TP Link RE450 V2 - How to restore factory firmware?

1 Like

J1 seems to be the guilty one, am I right?
Have you done this before or you need some help/advise on how to proceed?

I see something that could read J1 and a small triangle that could be the TP1. According to Heinz this would be order for the serial connection then?
JP1 - Tx (triangle?)
JP2 - Rx
JP3 - Gnd
JP4 - 3v3 - leave not connected?

If you agree I would solder four pin headers in.

BUT, what exactly comes next?

I have flashed Sonoff devices before using the same USB TTL cable.

For gnd you can test is using rhe continuity probes of a multimeter. That is the safest. Or with a very good zooming at both sides verify if the pin has connection to the ground of the board (usually has 4 lines like a cross connecting the circle and the rest of the board)

Then you don't need to connect 3.3v
And while booting your board you can connect either the tx/rx (if you dont know which one is which) one by one until receive text on the screen (that will be your tx board to rx ttl connection) and then use the other cable and try to send a key and see if you see it on the screen).

But sometimes you just find using google and someone else have already found the actual pinout for the board and you can skip those steps.

Then all depends if you use windows you can use putty or minicom/screen on linux... To connect to serial-ttl.

Yes. Seems to be right. Third one has that cross to gnd. And the last one has a bigger (for voltage) line.
If doesn't work you can just switch 1 and 2 snd retry.

I will try to identify ground first, which would then identify JP3, I guess?

The rectangular box arround JI (J1) appears to be thikcer on one side. Does than mean something?

I am still struggeling with what I would do with Putty (ind Windows)? I am using putty all the time to connect to my raspberry PIs, but what would be the settings for using it with a USB TTL cable and how do I transfer the firmware? This process here: https://www.youtube.com/watch?v=ZW5fpOWpI0I does not work with teh RE450 (this was mentioned in the OpenWRT forum several times).

You can use putty as a serial terminal connecting to a COM port on windows.

This seems to be from left to right:

Tx - Rx - Gnd - 3v3

But it could also be:

Rx - Tx - Gnd - 3v3

That's is what I wanted to say.

VERY HELPFUL! I now understand, what you meant with the PCB lines. Will solder in pins and test the TTL connection via putty. Maybe no today, but sometime next week or weekend. Need to work now. Will keep you posted, how far I get with the serial connection! Greetings to Buenos Aires.

Yes we are talking of this: https://openwrt.org/docs/guide-user/troubleshooting/vendor_specific_rescue

But we can also try: https://youtu.be/AHjq68rY0UU

It's a pleasure to help! Have a nice week!

Could not resists and tried it. When I power on the RE450 all blue LEDs flash briefly once. Then they are dar. I started the unit with the reset button pressed, without the button pressed, with the reset button pressed the moment the blue LEDs flashed: no luck. I swapped the Rx Tx lines. I used Putty with the COM port selected that the USB TTL was attached to. I am unable to enter this "magic mode", where the device is looking for the firmware. I am affraid that the RE450 does not behave like the other TP link products: https://www.tp-link.com/fr-be/support/faq/844/

You also have to shorten two places, R69 near the Pin and another one at the other side of the PCB, since TP.-Link has cut some traces: TP-Link RE450 V2 ( F/W: 1.0.2 Build 20170626 Rel. 60833) - #48 by SamiHAlTer

Hello Lucky,

a year passed and I have not managed to get this to work. It would be a shame to throw this device away without making another attempt to reinstall the firmware. In your post you suggested that I needed to shorten two areas. On this page https://openwrt.org/toh/tp-link/re450 however (image section) it says: TP-Link RE450 v2 []the one I have] needs unmounted R64 & R69 0201 resistors/jumpers". Now I am confused. Does that mean I should not mount (solder) these R64 and R69, or does it mean I need to undo it after the flashing process?

Would it be possible that you help me with step by step instructions to do the full flashing process? I have flashed all kinds of devices before (ESP32, ESP8266, other MCUs), but I am struggeling with this device and I don't want to destroy it completely.

