Full spi NOR flash dump Xiaomi Mi Router 4A Gigabit edition:
thanks comrade serge, this what I need.
Is it just me or is their OpenWRT-based stock firmware look like it's actually vulnerable to CVE-2020-8597 because they didn't turn on stack canaries?
Kind of looks like GCC actually optimised the entire check away too...
it is so sabile now
why it is still just snapschot and no fully suppoted?
If that's what's inside the box, then yes 
1 Like
benchmark it with IPERF3...
1 Like
Hello,
I ordered a Mi router 4A gigabit edition
Entered TTY mode, dumped output (attached)
I could not enter the boot stage, I changed bootdelay 0 to 5
But it is readonly
[ 479.820000] : sending a SIGUSR1 to process 4434
pid 4434 recv sig SIGUSR1!
۰▒▒▒▒C0D]۰▒050C0B][88890000][22224344][00222243]
DU Setting Cal ▒▒▒▒
U-Boot▒▒▒1.3 (Jul 24 2019 - 09:37:23)
▒oard: Ralink APSoC ▒RAM:▒ 64 MB
▒ower on memory test. Memory size= 64 MB...OK!
▒elocate_code Poi▒ter at: 83fb0000
*%%▒IIIRRR▒**%%%IIIRRR▒**▒H▒▒▒d p▒Ɂon O▒▒▒ɕd
▒%%▒II▒RRR***%%▒IIIRRR***%▒ȱ▒sh [X▒▒▒ˁi.▒▒▒ht!▒▒=▒OOO▒▒==▒OO▒▒▒==OOO▒▒===OOO▒▒==▒OOO▒▒= ▒C▒▒▒nk ը닁Ver▒▒▒ 4.3 r--▒KKK▒▒▒jjj---KKK▒▒▒jjj---KKK˩▒jjj▒--KKR▒P▒j▒762▒UA▒(PorWj▒r▒▒▒▒
D▒PS▒mpo▒▒▒▒ 512j▒▒▒▒ D▒* ▒▒dth▒L▒▒I5▒bus▒▒▒▒▒)▒Ջ▒▒ me[K▒▒ 64 S▒ѕ▒
F+͡▒com▒˕▒▒: S▒R2▒▒sh
=OOO▒▒===OOO▒▒===OOO▒▒==▒OOO▒▒==▒OO▒▒▒= ▒(▒▒▒he:▒▒▒▒i51▒ ▒▒▒s:4▒b▒▒▒sz:▒&b▒▒tal'SӚ▒
d▒▒▒▒i s▒▒▒2M ▒▒ys: b▒▒es▒&&b▒▒х▒:32▒R
▒▒▒▒▒Th▒AU▒fre\▒▒▒5 MJ# ▒C*▒▒ima▒Yj▒▒ory▒▒▒=64j▒▒ѕs
▒▒UQMT▒▒▒▒!e▒▒HH▒▒
▒▒▒b▒▒▒sysWV ▒Ʌ▒ion'R
▒▒▒▒to S▒5▒via▒▒▒
▒▒▒b▒▒▒sy▒WV
▒▒▒▒then▒ɥѕ t▒2▒▒▒h v▒X▒QP. ▒: B▒
▒▒^.WV
▒▒e v▒X2▒▒sh ▒V▒▒▒lt)I▒ ▒▒▒*▒▒Ɂboo▒▒and▒+▒▒▒intY.V▒▒.
▒ 9▒b▒▒▒ Bo▒▒L▒XVɁcod墡▒▒ wrZW▒▒ FlX. ▒ ▒n3'▒▒▒▒em ▒▒сsystY[▒▒e ▒ZX2▒ash▒▒x▒▒ѥng ▒^.WV
▒R▒E▒X▒▒▒SPR2▒▒▒h..I▒r▒.▒}▒rasY'z▒▒h%▒tin碽▒SPI +͡9..
