Phicomm K3 A1/ Wavlink Quantum Dax how to install OpenWrt?

The Phicomm K3 has been supported since 19.07.0, back then the CFE mode was available, you could flash OpenWRT via CFE and everything was good.
Between there and here, Phicomm traded the Hardware Design and GPL Sources to Wavlink, and the Quantum Dax was created.

The Hardware Revision is D1, the current stock firmware is here:
https://www.wavlink.com/en_us/firmware/details/ff7995ec6a.html

Phicomm K3 owners are able to flash this firmware, suggesting the hardware is almost identical.
As the Quantum Dax uses software version 31, all of the k3 exploits do not work, the CFE is locked down and the firmware seems to be signed.

Are there any Phicomm K3 owners willing to help me see if I can get OpenWRT on my Quantum Dax?

1 Like

Dear friend
Sorry for my late reply
And I hope it is not too late.
We do have the newer firmware.
Pls kindly check the firmware from the link below:

I hope this could help.
If you meet any other problem,pls be free to tell us.
Warm regards
Wavlink team
postsales@wavlink.com

Stock Firmware version 31.0.0.17 from June 2021 if anyone needs it, not mentioned on website.

1 Like

Progress, the Wavlink Quantum Dax is the Phicomm K3N D1.

Following https://github.com/xiao-mantou/K3N

The firmware can be binwalk, and the config.dat can be decrypted:

So if I keep the TRX firmware header the same can I inject k3 firmware and downgrade using the web interface

It seems that the link is down, do you mind re-uploading it elsewhere?
Anyway, I'm also trying to flash any custom firmware on this device (the quantum dax from wavlink).

Do you have any well written guide? All the stuff I found while searching around was in chinese.

1 Like

here's my backup of the new firmware:
SW_DAX_703004927_V31.0.0.17_20210617.bin

1 Like

I own one, I’ll help if necessary :slight_smile:

1 Like

currently getting hold of new serial cables, I own two Dax.

Replying to myself:
wiki page is empty https://openwrt.org/toh/phicomm/k3_a1 no pictures, no instructions.
git commit is sparse: https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=62dadcb86c6e6f80ce6fbcd89befc3cc22c2176a

serial ttl arrived, time to crack open a case take photos etc.

four philips screws on the bottom, under the rubber foot, lay the case on it's side with the wording at the bottom facing right way up.
You can the take the side off.

Inside are two pcbs slotted into a bottom pcb, five wireless antennas one side of the shell, three antennas on the back of the shell.

4 philips screws to take the pcbs out of the back shell, TX RX GND and VCC clearly labelled on the back PCB.

Digital core power voltage set to 1.05V
Decompressing...done
Digital core power voltage set to 1.05V

SHMOO VER 1.13

PKID07DC06011801080000000000001A103F01000000

S300001F3
00001560


RDLYW0 00000004

RDENW0 00000035

RDQSW0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ----------+++++++++++++++++++++++++++X++++++++++++++++++++++++--
 01 -----------++++++++++++++++++++++++++X++++++++++++++++++++++++++
 02 ------------++++++++++++++++++++++++++X+++++++++++++++++++++++++
 03 ---------+++++++++++++++++++++++++++X+++++++++++++++++++++++++++
 04 ------++++++++++++++++++++++++X+++++++++++++++++++++++----------
 05 ----------+++++++++++++++++++++++++++X++++++++++++++++++++++++--
 06 ------++++++++++++++++++++++++++X+++++++++++++++++++++++++------
 07 -----------++++++++++++++++++++++++++X++++++++++++++++++++++++--
 08 -----++++++++++++++++++++++++++X+++++++++++++++++++++++++-------
 09 -------+++++++++++++++++++++++++X+++++++++++++++++++++++++------
 10 ---------+++++++++++++++++++++++++X+++++++++++++++++++++++++----
 11 --------+++++++++++++++++++++++++X+++++++++++++++++++++++++-----
 12 --++++++++++++++++++++++++++X+++++++++++++++++++++++++----------
 13 -----+++++++++++++++++++++++++X++++++++++++++++++++++++---------
 14 -----+++++++++++++++++++++++++X+++++++++++++++++++++++++--------
 15 ----++++++++++++++++++++++++X+++++++++++++++++++++++------------


PW0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 --------++++++++++++++++++++++++++++X+++++++++++++++++++++++++--
 01 --------++++++++++++++++++++++++++++X+++++++++++++++++++++++++++
 02 -----------++++++++++++++++++++++++++X++++++++++++++++++++++++++
 03 --------++++++++++++++++++++++++++++X+++++++++++++++++++++++++++
 04 --++++++++++++++++++++++++++X++++++++++++++++++++++++++---------
 05 ---------+++++++++++++++++++++++++++X++++++++++++++++++++++++++-
 06 ----+++++++++++++++++++++++++++X++++++++++++++++++++++++++------
 07 ---------+++++++++++++++++++++++++++X+++++++++++++++++++++++++--
 08 ++++++++++++++++++++++++++++X++++++++++++++++++++++++++++-------
 09 ----+++++++++++++++++++++++++++X++++++++++++++++++++++++++------
 10 ---++++++++++++++++++++++++++++X++++++++++++++++++++++++++++----
 11 -----+++++++++++++++++++++++++++X++++++++++++++++++++++++++-----
 12 +++++++++++++++++++++++++++X++++++++++++++++++++++++++----------
 13 --++++++++++++++++++++++++++X++++++++++++++++++++++++++---------
 14 ----++++++++++++++++++++++++++X+++++++++++++++++++++++++--------
 15 -+++++++++++++++++++++++++X+++++++++++++++++++++++++------------


NW0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 -----------++++++++++++++++++++++++++X+++++++++++++++++++++++++-
 01 -----------++++++++++++++++++++++++++X++++++++++++++++++++++++++
 02 ------------++++++++++++++++++++++++++X+++++++++++++++++++++++++
 03 ---------+++++++++++++++++++++++++++X+++++++++++++++++++++++++++
 04 -----++++++++++++++++++++++++++X+++++++++++++++++++++++++-------
 05 ----------+++++++++++++++++++++++++++X+++++++++++++++++++++++++-
 06 -------++++++++++++++++++++++++++X++++++++++++++++++++++++++----
 07 -----------++++++++++++++++++++++++++X++++++++++++++++++++++++++
 08 -----+++++++++++++++++++++++++++X+++++++++++++++++++++++++++----
 09 -------++++++++++++++++++++++++++X+++++++++++++++++++++++++-----
 10 --------++++++++++++++++++++++++++++X++++++++++++++++++++++++++-
 11 --------+++++++++++++++++++++++++X+++++++++++++++++++++++++-----
 12 ---++++++++++++++++++++++++++X++++++++++++++++++++++++++--------
 13 ------+++++++++++++++++++++++++X++++++++++++++++++++++++--------
 14 -----++++++++++++++++++++++++++X++++++++++++++++++++++++++------
 15 -----+++++++++++++++++++++++++X+++++++++++++++++++++++++--------


