A look inside/accessing the serial port and SPI flash chip

So far, I haven’t found any software ‘backdoors’ to gain access to the eero.  So, for now, I’m getting in via hardware methods.  This includes connecting to the serial port and the SPI flash chip (where the eero boots from).  Thanks to my friend Al S. for the soldering help!

Here’s a photo of the eero main board:

As you can see, there are two obvious ‘ports’ on the board (10-pin headers): J11 in the center/left (vertically oriented), and J2 in the center/right (horizontally oriented).

J11 seems to be a debug/manufacturing access port.  It has the TTL-level serial port signals, as well as signals that connect to the SPI flash chip (the primary boot device, which includes the u-boot boot loader and other information).

I suspect that J2 is a JTAG port, but I really haven’t investigated it.

I have focused on J11 for my initial access to the hardware.  Here is a close-up of the connector:

The SPI boot flash chip is just to the right of the J11 connector (25Q064A – datasheet). Another important chip (that I’ll get to later) is below J11 (marked ZWU 57J).  This is TI SN74AVC4T245 bus level translation chip (datasheet).

I’ve buzzed-out the signals on the J11 connector – here’s a pinout:

Serial port

It’s possible to get serial port access to the eero by connecting a TTL serial adapter to the UART TXD/RXD/GND signals on this connector.

Unfortunately, u-boot on the eero is configured with “bootdelay=0”, meaning it’s not possible to interrupt the boot process by typing control-C on the serial port.  Also, by default, u-boot’s “bootargs” to the kernel leave the kernel’s console output going ‘nowhere’ (NOT to the serial port).  So, by connecting to the serial port, you can only see the u-boot output, see it start the kernel, then you’ll see nothing else.

SPI flash

As described in the pinout above, the SPI flash signals are also brought-out to J11.  Importantly, it’s possible to ‘disconnect’ the eero CPU from the SPI flash chip.  This is necessary if you want to dump/reprogram the SPI flash chip – you don’t want the CPU doing accesses to the chip while you are.

This is where the “TI SN74AVC4T245” chip comes in.  It’s a bus level translator.  But, it also has ‘output enable’ signals that let you control the output signals from this chip (the ones that go from the CPU to the SPI flash chip).

By default, these output enable signals are ‘low’ (enabled).  By pulling them ‘high’, the SPI flash signals from the CPU are disconnected from the SPI flash chip – leaving the SPI flash chip 100% accessible via the J11 port.

The CPU’s SPI chip-select (S#), SPI clock (C), and MOSI (DQ0) signals go through this bus level translator chip to the SPI flash chip.  They are disconnected from the SPI flash chip when the output enable signals are pulled high.

Pin 1 on J11 connects to both of the output enable signals (pins 1 and 16) on the “TI SN74AVC4T245” chip.  So, pulling pin 1 on J11 high will disconnect the CPU from the SPI flash chip.  I’ve labelled pin 1 “CPU SPI BUS RELEASE” in the diagram above.

All of the other important SPI flash signals are brought to J11.  So, it’s possible to connect an SPI flash programmer to J11, read the flash chip image, modify it, and write it back.

Reprogramming SPI flash to gain serial port access

I mentioned above that the u-boot image in the SPI flash has the environment variable “bootdelay” set to “0”, which prevents interruption of the boot process (by hitting control-C on the serial port, for example).

I gained access by reading the contents of the SPI flash chip to a file on my PC, modifying it to set “bootdelay” to “9”, then writing it back.

As you are editing the u-boot binary, if you search for “bootdelay=0”, you’ll see several occurrences.  The initial ones are the ‘default’ environment variables that u-boot uses if it can’t find a valid environment in the SPI flash.

Later, there are two copies of the environment in flash (starting at offsets 0x002a0000 and 0x002b0000 – a primary and a redundant copy).  NOTE that if you modify the “bootdelay=0” to “bootdelay=9” in these regions, you’ll need to update the 32-bit CRC at the start of the region (otherwise the environment will be considered ‘invalid’ and u-boot will revert to the ‘default’ compiled-in environment found earlier in the image).

After editing/writing the image back to SPI flash, you’ll be able to interrupt the boot process (by pressing control-C at the serial console).

Once you’ve interrupted the u-boot boot process, you can modify the “bootargs” environment variable to tell the Linux kernel to enable the serial port (add “console=ttyMSM0,115200n8 earlyprintk” to the existing kernel command line).

If you are interested, I used the “MiniPRO” TL866 universal programmer to reprogram my eero’s SPI flash.  Here’s a photo of the programmer with the cable I used to connect to my eero’s J11 port:

You’ll see signals from the cable connecting to the SPI flash pins on the ZIF adapter board that came with the programmer.  You’ll also see a pair of floating wires connected to each other.  Those are pins 1 (“CPU SPI BUS RELEASE”) and 7 (“VCC 1.8V”).  Tying these two signals together pulls the output enable signals on the  SN74AVC4T245 ‘high’ – disconnecting the CPU from the SPI flash chip (so it doesn’t interfere with our reading/writing to the flash chip).