▒.▒▒▒
▒$▒▒tin▒J▒▒▒e a▒▒6000▒..▒J▒▒▒▒ N▒[Y'▒MI▒*z▒nWrb▒▒▒x-3)▒r▒▒
▒▒ImXV▒▒pe:▒ Mɵ▒▒Z+▒Ker▒Y
J▒ageBlz▒X▒▒pre
"▒хSizY'142S▒▒▒ѕ▒ = ▒.4▒S(▒ L+▒▒▒▒▒▒s: ▒▒▒▒▒▒0
C*▒try▒▒▒▒: ▒▒▒▒▒▒00▒à▒Ve▒▒她g C▒▒▒▒▒m ▒▒ ▒OK
▒▒▒▒omp▒▒ͥ▒g KY.▒▒Im▒Vrr▒ OK
.▒X▒▒▒SP▒2▒▒▒h..I▒r▒.▒}▒ras▒'z▒▒s:2▒00▒▒▒▒1000R
.▒ZW▒▒to▒*▒▒Flas▒▒rR
com▒X▒▒▒ne ▒X.▒U▒▒0▒▒▒ѽry_[
▒▒0 m▒[OS
No ▒+▒ɑ ▒▒▒▒=/dYש▒▒bl▒-R
#$▒Ʌ▒sfe.▒▒▒co▒▒to ▒Z▒▒(at▒X▒ɕss ▒00▒▒▒J▒..▒h:▒٥▒g l▒▒memsZ▒J▒ MB ▒▒R
!▒9U▒ stX.W▒▒rj▒▒H▒▒
▒M▒IS A▒j5
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 3.10.14 (jenkins@1cd63d6bbb19) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 MiWiFi-R4AC-2.18.215 Wed Jul 24 09:48:47 UTC 2019
[ 0.000000]
[ 0.000000] The CPU feqenuce set to 575 MHz
[ 0.000000]
[ 0.000000] MIPS CPU sleep mode enabled.
[ 0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[ 0.000000] Software DMA cache coherency
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 04000000 @ 00000000 (usable)
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 04000000 @ 00000000 (usable)
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x03ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x03ffffff]
[ 0.000000] Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
[ 0.000000] Kernel command line: console=ttyS1,115200n8 uart_en=0 factory_mode=0 mem=64m root=/dev/mtdblock8
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Writing ErrCtl register=0006f4b5
[ 0.000000] Readback ErrCtl register=0006f4b5
[ 0.000000] allocated 131072 bytes of page_cgroup
[ 0.000000] please try 'cgroup_disable=memory' option if you don't want memory cgroups
[ 0.000000] Memory: 60488k/65536k available (3212k kernel code, 5048k reserved, 723k data, 220k init, 0k highmem)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:128
[ 0.000000] console [ttyS1] enabled
[ 0.120000] Calibrating delay loop... 380.92 BogoMIPS (lpj=1904640)
[ 0.180000] pid_max: default: 32768 minimum: 301
[ 0.180000] Mount-cache hash table entries: 512
[ 0.190000] Initializing cgroup subsys memory
[ 0.190000] Initializing cgroup subsys net_cls
[ 0.200000] NET: Registered protocol family 16
[ 0.200000] RALINK_GPIOMODE = 54054404
[ 0.210000] RALINK_GPIOMODE = 54044404
[ 0.310000] ***** Xtal 25MHz *****
[ 0.310000] start PCIe register access
[ 0.810000] RALINK_RSTCTRL = 2400000
[ 0.820000] RALINK_CLKCFG1 = fdbfffc0
[ 0.820000]
[ 0.820000] *************** MT7628 PCIe RC mode *************
[ 1.320000] PCIE0 enabled
[ 1.320000] Port 0 N_FTS = 1b105000
[ 1.330000] init_rt2880pci done
[ 1.350000] bio: create slab <bio-0> at 0
[ 1.360000] PCI host bridge to bus 0000:00
[ 1.360000] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[ 1.370000] pci_bus 0000:00: root bus resource [io 0x10160000-0x1016ffff]
[ 1.370000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 1.380000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 1.380000] pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
[ 1.390000] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[ 1.390000] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[ 1.400000] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[ 1.400000] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[ 1.410000] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[ 1.410000] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 1.420000] pci 0000:00:00.0: bridge window [mem 0x20000000-0x200fffff]
[ 1.420000] pci 0000:00:00.0: bridge window [mem 0x20100000-0x201fffff pref]
[ 1.430000] BAR0 at slot 0 = 0
[ 1.430000] bus=0x0, slot = 0x0
[ 1.430000] res[0]->start = 0
[ 1.430000] res[0]->end = 0
[ 1.440000] res[1]->start = 20200000
[ 1.440000] res[1]->end = 2020ffff
[ 1.440000] res[2]->start = 0
[ 1.450000] res[2]->end = 0
[ 1.450000] res[3]->start = 0
[ 1.450000] res[3]->end = 0
[ 1.450000] res[4]->start = 0
[ 1.460000] res[4]->end = 0
[ 1.460000] res[5]->start = 0
[ 1.460000] res[5]->end = 0
[ 1.460000] bus=0x1, slot = 0x0
[ 1.470000] res[0]->start = 20000000
[ 1.470000] res[0]->end = 200fffff
[ 1.470000] res[1]->start = 0
[ 1.480000] res[1]->end = 0
[ 1.480000] res[2]->start = 0
[ 1.480000] res[2]->end = 0