WRDQW0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ++++++++++++++++++++++++X++++++++++++++++++++++++---------+++++-
 01 ++++++++++++++++++++++++++X+++++++++++++++++++++++++-------++++-
 02 ++++++++++++++++++++++++++X+++++++++++++++++++++++++-------++++-
 03 +++++++++++++++++++++++++X++++++++++++++++++++++++--------+++++-
 04 ++++++++++++++++++++++X++++++++++++++++++++++--------------++++-
 05 ++++++++++++++++++++++++++X+++++++++++++++++++++++++-------++++-
 06 +++++++++++++++++++++++X+++++++++++++++++++++++-----------+++++-
 07 ++++++++++++++++++++++++++X+++++++++++++++++++++++++-------++++-
 08 +++++++++++++++++++++++X++++++++++++++++++++++------------+++++-
 09 ++++++++++++++++++++++++X+++++++++++++++++++++++----------+++++-
 10 +++++++++++++++++++++++++X+++++++++++++++++++++++++-------+++++-
 11 +++++++++++++++++++++++++X++++++++++++++++++++++++---------++++-
 12 ++++++++++++++++++++++X++++++++++++++++++++++------------++++++-
 13 ++++++++++++++++++++++++X+++++++++++++++++++++++-----------++++-
 14 +++++++++++++++++++++++X+++++++++++++++++++++++-----------+++++-
 15 +++++++++++++++++++++++X+++++++++++++++++++++++----------++++++-


WRDMW0 00000024
WRDMW0 00000023


ADDR

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 +++++++++++++++++++++S+++++++++X++++++++++++++++++++++++++++++++

Decompressing...done


CFE version 7.14.131.47 (r629548) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Thu May 17 19:53:26 CST 2018 (jenkins@SOHO-OPWRT)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
DDR Clock: 800 MHz
Info: DDR frequency set from clkfreq=1400,*800*
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.131.47 (r629548)
CPU type 0x0: 1400MHz
Tot mem: 524288 KBytes

CFE mem:    0x00F00000 - 0x017D2198 (9249176)
Data:       0x00F6A570 - 0x00F6AB3C (1484)
BSS:        0x00F6AB48 - 0x00FD0198 (415312)
Heap:       0x00FD0198 - 0x017D0198 (8388608)
Stack:      0x017D0198 - 0x017D2198 (8192)
Text:       0x00F00000 - 0x00F5DFB0 (384944)

Device eth0:  hwaddr 80-3F-5D-0C-AB-44, ipaddr 192.168.10.1, mask 255.255.255.0
        gateway not set, nameserver not set

stock firmware dmesg

# dmesg
SROM CRC Error
CONSOLE: 026738.664 initvars_srom_pci, Using external nvram
CONSOLE: 026738.664 wlc_ucode_download: wl0: Loading non-MU ucode
CONSOLE: 026738.664 reclaim section 0: Returned 216 bytes to the heap
CONSOLE: 026738.665 initvars_cis_pci: Not CIS format
CONSOLE: 026738.682 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.697 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.703 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.710 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.712 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.712 srom rev:0
CONSOLE: 026738.712 initvars_srom_pci, SROM CRC Error
CONSOLE: 026738.712 initvars_srom_pci, Using external nvram
CONSOLE: 026738.712 wlc_bmac_attach, deviceid 0x43c4 nbands 1
CONSOLE: 026738.716 ipxotp_init: mapping otpbase at 0x18007000 to 0x18007000
CONSOLE: 026738.716 wl0: wlc_bmac_attach: chiprev 4 corerev 65 cccap 0x58400009 maccap 0xf0018705 band 2.4G, phy_type 11 phy_rev 33
CONSOLE: 026738.716 enable 1: q0 frmcnt 0, wrdcnt 0, q1 frmcnt 0, wrdcnt 0
CONSOLE: 026738.716 enable 1: q0 frmcnt 0, wrdcnt 0, q1 frmcnt 0, wrdcnt 0
CONSOLE: 026738.717 wl0: wlc_stf_txcore_shmem_write: No clock
CONSOLE: 026738.718 wl0: wlc_ampdu_tx_set: AGG Mode = MAC+AQM txmaxpkts 512
CONSOLE: 026738.719 wl_eventq_dup_event: wl_eventq not initialized
CONSOLE: 026738.719 wl_eventq_dup_event: wl_eventq not initialized
CONSOLE: 026738.719 wl0: Broadcom BCM4366 802.11 Wireless Controller 10.10.69.74 (r629731 WLTEST)
CONSOLE: 026738.719 SPLITRX_MODE_2 enabled : tcmsegsize 160
CONSOLE: 026738.719 TCAM: 512 used: 141 exceed:0
CONSOLE: 026738.719 reclaim section 1: Returned 154812 bytes to the heap
CONSOLE: 026738.719 ThreadX v5.6 initialized
CONSOLE:
CONSOLE: 026738.735 HOST RX BUF: ret buf not available
CONSOLE: 026738.735 HOST RX BUF: ret buf not available
CONSOLE: 026738.737 wl0: wlc_enable_probe_req: state down, deferring setting of host flags
CONSOLE: 026738.737 wl0: wlc_enable_probe_req: state down, deferring setting of host flags
dhdpcie_download_code_array: Download, Upload and compare succeeded (4366c0-roml/pcie-ag-splitrx-fdap-mbss-mfgtest-err-seqcmds-phydbg-phydump-txbf-pktctx-amsdutx-ampduretry-chkd2hdma-11nprop-dbgam-dbgams-ringer-dmaindex16-bgdfs-hostpmac, 2018.02.24.224814, 2018/02/24 22:48:14).
dhdpcie_bus_write_vars: Download, Upload and compare of NVRAM succeeded.
PCIe shared addr (0x002be9cc) read took 196383 usec before dongle is ready
DMA RX offset from shared Area 0
dhdpcie_readshared: Dongle advertizes 2 size indices
dhdpcie_readshared: Host support DMAing indices: H2D:1 - D2H:1. FW supports it
H2D DMA WR INDX : array size 532 = 2 * 266
D2H DMA RD INDX : array size 6 = 2 * 3
D2H DMA WR INDX : array size 6 = 2 * 3
H2D DMA RD INDX : array size 532 = 2 * 266
ring_info_raw: 56
18 54 41 00 e8 64 41 00 fc 66 41 00 10 69 41 00
16 69 41 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 0a 01 00 00
dhdpcie_readshared: max H2D queues 266
dhd_bus_start: Initializing 266 h2drings
dhd_bus_cmn_writeshared:
  0000: 00 f0 80 5f 00 00 00 00
dhd_bus_cmn_writeshared:
  0000: 00 c0 7a 5c 00 00 00 00
dhd_bus_cmn_writeshared:
  0000: 00 60 85 5f 00 00 00 00
dhd_bus_cmn_writeshared:
  0000: 00 00 7b 5c 00 00 00 00
dhd_bus_cmn_writeshared:
  0000: 00 40 7b 5c 00 00 00 00
dhd_bus_cmn_writeshared:
  0000: 00 00 00 5c 00 00 00 00
dhd_bus_cmn_writeshared:
  0000: 10 00 08 00
dhd_bus_cmn_writeshared:
  0000: c0 09 90 5f 00 00 00 00
dhd_bus_cmn_writeshared:
  0000: 00 3c a8 5f 00 00 00 00
dhd_bus_cmn_writeshared:
  0000: 00 38 a8 5f 00 00 00 00
dhd_bus_cmn_writeshared:
  0000: c0 05 90 5f 00 00 00 00
Attach flowrings pool for 264 rings
CUR_ETHERADDR : 6
80 3f 5d 0c ab 46
dhd_sync_with_dongle: GET_REVINFO device 0x43c5, vendor 0x14e4, chipnum 0x4366
Dongle Host Driver, version 1.363.45.5804 (r624343 WLTEST)
Compiled in drivers/net/wireless/bcmdhd on May  8 2021 at 18:12:07
Register interface [eth2]  MAC: 80:3f:5d:0c:ab:46

