whr-300hp2能进breed，进不了系统，芯片全部都换新了也一样

街角***

buffalo whr-300hp2，刷breed-mt7620-whr-1166dhp的breed。另外两台完全正常，一模一样的机型内部一样的板子，怎么刷都正常。
就这一台折腾一星期了，能进breed，怎么都进不了系统，怎么刷都不行。原厂编程器备份，另外正常机器的编程器备份，breed恢复出厂，全都试过了。
MT7620A，64MB内存，8MB闪存，全都换成新的了还是不行。
能试的都试了，只能来论坛请教大家了。
刷的buffalo官方DD-WRT系统whr300hp2d-v24sp2-22750b。
TLL最后提示内核不同步，异常中断。
以下为正常启动机器的TTL内容：
Boot and Recovery Environment for Embedded Devices
Copyright (C) 2017 HackPascal <hackpascal@gmail.com>
Build date 2017-06-13 [git-2df7776]
Version 1.1 (r1016)

DRAM: 64MB
Platform: MediaTek MT7620A ver 2, eco 3
Board: Reference design
Clocks: CPU: 580MHz, Bus: 193MHz
Flash: Winbond W25Q64 (8MB) on rt2880-spi
rt2880-eth: Using MAC address 00:0c:43:76:20:77
eth0: MediaTek MT7620A built-in 5-port 10/100M switch

Network started on eth0, inet addr 192.168.1.1, netmask 255.255.255.0

Press any key to interrupt autoboot ... 0   

Trying to boot firmware from 0x00050000 in flash bank 0 ...
Reading data into memory ...
U-Boot firmware image header detected.
    Image Name:   DD-WRT v24 Linux Kernel Image
    Data Size:    1144455 Bytes
    Load Address: 80000000
    Entry Point:  800089d0
Uncompressing data (LZMA) ... done.
Flushing cache ... done.

Starting kernel at 0x800089d0...

Linux version 3.10.18 (root@dd-wrt.buildserver) (gcc version 4.6.3 20120201 (prerelease)

(Linaro GCC 4.6-2012.02) ) #37 Tue Nov 5 08:17:35 CET 2013
Board has DDR2
Analog PMU set to hw control
Digital PMU set to hw control
SoC Type: Ralink MT7620A ver:2 eco:3
bootconsole [early0] enabled
CPU revision is: 00019650 (MIPS 24KEc)
MIPS: machine is Ralink MT7620a + MT7610e evaluation board
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Zone ranges:
  Normal   [mem 0x00000000-0x03ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x03ffffff]
Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,57600 console=ttyS0,57600n8 root=/dev/mtdblock4

rootfstype=squashfs noinitrd
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Writing ErrCtl register=0000000a
Readback ErrCtl register=0000000a
Memory: 61288k/65536k available (2710k kernel code, 4248k reserved, 470k data, 208k init,

0k highmem)
NR_IRQS:128
CPU Clock: 580MHz
Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
PCIE0 no card, disable it(RST&CLK)
bio: create slab <bio-0> at 0
rt2880_gpio 10000600.gpio: registering 24 gpios
rt2880_gpio 10000600.gpio: registering 24 irq handlers
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
pci_bus 0000:00: root bus resource [io  0x10160000-0x1016ffff]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
Switching to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
rt-timer 10000100.timer: maximum frequncy is 2441Hz
squashfs: version 3.0 (2006/03/15) Phillip Lougher
msgmni has been set to 119
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20) is a 16550A
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Ralink gpio driver initialized
m25p80 spi32766.0: found s25fl064k, expected w25q64
m25p80 spi32766.0: s25fl064k (8192 Kbytes)
6 ofpart partitions found on MTD device spi32766.0
Creating 6 MTD partitions on "spi32766.0":
0x000000000000-0x000000030000 : "u-boot"
0x000000030000-0x000000040000 : "u-boot-env"
0x000000040000-0x000000050000 : "factory"
0x000000050000-0x000000600000 : "linux"
scan from offset 50000

found squashfs at 168000
Creating 1 MTD partitions on "spi32766.0":
0x000000168000-0x0000007f0000 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than