I’m in!

Within two days of receiving my eero device, I’ve got serial console root login!  I’ll detail how I did it in future posts.

U-Boot 2012.07 [standard IPQ806X.LN,r37758] (Apr 08 2016 - 19:01:11) 1.1.0

smem ram ptable found: ver: 0 len: 5
DRAM: 491 MiB
NAND: SF: Detected N25Q064A with page size 64 KiB, total 8 MiB
ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x800000
8 MiB
MMC: ipq_mmc: 0
PCI0 Link Intialized
PCI1 Link Intialized
In: serial
Out: serial
Err: serial
cdp: get part failed for 0:HLOS
cdp: get part failed for rootfs
Net: athrs17_reg_init: complete
athrs17_vlan_config ...done
S17c init done
eth0, eth1
(Re)start USB...
USB0: Register 2000240 NbrPorts 2
Starting the controller
USB XHCI 1.00
scanning bus 0 for devices... 1 USB Device(s) found
USB1: Register 2000240 NbrPorts 2
Starting the controller
USB XHCI 1.00
scanning bus 1 for devices... 1 USB Device(s) found
 scanning usb for storage devices... 0 Storage Device(s) found

** Invalid boot device **
Hit any key to stop autoboot: 9  0 
(eero) # <INTERRUPT>
(eero) # <INTERRUPT>
(eero) # <INTERRUPT>
(eero) # <INTERRUPT>
(eero) # printenv
baudrate=115200
bootarg_offset=44000000
bootargs=root=/dev/mmcblk0p3 loglevel=7 rdinit=/bin/kinit rw single console=ttyMSM0,115200n8 earlyprintk
bootcmd=ext2load mmc 0:1 0x44000000 eero_kernel.itb && bootm; reset
bootdelay=9
eth1addr=[redacted]
ethact=eth0
ethaddr=[redacted]
fdt_high=0xffffffff
ipaddr=192.168.2.101
machid=12ce
ramdisk_offset=44000000
stderr=serial
stdin=serial
stdout=serial
ver=U-Boot 2012.07 [standard IPQ806X.LN,r37758] (Apr 08 2016 - 19:01:11) 1.1.0

Environment size: 520/65531 bytes
(eero) # reset
resetting ...

Resetting with watch dog!



U-Boot 2012.07 [standard IPQ806X.LN,r37758] (Apr 08 2016 - 19:01:11) 1.1.0

smem ram ptable found: ver: 0 len: 5
DRAM: 491 MiB
NAND: SF: Detected N25Q064A with page size 64 KiB, total 8 MiB
ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x800000
8 MiB
MMC: ipq_mmc: 0
PCI0 Link Intialized
PCI1 Link Intialized
In: serial
Out: serial
Err: serial
cdp: get part failed for 0:HLOS
cdp: get part failed for rootfs
Net: athrs17_reg_init: complete
athrs17_vlan_config ...done
S17c init done
eth0, eth1
(Re)start USB...
USB0: Register 2000240 NbrPorts 2
Starting the controller
USB XHCI 1.00
scanning bus 0 for devices... 1 USB Device(s) found
USB1: Register 2000240 NbrPorts 2
Starting the controller
USB XHCI 1.00
scanning bus 1 for devices... 1 USB Device(s) found
 scanning usb for storage devices... 0 Storage Device(s) found

** Invalid boot device **
Hit any key to stop autoboot: 9  8  7  6  5  4  3  2  1  0 
Loading file "eero_kernel.itb" from mmc device 0:1 (kernel0)
6387320 bytes read
## Booting kernel from FIT Image at 44000000 ...
 Using 'config@1' configuration
 Trying 'kernel@1' kernel subimage
 Description: ARM OpenWrt Linux-3.14
 Type: Kernel Image
 Compression: gzip compressed
 Data Start: 0x440000e0
 Data Size: 6358649 Bytes = 6.1 MiB
 Architecture: ARM
 OS: Linux
 Load Address: 0x42208000
 Entry Point: 0x42208000
 Hash algo: crc32
 Hash value: e7ae46ce
 Hash algo: sha1
 Hash value: ea1e3c6c76154f6e8212647e82aefb2d9d54de7f
 Verifying Hash Integrity ... crc32+ sha1+ OK
## Flattened Device Tree from FIT Image at 44000000
 Using 'config@1' configuration
 Trying 'fdt@1' FDT blob subimage
 Description: ARM OpenWrt qcom-ipq8062-ap145 device tree blob
 Type: Flat Device Tree
 Compression: uncompressed
 Data Start: 0x44610898
 Data Size: 27323 Bytes = 26.7 KiB
 Architecture: ARM
 Hash algo: crc32
 Hash value: 52066729
 Hash algo: sha1
 Hash value: 70d930c22aafc2a44a1f8955cd1477a07240769f
 Verifying Hash Integrity ... crc32+ sha1+ OK
 Booting using the fdt blob at 0x44610898
 Uncompressing Kernel Image ... OK
 Using Device Tree in place at 44610898, end 4461a352
Using machid 0x12ce from environment

Starting kernel ...

