Need help with my OpenWRT router!

MuntadherTY · June 11, 2023, 4:32pm

Hello OpenWrt Community,
I'm encountering issues with my Notion R0121 OpenWRT router, which has a non-standard web interface that lacks essential controls compared to the usual Luci interface. Unfortunately, I'm unable to use the serial connection to control or interrupt the boot process. However, I can receive text on the console. I suspect that the problem might be related to the baud rate. Is there a quick method to determine the correct baud rate? Any assistance in resolving this matter urgently would be highly appreciated.

Here are some details about my router:

It's a cell carrier router manufactured in China.
The router model is Notion R0121.
The firmware version is OpenWrt Linux-3.10.14-p112871.

If anyone is willing to provide assistance, I can share a remote access link to allow you to control and troubleshoot my router. Your support in resolving this issue is invaluable!

Attached is a screenshot of the web interface dashboard for reference.

Log:

[04000D0C][04000C0E]
DDR Calibration DQS reg = 0000878A



U-Boot 1.1.3 (Nov 22 2021 - 10:37:39)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
flash manufacture id: 1c, device id 70 18
find flash: EN25Q128
============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Nov 22 2021  Time:10:37:39
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 575 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
[u]ofs = 0x00000000
[u]size = 0x00000000
REG: TESTSTAT value = 0x00000000

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   6: spi flash mcp test.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.


3: System Boot new system code via Flash.
## Booting image at bc800000 ...
   Image Name:   OpenWrt Linux-3.10.14-p112871
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1372678 Bytes =  1.3 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...


LINUX started...