an erase block -- forcing read-only
mtd: partition "rootfs" set to be root filesystem
mtd: partition "ddwrt" created automatically, ofs=600000, len=1F0000
0x000000600000-0x0000007f0000 : "ddwrt"
0x000000600000-0x000000700000 : "User_CFG"
0x0000007f0000-0x000000800000 : "nvram"
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
gsw: setting port4 to ephy mode
(unregistered net_device): port 3 link up (100Mbps/Full duplex)
eth0: done loading
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
u32 classifier
    Performance counters on
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (957 buckets, 3828 max)
ctnetlink v0.93: registering with nfnetlink.
ipip: IPv4 over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully
TCP: bic registered
TCP: cubic registered
TCP: westwood registered
TCP: highspeed registered
TCP: hybla registered
TCP: htcp registered
TCP: vegas registered
TCP: scalable registered
NET: Registered protocol family 17
Bridge firewalling registered
8021q: 802.1Q VLAN Support v1.8
searching for nvram
nvram size = -2144575314
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 208K (8031c000 - 80350000)
start service
starting Architecture code for rt2880
starting hotplug
Jan  1 00:00:02 udevtrigger[41]: parse_config_file: can't open '/etc/udev/udev.conf' as

config file: No such file or directory
done
rt2860v2_ap: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
rt2880_wdt 10000120.watchdog: Initialized
configure mac address to 10:6f:3f:f0:a9:bc
switch reg write offset=2004, value=ff0003
switch reg write offset=2104, value=ff0003
switch reg write offset=2204, value=ff0003
switch reg write offset=2304, value=ff0003
switch reg write offset=2404, value=ff0003
switch reg write offset=2504, value=ff0003
switch reg write offset=2010, value=810000c0
switch reg write offset=2110, value=810000c0
switch reg write offset=2210, value=810000c0
switch reg write offset=2310, value=810000c0
switch reg write offset=2410, value=810000c0
switch reg write offset=2510, value=810000c0
switch reg write offset=2610, value=81000000
switch reg write offset=2710, value=81000000
switch reg write offset=2604, value=20ff0003
switch reg write offset=2704, value=20ff0003
switch reg write offset=2014, value=10001
switch reg write offset=2114, value=10001
switch reg write offset=2214, value=10001
switch reg write offset=2314, value=10001
switch reg write offset=2414, value=10002
switch reg write offset=2514, value=10001
REG_ESW_WT_MAC_ATCnf_conntrack: automatic helper assignment is deprecated and it will be

removed soon. Use the iptables CT target to attach helpers instead.
is 0x7ff0002
done.
ra0: Network is down
device vlan1 entered promiscuous mode
device eth0 entered promiscuous mode
br0: port 1(vlan1) entered forwarding state
br0: port 1(vlan1) entered forwarding state
RtmpOSNetDevDetach(): RtmpOSNetDeviceDetach(), dev->name=ra0!
read ralink eeprom from 0 with len 200 to 837d46e8 (device 2)
mculedcntl 1
Led Actitity Settings AAA8
0x1300 = 00064300
read ralink eeprom from 0 with len 200 to 837d46e8 (device 2)
mculedcntl 1
Led Actitity Settings AAA8
br0: port 1(vlan1) entered forwarding state
0x1300 = 00064300
device ra0 entered promiscuous mode
br0: port 2(ra0) entered forwarding state
br0: port 2(ra0) entered forwarding state
wland: No such file or directory
nvram lock, waiting....
device vlan2 entered promiscuous mode
device vlan2 left promiscuous mode
/bin/sh: /opt/etc/init.d/rcS: not found
/bin/sh: /jffs/etc/init.d/rcS: not found
/bin/sh: /mmc/etc/init.d/rcS: not found
Segmentation fault
SIOCGIFFLAGS: No such device
nvram lock, waiting....
br0: port 2(ra0) entered forwarding state
nvram lock, waiting....
The Milkfish Router Services
ERROR: Necessary service setting not found: milkfish_username - aborting.
The Milkfish Router Services
Restoring SIP ddsubscriber database from NVRAM...
Empty.
The Milkfish Router Services
Restoring SIP ddaliases database from NVRAM...
Empty.
nvram lock, waiting....
ra0: Operation not supported
ra0: Operation not supported
ra0: Operation not supported



以下为无法正常启动机器的ttl内容：
Boot and Recovery Environment for Embedded Devices
Copyright (C) 2017 HackPascal <hackpascal@gmail.com>
Build date 2017-06-13 [git-2df7776]
Version 1.1 (r1016)

DRAM: 64MB
Platform: MediaTek MT7620A ver 2, eco 6
Board: Reference design
Clocks: CPU: 580MHz, Bus: 193MHz
Flash: Winbond W25Q64 (8MB) on rt2880-spi
rt2880-eth: Using MAC address 00:0c:43:76:20:77
eth0: MediaTek MT7620A built-in 5-port 10/100M switch

Network started on eth0, inet addr 192.168.1.1, netmask 255.255.255.0

Press any key to interrupt autoboot ... 0   

Trying to boot firmware from 0x00050000 in flash bank 0 ...
Reading data into memory ...
U-Boot firmware image header detected.
    Image Name:   DD-WRT v24 Linux Kernel Image
    Data Size:    1144455 Bytes
    Load Address: 80000000
    Entry Point:  800089d0
Uncompressing data (LZMA) ... done.
Flushing cache ... done.