[ 1.480000] res[3]->start = 0
[ 1.490000] res[3]->end = 0
[ 1.490000] res[4]->start = 0
[ 1.490000] res[4]->end = 0
[ 1.490000] res[5]->start = 0
[ 1.500000] res[5]->end = 0
[ 1.500000] cfg80211: Calling CRDA to update world regulatory domain
[ 1.510000] Switching to clocksource Ralink Systick timer
[ 1.510000] NET: Registered protocol family 2
[ 1.520000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[ 1.520000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[ 1.530000] TCP: Hash tables configured (established 512 bind 512)
[ 1.530000] TCP: reno registered
[ 1.540000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 1.540000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 1.550000] NET: Registered protocol family 1
[ 1.570000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 1.570000] jffs2: version 2.2. (ZLIB) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 1.580000] msgmni has been set to 118
[ 1.590000] io scheduler noop registered
[ 1.590000] io scheduler deadline registered (default)
[ 1.600000] MIWIFI panic notifier registered
[ 1.600000] pcieport 0000:00:00.0: device [14c3:0801] has invalid IRQ; check vendor BIOS
[ 1.620000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 1.620000] serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
[ 1.630000] serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
[ 1.640000] led=44, on=4000, off=1, blinks,=1, reset=1, time=4000
[ 1.640000] Ralink gpio driver initialized
[ 1.650000] flash manufacture id: c8, device id 40 18
[ 1.650000] GD25Q128C(c8 40180000) (16384 Kbytes)
[ 1.660000] mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
[ 1.670000] Creating 8 MTD partitions on "raspi":
[ 1.670000] 0x000000000000-0x000001000000 : "ALL"
[ 1.680000] 0x000000000000-0x000000020000 : "Bootloader"
[ 1.690000] 0x000000020000-0x000000030000 : "Config"
[ 1.690000] 0x000000030000-0x000000040000 : "Factory"
[ 1.700000] 0x000000040000-0x000000050000 : "crash"
[ 1.710000] 0x000000050000-0x000000060000 : "cfg_bak"
[ 1.710000] 0x000000060000-0x000000260000 : "overlay"
[ 1.720000] 0x000000260000-0x000001000000 : "OS1"
[ 1.730000] mtd: try split OS1 partition
[ 1.730000] mtd: split_firmware
[ 1.730000] mtd: firmware_partition->size 0xda0000
[ 1.740000] mtd: firmware_partition->offset 0x260000
[ 1.740000] mtd: uimage_len 1425036
[ 1.750000] mtd: uimage_len 1441792
[ 1.750000] mtd: rootfs_partition->size 0xc40000
[ 1.760000] mtd: rootfs_partition->offset 0x3c0000
[ 1.760000] mtd: partition "rootfs" created automatically, ofs=3C0000, len=C40000
[ 1.770000] 0x0000003c0000-0x000001000000 : "rootfs"
[ 1.780000] PPP generic driver version 2.4.2
[ 1.780000] PPP MPPE Compression module registered
[ 1.790000] NET: Registered protocol family 24
[ 1.790000] PPTP driver version 0.8.5
[ 1.790000] GMAC1_MAC_ADRH -- : 0x000050d2
[ 1.800000] GMAC1_MAC_ADRL -- : 0xf59a6961
[ 1.800000] Ralink APSoC Ethernet Driver Initilization. v3.1 256 rx/tx descriptors allocated, mtu = 1500!
[ 1.810000] GMAC1_MAC_ADRH -- : 0x000050d2
[ 1.820000] GMAC1_MAC_ADRL -- : 0xf59a6961
[ 1.820000] PROC INIT OK!
[ 1.830000] Ralink APSoC Hardware Watchdog Timer
[ 1.830000] Mirror/redirect action on
[ 1.830000] u32 classifier
[ 1.840000] input device check on
[ 1.840000] Actions configured
[ 1.840000] Netfilter messages via NETLINK v0.30.
[ 1.850000] nfnl_acct: registering with nfnetlink.
[ 1.850000] nf_conntrack version 0.5.0 (945 buckets, 3780 max)
[ 1.860000] ipip: IPv4 over IPv4 tunneling driver
[ 1.870000] gre: GRE over IPv4 demultiplexor driver
[ 1.870000] ip_gre: GRE over IPv4 tunneling driver
[ 1.880000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 1.880000] Type=Restricted Cone
[ 1.890000] TCP: cubic registered
[ 1.890000] NET: Registered protocol family 10
[ 1.900000] NET: Registered protocol family 17
[ 1.900000] l2tp_core: L2TP core driver, V2.0
[ 1.910000] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 1.910000] l2tp_netlink: L2TP netlink interface
[ 1.920000] 8021q: 802.1Q VLAN Support v1.8
[ 1.940000] VFS: Mounted root (squashfs filesystem) readonly on device 31:8.