[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 3.14.0 (root@build) (gcc version 4.7.3 (Ubuntu/Linaro 4.7.3-12ubuntu1) ) #5 SMP PREEMPT Fri Apr 29 01:05:37 UTC 2016
[ 0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c53c7d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[ 0.000000] Ignoring memory below PHYS_OFFSET: 0x40000000-0x42000000
[ 0.000000] Machine model: Qualcomm IPQ8062/AP145
[ 0.000000] cma: CMA: reserved 8 MiB at 5f800000
[ 0.000000] Memory policy: Data cache writealloc
[ 0.000000] PERCPU: Embedded 7 pages/cpu @9d419000 s8064 r8192 d12416 u32768
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 121920
[ 0.000000] Kernel command line: root=/dev/mmcblk0p3 loglevel=7 rdinit=/bin/kinit rw single console=ttyMSM0,115200n8 earlyprintk
[ 0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
[ 0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
[ 0.000000] Memory: 466852K/491520K available (7346K kernel code, 331K rwdata, 1888K rodata, 1655K init, 814K bss, 24668K reserved)
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] vmalloc : 0x9e800000 - 0xff000000 (1544 MB)
[ 0.000000] lowmem : 0x80000000 - 0x9e000000 ( 480 MB)
[ 0.000000] modules : 0x7f000000 - 0x80000000 ( 16 MB)
[ 0.000000] .text : 0x80208000 - 0x80b0cc78 (9236 kB)
[ 0.000000] .init : 0x80b0d000 - 0x80caaf80 (1656 kB)
[ 0.000000] .data : 0x80cac000 - 0x80cfec38 ( 332 kB)
[ 0.000000] .bss : 0x80cfec38 - 0x80dca7dc ( 815 kB)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[ 0.000000] Preemptible hierarchical RCU implementation.
[ 0.000000] Offload RCU callbacks from all CPUs
[ 0.000000] Offload RCU callbacks from CPUs: 0-1.
[ 0.000000] NR_IRQS:16 nr_irqs:16 16
[ 0.000012] sched_clock: 32 bits at 6MHz, resolution 160ns, wraps every 687194767200ns
[ 0.000289] Console: colour dummy device 80x30
[ 0.000899] Calibrating delay loop... 818.38 BogoMIPS (lpj=4091904)
[ 0.041426] pid_max: default: 32768 minimum: 301
[ 0.041569] Security Framework initialized
[ 0.041613] AppArmor: AppArmor disabled by boot time parameter
[ 0.041689] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.041704] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.049153] CPU: Testing write buffer coherency: ok
[ 0.049435] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[ 0.049505] Setting up static identity map for 0x4221a080 - 0x4221a0b4
[ 0.125318] CPU1: Booted secondary processor
[ 0.186144] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
[ 0.186285] Brought up 2 CPUs
[ 0.186304] SMP: Total of 2 processors activated (1231.25 BogoMIPS).
[ 0.186313] CPU: All CPU(s) started in SVC mode.
[ 0.187141] devtmpfs: initialized
[ 0.205896] VFP support v0.3: implementor 51 architecture 0 part 4d variant 2 rev 0
[ 0.206496] pinctrl core: initialized pinctrl subsystem
[ 0.207341] regulator-dummy: no parameters
[ 0.211759] NET: Registered protocol family 16
[ 0.217443] DMA: preallocated 6144 KiB pool for atomic coherent allocations
[ 0.218616] cpuidle: using governor ladder
[ 0.243224] scm_call failed with error code -4
[ 0.243254] read_version: Error in QFPROM read (-95, 0)
[ 0.243272] 
[ 0.243272] Version Read Failed with error -95
[ 0.246772] ipq8064-pinctrl 800000.pinmux: Invalid config param 000a
[ 0.246794] ipq8064-pinctrl 800000.pinmux: pin_config_group_set op failed for group 1
[ 0.246816] ipq8064-pinctrl 800000.pinmux: Error applying setting, reverse things back
[ 0.246843] ipq8064-pinctrl 800000.pinmux: failed to select default state
[ 0.250894] qcom_rpm 108000.rpm: RPM firmware 1.0.133
[ 0.266888] bio: create slab <bio-0> at 0
[ 0.320625] qcom_pcie 1b500000.pci: link initialized 0
[ 0.320881] qcom_pcie 1b500000.pci: PCI host bridge to bus 0000:00
