ApresiaLightGS120GT-SS RTL8231メモ

各SFPのI2Cもどこかに居るはずだけど未だ不明
“LOOP” LEDと未使用のLEDはピン番号それらしきもの判明しているものの反応せず

I/O	0
I/O	1	SFP?
I/O	2	SFP?
I/O	3	SFP?		18F MOD0
I/O	4	SFP?		18F LOS?
I/O	5
I/O	6	SFP?
I/O	7	SFP?
I/O	8	SFP?		17F MOD0
I/O	9	SFP?		17F LOS?
I/O	10	"LOOP" LED?
I/O	11	SFP?
I/O	12	SFP?
I/O	13	SFP?		20F MOD0
I/O	14	SFP?
I/O	15
I/O	16
I/O	17
I/O	18
I/O	19
I/O	20
I/O	21
I/O	22	SFP?
I/O	23	SFP?
I/O	24	SFP?		19F MOD0
OUT	25	SFP?
OUT	26
OUT	27
OUT	28
OUT	29
OUT	30
OUT	31
I/O	32
I/O	33	"RESET" button
I/O	34
I/O	35
I/O	36	unused LED?

DGS-1210-28 F1 ファームウェアメモ

APRESIA Systems ApresiaLightGSシリーズも恐らく同じ
DGS-1210-28 F1のGPL tar内のMakefile, plfmake.h、 host/tools/ のツール類から

ヘッダ

ApresiaLightGSシリーズだと0x17に1byte何かが居る
    0x0                 0x4                 0x8                 0xC
     +-------------------+-------------------+-------------------+-------------------+
 0x0 |    Checksum *1    |                                  Model Name             ->|
     +-------------------+-------------------+-------------------+-------------------+
0x10 |->         (Model Name)                |               Signature             ->|
     +-------------------+-------------------+----+----+---------+-------------------+ 
0x20 |->         (Signature)                 | *3 | *4 |    *5   |   Board Version   |
     +-------------------+-------------------+----+----+---------+-------------------+
0x30 |    Data Length    |                    Entry Point (text)                     |
     +-------------------+-------------------+-------------------+-------------------+

*1: Checksum
      data without block header (unit: 1byte, (addr 0x0) + (addr 0x1) + ...)
*2: Signature
      Kernel            -> "os"
      RootFS (SquashFS) -> "squashfs"
*3: Partition Index
*4: Header Length??
*5: Customer Signature

フッタ

    0x0                 0x4                 0x8                 0xC
     +-------------------+-------------------+-------------------+-------------------+
 0x0 |                               FW Version (text)                               |
     +-------------------+-------------------+-------------------+-------------------+
0x10 |'C'  'A'  'M'  'E'  'O'  'T'  'A'  'G' |     OS Version    |    Checksum *1    |
     +-------------------+-------------------+-------------------+-------------------+ 

1: Checksum
     data without block header and last 4bytes of checksum
     (unit: 1byte, (addr 0x0) + (addr 0x1) + ...)

フッタのChecksumに、それを1byte分ずつ足したものがヘッダのChecksumになる
例:

  • ヘッダ: 0x07953DD6
  • フッタ: 0x07953C7F

0x07953C7F + 0x07 + 0x95 + 0x3C + 0x7F = 0x7953DD6

ApresiaLightGS120GT-SS

例によってRTL83xx系SoCを搭載するスイッチングハブを様々なメーカーで調べた際に見つけたもの。APRESIA SystemsのApresiaLightGSシリーズは全モデル通してファームウェアが共通である為、この記事の120以外も全て同様にRealtek SoCを搭載していると思われる。
弄っていくのでメモ。

U-Boot

help

APLGS120GTSS # help
?       - alias for 'help'
base    - print or set address offset
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
env     - environment handling commands
erase   - erase FLASH memory
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print command description/usage
iminfo  - print header information for application image
loadb   - load binary file over serial line (kermit mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mdram_test- mdram_test   - do DRAM test.
mflash_test- mflash_test   - do flash test.
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
printenv2- print environment variables
protect - enable or disable FLASH write protection
reset   - Perform RESET of the CPU
rtk     - rtk     - Realtek commands

run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
saveenv2- save environment variables to persistent storage
setenv  - set environment variables
setenv2 - set environment variables
sf      - SPI flash sub-system
sleep   - delay execution for some time
tftpboot- boot image via network using TFTP protocol
version - print monitor, compiler and linker version

version

APLGS120GTSS # version

U-Boot 2011.12.(2.1.5.67086)-Candidate1 (Apr 21 2020 - 16:39:05)
1.00.013
mips-linux-gcc (GCC) 3.4.4 mipssde-6.03.00-20051020
GNU ld (Linux/GNU Binutils) 2.18.50.0.1.20070908

printenv

APLGS120GTSS # printenv
Board_Id=602131615488
Board_Version=4
Boot_Version=1.00.013
Serial_Number=************
addargs=setenv bootargs console=$(console_device),$(baudrate) mem=$(memsize) noinitrd root=$(image) rw rootfstype=squashfs
baudrate=115200
boardmodel=RTL8382M_8218B_INTPHY_8214FC_DEMO
boardversion=V1.0R
bootcmd=bootm 0xb4100000
bootdelay=2
console_device=ttyS0
ethact=rtl8380#0
ethaddr=FC:6D:D1:xx:xx:EA
gatewayip=192.168.10.254
hw_version=A1
image=/dev/mtdblock4
ipaddr=192.168.10.200
memsize=254M
netmask=255.255.255.0
serverip=192.168.10.20
stderr=serial
stdin=serial
stdout=serial

Environment size: 619/262140 bytes

printenv2

APLGS120GTSS # printenv2
Image_Id=1

Environment size: 14/262140 bytes

help rtk

APLGS120GTSS # help rtk
rtk - rtk     - Realtek commands

Usage:
rtk object action
- SOC commands.
rtk network on
- Enable the networking function
rtk netowkr off
- Disable the networking function
rtk testmode [mode] [port]
- Set default value for specific testing
rtk ext-pinGet [pinNum]
- get external 8231 GPIO pin status
rtk ext-pinSet [pinNum] [status]
- set external 8231 GPIO pin status
rtk smi list
- list all smi group
rtk smi init [group_id] [sck_pin] [sda_pin] [8/16 access type] [chipid] [delay] [name]
- create a smi group and init
rtk smi read [group_id] [reg]
rtk smi write [group_id] [reg] [data]
rtk pinGet [pinNum]
- get internal GPIO pin status
rtk pinSet [pinNum] [status]
- set internal GPIO pin status
rtk ledtest [port] [led_index]
- led test
rtk ledtest-bank [round]
- led back on/off test
rtk loopback ext [port-start] [port-end] [round]
- port traffic external loopback test
rtk loopback int [port-start] [port-end] [round]
- port traffic internal loopback test
rtk txportpkt [port-id] [round]
- tx packet from CPU to specific port test
rtk ldps [port] [ on | off ]
- Enable/Disable link-down power saving (LDPS) of PHY
rtk green [port] [ on | off ]
- Enable/Disable green feature of PHY
rtk cross-over [port] [ auto | mdi | mdix ]
- Configure cross-over mode as Auto, Force-MDI, or Force-MDIX of PHY.

rtk smi list

APLGS120GTSS # rtk smi list

Index SCK_DEV SCK_PIN SDA_DEV SDA_PIN TYPE   ID   Delay Name
=================================================================

tftpboot

APLGS120GTSS # tftpboot
*** Warning: no boot file name; using 'C80AA8C0.img'
Using rtl8380#0 device
TFTP from server 192.168.10.20; our IP address is 192.168.10.200
Filename 'C80AA8C0.img'.
Load address: 0xb4100000
Loading: *

Kernel

bootlog


U-Boot 2011.12.(2.1.5.67086)-Candidate1 (Apr 21 2020 - 16:39:05)
1.00.013

Board: RTL838x CPU:500MHz LXB:200MHz MEM:300MHz
DRAM:  256 MB
SPI-F: 1x32 MB
Loading 262144B env. variables from offset 0x80000
Magic ID = 00004001 Board ID = 00000001
Switch Model: RTL8382M_8218B_INTPHY_8214FC_DEMO (Port Count: 20)
Switch Chip: RTL8382
**************************************************
#### RTL8218B config - MAC ID = 0 ####
Now External 8218B
**************************************************
#### RTL8218B config - MAC ID = 8 ####
Now Internal PHY
**************************************************
**** RTL8214FC config - MAC ID = 24 ****
Now External 8214FC
Net:   Net Initialization Skipped
rtl8380#0
Hit Esc key to stop autoboot:  0
Verifying Checksum for Image 1 ...
BOOT:...OK
OS:...OK
FS:...OK

Loading Runtime Image ...
## Booting kernel from Legacy Image at b4100000 ...
Image Name:
Created:      2020-04-21  16:38:46 UTC
Image Type:   MIPS Linux Kernel Image (gzip compressed)
Data Size:    936172 Bytes = 914.2 KB
Load Address: 80000000
Entry Point:  80224000
Verifying Checksum ... OK
Force port28 link down

Uncompressing Kernel Image ... OK

Starting kernel ...

Linux version 2.6.19 (lemon@SW3) (gcc version 3.4.4 mipssde-6.03.00-20051020) #6 PREEMPT Tue Apr 21 16:38:45 CST 2020
CPU revision is: 00019070
Determined physical RAM map:
memory: 07e00000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 0fe00000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 64516
Kernel command line: console=ttyS0,115200 mem=254M noinitrd root=/dev/mtdblock4 rw rootfstype=squashfs imgid=1 failover=0 csb=0x014EDB69 cso=0x0795D885
csf=0x5A4A8562 ethaddr=FC:6D:D1:08:56:EA magicid=0x00004001
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 1024 (order: 10, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 255360k/260096k available (1793k kernel code, 4628k reserved, 394k data, 104k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 8192 bind 4096)
TCP reno registered
squashfs: version 3.3 (2007/10/31) Phillip Lougher
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 31) is a 16550A
Probe: SPI CS1 Flash Type MX25L25635F
Creating 8 MTD partitions on "Total SPI FLASH":
0x00000000-0x00080000 : "BOOT"
0x00080000-0x000c0000 : "BDINFO"
0x000c0000-0x00100000 : "BDINFO2"
0x00100000-0x00280000 : "KERNEL1"
0x00280000-0x00f80000 : "ROOTFS1"
0x00f80000-0x01100000 : "KERNEL2"
0x01100000-0x01e00000 : "ROOTFS2"
0x01e00000-0x02000000 : "JFFS2"
cdd_crash load
memmap_pid load
Init CAMEO Debug Trace Driver Module....OK
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 104k freed
init started:  BusyBox v1.00 (2020.04.09-03:38+0000) multi-call binary
Starting pid 14, console : '/etc/rc'
Init RTCORE Driver Module....OK
route: not found
SIOCSIFADDR: No such device
Magic ID: 0x00004001
------------------------------------------------------------
Dynamic data initialization:
Model id: 1 Model Name: APLGS120GTSS
MaxDevicePort: 20 MaxTrunk: 8
Combo Port Layout dynamic data: u2PortNum: 4 u2PortStart: 17
Fiber Port Layout dynamic data: u2PortNum: 0 u2PortStart: 128
------------------------------------------------------------

MAC Address : FC-6D-D1-xx-xx-EA
RTK.0> H/W Version : A1

Smart Management Switch

APLGS120GTSS login:

WN-DX2033GR bootnum, debugflagメモ

bootnum, debugflag いずれも格納場所はサポート済みのWN-DX1167R, WN-AX1167GR2と同じ。

root@WN-DX2033GR:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 07f80000 00020000 "ALL"
mtd1: 00100000 00020000 "Bootloader"
mtd2: 00100000 00020000 "Ubootenv"
mtd3: 00100000 00020000 "Factory"
mtd4: 03200000 00020000 "firmware"
mtd5: 0307687e 00020000 "rootfs"
mtd6: 00100000 00020000 "Config"
mtd7: 03200000 00020000 "firmware_2"
mtd8: 00100000 00020000 "Config_2"
mtd9: 00100000 00020000 "persist"
mtd10: 00100000 00020000 "idmkey"
mtd11: 01380000 00020000 "Backup"
mtd12: 00100000 00020000 "SecondBoot"

bootnum

0x4 (persist)

root@WN-DX2033GR:~# mstc_persist read bootnum
1
root@WN-DX2033GR:~# hexdump -n 128 -C /dev/mtd9
00000000  1b 05 ce 17 01 01 00 00  1a 4c 00 00 67 86 07 53  |.........L..g..S|
00000010  1a 4c 00 00 67 86 07 53  00 00 00 00 00 00 00 00  |.L..g..S........|
00000020  00 00 00 00 00 00 00 00  ff ff ff ff ff ff ff ff  |................|
00000030  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000080
root@WN-DX2033GR:~# mstc_persist write bootnum 2
Unlocking persist ...
root@WN-DX2033GR:~# hexdump -n 128 -C /dev/mtd9
00000000  1b 05 ce 17 02 01 00 00  1a 4c 00 00 67 86 07 53  |.........L..g..S|
00000010  1a 4c 00 00 67 86 07 53  00 00 00 00 00 00 00 00  |.L..g..S........|
00000020  00 00 00 00 00 00 00 00  ff ff ff ff ff ff ff ff  |................|
00000030  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000080

debugflag

0xFE75 (Factory)