Thank you!!!

I hope this helps: Recovered bricked RE450 v1 via TFTP server and Serial connection by Arduino Uno

See

Best regards, Thomas

can you share dump from RE450v3 ? Think i need 0x20000 to 0x50000 (config) . With stripped firmware have no luck :frowning: Read (by programmer) flash and compare - boot, kernel, hsqs are same as original tp-link (re450v3_un-up-ver1-0-1-P1[20190124-rel56886) firmware , art also are ok (extender working on openwrt-22.03.0-rc1) . Thanks in advanced and sorry about my bad English .Regards !

U-Boot 1.1.4 (Jan 24 2019 - 14:02:04)

ap152 - Dragonfly 1.0

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 123k for U-Boot at: 83fe0000
Reserving 192k for malloc() at: 83fb0000
Reserving 44 Bytes for Board Info at: 83faffd4
Reserving 36 Bytes for Global Data at: 83faffb0
Reserving 128k for boot params() at: 83f8ffb0
Stack Pointer at: 83f8ff98
Now running in RAM - U-Boot at: 83fe0000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
Max resets limit reached exiting...
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x40802100
Autobooting in 1 seconds
## Booting image at 9f050000 ...
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80193920) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

Booting QCA956x
Linux version 2.6.31--LSDK-9.2.0_U5.508 (jacob@j215) (gcc version 4.3.3 (GCC) ) #1 Thu Jan 24 14:04:32 HKT 2019
flash_size passed from bootloader = 8
Ram size passed from bootloader =67108864
CPU revision is: 00019750 (MIPS 74Kc)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 root=31:3 rootfstype=squashfs init=/sbin/init mtdparts=ath-nor0:128k(u-boot),192k(config),768k(kernel),7040k(rootfs),64k(art) mem=64M
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 60584k/65536k available (1635k kernel code, 4876k reserved, 417k data, 120k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
r4k_clockevent_init: Ignoring int_usable failure
Calibrating delay loop... 387.07 BogoMIPS (lpj=774144)
Mount-cache hash table entries: 512

****************ALLOC***********************
 Packet mem: 80231440 (0x200000 bytes)
********************************************

NET: Registered protocol family 16
ath_pcibios_init: bus 0
ath_pcibios_init(255): PCI 0 CMD write: 0x356
registering PCI controller with io_map_base unset
gpio init: JUMP_START: 19, RST_DFT: 6
bio: create slab <bio-0> at 0
pcibios_map_irq: IRQ 76 for bus 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 118
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
5 cmdlinepart partitions found on MTD device ath-nor0
Creating 5 MTD partitions on "ath-nor0":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x000000050000 : "config"
0x000000050000-0x000000110000 : "kernel"
0x000000110000-0x0000007f0000 : "rootfs"
0x0000007f0000-0x000000800000 : "art"
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
Freeing unused kernel memory: 120k freed
procd: Console is alive
procd: - watchdog -
procd: - preinit -
mounting /dev/root
procd: - early -
procd: - watchdog -
procd: state_enter-103 have console
procd: state_enter-105 have console
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
xt_time: kernel timezone is -0000
nf_conntrack version 0.5.0 (1024 buckets, 5120 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
liblog: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
Netfilter messages via NETLINK v0.30.
ctnetlink v0.93: registering with nfnetlink.
reloadprofile() begin
[NM_Error](nvrammanager_readPtnFromNvram) 00661: partition name(profile) not found.


[NM_Error](nvrammanager_readPtnFromNvram) 00661: partition name(profile) not found.


[NM_Error](nvrammanager_readPtnFromNvram) 00661: partition name(profile) not found.


error no profile
reloadprofile() end
reloadconfig() begin
do uci.cursor() done!
[NM_Error](nvrammanager_readPtnFromNvram) 00661: partition name(user-config) not found.


resetconfig() begin
[NM_Error](nm_api_erasePtn) 00411: partition name(user-config) not found.


