Support for Easybox 904 LTE

How to build image from this link
I follow this Build Instructions:
git clone Easybox-904-XDSL cd Easybox-904-XDSL ./scripts/feeds update && ./scripts/feeds install -a cp vr9_default.config .config make oldconfig make V=s

But I can't build image. I got error always:

make[2]: *** [package/feeds/packages/bash/compile] Error 2
make[2]: Leaving directory '/Openwrt/Easybox-904-XDSL-master-lede-plonk/Easybox-904-XDSL-master-lede'
package/Makefile:103: recipe for target '/Openwrt/Easybox-904-XDSL-master-lede-plonk/Easybox-904-XDSL-master-lede/staging_dir/target-mips_24kc_musl/stamp/.package_compile' failed
make[1]: *** [/Openwrt/Easybox-904-XDSL-master-lede-plonk/Easybox-904-XDSL-master-lede/staging_dir/target-mips_24kc_musl/stamp/.package_compile] Error 2
make[1]: Leaving directory '/Openwrt/Easybox-904-XDSL-master-lede-plonk/Easybox-904-XDSL-master-lede'
/Openwrt/Easybox-904-XDSL-master-lede-plonk/Easybox-904-XDSL-master-lede/include/ recipe for target 'world' failed
make: *** [world] Error 2

How to solve this error?

About: "reboots without console output"
Can i happen that the NAND-flash/UBI-FS do not correct work ?

I have month before strange errors like in some config files only dump characters, but on the tar.xz root they are intact, and other error messages that looks for reason NAND-flash.
Now i have build an "full working image" again and i get a bootloop Reason:
My /etc/init.d/asterisk make some chmod and chown commands.
I find out if i try to chmod a bigger file the Router hangs until the moment where the watchdog reboots.

A question are is this an generel kernel problem, but in combination with NAND UBI Lantiq f2fs USB-Storage.
Or is this a special Device problem (or a special problem only on my devide). And is this a different problem from the "reboots without any output" describe in post before

My next problem are strace make always an segment fault (It sucks so much)

Any suggestions how can i find out was going wrong ?

is there a connection beetween:

I do some tests and it looks that the router hangs every time when i try to change bigger files that exist from the beginnig, but only on Firmwares with Telefonsupport.
It shows no error logs and it hangs up to the time where the watchdog restart the router (i try 60s timeout too but it does not help).
I try it with and without my patch, i fear this problem exist since months.

It will be nice if somewhere can confirm it.
because it is possible only my Router or only this Model or all Lantiq router with NAND and Telephon support or whatever.
And i am not 100% shure if it sealable because i get confused easily when i have reinstall so much times.

Did somewhere know how can i enable the pr_debug(..) messages inside the kernelcode.
It stands here:
But i do not understand or better how does it concret works on openwrt ?

Here is the complete Image and reposatory:
But note the sysupgrade image brings the router to a bootloop, but with the extra kernel image is it possible to start rootfs from USB-stick.

