Netgear Orbi RBR750/RBS750

Netgear RBx750 are tri band, 2.4GHz and 2x 5GHz, 8 stream 802.11ax mesh devices from the Orbi series. The RBR750 is a router with a WAN and 3 LAN ports. The RBS750 is a satellite without WAN port, only 2 LAN ports and half the flash. The hardware is otherwise identical. They were sold in kits as RBK752-RBK757, with one router and 1-6 satellites.

Model	CPU	Ram	Flash	Network	WLAN	Serial
RBR750	Quad Core ARM Cortex A53 @ 2.2GHz	1 GiB	512 MiB	3x 1GbE LAN, 1x 1GbE WAN	2.4GHz: QCN5024 2×2:2 b/g/n/ax, 5GHz Low: QCN5054 2×2:2 a/n/ac/ax, 5GHz High: QCN5054 4×4:4 a/n/ac/ax	Yes, internal populated header
RBS750	Quad Core ARM Cortex A53 @ 2.2GHz	1 GiB	256 MiB	2x 1GbE LAN	2.4GHz: QCN5024 2×2:2 b/g/n/ax, 5GHz Low: QCN5054 2×2:2 a/n/ac/ax, 5GHz High: QCN5054 4×4:4 a/n/ac/ax	Yes, internal populated header

Install

Notes: The stock firmware images are signed. Both the bootloader and the stock web interface check the signature and will fail to boot/flash. The bootloader automatically does NMRP when a gigabit LAN connection is present. The stock and factory images contain a U-Boot script that is executed when flashing using NMRP. This is used to alter and persist the U-Boot env with a boot command that works with unsigned firmware.

Get the nmrpflash utility and OpenWrt factory image
Find network interface to use: nmrpflash -L
Start nmrpflash: nmrpflash -i interface -f openwrt-...-factory.img
Connect the device LAN port closest to the power jack to the same network using gigabit
Plug the device in and wait for the bootloader to flash
Unplug and replug the device once the power LED blinks amber

Revert to Stock

The boot command needs to be reverted before flashing the stock firmware, otherwise it will fail to boot and get stuck in recovery mode (red power LED flashing). Still in OpenWrt run this command to restore the original value:

fw_setenv bootcmd bootipq

Restart the device and flash the stock firmware RBx350-Va.b.c.d.img using nmrpflash.

The default network configuration for the RBR750 router is:

Interface Name	Description	Default configuration
br-lan	LAN & WiFi	192.168.1.1/24
wan	WAN	DHCP

The default network configuration for the RBS750 satellite is:

Interface Name	Description	Default configuration
br-lan	LAN & WiFi	DHCP

→ hardware.button on howto use and configure the hardware button(s). Here, we merely name the buttons, so we can use them in the above Howto.

The Netgear RBx750 has the following buttons:

BUTTON	Event
Reset	reset
Sync	wps

Architecture	AArch64
Vendor	Qualcomm
Bootloader	U-Boot
System-On-Chip	Qualcomm IPQ8074
CPU/Speed	Quad Core ARM Cortex-A53 @ 2.2GHz
Flash-Chip	Winbond W29N04GZ (RBR750) or Winbond W29N02GZ (RBS750)
Flash size	512MiB (RBR750) or 256MiB (RBS750)
RAM	1GiB Samsung
Wireless 2.4GHz	QCN5024 2×2:2 b/g/n/ax
Wireless 5GHz Low	QCN5054 2×2:2 a/n/ac/ax 5180-5320MHz
Wireless 5GHz High	QCN5054 4×4:4 a/n/ac/ax 5500-5700MHz
Ethernet	1 WAN, 3 LAN ports (RBR750) or 2 LAN ports (RBS750)
Switch	Qualcomm QCA8075
Serial	Yes internal populated header
JTAG	probably

There are two TX10 screws behind the sticker around the WAN/LAN/power ports, one on each top corner. The sticker is stiff and can be lifted and folded over by inserting a sharp object in the corner and pressing inwards.

→ port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

When removing all screws that hold the PCB, it can be pushed forward and the serial cable can be threaded in from the back, without unplugging any of the antennas.