[NM_Error](nvrammanager_readPtnFromNvram) 00661: partition name(default-config) not found.


[NM_Error](nvrammanager_writePtnToNvram) 00571: file size error!


resetconfig() end
[NM_Error](nvrammanager_readPtnFromNvram) 00661: partition name(user-config) not found.


resetconfig() begin
[NM_Error](nm_api_erasePtn) 00411: partition name(user-config) not found.


[NM_Error](nvrammanager_readPtnFromNvram) 00661: partition name(default-config) not found.


[NM_Error](nvrammanager_writePtnToNvram) 00571: file size error!


resetconfig() end
[NM_Error](nvrammanager_readPtnFromNvram) 00661: partition name(user-config) not found.


error no config
reloadconfig() end
mergeconfigbycountry() begin
[NM_Error](nvrammanager_readPtnFromNvram) 00661: partition name(product-info) not found.


no country in productinfo
mergeconfigbycountry() do nothing end
device is not production models, do nothing!!!
loadRepeaterProductInfo() start
[NM_Error](nvrammanager_readPtnFromNvram) 00661: partition name(product-info) not found.


read productinfo
[NM_Error](nvrammanager_readPtnFromNvram) 00661: partition name(pin) not found.


qca_soc_gmac: Length per segment 1536
956x_GMAC: qca956x_gmac_attach
956x_GMAC: qca956x_set_gmac_caps
Currently in polling mode unit1
qca_soc_gmac: RX TASKLET - Pkts per Intr:100
MAC:1 Warning: Phy not found!!!
qca_soc_gmac: Max segments per packet :   1
qca_soc_gmac: Max tx descriptor count :   128
qca_soc_gmac: Max rx descriptor count :   128
qca_soc_gmac: Mac capability flags    :   2202
956x_GMAC: qca956x_gmac_attach
956x_GMAC: qca956x_set_gmac_caps
Currently in polling mode unit0
Registering AR8033 Phy....
qca_soc_gmac: RX TASKLET - Pkts per Intr:100
qca_soc_gmac: Max segments per packet :   1
qca_soc_gmac: Max tx descriptor count :   128
qca_soc_gmac: Max rx descriptor count :   128
qca_soc_gmac: Mac capability flags    :   2202
956x_GMAC: Serdes PLL is locked value 0x1b838116
[GPIOD][gpio_create_ibus_thread:34]create ibus thread successfully


[GPIOD][_gpio_get_system_mode:192]open /tmp/device_runtime.info file failed


[GPIOD][main:763]Error: get sysmode fail

athr_gmac_ring_alloc Allocated 2048 at 0x8385e800
sram_desc_cnt 1536,mac Unit 0,Tx r->ring_desc 0xbd000000
athr_gmac_ring_alloc Allocated 2048 at 0x8385e000
sram_desc_cnt 3072,mac Unit 0,Rx r->ring_desc 0xbd000600
956x_GMAC: eth0 in SGMII MODE
athrs_ar8033_reg_init: Done
955x_SGMIIMax resets limit reached exiting...
955x_SGMII::athr_gmac_sgmii_setup  Done
Setting Drop CRC Errors, Pause Frames and Length Error frames
Invert Set to 0
956x_GMAC: Enet Unit:0 PHY:0 is UP eth0 SGMII 100Mbps full duplex
956x_GMAC: done cfg2 0x7135 ifctl 0x10000 miictrl
955x_SGMIIMax resets limit reached exiting...
955x_SGMII::athr_gmac_sgmii_setup  Done
Setting Drop CRC Errors, Pause Frames and Length Error frames
Invert Set to 1
device eth1 entered promiscuous mode
br0: port 1(eth1) entering forwarding state
tz isUTC
[NM_Error](nvrammanager_readPtnFromNvram) 00661: partition name(soft-version) not found.