Broadcom PCI Device 0x4715 has allocated with driver et
dhd_module_init out
dhd_prot_ioctl: status ret value is -4
CONSOLE: 000000.000 initvars_cis_pci: Not CIS format
CONSOLE: 000000.000 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 000000.000 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 000000.000 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 000000.000 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 000000.000 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 000000.000 srom rev:0
CONSOLE: 000000.000 initvars_srom_pci, SROM CRC Error
CONSOLE: 000000.000 initvars_srom_pci, Using external nvram
CONSOLE: 000000.000 Setting clocks to 800/400/200
CONSOLE: 000000.000 si_set_bb_vcofreq_frac: only work on 4360, 4350
CONSOLE: 000000.000 Enabling D-cache
CONSOLE: 026738.568 gic_dist_init max_irq 64
CONSOLE: 026738.569 c_init: Watchdog reset bit set, clearing
CONSOLE: 026738.569
CONSOLE: RTE (PCIE-MSG_BUF) 10.10.69.74 (r629731 WLTEST) on BCM4366 r4 @ 40.0/200.0/800.0MHz
CONSOLE: 026738.569 nvram_init: called again without calling nvram_exit()
CONSOLE: 026738.569 initvars_cis_pci: Not CIS format
CONSOLE: 026738.586 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.601 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.608 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.614 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.616 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.616 srom rev:0
CONSOLE: 026738.616 initvars_srom_pci, SROM CRC Error
CONSOLE: 026738.616 initvars_srom_pci, Using external nvram
CONSOLE: 026738.616 allocating a max of 511 rxcplid buffers
CONSOLE: 026738.617 pciemsgbuf0: Broadcom PCIE MSGBUF driver
CONSOLE: 026738.617 nvram_init: called again without calling nvram_exit()
CONSOLE: 026738.617 initvars_cis_pci: Not CIS format
CONSOLE: 026738.634 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.649 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.655 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.662 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.664 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.664 srom rev:0
CONSOLE: 026738.664 initvars_srom_pci, SROM CRC Error
CONSOLE: 026738.664 initvars_srom_pci, Using external nvram
CONSOLE: 026738.664 wlc_ucode_download: wl0: Loading non-MU ucode
CONSOLE: 026738.665 reclaim section 0: Returned 216 bytes to the heap
CONSOLE: 026738.665 initvars_cis_pci: Not CIS format
CONSOLE: 026738.682 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.697 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.704 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.710 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.712 sprom_read_pci: buf[0] = 0xffff, returning bad-crc
CONSOLE: 026738.712 srom rev:0
CONSOLE: 026738.712 initvars_srom_pci, SROM CRC Error
CONSOLE: 026738.712 initvars_srom_pci, Using external nvram
CONSOLE: 026738.712 wlc_bmac_attach, deviceid 0x43c5 nbands 1
CONSOLE: 026738.719 ipxotp_init: mapping otpbase at 0x18007000 to 0x18007000
CONSOLE: 026738.719 wl1: wlc_bmac_attach: chiprev 4 corerev 65 cccap 0x58400009 maccap 0xf0018705 band 5G, phy_type 11 phy_rev 33
CONSOLE: 026738.719 enable 1: q0 frmcnt 0, wrdcnt 0, q1 frmcnt 0, wrdcnt 0
CONSOLE: 026738.719 enable 1: q0 frmcnt 0, wrdcnt 0, q1 frmcnt 0, wrdcnt 0
CONSOLE: 026738.720 wl1: wlc_stf_txcore_shmem_write: No clock
CONSOLE: 026738.721 wl1: wlc_ampdu_tx_set: AGG Mode = MAC+AQM txmaxpkts 512
CONSOLE: 026738.722 wl_eventq_dup_event: wl_eventq not initialized
CONSOLE: 026738.722 wl_eventq_dup_event: wl_eventq not initialized
CONSOLE: 026738.722 wl1: Broadcom BCM4366 802.11 Wireless Controller 10.10.69.74 (r629731 WLTEST)
CONSOLE: 026738.722 SPLITRX_MODE_2 enabled : tcmsegsize 160
CONSOLE: 026738.722 TCAM: 512 used: 141 exceed:0
CONSOLE: 026738.722 reclaim section 1: Returned 154812 bytes to the heap
CONSOLE: 026738.723 ThreadX v5.6 initialized
CONSOLE:
CONSOLE: 026738.738 HOST RX BUF: ret buf not available
CONSOLE: 026738.738 HOST RX BUF: ret buf not available
CONSOLE: 026738.740 wl1: wlc_enable_probe_req: state down, deferring setting of host flags
CONSOLE: 026738.740 wl1: wlc_enable_probe_req: state down, deferring setting of host flags
wl_module_init: passivemode set to 0x0
wl_module_init: txworkq set to 0x0
Tuxera NTFS driver 3016.7.1.2.3 [Flags: R/W MODULE].
Built against headers 2.6.36.4brcmarm #1 SMP PREEMPT Tue Apr 18 13:37:29 CST 2017 arm
Running on kernel 2.6.36.4brcmarm #6 SMP PREEMPT Sat May 8 18:11:48 CST 2021 armv7l
exFAT: Version 1.2.9
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci_hcd 0000:00:0b.1: EHCI Host Controller
ehci_hcd 0000:00:0b.1: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0b.1: irq 111, io mem 0x18021000
ehci_hcd 0000:00:0b.1: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
ohci_hcd 0000:00:0b.0: OHCI Host Controller
ohci_hcd 0000:00:0b.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:0b.0: irq 111, io mem 0x18022000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
device vlan1 entered promiscuous mode
device eth0 entered promiscuous mode
dhd_prot_ioctl: status ret value is -29
dhd_prot_ioctl: status ret value is -23
dhd_prot_ioctl: status ret value is -23
dhd_prot_ioctl: status ret value is -20
dhd_prot_ioctl: status ret value is -23
dhd_prot_ioctl: status ret value is -23
dhd_prot_ioctl: status ret value is -23
dhd_prot_ioctl: status ret value is -23
device eth1 entered promiscuous mode
CONSOLE: 026750.131 wl0: wl_open
CONSOLE: 026750.132 wlc_ucode_download: wl0: Loading non-MU ucode
CONSOLE: 026750.133 wl0: CORE INIT : nfifo 6 mu_tx_enab 0
CONSOLE: 026750.133 wl0: CORE INIT : mode 2 pktclassify 1 rxsplit 0  hdr conve 0 DMA_CT Disabled
CONSOLE: 026750.146 wl0: wlc_enable_probe_req: state down, deferring setting of host flags
CONSOLE: 026750.146 enable 1: q0 frmcnt 0, wrdcnt 0, q1 frmcnt 0, wrdcnt 0
CONSOLE: 026750.148 wl0.0: wlc_keymgmt_set_bss_tx_key_id:key id 04, key index 65535 is out of range.
CONSOLE: 026750.159 wl0: invalid chanspec 0x1000
CONSOLE: 026750.161 wl0: wlc_ampdu_tx_set: AGG Mode = MAC+AQM txmaxpkts 512
CONSOLE: 026750.169 wl0: wlc_enable_probe_req: state down, deferring setting of host flags
CONSOLE: 026750.172 wl0: wl_open
CONSOLE: 026750.173 enable 1: q0 frmcnt 0, wrdcnt 0, q1 frmcnt 0, wrdcnt 0
CONSOLE: 026750.173 enable 1: q0 frmcnt 0, wrdcnt 0, q1 frmcnt 0, wrdcnt 0
CONSOLE: 026750.173 wlc_ucode_download: wl0: Loading MU ucode
CONSOLE: 026750.174 wl0: CORE INIT : nfifo 32 mu_tx_enab 1
CONSOLE: 026750.175 wl0: CORE INIT : mode 2 pktclassify 1 rxsplit 0  hdr conve 0 DMA_CT Enabled
CONSOLE: 026750.187 wl0: wlc_enable_probe_req: state down, deferring setting of host flags
CONSOLE: 026750.187 enable 1: q0 frmcnt 0, wrdcnt 0, q1 frmcnt 0, wrdcnt 0
dhd_prot_ioctl: status ret value is -29
dhd_prot_ioctl: status ret value is -23
dhd_prot_ioctl: status ret value is -23
dhd_prot_ioctl: status ret value is -13
dhd_prot_ioctl: status ret value is -13
dhd_prot_ioctl: status ret value is -20
dhd_prot_ioctl: status ret value is -23
dhd_prot_ioctl: status ret value is -23
dhd_prot_ioctl: status ret value is -23
dhd_prot_ioctl: status ret value is -23
device eth2 entered promiscuous mode
br0: topology change detected, propagating
br0: port 3(eth2) entering forwarding state
br0: port 3(eth2) entering forwarding state
br0: topology change detected, propagating
br0: port 2(eth1) entering forwarding state
br0: port 2(eth1) entering forwarding state
br0: topology change detected, propagating
br0: port 1(vlan1) entering forwarding state
br0: port 1(vlan1) entering forwarding state
dhd_prot_flow_ring_create: Send Flow Create Req flow ID 265 for peer 01:00:5e:00:00:01 prio 3 ifindex 0
dhd_prot_flow_ring_create: Send Flow Create Req flow ID 265 for peer 01:00:5e:00:00:01 prio 3 ifindex 0
dhd_prot_flow_ring_create_response_process: Flow Create Response status = 0 Flow 265
dhd_prot_flow_ring_create_response_process: Flow Create Response status = 0 Flow 265
CONSOLE: 026749.563 wl1: wl_open
CONSOLE: 026749.564 wlc_ucode_download: wl1: Loading non-MU ucode
CONSOLE: 026749.565 wl1: CORE INIT : nfifo 6 mu_tx_enab 0
CONSOLE: 026749.565 wl1: CORE INIT : mode 2 pktclassify 1 rxsplit 0  hdr conve 0 DMA_CT Disabled
CONSOLE: 026749.578 wl1: wlc_enable_probe_req: state down, deferring setting of host flags
CONSOLE: 026749.579 enable 1: q0 frmcnt 0, wrdcnt 0, q1 frmcnt 0, wrdcnt 0
CONSOLE: 026749.581 wl1.0: wlc_keymgmt_set_bss_tx_key_id:key id 04, key index 65535 is out of range.
CONSOLE: 026749.592 wl1: invalid chanspec 0x1000
CONSOLE: 026749.595 wl1: wlc_ampdu_tx_set: AGG Mode = MAC+AQM txmaxpkts 512
CONSOLE: 026749.602 wl1: wlc_enable_probe_req: state down, deferring setting of host flags
CONSOLE: 026749.605 wl1: wl_open
CONSOLE: 026749.607 enable 1: q0 frmcnt 0, wrdcnt 0, q1 frmcnt 0, wrdcnt 0
CONSOLE: 026749.607 enable 1: q0 frmcnt 0, wrdcnt 0, q1 frmcnt 0, wrdcnt 0
CONSOLE: 026749.607 wlc_ucode_download: wl1: Loading MU ucode
CONSOLE: 026749.608 wl1: CORE INIT : nfifo 32 mu_tx_enab 1
CONSOLE: 026749.608 wl1: CORE INIT : mode 2 pktclassify 1 rxsplit 0  hdr conve 0 DMA_CT Enabled
CONSOLE: 026749.621 wl1: wlc_enable_probe_req: state down, deferring setting of host flags
CONSOLE: 026749.622 enable 1: q0 frmcnt 0, wrdcnt 0, q1 frmcnt 0, wrdcnt 0
CONSOLE: 026749.629 flow_create : bitmap_size=512  maxitems=512
CONSOLE: 026750.268 flow_create : bitmap_size=512  maxitems=512
dhd_prot_ioctl: status ret value is -23
dhd_prot_ioctl: status ret value is -23
dhd_prot_ioctl: status ret value is -23
dhd_prot_ioctl: status ret value is -23