put the following unpacked archives to ./repo_owrt/ss20190311-214704r0/packages/mips_24kc/*
SHA 256 sums:
71705c616c523e97cf6d1b7abea465f9eb82a0f9b260f34e7260c83a4ba63c59 ./luci-ss20190311-214704.tar.xz
4a88c1cf55d7ed9d4b3c631787dfa0da46012d35d080d1bdf28ca272c48462fb ./repo_root-ss20190311-214704.tar.xz
8e06e4a7322b38a6f44cf96399101bba061b2761e88e3771d761a13754f59dea ./routing-ss20190311-214704.tar.xz
a0993b9214c3ce1643e6d718c52ca549f0a2e9815eb38d7c64c142d104134cac ./eb904-ss20190311-214704.tar.xz
0e23601229c28775c4834fc84af5ab7f7d6eaae3cb41c61dbdcec6bc558bc88c ./eb904_feedfix-ss20190311-214704.tar.xz
308d270e128048efb7a33d2582c530fa9348bcde207c63bca0c3a7afdf3071aa ./raspberry-ss20190311-214704.tar.xz
5dfd4f6cf8f0f7494090701a97f2e4365abb1cea5d55e702951f98ab39af4d09 ./packages-ss20190311-214704.tar.xz
f8061eff2c8b3e94e92aa919c7aa71f3e33775530cc7e90e70b19466d58c74c9 ./base-ss20190311-214704.tar.xz
523423771041239193db20892479237809d7ba28daa08e583234580e4f66422d ./telephony-ss20190311-214704.tar.xz
f7e3c66743254e3dc89dd54a1a4b0c22a35d1351fa93e5a4b05061e986f72553 ./fbtft_eb904-ss20190311-214704.tar.xz
487ed8f7b8207fb9cd454ecf7d50008f23f4968d3f7e6f48603e3b89c1ffbd6e ./eb904x-owrt-ss20190311-214704-img.tar.xz

1 Like

I can confirm that the NAND-flash does not correct works.

I use a Telefon support build with the addidional bootargs: mem=116M phym=128M vpe1_load_addr=0x87e00000 vpe1_mem=2M maxvpes=1 maxtcs=1 nosmp
The problem are:
If i want to change/modifie some bigger file that exist from beginning then the Router hangs without an end, but normaly the watchdog reboot the router after 30sek.
chmod 0777 /lib/ # 602000 KiB Router crashes
chmod 0777 /usr/sbin/pppd # 170528 KiB Router crashes
chmod 0755 /lib/firmware/xcpe_581816_580B11.bin # 898952 KiB Router crashes
chmod 0777 /usr/lib/ # 60656 KiB Router crashes not

I found the reason:
It works well without the display-driver, when i install the kernelmodules again the fail happen again.

I was not know that exist a connection between display and flash, but later i read this:
But i have not the know how to fix this Error. @Developers please help

OK the reason looks these commit:
because i looks working witout it.
(I test only if /dev/fb0 exist and if i can change bigger files)

So i have mix the old and the new and it looks that i have fix the NAND-flash blocking on Telphon support use.
( write_reg_nolock(..) for SMP use and the old write_reg(..) for nosmp.
But without knowing what i am doing. The old developer had certainly thought something about it.
It will be cool if he can explain it.
I have put all driver together that missed in Openwrt for this device. (touchpat, wifi, and display)


Can somewhere explain why devmem needed at wlan driver and how can be removed.
Because when the device are upstream,
i think the images will be build by a the "default" xrx200 device which will build all images (is this correct)
And here no devmem are enable right ?
I thing it is not usefull to have an image that can not be used with the wifidriver.


@QAuge i have do an pulrequest for adding Easybox-904xDSL by using the single commits as you say.
I split them into main and uboot

1 Like

Any news ongoing with this situation?

My github account was short time flagged, but now it is public.
PR to openwrt are here: main and uboot
The pullrequests needs reviewer.
In my personal opinium and with my small know how in programming, it is OK.
the does not work correct / need work

General, all works without ISDN, but i have not test the stability longer 24h.
The default build at the moment is with SMP support, but without Telephon (VMMC) support.
But if the pullrequest will be accepted, it is nessasary to build your own image too, if you want all working drivers.

  • For the display the build must contain: Videosupport and the kmod-fb-tft module
    for this it is usefull to install this PR: because if not the build stops and need Kernelparameter.
  • For Wifi it need devmem support inside kernel and busybox
    ( can somewhere eplain why ? I guess that values inside the binary FW for the ralink-wifi will be changed in RAM ? )

For building you can use
or the both publish PR main and uboot

For the Wifi, touchpad and display the drivers are here:
These Drivers are not in the PR because they need work, but they are working (read this thread about it).