====>>>>server: 192.168.0.100
wifid[_init_hostapd_devinfo:6614]: Error in /tmp/device.info, use the default value

wifid[qca_init_platform:6785]: operation mode is 0


wifid[wifi_create_ibus_thread:40]: Create ibus thread successfully

wifid[_get_product_id:3239]: open /tmp/device.info file failed


wifid[qca_init_platform:6822]: read device.info file failed


wifid[_get_profile_info:3304]: open /tmp/device.info file failed


wifid[qca_init_platform:6825]: read profile info failed


956x_GMAC: unit 0: phy 0 not up carrier 1
br0: port 1(eth1) entering disabled state
table: 0x433a70
wpsd[wps_create_ibus_thread:43]: create ibus thread successfully
wpsd[wpsd_backup_run_mode:1248]: Error: open /tmp/device_runtime.info failed
wpsd[main:1794]: wpsd open failed.
wpsd[main:1804]: wpsd_flag: 0
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 10.2-00082-4 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
ATH_TXBUF=2048
ATH_SUPPORT_SKB=10240
[ath_hal_attach:334]devid:0x3f
Enterprise mode: 0x03bda000
Restoring Cal data from Flash
ar9300_eeprom_restore_from_flash: eeprom_version = 2, template_version = 2
Green-AP : Green-AP : Attached

ath_get_caps[6185] rx chainmask mismatch actual 7 sc_chainmak 0
ath_get_caps[6160] tx chainmask mismatch actual 7 sc_chainmak 0
dfs_attach: dfs_attach
ath_attach_dfs[12635] dfsdomain 1
dfs_attach: malloc dfs_radartable in attach
ATH_RESERVED_TXBUF = 800
ath_tx_paprd_init sc 82690000 PAPRD disabled in HAL
wifi0: Atheros 956X: devID = 0x3f, mem=0xb8100000, irq=2
ath_pci: 10.2-00082-4 (Atheros/multi-bss)
ath_pci_probe
PCI device id is 003c :003c
ath_pci 0000:00:00.0: ath DEBUG: sc=0x83ad9600

 ol_ath_pci_configure : num_desired MSI set to 0

 Using PCI Legacy Interrupt
955x_SGMIIMax resets limit reached exiting...
955x_SGMII::athr_gmac_sgmii_setup  Done
Setting Drop CRC Errors, Pause Frames and Length Error frames
br0: port 1(eth1) entering forwarding state
__ol_ath_attach: ath_attach TODO
__ol_ath_attach: dev name wifi1
ol_ath_set_default_tgt_config : AC Minfree buffer allocation through module param (umac.ko)
 OL_ACBKMinfree : 0
 OL_ACBEMinfree : 0
 OL_ACVIMinfree : 0
 OL_ACVOMinfree : 0
ol_ath_attach() BMI inited.
ol_ath_attach() BMI Get Target Info.
ol_ath_attach() TARGET TYPE: 7 Vers 0x4100016c
NUM_DEV=1 FWMODE=0x2 FWSUBMODE=0x0 FWBR_BUF 0
[smartip_get_product_model 114] parse file 'tmp/device.info' failed.

ol_ath_attach() configure Target .
qc98xx_verify_checksum: flash checksum passed: 0xa718
ol_transfer_bin_file 1882: Download Flash data len 2116
[smartip_get_system_mode 147] parse file '/tmp/device_runtime.info' failed

[smartip_get_band_mode 192] open /tmp/device.info file failed


ol_transfer_bin_file 1827: Download Firmware data len 214628
ol_ath_attach() Download FW.
ol_ath_attach() HT Create .
ol_ath_attach() HIF Claim.
ol_ath_attach() BMI Done.
ol_ath_attach() WMI attached. wmi_handle 81d50000
+HWT
CE_recv_buf_enqueue 653 Populate last entry 512 for CE 5
CE_recv_buf_enqueue 662 CE 5 wi 511 dest_ptr 0x1f1d020 nbytes 0 recv_ctxt 0x81f1b740
-HWT
HTC Service:0x0300 ep:1 TX flow control disabled
CE_pkt_dl_len_set CE 4 Pkt download length 64
ol_txrx_pdev_attach: 1424 tx desc's allocated ; range starts from 81b60000
HTC Service:0x0100 ep:2 TX flow control disabled
wmi_service_ready_event_rx:  WMI UNIFIED SERVICE READY event
num_rf_chain : 00000003
ht_cap_info: : 0000085b
vht_cap_info : 338001b2
vht_supp_mcs : 0000ffea
LARGE_AP enabled. num_peers 144, num_vdevs 16, num_tids 256
idx 0 req 1  num_units 0 num_unit_info 2 unit size 444 actual units 145
chunk 0 len 64380 requested ,ptr  0x1b70000
FIRMWARE:P 145 V 16 T 443