root@WN-DX2033GR:~# sys debugflag
DebugFlag: 0
root@WN-DX2033GR:~# hexdump -n $((0x100)) -v -C -s $((0xFE00)) /dev/mtd3
0000fe00  4d 69 74 72 61 73 74 61  72 00 54 65 63 68 6e 6f  |Mitrastar.Techno|
0000fe10  6c 6f 67 79 20 43 6f 72  70 2e 00 00 00 00 00 00  |logy Corp.......|
0000fe20  4d 69 43 41 50 2d 33 33  34 30 43 00 00 00 00 00  |MiCAP-3340C.....|
0000fe30  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fe40  31 39 35 36 30 35 32 37  00 00 00 00 00 00 00 00  |19560527........|
0000fe50  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fe60  53 30 39 30 59 30 30 30  30 30 30 30 30 00 00 13  |S090Y00000000...|
0000fe70  49 55 aa 00 04 00 ff ff  5a 59 ff ff 00 00 00 00  |IU......ZY......|
0000fe80  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fe90  00 00 00 00 00 00 00 00  00 01 18 06 12 09 20 16  |.............. .|
0000fea0  10 20 37 4d 69 43 41 50  2d 33 33 34 30 43 00 00  |. 7MiCAP-3340C..|
0000feb0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fec0  00 00 00 41 30 42 00 00  00 00 00 00 00 00 00 00  |...A0B..........|
0000fed0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fee0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fef0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000ff00
root@WN-DX2033GR:~# sys debugflag 1
PASS
root@WN-DX2033GR:~# hexdump -n $((0x100)) -v -C -s $((0xFE00)) /dev/mtd3
0000fe00  4d 69 74 72 61 73 74 61  72 00 54 65 63 68 6e 6f  |Mitrastar.Techno|
0000fe10  6c 6f 67 79 20 43 6f 72  70 2e 00 00 00 00 00 00  |logy Corp.......|
0000fe20  4d 69 43 41 50 2d 33 33  34 30 43 00 00 00 00 00  |MiCAP-3340C.....|
0000fe30  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fe40  31 39 35 36 30 35 32 37  00 00 00 00 00 00 00 00  |19560527........|
0000fe50  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fe60  53 30 39 30 59 30 30 30  30 30 30 30 30 00 00 13  |S090Y00000000...|
0000fe70  49 55 aa 00 04 01 ff ff  5a 59 ff ff 00 00 00 00  |IU......ZY......|
0000fe80  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fe90  00 00 00 00 00 00 00 00  00 01 18 06 12 09 20 16  |.............. .|
0000fea0  10 20 37 4d 69 43 41 50  2d 33 33 34 30 43 00 00  |. 7MiCAP-3340C..|
0000feb0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fec0  00 00 00 41 30 42 00 00  00 00 00 00 00 00 00 00  |...A0B..........|
0000fed0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fee0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fef0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000ff00

WN-DX2033GR

発売に前後してファームウェアから調べた際、MT7621搭載機であることを確認していたもの。
某氏から提供して頂いたものの、しばらく多忙であったこと、Realtek SoCのスイッチングハブ等に注力してしまっていたことから後回しになっていたが、ようやく多少落ち着いてきたので着手する。
サポートの為弄っていくのでメモ。

Switch

zone WAN LAN
port
(WN-DX2033GR)
インターネット (LAN番号刻印無し)
port
(MT7530)
port0 port1 port2 port3 port4

MAC

  • LAN: 50:41:B9:xx:xx:90 (Ubootenv, ethaddr (text) / Factory, 0xE000 (hex))
  • WAN: 50:41:B9:xx:xx:92 (Factory, 0xE006 (hex))
  • 2.4G: 50:41:B9:xx:xx:90 (Factory, 0x4 (hex))
  • 5G: 50:41:B9:xx:xx:91 (Factory, 0x8004 (hex))

U-Boot

WN-AX2033GRの情報を参考に強引にKernelへログインしたうえでブート時のmtdロックを回避、
sys debugflag 1
を設定してデバッグモードを有効化しZ-Loaderを停止できるように変更。再度ブート時にZ-Loaderに入り、
ATGU
でU-Bootへ移動する

help

MSTC # help
Unknown command 'help' - try 'help'

version

MSTC # version
Unknown command 'version' - try 'help'

printenv

MSTC # printenv
bootcmd=tftp
ipaddr=10.10.10.123
serverip=10.10.10.3
serialnum=xxxxxxxxxxxx
countrycode=EA
ethaddr=50:41:B9:xx:xx:90
nfLicense=xxxxxxxxxxxx
wifi1ssid1=IODATA-xxxx90-2G
wifi1ssid2=IO-Guest-xxxx90-2G
wifi2ssid1=IODATA-xxxx90-5G
wifiwpapsk=xxxxxxxxxxxxx
wifiwpspin=xxxxxxxx
wifi2ssid2=IO-Guest-xxxx90-5G
stdin=serial
stdout=serial
stderr=serial
ethact=Eth0 (10/100-M)

Environment size: 365/131068 bytes

tftp

MSTC # tftp

NetTxPacket = 0x87FE2FC0

KSEG1ADDR(NetTxPacket) = 0xA7FE2FC0

NetLoop,call eth_halt !

NetLoop,call eth_init !
Trying Eth0 (10/100-M)

Waitting for RX_DMA_BUSY status Start... done

dev->iobase=BE100000,GDMA1_MAC_ADRH=0000FD9B

dev->iobase=BE100000,GDMA1_MAC_ADRL=FFFFFFFF

ETH_STATE_ACTIVE!!
*** Warning: no boot file name; using 'test.bin'
Using Eth0 (10/100-M) device
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'test.bin'.

TIMEOUT_COUNT=10,Load address: 0x80200000
Loading: checksum bad
checksum bad
checksum bad
checksum bad

Kernel

パスワードが設定されている

uname -a

root@WN-DX2033GR:~# uname -a
Linux WN-DX2033GR 3.10.14 #1 SMP Thu Sep 3 17:22:37 CST 2020 mips GNU/Linux

cat /proc/version

root@WN-DX2033GR:~# cat /proc/version
Linux version 3.10.14 (*******@*******-PC-*******-******) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #1 SMP Thu Sep 3 17:22:37 CST 2020

cat /proc/cpuinfo

root@WN-DX2033GR:~# cat /proc/cpuinfo
system type             : MT7621
machine                 : Unknown
processor               : 0
cpu model               : MIPS 1004Kc V2.15
BogoMIPS                : 583.68
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VPE                     : 0
VCED exceptions         : not available
VCEI exceptions         : not available

processor               : 1
cpu model               : MIPS 1004Kc V2.15
BogoMIPS                : 583.68
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VPE                     : 1
VCED exceptions         : not available
VCEI exceptions         : not available

processor               : 2
cpu model               : MIPS 1004Kc V2.15
BogoMIPS                : 583.68
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
core                    : 1
VPE                     : 0
VCED exceptions         : not available
VCEI exceptions         : not available

processor               : 3
cpu model               : MIPS 1004Kc V2.15
BogoMIPS                : 583.68
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
core                    : 1
VPE                     : 1
VCED exceptions         : not available
VCEI exceptions         : not available

cat /proc/meminfo

root@WN-DX2033GR:~# cat /proc/meminfo
MemTotal:         125196 kB
MemFree:           60268 kB
Buffers:            6308 kB
Cached:            21208 kB
SwapCached:            0 kB
Active:            10544 kB
Inactive:          19780 kB
Active(anon):       3744 kB
Inactive(anon):     2280 kB
Active(file):       6800 kB
Inactive(file):    17500 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          2832 kB
Mapped:             2856 kB
Shmem:              3216 kB
Slab:              16640 kB
SReclaimable:       1988 kB
SUnreclaim:        14652 kB
KernelStack:         536 kB
PageTables:          256 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       62596 kB
Committed_AS:       9404 kB
VmallocTotal:    1048372 kB
VmallocUsed:       15492 kB
VmallocChunk:     978376 kB

cat /proc/mtd

root@WN-DX2033GR:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 07f80000 00020000 "ALL"
mtd1: 00100000 00020000 "Bootloader"
mtd2: 00100000 00020000 "Ubootenv"
mtd3: 00100000 00020000 "Factory"
mtd4: 03200000 00020000 "firmware"
mtd5: 0307687e 00020000 "rootfs"
mtd6: 00100000 00020000 "Config"
mtd7: 03200000 00020000 "firmware_2"
mtd8: 00100000 00020000 "Config_2"
mtd9: 00100000 00020000 "persist"
mtd10: 00100000 00020000 "idmkey"
mtd11: 01380000 00020000 "Backup"
mtd12: 00100000 00020000 "SecondBoot"

sys atsh

root@WN-DX2033GR:~# sys atsh
Firmware Version              : 3.10(XID.0)b19
Boot Version                  : 1.24.06 | 12/09/2016 10:20:37
Product Model                 : WN-DX2033GR
First MAC Address             : 50:41:B9:xx:xx:90
MAC Quantity                  : 4
Serial Number                 : xxxxxxxxxxxx
firmware Checksum             : bcc0562b
Kernel Checksum               : a399b7b8
RomFile Checksum              : 53078667
Country Code                  : EA
Boot Number                   : 1

switch –help

root@WN-DX2033GR:~# switch --help
Usage:
switch acl etype add [ethtype] [portmap]              - drop etherytype packets
switch acl dip add [dip] [portmap]                    - drop dip packets
switch acl dip meter [dip] [portmap][meter:kbps]      - rate limit dip packets
switch acl dip trtcm [dip] [portmap][CIR:kbps][CBS][PIR][PBS] - TrTCM dip packets
switch acl port add [sport] [portmap]           - drop src port packets
switch acl L4 add [2byes] [portmap]             - drop L4 packets with 2bytes payload
switch add [mac] [portmap]                  - add an entry to switch table
switch add [mac] [portmap] [vlan id]        - add an entry to switch table
switch add [mac] [portmap] [vlan id] [age]  - add an entry to switch table
switch clear                                - clear switch table
switch del [mac]                            - delete an entry from switch table
switch del [mac] [fid]                  - delete an entry from switch table
switch dip add [dip] [portmap]                  - add a dip entry to switch table
switch dip del [dip]                        - del a dip entry to switch table
switch dip dump                                 - dump switch dip table
switch dip clear                                - clear switch dip table
switch dump            - dump switch table
switch ingress-rate on [port] [Kbps]        - set ingress rate limit on port 0~4
switch egress-rate on [port] [Kbps]         - set egress rate limit on port 0~4
switch ingress-rate off [port]              - del ingress rate limit on port 0~4
switch egress-rate off [port]               - del egress rate limit on port 0~4
switch filt [mac]                           - add a SA filtering entry (with portmap 1111111) to switch table
switch filt [mac] [portmap]                 - add a SA filtering entry to switch table
switch filt [mac] [portmap] [vlan id]       - add a SA filtering entry to switch table
switch filt [mac] [portmap] [vlan id] [age] - add a SA filtering entry to switch table
switch igmpsnoop on [Query Interval] [default router portmap] - turn on IGMP snoop and  router port learning (Query Interval 1~255)
switch igmpsnoop off                                  - turn off IGMP snoop and router port learning
switch igmpsnoop enable [port#]                       - enable IGMP HW leave/join/Squery/Gquery
switch igmpsnoop disable [port#]                      - disable IGMP HW leave/join/Squery/Gquery
switch mymac [mac] [portmap]                  - add a mymac entry to switch table
switch mirror monitor [portnumber]            - enable port mirror and indicate monitor port number
switch mirror target [portnumber] [0:off, 1:rx, 2:tx, 3:all]  - set port mirror target
switch phy [phy_addr]                   - dump phy register of specific port
switch phy mt7530                       - dump mt7530 phy registers
switch phy                                      - dump all phy registers
switch pvid [port] [pvid]                - set pvid on port 0~4
switch reg r [offset]                       - register read from offset
switch reg w [offset] [value]               - register write value to offset
switch reg d [offset]                       - register dump
switch sip add [sip] [dip] [portmap]            - add a sip entry to switch table
switch sip del [sip] [dip]                          - del a sip entry to switch table
switch sip dump                                 - dump switch sip table
switch sip clear                                - clear switch sip table
switch tag on [port]                        - keep vlan tag for egress packet on prot 0~4
switch tag off [port]                       - remove vlan tag for egress packet on port 0~4
switch vlan dump                            - dump switch table
switch vlan set [vlan idx (NULL)][vid] [portmap]  - set vlan id and associated member

switch vlan dump

root@WN-DX2033GR:~# switch vlan dump
vid  fid  portmap    s-tag
1    0  -1111-11       0
2    0  1----1--       0
3    0  invalid
4    0  invalid
5    0  invalid
6    0  invalid
7    0  invalid
8    0  invalid
9    0  invalid
10    0  invalid
11    0  invalid
12    0  invalid
13    0  invalid
14    0  invalid
15    0  invalid
16    0  invalid

swconfig list

root@WN-DX2033GR:~# swconfig list
Found: switch0 - mt7530

swconfig dev MT7530 show

root@WN-DX2033GR:~# swconfig dev mt7530 show
Global attributes:
enable_vlan: 1
enable_vlan4k: 1
Port 0:
mib: Port 0 MIB counters
TxDrop     : 0
TxCRC      : 0
TxUni      : 0
TxMulti    : 0
TxBroad    : 0
TxCollision: 0
TxSingleCol: 0
TxMultiCol : 0
TxDefer    : 0
TxLateCol  : 0
TxExcCol   : 0
TxPause    : 0
Tx64Byte   : 0
Tx65Byte   : 0
Tx128Byte  : 0
Tx256Byte  : 0
Tx512Byte  : 0
Tx1024Byte : 0
TxByte     : 0
RxDrop     : 0
RxFiltered : 0
RxUni      : 0
RxMulti    : 0
RxBroad    : 0
RxAlignErr : 0
RxCRC      : 0
RxUnderSize: 0
RxFragment : 0
RxOverSize : 0
RxJabber   : 0
RxPause    : 0
Rx64Byte   : 0
Rx65Byte   : 0
Rx128Byte  : 0
Rx256Byte  : 0
Rx512Byte  : 0
Rx1024Byte : 0
RxByte     : 0
RxCtrlDrop : 0
RxIngDrop  : 0
RxARLDrop  : 0