gro disabled

gro enabled with interval 2
CONSOLE: 026754.187 wl0: wlc_lq_chanim_update: WLC_CHANIM upd blocked scan/detect
CONSOLE: 026754.187 wl0: wlc_watchdog: WLC_CHANIM upd fail -25
CONSOLE: 026755.187 wl0: wlc_lq_chanim_update: WLC_CHANIM upd blocked scan/detect
CONSOLE: 026755.187 wl0: wlc_watchdog: WLC_CHANIM upd fail -25
Netlink received msg payload:
CONSOLE: 026756.187 wl0: wlc_lq_chanim_update: WLC_CHANIM upd blocked scan/detect
CONSOLE: 026756.187 wl0: wlc_watchdog: WLC_CHANIM upd fail -25
CONSOLE: 026756.653 wl0: link up (wl0)
CONSOLE: 026756.212 wl1: link up (wl1)
CONSOLE: 026757.187 pciedev_send_ltr:Giving up:0x302
CONSOLE: 026756.622 pciedev_send_ltr:Giving up:0x302
CONSOLE: 026757.622 wl1: wlc_lq_chanim_update: WLC_CHANIM upd blocked scan/detect
CONSOLE: 026757.622 wl1: wlc_watchdog: WLC_CHANIM upd fail -25
CONSOLE: 026758.622 wl1: wlc_lq_chanim_update: WLC_CHANIM upd blocked scan/detect
CONSOLE: 026758.622 wl1: wlc_watchdog: WLC_CHANIM upd fail -25
CONSOLE: 026759.167 wlc_phy_rx_iq_est: sampling_in_progress
CONSOLE: 026759.167 wlc_phy_rx_iq_est: sampling_in_progress
CONSOLE: 026759.167 wlc_phy_rx_iq_est: sampling_in_progress
CONSOLE: 026759.167 wlc_phy_rx_iq_est: sampling_in_progress
CONSOLE: 026759.167 wlc_phy_rx_iq_est: sampling_in_progress
CONSOLE: 026759.167 wlc_phy_rx_iq_est: sampling_in_progress
CONSOLE: 026759.167 wlc_phy_rx_iq_est: sampling_in_progress
CONSOLE: 026759.167 wlc_phy_rx_iq_est: sampling_in_progress
CONSOLE: 026759.167 wlc_phy_rx_iq_est: sampling_in_progress
CONSOLE: 026759.167 wlc_phy_rx_iq_est: sampling_in_progress

uname`uname -a
Linux K3B 2.6.36.4brcmarm #6 SMP PREEMPT Sat May 8 18:11:48 CST 2021 armv7l unknown

once in serial

Default IP is 192.168.2.1/24
So put your tftp server in 192.168.2.10 for example

cd /tmp
tftp -g -r openwrt.trx
cat openwrt.trx > /dev/mtdblock6 && reboot
1 Like

openwrt 21.02 kernel log:

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.4.188 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16554-1d4dea6d4f)) #0 SMP Sat Apr 16 12:59:34 2022
[    0.000000] CPU: ARMv7 Processor [413fc090] revision 0 (ARMv7), cr=10c5387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt: Machine model: Phicomm K3
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] Hit pending asynchronous external abort (FSR=0x00001c06) during first unmask, this is most likely caused by a firmware/bootloader bug.
[    0.000000] On node 0 totalpages: 131072
[    0.000000]   Normal zone: 288 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 32768 pages, LIFO batch:7
[    0.000000]   HighMem zone: 98304 pages, LIFO batch:31
[    0.000000] percpu: Embedded 14 pages/cpu s26764 r8192 d22388 u57344
[    0.000000] pcpu-alloc: s26764 r8192 d22388 u57344 alloc=14*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 130784
[    0.000000] Kernel command line: console=ttyS0,115200
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 511764K/524288K available (5206K kernel code, 154K rwdata, 732K rodata, 1024K init, 291K bss, 12524K reserved, 0K cma-reserved, 393216K highmem)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] L2C: DT/platform modifies aux control register: 0x0a130000 -> 0x3a530000
[    0.000000] L2C-310 enabling early BRESP for Cortex-A9
[    0.000000] L2C-310 full line of zeros enabled for Cortex-A9
[    0.000000] L2C-310 ID prefetch enabled, offset 1 lines
[    0.000000] L2C-310 dynamic clock gating enabled, standby mode enabled
[    0.000000] L2C-310 cache controller enabled, 16 ways, 256 kB
[    0.000000] L2C-310: CACHE_ID 0x410000c8, AUX_CTRL 0x7e530001
[    0.000000] random: get_random_bytes called from 0xc0700cfc with crng_init=0
[    0.000007] sched_clock: 64 bits at 700MHz, resolution 1ns, wraps every 4398046511103ns
[    0.000020] clocksource: arm_global_timer: mask: 0xffffffffffffffff max_cycles: 0xa17102bcf3, max_idle_ns: 440795224838 ns
[    0.000037] Switching to timer-based delay loop, resolution 1ns
[    0.000193] Calibrating delay loop (skipped), value calculated using timer frequency.. 1400.00 BogoMIPS (lpj=7000000)
[    0.000201] pid_max: default: 32768 minimum: 301
[    0.000294] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.000300] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.000837] CPU: Testing write buffer coherency: ok
[    0.000867] CPU0: Spectre v2: using BPIALL workaround
[    0.001105] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[    0.001465] Setting up static identity map for 0x100000 - 0x10003c
[    0.001573] rcu: Hierarchical SRCU implementation.
[    0.001778] smp: Bringing up secondary CPUs ...
[    0.002341] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
[    0.002347] CPU1: Spectre v2: using BPIALL workaround
[    0.002437] smp: Brought up 1 node, 2 CPUs
[    0.002444] SMP: Total of 2 processors activated (2800.00 BogoMIPS).
[    0.002449] CPU: WARNING: CPU(s) started in wrong/inconsistent modes (primary CPU mode 0x13)
[    0.002452] CPU: This may indicate a broken bootloader or firmware.
[    0.004026] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.004044] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.004153] pinctrl core: initialized pinctrl subsystem
[    0.004784] NET: Registered protocol family 16
[    0.005276] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.016583] clocksource: Switched to clocksource arm_global_timer
[    0.017129] thermal_sys: Registered thermal governor 'step_wise'
[    0.017545] NET: Registered protocol family 2
[    0.017679] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.018137] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.018159] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.018171] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.018184] TCP: Hash tables configured (established 1024 bind 1024)
[    0.018258] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.018281] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.018410] NET: Registered protocol family 1
[    0.018439] PCI: CLS 0 bytes, default 64
[    0.019424] workingset: timestamp_bits=14 max_order=17 bucket_order=3
[    0.023326] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.023339] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.024185] bounce: pool size: 64 pages
[    0.024247] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    0.026637] ns-pinmux 1800c100.cru:pinctrl: invalid resource
[    0.026651] ns-pinmux 1800c100.cru:pinctrl: Failed to map pinctrl regs
[    0.026668] ns-pinmux: probe of 1800c100.cru:pinctrl failed with error -22
[    0.027078] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.028492] printk: console [ttyS0] disabled
[    0.028559] 18000300.serial: ttyS0 at MMIO 0x18000300 (irq = 18, base_baud = 7812500) is a 16550
[    0.514144] printk: console [ttyS0] enabled
[    0.519009] bcm2835-rng 18004000.rng: hwrng registered
[    0.524732] nand: device found, Manufacturer ID: 0xec, Chip ID: 0xf1
[    0.531129] nand: Samsung NAND 128MiB 3,3V 8-bit
[    0.535754] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    0.543354] iproc_nand 18028000.nand-controller: detected 128MiB total, 128KiB blocks, 2KiB pages, 16B OOB, 8-bit, BCH-4
[    0.554263] Scanning device for bad blocks
[    0.576831] random: fast init done
[    0.865298] Bad eraseblock 515 at 0x000004060000
[    1.080234] Bad eraseblock 873 at 0x000006d20000
[    1.170759] crng init done
[    1.172767] Bad eraseblock 1023 at 0x000007fe0000
[    1.178347] 4 fixed-partitions partitions found on MTD device brcmnand.0
[    1.185083] Creating 4 MTD partitions on "brcmnand.0":
[    1.190248] 0x000000000000-0x000000080000 : "boot"
[    1.195548] 0x000000080000-0x000000180000 : "nvram"
[    1.200885] 0x000000180000-0x000000400000 : "phicomm"
[    1.206346] 0x000000400000-0x000008000000 : "firmware"
[    1.213627] 2 trx partitions found on MTD device firmware
[    1.219044] Creating 2 MTD partitions on "firmware":
[    1.224051] 0x00000000001c-0x000000400000 : "linux"
[    1.229662] 0x000000400000-0x000007c00000 : "ubi"
[    1.235669] bcm_iproc 18029200.spi: using bspi-mspi mode
[    1.242038] iproc-mdio 18003000.mdio: Broadcom iProc MDIO bus at 0x0e5db017
[    1.249992] bgmac_bcma: Broadcom 47xx GBit MAC driver loaded
[    1.256126] bcma-host-soc 18000000.axi: bus0: Found chip with id 53030, rev 0x00 and package 0x00
[    1.265108] bcma-host-soc 18000000.axi: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x2A, class 0x0)
[    1.275677] bcma-host-soc 18000000.axi: bus0: bcma_of_get_irq() failed with rc=-22
[    1.275684] bcma-host-soc 18000000.axi: bus0: Core 1 found: Chipcommon B (manuf 0x4BF, id 0x50B, rev 0x05, class 0x0)
[    1.286419] bcma-host-soc 18000000.axi: bus0: bcma_of_get_irq() failed with rc=-22
[    1.286426] bcma-host-soc 18000000.axi: bus0: Core 2 found: DMA (manuf 0x4BF, id 0x502, rev 0x04, class 0x0)
[    1.296411] bcma-host-soc 18000000.axi: bus0: Core 3 found: GBit MAC (manuf 0x4BF, id 0x82D, rev 0x07, class 0x0)
[    1.306813] bcma-host-soc 18000000.axi: bus0: Core 4 found: GBit MAC (manuf 0x4BF, id 0x82D, rev 0x07, class 0x0)
[    1.317222] bcma-host-soc 18000000.axi: bus0: Core 5 found: GBit MAC (manuf 0x4BF, id 0x82D, rev 0x07, class 0x0)
[    1.327627] bcma-host-soc 18000000.axi: bus0: Core 6 found: GBit MAC (manuf 0x4BF, id 0x82D, rev 0x07, class 0x0)
[    1.337978] bcma-host-soc 18000000.axi: bus0: Core 7 found: PCIe Gen 2 (manuf 0x4BF, id 0x501, rev 0x07, class 0x0)
[    1.348509] bcma-host-soc 18000000.axi: bus0: Core 8 found: PCIe Gen 2 (manuf 0x4BF, id 0x501, rev 0x07, class 0x0)
[    1.359047] bcma-host-soc 18000000.axi: bus0: Core 9 found: PCIe Gen 2 (manuf 0x4BF, id 0x501, rev 0x07, class 0x0)
[    1.369601] bcma-host-soc 18000000.axi: bus0: bcma_of_get_irq() failed with rc=-22
[    1.369608] bcma-host-soc 18000000.axi: bus0: Core 10 found: ARM Cortex A9 core (ihost) (manuf 0x4BF, id 0x510, rev 0x07, class 0x0)
[    1.381644] bcma-host-soc 18000000.axi: bus0: Core 11 found: USB 2.0 (manuf 0x4BF, id 0x504, rev 0x07, class 0x0)