[ 0.320904] pci_bus 0000:00: root bus resource [mem 0x08000000-0x0fdfffff]
[ 0.320917] pci_bus 0000:00: root bus resource [io 0xfe00000-0xfefffff]
[ 0.320932] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.321662] PCI: bus0: Fast back to back transfers disabled
[ 0.321683] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 0.322833] PCI: bus1: Fast back to back transfers disabled
[ 0.323007] pci 0000:00:00.0: BAR 14: assigned [mem 0x08000000-0x081fffff]
[ 0.323025] pci 0000:00:00.0: BAR 15: assigned [mem 0x08200000-0x082fffff pref]
[ 0.323047] pci 0000:01:00.0: BAR 0: assigned [mem 0x08000000-0x081fffff 64bit]
[ 0.323106] pci 0000:01:00.0: BAR 6: assigned [mem 0x08200000-0x0820ffff pref]
[ 0.323122] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 0.323149] pci 0000:00:00.0: bridge window [mem 0x08000000-0x081fffff]
[ 0.323174] pci 0000:00:00.0: bridge window [mem 0x08200000-0x082fffff pref]
[ 0.382669] qcom_pcie 1b700000.pci: link initialized 0
[ 0.382901] qcom_pcie 1b700000.pci: PCI host bridge to bus 0001:00
[ 0.382917] pci_bus 0001:00: root bus resource [mem 0x2e000000-0x31dfffff]
[ 0.382931] pci_bus 0001:00: root bus resource [io 0x31e00000-0x31efffff]
[ 0.382945] pci_bus 0001:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.383610] PCI: bus0: Fast back to back transfers disabled
[ 0.383628] pci 0001:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 0.384765] PCI: bus1: Fast back to back transfers disabled
[ 0.384932] pci 0001:00:00.0: BAR 14: assigned [mem 0x2e000000-0x2e1fffff]
[ 0.384949] pci 0001:00:00.0: BAR 15: assigned [mem 0x2e200000-0x2e2fffff pref]
[ 0.384968] pci 0001:01:00.0: BAR 0: assigned [mem 0x2e000000-0x2e1fffff 64bit]
[ 0.385023] pci 0001:01:00.0: BAR 6: assigned [mem 0x2e200000-0x2e20ffff pref]
[ 0.385038] pci 0001:00:00.0: PCI bridge to [bus 01]
[ 0.385064] pci 0001:00:00.0: bridge window [mem 0x2e000000-0x2e1fffff]
[ 0.385085] pci 0001:00:00.0: bridge window [mem 0x2e200000-0x2e2fffff pref]
[ 0.385871] SDCC Power: 3300 mV 
[ 0.386192] SDCC I/O Power: 1800 mV 
[ 0.386238] SDCC I/O Power: Failed to create debugfs directory
[ 0.386474] Core Power: 1150 mV 
[ 0.387964] vgaarb: loaded
[ 0.388606] SCSI subsystem initialized
[ 0.389274] usbcore: registered new interface driver usbfs
[ 0.389372] usbcore: registered new interface driver hub
[ 0.389564] usbcore: registered new device driver usb
[ 0.393988] i2c-gpio i2c.12: using pins 57 (SDA) and 58 (SCL)
[ 0.394385] msm_bus_fabric_init_driver
[ 0.395959] pcie_init: pcie_init: unable to create IPC log context for pcie0-short
[ 0.395974] pcie_init: pcie_init: unable to create IPC log context for pcie0-long
[ 0.395984] pcie_init: pcie_init: unable to create IPC log context for pcie1-short
[ 0.395993] pcie_init: pcie_init: unable to create IPC log context for pcie1-long
[ 0.396473] Switched to clocksource dg_timer
[ 0.396876] FS-Cache: Loaded
[ 0.397156] CacheFiles: Loaded
[ 0.413000] NET: Registered protocol family 2
[ 0.413929] TCP established hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.413969] TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
[ 0.414026] TCP: Hash tables configured (established 4096 bind 4096)
[ 0.414068] TCP: reno registered
[ 0.414091] UDP hash table entries: 256 (order: 1, 8192 bytes)
[ 0.414113] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[ 0.414395] NET: Registered protocol family 1
[ 0.674978] msm_rpm_log_probe: OK
[ 0.676940] futex hash table entries: 512 (order: 3, 32768 bytes)
[ 0.677030] audit: initializing netlink subsys (disabled)
[ 0.677138] audit: type=2000 audit(0.660:1): initialized
[ 0.686939] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.687210] fuse init (API version 7.22)
