records out
4 bytes (4B) copied, 0.009240 seconds, 432B/s
[ 16.130000] ra2880stop()...Done
[ 16.130000] Free TX/RX Ring Memory!
[ 16.140000] procd: - early -
[ 16.770000] procd: - ubus -
[ 16.840000] procd: - init -
Please press Enter to activate this console.
/etc/rc.d/S00sysfixtime: Thu Jun 10 02:34:24 UTC 2021
[ 18.480000] kmodloader: loading kernel modules from /etc/modules.d/*
[ 18.490000] l2tp_core: L2TP core driver, V2.0
[ 18.500000] l2tp_netlink: L2TP netlink interface
[ 19.270000]
[ 19.270000]
[ 19.270000] === pAd = c051f000, size = 1758600 ===
[ 19.270000]
[ 19.280000] <-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
[ 19.280000] <-- RTMPAllocAdapterBlock, Status=0
[ 19.290000] RtmpChipOpsHook(492): Not support for HIF_MT yet!
[ 19.300000] mt7628_init()-->
[ 19.300000] mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
[ 19.300000] e2.bin mt7628_init(1117)::(2), pChipCap->fw_len(63984)
[ 19.310000] mt_bcn_buf_init(218): Not support for HIF_MT yet!
[ 19.320000] <--mt7628_init()
[ 20.140000] <-- RTMPAllocTxRxRingMemory, Status=0
[ 20.160000] <-- RTMPAllocAdapterBlock, Status=0
[ 20.160000] pAd->CSRBaseAddress =0xc0a80000, csr_addr=0xc0a80000!
[ 20.170000] <dbg> MAC_CSR0=1986146304, RtmpChipOpsHook
[ 20.180000] <dbg> dev idx = 1!
[ 20.180000] <dbg> get_dev_config_idx pAd->MACVersion = 76623000, pAd->ChipID = 76120044
[ 20.220000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 20.230000] Type=Linux
[ 20.250000] nf_conntrack version 0.5.0 (957 buckets, 3828 max)
[ 20.320000] xt_time: kernel timezone is -0000
[ 20.330000] kmodloader: done loading kernel modules from /etc/modules.d/*
/etc/rc.d/S10boot: WARNING: Wifi detect is deprecated. Use wifi config instead
/etc/rc.d/S10boot: For more information, see commit 5f8f8a366136a07df661e31decce2458357c167a
[ 23.080000] led=2, on=1, off=4000, blinks,=1, reset=1, time=1
[ 23.090000] led=0, on=1, off=4000, blinks,=1, reset=1, time=1
[ 23.100000] led=2, on=4000, off=1, blinks,=1, reset=1, time=1
/etc/rc.d/S19dnsmasq: cp: can't stat '/etc/dnsmasq.d/*': No such file or directory
/etc/rc.d/S19dnsmasq: sh: out of range
/etc/rc.d/S19dnsmasq: sh: out of range
/etc/rc.d/S19dnsmasq: sed: /var/etc/dnsmasq.conf.cfg01411c: No such file or directory
/etc/rc.d/S19dnsmasq: sed: /var/etc/dnsmasq.conf.cfg01411c: No such file or directory
/etc/rc.d/S20network: Set: phy[0].reg[0] = 3300
/etc/rc.d/S20network: Set: phy[1].reg[0] = 3300
/etc/rc.d/S20network: Set: phy[2].reg[0] = 3300
/etc/rc.d/S20network: Set: phy[3].reg[0] = 3300
/etc/rc.d/S20network: Set: phy[4].reg[0] = 3300
/etc/rc.d/S20network: uci: Entry not found
/etc/rc.d/S20network: sh: out of range
/etc/rc.d/S20network: uci: Invalid argument
/etc/rc.d/S20network: uci: Invalid argument
/etc/rc.d/S21nginx: start fcgi-cgi by spawn-fcgi.
/etc/rc.d/S21nginx: start nginx ok.