pvid: 2
link: port:0 link:down
Port 1:
mib: Port 1 MIB counters
TxDrop     : 0
TxCRC      : 0
TxUni      : 0
TxMulti    : 0
TxBroad    : 0
TxCollision: 0
TxSingleCol: 0
TxMultiCol : 0
TxDefer    : 0
TxLateCol  : 0
TxExcCol   : 0
TxPause    : 0
Tx64Byte   : 0
Tx65Byte   : 0
Tx128Byte  : 0
Tx256Byte  : 0
Tx512Byte  : 0
Tx1024Byte : 0
TxByte     : 0
RxDrop     : 0
RxFiltered : 0
RxUni      : 0
RxMulti    : 0
RxBroad    : 0
RxAlignErr : 0
RxCRC      : 0
RxUnderSize: 0
RxFragment : 0
RxOverSize : 0
RxJabber   : 0
RxPause    : 0
Rx64Byte   : 0
Rx65Byte   : 0
Rx128Byte  : 0
Rx256Byte  : 0
Rx512Byte  : 0
Rx1024Byte : 0
RxByte     : 0
RxCtrlDrop : 0
RxIngDrop  : 0
RxARLDrop  : 0

pvid: 1
link: port:1 link:down
Port 2:
mib: Port 2 MIB counters
TxDrop     : 0
TxCRC      : 0
TxUni      : 0
TxMulti    : 0
TxBroad    : 0
TxCollision: 0
TxSingleCol: 0
TxMultiCol : 0
TxDefer    : 0
TxLateCol  : 0
TxExcCol   : 0
TxPause    : 0
Tx64Byte   : 0
Tx65Byte   : 0
Tx128Byte  : 0
Tx256Byte  : 0
Tx512Byte  : 0
Tx1024Byte : 0
TxByte     : 0
RxDrop     : 0
RxFiltered : 0
RxUni      : 0
RxMulti    : 0
RxBroad    : 0
RxAlignErr : 0
RxCRC      : 0
RxUnderSize: 0
RxFragment : 0
RxOverSize : 0
RxJabber   : 0
RxPause    : 0
Rx64Byte   : 0
Rx65Byte   : 0
Rx128Byte  : 0
Rx256Byte  : 0
Rx512Byte  : 0
Rx1024Byte : 0
RxByte     : 0
RxCtrlDrop : 0
RxIngDrop  : 0
RxARLDrop  : 0

pvid: 1
link: port:2 link:down
Port 3:
mib: Port 3 MIB counters
TxDrop     : 0
TxCRC      : 0
TxUni      : 0
TxMulti    : 0
TxBroad    : 0
TxCollision: 0
TxSingleCol: 0
TxMultiCol : 0
TxDefer    : 0
TxLateCol  : 0
TxExcCol   : 0
TxPause    : 0
Tx64Byte   : 0
Tx65Byte   : 0
Tx128Byte  : 0
Tx256Byte  : 0
Tx512Byte  : 0
Tx1024Byte : 0
TxByte     : 0
RxDrop     : 0
RxFiltered : 0
RxUni      : 0
RxMulti    : 0
RxBroad    : 0
RxAlignErr : 0
RxCRC      : 0
RxUnderSize: 0
RxFragment : 0
RxOverSize : 0
RxJabber   : 0
RxPause    : 0
Rx64Byte   : 0
Rx65Byte   : 0
Rx128Byte  : 0
Rx256Byte  : 0
Rx512Byte  : 0
Rx1024Byte : 0
RxByte     : 0
RxCtrlDrop : 0
RxIngDrop  : 0
RxARLDrop  : 0

pvid: 1
link: port:3 link:down
Port 4:
mib: Port 4 MIB counters
TxDrop     : 0
TxCRC      : 0
TxUni      : 1532
TxMulti    : 203
TxBroad    : 0
TxCollision: 0
TxSingleCol: 0
TxMultiCol : 0
TxDefer    : 0
TxLateCol  : 0
TxExcCol   : 0
TxPause    : 0
Tx64Byte   : 708
Tx65Byte   : 514
Tx128Byte  : 18
Tx256Byte  : 233
Tx512Byte  : 60
Tx1024Byte : 202
TxByte     : 488627
RxDrop     : 0
RxFiltered : 0
RxUni      : 1659
RxMulti    : 582
RxBroad    : 84
RxAlignErr : 0
RxCRC      : 0
RxUnderSize: 0
RxFragment : 0
RxOverSize : 0
RxJabber   : 0
RxPause    : 0
Rx64Byte   : 757
Rx65Byte   : 1166
Rx128Byte  : 149
Rx256Byte  : 96
Rx512Byte  : 157
Rx1024Byte : 0
RxByte     : 297785
RxCtrlDrop : 0
RxIngDrop  : 0
RxARLDrop  : 0

pvid: 1
link: port:4 link:up speed:1000baseT full-duplex
Port 5:
mib: Port 5 MIB counters
TxDrop     : 0
TxCRC      : 0
TxUni      : 0
TxMulti    : 0
TxBroad    : 0
TxCollision: 0
TxSingleCol: 0
TxMultiCol : 0
TxDefer    : 0
TxLateCol  : 0
TxExcCol   : 0
TxPause    : 0
Tx64Byte   : 0
Tx65Byte   : 0
Tx128Byte  : 0
Tx256Byte  : 0
Tx512Byte  : 0
Tx1024Byte : 0
TxByte     : 0
RxDrop     : 0
RxFiltered : 99
RxUni      : 0
RxMulti    : 2
RxBroad    : 97
RxAlignErr : 0
RxCRC      : 0
RxUnderSize: 0
RxFragment : 0
RxOverSize : 0
RxJabber   : 0
RxPause    : 0
Rx64Byte   : 0
Rx65Byte   : 1
Rx128Byte  : 1
Rx256Byte  : 97
Rx512Byte  : 0
Rx1024Byte : 0
RxByte     : 33810
RxCtrlDrop : 0
RxIngDrop  : 0
RxARLDrop  : 0

pvid: 2
link: port:5 link:up speed:1000baseT full-duplex
Port 6:
mib: Port 6 MIB counters
TxDrop     : 0
TxCRC      : 0
TxUni      : 1659
TxMulti    : 582
TxBroad    : 84
TxCollision: 0
TxSingleCol: 0
TxMultiCol : 0
TxDefer    : 0
TxLateCol  : 0
TxExcCol   : 0
TxPause    : 0
Tx64Byte   : 757
Tx65Byte   : 1166
Tx128Byte  : 149
Tx256Byte  : 96
Tx512Byte  : 157
Tx1024Byte : 0
TxByte     : 297785
RxDrop     : 0
RxFiltered : 1
RxUni      : 1532
RxMulti    : 204
RxBroad    : 0
RxAlignErr : 0
RxCRC      : 0
RxUnderSize: 0
RxFragment : 0
RxOverSize : 0
RxJabber   : 0
RxPause    : 0
Rx64Byte   : 708
Rx65Byte   : 514
Rx128Byte  : 19
Rx256Byte  : 233
Rx512Byte  : 60
Rx1024Byte : 202
RxByte     : 488761
RxCtrlDrop : 0
RxIngDrop  : 0
RxARLDrop  : 0

pvid: 1
link: port:6 link:up speed:1000baseT full-duplex
Port 7:
mib: Port 7 MIB counters
TxDrop     : 0
TxCRC      : 0
TxUni      : 0
TxMulti    : 0
TxBroad    : 0
TxCollision: 0
TxSingleCol: 0
TxMultiCol : 0
TxDefer    : 0
TxLateCol  : 0
TxExcCol   : 0
TxPause    : 0
Tx64Byte   : 0
Tx65Byte   : 0
Tx128Byte  : 0
Tx256Byte  : 0
Tx512Byte  : 0
Tx1024Byte : 0
TxByte     : 0
RxDrop     : 0
RxFiltered : 0
RxUni      : 0
RxMulti    : 0
RxBroad    : 0
RxAlignErr : 0
RxCRC      : 0
RxUnderSize: 0
RxFragment : 0
RxOverSize : 0
RxJabber   : 0
RxPause    : 0
Rx64Byte   : 0
Rx65Byte   : 0
Rx128Byte  : 0
Rx256Byte  : 0
Rx512Byte  : 0
Rx1024Byte : 0
RxByte     : 0
RxCtrlDrop : 0
RxIngDrop  : 0
RxARLDrop  : 0

pvid: 0
link: port:7 link:down
VLAN 1:
ports: 1 2 3 4 6 7
VLAN 2:
ports: 0 5

bootlog


===================================================================
MT7621   stage1 code 10:33:11 (ASIC)
CPU=50000000 HZ BUS=16666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL2 FB_DL: 0xa, 1/0 = 564/460 29000000
PLL3 FB_DL: 0x11, 1/0 = 513/511 45000000
PLL4 FB_DL: 0x15, 1/0 = 609/415 55000000
do DDR setting..[00320381]
Apply DDR3 Setting...(use customer AC)
0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
--------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    1
000E:|    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1    1
000F:|    0    0    0    0    1    1    1    1    1    1    1    1    1    1    0    0
0010:|    1    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0
0011:|    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
rank 0 coarse = 15
rank 0 fine = 72
B:|    0    0    0    0    0    0    0    1    1    1    0    0    0    0    0    0
opt_dle value:8
DRAMC_R0DELDLY[018]=00001E20
==================================================================
RX      DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    9 9 9 11 7 9 8 7 7 8
10 |    8 9 9 9 8 8
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =32 DQS1 = 30
==================================================================
bit     DQS0     bit      DQS1
0  (1~62)31  8  (1~58)29
1  (1~60)30  9  (1~58)29
2  (0~58)29  10  (1~58)29
3  (1~60)30  11  (1~57)29
4  (0~60)30  12  (1~60)30
5  (1~62)31  13  (1~58)29
6  (1~60)30  14  (1~60)30
7  (1~63)32  15  (1~60)30
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    10 11 12 13 9 10 10 7 8 9
10 |    9 10 9 10 8 8
==================================================================
==================================================================
TX  perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2
DQ loop=15, cmp_err_1 = ffff0080
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=1
DQ loop=14, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=14,  finish count=2
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
20,data:88
[EMI] DRAMC calibration passed

===================================================================
MT7621   stage1 code done
CPU=50000000 HZ BUS=16666666 HZ
===================================================================

U-Boot 1.1.3 (Dec  9 2016 - 10:20:35)

Board: Ralink APSoC DRAM:  128 MB
relocate_code Pointer at: 87fac000

Config XHCI 40M PLL
Allocate 16 byte aligned buffer: 87fdf010
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [C2 F1 80 95 02]
Device found in MTK table, ID: c2f1, EXT_ID: 809502
Support this Device in MTK table! c2f1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
....============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Dec  9 2016  Time:10:20:35
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

##### The CPU freq = 880 MHZ ####
estimate memory size =128 Mbytes
#Reset_MT7530
set LAN/WAN WLLLL
.## Starting application at 0x81E00000 ...

Z-LOADER V1.24 | 12/09/2016 10:20:37

..
Checking image 1...
Image Name:   3.10(XID.0)b19
Image Type:   MIPS Linux Kernel Image (lzma compressed)
Data Size:    1611586 Bytes =  1.5 MB
Load Address: 80001000
Entry Point:  80001000
.........................   Verifying Combo Checksum ... ............................................................................................................................................................## Booting image at bc400000 ...
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80001000) ...
## Giving linux memsize in MB, 128

Starting kernel ...

LINUX started...