Serial connection parameters for Netgear RBx750	115200, 8N1, 3.3V

Format: Log Type - Time(microsec) - Message - Optional Info Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00147 S - IMAGE_VARIANT_STRING=HAACANAZA S - OEM_IMAGE_VERSION_STRING=CRM S - Boot Config, 0x000002e5 B - 201 - PBL, Start B - 2735 - bootable_media_detect_entry, Start B - 3441 - bootable_media_detect_success, Start B - 3445 - elf_loader_entry, Start B - 6107 - auth_hash_seg_entry, Start B - 72457 - auth_hash_seg_exit, Start B - 134527 - elf_segs_hash_verify_entry, Start B - 197220 - PBL, End B - 321439 - SBL1, Start B - 401380 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4 B - 411353 - pm_device_init, Start B - 593865 - PM_SET_VAL:Skip D - 180377 - pm_device_init, Delta B - 596122 - pm_driver_init, Start D - 5337 - pm_driver_init, Delta B - 602619 - clock_init, Start D - 2135 - clock_init, Delta B - 606675 - boot_flash_init, Start D - 13145 - boot_flash_init, Delta B - 623511 - boot_config_data_table_init, Start D - 3172 - boot_config_data_table_init, Delta - (575 Bytes) B - 631045 - Boot Setting : 0x00000618 B - 634979 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:13 B - 641903 - sbl1_ddr_set_params, Start B - 645746 - CPR configuration: 0x30c B - 649131 - cpr_init, Start B - 651998 - Rail:0 Mode: 5 Voltage: 792000 B - 657153 - CL CPR settled at 744000mV B - 659959 - Rail:1 Mode: 5 Voltage: 880000 B - 664168 - Rail:1 Mode: 7 Voltage: 888000 D - 16439 - cpr_init, Delta B - 671030 - Pre_DDR_clock_init, Start B - 675056 - Pre_DDR_clock_init, End B - 678472 - DDR Type : PCDDR4 B - 685335 - do ddr sanity test, Start D - 1067 - do ddr sanity test, Delta B - 688873 - DDR: Start of HAL DDR Boot Training B - 693600 - DDR: End of HAL DDR Boot Training B - 699304 - DDR: Checksum to be stored on flash is 1740555694 B - 709704 - Image Load, Start D - 782478 - QSEE Image Loaded, Delta - (1380336 Bytes) B - 1492273 - Image Load, Start D - 61 - SEC Image Loaded, Delta - (0 Bytes) B - 1499959 - Image Load, Start D - 569130 - DEVCFG Image Loaded, Delta - (32404 Bytes) B - 2069181 - Image Load, Start D - 583709 - RPM Image Loaded, Delta - (112364 Bytes) B - 2652981 - Image Load, Start D - 655903 - APPSBL Image Loaded, Delta - (604308 Bytes) B - 3309006 - QSEE Execution, Start D - 61 - QSEE Execution, Delta B - 3314831 - USB D+ check, Start D - 0 - USB D+ check, Delta B - 3321236 - SBL1, End D - 3002085 - SBL1, Delta S - Flash Throughput, 6737 KB/s (2130659 Bytes, 316248 us) S - DDR Frequency, 600 MHz S - Core 0 Frequency, 800 MHz Orbi11AX V1.0.14 U-Boot 2016.01 (Dec 26 2019 - 01:01:31 -0800) DRAM: smem ram ptable found: ver: 1 len: 4 1 GiB NAND: ONFI device found ID = 1590acef Vendor = ef Device = ac SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0) 512 MiB MMC: <NULL>: 0 In: serial@78B3000 Out: serial@78B3000 Err: serial@78B3000 machid: 801000d Card did not respond to voltage select! eth0 MAC Address from ART is not valid eth1 MAC Address from ART is not valid eth2 MAC Address from ART is not valid eth3 MAC Address from ART is not valid eth4 MAC Address from ART is not valid eth5 MAC Address from ART is not valid Net: MAC0 addr:10:c:6b:53:d6:9e PHY ID1: 0x4d PHY ID2: 0xd0b1 EDMA ver 1 hw init Num rings - TxDesc:1 (0-0) TxCmpl:1 (7-7) RxDesc:1 (15-15) RxFill:1 (7-7) ipq807x_edma_alloc_rings: successfull ipq807x_edma_setup_ring_resources: successfull ipq807x_edma_configure_rings: successfull ipq807x_edma_hw_init: successfull eth0 0 set_firmware_partition:1017 setenv firmware_partition 0 Setting bus to 0 Valid chip addresses: 31 ipq807x_eth_halt: done eth0 PHY0 Down Speed :10 Half duplex eth0 PHY1 Down Speed :10 Half duplex eth0 PHY2 Down Speed :10 Half duplex eth0 PHY3 up Speed :1000 Full duplex eth0 PHY4 Down Speed :10 Half duplex 10M speed not supported ipq807x_eth_init: done net_loop:496 Client starts...[Listening] for ADVERTISE...TTT Retry count exceeded; boot the image as usual ipq807x_eth_halt: done nmrp server is stopped or failed ! Hit any key to stop autoboot: 0 IPQ807x# printenv baudrate=115200 bootargs=console=ttyMSM0,115200n8 bootcmd=bootipq bootdelay=2 default_mode_flag=1 ethact=eth0 ethaddr=10:0c:6b:53:d6:9e fdt_high=0x4A400000 fdtcontroladdr=4a97de50 firmware_partition=0 flash_type=2 ipaddr=192.168.1.1 machid=801000d mode_flag=1 netmask=255.255.255.0 region=0002 serverip=192.168.1.2 soc_version_major=2 soc_version_minor=0 stderr=serial@78B3000 stdin=serial@78B3000 stdout=serial@78B3000 voice_flag=0 Environment size: 480/262140 bytes IPQ807x# bootipq nand device 0 && setenv mtdids nand0=nand0 && setenv mtdparts mtdparts=nand0:0x6d00000@0x11c00000(fs),${msmparts} && ubi part fs && ubi read 0x44000000 kernel && ubi0: attaching mtd1 ubi0: scanning is finished ubi0: attached mtd1 (name "mtd=0", size 109 MiB) ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096 ubi0: good PEBs: 872, bad PEBs: 0, corrupted PEBs: 0 ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128 ubi0: max/mean erase counter: 5/2, WL threshold: 4096, image sequence number: 210922541 ubi0: available PEBs: 0, total reserved PEBs: 872, PEBs reserved for bad PEB handling: 80 Read 0 bytes from volume kernel to 44000000 No size specified -> Using max size (6348800) ## Loading kernel from FIT Image at 44000028 ... Using 'config@oak03' configuration Trying 'kernel@1' kernel subimage Description: ARM OpenWrt Linux-4.4.60 Type: Kernel Image Compression: gzip compressed Data Start: 0x4400010c Data Size: 4105365 Bytes = 3.9 MiB Architecture: ARM OS: Linux Load Address: 0x41208000 Entry Point: 0x41208000 Hash algo: crc32 Hash value: 6ade0860 Hash algo: sha1 Hash value: d8ababeb30ab47239387ba900a64ff6baab9a681 Verifying Hash Integrity ... crc32+ sha1+ OK ## Loading fdt from FIT Image at 44000028 ... Using 'config@oak03' configuration Trying 'fdt@oak03' fdt subimage Description: ARM OpenWrt qcom-ipq807x-hkxx device tree blob Type: Flat Device Tree Compression: uncompressed Data Start: 0x444a500c Data Size: 87302 Bytes = 85.3 KiB Architecture: ARM Hash algo: crc32 Hash value: f58e7356 Hash algo: sha1 Hash value: 3dde4c594f8ece1d58a1000870e4d3f242551057 Verifying Hash Integrity ... crc32+ sha1+ OK Booting using the fdt blob at 0x444a500c Uncompressing Kernel Image ... OK Loading Device Tree to 4a3e7000, end 4a3ff505 ... OK Using machid 0x801000d from environment Starting kernel ... [ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Initializing cgroup subsys cpuset [ 0.000000] Initializing cgroup subsys cpu [ 0.000000] Initializing cgroup subsys cpuacct [ 0.000000] Linux version 4.4.60 (rajenkins@1c619b3cd10d) (gcc version 5.2.0 (OpenWrt GCC 5.2.0 rtm-7.2.7.15+r49254) ) #3 SMP PREEMPT Thu Nov 14 17:04:45 UTC 2024 [ 0.000000] CPU: ARMv7 Processor [410fd034] revision 4 (ARMv7), cr=10c0383d [ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache [ 0.000000] Machine model: Qualcomm Technologies, Inc. IPQ807x/AP-OAK03 [ 0.000000] Ignoring memory range 0x40000000 - 0x41000000 [ 0.000000] Reserved memory: OVERLAP DETECTED! [ 0.000000] wifi_dump@51100000 (0x51100000--0x51700000) overlaps with wigig_dump@51300000 (0x51300000--0x51700000) [ 0.000000] Memory policy: Data cache writealloc [ 0.000000] psci: probing for conduit method from DT. [ 0.000000] psci: PSCIv1.0 detected in firmware. [ 0.000000] psci: Using standard PSCI v0.2 function IDs [ 0.000000] psci: MIGRATE_INFO_TYPE not supported. [ 0.000000] PERCPU: Embedded 11 pages/cpu @be6ae000 s15424 r8192 d21440 u45056 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 226340 [ 0.000000] Kernel command line: uboot_ver=V1.0.14 console=ttyMSM0,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait swiotlb=1 coherent_pool=2M [ 0.000000] PID hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Dentry cache hash table entries: 131072 (order: 7, 524288 bytes) [ 0.000000] Inode-cache hash table entries: 65536 (order: 6, 262144 bytes) [ 0.000000] Memory: 893912K/914432K available (6308K kernel code, 397K rwdata, 1988K rodata, 1024K init, 453K bss, 20520K reserved, 0K cma-reserved, 0K highmem) [ 0.000000] Virtual kernel memory layout: [ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB) [ 0.000000] fixmap : 0xffc00000 - 0xfff00000 (3072 kB) [ 0.000000] vmalloc : 0xbf800000 - 0xff800000 (1024 MB) [ 0.000000] lowmem : 0x80000000 - 0xbf000000 (1008 MB) [ 0.000000] pkmap : 0x7fe00000 - 0x80000000 ( 2 MB) [ 0.000000] modules : 0x7f000000 - 0x7fe00000 ( 14 MB) [ 0.000000] .text : 0x80208000 - 0x80b1a3f8 (9289 kB) [ 0.000000] .init : 0x80c00000 - 0x80d00000 (1024 kB) [ 0.000000] .data : 0x80d00000 - 0x80d63670 ( 398 kB) [ 0.000000] .bss : 0x80d66000 - 0x80dd7420 ( 454 kB) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 [ 0.000000] Preemptible hierarchical RCU implementation. [ 0.000000] Build-time adjustment of leaf fanout to 32. [ 0.000000] NR_IRQS:16 nr_irqs:16 16 [ 0.000000] Architected cp15 timer(s) running at 19.20MHz (virt). [ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns [ 0.000005] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns [ 0.000017] Switching to timer-based delay loop, resolution 52ns [ 0.000744] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000) [ 0.000755] pid_max: default: 32768 minimum: 301 [ 0.000846] Mount-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000856] Mountpoint-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.001384] Initializing cgroup subsys io [ 0.001400] Initializing cgroup subsys memory [ 0.001423] Initializing cgroup subsys devices [ 0.001435] Initializing cgroup subsys freezer [ 0.001445] Initializing cgroup subsys net_cls [ 0.001454] Initializing cgroup subsys pids [ 0.001476] CPU: Testing write buffer coherency: ok [ 0.001710] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.001756] Setting up static identity map for 0x41300000 - 0x41300058 [ 0.052963] MSM Memory Dump base table set up [ 0.052987] MSM Memory Dump apps data table set up [ 0.090173] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001 [ 0.120154] CPU2: thread -1, cpu 2, socket 0, mpidr 80000002 [ 0.150187] CPU3: thread -1, cpu 3, socket 0, mpidr 80000003 [ 0.150242] Brought up 4 CPUs [ 0.150261] SMP: Total of 4 processors activated (153.60 BogoMIPS). [ 0.150267] CPU: All CPU(s) started in SVC mode. [ 0.174690] VFP support v0.3: implementor 41 architecture 3 part 40 variant 3 rev 4 [ 0.175004] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.175028] futex hash table entries: 1024 (order: 4, 65536 bytes) [ 0.175391] pinctrl core: initialized pinctrl subsystem [ 0.176420] NET: Registered protocol family 16 [ 0.177527] DMA: preallocated 2048 KiB pool for atomic coherent allocations [ 0.200028] cpuidle: using governor ladder [ 0.230047] cpuidle: using governor menu [ 0.230277] NET: Registered protocol family 42 [ 0.232304] Soc version is not 1, changing clock offsets [ 0.242338] irq: no irq domain found for /soc/smp2p-wcss/slave-kernel ! [ 0.245163] irq: no irq domain found for /soc/smp2p-wcss/slave-kernel ! [ 0.265143] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers. [ 0.265154] hw-breakpoint: maximum watchpoint size is 8 bytes. [ 0.267120] Read of property:soc_version_minor from node failed [ 0.267130] CPU: IPQ8174, SoC Version: 2.0 [ 0.267717] qcom,cpr3-npu-regulator a4000.npu-cpr: NPU CPR valid fuse count: 2 [ 0.268124] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 2 [ 0.269134] spmi spmi-0: PMIC Arb Version-2 (0x20010000) [ 0.270873] IPC logging disabled [ 0.270880] IPC logging disabled [ 0.270885] IPC logging disabled [ 0.270889] IPC logging disabled [ 0.270894] IPC logging disabled [ 0.271126] sps:sps is ready. [ 0.302254] pps_core: LinuxPPS API ver. 1 registered [ 0.302261] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it> [ 0.302286] PTP clock support registered [ 0.304128] Advanced Linux Sound Architecture Driver Initialized. [ 0.304970] clocksource: Switched to clocksource arch_sys_counter [ 0.308874] NET: Registered protocol family 2 [ 0.309529] TCP established hash table entries: 8192 (order: 3, 32768 bytes) [ 0.309625] TCP bind hash table entries: 8192 (order: 4, 65536 bytes) [ 0.309766] TCP: Hash tables configured (established 8192 bind 8192) [ 0.309817] UDP hash table entries: 512 (order: 2, 16384 bytes) [ 0.309853] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes) [ 0.310020] NET: Registered protocol family 1 [ 0.311378] hw perfevents: enabled with armv7_cortex_a7 PMU driver, 7 counters available [ 0.319757] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.319772] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.323750] Key type asymmetric registered [ 0.323764] Asymmetric key parser 'x509' registered [ 0.323800] io scheduler noop registered [ 0.323813] io scheduler deadline registered (default) [ 0.326854] 20000000.pci supply vdda not found, using dummy regulator [ 0.326905] 20000000.pci supply vdda_phy not found, using dummy regulator [ 0.326961] 20000000.pci supply vdda_refclk not found, using dummy regulator [ 0.327631] PCI host bridge /soc/pci@20000000 ranges: [ 0.327657] IO 0x20200000..0x2020ffff -> 0x20200000 [ 0.327672] MEM 0x20220000..0x2fffffff -> 0x20220000 [ 1.476660] qcom-pcie 20000000.pci: phy link never came up [ 1.478219] qcom-pcie 20000000.pci: hostinit failed [ 1.478229] qcom-pcie 20000000.pci: cannot initialize host [ 1.478364] qcom-pcie: probe of 20000000.pci failed with error -110 [ 1.478537] 10000000.pci supply vdda not found, using dummy regulator [ 1.478577] 10000000.pci supply vdda_phy not found, using dummy regulator [ 1.478613] 10000000.pci supply vdda_refclk not found, using dummy regulator [ 1.479176] PCI host bridge /soc/pci@10000000 ranges: [ 1.479198] IO 0x10200000..0x1020ffff -> 0x10200000 [ 1.479211] MEM 0x10220000..0x1fffffff -> 0x10220000 [ 2.626663] qcom-pcie 10000000.pci: phy link never came up [ 2.628221] qcom-pcie 10000000.pci: hostinit failed [ 2.628231] qcom-pcie 10000000.pci: cannot initialize host [ 2.628342] qcom-pcie: probe of 10000000.pci failed with error -110 [ 2.628783] MDSS QPIC HW Base phy_Address=0x7980000 virt=bfb40000 [ 2.629231] mdss_qpic_panel_probe: Panel Name = qpic lcd panel [ 2.631041] mdss_fb_register: FrameBuffer[0] 800x480 registered successfully! [ 2.635660] global timer is null [ 2.635901] msm_rpm_log_probe: OK [ 2.636307] msm-dcc b3000.dcc: DCC XPU is not specified [ 2.636561] msm-dcc b3000.dcc: jiffies_64: 0xffff8bd7, cntvct_64: 0x1793d528 [ 2.636573] msm-dcc b3000.dcc: gcnt_hi: 0x00000000(0xbfb1e004) [ 2.636583] msm-dcc b3000.dcc: gcnt_lo: 0x1793d703(0xbfb1e000) [ 2.637435] scm_call failed: func id 0x2000119 ret: -1 syscall returns: 0x0, 0x0, 0x0 [ 2.637444] TZ SMMU State: Can't detect SMMU State [ 2.637498] TZ Log : Will warn on Access Violation, as paniconaccessviolation is not set [ 2.639455] msm_serial 78b3000.serial: msm_serial: detected port #0 [ 2.639497] msm_serial 78b3000.serial: uartclk = 3686400 [ 2.639538] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 23, base_baud = 230400) is a MSM [ 2.639558] msm_serial: console setup on port #0 [ 3.475403] console [ttyMSM0] enabled [ 3.480419] msm_serial 78b1000.serial: msm_serial: detected port #1 [ 3.483657] msm_serial 78b1000.serial: uartclk = 19200000 [ 3.489744] 78b1000.serial: ttyMSM1 at MMIO 0x78b1000 (irq = 24, base_baud = 1200000) is a MSM [ 3.495714] msm_serial: driver initialized [ 3.504157] msm_serial_hsl_init: driver initialized [ 3.517460] brd: module loaded [ 3.522790] loop: module loaded [ 3.525111] QPIC controller hw version Major:1, Minor:5 [ 3.525432] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xac [ 3.529944] nand: ONFI 10-Compliant Winbond W29N04GZ [ 3.536582] nand: 512 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 [ 3.541618] 30 ofpart partitions found on MTD device qcom_nand.0 [ 3.549787] Creating 30 MTD partitions on "qcom_nand.0": [ 3.555051] 0x000000000000-0x000000100000 : "0:SBL1" [ 3.561975] 0x000000100000-0x000000200000 : "0:MIBIB" [ 3.566836] 0x000000200000-0x000000280000 : "0:BOOTCONFIG" [ 3.571361] 0x000000280000-0x000000300000 : "0:BOOTCONFIG1" [ 3.576771] 0x000000300000-0x000000600000 : "0:QSEE" [ 3.584213] 0x000000600000-0x000000900000 : "0:QSEE_1" [ 3.589426] 0x000000900000-0x000000980000 : "0:DEVCFG" [ 3.592433] 0x000000980000-0x000000a00000 : "0:DEVCFG_1" [ 3.597593] 0x000000a00000-0x000000a80000 : "0:APDP" [ 3.603051] 0x000000a80000-0x000000b00000 : "0:APDP_1" [ 3.607930] 0x000000b00000-0x000000b80000 : "0:RPM" [ 3.612854] 0x000000b80000-0x000000c00000 : "0:RPM_1" [ 3.617660] 0x000000c00000-0x000000c80000 : "0:CDT" [ 3.622855] 0x000000c80000-0x000000d00000 : "0:CDT_1" [ 3.627579] 0x000000d00000-0x000000d80000 : "0:APPSBLENV" [ 3.632790] 0x000000d80000-0x000000e80000 : "0:APPSBL" [ 3.638599] 0x000000e80000-0x000000f80000 : "0:APPSBL_1" [ 3.643631] 0x000000f80000-0x000001000000 : "0:ART" [ 3.648700] 0x000001000000-0x000001080000 : "0:ETHPHYFW" [ 3.653206] 0x000001080000-0x000001180000 : "nvram" [ 3.659188] 0x000001180000-0x000001280000 : "nvram2" [ 3.663797] 0x000001280000-0x000001380000 : "board_data" [ 3.669041] 0x000001380000-0x000001480000 : "latest_rootfs" [ 3.674349] 0x000001480000-0x000001580000 : "ML1" [ 3.679662] 0x000001580000-0x000001680000 : "DebugMsg" [ 3.684507] 0x000001680000-0x000002080000 : "sstorage" [ 3.696602] 0x000002080000-0x000003e80000 : "Reserved1" [ 3.720384] 0x000003e80000-0x000011c00000 : "Reserved2" [ 3.893054] 0x000011c00000-0x000018900000 : "rootfs" [ 3.978573] mtd: device 29 (rootfs) set to be root filesystem [ 3.978836] mtdsplit: no squashfs found in "rootfs" [ 3.983300] 0x000018900000-0x00001f600000 : "rootfs_1" [ 4.073885] libphy: Fixed MDIO Bus: probed [ 4.294628] qca-mdio 90000.mdio: Could not find phy-reset-gpio [ 4.294773] libphy: qca_mdio: probed [ 4.300773] qca-mdio 90000.mdio: qca-mdio driver was registered [ 4.303330] cnss: INFO: IPC Logging is disabled! [ 4.309150] Skip QCA8074V1 in V2 platform [ 4.313645] cnss[2]: INFO: Disabling regdb support for QCA8074v2 [ 4.317770] cnss[2]: INFO: Platform driver probed successfully. plat bd068010 tgt 0xfffe [ 4.323838] i2c /dev entries driver [ 4.365600] device-mapper: ioctl: 4.34.0-ioctl (2015-10-28) initialised: dm-devel@redhat.com [ 4.366102] sdhci: Secure Digital Host Controller Interface driver [ 4.373098] sdhci: Copyright(c) Pierre Ossman [ 4.379112] sdhci-pltfm: SDHCI platform and OF driver helper [ 4.383951] qcom_ice_get_pdevice: invalid device list [ 4.389266] sdhci_msm 7824900.sdhci: sdhci_msm_ice_get_dev: ICE device not probed yet [ 4.394200] sdhci_msm 7824900.sdhci: sdhci_msm_probe: required ICE device not probed yet err = -517 [ 4.402414] sdhci_msm 7864900.sdhci: sdhci_msm_probe: ICE device is not enabled [ 4.410957] sdhci_msm 7864900.sdhci: Got SD LDO GPIO #21 [ 4.518207] sdhci_msm 7864900.sdhci: No vreg data found for vdd [ 4.518236] sdhci_msm 7864900.sdhci: No vreg data found for vdd-io [ 4.533801] pmd9655_ldo11: supplied by e-smps1-reg [ 4.533912] sdhci_msm 7864900.sdhci: No vmmc regulator found [ 4.575094] mmc0: SDHCI controller on 7864900.sdhci [7864900.sdhci] using ADMA 64-bit [ 4.577460] qcom_ice_get_device_tree_data: No vdd-hba-supply regulator, assuming not needed [ 4.581949] ICE IRQ = 26 [ 4.591290] sps_register_bam_device : unable to create IPC Logging 0 for bam 0x08b04000 [ 4.592839] sps_register_bam_device : unable to create IPC Logging 1 for bam 0x08b04000sps_register_bam_device : unable to create IPC Logging 2 for bam 0x08b04000 [ 4.608559] sps_register_bam_device : unable to create IPC Logging 3 for bam 0x08b04000sps_register_bam_device : unable to create IPC Logging 4 for bam 0x08b04000 [ 4.623042] sps:BAM 0x08b04000 is registered.[ 4.632221] qcom-q6v5-wcss-pil cd00000.qcom_q6v5_wcss: ssr registeration success qcom_q6v5_wcss [ 4.633807] remoteproc remoteproc0: cd00000.qcom_q6v5_wcss is available [ 4.643120] SPMI VADC - Min ch: 0 Max ch: 15 [ 4.650840] of_graph_get_next_endpoint(): no port node found in /soc/csr@6001000 [ 4.653606] coresight-csr 6001000.csr: CSR initialized [ 4.661091] of_graph_get_next_endpoint(): no port node found in /soc/cti@6010000 [ 4.666044] of_graph_get_next_endpoint(): no port node found in /soc/cti@6011000 [ 4.673562] of_graph_get_next_endpoint(): no port node found in /soc/cti@6012000 [ 4.680972] of_graph_get_next_endpoint(): no port node found in /soc/cti@6013000 [ 4.688342] of_graph_get_next_endpoint(): no port node found in /soc/cti@6014000 [ 4.695725] of_graph_get_next_endpoint(): no port node found in /soc/cti@6015000 [ 4.703085] of_graph_get_next_endpoint(): no port node found in /soc/cti@6016000 [ 4.710475] of_graph_get_next_endpoint(): no port node found in /soc/cti@6017000 [ 4.717861] of_graph_get_next_endpoint(): no port node found in /soc/cti@6018000 [ 4.725241] of_graph_get_next_endpoint(): no port node found in /soc/cti@6019000 [ 4.732603] of_graph_get_next_endpoint(): no port node found in /soc/cti@601a000 [ 4.739995] of_graph_get_next_endpoint(): no port node found in /soc/cti@601b000 [ 4.747379] of_graph_get_next_endpoint(): no port node found in /soc/cti@601c000 [ 4.754741] of_graph_get_next_endpoint(): no port node found in /soc/cti@601d000 [ 4.762138] of_graph_get_next_endpoint(): no port node found in /soc/cti@601e000 [ 4.769513] of_graph_get_next_endpoint(): no port node found in /soc/cti@601f000 [ 4.777982] of_graph_get_next_endpoint(): no port node found in /soc/cti@6198000 [ 4.784263] of_graph_get_next_endpoint(): no port node found in /soc/cti@6199000 [ 4.791670] of_graph_get_next_endpoint(): no port node found in /soc/cti@619a000 [ 4.799048] of_graph_get_next_endpoint(): no port node found in /soc/cti@619b000 [ 4.806434] of_graph_get_next_endpoint(): no port node found in /soc/cti@610c000 [ 4.813969] sps_register_bam_device : unable to create IPC Logging 0 for bam 0x06044000 [ 4.820979] sps_register_bam_device : unable to create IPC Logging 1 for bam 0x06044000sps_register_bam_device : unable to create IPC Logging 2 for bam 0x06044000 [ 4.836690] sps_register_bam_device : unable to create IPC Logging 3 for bam 0x06044000sps_register_bam_device : unable to create IPC Logging 4 for bam 0x06044000 [ 4.851180] sps:BAM 0x06044000 is registered.