[    1.392020] bcma-host-soc 18000000.axi: bus0: Core 12 found: USB 3.0 (manuf 0x4BF, id 0x505, rev 0x07, class 0x0)
[    1.402409] bcma-host-soc 18000000.axi: bus0: bcma_of_get_irq() failed with rc=-22
[    1.402416] bcma-host-soc 18000000.axi: bus0: Core 13 found: SDIO3 (manuf 0x4BF, id 0x503, rev 0x01, class 0x0)
[    1.412621] bcma-host-soc 18000000.axi: bus0: bcma_of_get_irq() failed with rc=-22
[    1.412628] bcma-host-soc 18000000.axi: bus0: Core 14 found: I2S (manuf 0x4BF, id 0x834, rev 0x03, class 0x0)
[    1.422656] bcma-host-soc 18000000.axi: bus0: bcma_of_get_irq() failed with rc=-22
[    1.422662] bcma-host-soc 18000000.axi: bus0: Core 15 found: ARM Cortex A9 JTAG (manuf 0x4BF, id 0x506, rev 0x01, class 0x0)
[    1.434006] bcma-host-soc 18000000.axi: bus0: bcma_of_get_irq() failed with rc=-22
[    1.434012] bcma-host-soc 18000000.axi: bus0: Core 16 found: Denali DDR2/DDR3 memory controller (manuf 0x4BF, id 0x507, rev 0x01, class 0x0)
[    1.446741] bcma-host-soc 18000000.axi: bus0: bcma_of_get_irq() failed with rc=-22
[    1.446747] bcma-host-soc 18000000.axi: bus0: Core 17 found: ROM (manuf 0x4BF, id 0x508, rev 0x08, class 0x0)
[    1.456805] bcma-host-soc 18000000.axi: bus0: Core 18 found: NAND flash controller (manuf 0x4BF, id 0x509, rev 0x01, class 0x0)
[    1.468411] bcma-host-soc 18000000.axi: bus0: bcma_of_get_irq() failed with rc=-22
[    1.468418] bcma-host-soc 18000000.axi: bus0: Core 19 found: SPI flash controller (manuf 0x4BF, id 0x50A, rev 0x01, class 0x0)
[    1.479876] bcma-host-soc 18000000.axi: bus0: Flash type not supported
[    1.525282] bcma-host-soc 18000000.axi: bus0: Using SPROM revision 8 provided by platform.
[    1.525488] bgmac_bcma bcma0:3: Found PHY addr: 30 (NOREGS)
[    1.531096] bgmac_bcma bcma0:3: Support for Roboswitch not implemented
[    1.543634] b53_common: found switch: BCM53012, rev 0
[    1.549343] bgmac_bcma bcma0:4: Found PHY addr: 0
[    1.554077] bgmac_bcma bcma0:4: Support for Roboswitch not implemented
[    1.560619] bgmac_bcma bcma0:4: Invalid MAC addr: 00:00:00:00:00:00
[    1.566909] bgmac_bcma bcma0:4: Using random MAC: c2:af:7a:70:2e:67
[    1.574483] bgmac_bcma bcma0:5: Found PHY addr: 0
[    1.579209] bgmac_bcma bcma0:5: Support for Roboswitch not implemented
[    1.585789] bgmac_bcma bcma0:5: Invalid MAC addr: 00:00:00:00:00:00
[    1.592076] bgmac_bcma bcma0:5: Using random MAC: ea:0e:7f:59:95:82
[    1.599614] bgmac_bcma bcma0:6: Unsupported core_unit 3
[    1.604919] bgmac_bcma: probe of bcma0:6 failed with error -524
[    1.732349] pcie_iproc_bcma bcma0:7: link: UP
[    1.736803] pcie_iproc_bcma bcma0:7: PCI host bridge to bus 0000:00
[    1.743104] pci_bus 0000:00: root bus resource [mem 0x08000000-0x0fffffff]
[    1.749998] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.757951] pci 0000:00:00.0: [14e4:d612] type 01 class 0x060400
[    1.763983] pci_bus 0000:00: 2-byte config write to 0000:00:00.0 offset 0x4 may corrupt adjacent RW1C bits
[    1.773660] pci_bus 0000:00: 2-byte config write to 0000:00:00.0 offset 0x4 may corrupt adjacent RW1C bits
[    1.783346] pci_bus 0000:00: 2-byte config write to 0000:00:00.0 offset 0x1c may corrupt adjacent RW1C bits
[    1.793114] pci_bus 0000:00: 2-byte config write to 0000:00:00.0 offset 0x1c may corrupt adjacent RW1C bits
[    1.802885] pci_bus 0000:00: 2-byte config write to 0000:00:00.0 offset 0x3e may corrupt adjacent RW1C bits
[    1.812678] pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
[    1.818786] pci_bus 0000:00: 2-byte config write to 0000:00:00.0 offset 0x4c may corrupt adjacent RW1C bits
[    1.829136] pci_bus 0000:00: 2-byte config write to 0000:00:00.0 offset 0x3e may corrupt adjacent RW1C bits
[    1.838920] pci_bus 0000:00: 2-byte config write to 0000:00:00.0 offset 0x4 may corrupt adjacent RW1C bits
[    1.848602] pci_bus 0000:00: 1-byte config write to 0000:00:00.0 offset 0xc may corrupt adjacent RW1C bits
[    1.858277] PCI: bus0: Fast back to back transfers disabled
[    1.863868] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.871889] pci_bus 0000:00: 2-byte config write to 0000:00:00.0 offset 0x3e may corrupt adjacent RW1C bits
[    1.881760] pci 0000:01:00.0: [14e4:4365] type 00 class 0x028000
[    1.887826] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x00007fff 64bit]
[    1.894645] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x007fffff 64bit]
[    1.901455] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x000fffff 64bit pref]
[    1.908779] pci 0000:01:00.0: supports D1 D2
[    1.913610] PCI: bus1: Fast back to back transfers disabled
[    1.919199] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    1.925841] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[    1.932492] pci 0000:00:00.0: BAR 8: assigned [mem 0x08000000-0x08bfffff]
[    1.939293] pci 0000:00:00.0: BAR 9: assigned [mem 0x08c00000-0x08cfffff 64bit pref]
[    1.947065] pci 0000:01:00.0: BAR 2: assigned [mem 0x08000000-0x087fffff 64bit]
[    1.954399] pci 0000:01:00.0: BAR 4: assigned [mem 0x08c00000-0x08cfffff 64bit pref]
[    1.962166] pci 0000:01:00.0: BAR 0: assigned [mem 0x08800000-0x08807fff 64bit]
[    1.969497] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.974478] pci 0000:00:00.0:   bridge window [mem 0x08000000-0x08bfffff]
[    1.981280] pci 0000:00:00.0:   bridge window [mem 0x08c00000-0x08cfffff 64bit pref]
[    2.102349] pcie_iproc_bcma bcma0:8: link: UP
[    2.106805] pcie_iproc_bcma bcma0:8: PCI host bridge to bus 0001:00
[    2.113102] pci_bus 0001:00: root bus resource [mem 0x20000000-0x27ffffff]
[    2.119996] pci_bus 0001:00: No busn resource found for root bus, will use [bus 00-ff]
[    2.127947] pci 0001:00:00.0: [14e4:d612] type 01 class 0x060400
[    2.134020] pci 0001:00:00.0: PME# supported from D0 D3hot D3cold
[    2.140688] PCI: bus0: Fast back to back transfers disabled
[    2.146291] pci 0001:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    2.154425] pci 0001:01:00.0: [14e4:4365] type 00 class 0x028000
[    2.160476] pci 0001:01:00.0: reg 0x10: [mem 0x00000000-0x00007fff 64bit]
[    2.167293] pci 0001:01:00.0: reg 0x18: [mem 0x00000000-0x007fffff 64bit]
[    2.174104] pci 0001:01:00.0: reg 0x20: [mem 0x00000000-0x000fffff 64bit pref]
[    2.181449] pci 0001:01:00.0: supports D1 D2
[    2.186288] PCI: bus1: Fast back to back transfers disabled
[    2.191880] pci_bus 0001:01: busn_res: [bus 01-ff] end is updated to 01
[    2.198519] pci_bus 0001:00: busn_res: [bus 00-ff] end is updated to 01
[    2.205171] pci 0001:00:00.0: BAR 8: assigned [mem 0x20000000-0x20bfffff]
[    2.211973] pci 0001:00:00.0: BAR 9: assigned [mem 0x20c00000-0x20cfffff 64bit pref]
[    2.219744] pci 0001:01:00.0: BAR 2: assigned [mem 0x20000000-0x207fffff 64bit]
[    2.227077] pci 0001:01:00.0: BAR 4: assigned [mem 0x20c00000-0x20cfffff 64bit pref]
[    2.234848] pci 0001:01:00.0: BAR 0: assigned [mem 0x20800000-0x20807fff 64bit]
[    2.242181] pci 0001:00:00.0: PCI bridge to [bus 01]
[    2.247157] pci 0001:00:00.0:   bridge window [mem 0x20000000-0x20bfffff]
[    2.253963] pci 0001:00:00.0:   bridge window [mem 0x20c00000-0x20cfffff 64bit pref]
[    2.382345] pcie_iproc_bcma bcma0:9: PHY or data link is INACTIVE!
[    2.388541] pcie_iproc_bcma bcma0:9: no PCIe EP device detected
[    2.394475] pcie_iproc_bcma bcma0:9: PCIe controller setup failed
[    2.401360] bcm47xx-wdt bcm47xx-wdt.0: BCM47xx Watchdog Timer enabled (30 seconds, Software Timer)
[    2.410402] bcma-host-soc 18000000.axi: bus0: Bus registered
[    2.416967] NET: Registered protocol family 10
[    2.422253] Segment Routing with IPv6
[    2.426021] NET: Registered protocol family 17
[    2.430519] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.443518] 8021q: 802.1Q VLAN Support v1.8
[    2.447752] Registering SWP/SWPB emulation handler
[    2.456008] UBI: auto-attach mtd5
[    2.459343] ubi0: attaching mtd5
[    3.077859] ubi0: scanning is finished
[    3.090274] ubi0: attached mtd5 (name "ubi", size 120 MiB)