THIS IS ASIC

SDK 5.0.S.0
[    0.000000] Linux version 3.10.14 (*******@*******-PC-*******-******) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #1 SMP Thu Sep 3 17:22:37 CST 2020
[    0.000000]
[    0.000000]  The CPU feqenuce set to 880 MHz
[    0.000000] GCMP present
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] Software DMA cache coherency
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x07ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x07ffffff]
[    0.000000] Detected 3 available secondary CPU(s)
[    0.000000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] PERCPU: Embedded 7 pages/cpu @81103000 s6464 r8192 d14016 u32768
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS1,57600n8 BootImage=1 root=/dev/mtdblock5 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00004080
[    0.000000] Readback ErrCtl register=00004080
[    0.000000] Memory: 124944k/131072k available (3551k kernel code, 6128k reserved, 861k data, 252k init, 0k highmem)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:128
[    0.000000] console [ttyS1] enabled
[    0.116000] Calibrating delay loop... 562.17 BogoMIPS (lpj=1124352)
[    0.148000] pid_max: default: 32768 minimum: 301
[    0.152000] Mount-cache hash table entries: 512
[    0.156000] launch: starting cpu1
[    0.160000] launch: cpu1 gone!
[    0.160000] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.160000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.160000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.160000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.192000] Synchronize counters for CPU 1: done.
[    0.200000] launch: starting cpu2
[    0.204000] launch: cpu2 gone!
[    0.204000] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.204000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.204000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.204000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.232000] Synchronize counters for CPU 2: done.
[    0.240000] launch: starting cpu3
[    0.244000] launch: cpu3 gone!
[    0.244000] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.244000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.244000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.244000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.272000] Synchronize counters for CPU 3: done.
[    0.280000] Brought up 4 CPUs
[    0.284000] NET: Registered protocol family 16
[    0.576000] release PCIe RST: RALINK_RSTCTRL = 7000000
[    0.580000] PCIE PHY initialize
[    0.584000] ***** Xtal 40MHz *****
[    0.588000] start MT7621 PCIe register access
[    1.164000] RALINK_RSTCTRL = 7000000
[    1.168000] RALINK_CLKCFG1 = 77ffeff8
[    1.172000]
[    1.172000] *************** MT7621 PCIe RC mode *************
[    1.652000] PCIE2 no card, disable it(RST&CLK)
[    1.656000] pcie_link status = 0x3
[    1.660000] RALINK_RSTCTRL= 3000000
[    1.664000] *** Configure Device number setting of Virtual PCI-PCI bridge ***
[    1.668000] RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2
[    1.672000] PCIE0 enabled
[    1.676000] PCIE1 enabled
[    1.680000] interrupt enable status: 300000
[    1.684000] Port 1 N_FTS = 1b105000
[    1.688000] Port 0 N_FTS = 1b105000
[    1.692000] config reg done
[    1.696000] init_rt2880pci done
[    1.716000] bio: create slab  at 0
[    1.720000] SCSI subsystem initialized
[    1.724000] usbcore: registered new interface driver usbfs
[    1.728000] usbcore: registered new interface driver hub
[    1.732000] usbcore: registered new device driver usb
[    1.736000] PCI host bridge to bus 0000:00
[    1.740000] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    1.744000] pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
[    1.748000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.752000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.756000] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.760000] pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
[    1.764000] pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000)
[    1.768000] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    1.772000] pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff]
[    1.776000] pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff]
[    1.780000] pci 0000:00:01.0: BAR 1: assigned [mem 0x60210000-0x6021ffff]
[    1.784000] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff]
[    1.788000] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.792000] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    1.796000] pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff 64bit]
[    1.800000] pci 0000:00:01.0: PCI bridge to [bus 02]
[    1.804000] pci 0000:00:01.0:   bridge window [mem 0x60100000-0x601fffff]
[    1.808000] PCI: Enabling device 0000:00:00.0 (0004 -> 0006)
[    1.812000] PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
[    1.816000] BAR0 at slot 0 = 0
[    1.820000] bus=0x0, slot = 0x0
[    1.824000] res[0]->start = 0
[    1.828000] res[0]->end = 0
[    1.832000] res[1]->start = 60200000
[    1.836000] res[1]->end = 6020ffff
[    1.840000] res[2]->start = 0
[    1.844000] res[2]->end = 0
[    1.848000] res[3]->start = 0
[    1.852000] res[3]->end = 0
[    1.856000] res[4]->start = 0
[    1.860000] res[4]->end = 0
[    1.864000] res[5]->start = 0
[    1.868000] res[5]->end = 0
[    1.872000] BAR0 at slot 1 = 0
[    1.876000] bus=0x0, slot = 0x1
[    1.880000] res[0]->start = 0
[    1.884000] res[0]->end = 0
[    1.888000] res[1]->start = 60210000
[    1.892000] res[1]->end = 6021ffff
[    1.896000] res[2]->start = 0
[    1.900000] res[2]->end = 0
[    1.904000] res[3]->start = 0
[    1.908000] res[3]->end = 0
[    1.912000] res[4]->start = 0
[    1.916000] res[4]->end = 0
[    1.920000] res[5]->start = 0
[    1.924000] res[5]->end = 0
[    1.928000] bus=0x1, slot = 0x0, irq=0x4
[    1.932000] res[0]->start = 60000000
[    1.936000] res[0]->end = 600fffff
[    1.940000] res[1]->start = 0
[    1.944000] res[1]->end = 0
[    1.948000] res[2]->start = 0
[    1.952000] res[2]->end = 0
[    1.956000] res[3]->start = 0
[    1.960000] res[3]->end = 0
[    1.964000] res[4]->start = 0
[    1.968000] res[4]->end = 0
[    1.972000] res[5]->start = 0
[    1.976000] res[5]->end = 0
[    1.980000] bus=0x2, slot = 0x1, irq=0x18
[    1.984000] res[0]->start = 60100000
[    1.988000] res[0]->end = 601fffff
[    1.992000] res[1]->start = 0
[    1.996000] res[1]->end = 0
[    2.000000] res[2]->start = 0
[    2.004000] res[2]->end = 0
[    2.008000] res[3]->start = 0
[    2.012000] res[3]->end = 0
[    2.016000] res[4]->start = 0
[    2.020000] res[4]->end = 0
[    2.024000] res[5]->start = 0
[    2.028000] res[5]->end = 0
[    2.032000] Switching to clocksource MIPS
[    2.036000] NET: Registered protocol family 2
[    2.044000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    2.060000] TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
[    2.072000] TCP: Hash tables configured (established 1024 bind 1024)
[    2.084000] TCP: reno registered
[    2.092000] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    2.104000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    2.116000] NET: Registered protocol family 1
[    2.212000] 4 CPUs re-calibrate udelay(lpj = 1167360)
[    2.224000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.236000] jffs2: version 2.2. (NAND) (SUMMARY)  (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    2.260000] io scheduler noop registered (default)
[    2.268000] reg_int_mask=0, INT_MASK= 0
[    2.276000] HSDMA_init
[    2.280000]
[    2.280000]  hsdma_phy_tx_ring0 = 0x0fd18000, hsdma_tx_ring0 = 0xafd18000
[    2.300000]
[    2.300000]  hsdma_phy_rx_ring0 = 0x0fcf4000, hsdma_rx_ring0 = 0xafcf4000
[    2.316000] TX_CTX_IDX0 = 0
[    2.320000] TX_DTX_IDX0 = 0
[    2.324000] RX_CRX_IDX0 = 3ff
[    2.332000] RX_DRX_IDX0 = 0
[    2.336000] set_fe_HSDMA_glo_cfg
[    2.344000] HSDMA_GLO_CFG = 465
[    2.356000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    2.368000] serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A
[    2.380000] serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A
[    2.396000] Ralink gpio driver initialized
[    2.404000] MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
[    2.416000] Allocate 16 byte aligned buffer: 804a1c20
[    2.428000] Enable NFI Clock
[    2.432000] # MTK NAND # : Use HW ECC
[    2.440000] NAND ID [C2 F1 80 95 02, 00809502]
[    2.448000] Device found in MTK table, ID: c2f1, EXT_ID: 809502
[    2.460000] Support this Device in MTK table! c2f1
[    2.472000] NAND device: Manufacturer ID: 0xc2, Chip ID: 0xf1 (Macronix NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[    2.496000] [NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
[    2.508000] Scanning device for bad blocks
[    2.756000] Signature matched and data read!
[    2.764000] load_fact_bbt success 1023
[    2.772000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    2.792000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    2.808000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    2.828000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    2.848000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    2.868000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    2.888000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    2.908000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[    2.928000] Creating 12 MTD partitions on "MT7621-NAND":
[    2.940000] 0x000000000000-0x000007f80000 : "ALL"
[    2.948000] 0x000000000000-0x000000100000 : "Bootloader"
[    2.960000] 0x000000100000-0x000000200000 : "Ubootenv"
[    2.972000] 0x000000200000-0x000000300000 : "Factory"
[    2.984000] 0x000000400000-0x000003600000 : "firmware"
[    2.996000] 0x000000589782-0x000003600000 : "rootfs"
[    3.008000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    3.040000] 0x000003600000-0x000003700000 : "Config"
[    3.052000] 0x000003700000-0x000006900000 : "firmware_2"
[    3.064000] 0x000006900000-0x000006a00000 : "Config_2"
[    3.072000] 0x000006a00000-0x000006b00000 : "persist"
[    3.084000] 0x000006b00000-0x000006c00000 : "idmkey"
[    3.096000] 0x000006c00000-0x000007f80000 : "Backup"
[    3.108000] 0x000000300000-0x000000400000 : "SecondBoot"
[    3.120000] [mtk_nand] probe successfully!
[    3.128000] rootfs = 589782 to dc0000
[    3.132000] PPP generic driver version 2.4.2
[    3.144000] NET: Registered protocol family 24
[    3.152000] PPTP driver version 0.8.5
[    3.160000] rdm_major = 253
[    3.164000] netif_napi_add() called with weight 128 on device eth0
[    3.176000] GMAC1_MAC_ADRH -- : 0x00005041
[    3.184000] GMAC1_MAC_ADRL -- : 0xb9209990
[    3.196000] Ralink APSoC Ethernet Driver Initilization. v3.1  1024 rx/tx descriptors allocated, mtu = 1500!
[    3.212000] NAPI enable, Tx Ring = 1088, Rx Ring = 1024
[    3.224000] GMAC1_MAC_ADRH -- : 0x00005041
[    3.232000] GMAC1_MAC_ADRL -- : 0xb9209990
[    3.240000] register mt7530
[    3.248000] PROC INIT OK!
[    3.252000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    3.264000] ehci-pci: EHCI PCI platform driver
[    3.272000] *****run project phy.
[    3.288000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.304000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.324000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.344000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.364000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.384000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.400000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.420000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.436000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.452000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.484000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.500000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.516000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.532000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.548000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.564000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.580000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.596000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.612000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.628000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.756000] xhci-hcd xhci-hcd: xHCI Host Controller
[    3.764000] xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 1
[    3.780000] xhci-hcd xhci-hcd: irq 22, io mem 0x1e1c0000
[    3.792000] hub 1-0:1.0: USB hub found
[    3.800000] hub 1-0:1.0: 2 ports detected
[    3.808000] xhci-hcd xhci-hcd: xHCI Host Controller
[    3.816000] xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 2
[    3.832000] hub 2-0:1.0: USB hub found
[    3.840000] hub 2-0:1.0: 1 port detected
[    3.848000] usbcore: registered new interface driver usb-storage
[    3.860000] gre: GRE over IPv4 demultiplexor driver
[    3.868000] TCP: cubic registered
[    3.876000] NET: Registered protocol family 10
[    3.884000] NET: Registered protocol family 17
[    3.896000] Bridge firewalling registered
[    3.904000] 8021q: 802.1Q VLAN Support v1.8
[    3.912000] console [netcon0] enabled
[    3.920000] netconsole: network logging started
[    3.936000] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    3.948000] Freeing unused kernel memory: 252K (80451000 - 80490000)
procd: Console is alive
procd: - preinit -
[    5.368000] 50:41:FFFFFFB9:xx:FFFFFFxx:FFFFFF90
[    5.376000] Raeth v3.1 (NAPI
[    5.384000] )
[    5.388000] set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1
[    5.404000] phy_free_head is 0xf6f6000!!!
[    5.412000] phy_free_tail_phy is 0xf6f7ff0!!!
[    5.420000] txd_pool=af738000 phy_txd_pool=0F738000
[    5.428000] ei_local->skb_free start address is 0x87eea6e0.
[    5.440000] free_txd: 0f738010, ei_local->cpu_ptr: 0F738000
[    5.452000]  POOL  HEAD_PTR | DMA_PTR | CPU_PTR
[    5.460000] ----------------+---------+--------
[    5.468000]      0xaf738000 0x0F738000 0x0F738000
[    5.480000]
[    5.480000] phy_qrx_ring = 0x0f6f5000, qrx_ring = 0xaf6f5000
[    5.496000]
[    5.496000] phy_rx_ring0 = 0x0f748000, rx_ring[0] = 0xaf748000
[    5.532000] MT7530 Reset Completed!!
[    5.544000] change HW-TRAP to 0x117c8f
[    5.552000] set LAN/WAN WLLLL
[    5.564000] GMAC1_MAC_ADRH -- : 0x00005041
[    5.572000] GMAC1_MAC_ADRL -- : 0xb9209990
[    5.580000] GDMA2_MAC_ADRH -- : 0x00005041
[    5.588000] GDMA2_MAC_ADRL -- : 0xb9209992
[    5.596000] eth1: ===> VirtualIF_open
[    5.604000] MT7621 GE2 link rate to 1G
[    5.604000] CDMA_CSG_CFG = 81000000
[    5.604000] GDMA1_FWD_CFG = 20710000
[    5.604000] GDMA2_FWD_CFG = 20710000
[    5.728000] led=9, on=1, off=1, blinks,=1, reset=1, time=4000 low_trigger=1
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    8.832000] led=9, on=1, off=1, blinks,=1, reset=1, time=4000 low_trigger=1
Could not open mtd device: /dev/mtd5
reading ro[    8.944000] ra2880stop()...otfs failed
mouDone
[    8.952000] eth1: ===> VirtualIF_close