For the more ore less required userspace packages specialy "lcd4linux" use this feed:

For telefon support change the bootargs manuelly before build or better use these patches:
main-split-in-SMP-VPE.patch and uboot-split-in-SMP-VPE.patch
These patches split into two images one with SMP and one with Telefon support, the good thing are if you do that, the Imagebuilder contain both variants and you can later after build use them to create an changed image with or witout SMP/Telefon support.

The code for xrx200 devices are not perfect in generell for more speed read here:

and here:

In the last threads you can find kernel patches for speed up, if you use them you must replace the default 4027-* patch by 4027-NET-MIPS-lantiq-support-fixed-link-incl-patch-904.patch
And if you want the 34kc arch instead the default 24kc Arch use this

I have used this diffconfig
note the the bootloader in this config make a higher CPU and RAM speed them normal (CONFIG_UBOOT_CONFIG_VR9_CPU_600M_RAM_300M=y) and it is untested.

for building i use this scripts:
in the first step i make an minimal build from source without extra packages:


# prepare build look i these nessasary
git config --global ""; git config --global "Your Name" # for merging into your local branch
cd /opt/build # your build directory
rm -r ./openwrt # delete openwrt directory if exist (not nessasary if not exist)

# clone openwrt source and create a new branch called: eb904x
git clone
cd openwrt
git checkout -b eb904x

# install main pullrequest in branch eb904x 
git fetch origin pull/2060/head:pr001-eb904x
git rebase eb904x pr001-eb904x
git checkout eb904x
git merge pr001-eb904x

# install uboot pullrequest in branch eb904x 
git fetch origin pull/2061/head:pr002-eb904x_uboot
git rebase eb904x pr002-eb904x_uboot
git checkout eb904x
git merge pr002-eb904x_uboot

# add missed some extra kernelconfigparameter for videosupport
# without it the build stops and ask for the parameter
git fetch origin pull/1885/head:pullreq
git rebase eb904x pullreq
git checkout eb904x
git merge pullreq

# download and install split-into a SMP and VPE version patches
mkdir ./dl
rm -r ./dl; ln -sv /mnt/mapper/sda3/openwrt-source-dl dl # if you collect the whole openwrtsource like me inside /mnt/mapper/sda3/openwrt-source-dl use this line
cd ./dl
wget -O main-split-in-SMP-VPE.patch
wget -O uboot-split-in-SMP-VPE.patch
cd ..
git am < ./dl/main-split-in-SMP-VPE.patch
git am < ./dl/uboot-split-in-SMP-VPE.patch

# download and install patches for increase the ethernet speed
cd ./target/linux/lantiq/patches-4.14
wget -O 0901-add-icu-smp-support.patch
wget -O 0902-enable-external-irqs-for-second-vpe.patch
wget -O 0903-add-icu1-node-for-smp.patch

wget -O 0904-backport-vanilla-eth-driver.patch
wget -O 0905-increase-dma-descriptors.patch
wget -O 0906-increase-dma-burst-size.patch

rm -v 4027-*
wget -O 4027-NET-MIPS-lantiq-support-fixed-link-incl-patch-904.patch
cd ../../../..

# this patch uses the 34Kc architecture for buildind instead of the defauld and older 24kc (not usefull because the packages are all 24kc)
#cd ./dl
#wget -O xrx200-use-34kc.patch
#cd ..
#patch -p1 < ./dl/xrx200-use-34kc.patch

# Change to your device: 
#	Target System = Lantiq / Suptarget = XRX200 / Target Profile = Easybox 904
# for later Display support: 
#	Global build settings  ---> / [*] Select all target specific packages by default
#	Global build settings  ---> / [*] Show packages that require graphics support (local or remote)
# for later Wifi support you need devmem support: 
# 	Global build settings  ---> / Kernel build options  ---> / [*] /dev/mem virtual device support
#	Base system  ---> / <*> busybox / [*] Customize busybox options / Miscellaneous Utilities  ---> / [*] devmem
# enable the easybox bootloader
# 	Boot Loaders  ---> / [*] u-boot-easybox904	
# eanable the SDK and the image builder
#	[*] Build the OpenWrt SDK (NEW)
# 	[*] Build the OpenWrt Image Builder
make menuconfig
make -j8 V=1 IGNORE_ERRORS=1 || make V=s IGNORE_ERRORS=1