[ 26.700000] TX_BCN DESC a2c29000 size = 320
[ 26.700000] RX[0] DESC a2c2b000 size = 2048
[ 26.710000] RX[1] DESC a2c2e000 size = 1024
[ 26.730000] ERROR!!! RTMPReadParametersHook failed, Status[=0x00000001]
[ 26.770000] IPv6: ADDRCONF(NETDEV_UP): wl1: link is not ready
/etc/init.d/network: ifconfig: SIOCGIFFLAGS: No such device
[ 27.210000] Raeth v3.1 (Tasklet,SkbRecycle)
[ 27.210000]
[ 27.210000] phy_tx_ring = 0x02287000, tx_ring = 0xa2287000
[ 27.220000]
[ 27.220000] phy_rx_ring0 = 0x0227d000, rx_ring0 = 0xa227d000
[ 27.240000] config 7628 esw as LLLLW
[ 27.320000] GMAC1_MAC_ADRH -- : 0x00003ccd
[ 27.320000] GMAC1_MAC_ADRL -- : 0x5714f1ef
[ 27.320000] Link Status Changed: Port 0 linked Down.
[ 27.350000] device eth0.1 entered promiscuous mode
[ 27.350000] device eth0 entered promiscuous mode
[ 27.390000] br-lan2: port 1(eth0.1) entered forwarding state
[ 27.390000] br-lan2: port 1(eth0.1) entered forwarding state
[ 27.430000] <dbg> MAC_CSR0=1986146304, rtmp_asic_top_init
[ 27.610000] UserCfgInit set RDMode = RD_SILENCE_MODE
[ 27.680000] mt7612_set_ed_cca on
[ 28.130000] mt7612_set_ed_cca on
[ 29.390000] br-lan2: port 1(eth0.1) entered forwarding state
[ 29.980000] mt7612_set_ed_cca on
[ 29.990000] <==== rt28xx_init, Status=0
[ 30.220000] device wl0 entered promiscuous mode
[ 30.220000] br-lan2: port 2(wl0) entered forwarding state
[ 30.230000] br-lan2: port 2(wl0) entered forwarding state
[ 30.290000] device apclii0 entered promiscuous mode
[ 30.290000] br-lan2: port 3(apclii0) entered forwarding state
[ 30.300000] br-lan2: port 3(apclii0) entered forwarding state
/etc/init.d/network: ifconfig: SIOCGIFFLAGS: No such device
[ 30.360000] Link Status Changed: Port 0 linked Up.
[ 30.680000] TX_BCN DESC a2c29000 size = 320
[ 30.680000] RX[0] DESC a2c2b000 size = 2048
[ 30.690000] RX[1] DESC a2c2e000 size = 1024
/etc/init.d/network: ifconfig: SIOCGIFFLAGS: No such device
[ 30.760000] E2pAccessMode=2
[ 30.770000] cfg_mode=9
[ 30.770000] cfg_mode=9
[ 30.770000] wmode_band_equal(): Band Equal!
[ 30.850000] load fw image from fw_header_image
[ 30.860000] AndesMTLoadFwMethod1(2183)::pChipCap->fw_len(63984)
[ 30.860000] CmdAddressLenReq:(ret = 0)
[ 30.870000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.870000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.880000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.880000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.890000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.890000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.900000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.900000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.910000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.910000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.920000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.920000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.930000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.930000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.940000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.940000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 30.950000] CmdFwStartReq: override = 1, address = 1048576
[ 30.950000] CmdStartDLRsp: WiFI FW Download Success
[ 31.040000] MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
[ 31.040000] efuse_probe: efuse = 10000002
[ 31.050000] RtmpChipOpsEepromHook::e2p_type=2, inf_Type=4
[ 31.050000] RtmpEepromGetDefault::e2p_dafault=2
[ 31.060000] RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
[ 31.060000] NVM is FLASH mode
[ 31.070000] 1. Phy Mode = 14
[ 31.320000] Country Region from e2p = ffff
[ 31.320000] tssi_1_target_pwr_g_band = 34
[ 31.320000] 2. Phy Mode = 14
[ 31.330000] 3. Phy Mode = 14
[ 31.330000] NICInitPwrPinCfg(11): Not support for HIF_MT yet!