Starting kernel at 0x800089d0...

Linux version 3.10.18 (root@dd-wrt.buildserver) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #37 Tue Nov 5 08:17:35 CET 2013
Board has DDR2
Analog PMU set to hw control
Digital PMU set to hw control
SoC Type: Ralink MT7620A ver:2 eco:6
bootconsole [early0] enabled
CPU revision is: 00019650 (MIPS 24KEc)
MIPS: machine is Ralink MT7620a + MT7610e evaluation board
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Zone ranges:
  Normal   [mem 0x00000000-0x03ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x03ffffff]
Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,57600 console=ttyS0,57600n8 root=/dev/mtdblock4 rootfstype=squashfs noinitrd
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Writing ErrCtl register=0007e3e3
Readback ErrCtl register=0007e3e3
Memory: 61288k/65536k available (2710k kernel code, 4248k reserved, 470k data, 208k init, 0k highmem)
NR_IRQS:128
CPU Clock: 580MHz
Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
PCIE0 no card, disable it(RST&CLK)
bio: create slab <bio-0> at 0
rt2880_gpio 10000600.gpio: registering 24 gpios
rt2880_gpio 10000600.gpio: registering 24 irq handlers
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
pci_bus 0000:00: root bus resource [io  0x10160000-0x1016ffff]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
Switching to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
rt-timer 10000100.timer: maximum frequncy is 2441Hz
squashfs: version 3.0 (2006/03/15) Phillip Lougher
msgmni has been set to 119
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20) is a 16550A
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Ralink gpio driver initialized
m25p80 spi32766.0: found s25fl064k, expected w25q64
m25p80 spi32766.0: s25fl064k (8192 Kbytes)
6 ofpart partitions found on MTD device spi32766.0
Creating 6 MTD partitions on "spi32766.0":
0x000000000000-0x000000030000 : "u-boot"
0x000000030000-0x000000040000 : "u-boot-env"
0x000000040000-0x000000050000 : "factory"
0x000000050000-0x000000600000 : "linux"
scan from offset 50000

found squashfs at 168000
Creating 1 MTD partitions on "spi32766.0":
0x000000168000-0x0000007f0000 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs" set to be root filesystem
mtd: partition "ddwrt" created automatically, ofs=600000, len=1F0000
0x000000600000-0x0000007f0000 : "ddwrt"
0x000000600000-0x000000700000 : "User_CFG"
0x0000007f0000-0x000000800000 : "nvram"
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
gsw: setting port4 to ephy mode
(unregistered net_device): port 3 link up (100Mbps/Full duplex)
eth0: done loading
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
u32 classifier
    Performance counters on
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (957 buckets, 3828 max)
ctnetlink v0.93: registering with nfnetlink.
ipip: IPv4 over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully
TCP: bic registered
TCP: cubic registered
TCP: westwood registered
TCP: highspeed registered
TCP: hybla registered
TCP: htcp registered
TCP: vegas registered
TCP: scalable registered
NET: Registered protocol family 17
Bridge firewalling registered
8021q: 802.1Q VLAN Support v1.8
searching for nvram
nvram size = -2144575314
Broken NVRAM found, recovering it (Magic FFFFFFFF)
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 208K (8031c000 - 80350000)
start service
starting Architecture code for rt2880
starting hotplug
Jan  1 00:00:02 udevtrigger[41]: parse_config_file: can't open '/etc/udev/udev.conf' as config file: No such file or directory
CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 800834ac, ra == 80087cd0
Oops[#1]:
CPU: 0 PID: 41 Comm: udevtrigger Not tainted 3.10.18 #37
task: 83f870d8 ti: 83f98000 task.ti: 83f98000
$ 0   : 00000000 00000000 80300000 83f870d8
$ 4   : 83c01f80 00000000 83f99e78 83f99f00
$ 8   : 00000000 0000000f 80085be0 fffffff8
$12   : 0000005c 00000000 0000002f 00410000
$16   : 8030fea4 83c01f80 00000001 000080d0
$20   : 83f99f00 00414050 00400000 00100100
$24   : 004140f4 77446fa0                  
$28   : 83f98000 83f99db8 00000041 80087cd0
Hi    : 00000150
Lo    : 00034f18
epc   : 800834ac 0x800834ac
    Not tainted
ra    : 80087cd0 0x80087cd0
Status: 1100a402        KERNEL EXL
Cause : 00800008
BadVA : 00000000
PrId  : 00019650 (MIPS 24KEc)
Modules linked in:
Process udevtrigger (pid: 41, threadinfo=83f98000, task=83f870d8, tls=774e2440)
Stack : 00000000 801f21d8 ff0a0004 ffffffff 0000001f 8030fea4 80360000 83c1fae0
          83c97000 80087cd0 00000000 00000001 83f9501c 00000007 ffffff9c 83f99e78
          ffffff9c 80093c6c 83f9501c 00000000 83d27288 8010d78c 83f99e18 004286f8
          00000000 00000000 000000d0 8010d7dc 83d27288 838ab888 004284f0 004286f8
          00000001 83f99f00 ffffff9c 83c97000 00410000 00414050 00400000 00100100
          ...
Call Trace:[<801f21d8>] 0x801f21d8
[<80087cd0>] 0x80087cd0
[<80093c6c>] 0x80093c6c
[<8010d78c>] 0x8010d78c
[<8010d7dc>] 0x8010d7dc
[<800942d8>] 0x800942d8
[<80159744>] 0x80159744
[<80062574>] 0x80062574
[<800d4488>] 0x800d4488
[<8009f2bc>] 0x8009f2bc
[<80085b38>] 0x80085b38
[<80030000>] 0x80030000
[<80006544>] 0x80006544