[ 1.950000] Freeing unused kernel memory: 220K (803d9000 - 80410000)
config core 'version'
# ROM ver
option ROM '2.18.215'
# channel
option CHANNEL 'release'
# hardware platform R1AC or R1N etc.
option HARDWARE 'R4AC'
# CFE ver
option UBOOT '1.0.0'
# Linux Kernel ver
option LINUX '0.0.1'
# RAMFS ver
option RAMFS '0.0.1'
# SQUASHFS ver
option SQAFS '0.0.1'
# ROOTFS ver
option ROOTFS '0.0.1'
#build time
option BUILDTIME 'Wed, 24 Jul 2019 09:36:35 +0000'
#build timestamp
option BUILDTS '1563960995'
#build git tag
option GTAG 'commit cf965a3ec172dfa1b2832dbbaab9d0b975bf11e6'
[ 3.810000] Raeth v3.1 (Tasklet,SkbRecycle)
[ 3.810000]
[ 3.810000] phy_tx_ring = 0x03ffe000, tx_ring = 0xa3ffe000
[ 3.820000]
[ 3.820000] phy_rx_ring0 = 0x03fff000, rx_ring0 = 0xa3fff000
[ 3.840000] config 7628 esw as WLLLL
[ 3.920000] GMAC1_MAC_ADRH -- : 0x000050d2
[ 3.920000] GMAC1_MAC_ADRL -- : 0xf59a6961
[ 3.930000] Link Status Changed: Port 6 linked Up.
[ 3.930000] Link Status Changed: Port 2 linked Up.
[ 3.930000] Link Status Changed: Port 0 linked Up.
- preinit -
Wed Jul 24 09:48:47 UTC 2019
- regular preinit -
/lib/preinit.sh: line 1: pi_indicate_led: not found
jffs2 not ready yet; using ramdisk
- init -
[ 5.190000] ra2880stop()...Done
[ 5.190000] Free TX/RX Ring Memory!
init started: BusyBox v1.19.4 (2019-07-24 09:34:35 UTC)
Please press Enter to activate this console. rcS S boot: INFO: rc script run time limit to 65 seconds.
[ 5.540000] MIWIFI crash syslog initialize skiped! Code=1
[ 7.250000] xt_time: kernel timezone is +0800
[ 7.390000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 7.530000] nf_nat_amanda: Unknown symbol nf_nat_amanda_hook (err 0)
[ 7.630000] ip_set: protocol 6
[ 7.670000] ipaccount: ifname [lo] event[5]
[ 7.680000] ipaccount: ifname [ifb0] event[5]
[ 7.680000] ipaccount: ifname [eth0] event[5]
[ 7.680000] ipaccount: ifname [tunl0] event[5]
[ 7.690000] ipaccount: ifname [gre0] event[5]
[ 7.690000] ipaccount: ifname [gretap0] event[5]
[ 7.710000] dev_redirect OFF.dev_redirect load success.
[ 8.850000]
[ 8.850000]
[ 8.850000] === pAd = c0679000, size = 1763448 ===
[ 8.850000]
[ 8.860000] <-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
[ 8.870000] <-- RTMPAllocAdapterBlock, Status=0
[ 8.870000] RtmpChipOpsHook(492): Not support for HIF_MT yet!
[ 8.880000] mt7628_init()-->
[ 8.880000] mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
[ 8.890000] e2.bin mt7628_init(1120)::(2), pChipCap->fw_len(63984)
[ 8.900000] mt_bcn_buf_init(218): Not support for HIF_MT yet!
[ 8.900000] <--mt7628_init()
[ 8.900000] ipaccount: ifname [wl1] event[16]
[ 8.910000] ipaccount: ifname [wl1] event[5]
[ 9.980000] <-- RTMPAllocTxRxRingMemory, Status=0
[ 10.000000] <-- RTMPAllocAdapterBlock, Status=0
[ 10.000000] pAd->CSRBaseAddress =0xc0c00000, csr_addr=0xc0c00000!
[ 10.010000] <dbg> MAC_CSR0=1986146304, RtmpChipOpsHook
[ 10.010000] <dbg> dev idx = 1!
[ 10.020000] <dbg> get_dev_config_idx pAd->MACVersion = 76623000, pAd->ChipID = 76120044
[ 10.020000] ipaccount: ifname [wl0] event[16]
[ 10.030000] ipaccount: ifname [wl0] event[5]
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: INFO: loading exist /etc/config/network.