[ 31.340000] NICInitializeAsic(652): Not support rtmp_mac_sys_reset () for HIF_MT yet!
[ 31.340000] mt_mac_init()-->
[ 31.350000] MtAsicInitMac()-->
[ 31.460000] mt7628_init_mac_cr()-->
[ 31.460000] MtAsicSetMacMaxLen(1279): Set the Max RxPktLen=1024!
[ 31.470000] <--mt_mac_init()
[ 31.470000] WTBL Segment 1 info:
[ 31.470000] MemBaseAddr/FID:0x28000/0
[ 31.480000] EntrySize/Cnt:32/128
[ 31.480000] WTBL Segment 2 info:
[ 31.480000] MemBaseAddr/FID:0x40000/0
[ 31.490000] EntrySize/Cnt:64/128
[ 31.490000] WTBL Segment 3 info:
[ 31.490000] MemBaseAddr/FID:0x42000/64
[ 31.500000] EntrySize/Cnt:64/128
[ 31.500000] WTBL Segment 4 info:
[ 31.500000] MemBaseAddr/FID:0x44000/128
[ 31.510000] EntrySize/Cnt:32/128
[ 31.510000] AntCfgInit(2918): Not support for HIF_MT yet!
[ 31.520000] MCS Set = ff ff 00 00 01
[ 31.520000] MtAsicSetChBusyStat(846): Not support for HIF_MT yet!
/etc/rc.d/S49messagingagent.sh: start messagingagent ok.
[ 32.230000] br-lan2: port 2(wl0) entered forwarding state
[ 32.300000] br-lan2: port 3(apclii0) entered forwarding state
[ 35.290000] MtAsicSetRalinkBurstMode(2971): Not support for HIF_MT yet!
[ 35.290000] MtAsicSetPiggyBack(783): Not support for HIF_MT yet!
[ 35.330000] MtAsicSetTxPreamble(2950): Not support for HIF_MT yet!
[ 35.330000] MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
[ 35.340000] Main bssid = 3c:cd:57:ac:d6:05
[ 35.340000] <==== rt28xx_init, Status=0
[ 35.350000] CmdSlotTimeSet start
[ 35.360000] !!!mt7628_xq_board=RA75!!!
[ 35.360000] br-lan2: port 2(wl0) entered disabled state
[ 35.370000] device wl1 entered promiscuous mode
[ 35.410000] br-lan1: port 1(wl1) entered forwarding state
[ 35.410000] br-lan1: port 1(wl1) entered forwarding state
[ 35.430000] CmdSlotTimeSet end
[ 35.450000] ##### mbss_cr_enable, BssId = 1
[ 35.560000] device wl2 entered promiscuous mode
[ 35.560000] br-miot: port 1(wl2) entered forwarding state
[ 35.570000] br-miot: port 1(wl2) entered forwarding state
[ 35.640000] device apcli0 entered promiscuous mode
[ 35.650000] br-lan1: port 2(apcli0) entered forwarding state
[ 35.660000] br-lan1: port 2(apcli0) entered forwarding state
[ 37.410000] br-lan1: port 1(wl1) entered forwarding state
[ 37.570000] br-miot: port 1(wl2) entered forwarding state
/etc/init.d/network: Command failed: Not found
[ 37.660000] br-lan1: port 2(apcli0) entered forwarding state
Thu Jun 10 10:34:44 CST 2021 boot_check[1581]: INFO: Wireless OK
/etc/init.d/network: Command failed: Not found
[ 38.510000] br-miot: port 1(wl2) entered disabled state
/etc/rc.d/S60iweventd: iwevent-call start ok
[ 41.270000] led=2, on=1, off=4000, blinks,=1, reset=1, time=4000
[ 41.270000] led=0, on=1, off=4000, blinks,=1, reset=1, time=4000
[ 41.300000] led=2, on=1, off=4000, blinks,=1, reset=1, time=4000
[ 41.330000] led=0, on=4000, off=1, blinks,=1, reset=1, time=4000
/etc/rc.d/S99boot_check: <btnd> main(),L146:
/etc/rc.d/S99boot_check: <btnd> hook_gpio(),L47: <btnd> main(),L146:
Thu Jun 10 10:34:48 CST 2021 boot_check[2549]: Booting up finished.