[ 4.858270] coresight-tmc 6028000.tmc: TMC initialized [ 4.862298] coresight-tmc 6027000.tmc: TMC initialized [ 4.867447] coresight-funnel 6021000.funnel: FUNNEL initialized [ 4.872437] coresight-funnel 6100000.funnel: FUNNEL initialized [ 4.878275] coresight-funnel 6120000.funnel: FUNNEL initialized [ 4.884140] coresight-funnel 6130000.funnel: FUNNEL initialized [ 4.890078] coresight-funnel 61a1000.funnel: FUNNEL initialized [ 4.896620] coresight-etm4x 619c000.etm: ETM 4.0 initialized [ 4.902173] coresight-etm4x 619d000.etm: ETM 4.0 initialized [ 4.908103] coresight-etm4x 619e000.etm: ETM 4.0 initialized [ 4.913742] coresight-etm4x 619f000.etm: ETM 4.0 initialized [ 4.919106] coresight-replicator-qcom 6026000.replicator: REPLICATOR 1.0 initialized [ 4.924838] coresight-stm 6002000.stm: STM initialized [ 4.933627] of_graph_get_next_endpoint(): no port node found in /soc/hwevent@6101000 [ 4.937247] coresight-hwevent 6101000.hwevent: Hardware Event driver initialized [ 4.946736] ipq_audio soc:sound@0: ASoC: CPU DAI qca-i2s-dai not registered [ 4.952386] ipq_audio soc:sound@0: snd_soc_register_card() failed:-517 [ 4.961854] qca_codec 0-0012: i2c regmap done [ 4.967254] Netfilter messages via NETLINK v0.30. [ 4.970152] nf_conntrack version 0.5.0 (13967 buckets, 55868 max) [ 4.975459] ip_tables: (C) 2000-2006 Netfilter Core Team [ 4.981660] NET: Registered protocol family 10 [ 4.986997] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 4.990531] NET: Registered protocol family 17 [ 4.996012] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this. [ 5.000338] Bridge firewalling registered [ 5.013080] 8021q: 802.1Q VLAN Support v1.8 [ 5.017264] Registering SWP/SWPB emulation handler [ 5.022168] qcom,cpr3-npu-regulator a4000.npu-cpr: NPU CPR valid fuse count: 2 [ 5.026060] pmd9655_s4: supplied by e-smps1-reg [ 5.033171] cpr3_mem_acc_init: npu: not using memory accelerator regulator [ 5.037493] npu_corner: fused NOM: open-loop= 792000 uV [ 5.044394] npu_corner: fused TURBO: open-loop= 856000 uV [ 5.050319] npu_corner: fused NOM: open-loop= 792000 uV [ 5.055868] npu_corner: fused TURBO: open-loop= 856000 uV [ 5.061524] npu_corner: Normal and Cold condition init done. Default to normal. [ 5.067518] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 2 [ 5.074290] pmd9655_s3: supplied by e-smps1-reg [ 5.081608] cpr4_ipq807x_apss_read_fuse_data: apc_corner: speed bin = 0 [ 5.085991] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR fusing revision = 1 [ 5.092577] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR misc fuse value = 0 [ 5.100246] cpr4_ipq807x_apss_read_fuse_data: apc_corner: Voltage boost fuse config = 0 boost = disable [ 5.107747] cpr3_mem_acc_init: apc: not using memory accelerator regulator [ 5.116894] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused SVS: open-loop= 704000 uV [ 5.123831] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused NOM: open-loop= 816000 uV [ 5.133876] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused SVS: quot[ 7]= 726, quot_offset[ 7]= 0 [ 5.143639] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused NOM: quot[ 7]= 937, quot_offset[ 7]= 210 [ 5.154585] cpr3_regulator_init_ctrl: apc: Default CPR mode = closed-loop [ 5.166300] cpufreq: cpufreq_online: CPU0: Running at unlisted freq: 800000 KHz [ 5.172284] cpufreq: cpufreq_online: CPU0: Unlisted initial frequency changed to: 1017600 KHz [ 5.179890] qcom_ice_get_pdevice: found ice device bdbafe40 [ 5.188004] qcom_ice_get_pdevice: matching platform device be234a00 [ 5.193389] sdhci_msm 7824900.sdhci: No vreg data found for vdd [ 5.199623] sdhci_msm 7824900.sdhci: No vreg data found for vdd-io [ 5.205717] qcom_ice 7803000.sdcc1ice: QC ICE 2.1.44 device found @0xc08b8000 [ 5.212812] sdhci_msm 7824900.sdhci: No vmmc regulator found [ 5.218970] sdhci_msm 7824900.sdhci: No vqmmc regulator found [ 5.264978] mmc1: SDHCI controller on 7824900.sdhci [7824900.sdhci] using ADMA 64-bit [ 5.270338] ipq_audio soc:sound@0: qca-i2s-codec-dai <-> qca-i2s-dai mapping ok [ 5.272696] ipq_audio soc:sound@0: qca-tdm-codec-dai <-> qca-tdm-dai mapping ok [ 5.309582] ubi0: attaching mtd29 [ 5.317174] random: nonblocking pool is initialized [ 5.751593] ubi0: scanning is finished [ 5.757513] ubi0: attached mtd29 (name "rootfs", size 109 MiB) [ 5.757534] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 5.762229] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 5.769097] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 5.775950] ubi0: good PEBs: 872, bad PEBs: 0, corrupted PEBs: 0 [ 5.782713] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128 [ 5.788973] ubi0: max/mean erase counter: 5/2, WL threshold: 4096, image sequence number: 210922541 [ 5.796006] ubi0: available PEBs: 0, total reserved PEBs: 872, PEBs reserved for bad PEB handling: 80 [ 5.804950] ubi0: background thread "ubi_bgt0d" started, PID 142 [ 5.815580] hctosys: unable to open rtc device (rtc0) [ 5.827669] ALSA device list: [ 5.827689] #0: ipq8074_snd_card [ 5.831874] VFS: Mounted root (squashfs filesystem) readonly on device 31:32. [ 5.834559] Freeing unused kernel memory: 1024K (80c00000 - 80d00000) [ 6.160284] init: Console is alive [ 6.160384] init: - watchdog - [ 7.610813] usbcore: registered new interface driver usbfs [ 7.610870] usbcore: registered new interface driver hub [ 7.615294] usbcore: registered new device driver usb [ 7.622103] Button Hotplug driver version 0.4.1 [ 7.642742] SCSI subsystem initialized [ 7.652706] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 7.653134] ehci-platform: EHCI generic platform driver [ 7.667001] msm-usb-ssphy-qmp 78000.ssphy: Initializing QMP phy [ 7.675999] msm-usb-ssphy-qmp 78000.ssphy: QMP PHY initialization timeout [ 7.676023] msm-usb-ssphy-qmp 78000.ssphy: USB3_PHY_PCS_STATUS:68686868 [ 7.882891] msm-usb-ssphy-qmp 58000.ssphy: Initializing QMP phy [ 7.893698] msm-usb-ssphy-qmp 58000.ssphy: QMP PHY initialization timeout [ 7.893722] msm-usb-ssphy-qmp 58000.ssphy: USB3_PHY_PCS_STATUS:68686868 [ 8.105136] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller [ 8.105178] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1 [ 8.109661] xhci-hcd xhci-hcd.0.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x00010010 [ 8.117112] xhci-hcd xhci-hcd.0.auto: irq 231, io mem 0x08a00000 [ 8.126212] hub 1-0:1.0: USB hub found [ 8.132001] hub 1-0:1.0: 1 port detected [ 8.135784] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller [ 8.139634] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2 [ 8.144991] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM. [ 8.152847] hub 2-0:1.0: USB hub found [ 8.160828] hub 2-0:1.0: 1 port detected [ 8.164601] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller [ 8.168470] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 3 [ 8.173883] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x00010010 [ 8.181334] xhci-hcd xhci-hcd.1.auto: irq 232, io mem 0x08c00000 [ 8.190358] hub 3-0:1.0: USB hub found [ 8.196249] hub 3-0:1.0: 1 port detected [ 8.199962] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller [ 8.203870] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 4 [ 8.209205] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM. [ 8.217042] hub 4-0:1.0: USB hub found [ 8.225062] hub 4-0:1.0: 1 port detected [ 8.232219] usbcore: registered new interface driver usb-storage [ 8.233350] usbcore: registered new interface driver uas [ 9.163172] init: - preinit - [ 9.344916] ipq807x-pinctrl 1000000.pinctrl: pin GPIO_34 already requested by soc:pcm_lb@0; cannot claim for soc:gpio_keys [ 9.344955] ipq807x-pinctrl 1000000.pinctrl: pin-34 (soc:gpio_keys) status -22 [ 9.354851] ipq807x-pinctrl 1000000.pinctrl: could not request pin 34 (GPIO_34) from group gpio34 on device 1000000.pinctrl [ 9.362075] gpio-keys soc:gpio_keys: Error applying setting, reverse things back Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level Before mount_root Mount volumes in Reserved 2 partiton [ 11.555960] 0x000002080000-0x000002a80000 : "persistent" [ 11.563075] 0x000002a80000-0x000011c00000 : "cache" [ 11.790923] ubi1: attaching mtd34 [ 11.831239] ubi1: scanning is finished [ 11.836244] ubi1 warning: print_rsvd_warning: cannot reserve enough PEBs for bad PEB handling, reserved 5, need 80 [ 11.836616] ubi1: attached mtd34 (name "persistent", size 10 MiB) [ 11.845487] ubi1: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 11.851638] ubi1: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 11.858416] ubi1: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 11.865273] ubi1: good PEBs: 80, bad PEBs: 0, corrupted PEBs: 0 [ 11.872035] ubi1: user volume: 1, internal volumes: 1, max. volumes count: 128 [ 11.877948] ubi1: max/mean erase counter: 1790/1134, WL threshold: 4096, image sequence number: 858911520 [ 11.885246] ubi1: available PEBs: 0, total reserved PEBs: 80, PEBs reserved for bad PEB handling: 5 [ 11.894882] ubi1: background thread "ubi_bgt1d" started, PID 213 [ 11.900062] ubi2: attaching mtd35 [ 12.908290] ubi2: scanning is finished [ 12.914753] ubi2: attached mtd35 (name "cache", size 241 MiB) [ 12.914775] ubi2: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 12.919484] ubi2: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 12.926248] ubi2: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 12.933098] ubi2: good PEBs: 1932, bad PEBs: 0, corrupted PEBs: 0 [ 12.939875] ubi2: user volume: 1, internal volumes: 1, max. volumes count: 128 [ 12.946128] ubi2: max/mean erase counter: 633/412, WL threshold: 4096, image sequence number: 382127801 [ 12.953243] ubi2: available PEBs: 43, total reserved PEBs: 1889, PEBs reserved for bad PEB handling: 80 [ 12.962546] ubi2: background thread "ubi_bgt2d" started, PID 217 [ 13.052297] UBIFS (ubi1:0): background thread "ubifs_bgt1_0" started, PID 246 [ 13.078458] UBIFS (ubi1:0): recovery needed [ 13.211480] UBIFS (ubi1:0): recovery completed [ 13.211540] UBIFS (ubi1:0): UBIFS: mounted UBI device 1, volume 0, name "Persistent" [ 13.214811] UBIFS (ubi1:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 13.222730] UBIFS (ubi1:0): FS size: 7745536 bytes (7 MiB, 61 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs) [ 13.232531] UBIFS (ubi1:0): reserved for root: 365840 bytes (357 KiB) [ 13.242421] UBIFS (ubi1:0): media format: w4/r0 (latest is w4/r0), UUID 05217C74-126D-4803-BF2D-040D23229183, small LPT model [ 13.257782] UBIFS (ubi2:0): background thread "ubifs_bgt2_0" started, PID 251 [ 13.286643] UBIFS (ubi2:0): recovery needed [ 13.691928] UBIFS (ubi2:0): recovery completed [ 13.692018] UBIFS (ubi2:0): UBIFS: mounted UBI device 2, volume 0, name "Reserved" [ 13.695283] UBIFS (ubi2:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 13.702829] UBIFS (ubi2:0): FS size: 227667968 bytes (217 MiB, 1793 LEBs), journal size 11427840 bytes (10 MiB, 90 LEBs) [ 13.712818] UBIFS (ubi2:0): reserved for root: 4952683 bytes (4836 KiB) [ 13.723748] UBIFS (ubi2:0): media format: w4/r0 (latest is w4/r0), UUID 85060E5C-036D-4D85-9E95-92A92F958817, small LPT model After mount_root 12064+0 records in 12064+0 records out 12064 bytes (11.8KB) copied, 0.038066 seconds, 309.5KB/s 131072+0 records in 131072+0 records out 131072 bytes (128.0KB) copied, 0.385430 seconds, 332.1KB/s [ 14.240450] procd: - early - [ 14.240495] procd: - watchdog - [ 14.893848] procd: - ubus - [ 15.898748] procd: - init - Please press Enter to activate this console. [ 16.842537] ubi3: attaching mtd27 [ 16.883061] ubi3 error: scan_peb: bad image sequence number 382127801 in PEB 80, expected 858911520 [ 16.883089] Erase counter header dump: [ 16.890909] magic 0x55424923 [ 16.894715] version 1 [ 16.898455] ec 629 [ 16.901483] vid_hdr_offset 2048 [ 16.904435] data_offset 4096 [ 16.907938] image_seq 382127801 [ 16.911120] hdr_crc 0xb49a2fb [ 16.914679] erase counter header hexdump: [ 16.918414] ubi3 error: ubi_attach_mtd_dev: failed to attach mtd27, error -22 [ 22.742315] nvram_kernel_module: module license 'unspecified' taints kernel. [ 22.742347] Disabling lock debugging due to kernel taint [ 22.763886] acos_nvram: magic error:0x4294967295lx! [ 22.798247] Sorry, registering the character device failed with -16 [ 22.805552] get lan_hwaddr fail! [ 22.842548] Initialise conn table 2048 entries Restoring defaults...nvram set default values... Reading board data... hwtype=RBR750<,hwrev= env_region_num=2 read_bd(1947) region_num=2 2 (WW) done orch_f_convert_acos_nvram_to_ntgr=============================================== setTimezone(2821), TZ='GMT0DST,M03.05.00,M10.05.00' into /tmp/TZ get_gpio_value:422 22 0 /lib/firmware/qca-nss0.bin 33 /lib/firmware/qca-nss1.bin 33 qcawifi configuration is disable ******FW ini file not found****** ******No cold_boot_support***** No Direct-Attach chipsets found. ******FW ini file not found****** ******No cold_boot_support***** acfg_tool: Issuing blocking call to wait for events CAP: install SON package entering seal boot function... /tmp/dal soft link done, start armor files backup... /opt/cache/armor-bd/bitdefender/etc not present ...... why ?? Need to create.. /opt/cache/armor-bd/bitdefender/etc created by seal boot function... bd_host_dir not present ??? exiting seal boot function... acfg_tool: Issuing blocking call to wait for events config_vlan:1301 [ 62.813244] ==== br-guest IP address is changed!! [ 62.852703] ==== br-lan IP address is changed!! [ 62.852730] g_networkIP=0xc0a80101, g_networkMask=0xffffff00, g_networkId=0xc0a80100 [ 62.879970] ==== lo IP address is changed!! [wsplcd]WLAN interface ath1 is not ready hyd: some interface(s) are not ready. hyd: ERROR: Private network interface checking failed check SKU before monit region code: 0002 env_region_num=2 set_region_bd(1393) region_num=2 2 (WW) hyd: some interface(s) are not ready. hyd: ERROR: Private network interface checking failed Skipped acos_wait in te_test_mode. change_led_behavior:56 led_state : -1 swresetd: No such file or directory telnetenabled: No such file or directory cat: can't open '/sys/class/net/ath0/operstate': No such file or directory POT integrity check OK. POT time is up. Unknown option: & start_dhcpsv6,3022 ipv6_proto=disable mDNSNetMonitor: No such file or directory check_lang starting... device_detect start by monit dal_cb_handler start by monit httpd start by monit killall: map_d: no process killed check_fw start by monit ifconfig: Bad address , usStartPort: 49, usEndPort: 49 agApi_fwServiceAdd 2504 sName: Telnet, bProtocol: , usStartPort: 23, usEndPort: 23 agApi_fwServiceAdd 2504 sName: TFTP, bProtocol: , usStartPort: 69, usEndPort: 69 agApi_fwServiceAdd 2504 sName: VDOLIVE, bProtocol: , usStartPort: 7000, usEndPort: 7000 agApi_fwServiceAdd 2504 sName: VPN-IPSEC, bProtocol: , usStartPort: 500, usEndPort: 500 agApi_fwServiceAdd 2504 sName: VPN-L2TP, bProtocol: , usStartPort: 1701, usEndPort: 1701 agApi_fwServiceAdd 2504 sName: PPTP, bProtocol: , usStartPort: 1723, usEndPort: 1723 cat: can't open '/sys/class/net/ath0/operstate': No such file or directory main(2411)==> start_services done. [ 80.601505] LAN hook to br-lan (if 29) [ 80.603561] IOCTL_AG_REGION_SET: English start_wan(1421) Start DHCP client daemon... Error: Item not found Error: Item not found Write wdhcp6c config done! main,2446 start_wan_ipv6! cat: can't open '/sys/class/net/ath0/operstate': No such file or directory [ 84.002342] LAN hook to br-lan (if 29) start_dhcpsv6,3022 ipv6_proto=disable Invalid arguments. USAGE: wpsd <ifname> <enable/disable/reconfig> main(2614)==> acos_service start Done. **** Platform Name: ap-oak03 ***** Copy ART caldata from /dev/mtdblock18 to /tmp/virtual_art.bin whc (repacd): starting WHC auto-configuration whc (repacd): Managed network: lan whc (repacd): Device type: RE whc (repacd): Set qcawifi.wps_pbc_extender_enhance=1 whc (repacd): Initialized lan VAPs whc (repacd): Auto create VAPs disabled whc (repacd): Auto create VAPs disabled whc (repacd): Auto create VAPs disabled whc (repacd): Auto create VAPs disabled whc (repacd): Using SON mode for GW Connected AP whc (repacd): Set radio wifi0 to QWrap Enabled=0 whc (repacd): Set radio wifi2 to QWrap Enabled=0 whc (repacd): Set iface FhAp2 to RootDistance=0 whc (repacd): Set iface FhAp5 to RootDistance=0 whc (repacd): Set iface IOT2 to RootDistance=0 whc (repacd): Set iface IOT5 to RootDistance=0 whc (repacd): Set iface BhAp5 to RootDistance=0 whc (repacd): Set iface BhAp2 to RootDistance=0 whc (repacd): Set iface Guest2 to RootDistance=0 whc (repacd): Set iface Guest5 to RootDistance=0 whc (repacd): Restarting network stack... cat: can't open '/sys/class/net/ath0/operstate': No such file or directory [ 89.191914] ==== br-guest IP address is changed!! qcawifi qcawificfg80211 disable radio wifi1 qcawifi qcawificfg80211 disable radio wifi0 qcawifi qcawificfg80211 disable radio wifi2 qcawifi qcawificfg80211: enable radio wifi1 number of vifs: FhAp2 BhAp2 Guest2 IOT2 SM0 cat: can't open '/sys/class/net/ath0/operstate': No such file or directory cat: can't open '/sys/class/net/ath0/operstate': No such file or directory HWMODE: 11GHE40 qcawifi qcawificfg80211: enable radio wifi0 descrambling key generating lighty config from lighty lua template lighttpd start by monit generating lighty root config from lighty lua template another lighttpd start with root privilege number of vifs: FhAp5 Guest5 IOT5 SM1 [Warning] hyt "td s2" command return empty result. HWMODE: 11AHE80 qcawifi qcawificfg80211: enable radio wifi2 cat: can't open '/sys/class/net/ath2/operstate': No such file or directory [Warning] hyt "td s2" command return empty result. number of vifs: BhAp5 [Warning] hyt "td s2" command return empty result. init ATD value WAN port link down!! Output solid WHITE!! [Warning] hyt "td s2" command return empty result. wsplcd: starting daemon ******FW ini file not found****** ****** Debug : essid ORBI17 istate acs_state 0 channel auto ---****SSID is 'ORBI17' mode *****---- ****** Debug : essid NETGEAR_ORBI_hidden61 istate acs_state 0 channel auto ---****SSID is 'NETGEAR_ORBI_hidden61' mode *****---- ****** Debug : essid NETGEAR-Guest istate acs_state 0 channel auto ----****Call ifconfig ath12 1 count=20 ****** Debug : essid ORBI17-IoT istate acs_state 0 channel auto ----****Call ifconfig ath13 1 count=20 ****** Debug : essid SM_0 istate acs_state 0 channel auto ---****SSID is 'SM_0' mode *****---- [Warning] hyt "td s2" command return empty result. ****** Debug : essid ORBI17 istate acs_state 0 channel 40 ---****SSID is 'ORBI17' mode *****---- ****** Debug : essid NETGEAR-Guest istate acs_state 0 channel 40 ----****Call ifconfig ath01 1 count=20 ****** Debug : essid ORBI17-IoT istate acs_state 0 channel 40 ----****Call ifconfig ath02 1 count=20 ****** Debug : essid SM_1 istate acs_state 0 channel 40 ---****SSID is 'SM_1' mode *****---- ****** Debug : essid NETGEAR_ORBI_hidden61 istate acs_state 0 channel 100 ---****SSID is 'NETGEAR_ORBI_hidden61' mode *****---- [Warning] hyt "td s2" command return empty result. hyd: starting daemon hyd: starting daemon guest whc (repacd): Version Compatibility check PASSED whc (repacd): Add VLAN ifaces for ethernet guest network support whc (repacd): For Home network all the traffic is untagged,no vlan whc (repacd): No changes; not restarting network stack... whc (repacd): Version Compatibility check PASSED whc (repacd): Starting wsplcd [Warning] hyt "td s2" command return empty result. wsplcd: starting daemon whc (repacd): Starting hyd [Warning] hyt "td s2" command return empty result. hyd: starting daemon hyd: starting daemon guest === S99 bootup_armor_done === [Warning] hyt "td s2" command return empty result. temp = 35 Threshold = 99 === S99 OTP init. done === Starting Recovery Daemon to sync pw to satellite get_gpio_value:422 22 0 Output pulse WHITE!! orch_f_convert_acos_nvram_to_ntgr=============================================== orch_f_restart_wifi(983)============ Start do orch API WIFI_RECONFIG ========== hyd: starting daemon hyd: starting daemon guest iot_enable_group optimized ifdown=1!!! [Warning] hyt "td s2" command return empty result. readDevIdTablefromDIL 201 readDevIdTablefromDIL_fillDevEntry 151 index: 0 readDevIdTablefromDIL_fillDevEntry 156 index: 0 dilapi.c: 1101: DEBUG: DIL:Entry Function:get_all_device_details Line:1101 index:0 dilapi.c: 1166: DEBUG: (DIL) - DIL-E Feature supported !! get all the newly added fields value for dil-e feature readDevIdTablefromDIL_fillDevEntry 151 index: 1 readDevIdTablefromDIL_fillDevEntry 156 index: 1 dilapi.c: 1101: DEBUG: DIL:Entry Function:get_all_device_details Line:1101 index:1 dilapi.c: 1166: DEBUG: (DIL) - DIL-E Feature supported !! get all the newly added