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: config interface 'loopback'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option ifname 'lo'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option proto 'static'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option ipaddr '127.0.0.1'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option netmask '255.0.0.0'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: config interface 'lan'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option ifname 'eth0.1'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option type 'bridge'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option proto 'static'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option ipaddr '192.168.31.1'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option netmask '255.255.255.0'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option ip6assign '64'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: list ip6class 'ifb'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: config interface 'ifb'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option ifname 'ifb0'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: config interface 'ready'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option proto 'static'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option ipaddr '169.254.29.1'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option netmask '255.255.255.0'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: config interface 'openvpn'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option ifname 'tun0'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option proto 'openvpn'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: config interface 'wan'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option ifname 'eth0.2'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option proto 'static'
Wed Jul 24 11:48:53 CEST 2019 netconfig[726]: option ipaddr '192.168.10.46'
Wed Jul 24 11:48:54 CEST 2019 netconfig[726]: option mtu '1500'
Wed Jul 24 11:48:54 CEST 2019 netconfig[726]: option netmask '255.255.254.0'
Wed Jul 24 11:48:54 CEST 2019 netconfig[726]: option dns '8.8.8.8'
Wed Jul 24 11:48:54 CEST 2019 netconfig[726]: option gateway '192.168.10.1'
[ 13.920000] ipaccount: ifname [br-lan] event[16]
[ 13.920000] ipaccount: ifname [br-lan] event[5]
[ 13.940000] ipaccount: ifname [eth0] event[13]
[ 13.940000] Raeth v3.1 (Tasklet,SkbRecycle)
[ 13.950000]
[ 13.950000] phy_tx_ring = 0x02144000, tx_ring = 0xa2144000
[ 13.950000]
[ 13.950000] phy_rx_ring0 = 0x02145000, rx_ring0 = 0xa2145000
[ 13.970000] config 7628 esw as WLLLL
[ 14.050000] GMAC1_MAC_ADRH -- : 0x000050d2
[ 14.050000] GMAC1_MAC_ADRL -- : 0xf59a6961
[ 14.060000] ipaccount: ifname [eth0] event[1]
[ 14.080000] ipaccount: ifname [eth0.1] event[16]
[ 14.080000] ipaccount: ifname [eth0.1] event[5]
[ 14.110000] ipaccount: ifname [eth0.1] event[13]
[ 14.110000] ipaccount: ifname [eth0.1] event[1]
[ 14.130000] ipaccount: ifname [eth0.1] event[20]
[ 14.130000] device eth0.1 entered promiscuous mode
[ 14.140000] device eth0 entered promiscuous mode
[ 14.140000] ipaccount: ifname [br-lan] event[11]
[ 14.140000] ipaccount: ifname [br-lan] event[8]
[ 14.170000] ipaccount: ifname [br-lan] event[8]
[ 14.170000] ipaccount: ifname [br-lan] event[13]
[ 14.170000] br-lan: port 1(eth0.1) entered forwarding state
[ 14.180000] br-lan: port 1(eth0.1) entered forwarding state
[ 14.190000] ipaccount: ifname [br-lan] event[1]
[ 14.200000] ipaccount: ifname [ifb0] event[13]
[ 14.200000] ipaccount: ifname [ifb0] event[1]
[ 14.240000] ipaccount: ifname [lo] event[13]
[ 14.240000] ipaccount: ifname [lo] event[1]
[ 14.270000] ipaccount: ifname [eth0.2] event[16]
[ 14.280000] ipaccount: ifname [eth0.2] event[5]
[ 14.300000] ipaccount: ifname [eth0.2] event[13]
[ 14.300000] ipaccount: ifname [eth0.2] event[1]
[ 14.940000] ipaccount: ifname [eth0.1] event[4]
[ 14.940000] ipaccount: ifname [br-lan] event[4]
[ 14.950000] ipaccount: ifname [eth0.2] event[4]
[ 16.180000] br-lan: port 1(eth0.1) entered forwarding state
[ 17.340000] ipaccount: ifname [wl0] event[13]
[ 17.340000] <dbg> MAC_CSR0=1986146304, rtmp_asic_top_init
[ 17.440000] Set defult RDRegion value: CountryCode=EU 11▒, RDRegion=0
[ 19.980000] <==== rt28xx_init, Status=0
[ 19.980000] ipaccount: ifname [apclii0] event[16]
[ 19.990000] ipaccount: ifname [apclii0] event[5]
[ 19.990000] ipaccount: ifname [wl0] event[1]
[ 24.400000] ipaccount: ifname [wl0] event[20]
[ 24.400000] device wl0 entered promiscuous mode
[ 24.410000] br-lan: port 2(wl0) entered forwarding state
[ 24.410000] br-lan: port 2(wl0) entered forwarding state
[ 26.360000] ipaccount: ifname [wl1] event[13]
[ 26.370000] TX_BCN DESC a365e000 size = 320
[ 26.370000] RX[0] DESC a3662000 size = 2048
[ 26.380000] RX[1] DESC a3663000 size = 1024
[ 26.390000] E2pAccessMode=2
[ 26.400000] cfg_mode=9
[ 26.400000] cfg_mode=9
[ 26.400000] wmode_band_equal(): Band Equal!