I the next step i build the required packages that are not in openwrt for this device, with the SDK:


cd /opt/build # my build directory change if needed

rm -rf ./owrtsdk
tar -xf $(find ./openwrt/bin/targets/lantiq/xrx200/openwrt-sdk-*.tar.xz)
mv -v $(find ./openwrt-sdk-* -type d -maxdepth 0) ./owrtsdk
cd ./owrtsdk
mkdir ./dl
rm -r ./dl; ln -sv /mnt/mapper/sda3/openwrt-source-dl dl # if you collect the whole openwrtsource like me inside /mnt/mapper/sda3/openwrt-source-dl use this line

cat ./feeds.conf.default |  grep -E -v "src-git[[:blank:]]*base.*" > ./feeds.conf

# If you do not have /opt/build/openwrt change it or use this line instead but note it is better to use same openwrt source that you have used for source build. 
#echo "src-git base"
echo "src-git base file:///opt/build/openwrt" >> ./feeds.conf

echo "src-git eb904_driver" >> ./feeds.conf
echo "src-git eb904_pkg" >> ./feeds.conf

./scripts/feeds update -a

./scripts/feeds install -p eb904_driver fbtft
./scripts/feeds install -p eb904_driver touchpad
./scripts/feeds install -p eb904_driver ralink_bin
./scripts/feeds install -p eb904_driver ralink_inic

./scripts/feeds install -p eb904_pkg freetype
./scripts/feeds install -p eb904_pkg serdisplib
./scripts/feeds install -p eb904_pkg con2fbmap
./scripts/feeds install -p eb904_pkg lcd4linux-eb904
./scripts/feeds install -p eb904_pkg lcdcontroller

make -j2 IGNORE_ERRORS=1 V=1 || make -j1 IGNORE_ERRORS=1 V=s

The result are here:
shasum256 = 3001ac786e87f4fe4df1cd521756415a9569fbe73d4a34ac7b5aadef9f775d0e
shasum256 = e6ecc24ced5b395e51ab5d39ca66047d4baec2563d4a9d043e325fe25e8f0878


I can explain. On weekend. Currently haven't time.

1 Like

@kovz It will be great to find a solution for the required devmem
If the pullrequest accept, it will not much help because the standart kernel are without devmem and it will be required to make a selfbuild too.

1 Like

@Plonk34 Sorry for this delay.
First of all I have to say, that all this devmem calls just a configuring for internal Ethernet switch MAC_5 port. Basing on previous investigation, there is a description of this setup . It sets port 5 of internal switch to RGMII mode with clock 125MHz, 1G full duplex connected to external PHY wth addr 5 on mdio bus. Physically it connected to rt3883 with fake mdio address. Currently x200 ethernet driver support all this settings out of the box with fixed link phy specified as phy. Only one thing didn't exist in the driver - setting PCDU_5. We can find description for this register in original sources here
As we can see this register is responsible for Clock Delay settings. This means, that we have to add additional delay parameters to device tree and handle them in the driver.
May be this description is little bit muddied, please, do not hesitate and ask for more detailed description.

1 Like

Thanks @kovz for your reply,
I have less time too, for this reason i do a short look only,
but i understand that means devmem is not required if i implement the oldcode to the ifxmips_sw_reg.h
Or if it possible the oldcode into to the driver ?
But from where did you know the offset adresses for the values ?