[    8.964000] Free TX/RX Ring Memory!
procd: - early -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
[   11.040000] jffs2: notice: (774) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   11.168000] jffs2: notice: (777) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
##### Backup Config. #####
[   12.584000] Initializing XFRM netlink socket
[   12.592000] NET: Registered protocol family 15
[   12.604000] sbdev driver(major: 254) installed.
[   12.612000] wpdev driver(major: 250) installed.
[   12.636000] l2tp_core: L2TP core driver, V2.0
[   12.648000] l2tp_netlink: L2TP netlink interface
[   12.656000] ip_gre: GRE over IPv4 tunneling driver
[   12.676000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   12.688000] Type=Restricted Cone
[   12.696000] nf_conntrack version 0.5.0 (1956 buckets, 7824 max)
[   12.712000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   12.744000] ebt_time: kernel timezone is -0000
[   12.756000] Ebtables v2.0 registered
[   12.768000] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[   12.848000] Netfilter messages via NETLINK v0.30.
[   12.860000] PPP MPPE Compression module registered
[   12.872000] Ralink APSoC Hardware Watchdog Timer
[   12.904000] xt_time: kernel timezone is -0000
[   12.920000] ctnetlink v0.93: registering with nfnetlink.
[   15.804000] mtd: ALL locked
[   15.812000] mtd: Bootloader locked
[   15.816000] mtd: Ubootenv locked
[   15.824000] mtd: Factory locked
[   15.832000] mtd_locked init
[   17.436000] 50:41:FFFFFFB9:xx:FFFFFFxx:FFFFFF90
[   17.444000] Raeth v3.1 (NAPI
[   17.452000] )
[   17.456000] set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1
[   17.472000] phy_free_head is 0xedcc000!!!
[   17.480000] phy_free_tail_phy is 0xedcdff0!!!
[   17.488000] txd_pool=aefb0000 phy_txd_pool=0EFB0000
[   17.500000] ei_local->skb_free start address is 0x87eea6e0.
[   17.512000] free_txd: 0efb0010, ei_local->cpu_ptr: 0EFB0000
[   17.520000]  POOL  HEAD_PTR | DMA_PTR | CPU_PTR
[   17.532000] ----------------+---------+--------
[   17.540000]      0xaefb0000 0x0EFB0000 0x0EFB0000
[   17.548000]
[   17.548000] phy_qrx_ring = 0x0efdf000, qrx_ring = 0xaefdf000
[   17.568000]
[   17.568000] phy_rx_ring0 = 0x0efe8000, rx_ring[0] = 0xaefe8000
[   17.608000] MT7530 Reset Completed!!
[   17.624000] change HW-TRAP to 0x117c8f
[   17.632000] set LAN/WAN WLLLL
[   17.644000] GMAC1_MAC_ADRH -- : 0x00005041
[   17.652000] GMAC1_MAC_ADRL -- : 0xb9209990
[   17.660000] eth1: ===> VirtualIF_open
[   17.668000] MT7621 GE2 link rate to 1G
[   17.668000] CDMA_CSG_CFG = 81000000
[   17.668000] GDMA1_FWD_CFG = 20710000
[   17.668000] GDMA2_FWD_CFG = 20710000
[   17.668000] device eth0 entered promiscuous mode
[   17.668000] br-lan: port 1(eth0) entered forwarding state
[   17.668000] br-lan: port 1(eth0) entered forwarding state
[   17.668000] eth1: ===> VirtualIF_open
[   19.672000] br-lan: port 1(eth0) entered forwarding state
[   22.216000] register rlt_drv
[   22.224000]
[   22.224000]
[   22.224000] === pAd = c1581000, size = 1244888 ===
[   22.224000]
[   22.244000] <-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
[   22.256000] <-- RTMPAllocAdapterBlock, Status=0
[   22.268000] pAd->CSRBaseAddress =0xc1480000, csr_addr=0xc1480000!
[   22.280000] device_id =0x7603
[   22.284000] RtmpChipOpsHook(507): Not support for HIF_MT yet!
[   22.296000] mt7603_init()-->
[   22.300000] mt_bcn_buf_init(224): Not support for HIF_MT yet!
[   22.312000] <--mt7603_init()
[   22.328000] TX_BCN DESC aefd4000 size = 320
[   22.336000] RX[0] DESC aecf6000 size = 2048
[   22.348000] RX[1] DESC aecf7000 size = 2048
[   22.360000] RT_CfgSetMacAddress : invalid length (0)
[   22.372000] E2pAccessMode=2
[   22.380000] cfg_mode=9
[   22.384000] cfg_mode=9
[   22.388000] wmode_band_equal(): Band Equal!
[   22.400000] APSDCapable[0]=1
[   22.404000] APSDCapable[1]=1
[   22.412000] APSDCapable[2]=1
[   22.416000] APSDCapable[3]=1
[   22.420000] APSDCapable[4]=1
[   22.428000] APSDCapable[5]=1
[   22.432000] APSDCapable[6]=1
[   22.440000] APSDCapable[7]=1
[   22.444000] APSDCapable[8]=1
[   22.452000] APSDCapable[9]=1
[   22.456000] APSDCapable[10]=1
[   22.464000] APSDCapable[11]=1
[   22.468000] APSDCapable[12]=1
[   22.476000] APSDCapable[13]=1
[   22.480000] APSDCapable[14]=1
[   22.488000] APSDCapable[15]=1
[   22.492000] default ApCliAPSDCapable[0]=1
[   22.976000] Key1Str is Invalid key length(0) or Type(0)
[   22.984000] Key1Str is Invalid key length(0) or Type(0)
[   22.996000] Key1Str is Invalid key length(0) or Type(0)
[   23.004000] Key1Str is Invalid key length(0) or Type(0)
[   23.016000] Key2Str is Invalid key length(0) or Type(0)
[   23.028000] Key2Str is Invalid key length(0) or Type(0)
[   23.036000] Key2Str is Invalid key length(0) or Type(0)
[   23.048000] Key2Str is Invalid key length(0) or Type(0)
[   23.060000] Key3Str is Invalid key length(0) or Type(0)
[   23.068000] Key3Str is Invalid key length(0) or Type(0)
[   23.080000] Key3Str is Invalid key length(0) or Type(0)
[   23.092000] Key3Str is Invalid key length(0) or Type(0)
[   23.100000] Key4Str is Invalid key length(0) or Type(0)
[   23.112000] Key4Str is Invalid key length(0) or Type(0)
[   23.124000] Key4Str is Invalid key length(0) or Type(0)
[   23.132000] Key4Str is Invalid key length(0) or Type(0)
[   23.176000] [PMF]Set_PMFMFPC_Proc:: apidx=0, Desired MFPC=0
[   23.188000] [PMF]Set_PMFMFPC_Proc:: apidx=1, Desired MFPC=0
[   23.200000] [PMF]Set_PMFMFPC_Proc:: apidx=2, Desired MFPC=0
[   23.208000] [PMF]Set_PMFMFPC_Proc:: apidx=3, Desired MFPC=0
[   23.220000] [PMF]Set_PMFMFPR_Proc:: apidx=0, Desired MFPR=0
[   23.232000] [PMF]Set_PMFMFPR_Proc:: apidx=1, Desired MFPR=0
[   23.244000] [PMF]Set_PMFMFPR_Proc:: apidx=2, Desired MFPR=0
[   23.256000] [PMF]Set_PMFMFPR_Proc:: apidx=3, Desired MFPR=0
[   23.264000] [PMF]Set_PMFSHA256_Proc:: apidx=0, Desired PMFSHA256=0
[   23.276000] [PMF]Set_PMFSHA256_Proc:: apidx=1, Desired PMFSHA256=0
[   23.292000] [PMF]Set_PMFSHA256_Proc:: apidx=2, Desired PMFSHA256=0
[   23.304000] [PMF]Set_PMFSHA256_Proc:: apidx=3, Desired PMFSHA256=0
[   23.316000] FW Version:tssi_1222
[   23.324000] FW Build Date:20151222134859
[   23.332000] CmdAddressLenReq:(ret = 0)
[   23.340000] CmdFwStartReq: override = 1, address = 1048576
[   23.352000] CmdStartDLRsp: WiFI FW Download Success
[   23.368000] AsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
[   23.380000] efuse_probe: efuse = 10000002
[   23.388000] RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5
[   23.400000] RtmpEepromGetDefault::e2p_dafault=1
[   23.408000] RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1
[   23.424000] NVM is FLASH mode, flash_offset = 0x40000
[   23.436000] 1. Phy Mode = 14
[   23.440000] @@@  NICReadEEPROMParameters : pAd->FWLoad=0
[   23.600000] Country Region from e2p = ffff
[   23.608000] tssi_1_target_pwr_g_band = 32
[   23.616000] 2. Phy Mode = 14
[   23.624000] 3. Phy Mode = 14
[   23.628000] NICInitPwrPinCfg(14): Not support for HIF_MT yet!
[   23.640000] NICInitializeAsic(584): Not support rtmp_mac_sys_reset () for HIF_MT yet!
[   23.656000] mt_mac_init()-->
[   23.664000] mt7603_init_mac_cr()-->
[   23.672000] AsicSetMacMaxLen(1814): Set the Max RxPktLen=1024!
[   23.684000] <--mt_mac_init()
start daemon
[   23.688000]  WTBL Segment 1 info:
[   23.696000]          MemBaseAddr/FID:0x28000/0
[   23.704000]          EntrySize/Cnt:32/128
[   23.712000]  WTBL Segment 2 info:
[   23.720000]          MemBaseAddr/FID:0x40000/0
[   23.728000]          EntrySize/Cnt:64/128
[   23.732000]  WTBL Segment 3 info:
[   23.740000]          MemBaseAddr/FID:0x42000/64
[   23.748000]          EntrySize/Cnt:64/128
[   23.756000]  WTBL Segment 4 info:
[   23.760000]          MemBaseAddr/FID:0x44000/128
[   23.768000]          EntrySize/Cnt:32/128
[   23.776000] MtAsicACQueue: Write CR:21510, Value=10421
[   23.784000] MtAsicACQueue: Write CR:21500, Value=10421
[   23.796000] AntCfgInit(2558): Not support for HIF_MT yet!
[   23.808000] RTMPSetPhyMode(): channel out of range, use first ch=0
[   23.820000] MCS Set = ff ff 00 00 01
[   24.144000] led=8, on=0, off=4000, blinks,=0, reset=0, time=1 low_trigger=1
[   24.220000] led=8, on=0, off=4000, blinks,=0, reset=0, time=1 low_trigger=0
[   24.292000] led=8, on=0, off=4000, blinks,=0, reset=0, time=1 low_trigger=1
[   27.456000] [PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0
[   27.468000] [PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
[   27.480000] [PMF]ap_pmf_init:: apidx=1, MFPC=0, MFPR=0, SHA256=0
[   27.492000] [PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
[   27.504000] [PMF]ap_pmf_init:: apidx=2, MFPC=0, MFPR=0, SHA256=0
[   27.516000] [PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
[   27.528000] [PMF]ap_pmf_init:: apidx=3, MFPC=0, MFPR=0, SHA256=0
[   27.540000] [PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
[   27.552000] AsicSetRalinkBurstMode(4127): Not support for HIF_MT yet!
[   27.564000] RTMPSetPiggyBack(876): Not support for HIF_MT yet!
[   27.596000] AsicSetTxPreamble(4114): Not support for HIF_MT yet!
[   27.608000] AsicAddSharedKeyEntry(1980): Not support for HIF_MT yet!
[   27.624000] AsicAddSharedKeyEntry(1980): Not support for HIF_MT yet!
[   27.640000] AsicAddSharedKeyEntry(1980): Not support for HIF_MT yet!
[   27.652000] AsicAddSharedKeyEntry(1980): Not support for HIF_MT yet!
[   27.668000] AsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xa0
[   27.676000] Main bssid = 50:41:b9:xx:xx:90
[   27.688000] <==== rt28xx_init, Status=0
[   27.700000] first MBSSID is 50 41 b9 xx xx 90
[   27.708000] first MBSSID is 50 41 b9 xx xx 90
[   27.720000] first MBSSID is 50 41 b9 xx xx 90
[   27.728000] first MBSSID is 50 41 b9 xx xx 90
[   27.736000] first MBSSID is 50 41 b9 xx xx 90
[   27.744000] @@@ ed_monitor_exit : ===>
[   27.752000] @@@ ed_monitor_exit : <===
[   27.760000] mt7603_set_ed_cca: TURN OFF EDCCA  mac 0x10618 = 0xd7083f0f
[   27.772000] mt7603_set_ed_cca: pAd->CommonCfg.CountryCode = JP
[   27.784000] mt7603_set_ed_cca: TURN OFF NBID mac 0x10610 = 0x36a1282a
[   27.796000] WiFi Startup Cost (ra0): 5.468s
[   28.284000] device ra0 entered promiscuous mode
[   28.292000] br-lan: port 2(ra0) entered forwarding state
[   28.304000] br-lan: port 2(ra0) entered forwarding state
[   30.308000] br-lan: port 2(ra0) entered forwarding state
[   31.568000] register mt_drv
[   31.584000]
[   31.584000]
[   31.584000] === pAd = c3a81000, size = 3623712 ===
[   31.584000]
[   31.604000] <-- RTMPAllocAdapterBlock, Status=0
[   31.616000] pAd->PciHif.CSRBaseAddress =0xc3980000, csr_addr=0xc3980000!
[   31.628000] RTMPInitPCIeDevice():device_id=0x7615
[   31.636000] DriverOwn()::Try to Clear FW Own...
[   31.956000] DriverOwn()::Success to clear FW Own
[   31.968000] mt_pci_chip_cfg(): HWVer=0x8a10, FWVer=0x8a10, pAd->ChipID=0x7615
[   31.980000] mt_pci_chip_cfg(): HIF_SYS_REV=0x76150001
[   31.992000] RtmpChipOpsHook(492): Not support for HIF_MT yet! MACVersion=0x0
[   32.004000] mt7615_init()-->
[   32.012000] Use 1st ePAeLNA default bin.
[   32.020000] <--mt7615_init()
[   32.024000] ChipOpsMCUHook
[   32.036000] cut_through_token_list_init(): TokenList inited done!id_head/tail=0/4096
[   32.052000] cut_through_token_list_init(): 84eaed08,84eaed08
[   32.064000] cut_through_token_list_init(): TokenList inited done!id_head/tail=0/4096
[   32.080000] cut_through_token_list_init(): 84eaed18,84eaed18
[   32.092000] <-- RTMPAllocTxRxRingMemory, Status=0
[   32.116000] DriverOwn()::Return since already in Driver Own...
[   32.132000] RT_CfgSetMacAddress : invalid length (0)
[   32.144000] RT_CfgSetMacAddress : invalid length (0)
[   32.152000] RT_CfgSetMacAddress : invalid length (0)
[   32.164000] RT_CfgSetMacAddress : invalid length (0)
[   32.172000] E2pAccessMode=2
[   32.180000] SSID[0]=IODATA-209990-5G, EdcaIdx=0
[   32.188000] SSID[1]=IO-Guest-209990-5G, EdcaIdx=0
[   32.200000] RTMPSetProfileParameters(): DBDC Mode=0
[   32.208000] cfg_mode=14
[   32.216000] cfg_mode=14
[   32.220000] wmode_band_equal(): Band Equal!
[   32.228000] APEdca0
[   32.232000] APEdca1
[   32.236000] APEdca2
[   32.244000] APEdca3
[   32.248000] APSDCapable[0]=1
[   32.252000] APSDCapable[1]=1
[   32.260000] APSDCapable[2]=1
[   32.264000] APSDCapable[3]=1
[   32.272000] APSDCapable[4]=1
[   32.276000] APSDCapable[5]=1
[   32.284000] APSDCapable[6]=1
[   32.288000] APSDCapable[7]=1
[   32.296000] APSDCapable[8]=1
[   32.300000] APSDCapable[9]=1
[   32.308000] APSDCapable[10]=1
[   32.312000] APSDCapable[11]=1
[   32.320000] APSDCapable[12]=1
[   32.324000] APSDCapable[13]=1
[   32.332000] APSDCapable[14]=1
[   32.336000] APSDCapable[15]=1
[   32.340000] default ApCliAPSDCapable[0]=1
[   32.348000] default ApCliAPSDCapable[1]=1
[   32.360000] DfsZeroWait Support=0/0
[   32.384000] [PMF]Set_PMFMFPC_Proc:: apidx=0, Desired MFPC=0
[   32.396000] [PMF]Set_PMFMFPC_Proc:: apidx=1, Desired MFPC=0
[   32.404000] [PMF]Set_PMFMFPC_Proc:: apidx=2, Desired MFPC=0
[   32.416000] [PMF]Set_PMFMFPC_Proc:: apidx=3, Desired MFPC=0
[   32.428000] [PMF]Set_PMFMFPR_Proc:: apidx=0, Desired MFPR=0
[   32.440000] [PMF]Set_PMFMFPR_Proc:: apidx=1, Desired MFPR=0
[   32.452000] [PMF]Set_PMFMFPR_Proc:: apidx=2, Desired MFPR=0