[ 26.410000] br-lan: port 2(wl0) entered forwarding state
[ 26.810000] load fw image from fw_header_image
[ 26.810000] AndesMTLoadFwMethod1(2181)::pChipCap->fw_len(63984)
[ 26.820000] CmdAddressLenReq:(ret = 0)
[ 26.820000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.830000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.830000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.840000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.840000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.850000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.850000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.860000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.860000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.870000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.870000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.880000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.880000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.890000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.890000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.900000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[ 26.900000] CmdFwStartReq: override = 1, address = 1048576
[ 26.910000] CmdStartDLRsp: WiFI FW Download Success
[ 26.920000] MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
[ 26.920000] efuse_probe: efuse = 10000002
[ 26.930000] RtmpChipOpsEepromHook::e2p_type=2, inf_Type=4
[ 26.930000] RtmpEepromGetDefault::e2p_dafault=2
[ 26.940000] RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
[ 26.940000] NVM is FLASH mode
[ 26.950000] 1. Phy Mode = 14
[ 27.180000] Country Region from e2p = ffff
[ 27.190000] tssi_1_target_pwr_g_band = 22
[ 27.190000] 2. Phy Mode = 14
[ 27.190000] 3. Phy Mode = 14
[ 27.200000] NICInitPwrPinCfg(11): Not support for HIF_MT yet!
[ 27.200000] NICInitializeAsic(652): Not support rtmp_mac_sys_reset () for HIF_MT yet!
[ 27.210000] mt_mac_init()-->
[ 27.210000] MtAsicInitMac()-->
[ 27.230000] mt7628_init_mac_cr()-->
[ 27.230000] MtAsicSetMacMaxLen(1279): Set the Max RxPktLen=1024!
[ 27.240000] <--mt_mac_init()
[ 27.240000] WTBL Segment 1 info:
[ 27.240000] MemBaseAddr/FID:0x28000/0
[ 27.250000] EntrySize/Cnt:32/128
[ 27.250000] WTBL Segment 2 info:
[ 27.250000] MemBaseAddr/FID:0x40000/0
[ 27.260000] EntrySize/Cnt:64/128
[ 27.260000] WTBL Segment 3 info:
[ 27.260000] MemBaseAddr/FID:0x42000/64
[ 27.270000] EntrySize/Cnt:64/128
[ 27.270000] WTBL Segment 4 info:
[ 27.270000] MemBaseAddr/FID:0x44000/128
[ 27.280000] EntrySize/Cnt:32/128
[ 27.280000] AntCfgInit(2925): Not support for HIF_MT yet!
[ 27.290000] MCS Set = ff ff 00 00 00
[ 27.290000] MtAsicSetChBusyStat(846): Not support for HIF_MT yet!
[ 27.470000] dev_redirect: add(+) dev redirect mapping: src:eth0.2->dst:ifb0
[ 30.420000] MtAsicSetRalinkBurstMode(2971): Not support for HIF_MT yet!
[ 30.430000] MtAsicSetPiggyBack(783): Not support for HIF_MT yet!
[ 30.460000] MtAsicSetTxPreamble(2950): Not support for HIF_MT yet!
[ 30.470000] MtAsicAddSharedKeyEntry(1346): Not support for HIF_MT yet!
[ 30.480000] MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
[ 30.480000] Main bssid = 50:d2:f5:9a:69:62
[ 30.490000] <==== rt28xx_init, Status=0
[ 30.490000] ipaccount: ifname [wl2] event[16]
[ 30.490000] ipaccount: ifname [wl2] event[5]
[ 30.500000] ipaccount: ifname [wl3] event[16]
[ 30.500000] ipaccount: ifname [wl3] event[5]
[ 30.510000] ipaccount: ifname [apcli0] event[16]
[ 30.510000] ipaccount: ifname [apcli0] event[5]
[ 30.520000] ipaccount: ifname [apcli1] event[16]
[ 30.520000] ipaccount: ifname [apcli1] event[5]
[ 30.530000] !!!mt7628_xq_board=R4AC!!!