wmi_ready_event_rx:  WMI UNIFIED READY event
ol_ath_connect_htc() WMI is ready
ol_ath_set_host_app_area TODO
target uses HTT version 2.1; host uses 2.1
ol_ath_attach() connect HTC.
bypasswmi : 0
ol_regdmn_start: reg-domain param: regdmn=0, countryName=, wModeSelect=FFFFFFFF, netBand=FFFFFFFF, extendedChanMode=0.
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2) flags 0x2150
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4) flags 0xa0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x8) flags 0xc0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x20) flags 0xd0
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x40) flags 0x150
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x800) flags 0x10080
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2000) flags 0x20080
ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4000) flags 0x40080
Add VHT80 channel: 5210
Add VHT80 channel: 5290
Add VHT80 channel: 5530
Add VHT80 channel: 5610
Add VHT80 channel: 5690
Add VHT80 channel: 5775
Skipping VHT80 channel 5825
ol_ath_phyerr_attach: called
OL Resmgr Init-ed
Green-AP : Green-AP : Attached

Green-AP : Attached
ol_if_dfs_setup: called
dfs_attach: dfs_attach
ol_if_dfs_attach: called; ptr=81b91974, radar_info=831e5c00
dfs_attach: malloc dfs_radartable in attach
ol_ath_rtt_meas_report_attach: called
ol_ath_attach() UMAC attach .
ol_if_dfs_configure: called
ol_if_dfs_configure: FCC domain
ol_if_dfs_disable: called
ol_ath_attach: Calling ol_if_dfs_configure
__ol_ath_attach: init tx/rx TODO
__ol_ath_attach: hard_header_len reservation 58
FWLOG: [27757] WAL_DBGID_TX_AC_BUFFER_SET ( 0x3, 0x1e, 0x460, 0x460, 0x0 )
FWLOG: [27757] WAL_DBGID_TX_AC_BUFFER_SET ( 0x12, 0x1e, 0x460, 0x460, 0x0 )
FWLOG: [27757] WAL_DBGID_TX_AC_BUFFER_SET ( 0x45, 0x1e, 0x460, 0x460, 0x0 )
FWLOG: [27757] WAL_DBGID_TX_AC_BUFFER_SET ( 0x67, 0x1e, 0x460, 0x460, 0x0 )
FWLOG: [27762] WHAL_ERROR_RECV_STOPPCU ( 0x110298a, 0x3 )
FWLOG: [27762] WHAL_ERROR_RESET_PM (  )
wifid[wifi_ubus_send_wifi_event:45]: WIFI action: 1

wifid[wifi_ubus_wifi_cb:220]: Message: {action:1}

wifid[wifi_ubus_wifi_cb:235]: WIFI action: 1

wifid[wifi_ubus_send_wifi_event:63]: Ubus cmd: ubus send wifi '{action:1}'

wifid[wifi_ubus_send_wifi_event:45]: WIFI action: 8

wifid[wifi_ubus_wifi_cb:220]: Message: {action:8}

wifid[wifi_ubus_wifi_cb:235]: WIFI action: 8

wifid[wifi_ubus_send_wifi_event:63]: Ubus cmd: ubus send wifi '{action:8}'