Hallo everyone,
i'm very new to this. But try to setup a good openwrt for my easybox 904 xdsl.
I have 2 problems at the moment after ínstall openwrt / luci using binarys (e.g.
1.) I can't find the "Advanced Settings" tab to setup my country code or something else, to get wifi work (at the moment '00' and signal power is 0)
2.) with the ssh access, i have no command flash_eraseall, just flash_erase. Is this normal? I can use this as well to flash the uboot?
Thank you in advanced,

On the EB904, Wifi is "external" to the system and a bit of a black box. One can send commands but it won't accept all (documented) commands, and if it does it returns hardly any confirmations or status information. That's probably why LuCI cannot really show its status.

I dabbled with the EB904's Wifi some time ago, so my memory is a bit hazy. But I seem to remember that it doesn't accept all of the commands it should, "country code" being one of them. Also, it seemed like it would accept certain commands only once and never after.

I'm almost sure one could make the LuCI interface show if not the current status then at least the current configuration and allow to modify it, but noone took the time or made the effort to do so yet.

And is there an alternative way, to configure wlan on the eb904?

Or what do you recommend?

I'm also still interested in future development on this device.

What can we do to solve the issues?

Actually I'm still confused how to come to a working Box with VVDSL support, working (fast) wifi and fast switching speed between wan, lan and wifi.

Thanks @Plonk34, @kovz and @QAuge for their investigation and hard work you already put into this devil device.

I would really love to understand these whole problems with so many different devices.

Unfortunately it seems actually an unrealistic dreaming to get one fully working device with OpenWRT.

  • Even my recommended BT Hub 5A has still problems with high throughput in wifi and it's a mess to update via serial always the box.

So I don't know if this whole openwrt world is not slowly dieing because we can't get through the important (performance) doors with any device.

I would love to give more to this community than complaining within the last month, but I unfortunately can't really debug and compile whole images. I can just use the chef online builder and put things together and try out. Also soldering is OK, but when it comes to hardware acceleration implementation things in source code I can't help and it's always a hustle to find any solution for such problems instead of using somehow the original source for it...

In the meantime usually people give up and buy a FritzBox and are happy...

The performance is roughly similar between all VRX2xx devices, aside from the decision of enabling FXS ports (and thereby sacrificing a mips core to them) or retaining SMP support. So if your BT Home Hub 5 Type A isn't fast enough, the Easybox 904 xDSL won't be either (given that it has FXS ports, it will be considerably slower (55-60 MBit/s at most) - and its WLAN isn't as good as on the BTHub5 either). With the advent of super vectoring (profile 35b), the days of VRX2xx devices are numbered anyways (GRX3xx/ GRX550/ GRX750, which would support super vectoring, aren't supported by OpenWrt yet).

Unfortunately there is a big problem with drivers. I have found inic driver absolutely spontaneous! There is no datasheet for lantiq IC and most important drivers is closed. Currently I'm trying to bring up LTE version. It looks more simple than xDSL version, but still has a lot of problems. And both versions is outdated due to luck of WiFi ac standard support.

Of course, you can edit the /etc/config/wireless config file directly through the shell.

Somebody would probably have a deeper look why LuCI doesn't pick up on the settings. I reckon it's a minor thing why it currently fails to do so. As for the fact that it doesn't display the current status, I'm afraid that will not happen unless someone reverse engineers what the original firmware uses to do it. I distinctly remember that with the current means I couldn't get any status information no matter what I tried.

I have never used luci no idea if it works.
Did you mean "at the moment '00' and signal power is 0" in luci

Modifie the /etc/config/wireless via SSH and reboot the wifi via: /etc/init.d/rt3883 boot
see the /etc/init.d/rt3883 for single commands.
Some values can be change with the old iwconfig and iwpriv commands.
@kovs should correct me, but he background are it based on a very old driver time before using the default nl80211 connection of the linuxkernel.

yes it is normal flash_eraseall do not exist anymore.

flash_erase /dev/mtd0 0x0 0x2
nandwrite -p /dev/mtd0 u-boot.lq


The combination of @pc2005 patches

software flow offloading
brings 88Mbit/s from 94Mbit/s VDSL speed. (no SMP support, i use the FXS ports)

At the moment it is the only solution for VVDSL (up to profile 30a) and Telefon support i can not see that there are somthing change in the next future.
An other thing are these devices second hand are really cheap in Germany.