[    3.095804] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.102698] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.109499] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.116477] ubi0: good PEBs: 957, bad PEBs: 3, corrupted PEBs: 0
[    3.122498] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    3.129738] ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1650113974
[    3.138888] ubi0: available PEBs: 0, total reserved PEBs: 957, PEBs reserved for bad PEB handling: 17
[    3.148166] ubi0: background thread "ubi_bgt0d" started, PID 483
[    3.155017] block ubiblock0_0: created from ubi0:0(rootfs)
[    3.160524] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem
[    3.170406] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    3.178350] Freeing unused kernel memory: 1024K
[    3.222421] Run /sbin/init as init process
[    3.425946] init: Console is alive
[    3.429489] init: - watchdog -
[    3.666978] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.734126] usbcore: registered new interface driver usbfs
[    3.739676] usbcore: registered new interface driver hub
[    3.745067] usbcore: registered new device driver usb
[    3.752471] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    3.759595] ehci-fsl: Freescale EHCI Host controller driver
[    3.766603] ehci-platform: EHCI generic platform driver
[    3.773848] ehci-platform 18021000.usb: EHCI Host Controller
[    3.779544] ehci-platform 18021000.usb: new USB bus registered, assigned bus number 1
[    3.781960] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    3.787572] ehci-platform 18021000.usb: irq 37, io mem 0x18021000
[    3.794342] ohci-platform: OHCI generic platform driver
[    3.805144] ohci-platform 18022000.usb: Generic Platform OHCI controller
[    3.811904] ohci-platform 18022000.usb: new USB bus registered, assigned bus number 2
[    3.819831] ohci-platform 18022000.usb: irq 37, io mem 0x18022000
[    3.832412] ehci-platform 18021000.usb: USB 2.0 started, EHCI 1.00
[    3.839034] hub 1-0:1.0: USB hub found
[    3.842918] hub 1-0:1.0: 2 ports detected
[    3.894581] hub 2-0:1.0: USB hub found
[    3.898427] hub 2-0:1.0: 2 ports detected
[    4.010100] xhci-hcd 18023000.usb: xHCI Host Controller
[    4.015374] xhci-hcd 18023000.usb: new USB bus registered, assigned bus number 3
[    4.022994] xhci-hcd 18023000.usb: hcc params 0x02501164 hci version 0x100 quirks 0x0000001000010010
[    4.032187] xhci-hcd 18023000.usb: irq 38, io mem 0x18023000
[    4.038473] hub 3-0:1.0: USB hub found
[    4.042345] hub 3-0:1.0: config failed, hub doesn't have any ports! (err -19)
[    4.049618] xhci-hcd 18023000.usb: xHCI Host Controller
[    4.054875] xhci-hcd 18023000.usb: new USB bus registered, assigned bus number 4
[    4.062297] xhci-hcd 18023000.usb: Host supports USB 3.0 SuperSpeed
[    4.070181] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM.
[    4.078670] hub 4-0:1.0: USB hub found
[    4.082490] hub 4-0:1.0: 1 port detected
[    4.087730] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.102548] init: - preinit -
[    5.068640] bgmac_bcma bcma0:3 eth0: Link is Up - 1Gbps/Full - flow control off
[    5.076260] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    5.082883] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[    9.214343] UBIFS (ubi0:1): Mounting in unauthenticated mode
[    9.220142] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 646
[    9.267954] UBIFS (ubi0:1): recovery needed
[    9.388475] UBIFS (ubi0:1): recovery completed
[    9.393021] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[    9.400864] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    9.410808] UBIFS (ubi0:1): FS size: 113516544 bytes (108 MiB, 894 LEBs), journal size 5713920 bytes (5 MiB, 45 LEBs)
[    9.421444] UBIFS (ubi0:1): reserved for root: 4952683 bytes (4836 KiB)
[    9.428078] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 75A6AB2E-E9B0-4BEA-AE24-EB4DE165E245, small LPT model
[    9.445131] mount_root: switching to ubifs overlay
[    9.458498] urandom-seed: Seeding with /etc/urandom.seed
[    9.553648] procd: - early -
[    9.556589] procd: - watchdog -
[   10.082437] procd: - watchdog -
[   10.119612] procd: - ubus -
[   10.183816] procd: - init -
[   10.515912] urngd: v1.0.2 started.
[   10.516322] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.567210] Loading modules backported from Linux version v5.10.110-0-g3238bffaf992
[   10.574918] Backport generated by backports.git v5.10.110-1-0-g1fbde860
[   10.591107] xt_time: kernel timezone is -0000
[   10.609248] PPP generic driver version 2.4.2
[   10.614331] NET: Registered protocol family 24
[   10.627581] usbcore: registered new interface driver brcmfmac
[   10.633521] pci_generic_config_write32: 50 callbacks suppressed
[   10.633532] pci_bus 0000:01: 1-byte config write to 0000:01:00.0 offset 0x3c may corrupt adjacent RW1C bits
[   10.649272] pci 0000:00:00.0: enabling device (0140 -> 0142)
[   10.654959] pci_bus 0000:00: 2-byte config write to 0000:00:00.0 offset 0x4 may corrupt adjacent RW1C bits
[   10.664644] pci_bus 0000:00: 2-byte config write to 0000:00:00.0 offset 0x4 may corrupt adjacent RW1C bits
[   10.674329] brcmfmac 0000:01:00.0: enabling device (0140 -> 0142)
[   10.680436] pci_bus 0000:01: 2-byte config write to 0000:01:00.0 offset 0x4 may corrupt adjacent RW1C bits
[   10.690125] pci_bus 0000:01: 2-byte config write to 0000:01:00.0 offset 0x4 may corrupt adjacent RW1C bits
[   10.870144] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4366c-pcie for chip BCM4366/4
[   11.092290] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac4366c-pcie.phicomm,k3.txt failed with error -2
[   11.103175] brcmfmac 0000:01:00.0: Direct firmware load for brcm/brcmfmac4366c-pcie.txt failed with error -2
[   11.462808] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4366c-pcie for chip BCM4366/4
[   11.471553] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
[   11.482837] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4366/4 wl0: Nov  5 2018 03:19:56 version 10.28.2 (r769115) FWID 01-d2cbb8fd
[   11.504001] pci_bus 0001:01: 1-byte config write to 0001:01:00.0 offset 0x3c may corrupt adjacent RW1C bits
[   11.513846] pci 0001:00:00.0: enabling device (0140 -> 0142)
[   11.519540] pci_bus 0001:00: 2-byte config write to 0001:00:00.0 offset 0x4 may corrupt adjacent RW1C bits
[   11.529287] pci_bus 0001:00: 2-byte config write to 0001:00:00.0 offset 0x4 may corrupt adjacent RW1C bits
[   11.538997] brcmfmac 0001:01:00.0: enabling device (0140 -> 0142)
[   11.545131] pci_bus 0001:01: 2-byte config write to 0001:01:00.0 offset 0x4 may corrupt adjacent RW1C bits
[   11.554858] pci_bus 0001:01: 2-byte config write to 0001:01:00.0 offset 0x4 may corrupt adjacent RW1C bits
[   11.740227] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4366c-pcie for chip BCM4366/4
[   11.751796] brcmfmac 0001:01:00.0: Direct firmware load for brcm/brcmfmac4366c-pcie.phicomm,k3.txt failed with error -2
[   11.762688] brcmfmac 0001:01:00.0: Direct firmware load for brcm/brcmfmac4366c-pcie.txt failed with error -2
[   12.122802] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4366c-pcie for chip BCM4366/4
[   12.131513] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
[   12.142797] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4366/4 wl0: Nov  5 2018 03:19:56 version 10.28.2 (r769115) FWID 01-d2cbb8fd
[   12.170743] kmodloader: done loading kernel modules from /etc/modules.d/*
[   14.938956] br-lan: port 1(eth0.1) entered blocking state
[   14.944471] br-lan: port 1(eth0.1) entered disabled state
[   14.950213] device eth0.1 entered promiscuous mode
[   14.955032] device eth0 entered promiscuous mode
[   14.960260] bgmac_bcma bcma0:3 eth0: Link is Up - 1Gbps/Full - flow control off
[   14.970956] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   14.994994] br-lan: port 1(eth0.1) entered blocking state
[   15.000452] br-lan: port 1(eth0.1) entered forwarding state
[   15.048939] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
1 Like