get system infomation failed
dfs_detach: dfs_detach
dfs_detach: free dfs_radartable in detach
dfs_attach: dfs_attach
ath_attach_dfs[12635] dfsdomain 1
dfs_attach: malloc dfs_radartable in attach
wlan_vap_create : enter. devhandle=0x826802c0, opmode=IEEE80211_M_HOSTAP, flags=0x401
ieee80211_extap_mac_add:00:02:03:04:05:06
wlan_vap_create : exit. devhandle=0x826802c0, opmode=IEEE80211_M_HOSTAP, flags=0x401.
VAP device ath0 created
open /tmp/device_runtime.info file failed

monitor doing

 ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1

 DES SSID SET= ssid.len:0
device ath0 entered promiscuous mode
wifid[wifi_ubus_send_wifi_event:45]: WIFI action: 4

wifid[wifi_ubus_wifi_cb:220]: Message: {action:4}

wifid[wifi_ubus_send_wifi_event:63]: Ubus cmd: ubus send wifi '{action:4}'

wifid[wifi_ubus_send_wifi_event:45]: WIFI action: 5

wifid[wifi_ubus_wifi_cb:235]: WIFI action: 4

wifid[wifi_ubus_wifi_cb:220]: Message: {action:5}

wifid[wifi_ubus_send_wifi_event:63]: Ubus cmd: ubus send wifi '{action:5}'

wifid[_start_prescan:5418]: _start_prescan!


wifid[wifi_ubus_wifi_cb:235]: WIFI action: 5

wifid[_stop_prescan:5434]: _stop_prescan!


[NM_Error](nvrammanager_readPtnFromNvram) 00661: partition name(product-info) not found.


table: 0x433a70
procd: - init complete -
wpsd[wps_create_ibus_thread:43]: create ibus thread successfully
wpsd[wpsd_backup_run_mode:1248]: Error: open /tmp/device_runtime.info failed
wpsd[main:1794]: wpsd open failed.
wpsd[main:1804]: wpsd_flag: 0
wifid[wifi_ubus_send_wifi_event:45]: WIFI action: 4

wifid[wifi_ubus_wifi_cb:220]: Message: {action:4}

wifid[wifi_ubus_wifi_cb:235]: WIFI action: 4

wifid[wifi_ubus_send_wifi_event:63]: Ubus cmd: ubus send wifi '{action:4}'

wifid[wifi_ubus_send_wifi_event:45]: WIFI action: 5

wifid[wifi_ubus_send_wifi_event:63]: Ubus cmd: ubus send wifi '{action:5}'

wifid[_start_prescan:5418]: _start_prescan!


wifid[wifi_ubus_wifi_cb:220]: Message: {action:5}

wifid[wifi_ubus_wifi_cb:235]: WIFI action: 5

wifid[qca_ibus_handle_wifi_event:7079]: QCA_PRESCAN_ON l_prescan_cnt 0!


wifid[_start_dual_scan:5463]: region is NULL

dfs_detach: dfs_detach
dfs_detach: free dfs_radartable in detach
dfs_attach: dfs_attach
ath_attach_dfs[12635] dfsdomain 2
dfs_attach: malloc dfs_radartable in attach
dfs_detach: dfs_detach
dfs_detach: free dfs_radartable in detach
dfs_attach: dfs_attach
ath_attach_dfs[12635] dfsdomain 2
dfs_attach: malloc dfs_radartable in attach
wifid[_scan_result:5148]: unable to get scan result

wifid[qca_ibus_handle_wifi_event:7079]: QCA_PRESCAN_ON l_prescan_cnt 0!


wifid[_start_dual_scan:5463]: region is NULL

dfs_detach: dfs_detach
dfs_detach: free dfs_radartable in detach
dfs_attach: dfs_attach
ath_attach_dfs[12635] dfsdomain 2
dfs_attach: malloc dfs_radartable in attach
dfs_detach: dfs_detach
dfs_detach: free dfs_radartable in detach
dfs_attach: dfs_attach
ath_attach_dfs[12635] dfsdomain 2
dfs_attach: malloc dfs_radartable in attach
wifid[_scan_result:5148]: unable to get scan result