I do it long time too but i more and more understand why openwrt official support only wifi and ethernet.
Every time when i make an build somthing else does not correct work

At the moment the biggest problem are SQM (using the tc command) in combination with the Wifi driver reboot the devices.
(see here: SQM reboot my Router (Easybox 904xDSL))

@Plonk34 thanks for your information about the rt3884 driver.

What I don't understand is on the device is an Openwrt Backfire previous version originally and it worked quite OK, why is it than so difficult with newer versions?

@ suppenkasper0815

No idea i have no investigate it, i thing @kovs have more know how.


The kernelversion for the lantiq devices was changed from 4.14.x to 4.19.x
I modifie the pullrequest for it. (It was was simple the most kernelpatches can be leave)
I do only a short test and the Devices works in general.

The bad new is that the wifi driver does not work anymore.
First building is not possible because init_timer(..) function does not exist in 4.19
I replace by setup_timer(..)

my modified ./comm/raconfig.c
and the resulting patch

Them building are possible but it reboot the device with:
On first try (the first try differ always from the rest)

root@OpenWrt:~# ./rt3883 boot
Insmod with MAC1=4c:09:d4:15:10:54 and MAC2=4c:09:d4:15:10:56
[  354.149085] Warnning!! syncmiimac is foreced to 0 in dual concurrent mode.
[  354.154665] RT3883iNIC: 802.11n WLAN MII driver v2.4.0.6 (Feb. 09, 2011)
[  354.161435] eth0.3: Master at 0x0, 00:11:22:33:44:55
[  354.166326] Use default profile path.
[  354.169907] -----> mii_hardware_reset
[  354.183638] -----> mii_hardware_reset
[  354.185921] Update MAC(0)=4c:09:d4:15:10:54
[  354.190080] ============= Init Thread ===================
[  354.198371] RacfgTaskThread pid = 2076
[  354.200942] RacfgBacklogThread pid = 2077
[  354.206381] wl000: Ralink iNIC at 0x0, 4c:09:d4:15:10:54
[  354.213840] Ignored command_type: 1, command_id: 1 
[  354.224184] Update MAC(0)=4c:09:d4:15:10:56
[  354.226971] ============= Init Thread ===================
[  354.269925] RacfgTaskThread pid = 2082
[  354.273989] RacfgBacklogThread pid = 2084
[  354.278184] wl010: Ralink iNIC at 0x0, 4c:09:d4:15:10:56
[  354.316261] iNIC Open wl000
[  354.317759] -----> mii_hardware_reset
[  355.349509] -----> mii_hardware_reset
[  355.351738] Op mode = 1
[  355.354252] ConcurrentObj.CardCount=0
[  355.357867] Read profile[0]
[  355.363549] BssidNum=2
[  355.366144] Read profile[1]
[  355.368938] BssidNum=2
[  355.371508] rlk_inic_mbss_init (pAd->RaCfgObj.BssidNum=2)
[  355.375549] rlk_inic_mbss_init --->
[  355.379053] Register MBSSID IF (wl001)
[  355.384233] register_netdev done
[  355.386112] rlk_inic_mbss_init <---
[  355.389548] ConcurrentObj.CardCount=0 init_flag=0
[  355.394237] Wait for boot done...
[  355.397545] Call RaCfgWaitSyncRsp
[  355.402357] RACFG_CMD_BOOT_NOTIFY
[  355.404306] Firmware path iNIC/RT3883/iNIC_ap.bin
[  355.409024] Profile[0] path iNIC/RT3883/iNIC_ap.dat, read path iNIC/RT3883/iNIC_ap.dat
[  355.416904] EEPROM[0] path iNIC/RT3883/iNIC_e2p.bin, read path iNIC/RT3883/iNIC_e2p.bin
[  355.424905] Profile[1] path iNIC/RT3883/iNIC_ap1.dat, read path iNIC/RT3883/iNIC_ap1.dat
[  355.432998] EEPROM[1] path iNIC/RT3883/iNIC_e2p1.bin, read path iNIC/RT3883/iNIC_e2p1.bin
[  355.441196] Request file: iNIC/RT3883/iNIC_ap.bin
[  355.710247] Request file: iNIC/RT3883/iNIC_ap.dat
[  355.713977] Request file: iNIC/RT3883/iNIC_e2p.bin
[  355.719698] Request file: iNIC/RT3883/iNIC_ap1.dat
[  355.723805] Request file: iNIC/RT3883/iNIC_e2p1.bin
[  355.729384] Upload Profile 1024 bytes from file, 0 from extra...