[ 30.530000] ipaccount: ifname [wl1] event[1]
[ 30.540000] CmdSlotTimeSet start
[ 30.670000] CmdSlotTimeSet end
[ 31.420000] MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0x0
[ 31.430000] MtAsicSetPiggyBack(783): Not support for HIF_MT yet!
[ 31.640000] MtAsicSetRalinkBurstMode(2971): Not support for HIF_MT yet!
[ 31.650000] MtAsicSetPiggyBack(783): Not support for HIF_MT yet!
[ 31.780000] MtAsicSetTxPreamble(2950): Not support for HIF_MT yet!
[ 31.790000] MtAsicAddSharedKeyEntry(1346): Not support for HIF_MT yet!
[ 31.790000] MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
[ 31.800000] Main bssid = 50:d2:f5:9a:69:62
[ 34.510000] ipaccount: ifname [wl1] event[20]
[ 34.520000] device wl1 entered promiscuous mode
[ 34.520000] br-lan: port 3(wl1) entered forwarding state
[ 34.530000] br-lan: port 3(wl1) entered forwarding state
[ 34.570000] ipaccount: ifname [wl2] event[13]
[ 34.580000] ##### mbss_cr_enable, BssId = 1
[ 34.580000] ipaccount: ifname [wl2] event[1]
[ 36.530000] br-lan: port 3(wl1) entered forwarding state
[ 36.890000] Link Status Changed: Port 0 linked Down.
[ 36.910000] Link Status Changed: Port 2 linked Down.
rcS S calling: /etc/rc.d/S20network boot: WARNING: EXITCODE=0, execute too slow, 25 >= 15: /etc/rc.d/S20network boot
[ 38.560000] Link Status Changed: Port 0 linked Up.
[ 38.570000] Link Status Changed: Port 2 linked Up.
[ 43.350000] dev_redirect: add(+) dev redirect mapping: src:eth0.2->dst:ifb0
Wed Jul 24 11:49:30 CEST 2019 boot_check[3138]: INFO: Wireless OK
[ 48.790000] ipaccount: refresh dev ifname to [eth0 wl0 wl1 wl3]
[ 48.790000] ipaccount: landev_init_all() add dev [eth0] is_wireless: 0.
[ 48.800000] ipaccount: landev_init_all() add dev [wl0] is_wireless: 1.
[ 48.810000] ipaccount: landev_init_all() add dev [wl1] is_wireless: 1.
[ 48.810000] ipaccount: landev_init_all() add dev [wl3] is_wireless: 1.
[ 49.680000] ipaccount: landev_init_all() add dev [eth0] is_wireless: 0.
[ 49.690000] ipaccount: landev_init_all() add dev [wl0] is_wireless: 1.
[ 49.700000] ipaccount: landev_init_all() add dev [wl1] is_wireless: 1.
[ 49.700000] ipaccount: landev_init_all() add dev [wl3] is_wireless: 1.
[ 50.780000] dev_redirect OFF.
[ 52.390000] dev_redirect OFF.xqfp: forward hooks init success!
[ 57.700000] xqfp:pre hooks init success!
[ 57.710000] xqfp:extend init success!
[ 57.710000] xqfp: register_netdevice_notifier_v3!
[ 57.720000] xqfp: module init success!
[ 58.150000] ctf: bytes_threshold 3MB(3145728B), mask F00000, old_mark: 200000, new_mark: 400000
[ 58.210000] dev_redirect: add(+) dev redirect mapping: src:eth0.2->dst:ifb0
[ 59.260000] dev_redirect OFF.
[ 59.280000] dev_redirect OFF.dev_redirect OFF.ipaccount: landev_init_all() add dev [eth0] is_wireless: 0.
[ 63.050000] ipaccount: landev_init_all() add dev [wl0] is_wireless: 1.
[ 63.050000] ipaccount: landev_init_all() add dev [wl1] is_wireless: 1.
[ 63.060000] ipaccount: landev_init_all() add dev [wl3] is_wireless: 1.
rcS S boot: INFO: rcS S boot timing 54 seconds.
Tue Feb 25 09:32:16 CET 2020 INFO: rcS S boot timing 54 seconds.
rcS S boot: system type(R4AC/2): SQUASH/3
Tue Feb 25 09:32:16 CET 2020 system type(R4AC/2): SQUASH/3
rcS S boot: ROOTFS: /dev/root on / type squashfs (ro,relatime)
Tue Feb 25 09:32:16 CET 2020 ROOTFS: /dev/root on / type squashfs (ro,relatime)
[ 64.320000] led=44, on=1, off=4000, blinks,=1, reset=1, time=4000
[ 64.320000] led=11, on=1, off=4000, blinks,=1, reset=1, time=4000
[ 64.330000] led=44, on=1, off=4000, blinks,=1, reset=1, time=4000
[ 64.350000] led=11, on=4000, off=1, blinks,=1, reset=1, time=4000
Unlocking cfg_bak ...