 THIS IS ASIC
[    0.000000] Linux version 3.10.14 (jenkins@wh-cis01) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #1 Wed May 25 14:31:29 CST 2022
[    0.000000]
[    0.000000]  The CPU feqenuce set to 580 MHz
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] Software DMA cache coherency
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock6 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00049079
[    0.000000] Readback ErrCtl register=00049079
[    0.000000] Memory: 60692k/65536k available (3067k kernel code, 4792k reserved, 727k data, 236k init, 0k highmem)
[    0.000000] NR_IRQS:128
[    0.000000] console [ttyS1] enabled
[    0.096000] Calibrating delay loop... 385.02 BogoMIPS (lpj=770048)
[    0.136000] pid_max: default: 32768 minimum: 301
[    0.140000] Mount-cache hash table entries: 512
[    0.144000] NET: Registered protocol family 16
[    0.148000] RALINK_GPIOMODE = 54054404
[    0.152000] RALINK_GPIOMODE = 54044404
[    0.252000] ***** Xtal 25MHz *****
[    0.256000] start PCIe register access
[    0.756000] RALINK_RSTCTRL = 2400000
[    0.760000] RALINK_CLKCFG1 = fdbfffc0
[    0.764000]
[    0.764000] *************** MT7628 PCIe RC mode *************
[    1.264000] PCIE0 no card, disable it(RST&CLK)
[    1.296000] bio: create slab <bio-0> at 0
[    1.300000] usbcore: registered new interface driver usbfs
[    1.304000] usbcore: registered new interface driver hub
[    1.308000] usbcore: registered new device driver usb
[    1.312000] cfg80211: Calling CRDA to update world regulatory domain
[    1.316000] Switching to clocksource MIPS
[    1.320000] NET: Registered protocol family 2
[    1.332000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    1.344000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    1.356000] TCP: Hash tables configured (established 512 bind 512)
[    1.368000] TCP: reno registered
[    1.376000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.388000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.400000] NET: Registered protocol family 1
[    1.408000] MTK/Ralink EHCI/OHCI init.
[    1.416000] MTK/Ralink leds init.
[    1.424000] MTK/Ralink keys init.
[    1.432000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.444000] jffs2: version 2.2. (NAND) (SUMMARY)  (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.464000] msgmni has been set to 118
[    1.472000] io scheduler noop registered (default)
[    1.488000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.504000] serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
[    1.516000] serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
[    1.528000] Ralink gpio driver initialized
[    1.536000] RALINK_SYSCTL_BASE = 0xb0000000
[    1.548000] flash manufacture id: 1c, device id 70 18
[    1.556000] EN25Q128(1c 70181c70) (16384 Kbytes)
[    1.568000] mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
[    1.584000] Creating 8 MTD partitions on "raspi":
[    1.596000] 0x000000000000-0x000001000000 : "ALL"
[    1.604000] 0x000000000000-0x000000030000 : "Bootloader"
[    1.616000] 0x000000030000-0x000000040000 : "Config"
[    1.628000] 0x000000040000-0x000000050000 : "Factory"
[    1.640000] 0x000000050000-0x000000800000 : "firmware1"
[    1.652000] 0x000000800000-0x000000fb0000 : "firmware2"
[    1.664000] 0x00000094f246-0x000000fb0000 : "rootfs"
[    1.676000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    1.700000] mtd: partition "rootfs_data" created automatically, ofs=0xed0000, len=0xe0000
[    1.716000] 0x000000ed0000-0x000000fb0000 : "rootfs_data"
[    1.728000] 0x000000fb0000-0x000000ff0000 : "reserved"
[    1.740000] 0x000000ff0000-0x000001000000 : "Configbak"
[    1.752000] PPP generic driver version 2.4.2
[    1.760000] PPP MPPE Compression module registered
[    1.772000] NET: Registered protocol family 24
[    1.780000] PPTP driver version 0.8.5
[    1.788000] GMAC1_MAC_ADRH -- : 0x00008c88
[    1.796000] GMAC1_MAC_ADRL -- : 0x2b000019
[    1.804000] Ralink APSoC Ethernet Driver Initilization. v3.1  256 rx/tx descriptors allocated, mtu = 1500!
[    1.824000] GMAC1_MAC_ADRH -- : 0x00008c88
[    1.832000] GMAC1_MAC_ADRL -- : 0x2b000019
[    1.840000] PROC INIT OK!