[   32.460000] [PMF]Set_PMFMFPR_Proc:: apidx=3, Desired MFPR=0
[   32.472000] [PMF]Set_PMFSHA256_Proc:: apidx=0, Desired PMFSHA256=0
[   32.484000] [PMF]Set_PMFSHA256_Proc:: apidx=1, Desired PMFSHA256=0
[   32.496000] [PMF]Set_PMFSHA256_Proc:: apidx=2, Desired PMFSHA256=0
[   32.512000] [PMF]Set_PMFSHA256_Proc:: apidx=3, Desired PMFSHA256=0
[   32.532000] HT: Ext Channel = BELOW
[   32.564000] WtcSetMaxStaNum: MaxStaNum:88, BssidNum:4, WdsNum:0, ApcliNum:2, MaxNumChipRept:32, MinMcastWcid:122
[   32.584000] Top Init Done!
[   32.592000] Use alloc_skb
[   32.596000] RX[0] DESC acdb4000 size = 8192
[   32.608000] RX[1] DESC acdb6000 size = 8192
[   32.616000] Hif Init Done!
[   32.624000] ctl->txq = c3df1a60
[   32.628000] ctl->rxq = c3df1a6c
[   32.636000] ctl->ackq = c3df1a78
[   32.640000] ctl->kickq = c3df1a84
[   32.648000] ctl->tx_doneq = c3df1a90
[   32.656000] ctl->rx_doneq = c3df1a9c
[   32.664000] mt7615_fw_prepare():FW(8a10), HW(8a10), CHIPID(7615))
[   32.676000] mt7615_fw_prepare(2629): MT7615_E3, USE E3 patch and ram code binary image
[   32.692000] AndesMTLoadRomMethodFwDlRing(1035), cap->rom_patch_len(10206)
[   32.704000] AndesRestartCheck: Current TOP_MISC2(0x1)
[   32.716000] AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
[   32.728000] 20161013140927a
[   32.736000]
[   32.740000] platform =
[   32.744000] ALPS
[   32.748000] hw/sw version =
[   32.752000] 8a108a10
[   32.756000] patch version =
[   32.764000] 00000010
[   32.768000] Patch SEM Status=2
[   32.772000] MtCmdPatchSemGet:(ret = 0)
[   32.780000]
[   32.780000] Patch is not ready && get semaphore success, SemStatus(2)
[   32.796000] EventGenericEventHandler: CMD Success
[   32.808000] MtCmdAddressLenReq:(ret = 0)
[   32.816000] MtCmdPatchFinishReq
[   32.832000] EventGenericEventHandler: CMD Success
[   32.840000] Send checksum req..
[   32.848000] Patch SEM Status=3
[   32.856000] MtCmdPatchSemGet:(ret = 0)
[   32.860000]
[   32.860000] Release patch semaphore, SemStatus(3)
[   32.876000] AndesMTEraseRomPatch
[   32.880000] WfMcuHwInit: Before NICLoadFirmware, check IcapMode=0
[   32.892000] AndesMTLoadFwMethodFwDlRing(809), cap->fw_len(456424)
[   32.904000] Build Date:_201610141152
[   32.912000] Build Date:_201610141152
[   32.920000] AndesRestartCheck: Current TOP_MISC2(0x1)
[   32.928000] AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
[   32.944000] EventGenericEventHandler: CMD Success
[   32.952000] MtCmdAddressLenReq:(ret = 0)
[   32.968000] EventGenericEventHandler: CMD Success
[   32.976000] MtCmdAddressLenReq:(ret = 0)
[   32.984000] MtCmdFwStartReq: override = 1, address = 540672
[   32.996000] EventGenericEventHandler: CMD Success
[   33.004000] Build Date:_201609191315
[   33.012000] EventGenericEventHandler: CMD Success
[   33.020000] MtCmdAddressLenReq:(ret = 0)
[   33.032000] MtCmdFwStartReq: override = 4, address = 0
[   33.108000] EventGenericEventHandler: CMD Success
[   33.148000] WfMcuHwInit: NICLoadFirmware OK, Check IcapMode=0
[   33.156000] MCU Init Done!
[   33.164000] efuse_probe: efuse = 10000212
[   33.172000] RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5
[   33.180000] RtmpEepromGetDefault::e2p_dafault=1
[   33.192000] RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1
[   33.208000] NVM is FLASH mode. dev_idx [1] FLASH OFFSET [0x8000]
[   33.228000] NICReadEEPROMParameters: EEPROM 0x52 b307
[   33.244000] MtCmdSetTxLpfCal:(ret = 0)
[   33.252000] MtCmdSetTxIqCal:(ret = 0)
[   33.260000] MtCmdSetTxDcCal:(ret = 0)
[   33.264000] MtCmdSetRxFiCal:(ret = 0)
[   33.272000] MtCmdSetRxFdCal:(ret = 0)
[   33.280000] MtCmdSetRxFdCal:(ret = 0)
[   33.288000] MtCmdSetRxFdCal:(ret = 0)
[   33.296000] MtCmdSetRxFdCal:(ret = 0)
[   33.304000] MtCmdSetRxFdCal:(ret = 0)
[   33.308000] MtCmdSetRxFdCal:(ret = 0)
[   33.316000] MtCmdSetRxFdCal:(ret = 0)
[   33.324000] MtCmdSetRxFdCal:(ret = 0)
[   33.332000] MtCmdSetRxFdCal:(ret = 0)
[   33.340000] NICReadEEPROMParameters: EEPROM 0x52 b307
[   33.904000] Country Region from e2p = 101
[   33.912000] mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4
[   33.924000] rtmp_read_txpwr_from_eeprom(233): Don't Support this now!
[   33.936000] RTMPReadTxPwrPerRate(1381): Don't Support this now!
[   33.948000] RcRadioInit(): DbdcMode=0, ConcurrentBand=1
[   33.960000] RcRadioInit(): pRadioCtrl=84eaf440,Band=0,rfcap=3,channel=1,PhyMode=2
[   33.972000] MtCmdSetDbdcCtrl:(ret = 0)
[   33.980000] Band Rf: 1, Phy Mode: 2
[   33.988000] AntCfgInit(2637): Not support for HIF_MT yet!
[   34.000000] MtSingleSkuLoadParam: RF_LOCKDOWN Feature OFF !!!
[   34.012000] MtBfBackOffLoadTable: RF_LOCKDOWN Feature OFF !!!
[   34.024000] EEPROM Init Done!
[   34.028000] mt_mac_init()-->
[   34.036000] mt_mac_pse_init(2715): Don't Support this now!
[   34.044000] mt7615_init_mac_cr()-->
[   34.052000] mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c
[   34.064000] mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c
[   34.072000] MtAsicSetMacMaxLen(1288): Not finish Yet!
[   34.084000] <--mt_mac_init()
[   34.092000] CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0
[   34.108000] CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0
[   34.120000] CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0
[   34.132000] MAC Init Done!
[   34.136000] MT7615BBPInit():BBP Initialization.....
[   34.148000]  Band 0: valid=1, isDBDC=0, Band=2, CBW=1, CentCh/PrimCh=1/1, prim_ch_idx=0, txStream=2
[   34.164000]  Band 1: valid=0, isDBDC=0, Band=0, CBW=0, CentCh/PrimCh=0/0, prim_ch_idx=0, txStream=0
[   34.184000] MT7615BBPInit() todo
[   34.192000] PHY Init Done!
[   34.196000] tx_pwr_comp_init():NotSupportYet!
[   34.208000] MtCmdSetMacTxRx:(ret = 0)
[   34.212000] CountryCode(2.4G/5G)=1/1, RFIC=25, PHY mode(2.4G/5G)=49/49, support 19 channels
[   34.232000] ApAutoChannelAtBootUp----------------->
[   34.240000] MtCmdSetMacTxRx:(ret = 0)
[   34.248000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900]
[   34.268000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   34.276000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98]
[   34.296000] MtCmdGetTXDPDCalResult:(ret = 0)
[   34.304000] MtCmdChannelSwitch: control_chl = 36,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0
[   34.320000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
[   34.580000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900]
[   34.596000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   34.604000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98]
[   34.624000] MtCmdGetTXDPDCalResult:(ret = 0)
[   34.632000] MtCmdChannelSwitch: control_chl = 40,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0
[   34.652000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
[   34.912000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900]
[   34.928000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   34.936000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98]
[   34.956000] MtCmdGetTXDPDCalResult:(ret = 0)
[   34.964000] MtCmdChannelSwitch: control_chl = 44,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0
[   34.984000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
[   35.240000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900]
[   35.256000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   35.264000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98]
[   35.284000] MtCmdGetTXDPDCalResult:(ret = 0)
[   35.292000] MtCmdChannelSwitch: control_chl = 48,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0
[   35.312000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
[   35.572000] ====================================================================
[   35.584000] Channel  36 : Busy Time =    810, Skip Channel = FALSE, BwCap = TRUE
[   35.600000] Channel  40 : Busy Time =    984, Skip Channel = FALSE, BwCap = TRUE
[   35.616000] Channel  44 : Busy Time =   1120, Skip Channel = FALSE, BwCap = TRUE
[   35.628000] Channel  48 : Busy Time =    698, Skip Channel = FALSE, BwCap = TRUE
[   35.644000] ====================================================================
[   35.660000] Rule 3 Channel Busy time value : Select Primary Channel 48
[   35.672000] Rule 3 Channel Busy time value : Min Channel Busy = 1120
[   35.684000] Rule 3 Channel Busy time value : BW = 80
[   35.696000]  AutoChSelUpdateChannel(): Update channel for wdev0 for this band PhyMode = 49,Channel = 48
[   35.716000]  AutoChSelUpdateChannel(): Update channel for wdev1 for this band PhyMode = 49,Channel = 48
[   35.736000]  AutoChSelUpdateChannel(): Update channel for wdev2 for this band PhyMode = 49,Channel = 48
[   35.756000]  AutoChSelUpdateChannel(): Update channel for wdev3 for this band PhyMode = 49,Channel = 48
[   35.776000] ApAutoChannelAtBootUp<-----------------
[   35.784000] WifiSysOpen(), wdev idx = 0
[   35.792000] wdev_attr_update(): wdevId0 = 50:41:b9:xx:xx:91
[   35.804000] MtCmdSetDbdcCtrl:(ret = 0)
[   35.812000] Current Channel is 48. DfsZeroWaitSupport=0
[   35.824000] MtAsicSetChBusyStat(840): Not support for HIF_MT yet!
[   35.836000] [PMF]APPMFInit:: apidx=0, MFPC=0, MFPR=0, SHA256=0
[   35.848000] [PMF]WPAMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
[   35.860000] HcUpdatePhyMode(): Update PhyMode for all wdev for this band PhyMode:49,Channel=48
[   35.876000] CountryCode(2.4G/5G)=1/1, RFIC=25, PHY mode(2.4G/5G)=49/49, support 19 channels
[   35.892000] wtc_acquire_groupkey_wcid: Found a non-occupied wtbl_idx:127 for WDEV_TYPE:1
[   35.892000]  LinkToOmacIdx = 0, LinkToWdevType = 1
[   35.924000] bssUpdateBmcMngRate (BSS_INFO_BROADCAST_INFO),                 CmdBssInfoBmcRate.u2BcTransmit= 8192,                 CmdBssInfoBmcRate.u2McTransmit = 8192
[   35.952000] LeadTimeForBcn, OmacIdx = 0, WDEV_WITH_BCN_ABILITY
[   36.056000] [RadarStateCheck]Set into RD_NORMAL_MODE
[   36.064000] MtCmdTxPowerSKUCtrl: fgTxPowerSKUEn = 1
[   36.076000] MtCmdTxPowerPercentCtrl: fgTxPowerPercentEn = 1
[   36.088000] MtCmdTxBfBackoffCtrl: fgTxBFBackoffEn = 0
[   36.096000] mt7615_bbp_adjust():rf_bw=2, ext_ch=3, PrimCh=48, HT-CentCh=46, VHT-CentCh=42
[   36.112000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900]
[   36.132000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   36.140000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98]
[   36.160000] MtCmdGetTXDPDCalResult:(ret = 0)
[   36.168000] MtCmdChannelSwitch: control_chl = 48,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0
[   36.188000] BW = 2,TXStream = 4, RXStream = 4, scan(0)
[   36.292000] ap_phy_rrm_init_byRf(): AP Set CentralFreq at 42(Prim=48, HT-CentCh=46, VHT-CentCh=42, BBP_BW=2)
[   36.332000] [WrapDfsRadarDetectStart]: Band0Ch is 48[WrapDfsRadarDetectStart]: Band1Ch is 0MtAsicSetRalinkBurstMode(2593): Not support for HIF_MT yet!
[   36.360000] MtAsicSetPiggyBack(777): Not support for HIF_MT yet!
[   36.372000] MtAsicSetTxPreamble(2572): Not support for HIF_MT yet!
[   36.384000] Main bssid = 50:41:b9:xx:xx:91
[   36.392000] AsicRadioOnOffCtrl(): DbdcIdx=0 RadioOn
[   36.400000] MtCmdSetMacTxRx:(ret = 0)
[   36.408000] MCS Set = ff ff ff ff 01
[   36.416000] <==== mt_wifi_init, Status=0
[   36.424000] MtCmdEDCCACtrl: BandIdx: 0, EDCCACtrl: 1
[   36.436000] MtCmdEDCCACtrl: BandIdx: 1, EDCCACtrl: 1
[   36.452000] WtcSetMaxStaNum: MaxStaNum:88, BssidNum:4, WdsNum:0, ApcliNum:2, MaxNumChipRept:32, MinMcastWcid:122
[   36.512000] red_is_enabled: set CR4/N9 RED Enable to 1.
[   36.524000] cp_support_is_enabled: set CR4 CP_SUPPORT to Mode 2.
[   36.536000] Correct apidx from 3 to 0 for WscUUIDInit
[   36.544000] Generate UUID for apidx(0)
[   36.552000] first MBSSID is 50 41 b9 xx xx 90
[   36.560000] UUID: c3ab3540, len = 16
[   36.568000] 0x0000 : bc 32 9e 00 1d d8 11 b2 86 01 50 41 b9 xx xx 90
[   36.580000]
[   36.976000] device rai0 entered promiscuous mode
[   36.984000] br-lan: port 3(rai0) entered forwarding state
[   36.996000] br-lan: port 3(rai0) entered forwarding state
[   37.292000] Device Instance
[   37.296000]  WDEV 00:
Name:rai0
[   37.304000]          Wdev(list) Idx:0
[   37.312000]           Idx:13
[   37.316000]  WDEV 01:
Name:rai1
[   37.324000]          Wdev(list) Idx:1
[   37.324000] :MtCmdPktBudgetCtrl: bssid(255),wcid(65535),type(0)
[   37.340000]           Idx:14
[   37.344000]  WDEV 02:
Name:rai2
[   37.352000]          Wdev(list) Idx:2
[   37.356000]           Idx:15
[   37.360000]  WDEV 03:
Name:rai3
[   37.368000]          Wdev(list) Idx:3
[   37.376000]           Idx:16
[   37.380000]  WDEV 04:
Name:apclii0
[   37.388000]          Wdev(list) Idx:4
[   37.392000]           Idx:17
[   37.396000]  WDEV 05:
[   37.400000]  WDEV 06:
[   37.408000]  WDEV 07:
[   37.412000]  WDEV 08:
[   37.416000]  WDEV 09:
[   37.420000]  WDEV 10:
[   37.424000]  WDEV 11:
[   37.428000]  WDEV 12:
[   37.432000]  WDEV 13:
[   37.436000]  WDEV 14:
[   37.444000]  WDEV 15:
[   37.448000]  WDEV 16:
[   37.452000]  WDEV 17:
[   39.000000] br-lan: port 3(rai0) entered forwarding state
switch_val: 1
ifce_automode: 0x01
wan_link_stat: 0
[   48.580000] led=9, on=4000, off=0, blinks,=0, reset=0, time=1 low_trigger=0
[   62.188000] led=9, on=4000, off=0, blinks,=0, reset=0, time=1 low_trigger=0
procd: - init complete -