Reasons to not use Wavlink firmware:

Phicomm went bankrupt in 2018, every firmware release since has a cryptographic backdoor.

Wavlink may have rebranded the model but the above is a concern.

1 Like

I'm planning to get all the hardware to flash this router, I should receive the serial TTL to USB adapter tomorrow.

What else do I need? This'd be the first time I'm fiddling with TFTP and whatnot.

Usb to ttl
Baudrate 115200 8n1 flow off
I used putty for the serial connection
Tftpd64 for the tftp server
Ethernet cable between board and pc

1 Like

VCC doesn't need to be connected

1 Like

I managed to successfully install openwrt through the serial connection. I had to install putty among all the Linux dedicated programs I tried, it worked right away.

Wireless performance with the official openwrt build is quite underwhelming, since it’s Broadcom.
It gets way better with other custom firmwares.
Still, I can’t get fast roaming to work with the other openwrt dumb AP in my house, so probably I’m giving it to my parents for their place.
It has really strong Wi-Fi capabilities.

I have plenty of pictures and details, I might update the wiki page with proper disassembly tips.

1 Like

Which openwrt build did you use?
The stock firmware disables gr0, the only openwrt build that does the same so far is 22.03 rc6.

https://git.openwrt.org/?p=openwrt/openwrt.git;a=commitdiff;h=5359a8ca382f473e2f671f6ed6f22e9d811c80cf

By custom firmware do you mean the asuswrt Merlin Ng build?

I’m referring to LEDE. I was looking for GitHub repos that matched “phicomm k3” and I stumbled upon a bunch of LEDE forks. It’s a fork of openwrt, actively maintained by Eastern People (Asia).

The reason why LEDE wireless performance is better is the included closed source firmwares, something you will never see in openwrt, where reverse engineering is preferred.

LEDE is Openwrt.

About six years ago, several openwrt developers forked Openwrt, and released four releases in 2017, whatever happened, LEDE and Openwrt merged back together in 2018

You can add the proprietary driver to the current release of Openwrt, I would not recommend running something from five years ago

1 Like

Root Shell possibility:

1 Like