[    1.844000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    1.856000] ehci-pci: EHCI PCI platform driver
[    1.868000] ehci-platform: EHCI generic platform driver
[    1.896000] ******MT7628 mtk phy
[    1.904000] *****run project phy.
[    1.920000] FM_OUT value: u4FmOut = 0(0x00000000)
[    1.936000] FM_OUT value: u4FmOut = 130(0x00000082)
[    1.944000] FM detection done! loop = 1
[    1.960000] SR calibration value u1SrCalVal = 6
[    1.968000] *********Execute mt7628_phy_init!!
[    1.976000] ehci-platform ehci-platform: EHCI Host Controller
[    1.988000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
[    2.004000] ehci-platform ehci-platform: irq 18, io mem 0x101c0000
[    2.028000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
[    2.040000] hub 1-0:1.0: USB hub found
[    2.048000] hub 1-0:1.0: 1 port detected
[    2.056000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    2.088000] *********Execute mt7628_phy_init!!
[    2.096000] ohci-platform ohci-platform: Generic Platform OHCI Controller
[    2.108000] ohci-platform ohci-platform: new USB bus registered, assigned bus number 2
[    2.124000] ohci-platform ohci-platform: irq 18, io mem 0x101c1000
[    2.196000] hub 2-0:1.0: USB hub found
[    2.204000] hub 2-0:1.0: 1 port detected
[    2.212000] logger: created 256K log 'log_main'
[    2.220000] logger: created 256K log 'log_events'
[    2.232000] logger: created 256K log 'log_radio'
[    2.240000] logger: created 256K log 'log_system'
[    2.248000] nf_conntrack version 0.5.0 (948 buckets, 3792 max)
[    2.260000] ipip: IPv4 over IPv4 tunneling driver
[    2.272000] gre: GRE over IPv4 demultiplexor driver
[    2.280000] ip_gre: GRE over IPv4 tunneling driver
[    2.292000] TCP: cubic registered
[    2.300000] NET: Registered protocol family 10
[    2.312000] NET: Registered protocol family 17
[    2.320000] Bridge firewalling registered
[    2.328000] 8021q: 802.1Q VLAN Support v1.8
[    2.368000] registered taskstats version 1
[    2.380000] VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
[    2.396000] Freeing unused kernel memory: 236K (803b5000 - 803f0000)
[    3.260000] init: Console is alive
[    3.612000] usb 1-1: new high-speed USB device number 2 using ehci-platform
[    4.804000] xiehj : RALINK_REG_GPIOMODE = 0x55044410
[    4.816000] xiehj : RALINK_REG_GPIOMODE = 0x55054410
[    4.824000] cpflag_gpio = 5
[    4.832000] reset_cp_gpio = 37
[    4.840000] register reboot notifier
[    4.856000] SCSI subsystem initialized
[    4.872000] usbcore: registered new interface driver usb-storage
[    4.900000] init: - preinit -
ifconfig eth0 up ignore
sendto(): Network is unreachable
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    9.672000] jffs2: notice: (308) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 13 of xref (0 dead, 3 orphan) found.
block: extroot: no root or overlay mount defined
jffs2 is ready
jffs2 is ready
[    9.800000] jffs2: notice: (305) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 13 of xref (0 dead, 3 orphan) found.
switching to overlay
ifconfig eth0 down ignore
[    9.856000] procd: - early -
[   11.024000] procd: - ubus -
[   11.088000] procd: - init -
Please press Enter to activate this console.
[   12.432000] exec  reboot_flag
[   12.484000] NET: Registered protocol family 8
[   12.492000] NET: Registered protocol family 20
[   12.508000] NTFS driver 2.1.30 [Flags: R/O MODULE].
[   12.524000] l2tp_core: L2TP core driver, V2.0
[   12.532000] l2tp_netlink: L2TP netlink interface
[   12.548000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   12.596000] u32 classifier
[   12.600000]     input device check on
[   12.608000]     Actions configured
[   12.616000] Mirror/redirect action on
[   12.628000] Failed to load ipt action
[   13.296000]
[   13.296000]
[   13.296000] === pAd = c07cd000, size = 825624 ===
[   13.296000]
[   13.316000] <-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
[   13.328000] <-- RTMPAllocAdapterBlock, Status=0
[   13.336000] RtmpChipOpsHook(492): Not support for HIF_MT yet!
[   13.348000] mt7628_init()-->
[   13.356000] mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