DIR-X1860 ファームウェア復号メモ

Forumにあるtopicを手元で紐解いたメモ

  1. key (9I92bgRMPu+0fgFzo/ZwCyuBTNrtpeQ7) と iv (tTc4XS3LiRBq+Muv) をそれぞれkey.txt, iv.txtなどとしてテキストファイルに保存
    この時末尾で改行せずそれぞれ32バイトと16バイトで収めること
  2. firmware-wintoolsでkeyとivのテキストファイルをそれぞれxor
    “-x” オプションが必要なので注意すること
    “-Q” オプションはメッセージ抑制なのであっても無くても

    PS > firmware-wintools xorimage -i key.txt -o key.xor_1 -p 0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20 -x -Q
    PS > firmware-wintools xorimage -i iv.txt -o iv.xor_1 -p 0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20 -x -Q
    
  3. xorしたkeyとivを再度機種固有文字列でxor
    1つ前の手順と異なり “-x” オプションは付けない

    PS > firmware-wintools xorimage -i key.xor_1 -o key.xor -p wrgax10_dlink_dirx1860 -Q
    PS > firmware-wintools xorimage -i iv.xor_1 -o iv.xor -p wrgax10_dlink_dirx1860 -Q
    
  4. keyとivをそれぞれ16進数値で取り出す
    WSLなどを使うか、busybox-w32のhexdumpを使うなどする

    $ hexdump -v -e '1/1 "%02x"' key.xor
    4f395d571f50651a3d13495200362d030c45785b605f15282a3511595d242a7b
    $ hexdump -v -e '1/1 "%02x"' iv.xor
    022407512564041b043420134d1c1e0f
    
  5. 取り出したkeyとivを用いてAESで復号する
    復号なので “-d” オプションが必要
    “-K” オプションと “-V” オプションは大文字の方を使う

    PS > firmware-wintools aes -i DIRX1860A1_FW101B07.bin -o .\DIRX1860A1_FW101B07.dec -K 4f395d571f50651a3d13495200362d030c45785b605f15282a3511595d242a7b -V 022407512564041b043420134d1c1e0f -d -Q
    

以上で完了。
Linux環境でやる場合は、たぶんForumのtopicにリンクされているPRのalpha_encimg.cを使わなくても、OpenWrtのxorimage.cとopensslの使用で代替できるはず。alpha_encimg.cをよく見ると、使い方のメッセージにおける引数の順番と実際に実行時に取得する順番が異なっているのが少々罠。

OpenWrt 21.02あれこれ

ざっくりと備忘録も兼ねたもの。詳細な点については公式のドキュメントを参照すること。

MT7621 SoC搭載機は19.07以前から設定を引き継いでのアップグレードは不可
スイッチングハブチップ部分 (MT7530)のドライバが、OpenWrt内の実装であるswconfig APIを使用したものからLinux Kernelで採用されているDSA (Distributed Switch Architecture)を利用したものに変更されたことにより、設定方法が異なることからコンフィグの互換性が無くなった為。
sysupgradeの際は通常通り行おうとすると “このファームウェアではサポートされない機種” というメッセージが出るが、DSAに絡んだメッセージも同時に出るので、確認の上 “-F” オプションと “-n” オプションを付けて設定を保持せず強制的にアップグレードする。
OpenWrtから見て上流に位置するLinux Kernelに既に実装が存在するにも関わらずOpenWrtで独自に実装を保守するメリットは薄いため、移行は必然的と言える。
BHR-4GRV2をar71xxから移行する場合は要再インストール
21.02ではar71xx targetが廃止され、ath79に一本化された。BHR-4GRV2は、ath79においてはFlash内のKernelとRootFSの配置の問題からパーティション構成をar71xxのものから変更しており、互換性が無くなったために19.07以前のar71xx targetのファームウェアから直接のアップグレードは不可になっている。
このことから、記事に書いた通りU-Bootの設定を行い再度インストールし直す必要がある。
19.07でath79のファームウェアを使用していた場合は、直接のアップグレードで問題無い。
realtek targetが追加された
21.02ではrealtek targetが追加された。名前こそ “realtek” ではあるものの源流は rtl838x target であり、今のところは安価帯寄りのマネージドスイッチに使用されるSoCファミリーのみがサポートされる。
masterにおいては国内メーカーである因幡電機産業のAML2-17GPもサポートされるが、21.02においてサポートされる機種は国外メーカー機のみ。
21.02.0時点ではオフロード周りにおいてIPv6の扱いに問題有
長らく21.02.0のリリースを遅延させていた原因の一つ。極度に重大な問題とは言えないこと、有効な解決策が一向に出てこないことから、これ以上待つことはできないと判断され21.02.0のリリースが決定された。問題が発生する通信を発生させる場合においてはオフロード機能を無効化することが推奨されている。
今後の .1 またはそれ以降のアップデートでの修正が見込まれている。
WZR-HP-G300NH2のファームウェアは21.02に存在せず
前述の通りar71xx targetは21.02においては削除済みでありリリースされない。その関係上、ath79に移植されていないWZR-HP-G300NH2のファームウェアは21.02に存在せず、利用不可。
なお、筆者(musashino_205)はこの機種の移植はモチベーション無し。今後誰かが移植するとしても、原則としてmasterに先にマージされることがルールとして定められており、それが21.02にも取り込まれるかは未知数。既に21.02.0がリリース済みであることから、取り込まれることは無く21.02の次のリリースになる気はする。
WZR-HP-G300NHのファームウェアは2種類ある
21.02において一本化されたath79 targetにおいて、WZR-HP-G300NHのサポートは2種類ある。
WZR-HP-G300NHがハードウェアリビジョンによってスイッチングハブチップを2種類 (RTL8366SR/RTL8366RB) のうちどちらかを使用していることに起因しており、適切な方を使わないとイーサネットが機能しない。
19.07以前からのアップグレードの場合は、元のファームウェアにおいてスイッチがどちらで認識しているかを確認し、ath79の2種類のサポートから適切なプレフィックスが付いている方を選択する。
新規に導入する場合、Forumに多少ハードウェアリビジョンの情報があるのでそれを参考にするか、一度適当な方を投げ込んでみてイーサネットが死んでいるようならもう片方を試すなどする。
なお、WZR-HP-G301NHは恐らくRTL8366RBを搭載するもののみ。

M24eG RTL8218FBメモ

phy PowerON周り

RTL838x# # rtk phyreg set 22 0xfff 30 3
Set Port 22 page 4095 reg 30 val: 0x0003
RTL838x# # rtk phyreg get 22 0 16
Get Port 22 page 00 reg 16 val: 0x1940    <-----
RTL838x# # rtk phyreg set 22 0xfff 30 1
Set Port 22 page 4095 reg 30 val: 0x0001
RTL838x# # rtk phyreg get 22 0xa40 16
Get Port 22 page 2624 reg 16 val: 0x1940    <-----
RTL838x# # rtk phyreg set 22 0xfff 30 0
Set Port 22 page 4095 reg 30 val: 0x0000
RTL838x# # rtk network on
Enable network
Force port28 link up 1G
Please wait for PHY init-time ...