[ 0.696449] NET: Registered protocol family 38
[ 0.697889] Crypto Speed tests
[ 0.697947] OCF: testing ...
[ 0.697961] crypto_newsession failed 22
[ 0.698050] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
[ 0.698064] io scheduler noop registered
[ 0.698075] io scheduler deadline registered (default)
[ 0.698294] io scheduler cfq registered
[ 0.700551] crc32: CRC_LE_BITS = 32, CRC_BE BITS = 32
[ 0.700565] crc32: self tests passed, processed 225944 bytes in 1068160 nsec
[ 0.701631] crc32c: CRC_LE_BITS = 32
[ 0.701642] crc32c: self tests passed, processed 225944 bytes in 522880 nsec
[ 1.191579] crc32_combine: 8373 self tests passed
[ 1.682172] crc32c_combine: 8373 self tests passed
[ 1.683588] PCI: enabling device 0000:00:00.0 (0140 -> 0143)
[ 1.684091] PCI: enabling device 0001:00:00.0 (0140 -> 0143)
[ 1.685051] pcieport 0000:00:00.0: Signaling PME through PCIe PME interrupt
[ 1.685067] pci 0000:01:00.0: Signaling PME through PCIe PME interrupt
[ 1.685184] pcieport 0001:00:00.0: Signaling PME through PCIe PME interrupt
[ 1.685200] pci 0001:01:00.0: Signaling PME through PCIe PME interrupt
[ 1.688016] gsbi 16300000.gsbi: GSBI port protocol: 6 crci: 0
[ 1.688543] gsbi 1a200000.gsbi: GSBI port protocol: 3 crci: 0
[ 1.689248] tcsr 1a400000.tcsr: setting usb port select = 3
[ 1.782484] msm_serial 16340000.serial: msm_serial: detected port #0
[ 1.782609] msm_serial 16340000.serial: uartclk = 1843200
[ 1.782680] 16340000.serial: ttyMSM0 at MMIO 0x16340000 (irq = 184, base_baud = 115200) is a MSM
[ 1.783251] msm_serial: console setup on port #0
[ 2.650998] console [ttyMSM0] enabled
[ 2.655890] msm_serial: driver initialized
[ 2.659553] msm_serial_hs module loaded
[ 2.663076] qca_serial_hs_init: error creating logging context
[ 2.668204] 
[ 2.668204] Loaded Module Successfully!
[ 2.674855] spi_qup 1a280000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[ 2.679605] m25p80 spi32766.0: n25q064a (8192 Kbytes)
[ 2.685302] 7 ofpart partitions found on MTD device spi32766.0
[ 2.690335] Creating 7 MTD partitions on "spi32766.0":
[ 2.695989] 0x000000000000-0x000000220000 : "bootstrap"
[ 2.706344] ftl_cs: FTL header not found.
[ 2.706388] 0x000000220000-0x0000002a0000 : "u-boot"
[ 2.713360] ftl_cs: FTL header not found.
[ 2.715433] 0x0000002a0000-0x0000002e0000 : "u-boot env"
[ 2.721187] ftl_cs: FTL header not found.
[ 2.724719] 0x0000002e0000-0x000000320000 : "art"
[ 2.730412] ftl_cs: FTL header not found.
[ 2.733313] 0x000000320000-0x000000330000 : "identity"
[ 2.738291] ftl_cs: FTL header not found.
[ 2.742343] 0x000000330000-0x000000340000 : "secret"
[ 2.747398] ftl_cs: FTL header not found.
[ 2.751455] 0x000000340000-0x000000800000 : "scratch"
[ 2.760524] ftl_cs: FTL header not found.
[ 2.760743] bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
[ 2.775518] libphy: Fixed MDIO Bus: probed
[ 2.776206] libphy: GPIO Bitbanged MDIO: probed
[ 2.820125] switch0: Atheros AR8337 rev. 2 switch registered on gpio-0
[ 4.778272] ipddp.c:v0.01 8/28/97 Bradford W. Johnson <johns393@maroon.tc.umn.edu>
[ 4.779249] ipddp0: Appletalk-IP Encap. mode by Bradford W. Johnson <johns393@maroon.tc.umn.edu>
[ 4.784744] edma module_init
[ 4.794079] PPP generic driver version 2.4.2
[ 4.797071] PPP MPPE Compression module registered
[ 4.800800] NET: Registered protocol family 24
[ 4.805436] PPTP driver version 0.8.5
[ 4.810872] usb30.5 supply gdsc not found, using dummy regulator
[ 4.814527] dwc3 11000000.dwc3: no usb2 phy configured
[ 4.819742] platform 11000000.dwc3: Driver dwc3 requests probe deferral
[ 4.824746] usb30.6 supply gdsc not found, using dummy regulator
[ 4.831965] dwc3 10000000.dwc3: no usb2 phy configured
[ 4.837448] platform 10000000.dwc3: Driver dwc3 requests probe deferral