[   13.364000] e2.bin mt7628_init(1117)::(2), pChipCap->fw_len(63056)
[   13.376000] mt_bcn_buf_init(218): Not support for HIF_MT yet!
[   13.388000] <--mt7628_init()
[   13.404000] cdc_acm 1-1:1.2: This device cannot do calls on its own. It is not a modem.
[   13.420000] cdc_acm 1-1:1.2: Diag_device = ttyACM0
[   13.428000] cdc_acm 1-1:1.2: ttyACM0: USB ACM device
[   13.440000] acm register reboot notifier
[   13.448000] cdc_acm 1-1:1.4: This device cannot do calls on its own. It is not a modem.
[   13.464000] cdc_acm 1-1:1.4: AT_device = ttyACM1
[   13.472000] cdc_acm 1-1:1.4: ttyACM1: USB ACM device
[   13.484000] acm register reboot notifier
[   13.492000] usbcore: registered new interface driver cdc_acm
[   13.504000] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[   13.568000] Ebtables v2.0 registered
[   13.588000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   13.596000] Type=Linux
[   13.628000] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[   13.676000] luow: watchdog test.
[   13.684000] Ralink APSoC Hardware Watchdog Timer
[   13.696000] rdm_major = 253
[   13.760000] xt_time: kernel timezone is -0000
[   13.776000] usbcore: registered new interface driver cdc_ether
[   13.796000] fast-classifier[v2.0]: starting up
[   13.804000] fast-classifier: registered
[   13.820000] generic_rndis_bind: rx_urb_size: 0x4000
[   13.832000] generic_rndis_bind: data zero copy=0
[   13.856000] rndis_host 1-1:1.0 eth1: register 'rndis_host' at usb-ehci-platform-1, RNDIS device, 00:0c:29:a3:9b:6d
[   13.896000] usbcore: registered new interface driver rndis_host
[   15.936000] Started WatchDog Timer.
[   16.636000] mem_monitor not start
[   23.016000] <<<< start DiagTransfer after rild
[   23.272000] DiagSaverEnable=false
[   23.280000] /etc/rc.common should not exe DiagSaver,exit
[   24.528000] *********start firewall***********
[   26.272000] netifd open kmsg done
[   28.408000] *************dropbear_mode is close***********
[   29.508000] NETIFD:ADD dev.claimed:0,present:0, n_present:0, bst_dev.active: 0, bm:eth0.1, act:0
[   29.544000] Raeth v3.1 (Tasklet,SkbRecycle)
[   29.552000]
[   29.552000] phy_tx_ring = 0x024ab000, tx_ring = 0xa24ab000
[   29.568000]
[   29.568000] phy_rx_ring0 = 0x024ac000, rx_ring0 = 0xa24ac000
[   29.596000] GMAC1_MAC_ADRH -- : 0x00008c88
[   29.604000] GMAC1_MAC_ADRL -- : 0x2b000019
[   29.612000] RT305x_ESW: Link Status Changed
[   30.032000] device eth0.1 entered promiscuous mode
[   30.040000] device eth0 entered promiscuous mode
[   30.052000] br-lan: port 1(eth0.1) entered forwarding state
[   30.064000] br-lan: port 1(eth0.1) entered forwarding state
[   30.164000] device eth1 entered promiscuous mode
[   30.176000] device_claim: active: 2
[   30.200000] device_claim: active: 2
[   32.068000] br-lan: port 1(eth0.1) entered forwarding state
[   35.560000] *********reload firewall***********
[   36.092000] wantype = dhcp
[   36.100000] *************hotplug: br-lan up: start dnsmasq...
[   36.516000] device_claim: active: 3
[   37.540000] ********/var/etc/689f7d6e7e.conf_br-lan*********
[   39.692000] ********hotplug : autolan creat**********
[   39.716000] device eth0.2 entered promiscuous mode
[   39.848000] NETIFD:ADD dev.claimed:0,present:0, n_present:1, bst_dev.active: 1, bm:autolan, act:0
[   39.872000] device_claim: active: 2
[   39.908000] device autolan entered promiscuous mode
[   39.916000] br-lan: port 2(autolan) entered forwarding state
[   39.928000] br-lan: port 2(autolan) entered forwarding state
[   41.932000] br-lan: port 2(autolan) entered forwarding state
[   42.136000] add package deal chain,result=0,num=1
[   42.284000] add client deal chain,result=0,num=1
[   42.356000] add bolt_redirect chain,result=0,num=1
[   44.196000] wantype = dhcp
[   44.204000] *************hotplug: lo...
[   47.528000] ********/var/etc/dnsmasq-def.conf*********
[   50.704000] *********reload firewall***********
[   52.260000] wantype = dhcp
[   52.320000] *************hotplug: eth1...
[   54.928000] *********reload firewall***********
[   56.212000] wantype = dhcp
[   56.216000] *************hotplug: apn9...
[   56.584000] wantype = dhcp
[   56.592000] *************hotplug: eth1...