RTL838x# # rtk phyreg set 22 0xfff 30 3
Set Port 22 page 4095 reg 30 val: 0x0003
RTL838x# # rtk phyreg get 22 0 16
Get Port 22 page 00 reg 16 val: 0x1140    <-----
RTL838x# # rtk phyreg set 22 0xfff 30 1
Set Port 22 page 4095 reg 30 val: 0x0001
RTL838x# # rtk phyreg get 22 0xa40 16
Get Port 22 page 2624 reg 16 val: 0x1140    <-----
RTL838x# # rtk phyreg set 22 0xfff 30 0
Set Port 22 page 4095 reg 30 val: 0x0000

Switch-M48eG PN28480K

既に記事があるM8eGやM48eGと同様に、Realtek SoCを搭載するスイッチングハブを調べた際に見つけた機種。
最近深夜になんとなくヤフオクであまり期待せずに “M48eG” を検索したところ、これまで見掛けたことが無い “PN28480K” を見つけ、送料別8,000弱であったことから衝動的に購入してしまったもの。手が滑った
まとめていきます。

U-Boot

help

RTL839x# # help
?         - alias for 'help'
alphachk  - check image header and verify imgae in RAM [srcaddr] [imagetype]
alphadec  - decompress image[filename] from temp memory[srcaddr] to boot address[dstaddr]
base      - print or set address offset
boardid   - boardid  - Get/Set board model id

boota     - boota  - boot application image from one of dual images partition automatically

bootelf   - Boot from an ELF image in memory
bootm     - boot application image from memory
bootp     - boot image via network using BOOTP/TFTP protocol
bootvx    - Boot vxWorks from an ELF image
cmp       - memory compare
cp        - memory copy
crc32     - checksum calculation
eepw      - eepw  - EEPROM write all

env       - environment handling commands
erase     - erase FLASH memory
ffsfmt    - ffs format
ffsls     - ffs ls
ffsmount  - mount ffs
ffsrdm    - read file to memory from ffs
ffsrm     - FFS rm
ffsumount - unmount ffs
ffswrm    - write file from memory to ffs
flinfo    - print FLASH memory information
go        - start application at address 'addr'
help      - print command description/usage
iminfo    - print header information for application image
loadb     - load binary file over serial line (kermit mode)
loady     - load binary file over serial line (ymodem mode)
loop      - infinite loop on address range
lzmadec   - decompress lzma image from src to dst
md        - memory display
memalloc  - memory allocate test
mm        - memory modify (auto-incrementing address)
mtest     - simple RAM read/write test
mw        - memory write (fill)
nm        - memory modify (constant address)
ping      - send ICMP ECHO_REQUEST to network host
printenv  - print environment variables
printsys  - printsys - print system information variables

protect   - enable or disable FLASH write protection
reset     - Perform RESET of the CPU
rtk       - rtk     - Realtek commands

run       - run commands in an environment variable
saveenv   - save environment variables to persistent storage
savesys   - savesys - save system information variables to persistent storage

setenv    - set environment variables
setsys    - setsys  - set system information variables

sf        - SPI flash sub-system
showsub   - show u-boot sub version
sleep     - delay execution for some time
tftpboot  - boot image via network using TFTP protocol
updatert  - update runtime firmware
updateub  - update u-boot firmware
version   - print monitor, compiler and linker version

version

RTL839x# # version

U-Boot 2011.12.46351-1.00.09-svn5722 (Mar 12 2015 - 20:08:54)
mips-linux-uclibc-gcc (GCC) 3.4.4 mipssde-6.03.00-20051020
GNU ld version 2.15.94 mipssde-6.03.00-20051020

printenv

少々厄介なことに、printenvでのethaddrはFlash内にバイナリとして埋め込まれたMACアドレスが常に表示される。その上、何も触れていない完全な初期状態では、U-Bootの環境変数領域にはSDKデフォルトで個体固有ではないと思われるMACアドレスが格納されている。また、setenvでethaddrを設定した場合、U-Bootの環境変数領域のethaddrに加え、Flash内に埋め込まれているアドレスにも適用され変更される。
Flash内に埋め込まれたアドレスとU-Boot環境変数内のアドレスが異なる状態でethaddrのsetenvをせずにsaveenvした場合、埋め込まれたアドレスがU-Bootの環境変数におけるethaddrにも書き込まれる。

RTL839x# # printenv
baudrate=9600
boardmodel=RTL8393M_8218B_8218FB_2SFP
bootcmd=ffsrdm c:/runtime.had 0x81000000;alphadec c:/runtime.had 0x81000240 0x80010000;
bootdelay=3
diagmode=4
ethact=rtl8390#0
ethaddr=00:50:40:**:**:b6
file_linux=vmlinux.bix
file_linux2=vmlinux.bix
file_uboot=u-boot.bin
flashoffset_env=0x80000
flashoffset_linux=0x5a0000
flashoffset_linux2=0xc50000
flashoffset_uboot=0x0
freemem=0x81000000
ipaddr=192.168.1.1
load_addr=0xb4100000
nuke_env=sf probe 0; sf erase $(flashoffset_env) +$(ssize_env)
rtkon=rtk network on;ping $(serverip)
serverip=192.168.1.111
ssize_env=0x10000
ssize_linux=0x6b0000
ssize_linux2=0x6b0000
ssize_uboot=0x80000
stderr=serial
stdin=serial
stdout=serial
up_linux=sf probe 0;sf read $(freemem) $(flashoffset_linux) $(ssize_linux);bootm $(freemem)
update_linux=tftp $(freemem) $(file_linux);sf probe 0;sf erase $(flashoffset_linux) $(ssize_linux);sf write $(fileaddr) $(flashoffset_linux) $(ssize_linux)
update_linux2=tftp $(freemem) $(file_linux2);sf probe 0;sf erase $(flashoffset_linux2) $(ssize_linux2);sf write $(fileaddr) $(flashoffset_linux2) $(ssize_linux2)
update_uboot=tftp $(freemem) $(file_uboot);sf probe 0;sf erase $(flashoffset_uboot) $(ssize_uboot);sf write $(fileaddr) $(flashoffset_uboot) $(ssize_uboot)

Environment size: 1310/65532 bytes

printsys

stockではbootaを利用していないので、関連する “sys” 領域もたぶん利用されていない

RTL838x# # printsys
Invalid system information

help rtk

RTL839x# # help rtk
rtk - rtk     - Realtek commands

Usage:
rtk object action
- SOC commands.
rtk network on
- Enable the networking function
rtk netowkr off
- Disable the networking function
rtk testmode [mode] [port]
- Set default value for specific testing
rtk ext-pinGet [pinNum]
- get external 8231 GPIO pin status
rtk ext-pinSet [pinNum] [status]
- set external 8231 GPIO pin status
rtk smi list
- list all smi group
rtk smi init [group_id] [sck_pin] [sda_pin] [8/16 access type] [chipid] [delay] [name]
- create a smi group and init
rtk smi read [group_id] [reg]
rtk smi write [group_id] [reg] [data]
rtk pinGet [pinNum]
- get internal GPIO pin status
rtk pinSet [pinNum] [status]
- set internal GPIO pin status
rtk poe probe
- probe poe device
rtk ledtest [port] [led_index]
- led test
rtk loopback ext [port-start] [port-end] [round]
- port traffic external loopback test
rtk loopback int [port-start] [port-end] [round]
- port traffic internal loopback test

rtk smi list

RTL839x# # rtk smi list

Index SCK_DEV SCK_PIN SDA_DEV SDA_PIN TYPE   ID   Delay Name
=================================================================
00      00      16      00      17  16_1R    75   04000  PCA9539
01      00      14      00      15   8_0R    70   04000  PCA9545
02      00      16      00      17  16_1R    20   04000  PCA9555
03      00      14      00      15   8_0R    50   04000  GBIC-A0H
04      00      14      00      15   8_0R    51   04000  GBIC-A2H

rtk pinGet 0-32

RTL839x# # rtk pinGet 0
pin0:   0

RTL839x# # rtk pinGet 1
pin1:   1

RTL839x# # rtk pinGet 2
pin2:   1

RTL839x# # rtk pinGet 3
pin3:   0

RTL839x# # rtk pinGet 4
pin4:   0

RTL839x# # rtk pinGet 5
pin5:   0

RTL839x# # rtk pinGet 6
pin6:   0

RTL839x# # rtk pinGet 7
pin7:   0

RTL839x# # rtk pinGet 8
pin8:   1

RTL839x# # rtk pinGet 9
pin9:   1

RTL839x# # rtk pinGet 10
pin10:  0

RTL839x# # rtk pinGet 11
pin11:  0

RTL839x# # rtk pinGet 12
pin12:  1

RTL839x# # rtk pinGet 13
pin13:  1

RTL839x# # rtk pinGet 14
pin14:  1

RTL839x# # rtk pinGet 15
pin15:  1

RTL839x# # rtk pinGet 16
pin16:  1

RTL839x# # rtk pinGet 17
pin17:  1

RTL839x# # rtk pinGet 18
pin18:  1

RTL839x# # rtk pinGet 19
pin19:  0

RTL839x# # rtk pinGet 20
pin20:  1

RTL839x# # rtk pinGet 21
pin21:  1

RTL839x# # rtk pinGet 22
pin22:  1

RTL839x# # rtk pinGet 23
pin23:  1

RTL839x# # rtk pinGet 24
pin24:  0

RTL839x# # rtk pinGet 25
pin25:  0

RTL839x# # rtk pinGet 26
pin26:  0

RTL839x# # rtk pinGet 27
pin27:  0

RTL839x# # rtk pinGet 28
pin28:  0

RTL839x# # rtk pinGet 29
pin29:  0

RTL839x# # rtk pinGet 30
pin30:  0

RTL839x# # rtk pinGet 31
pin31:  0

RTL839x# # rtk pinGet 32
pin32:  0

tftpboot

RTL839x# # tftpboot
*** Warning: no boot file name; using '0101A8C0.img'
Using rtl8390#0 device
TFTP from server 192.168.1.111; our IP address is 192.168.1.1
Filename '0101A8C0.img'.
Load address: 0xb4100000
Loading: *

ffsmount, ffsls

RTL839x# # ffsmount c:/
File system initialization done
RTL839x# # ffsls c:/
-rw- 3346740  runtime.had
-rw- 2        runtime_checksum
-rw- 3346740  runtime_2.had
-rw- 2        runtime_2_checksum
-rw- 2167     config.cfg
-rw- 2        config.cks
-rw- 2167     config_2.cfg
-rw- 2        config_2.cks

md.l 0x1b000280, md.l 0x1b000290

0x1b000274, 0x1b000284 にそれぞれ 1 を書き込んで有効化すると温度2カ所を読めるようになる

RTL839x# # md.l 0x1b000280 1
1b000280: 00000000    ....
RTL839x# # mw.l 0x1b000274 1
RTL839x# # md.l 0x1b000280 1
1b000280: 00000122    ..."
RTL839x# # md.l 0x1b000290 1
1b000290: 00000000    ....
RTL839x# # mw.l 0x1b000284 1
RTL839x# # md.l 0x1b000290 1
1b000290: 00000123    ...#

temp (hex) = val & 0x3F

Kernel

KernelはLinuxではなくVxWorks。Flash内にファイルシステムが形成されており、その中にKernelイメージが配置されている。

bootlog


U-Boot 2011.12.46351-1.00.09-svn5722 (Mar 12 2015 - 20:08:54)

Board: RTL839x CPU:700MHz LXB:200MHz MEM:400MHz
DRAM:  128 MB
SPI-F: 1x32 MB
Loading 65536B env. variables from offset 0x80000
#### Periphery Devices Init Successfully ####
Switch Model: RTL8393M_8218B_8218FB_2SFP (Port Count: 48)
Switch Chip: RTL8393M
Model Info: 83936802
### RTL8218B config - MAC ID = 0 ###
### RTL8218B config - MAC ID = 8 ###
### RTL8218B config - MAC ID = 16 ###
### RTL8218B config - MAC ID = 24 ###
### RTL8218B config - MAC ID = 32 ###
### RTL8218FB config - MAC ID = 40 ###
PHY[0]: disable EEE
PHY[1]: disable EEE
PHY[2]: disable EEE
PHY[3]: disable EEE
PHY[4]: disable EEE
PHY[5]: disable EEE
File system initialization done
Start to check runtime code(1)

## Booting kernel from Legacy Image

Verifying Checksum ... OK

Uncompressing Kernel Image ... OK

## Starting program

UART init . ................................................  100 %
Starting runtime image ....................................      |100 %

Configuration init ........................................      |/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|100 %

[2J[0m[2J[1;1H ==============================================================================
PN28480K Local Management System Version 3.0.0.02
MAC Address: 00:50:40:**:**:B6

==============================================================================

Login Menu

Login:

WN-DEAX1800GR fwhandleメモ

/tmp/fw/wn-deax1800gr_f102 # fwhandle -x wn-deax1800gr_v1.02.003.bin -t kernel_p
ad_apps
------- Header Info ----------
Image Header Size      : 0x0074
Image Header Magic Code: 0x031d6129
Image Data Size        : 15597746
Image Type             : 7 [kernel_pad_apps]
Compression Type       : TBD
Model Name             : WN-DEAX1800GR
Model ID               : 0x7fffffff
Build Date             : 2021-04-27
Version Firmware       : 1.02.003
Version Code SCM       : cadee5db
Version Config         : 9b6c8a0e9a0d069845749ddb7d7dc581
Data CRC Checksum      : 0x72f0addd
Header CRC Checksum    : 0x5e049c5c
------------------------------
FWHANDLE, DECODE PASS
    0x0                 0x4                 0x8                 0xC
     +-------------------+----+--------------+-------------------+-------------------+
 0x0 |    Magic Number   |Type|                                          Model     ->|
     +-------------------+----+--------------+-------------------+-------------------+
0x10 |->  Name                |                                        Firmware    ->|
     +-------------------+----+--------------+-------------------+---------+---------+ 
0x20 |->  Version             |                Code SCM Version            |       ->|
     +-------------------+----+--------------+-------------------+---------+---------+
0x30 |->                               Config Version                              ->|
     +-------------------+-------------------+-------------------+--------------+----+
0x40 |->                            (Config Version)                            |  ->|
     +-------------------+-------------------+----+--------------+---------+----+----+
0x50 |->            Build Date                    |     Model ID (???)     |  Model->|
     +---------+---------+---------+---------+----+----+---------+---------+---------+
0x60 |->ID (?)*|      (pad?)       |     Data Size     |     Data CRC      | Header->|
     +---------+---------+---------+---------+---------+---------+---------+---------+
0x70 |-> CRC   |  (pad)  |
     +---------+---------+

* : fwhandleで “Model ID” として出ているオフセット 0x5A は誤りで、0x5Eが Model ID として正しいものであるように思われる