[ 4.842869] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 4.848912] ehci-pci: EHCI PCI platform driver
[ 4.855546] ehci-platform: EHCI generic platform driver
[ 4.861308] 100f8800.phy supply vddcx not found, using dummy regulator
[ 4.865112] 100f8800.phy supply v3p3 not found, using dummy regulator
[ 4.871797] 100f8800.phy supply v1p8 not found, using dummy regulator
[ 4.878282] 100f8800.phy supply vbus not found, using dummy regulator
[ 4.884823] 110f8800.phy supply vddcx not found, using dummy regulator
[ 4.891140] 110f8800.phy supply v3p3 not found, using dummy regulator
[ 4.897540] 110f8800.phy supply v1p8 not found, using dummy regulator
[ 4.903975] 110f8800.phy supply vbus not found, using dummy regulator
[ 4.911009] 100f8830.phy supply vddcx not found, using dummy regulator
[ 4.916898] 100f8830.phy supply v1p8 not found, using dummy regulator
[ 4.923288] qcom-dwc3-ssphy 100f8830.phy: cannot get HSIO settings from device node, using default values
[ 4.929860] 110f8830.phy supply vddcx not found, using dummy regulator
[ 4.939380] 110f8830.phy supply v1p8 not found, using dummy regulator
[ 4.945714] qcom-dwc3-ssphy 110f8830.phy: cannot get HSIO settings from device node, using default values
[ 4.953760] mousedev: PS/2 mouse device common for all mice
[ 4.962757] input: gpio-keys.14 as /devices/soc.3/gpio-keys.14/input/input0
[ 4.968349] i2c /dev entries driver
[ 4.977376] tmp102 0-0048: initialized
[ 4.978927] tmp102 0-0049: initialized
[ 4.982727] tmp102 0-004a: initialized
[ 4.993171] GPIO_WDT: failed to register misc device
[ 4.993217] Error: Driver 'gpio-wdt' is already registered, aborting...
[ 4.998060] SPEED BIN: 0
[ 5.003540] ACPU PVS: 2
[ 5.006330] cpu cpu0: dev_pm_opp_get_opp_count: device OPP not found (-19)
[ 5.008681] deviceless supply vcore_regulator not found, using dummy regulator
[ 5.015686] platform cpufreq-krait.0: Driver cpufreq-krait requests probe deferral
[ 5.023580] ipq8064-pinctrl 800000.pinmux: invalid group "gpio12" for function "sdc1"
[ 5.031922] mmc0: SDCC Version: 0x06000018
[ 5.038222] mmci-pl18x 12400000.sdcc: mmc0: PL180 manf 51 rev0 at 0x12400000 irq 136,0 (pio)
[ 5.043409] mmci-pl18x 12400000.sdcc: DMA channels RX dma0chan1, TX dma0chan2
[ 5.097128] sdhci: Secure Digital Host Controller Interface driver
[ 5.097162] sdhci: Copyright(c) Pierre Ossman
[ 5.102449] Synopsys Designware Multimedia Card Interface Driver
[ 5.107280] usbcore: registered new interface driver ushc
[ 5.112709] sdhci-pltfm: SDHCI platform and OF driver helper
[ 5.121849] deviceless supply vcore_regulator not found, using dummy regulator
[ 5.126270] L2 @ QSB rate. Forcing new rate.
[ 5.131018] L2 @ 384000 KHz
[ 5.135326] CPU0 @ 800000 KHz
[ 5.137794] CPU1 @ QSB rate. Forcing new rate.
[ 5.141034] CPU1 @ 384000 KHz
[ 5.141706] mmc0: BKOPS_EN bit is not set
[ 5.147584] mmc0: new high speed MMC card at address 0001
[ 5.152410] mmcblk0: mmc0:0001 MMC04G 3.57 GiB 
[ 5.153529] NET: Registered protocol family 26
[ 5.153551] GACT probability on
[ 5.153569] Mirror/redirect action on
[ 5.154689] netem: version 1.3
[ 5.154765] u32 classifier
[ 5.154771] Performance counters on
[ 5.154775] input device check on
[ 5.154779] Actions configured
[ 5.154815] Netfilter messages via NETLINK v0.30.
[ 5.154842] nfnl_acct: registering with nfnetlink.
[ 5.154944] nf_conntrack version 0.5.0 (7422 buckets, 29688 max)
[ 5.155869] ctnetlink v0.93: registering with nfnetlink.
[ 5.155902] nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>
[ 5.156192] ipip: IPv4 over IPv4 tunneling driver
[ 5.157385] gre: GRE over IPv4 demultiplexor driver
[ 5.157392] ip_gre: GRE over IPv4 tunneling driver
[ 5.159543] IPv4 over IPSec tunneling driver