Additionally, I noticed that only a few ports are open on the router, including port 80 for the web UI and ports 53 for DNS. While inspecting the router's web interface using the Microsoft Edge (or Chrome) browser's "Sources" tab, I came across an "ssh_tunnel.js" file (please see the screenshot below).

This gives me hope that I can find a workaround to enable SSH or another method to access the router terminal. Currently, my main priority is to gain access via SSH or serial connection.

Please let me know if you require any further information or screenshots. Thank you for your assistance in advance!

RuralRoots · June 11, 2023, 5:23pm

There is very little help that can be gained here in this forum.

It appears you are using firmware that is not from the official OpenWrt project.

When using forks/offshoots/vendor-specific builds that are "based on OpenWrt", there may be many differences compared to the official versions (hosted by OpenWrt.org). Some of these customizations may fundamentally change the way that OpenWrt works. You might need help from people with specific/specialized knowledge about the firmware you are using, so it is possible that advice you get here may not be useful.

You may find that the best options are:

Install an official version of OpenWrt, if your device is supported (see https://firmware-selector.openwrt.org).
Ask for help from the maintainer(s) or user community of the specific firmware that you are using.
Provide the source code for the firmware so that users on this forum can understand how your firmware works (OpenWrt forum users are volunteers, so somebody might look at the code if they have time and are interested in your issue).

If you believe that this specific issue is common to generic/official OpenWrt and/or the maintainers of your build have indicated as such, please feel free to clarify.

MuntadherTY · June 11, 2023, 10:02pm

Thank you for your response and suggestions regarding my Notion R0121 OpenWRT router issue. I understand that using a firmware version that is not from the official OpenWrt project may introduce significant differences and customization, which can impact the support available through this forum.

Regarding the inability to control the router using the serial communication, I believe there might be a misunderstanding. In my previous message, I mentioned that I am able to receive text on the console, which suggests that the serial connection is working. However, I am unable to control or interrupt the boot process through the serial connection. I suspect that this limitation might be related to the baud rate settings or other configuration parameters.

To further troubleshoot the issue, I would like to clarify the correct wiring connections for the UART. My understanding is that I should connect the aptx pin to the tx0 pin in the UART and the aprx pin to the rx0 pin in the UART. Additionally, I should connect the ground (GND) pin to the corresponding ground pin in order to establish a proper connection. However, despite the convention of connecting the transmit (TX) pin to the receive (RX) pin and vice versa, I have observed that connecting the TX pin to the TX pin and the RX pin to the RX pin, along with the ground connection, allows me to receive output on the serial Putty terminal.

Considering the unconventional wiring arrangement, I would appreciate any insights or explanations regarding this behavior. Is there a specific reason why connecting the TX pin to the TX pin and the RX pin to the RX pin would produce output on the serial terminal? I want to ensure that I have a clear understanding of the underlying principles.

Furthermore, I would like to share that after some experimentation, I have found that the working baud rate to receive English words on the terminal is 57600. This information might be helpful for others facing similar issues.

Once again, I would like to express my gratitude for your support in resolving this issue. Please let me know if there is any additional information or clarification I can provide.

Thank you for your assistance.

Sincerely,
Muntadher Majid

bevanweiss · June 12, 2023, 3:59am

Tx/Rx labelling is pretty arbitrary. Is it that "I" 'Tx' or that "you" 'Tx' on the Tx port?!?
If you've connected it such that you get words streaming out when you power it on, then you have the device Tx to your Rx sorted out. The other direction should be relatively straight forward also.

What you want to do is try pressing the ESC rapidly during the very first boot up (before it starts printing the UBoot message), and then continue rapidly pressing it... If it asks you for a password, or otherwise doesn't drop into Linux, then you have a chance to enter UBoot. If you don't know what UBoot is, then you should start googling.

Some devices have UBoot locked out from the OEM, so you can't easily get in from a serial connection. In this case your best option is to try to get into the Linux command line.
You haven't included the end of the Linux boot. If it's close to OpenWRT then it should drop into an OpenWRT command line after booting. Most OEMs tend to also change the default shell to be a locked down proprietary thing, or even just redirect the whole thing to /dev/null. In that case your best option is to try to catch it before it ends up at a user login, you could do this with precise timing to catch the Press the [f] key and hit [enter] to enter failsafe mode message. So if you don't get UBoot, then just start spamming 'f' and 'enter' in the hopes that you got it right and it goes into failsafe.

If that doesn't work... then it'll be less trivial...

psherman · June 12, 2023, 3:00pm

This topic was automatically closed after 16 hours. New replies are no longer allowed.