fields value for dil-e feature readDevIdTablefromDIL_fillDevEntry 151 index: 2 readDevIdTablefromDIL_fillDevEntry 156 index: 2 dilapi.c: 1101: DEBUG: DIL:Entry Function:get_all_device_details Line:1101 index:2 dilapi.c: 1166: DEBUG: (DIL) - DIL-E Feature supported !! get all the newly added fields value for dil-e feature readDevIdTablefromDIL_fillDevEntry 151 index: 3 readDevIdTablefromDIL_fillDevEntry 156 index: 3 dilapi.c: 1101: DEBUG: DIL:Entry Function:get_all_device_details Line:1101 index:3 dilapi.c: 1166: DEBUG: (DIL) - DIL-E Feature supported !! get all the newly added fields value for dil-e feature readDevIdTablefromDIL_fillDevEntry 151 index: 4 readDevIdTablefromDIL_fillDevEntry 156 index: 4 dilapi.c: 1101: DEBUG: DIL:Entry Function:get_all_device_details Line:1101 index:4 dilapi.c: 1166: DEBUG: (DIL) - DIL-E Feature supported !! get all the newly added fields value for dil-e feature dilapi.c: 2162: DEBUG: ********** Going to reset signature device detail at index: 0 ********** dilapi.c: 1601: DEBUG: (DIL) - DIL-E Feature supported !! Reset all the newly added fields for dil-e feature dilapi.c: 2162: DEBUG: ********** Going to reset signature device detail at index: 1 ********** dilapi.c: 1601: DEBUG: (DIL) - DIL-E Feature supported !! Reset all the newly added fields for dil-e feature dilapi.c: 2162: DEBUG: ********** Going to reset signature device detail at index: 2 ********** dilapi.c: 1601: DEBUG: (DIL) - DIL-E Feature supported !! Reset all the newly added fields for dil-e feature dilapi.c: 2162: DEBUG: ********** Going to reset signature device detail at index: 3 ********** dilapi.c: 1601: DEBUG: (DIL) - DIL-E Feature supported !! Reset all the newly added fields for dil-e feature wsplcd: starting daemon readDevIdTablefromDIL 201 readDevIdTablefromDIL_fillDevEntry 151 index: 0 readDevIdTablefromDIL_fillDevEntry 156 index: 0 dilapi.c: 1101: DEBUG: DIL:Entry Function:get_all_device_details Line:1101 index:0 dilapi.c: 1166: DEBUG: (DIL) - DIL-E Feature supported !! get all the newly added fields value for dil-e feature readDevIdTablefromDIL_fillDevEntry 151 index: 4 readDevIdTablefromDIL_fillDevEntry 156 index: 4 dilapi.c: 1101: DEBUG: DIL:Entry Function:get_all_device_details Line:1101 index:4 dilapi.c: 1166: DEBUG: (DIL) - DIL-E Feature supported !! get all the newly added fields value for dil-e feature Output solid MAGENTA!! login: admin Password: === IMPORTANT ============================ Use 'passwd' to set your login password this will disable telnet and enable SSH ------------------------------------------ BusyBox v1.30.1 () built-in shell (ash) .oooooo. .o8 o8o .o. ooooooo ooooo d8P' `Y8b "888 `"' .888. `8888 d8' 888 888 oooo d8b 888oooo. oooo .8"888. Y888..8P 888 888 `888""8P d88' `88b `888 .8' `888. `8888' 888 888 888 888 888 888 .88ooo8888. .8PY888. `88b d88' 888 888 888 888 .8' `888. d8' `888b `Y8bood8P' d888b `Y8bod8P' o888o o88o o8888o o888o o88888o --------------------------------------------------------------- For those about to rock... (Chaos Calmer, 10.0.3440.3644) --------------------------------------------------------------- root@RBR750:/# cat /proc/mtd dev: size erasesize name mtd0: 20000000 00020000 "qcom_nand.0" mtd1: 00100000 00020000 "0:SBL1" mtd2: 00100000 00020000 "0:MIBIB" mtd3: 00080000 00020000 "0:BOOTCONFIG" mtd4: 00080000 00020000 "0:BOOTCONFIG1" mtd5: 00300000 00020000 "0:QSEE" mtd6: 00300000 00020000 "0:QSEE_1" mtd7: 00080000 00020000 "0:DEVCFG" mtd8: 00080000 00020000 "0:DEVCFG_1" mtd9: 00080000 00020000 "0:APDP" mtd10: 00080000 00020000 "0:APDP_1" mtd11: 00080000 00020000 "0:RPM" mtd12: 00080000 00020000 "0:RPM_1" mtd13: 00080000 00020000 "0:CDT" mtd14: 00080000 00020000 "0:CDT_1" mtd15: 00080000 00020000 "0:APPSBLENV" mtd16: 00100000 00020000 "0:APPSBL" mtd17: 00100000 00020000 "0:APPSBL_1" mtd18: 00080000 00020000 "0:ART" mtd19: 00080000 00020000 "0:ETHPHYFW" mtd20: 00100000 00020000 "nvram" mtd21: 00100000 00020000 "nvram2" mtd22: 00100000 00020000 "board_data" mtd23: 00100000 00020000 "latest_rootfs" mtd24: 00100000 00020000 "ML1" mtd25: 00100000 00020000 "DebugMsg" mtd26: 00a00000 00020000 "sstorage" mtd27: 01e00000 00020000 "Reserved1" mtd28: 0dd80000 00020000 "Reserved2" mtd29: 06d00000 00020000 "rootfs" mtd30: 06d00000 00020000 "rootfs_1" mtd31: 0060e000 0001f000 "kernel" mtd32: 02d4a000 0001f000 "ubi_rootfs" mtd33: 02c14000 0001f000 "rootfs_data" mtd34: 00a00000 00020000 "persistent" mtd35: 0f180000 00020000 "cache" mtd36: 00899000 0001f000 "Persistent" mtd37: 0da93000 0001f000 "Reserved" root@RBR750:/# ip addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: miireg: <> mtu 0 qdisc noop state DOWN group default qlen 1 link/generic 3: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000 link/ether 10:0c:6b:53:d6:9f brd ff:ff:ff:ff:ff:ff 4: eth1: <NO-CARRIER,BROADCAST,MULTICAST,ALLMULTI,UP> mtu 1500 qdisc mq master br-lan state DOWN group default qlen 1000 link/ether 10:0c:6b:53:d6:9e brd ff:ff:ff:ff:ff:ff 5: eth2: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP> mtu 1500 qdisc mq master br-lan state UP group default qlen 1000 link/ether 12:0c:6b:53:d6:9f brd ff:ff:ff:ff:ff:ff inet6 fe80::100c:6bff:fe53:d69f/64 scope link valid_lft forever preferred_lft forever 6: eth3: <NO-CARRIER,BROADCAST,MULTICAST,ALLMULTI,UP> mtu 1500 qdisc mq master br-lan state DOWN group default qlen 1000 link/ether 12:0c:6b:53:d6:a0 brd ff:ff:ff:ff:ff:ff 7: ip6tnl0@NONE: <NOARP> mtu 1452 qdisc noop state DOWN group default qlen 1 link/tunnel6 :: brd :: 8: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1 link/sit 0.0.0.0 brd 0.0.0.0 9: ifb0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 32 link/ether 06:58:63:0c:f7:36 brd ff:ff:ff:ff:ff:ff 10: ifb1: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 32 link/ether 9e:27:85:e9:dd:cd brd ff:ff:ff:ff:ff:ff 11: gre0@NONE: <NOARP> mtu 1476 qdisc noop state DOWN group default qlen 1 link/gre 0.0.0.0 brd 0.0.0.0 12: gretap0@NONE: <BROADCAST,MULTICAST> mtu 1462 qdisc noop state DOWN group default qlen 1000 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff 13: ip6gre0@NONE: <NOARP> mtu 1448 qdisc noop state DOWN group default qlen 1 link/gre6 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 brd 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 14: bond0: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 3a:0f:e9:4f:11:f6 brd ff:ff:ff:ff:ff:ff 15: ipsecdummy: <> mtu 1500 qdisc noop state DOWN group default qlen 1 link/generic 16: teql0: <NOARP> mtu 1500 qdisc noop state DOWN group default qlen 100 link/void 17: wifi0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 2699 link/ieee802.11 10:0c:6b:53:d6:a1 brd ff:ff:ff:ff:ff:ff 18: wifi1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 2699 link/ieee802.11 10:0c:6b:53:d6:a0 brd ff:ff:ff:ff:ff:ff 19: wifi2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 2699 link/ieee802.11 10:0c:6b:53:d6:a2 brd ff:ff:ff:ff:ff:ff 20: soc0: <> mtu 0 qdisc noop state DOWN group default qlen 1 link/ieee802.11 21: br-guest: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 10:0c:6b:53:d6:a1 brd ff:ff:ff:ff:ff:ff inet 192.168.2.1/24 brd 192.168.2.255 scope global br-guest valid_lft forever preferred_lft forever inet6 fd1b:ecb2:6a4a::1/60 scope global noprefixroute valid_lft forever preferred_lft forever inet6 fe80::120c:6bff:fe53:d69e/64 scope link valid_lft forever preferred_lft forever 22: eth1.4093@eth1: <NO-CARRIER,BROADCAST,MULTICAST,ALLMULTI,UP> mtu 1500 qdisc noqueue master br-guest state LOWERLAYERDOWN group default qlen 1000 link/ether 10:0c:6b:53:d6:9e brd ff:ff:ff:ff:ff:ff 23: eth2.4093@eth2: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-guest state UP group default qlen 1000 link/ether 12:0c:6b:53:d6:9f brd ff:ff:ff:ff:ff:ff 24: eth3.4093@eth3: <NO-CARRIER,BROADCAST,MULTICAST,ALLMULTI,UP> mtu 1500 qdisc noqueue master br-guest state LOWERLAYERDOWN group default qlen 1000 link/ether 12:0c:6b:53:d6:a0 brd ff:ff:ff:ff:ff:ff 25: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 10:0c:6b:53:d6:9e brd ff:ff:ff:ff:ff:ff inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan valid_lft forever preferred_lft forever inet6 fd1b:ecb2:6a4a:10::1/60 scope global noprefixroute valid_lft forever preferred_lft forever inet6 fe80::120c:6bff:fe53:d69e/64 scope link valid_lft forever preferred_lft forever 26: ath1: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP group default link/ether 10:0c:6b:53:d6:a0 brd ff:ff:ff:ff:ff:ff inet6 fe80::120c:6bff:fe53:d6a0/64 scope link valid_lft forever preferred_lft forever 27: ath11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default link/ether 16:0c:6b:53:d6:a0 brd ff:ff:ff:ff:ff:ff inet6 fe80::140c:6bff:fe53:d6a0/64 scope link valid_lft forever preferred_lft forever 28: ath11.4093@ath11: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-guest state UP group default qlen 1000 link/ether 16:0c:6b:53:d6:a0 brd ff:ff:ff:ff:ff:ff 29: ath11.4094@ath11: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP group default qlen 1000 link/ether 16:0c:6b:53:d6:a0 brd ff:ff:ff:ff:ff:ff 30: ath12: <BROADCAST,MULTICAST> mtu 1500 qdisc noqueue master br-guest state DOWN group default link/ether 1a:0c:6b:53:d6:a0 brd ff:ff:ff:ff:ff:ff 31: ath13: <BROADCAST,MULTICAST> mtu 1500 qdisc noqueue master br-lan state DOWN group default link/ether 1e:0c:6b:53:d6:a0 brd ff:ff:ff:ff:ff:ff 32: ath14: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default link/ieee802.11/radiotap 22:0c:6b:53:d6:a0 brd ff:ff:ff:ff:ff:ff 33: ath0: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP group default link/ether 10:0c:6b:53:d6:a1 brd ff:ff:ff:ff:ff:ff inet6 fe80::120c:6bff:fe53:d6a1/64 scope link valid_lft forever preferred_lft forever 34: ath01: <BROADCAST,MULTICAST> mtu 1500 qdisc noqueue master br-guest state DOWN group default link/ether 16:0c:6b:53:d6:a1 brd ff:ff:ff:ff:ff:ff 35: ath02: <BROADCAST,MULTICAST> mtu 1500 qdisc noqueue master br-lan state DOWN group default link/ether 1a:0c:6b:53:d6:a1 brd ff:ff:ff:ff:ff:ff 36: ath03: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default link/ieee802.11/radiotap 1e:0c:6b:53:d6:a1 brd ff:ff:ff:ff:ff:ff 37: ath2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default link/ether 10:0c:6b:53:d6:a2 brd ff:ff:ff:ff:ff:ff inet6 fe80::120c:6bff:fe53:d6a2/64 scope link valid_lft forever preferred_lft forever 38: ath2.4093@ath2: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-guest state UP group default qlen 1000 link/ether 10:0c:6b:53:d6:a2 brd ff:ff:ff:ff:ff:ff 39: ath2.4094@ath2: <BROADCAST,MULTICAST,ALLMULTI,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP group default qlen 1000 link/ether 10:0c:6b:53:d6:a2 brd ff:ff:ff:ff:ff:ff