[ 5.160622] TCP: bic registered
[ 5.160633] TCP: cubic registered
[ 5.160642] TCP: westwood registered
[ 5.160652] TCP: highspeed registered
[ 5.160658] TCP: hybla registered
[ 5.160665] TCP: htcp registered
[ 5.160672] TCP: vegas registered
[ 5.160679] TCP: veno registered
[ 5.160685] TCP: scalable registered
[ 5.160693] TCP: lp registered
[ 5.160700] TCP: yeah registered
[ 5.160707] TCP: illinois registered
[ 5.160713] Initializing XFRM netlink socket
[ 5.161823] NET: Registered protocol family 10
[ 5.164960] sit: IPv6 over IPv4 tunneling driver
[ 5.167626] ip6_gre: GRE over IPv6 tunneling driver
[ 5.168978] NET: Registered protocol family 17
[ 5.169049] NET: Registered protocol family 15
[ 5.169061] NET: Registered protocol family 5
[ 5.169245] l2tp_core: L2TP core driver, V2.0
[ 5.169284] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 5.169290] l2tp_netlink: L2TP netlink interface
[ 5.170209] sctp: Hash tables configured (established 16384 bind 16384)
[ 5.171071] openvswitch: Open vSwitch switching datapath
[ 5.171511] mpls_gso: MPLS GSO support
[ 5.197536] regulator-dummy: disabling
[ 5.336704] qcom-dwc3-hsphy 110f8800.phy: cannot set voltage for vddcx
[ 5.336852] mmcblk0boot0: mmc0:0001 MMC04G partition 1 2.00 MiB
[ 5.337013] mmcblk0boot1: mmc0:0001 MMC04G partition 2 2.00 MiB
[ 5.337167] mmcblk0rpmb: mmc0:0001 MMC04G partition 3 128 KiB
[ 5.345034] mmcblk0: p1 p2 p3 p4 p5
[ 5.348415] mmcblk0boot1: unknown partition table
[ 5.349828] mmcblk0boot0: unknown partition table
[ 5.372625] qcom-dwc3-hsphy 110f8800.phy: cannot set voltage for v3p3
[ 5.377290] qcom-dwc3-hsphy 110f8800.phy: cannot set voltage for v1p8
[ 5.383721] regulator-dummy: operation not allowed
[ 5.390221] regulator-dummy: operation not allowed
[ 5.397228] qcom-dwc3-ssphy 110f8830.phy: cannot set voltage for vddcx
[ 5.657433] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[ 5.657525] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
[ 5.662721] xhci-hcd xhci-hcd.0.auto: irq 142, io mem 0x11000000
[ 5.669948] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[ 5.675631] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 5.682407] usb usb1: Product: xHCI Host Controller
[ 5.689496] usb usb1: Manufacturer: Linux 3.14.0 xhci-hcd
[ 5.694200] usb usb1: SerialNumber: xhci-hcd.0.auto
[ 5.701169] hub 1-0:1.0: USB hub found
[ 5.704514] hub 1-0:1.0: 1 port detected
[ 5.709127] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[ 5.712366] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
[ 5.718212] usb usb2: New USB device found, idVendor=1d6b, idProduct=0003
[ 5.725195] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 5.732233] usb usb2: Product: xHCI Host Controller
[ 5.739324] usb usb2: Manufacturer: Linux 3.14.0 xhci-hcd
[ 5.744027] usb usb2: SerialNumber: xhci-hcd.0.auto
[ 5.750880] hub 2-0:1.0: USB hub found
[ 5.754328] hub 2-0:1.0: 1 port detected
[ 5.759796] qcom-dwc3-hsphy 100f8800.phy: cannot set voltage for vddcx
[ 5.762174] qcom-dwc3-hsphy 100f8800.phy: cannot set voltage for v3p3
[ 5.768660] qcom-dwc3-hsphy 100f8800.phy: cannot set voltage for v1p8
[ 5.775013] regulator-dummy: operation not allowed
[ 5.781524] regulator-dummy: operation not allowed
[ 5.788536] qcom-dwc3-ssphy 100f8830.phy: cannot set voltage for vddcx
[ 6.047369] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[ 6.047449] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 3
[ 6.052596] xhci-hcd xhci-hcd.1.auto: irq 237, io mem 0x10000000
[ 6.059810] usb usb3: New USB device found, idVendor=1d6b, idProduct=0002
[ 6.065565] usb usb3: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 6.072383] usb usb3: Product: xHCI Host Controller