> here it have no reaction if after 30 seconds ( reboot by watchdog ? )

on the 2, 3 n times:

[  159.826860] Request file: iNIC/RT3883/iNIC_ap1.dat
[  159.831331] Request file: iNIC/RT3883/iNIC_e2p1.bin
[  159.836676] Upload Profile 1024 bytes from file, 0 from extra...
[  159.841624] Unhandled kernel unaligned access[#1]:
[  159.846198] CPU: 0 PID: 1939 Comm: RaCfg Task Tainted: G         C        4.19.56 #0
[  159.853933] $ 0   : 00000000 00000001 80736360 00000001
[  159.859154] $ 4   : 80d2c9c9 86779bd4 861204a0 00000000
[  159.864376] $ 8   : 00000001 50415053 0a575041 50534b33
[  159.869598] $12   : 3d0a5750 37800000 0000013d 4150534b
[  159.874821] $16   : 00000001 86120644 806dbfe4 80736360
[  159.880043] $20   : 00040000 86779bd4 80d2c9c9 00000001
[  159.885266] $24   : 00000000 00000000                  
[  159.890488] $28   : 86778000 86779b70 00000000 80096fc4
[  159.895711] Hi    : 00000053
[  159.898584] Lo    : a8f5c3de
[  159.901476] epc   : 8054fa80 _raw_spin_lock_irqsave+0x1c/0x64
[  159.907225] ra    : 80096fc4 lock_timer_base+0x6c/0xbc
[  159.912336] Status: 1100ff02	KERNEL EXL 
[  159.916254] Cause : 00800010 (ExcCode 04)
[  159.920257] BadVA : 80d2c9c9
[  159.923130] PrId  : 00019556 (MIPS 34Kc)
[  159.927045] Modules linked in: rt3883_iNIC iptable_nat ipt_MASQUERADE xt_state xt_nat xt_conntrack xt_REDIRECT xt_FLOWOFFLOAD xt_CT pppoe nf_nat_ipv4 nf_nat nf_flow_table_hw nf_flow_table nf_conntrack_rtcache nf_conntrack ipt_REJECT xt_time xt_tcpudp xt_multiport xt_mark xt_mac xt_limit xt_comment xt_TCPMSS xt_LOG pppox ppp_async nf_reject_ipv4 nf_log_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 ltq_deu_vr9 iptable_mangle iptable_filter ip_tables drv_vmmc crc_ccitt drv_dsl_cpe_api drv_mei_cpe nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 pppoatm ppp_generic slhc br2684 atm drv_tapi drv_ifxos fb_ili9341_eb904 fbtft(C) fb_sys_fops backlight sysimgblt sysfillrect syscopyarea fb font dwc2 gpio_button_hotplug
[  159.993819] Process RaCfg Task (pid: 1939, threadinfo=bb2a0ea3, task=7c6cd506, tls=00000000)
[  160.002247] Stack : 00000000 00000001 00000000 8007ea18 00000000 ffffffe5 861204a0 80096fc4
[  160.010602]         86118ca0 86779bfc 8600f380 8600f100 86120644 8600f100 867c9bbc ffff780a
[  160.018958]         86102f84 80660000 80840000 800979c4 8600f380 8600f100 86118ca0 86779bfc
[  160.027314]         86102f84 8007f0d4 8600f380 8600f100 867c9bbc 861204a0 86102f84 80660000
[  160.035670]         80840000 86105f60 86042b94 00000400 00000000 00000000 00000000 00000001
[  160.044026]         ...
[  160.046464] Call Trace:
[  160.048911] [<8054fa80>] _raw_spin_lock_irqsave+0x1c/0x64
[  160.054314] [<80096fc4>] lock_timer_base+0x6c/0xbc
[  160.059095] [<800979c4>] mod_timer+0x94/0x1b4
[  160.063470] [<86105f60>] _append_extra_profile2+0xde4/0x1820 [rt3883_iNIC]
[  160.070325] Code: 32100001  000000c0  24030001 <c0850000> 14a00005  00000000  00600825  e0810000  1020fffa 
[  160.080060] 
[  160.081712] ---[ end trace 3ebc1fc412e9a498 ]---
[  160.089508] Kernel panic - not syncing: Fatal exception
[  160.095159] Rebooting in 3 seconds..