Erasing cfg_bak ...
Unlocking cfg_bak ...
Writing from /tmp/cfg_bak.tgz to cfg_bak ...
Tue Feb 25 09:32:17 CET 2020 boot_check[4823]: Booting up finished.
[ 73.280000] Started WatchDog Timer.
Hi,
Using the lastest SNAPSHOT I get a similar (or the same) problem reported by dossalab, stamasd, etc.
The last one I tried is from February 23rd.
A first reboot after installing LuCi I got error:
[ 56.219306] jffs2: Erase at 0x00a40000 failed immediately: errno -22
After this error more and more errors shows about CRC error in jffs2 and LuCi disapers and even my configuration.
[ 67.280389] jffs2: Erase at 0x00a40000 failed immediately: errno -22
[ 308.526386] jffs2: notice: (2165) jffs2_get_inode_nodes: Node header CRC failed at 0x89e7b0. {ffff,ffff,ffffffff,ffffffff}
[ 308.537478] jffs2: notice: (2165) jffs2_get_inode_nodes: Node header CRC failed at 0x897754. {ffff,ffff,ffffffff,ffffffff}
[ 308.548681] jffs2: notice: (2165) jffs2_get_inode_nodes: Node header CRC failed at 0x897564. {ffff,ffff,ffffffff,ffffffff}
[ 308.559761] jffs2: notice: (2165) jffs2_get_inode_nodes: Node header CRC failed at 0x89735c. {ffff,ffff,ffffffff,ffffffff}
[ 308.570861] jffs2: notice: (2165) jffs2_get_inode_nodes: Node header CRC failed at 0x8970fc. {ffff,ffff,ffffffff,ffffffff}
[ 308.582012] jffs2: notice: (2165) jffs2_get_inode_nodes: Node header CRC failed at 0x896fa8. {ffff,ffff,ffffffff,ffffffff}
[ 308.593115] jffs2: notice: (2165) jffs2_get_inode_nodes: Node header CRC failed at 0x891418. {ffff,ffff,ffffffff,ffffffff}
[ 308.604261] jffs2: notice: (2165) jffs2_get_inode_nodes: Node header CRC failed at 0x8911f8. {ffff,ffff,ffffffff,ffffffff}
[ 308.615347] jffs2: notice: (2165) jffs2_get_inode_nodes: Node header CRC failed at 0x890fec. {ffff,ffff,ffffffff,ffffffff}
[ 308.626432] jffs2: notice: (2165) jffs2_get_inode_nodes: Node header CRC failed at 0x890d98. {ffff,ffff,ffffffff,ffffffff}
If I use the Gingernut image openwrt-ramips-mt7621-xiaomi_mir3g-v2-squashfs-sysupgrade_05_01_2020_4.19.bin I get no errors and everything goes perfectly.
¿Does anyone having similar problems?
Thanks for the help.
1 Like
Wow !! Found the 4A Gigabit edition on Amazon for $30 with next day delivery.
I now have one arriving tomorrow. Looks like the performance on this router should be excellent, especially considering the amazing price point.
Thanks to all of you for your hard work on identifying how to flash OpenWRT to this hardware.
I've got same issue. I believe it started 3 weeks ago, or so
1 Like
YOU don't have mi4a giga version it is mi router 4A.
Careful with using someone else's stock firmware dumps. I have several 4A-giga and I dumped the firmware of all. When comparing the files, they are not the same. They are identical for the most part but there are blocks which are completely different. I assume calibration data etc. So if using a non-matched dump you may get the wrong calibration data for your particular device.
1 Like
I did that out of stupidity and now my routers use the calibration data that was destined for another device.
The good news is, that everything still works. Maybe it is a little to weak or strong on this or that channel, but one doesn't notice it and wifi is fine. So if that mistake happened to you as it did to me, don't panic, there is only one real problem: the mac-adresses is stored in it and your device now has another device's mac copied. To fix this, search for the mac, edit it to the mac that is printed on your router and be happy again.
Of course @stamasd is right and one must not simpy flash another devices firmware dump to your device.
Instead read out your device's firmware, edit it and write it back.
i have same problem too
Anyone knows how to solve that issue or where to ask for a properly fix?
Thanks,
Regards
SPI flash clock rated at max 80MHz. It's possibly reason of unstable i/o operations. Can you decrease spi clock and check again?
fix jffs2 error
***.build opnwrt master only use kernal 4.14.166 , date 2020-01-23
all working
Just for test you can try this 19.07.2 image (spi clk down to 24MHz):