Code: 32520001  000000c0  8c850054 <8ca20000> 10400013  24030001  aca3000c  00000000  00000000
---[ end trace 454cf0877a2d45be ]---
Fatal exception: panic in 5 secondsCPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 800822b0, ra == 8005853c
Oops[#2]:
CPU: 0 PID: 3 Comm: ksoftirqd/0 Tainted: G      D      3.10.18 #37
task: 83c21078 ti: 83c2e000 task.ti: 83c2e000

$ 0   : 00000000 00000000 00000000 00000001
$ 4   : 83c01f80 83f8bde0 04208040 ffff00fe
$ 8   : 83c2ffe0 0000a400 80352ab0 000000a0
$12   : 00000000 000000a0 00000000 69206369
$16   : 00000000 83f8bde0 00000001 00000024
$20   : 00000009 80357840 0000000a 80350000
$24   : 00000003 8004627c                  
$28   : 83c2e000 83c2fe00 80306f00 8005853c
Hi    : 00000008
Lo    : cccccccf
epc   : 800822b0 0x800822b0
    Tainted: G      D     
ra    : 8005853c 0x8005853c
Status: 1100a402        KERNEL EXL
Cause : 00800008
BadVA : 00000000
PrId  : 00019650 (MIPS 24KEc)
Modules linked in:
Process ksoftirqd/0 (pid: 3, threadinfo=83c2e000, task=83c21078, tls=00000000)
Stack : 80357840 8001a7f8 80300000 00000003 83f8bde0 83f64aa0 00000100 8005853c
          00000000 80043954 00000000 83c21898 83c210a8 00000000 80357864 80058574
          80306f68 80306f30 83f87108 800456d0 80306f30 800246a8 83c21078 83c21078
          83c21078 83c21078 80306f30 80300660 ffff8c2d 04208040 00000000 8030a244
          00000001 00000002 80042750 80300000 00000000 8030fca8 00000000 800247c4
          ...
Call Trace:[<8001a7f8>] 0x8001a7f8
[<8005853c>] 0x8005853c
[<80043954>] 0x80043954
[<80058574>] 0x80058574
[<800456d0>] 0x800456d0
[<800246a8>] 0x800246a8
[<80042750>] 0x80042750
[<800247c4>] 0x800247c4
[<80042750>] 0x80042750
[<800428a0>] 0x800428a0
[<8003accc>] 0x8003accc
[<80043d40>] 0x80043d40
[<8003ac1c>] 0x8003ac1c
[<80004870>] 0x80004870
[<80010400>] 0x80010400


Code: 32520001  000000c0  8c900054 <8e030000> 8e020004  0062102b  14400003  00000000  0c02095a
---[ end trace 454cf0877a2d45bf ]---
Kernel panic - not syncing: Fatal exception in interrupt
Rebooting in 1 seconds..

nianq***

试试潘多拉呢？ 我的300hp2刷了k2的潘多拉用