[ 42.530000] led=37, on=1, off=4000, blinks,=1, reset=1, time=1
[ 42.540000] led=44, on=1, off=4000, blinks,=1, reset=1, time=1
[ 42.550000] led=46, on=1, off=4000, blinks,=1, reset=1, time=1
[ 42.570000] led=46, on=10, off=10, blinks,=4000, reset=1, time=4000
[ 99.540000] wifi_auth1 MAC fc-e2-6c-0b-e***
[ 99.550000] wifi_log: [Class 1 - RECV AUTH] - if="wl1", sta_mac="fc:e2:6c***", bssid="3c:cd:57:ac:d***5", action="recv-auth", rssi="-56", status="0"
[ 99.560000] wifi_log: [Class 1 - SEND AUTH_RSP] - if="wl1", sta_mac="fc:e2:6c:0", bssid="3c:cd:57:ac:d6:05", action="mlme-auth", info="send auth resp(Success)", status="0"
[ 99.590000] wifi_log: [Class 2 - RECV ASSOC] - if="wl1", sta_mac="fc:e2:6c:***", bssid="3c:cd:57:ac:d6:05", action="recv-assoc", rssi="-55", Aid="1"
[ 99.600000] wifi_assoc MAC fc-e2-6c-0***, RSSI -55 StatusCode 0
[ 99.610000] wifi_log: [Class 2 - SEND ASSOC RSP] - if="wl1", sta_mac="fc:e2:6c:0***", bssid="3c:cd:57***", action="mlme-assoc", status="0", Aid="1"
[ 99.620000] Rcv Wcid(1) AddBAReq
[ 99.630000] Start Seq = 00000000
[ 99.630000] Rcv Wcid(1) AddBAReq
[ 99.630000] Start Seq = 00000000
I also set uart_en & ssh_en to 1 and I get:
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
f
- failsafe -
/etc/preinit: line 1: dropbearkey: not found
/etc/preinit: line 1: dropbear: not found
BusyBox v1.25.1 (2021-06-10 02:21:20 UTC) built-in shell (ash)
ash: can't access tty; job control turned off
-----------------------------------------------------
Welcome to XiaoQiang!
-----------------------------------------------------
$$$$$$\ $$$$$$$\ $$$$$$$$\ $$\ $$\ $$$$$$\ $$\ $$\
$$ __$$\ $$ __$$\ $$ _____| $$ | $$ | $$ __$$\ $$ | $$ |
$$ / $$ |$$ | $$ |$$ | $$ | $$ | $$ / $$ |$$ |$$ /
$$$$$$$$ |$$$$$$$ |$$$$$\ $$ | $$ | $$ | $$ |$$$$$ /
$$ __$$ |$$ __$$< $$ __| $$ | $$ | $$ | $$ |$$ $$<
$$ | $$ |$$ | $$ |$$ | $$ | $$ | $$ | $$ |$$ |\$$\
$$ | $$ |$$ | $$ |$$$$$$$$\ $$$$$$$$$ | $$$$$$ |$$ | \$$\
\__| \__|\__| \__|\________| \_________/ \______/ \__| \__|
================= FAILSAFE MODE active ================
special commands:
* firstboot reset settings to factory defaults
* mount_root mount root-partition with config files
after mount_root:
* passwd change root's password
* /etc/config directory with config files
for more help see:
https://openwrt.org/docs/guide-user/troubleshooting/
- failsafe_and_factory_reset
- root_password_reset
=======================================================
Hi there, I can't install luci
got error
BusyBox v1.36.0 (2023-01-14 18:25:06 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt SNAPSHOT, r21847-4a444e576f
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~# opkg update
Downloading https://downloads.openwrt.org/snapshots/targets/ramips/mt76x8/packag es/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_core
Downloading https://downloads.openwrt.org/snapshots/targets/ramips/mt76x8/packag es/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/Pa ckages.gz
Updated list of available packages in /var/opkg-lists/openwrt_base
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/Pa ckages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/luci/Pa ckages.gz
Updated list of available packages in /var/opkg-lists/openwrt_luci
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/luci/Pa ckages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/package s/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_packages
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/package s/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/routing/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_routing
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/routing/Packages.sig
Signature check passed.
root@OpenWrt:~# opkg install luci
Multiple packages (libgcc1 and libgcc1) providing same name marked HOLD or PREFER. Using latest.