[ 6.079434] usb usb3: Manufacturer: Linux 3.14.0 xhci-hcd
[ 6.084136] usb usb3: SerialNumber: xhci-hcd.1.auto
[ 6.090646] hub 3-0:1.0: USB hub found
[ 6.094428] hub 3-0:1.0: 1 port detected
[ 6.098746] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[ 6.102286] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 4
[ 6.107988] usb usb4: New USB device found, idVendor=1d6b, idProduct=0003
[ 6.115123] usb usb4: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 6.122136] usb usb4: Product: xHCI Host Controller
[ 6.129256] usb usb4: Manufacturer: Linux 3.14.0 xhci-hcd
[ 6.133957] usb usb4: SerialNumber: xhci-hcd.1.auto
[ 6.140476] hub 4-0:1.0: USB hub found
[ 6.144240] hub 4-0:1.0: 1 port detected
[ 6.148845] SPEED BIN: 0
[ 6.152092] ACPU PVS: 2
[ 6.154639] deviceless supply vcore_regulator not found, using dummy regulator
[ 6.156881] regulator-dummy: Failed to create debugfs directory
[ 6.164364] Frequency table not initialized.
[ 6.170062] Frequency table not initialized.
[ 6.174445] Frequency table not initialized.
[ 6.178734] Frequency table not initialized.
[ 6.182910] Frequency table not initialized.
[ 6.187415] Frequency table not initialized.
[ 6.191472] Frequency table not initialized.
[ 6.195689] Frequency table not initialized.
[ 6.200057] Frequency table not initialized.
[ 6.204175] Frequency table not initialized.
[ 6.218326] Freeing unused kernel memory: 1652K (80b0d000 - 80caa000)
 argc == 8
 argv[0]: "/bin/kinit"
 argv[1]: "root=/dev/mmcblk0p3"
 argv[2]: "loglevel=7"
 argv[3]: "rdinit=/bin/kinit"
 argv[4]: "rw"
 argv[5]: "single"
 argv[6]: "console=ttyMSM0,115200n8"
 argv[7]: "earlyprintk"
Running ipconfig
 argc == 3
 argv[0]: "IP-Config"
 argv[1]: "-i"
 argv[2]: "Linux kinit"
IP-Config: no devices to configure
kinit: do_mounts
kinit: try_name mmcblk0,3 = mmcblk0p3(179,3)
kinit: name_to_dev_t(/dev/mmcblk0p3) = mmcblk0p3(179,3)
kinit: root_dev = mmcblk0p3(179,3)
kinit: mounting root rw
kinit: /dev/root appears to be a ext4 filesystem
kinit: trying to mount /dev/root on /root with type ext4, flags 0x8000, data '(null)'
[ 6.416902] usb 3-1: new full-speed USB device number 2 using xhci-hcd
[ 6.557631] usb 3-1: New USB device found, idVendor=0cf3, idProduct=3004
[ 6.557659] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 8.142518] EXT4-fs (mmcblk0p3): recovery complete
[ 8.144170] EXT4-fs (mmcblk0p3): mounted filesystem with ordered data mode. Opts: (null)
kinit: Mounted root (ext4 filesystem).
Checking for init: /sbin/init
Mount failed for selinuxfs on /sys/fs/selinux: No such file or directory
[ 8.718645] random: init urandom read with 93 bits of entropy available
[ 9.200508] init: mounted-proc main process (282) terminated with status 1
Starting Hardware RNG entropy gatherer daemon: rngd.
net.core.rmem_default = 8388608
net.core.wmem_default = 8388608
net.core.rmem_max = 8388608
net.core.wmem_max = 8388608
net.ipv4.tcp_wmem = 1048576 2097152 8388608
net.ipv4.tcp_rmem = 1048576 2097152 8388608
net.core.netdev_max_backlog = 2000
net.ipv4.ip_forward = 1
autoneg unmodified, ignoring
autoneg unmodified, ignoring
dev.nss.general.jumbo_mru = 9000
dev.nss.general.redirect = 1
sysctl: setting key "dev.nss.general.rps": Invalid argument
dev.nss.general.rps = 1
e2fsck 1.42.9 (4-Feb-2014)
/dev/mmcblk0p5 was not cleanly unmounted, check forced.
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/dev/mmcblk0p5: 27/7936 files (0.0% non-contiguous), 1414/31744 blocks
root@eero:~# [ 15.635527] AHB support is still work in progress
[ 18.103697] watchdog watchdog0: watchdog did not stop!
[ 27.653484] zorgo_0_0: Not creating an NSS virtual interface
[ 28.903518] zorgo_1_0: Not creating an NSS virtual interface

root@eero:~# 
root@eero:~#