Format: Log Type - Time(microsec) - Message - Optional Info Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00147 S - IMAGE_VARIANT_STRING=HAACANAZA S - OEM_IMAGE_VERSION_STRING=CRM S - Boot Config, 0x000002e5 B - 201 - PBL, Start B - 2735 - bootable_media_detect_entry, Start B - 3441 - bootable_media_detect_success, Start B - 3446 - elf_loader_entry, Start B - 6107 - auth_hash_seg_entry, Start B - 72457 - auth_hash_seg_exit, Start B - 134526 - elf_segs_hash_verify_entry, Start B - 197219 - PBL, End B - 316681 - SBL1, Start B - 395432 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4 B - 405253 - pm_device_init, Start B - 585051 - PM_SET_VAL:Skip D - 177723 - pm_device_init, Delta B - 587308 - pm_driver_init, Start D - 5337 - pm_driver_init, Delta B - 593804 - clock_init, Start D - 2135 - clock_init, Delta B - 597861 - boot_flash_init, Start D - 13145 - boot_flash_init, Delta B - 614697 - boot_config_data_table_init, Start D - 3172 - boot_config_data_table_init, Delta - (575 Bytes) B - 622230 - Boot Setting : 0x00000618 B - 626165 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:13 B - 633088 - sbl1_ddr_set_params, Start B - 636931 - CPR configuration: 0x30c B - 640317 - cpr_init, Start B - 643184 - Rail:0 Mode: 5 Voltage: 792000 B - 648338 - CL CPR settled at 744000mV B - 651144 - Rail:1 Mode: 5 Voltage: 880000 B - 655323 - Rail:1 Mode: 7 Voltage: 888000 D - 16439 - cpr_init, Delta B - 662216 - Pre_DDR_clock_init, Start B - 666242 - Pre_DDR_clock_init, End B - 669627 - DDR Type : PCDDR4 B - 676185 - do ddr sanity test, Start D - 1067 - do ddr sanity test, Delta B - 680089 - DDR: Start of HAL DDR Boot Training B - 684847 - DDR: End of HAL DDR Boot Training B - 690520 - DDR: Checksum to be stored on flash is 1740555694 B - 700829 - Image Load, Start D - 782477 - QSEE Image Loaded, Delta - (1380336 Bytes) B - 1483398 - Image Load, Start D - 61 - SEC Image Loaded, Delta - (0 Bytes) B - 1491084 - Image Load, Start D - 569130 - DEVCFG Image Loaded, Delta - (32404 Bytes) B - 2060305 - Image Load, Start D - 583709 - RPM Image Loaded, Delta - (112364 Bytes) B - 2644106 - Image Load, Start D - 656024 - APPSBL Image Loaded, Delta - (604308 Bytes) B - 3300252 - QSEE Execution, Start D - 61 - QSEE Execution, Delta B - 3306078 - USB D+ check, Start D - 0 - USB D+ check, Delta B - 3312452 - SBL1, End D - 2998089 - SBL1, Delta S - Flash Throughput, 6738 KB/s (2130659 Bytes, 316184 us) S - DDR Frequency, 600 MHz S - Core 0 Frequency, 800 MHz Orbi11AX V1.0.14 U-Boot 2016.01 (Dec 26 2019 - 01:01:31 -0800) DRAM: smem ram ptable found: ver: 1 len: 4 1 GiB NAND: ONFI device found ID = 1590acef Vendor = ef Device = ac SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0) 512 MiB MMC: <NULL>: 0 In: serial@78B3000 Out: serial@78B3000 Err: serial@78B3000 machid: 801000d Card did not respond to voltage select! eth0 MAC Address from ART is not valid eth1 MAC Address from ART is not valid eth2 MAC Address from ART is not valid eth3 MAC Address from ART is not valid eth4 MAC Address from ART is not valid eth5 MAC Address from ART is not valid Net: MAC0 addr:10:c:6b:53:d6:9e PHY ID1: 0x4d PHY ID2: 0xd0b1 EDMA ver 1 hw init Num rings - TxDesc:1 (0-0) TxCmpl:1 (7-7) RxDesc:1 (15-15) RxFill:1 (7-7) ipq807x_edma_alloc_rings: successfull ipq807x_edma_setup_ring_resources: successfull ipq807x_edma_configure_rings: successfull ipq807x_edma_hw_init: successfull eth0 0 set_firmware_partition:1017 setenv firmware_partition 0 Setting bus to 0 Valid chip addresses: 31 ipq807x_eth_halt: done eth0 PHY0 Down Speed :10 Half duplex eth0 PHY1 Down Speed :10 Half duplex eth0 PHY2 Down Speed :10 Half duplex eth0 PHY3 Down Speed :10 Half duplex eth0 PHY4 up Speed :1000 Full duplex eth0 PHY5 up Speed :1000 Full duplex ipq807x_eth_init: done net_loop:496 Client starts...[Listening] for ADVERTISE...TTT Retry count exceeded; boot the image as usual ipq807x_eth_halt: done nmrp server is stopped or failed ! Hit any key to stop autoboot: 0 ubi0: attaching mtd1 ubi0: scanning is finished ubi0: attached mtd1 (name "mtd=0", size 109 MiB) ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096 ubi0: good PEBs: 872, bad PEBs: 0, corrupted PEBs: 0 ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128 ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1770495823 ubi0: available PEBs: 0, total reserved PEBs: 872, PEBs reserved for bad PEB handling: 80 Read 0 bytes from volume kernel to 44000000 No size specified -> Using max size (5586944) ## Loading kernel from FIT Image at 44000000 ... Using 'config@oak03' configuration Trying 'kernel-1' kernel subimage Description: ARM64 OpenWrt Linux-6.12.68 Type: Kernel Image Compression: gzip compressed Data Start: 0x440000e8 Data Size: 5522422 Bytes = 5.3 MiB Architecture: AArch64 OS: Linux Load Address: 0x41000000 Entry Point: 0x41000000 Hash algo: crc32 Hash value: 0fbc47b7 Hash algo: sha1 Hash value: 518c7b6d8c82552f7d3b0b5d85aa31d140cf99eb Verifying Hash Integrity ... crc32+ sha1+ OK ## Loading fdt from FIT Image at 44000000 ... Using 'config@oak03' configuration Trying 'fdt-1' fdt subimage Description: ARM64 OpenWrt netgear_rbr750 device tree blob Type: Flat Device Tree Compression: uncompressed Data Start: 0x44544620 Data Size: 44789 Bytes = 43.7 KiB Architecture: AArch64 Hash algo: crc32 Hash value: bf1e779c Hash algo: sha1 Hash value: e7b497cc2b412467588db6a5eb1fa2ccda27ffd6 Verifying Hash Integrity ... crc32+ sha1+ OK Booting using the fdt blob at 0x44544620 Uncompressing Kernel Image ... OK Loading Device Tree to 4a3f2000, end 4a3ffef4 ... OK Using machid 0x801000d from environment Starting kernel ... Jumping to AARCH64 kernel via monitor [ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034] [ 0.000000] Linux version 6.12.68 (build@e403190db63e) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r32902-b7cd16dba3) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP Sat Feb 7 23:32:55 2026 [ 0.000000] Machine model: Netgear RBR750 [ 0.000000] OF: reserved mem: 0x0000000040000000..0x0000000040ffffff (16384 KiB) nomap non-reusable nss@40000000 [ 0.000000] OF: reserved mem: 0x000000004a400000..0x000000004a5fffff (2048 KiB) nomap non-reusable tzapp@4a400000 [ 0.000000] OF: reserved mem: 0x000000004a600000..0x000000004a9fffff (4096 KiB) nomap non-reusable bootloader@4a600000 [ 0.000000] OF: reserved mem: 0x000000004aa00000..0x000000004aafffff (1024 KiB) nomap non-reusable sbl@4aa00000 [ 0.000000] OF: reserved mem: 0x000000004ab00000..0x000000004abfffff (1024 KiB) nomap non-reusable smem@4ab00000 [ 0.000000] OF: reserved mem: 0x000000004ac00000..0x000000004affffff (4096 KiB) nomap non-reusable memory@4ac00000 [ 0.000000] OF: reserved mem: 0x000000004b000000..0x0000000050efffff (97280 KiB) nomap non-reusable wcnss@4b000000 [ 0.000000] OF: reserved mem: 0x0000000050f00000..0x0000000050ffffff (1024 KiB) nomap non-reusable q6_etr_dump@50f00000 [ 0.000000] OF: reserved mem: 0x0000000051000000..0x00000000510fffff (1024 KiB) nomap non-reusable m3_dump@51000000 [ 0.000000] Zone ranges: [ 0.000000] DMA [mem 0x0000000040000000-0x000000007fffffff] [ 0.000000] DMA32 empty [ 0.000000] Normal empty [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000040000000-0x0000000040ffffff] [ 0.000000] node 0: [mem 0x0000000041000000-0x000000004a3fffff] [ 0.000000] node 0: [mem 0x000000004a400000-0x00000000510fffff] [ 0.000000] node 0: [mem 0x0000000051100000-0x000000007fffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000007fffffff] [ 0.000000] psci: probing for conduit method from DT. [ 0.000000] psci: PSCIv1.0 detected in firmware. [ 0.000000] psci: Using standard PSCI v0.2 function IDs [ 0.000000] psci: MIGRATE_INFO_TYPE not supported. [ 0.000000] psci: SMC Calling Convention v1.0 [ 0.000000] psci: OSI mode supported. [ 0.000000] psci: [Firmware Bug]: failed to set PC mode: -1 [ 0.000000] percpu: Embedded 20 pages/cpu s43224 r8192 d30504 u81920 [ 0.000000] Detected VIPT I-cache on CPU0 [ 0.000000] alternatives: applying boot alternatives [ 0.000000] Kernel command line: console=ttyMSM0,115200n8 ubi.mtd=rootfs root=/dev/ubiblock0_1 [ 0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear) [ 0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear) [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 262144 [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 1MB [ 0.000000] software IO TLB: area num 4. [ 0.000000] software IO TLB: mapped [mem 0x000000007eb00000-0x000000007ec00000] (1MB) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 [ 0.000000] rcu: Hierarchical RCU implementation. [ 0.000000] Tracing variant of Tasks RCU enabled. [ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies. [ 0.000000] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4. [ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0 [ 0.000000] Root IRQ handler: gic_handle_irq [ 0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479] [ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention. [ 0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt). [ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns [ 0.000001] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns [ 0.000113] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000) [ 0.000127] pid_max: default: 32768 minimum: 301 [ 0.005180] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear) [ 0.005196] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear) [ 0.010178] rcu: Hierarchical SRCU implementation. [ 0.010187] rcu: Max phase no-delay instances is 1000. [ 0.010493] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level [ 0.010900] smp: Bringing up secondary CPUs ... [ 0.011569] Detected VIPT I-cache on CPU1 [ 0.011678] CPU1: Booted secondary processor 0x0000000001 [0x410fd034] [ 0.012435] Detected VIPT I-cache on CPU2 [ 0.012513] CPU2: Booted secondary processor 0x0000000002 [0x410fd034] [ 0.013200] Detected VIPT I-cache on CPU3 [ 0.013274] CPU3: Booted secondary processor 0x0000000003 [0x410fd034] [ 0.013356] smp: Brought up 1 node, 4 CPUs [ 0.013365] SMP: Total of 4 processors activated. [ 0.013369] CPU: All CPU(s) started at EL1 [ 0.013374] CPU features: detected: 32-bit EL0 Support [ 0.013379] CPU features: detected: CRC32 instructions [ 0.013426] alternatives: applying system-wide alternatives [ 0.013619] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching [ 0.013903] Memory: 881656K/1048576K available (8768K kernel code, 902K rwdata, 2868K rodata, 960K init, 286K bss, 163448K reserved, 0K cma-reserved) [ 0.022973] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.023000] futex hash table entries: 1024 (order: 4, 65536 bytes, linear) [ 0.023129] 29264 pages in range for non-PLT usage [ 0.023134] 520784 pages in range for PLT usage [ 0.025258] pinctrl core: initialized pinctrl subsystem [ 0.027426] NET: Registered PF_NETLINK/PF_ROUTE protocol family [ 0.027967] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations [ 0.028006] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations [ 0.028040] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations [ 0.028420] thermal_sys: Registered thermal governor 'step_wise' [ 0.028482] cpuidle: using governor menu [ 0.028674] ASID allocator initialised with 65536 entries [ 0.088724] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4 [ 0.111482] SCSI subsystem initialized [ 0.111702] usbcore: registered new interface driver usbfs [ 0.111742] usbcore: registered new interface driver hub [ 0.111792] usbcore: registered new device driver usb [ 0.112111] qcom_scm: convention: smc arm 64 [ 0.113856] clocksource: Switched to clocksource arch_sys_counter [ 0.117575] NET: Registered PF_INET protocol family [ 0.117732] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear) [ 0.120086] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes, linear) [ 0.120111] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) [ 0.120127] TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear) [ 0.120292] TCP bind hash table entries: 8192 (order: 6, 262144 bytes, linear) [ 0.120584] TCP: Hash tables configured (established 8192 bind 8192) [ 0.121118] MPTCP token hash table entries: 1024 (order: 3, 24576 bytes, linear) [ 0.121320] UDP hash table entries: 512 (order: 2, 16384 bytes, linear) [ 0.121358] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes, linear) [ 0.121817] NET: Registered PF_UNIX/PF_LOCAL protocol family [ 0.121858] PCI: CLS 0 bytes, default 64 [ 0.123868] workingset: timestamp_bits=46 max_order=18 bucket_order=0 [ 0.124458] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.124465] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.139399] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled [ 0.140362] msm_serial 78b3000.serial: msm_serial: detected port #0 [ 0.140472] msm_serial 78b3000.serial: uartclk = 3686400 [ 0.140847] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 20, base_baud = 230400) is a MSM [ 0.140891] msm_serial: console setup on port #0 [ 0.140929] printk: legacy console [ttyMSM0] enabled [ 0.880265] msm_serial: driver initialized [ 0.890008] loop: module loaded [ 0.891409] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xac [ 0.891973] nand: Winbond W29N04GZ [ 0.898640] nand: 512 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 [ 0.903708] spmi_pmic_arb 200f000.spmi: PMIC arbiter version v2 (0x20010000) [ 0.928573] i2c_dev: i2c /dev entries driver [ 0.936866] sdhci: Secure Digital Host Controller Interface driver [ 0.936915] sdhci: Copyright(c) Pierre Ossman [ 0.941950] sdhci-pltfm: SDHCI platform and OF driver helper [ 0.948343] remoteproc remoteproc0: releasing cd00000.q6v5_wcss [ 0.955616] NET: Registered PF_INET6 protocol family [ 0.959237] Segment Routing with IPv6 [ 0.963003] In-situ OAM (IOAM) with IPv6 [ 0.966645] NET: Registered PF_PACKET protocol family [ 0.971117] 8021q: 802.1Q VLAN Support v1.8 [ 1.008066] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4 [ 1.008453] cpr4_ipq807x_apss_read_fuse_data: apc_corner: speed bin = 0 [ 1.014245] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR fusing revision = 1 [ 1.020796] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR misc fuse value = 0 [ 1.028488] cpr4_ipq807x_apss_read_fuse_data: apc_corner: Voltage boost fuse config = 0 boost = disable [ 1.036031] cpr3_mem_acc_init: apc: not using memory accelerator regulator [ 1.045128] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused SVS: open-loop= 704000 uV [ 1.052049] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused NOM: open-loop= 816000 uV [ 1.062059] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused TURBO: open-loop= 872000 uV [ 1.071871] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused STURBO: open-loop= 952000 uV [ 1.081722] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused SVS: quot[ 7]= 726, quot_offset[ 7]= 0 [ 1.091487] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused NOM: quot[ 7]= 937, quot_offset[ 7]= 210 [ 1.102334] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused TURBO: quot[ 7]=1031, quot_offset[ 7]= 90 [ 1.113277] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused STURBO: quot[ 7]=1175, quot_offset[ 7]= 140 [ 1.124465] cpr3_regulator_init_ctrl: apc: Default CPR mode = closed-loop [ 1.128875] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xac [ 1.141888] nand: Winbond W29N04GZ [ 1.148320] nand: 512 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64 [ 1.151790] 30 qcomsmem partitions found on MTD device qcom_nand.0 [ 1.159179] Creating 30 MTD partitions on "qcom_nand.0": [ 1.165251] 0x000000000000-0x000000100000 : "0:sbl1" [ 1.172080] 0x000000100000-0x000000200000 : "0:mibib" [ 1.177077] 0x000000200000-0x000000280000 : "0:bootconfig" [ 1.181413] 0x000000280000-0x000000300000 : "0:bootconfig1" [ 1.186807] 0x000000300000-0x000000600000 : "0:qsee" [ 1.194221] 0x000000600000-0x000000900000 : "0:qsee_1" [ 1.199402] 0x000000900000-0x000000980000 : "0:devcfg" [ 1.202413] 0x000000980000-0x000000a00000 : "0:devcfg_1" [ 1.207579] 0x000000a00000-0x000000a80000 : "0:apdp" [ 1.213029] 0x000000a80000-0x000000b00000 : "0:apdp_1" [ 1.217979] 0x000000b00000-0x000000b80000 : "0:rpm" [ 1.222889] 0x000000b80000-0x000000c00000 : "0:rpm_1" [ 1.227753] 0x000000c00000-0x000000c80000 : "0:cdt" [ 1.232922] 0x000000c80000-0x000000d00000 : "0:cdt_1" [ 1.237661] 0x000000d00000-0x000000d80000 : "0:appsblenv" [ 1.273682] 0x000000d80000-0x000000e80000 : "0:appsbl" [ 1.275011] 0x000000e80000-0x000000f80000 : "0:appsbl_1" [ 1.278989] 0x000000f80000-0x000001000000 : "0:art" [ 1.284064] 0x000001000000-0x000001080000 : "0:ethphyfw" [ 1.288609] 0x000001080000-0x000001180000 : "nvram" [ 1.294591] 0x000001180000-0x000001280000 : "nvram2" [ 1.299220] 0x000001280000-0x000001380000 : "board_data" [ 1.304962] 0x000001380000-0x000001480000 : "latest_rootfs" [ 1.309719] 0x000001480000-0x000001580000 : "ml1" [ 1.315015] 0x000001580000-0x000001680000 : "debugmsg" [ 1.319866] 0x000001680000-0x000002080000 : "sstorage" [ 1.332057] 0x000002080000-0x000003e80000 : "reserved1" [ 1.356423] 0x000003e80000-0x000011c00000 : "reserved2" [ 1.532799] 0x000011c00000-0x000018900000 : "rootfs" [ 1.619749] mtd: setting mtd28 (rootfs) as root device [ 1.620058] mtdsplit: no squashfs found in "rootfs" [ 1.623854] 0x000018900000-0x00001f600000 : "rootfs_1" [ 1.727393] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 800000 KHz, changing to: 1017600 KHz [ 1.730250] remoteproc remoteproc0: cd00000.q6v5_wcss is available [ 1.737524] ubi0: attaching mtd28 [ 2.133854] random: crng init done [ 2.233597] ubi0: scanning is finished [ 2.294367] ubi0: attached mtd28 (name "rootfs", size 109 MiB) [ 2.294408] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 2.299102] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 2.305975] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 2.312817] ubi0: good PEBs: 872, bad PEBs: 0, corrupted PEBs: 0 [ 2.319595] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128 [ 2.325845] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1770495823 [ 2.332873] ubi0: available PEBs: 0, total reserved PEBs: 872, PEBs reserved for bad PEB handling: 80 [ 2.342182] ubi0: background thread "ubi_bgt0d" started, PID 686 [ 2.351846] block ubiblock0_1: created from ubi0:1(rootfs) [ 2.357492] clk: Disabling unused clocks [ 2.363166] ------------[ cut here ]------------ [ 2.366719] gcc_usb1_master_clk status stuck at 'on' [ 2.366755] WARNING: CPU: 2 PID: 1 at drivers/clk/qcom/clk-branch.c:87 clk_branch_toggle+0x168/0x180 [ 2.376277] Modules linked in: [ 2.385383] CPU: 2 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.68 #0 [ 2.388250] Hardware name: Netgear RBR750 (DT) [ 2.394759] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 2.399275] pc : clk_branch_toggle+0x168/0x180 [ 2.406128] lr : clk_branch_toggle+0x168/0x180 [ 2.410641] sp : ffffffc080ddbc80 [ 2.415066] x29: ffffffc080ddbc80 x28: 0000000000000000 x27: 0000000000000000 [ 2.418460] x26: 0000000000000000 x25: 0000000000000000 x24: ffffffc080acf8f0 [ 2.425579] x23: 0000000000000000 x22: 0000000000000000 x21: ffffffc08047bb28 [ 2.432696] x20: ffffffc080d16318 x19: 0000000000000000 x18: ffffffc080c8b680 [ 2.439814] x17: ffffffc080d1e7b0 x16: 0000000040709ec8 x15: 00000000000000ca [ 2.446933] x14: 00000000000000ca x13: 00000000ffffffea x12: ffffffc080ce3628 [ 2.454050] x11: ffffffc080c8b680 x10: ffffffc080ce3680 x9 : 0000000000000001 [ 2.461169] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : c0000000ffffefff [ 2.468287] x5 : 0000000000057fa8 x4 : 0000000000000000 x3 : ffffffc080ddba60 [ 2.475404] x2 : ffffffc080c8b5a8 x1 : ffffffc080c8b5a8 x0 : 0000000000000028 [ 2.482523] Call trace: [ 2.489631] clk_branch_toggle+0x168/0x180 [ 2.491891] clk_branch2_disable+0x1c/0x30 [ 2.496058] clk_disable_unused_subtree+0x84/0xd0 [ 2.500139] clk_disable_unused_subtree+0x2c/0xd0 [ 2.504914] clk_disable_unused_subtree+0x2c/0xd0 [ 2.509600] clk_disable_unused_subtree+0x2c/0xd0 [ 2.514289] clk_disable_unused_subtree+0x2c/0xd0 [ 2.518976] clk_disable_unused+0x64/0xf0 [ 2.523663] do_one_initcall+0x50/0x210 [ 2.527654] kernel_init_freeable+0x23c/0x298 [ 2.531302] kernel_init+0x20/0x120 [ 2.535813] ret_from_fork+0x10/0x20 [ 2.539113] ---[ end trace 0000000000000000 ]--- [ 2.543289] ------------[ cut here ]------------ [ 2.547535] gcc_usb0_master_clk status stuck at 'on' [ 2.547564] WARNING: CPU: 2 PID: 1 at drivers/clk/qcom/clk-branch.c:87 clk_branch_toggle+0x168/0x180 [ 2.557094] Modules linked in: [ 2.566196] CPU: 2 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.12.68 #0 [ 2.569072] Tainted: [W]=WARN [ 2.577306] Hardware name: Netgear RBR750 (DT) [ 2.580173] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 2.584519] pc : clk_branch_toggle+0x168/0x180 [ 2.591371] lr : clk_branch_toggle+0x168/0x180 [ 2.595885] sp : ffffffc080ddbc80 [ 2.600309] x29: ffffffc080ddbc80 x28: 0000000000000000 x27: 0000000000000000 [ 2.603702] x26: 0000000000000000 x25: 0000000000000000 x24: ffffffc080acf9a8 [ 2.610821] x23: 0000000000000000 x22: 0000000000000000 x21: ffffffc08047bb28 [ 2.617939] x20: ffffffc080d16698 x19: 0000000000000000 x18: ffffffc080c8b680 [ 2.625057] x17: ffffffc080d1e7b0 x16: 0000000040709ec8 x15: 00000000000000ec [ 2.632176] x14: 00000000000000ec x13: 00000000ffffffea x12: ffffffc080ce3628 [ 2.639293] x11: ffffffc080c8b680 x10: ffffffc080ce3680 x9 : 0000000000000001 [ 2.646412] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : c0000000ffffefff [ 2.653529] x5 : 0000000000057fa8 x4 : 0000000000000000 x3 : ffffffc080ddba60 [ 2.660647] x2 : ffffffc080c8b5a8 x1 : ffffffc080c8b5a8 x0 : 0000000000000028 [ 2.667766] Call trace: [ 2.674874] clk_branch_toggle+0x168/0x180 [ 2.677134] clk_branch2_disable+0x1c/0x30 [ 2.681301] clk_disable_unused_subtree+0x84/0xd0 [ 2.685381] clk_disable_unused_subtree+0x2c/0xd0 [ 2.690157] clk_disable_unused_subtree+0x2c/0xd0 [ 2.694844] clk_disable_unused_subtree+0x2c/0xd0 [ 2.699530] clk_disable_unused_subtree+0x2c/0xd0 [ 2.704218] clk_disable_unused+0x64/0xf0 [ 2.708904] do_one_initcall+0x50/0x210 [ 2.712898] kernel_init_freeable+0x23c/0x298 [ 2.716544] kernel_init+0x20/0x120 [ 2.721057] ret_from_fork+0x10/0x20 [ 2.724355] ---[ end trace 00000000000000[ 2.735362] VFS: Mounted root (squashfs filesystem) readonly on device 254:0. [ 2.735782] Freeing unused kernel memory: 960K [ 2.741566] Run /sbin/init as init process [ 2.920184] init: Console is alive [ 2.920320] init: - watchdog - [ 3.359359] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 3.423350] gpio_button_hotplug: loading out-of-tree module taints kernel. [ 3.508541] ssdk_dt_parse_interrupt[942]:INFO:intr-gpio does not exist [ 3.767936] adpt_hppe_uniphy_mode_set[1398]:INFO:ssdk doesn't support mode:0 in uniphy:0 on platform! [ 3.768104] regi_init[2525]:INFO:Initializing HPPE Done!! [ 3.776244] regi_init[2574]:INFO:qca-ssdk module init succeeded! [ 3.784151] EDMA ver 1 hw init [ 3.787827] EDMA HW Reset completed succesfully [ 3.790502] Num rings - TxDesc:1 (23-23) TxCmpl:1 (7-7) [ 3.794912] RxDesc:1 (15-15) RxFill:1 (7-7) [ 3.974710] Qualcomm QCA8075 90000.mdio-1:00: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:00, irq=POLL) [ 4.044233] Qualcomm QCA8075 90000.mdio-1:01: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:01, irq=POLL) [ 4.124227] Qualcomm QCA8075 90000.mdio-1:03: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:03, irq=POLL) [ 4.194233] Qualcomm QCA8075 90000.mdio-1:04: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:04, irq=POLL) [ 4.195137] ********************************************************** [ 4.203138] * NSS Data Plane driver [ 4.209669] ********************************************************** [ 4.286504] lp5562 0-0031: internal clock used [ 4.287098] lp5562 0-0031: lp5562 Programmable led chip found [ 4.291434] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 4.305981] init: - preinit - Cannot parse config file '/etc/fw_env.config': No such file or directory Failed to find NVMEM device Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 9.229136] UBIFS (ubi0:2): Mounting in unauthenticated mode [ 9.229296] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 906 [ 9.259145] UBIFS (ubi0:2): recovery needed [ 9.339485] UBIFS (ubi0:2): recovery completed [ 9.339604] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data" [ 9.342830] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 9.350755] UBIFS (ubi0:2): FS size: 85708800 bytes (81 MiB, 675 LEBs), max 686 LEBs, journal size 4317184 bytes (4 MiB, 34 LEBs) [ 9.360642] UBIFS (ubi0:2): reserved for root: 4048238 bytes (3953 KiB) [ 9.372277] UBIFS (ubi0:2): media format: w5/r0 (latest is w5/r0), UUID 6C4F0965-1708-42A3-9540-44C5BFDA7A86, small LPT model [ 9.383439] mount_root: switching to ubifs overlay [ 9.394176] overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off. [ 9.398662] urandom-seed: Seeding with /etc/urandom.seed [ 9.468397] procd: - early - [ 9.468511] procd: - watchdog - [ 10.030156] procd: - watchdog - [ 10.030736] procd: - ubus - [ 10.183439] procd: - init - Please press Enter to activate this console. [ 10.546344] kmodloader: loading kernel modules from /etc/modules.d/* [ 10.694240] Loading modules backported from Linux version v6.18.7-0-g5dfbc5357 [ 10.694287] Backport generated by backports.git c8a37ce [ 10.707743] NET: Registered PF_QIPCRTR protocol family [ 10.778940] urngd: v1.0.2 started. [ 10.834419] PPP generic driver version 2.4.2 [ 10.835492] NET: Registered PF_PPPOX protocol family [ 10.875044] ath11k c000000.wifi: ipq8074 hw2.0 [ 10.875083] ath11k c000000.wifi: FW memory mode: 0 [ 10.912136] remoteproc remoteproc0: powering up cd00000.q6v5_wcss [ 10.912557] remoteproc remoteproc0: Booting fw image IPQ8074/q6_fw.mdt, size 668 [ 12.073890] remoteproc remoteproc0: remote processor cd00000.q6v5_wcss is now up [ 12.117816] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req [ 12.125273] ath11k c000000.wifi: chip_id 0x0 chip_family 0x0 board_id 0xff soc_id 0xffffffff [ 12.125312] ath11k c000000.wifi: fw_version 0x290b84a5 fw_build_timestamp 2024-09-23 11:32 fw_build_id WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1 [ 12.280190] remoteproc remoteproc0: stopped remote processor cd00000.q6v5_wcss [ 12.280242] remoteproc remoteproc0: powering up cd00000.q6v5_wcss [ 12.286410] remoteproc remoteproc0: Booting fw image IPQ8074/q6_fw.mdt, size 668 [ 12.639563] remoteproc remoteproc0: remote processor cd00000.q6v5_wcss is now up [ 12.643305] kmodloader: done loading kernel modules from /etc/modules.d/* [ 12.683819] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req [ 12.691309] ath11k c000000.wifi: chip_id 0x0 chip_family 0x0 board_id 0xff soc_id 0xffffffff [ 12.691364] ath11k c000000.wifi: fw_version 0x290b84a5 fw_build_timestamp 2024-09-23 11:32 fw_build_id WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1 [ 13.082286] ath11k c000000.wifi: htt event 48 not handled [ 15.294802] br-lan: port 1(lan1) entered blocking state [ 15.294854] br-lan: port 1(lan1) entered disabled state [ 15.298950] nss-dp 3a001200.dp2 lan1: entered allmulticast mode [ 15.304448] nss-dp 3a001200.dp2 lan1: entered promiscuous mode [ 15.316766] br-lan: port 2(lan2) entered blocking state [ 15.316833] br-lan: port 2(lan2) entered disabled state [ 15.321046] nss-dp 3a001600.dp4 lan2: entered allmulticast mode [ 15.326552] nss-dp 3a001600.dp4 lan2: entered promiscuous mode [ 15.336459] br-lan: port 3(lan3) entered blocking state [ 15.338003] br-lan: port 3(lan3) entered disabled state [ 15.343158] nss-dp 3a001800.dp5 lan3: entered allmulticast mode [ 15.348807] nss-dp 3a001800.dp5 lan3: entered promiscuous mode [ 19.524364] nss-dp 3a001800.dp5 lan3: PHY Link up speed: 1000 [ 19.524431] br-lan: port 3(lan3) entered blocking state [ 19.529108] br-lan: port 3(lan3) entered forwarding state [ 33.123903] l11: disabling BusyBox v1.37.0 (2026-01-02 17:07:02 UTC) built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt SNAPSHOT, r32941+1-336ffdf631 ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- OpenWrt recently switched to the "apk" package manager! OPKG Command APK Equivalent Description ------------------------------------------------------------------ opkg install <pkg> apk add <pkg> Install a package opkg remove <pkg> apk del <pkg> Remove a package opkg upgrade apk upgrade Upgrade all packages opkg files <pkg> apk info -L <pkg> List package contents opkg list-installed apk info List installed packages opkg update apk update Update package lists opkg search <pkg> apk search <pkg> Search for packages ------------------------------------------------------------------ For more information visit: https://openwrt.org/docs/guide-user/additional-software/opkg-to-apk-cheatsheet root@OpenWrt:~#

qualcommax, ipq807x, ipq8074, 512flash, 1024ram, 4port, gigabitethernet, switch, qca8075, u-boot, cortexa53, 4core, qcn5024, qcn5054, 802.11ax, wlan, internalantenna, serial

qualcommax ipq807x ipq8074 512flash 1024ram 4port gigabitethernet switch qca8075 u-boot cortexa53 4core qcn5024 qcn5054 802.11ax wlan internalantenna serial

Netgear Orbi RBR750/RBS750

OpenWrt support

Hardware highlights

Installation

Installing OpenWrt

Install

Revert to Stock

Specific configuration

Network interfaces

Buttons

Hardware

Info

Photos

Opening the case

Serial

Bootlogs

OEM bootlog

OpenWrt bootlog

Notes

Tags