Multiple packages (libgcc1 and libgcc1) providing same name marked HOLD or PREFER. Using latest.
Multiple packages (libpthread and libpthread) providing same name marked HOLD or PREFER. Using latest.
Installing luci (git-23.051.66410-a505bb1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/luci/luci_git-23.051.66410-a505bb1_all.ipk
Installing luci-proto-ipv6 (git-21.148.48881-79947af) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/luci/luci-proto-ipv6_git-21.148.48881-79947af_all.ipk
Installing luci-app-firewall (git-23.136.70495-73abc0e) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/luci/luci-app-firewall_git-23.136.70495-73abc0e_all.ipk
Installing libubox20230523 (2023-05-23-75a3b870-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/libubox20230523_2023-05-23-75a3b870-1_mipsel_24kc. ipk
Installing libubus20220615 (2022-06-15-9913aa61-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/libubus20220615_2022-06-15-9913aa61-1_mipsel_24kc. ipk
Installing libblobmsg-json20230523 (2023-05-23-75a3b870-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/libblobmsg-json20230523_2023-05-23-75a3b870-1_mips el_24kc.ipk
Installing rpcd (2023-03-14-d9788300-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/rpcd_2023-03-14-d9788300-1_mipsel_24kc.ipk
Installing rpcd-mod-file (2023-03-14-d9788300-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/rpcd-mod-file_2023-03-14-d9788300-1_mipsel_24kc.ip k
Installing libnl-tiny2023-04-02 (2023-04-02-11b7c5f0-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/libnl-tiny2023-04-02_2023-04-02-11b7c5f0-1_mipsel_ 24kc.ipk
Configuring libubox20230523.
Configuring libubus20220615.
Configuring libblobmsg-json20230523.
Configuring rpcd.
Configuring luci-app-firewall.
Configuring rpcd-mod-file.
Configuring luci-proto-ipv6.
Collected errors:
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nfnetlink
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nf-reject
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nf-reject6
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nf-conntrac k
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nf-conntrac k6
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nf-nat
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nf-log
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nf-log6
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-crypto-hash
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-crypto-crc3 2c
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-lib-crc32c
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nft-core
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nft-fib
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nf-flow
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nft-nat
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nft-offload
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-nf-ipt
* pkg_hash_fetch_best_installation_candidate: Packages for kmod-nf-ipt found, but incompatible with the architectures configure d
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-ipt-core
* pkg_hash_fetch_best_installation_candidate: Packages for kmod-ipt-core found, but incompatible with the architectures configu red
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-ipt-conntra ck
* pkg_hash_fetch_best_installation_candidate: Packages for kmod-ipt-conntrack found, but incompatible with the architectures co nfigured
* pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.117-1-be57503e7ec8c0657d49a10d963d9d86) for kmod-ipt-nat
* pkg_hash_fetch_best_installation_candidate: Packages for kmod-ipt-nat found, but incompatible with the architectures configur ed
* check_data_file_clashes: Package libnl-tiny2023-04-02 wants to install file /usr/lib/libnl-tiny.so
But that file is already provided by package * libnl-tiny2022-11-01
* opkg_install_cmd: Cannot install package luci.
who faced such a thing? can this be fixed?
When you get the message “Cannot satisfy the following dependencies for…” it is most likely because you installed a snapshot version of OpenWrt.
Read here for possible solutions.
Install a release build and LuCI will be pre installed. Or install a new snapshot and you can then install LuCI
1 Like