ROM VER: 1.1.4
CFG 06

without using of busybox memdev:

root@OpenWrt:~# ./rt3883 boot
Insmod with MAC1=4c:09:d4:15:10:54 and MAC2=4c:09:d4:15:10:56
[  113.371392] Warnning!! syncmiimac is foreced to 0 in dual concurrent mode.
[  113.376939] RT3883iNIC: 802.11n WLAN MII driver v2.4.0.6 (Feb. 09, 2011)
[  113.383726] eth0.3: Master at 0x0, 00:11:22:33:44:55
[  113.388620] Use default profile path.
[  113.392200] -----> mii_hardware_reset
[  113.405958] -----> mii_hardware_reset
[  113.408252] Update MAC(0)=4c:09:d4:15:10:54
[  113.412399] ============= Init Thread ===================
[  113.419825] RacfgTaskThread pid = 1888
[  113.422378] RacfgBacklogThread pid = 1889
[  113.427818] wl000: Ralink iNIC at 0x0, 4c:09:d4:15:10:54
[  113.442034] Update MAC(0)=4c:09:d4:15:10:56
[  113.444850] ============= Init Thread ===================
[  113.480983] RacfgTaskThread pid = 1893
[  113.487750] RacfgBacklogThread pid = 1896
[  113.491972] wl010: Ralink iNIC at 0x0, 4c:09:d4:15:10:56
[  113.524369] iNIC Open wl000
[  113.525729] -----> mii_hardware_reset
[  114.563312] -----> mii_hardware_reset
[  114.565595] Op mode = 1
[  114.568058] ConcurrentObj.CardCount=0
[  114.571674] Read profile[0]
[  114.577347] BssidNum=2
[  114.579935] Read profile[1]
[  114.582724] BssidNum=2
[  114.585286] rlk_inic_mbss_init (pAd->RaCfgObj.BssidNum=2)
[  114.589328] rlk_inic_mbss_init --->
[  114.592828] Register MBSSID IF (wl001)
[  114.597983] register_netdev done
[  114.599885] rlk_inic_mbss_init <---
[  114.603307] ConcurrentObj.CardCount=0 init_flag=0
[  114.607988] Wait for boot done...
[  114.611293] Call RaCfgWaitSyncRsp

[  154.657588] timeout(40 secs): cmd=0000 no response
[  154.660946] ERROR! can't get target's MAC address, boot fail.
> no response

Have someone any ideas ?
What is the meaning of:

[  159.907225] ra    : 80096fc4 lock_timer_base+0x6c/0xbc
[  159.912336] Status: 1100ff02	KERNEL EXL 
[  159.916254] Cause : 00800010 (ExcCode 04)