カテゴリー: ramips

WN-AC1167GRメモ headerチェック

WN-AC1167GR内の header でファームのヘッダが問題無くチェックをパスできるか確認。

# tftp -r openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin -g 192.168.0.100
# header -x openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin 
### Decoding  image ####
Decode source file [openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin]
------- Header Info -------
Vendor  id:  0x0104
Product id:  0x0016
Hardware id:  0x01040016
Version id:  
Code Version:  
Type: 0x3 [kernel]
comp_file_len:  5505028
comp_file_sum:  0x0
Header sum:  0x0
Magic key:  0x0
MD5 chksum:  90ba7450183602a7cbe542bc1a9b436
------------------------------
Decode finished, got file [openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin.bin] with size 5505028 bytes
header: Return OK

header付加スクリプト

  • TOOLDIRは環境に合わせて書き換え
  • mkhashとxorimageはOpenWrtのfirmware-utilsを使用
  • ファイルサイズとmd5sumの埋め込みはxxd利用するともう少し簡略化できる（たぶん）
  • create_headerの hw_id を変更することで、WN-AC733GRxやWNPR2600G、ELECOMの同様のヘッダを持つ機種にも利用できるかもしれない
#!/bin/bash

TOOLDIR="/home/tofu/routers/firmware-utils"

create_header(){
	fw_bin="$1"
	hw_id="01040016"

	[ -d "$(pwd)/tmp" ] || mkdir $(pwd)/tmp
	( \
		echo -ne "\x00\x00\x00\x00\x00\x00\x00\x03" | \
			dd bs=42 count=1 conv=sync; \
		echo -ne "\x${hw_id:0:2}\x${hw_id:2:2}\x${hw_id:4:2}\x${hw_id:6:2}" | \
			dd bs=20 count=1 conv=sync; \
		echo -ne "$(printf '%08x' $(stat -c%s $fw_bin) | fold -s2 | xargs -I {} echo \\x{} | tr -d '\n')" | \
			dd bs=8 count=1 conv=sync; \
		echo -ne "$(${TOOLDIR}/mkhash md5 $fw_bin | fold -s2 | xargs -I {} echo \\x{} | tr -d '\n')" | \
			dd bs=58 count=1 conv=sync; \
	 ) > ./tmp/header.bin
}

xor_fw(){
	fw_bin="$1"
	xor_key="8844A2D168B45A2D"

	${TOOLDIR}/xorimage -i $fw_bin -o ./tmp/${fw_bin}.xor -p "$xor_key" -x
}

concat_header(){
	fw_bin="$1"
	cat ./tmp/header.bin ./tmp/${fw_bin}.xor > ./tmp/${fw_bin}.new
}

fw_bin=$1

[ -r "$fw_bin" ] && \
create_header $fw_bin && \
xor_fw $fw_bin && \
concat_header $fw_bin && \
cp ./tmp/${fw_bin}.new ./ || \
echo "ERROR"

実行例

./header.sh openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-plain.bin
広告

WN-AC1167GR stock -> OpenWrt

それっぽい感じにヘッダを作り、投げ込めたのでメモ。
“wnac1167gr_v000.bin” というようなファイル名にリネームして放り込む必要がありそうな？ → 特にリネームする必要は無かった。

br0: port 4(rai0) entering forwarding state
br0: port 3(ra1) entering forwarding state
br0: port 2(ra0) entering forwarding state
br0: port 1(eth2.1) entering forwarding state
device eth2.1 left promiscuous mode
br0: port 1(eth2.1) entering disabled state
sh: can't kill pid 719: No such process
route: SIOCDELRT: No such process
device ra0 left promiscuous mode
br0: port 2(ra0) entering disabled state
device ra1 left promiscuous mode
br0: port 3(ra1) entering disabled state
device wds0 is not a slave of br0
device wds1 is not a slave of br0
device wds2 is not a slave of br0
device wds3 is not a slave of br0
sh: can't kill pid 811: No such process
route: SIOCDELRT: No such process
device rai0 left promiscuous mode
br0: port 4(rai0) entering disabled state
interface wds4 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
interface wds5 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
interface wds6 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
interface wds7 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
Interface doesn't accept private ioctl...
set (8BE2): Network is down
Interface doesn't accept private ioctl...
set (8BE2): Network is down
Sent SIGKILL to all processes
Requesting system reboot
Restarting system.
Hardware reset!!


U-Boot 1.1.3 (Jul 30 2014 - 21:26:23)

Board: Ralink APSoC DRAM:  64 MB
Ralink UBoot ver: 4.0.1.0
ELX UBoot ver: 4.0.1.6 (Jul 30 2014 21:26:23)
Date:Jul 30 2014  Time:21:26:23
CPU: 580 MHz, MEM: 64 MB
#Reset_MT7530
MT7620N disable wan port phy 0

Please choose the operation: 1, 2, 3, 4, 9
                                                                                                                          0  
   
3: System Boot system code via Flash.
## Booting image at bc070000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.89
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1572544 Bytes =  1.5 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 4.14.89 (musashino205@Taiha.Net) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r0+8844-8b0f1087cc)) #0 Wed Dec 19 14:20:51 2018
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620A ver:2 eco:6
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is I-O DATA WN-AC1167GR
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] random: get_random_bytes called from start_kernel+0x8c/0x474 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=0001af06
[    0.000000] Readback ErrCtl register=0001af06
[    0.000000] Memory: 59792K/65536K available (3650K kernel code, 169K rwdata, 852K rodata, 184K init, 207K bss, 5744K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000011] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015469] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087708] pid_max: default: 32768 minimum: 301
[    0.097110] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.110134] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.130733] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.150215] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.162391] pinctrl core: initialized pinctrl subsystem
[    0.173240] NET: Registered protocol family 16
[    0.664925] PCI host bridge /pcie@10140000 ranges:
[    0.674322]  MEM 0x0000000020000000..0x000000002fffffff
[    0.684696]   IO 0x0000000010160000..0x000000001016ffff
[    0.711848] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.722885] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.735975] PCI host bridge to bus 0000:00
[    0.743971] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.757691] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    0.769418] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.782919] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.799126] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.815680] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.828738] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.842549] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    0.856050] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[    0.870415] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.883925] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[    0.898470] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[    0.912817] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.922669] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
[    0.936186] pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
[    0.954220] clocksource: Switched to clocksource systick
[    0.965893] NET: Registered protocol family 2
[    0.975340] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.989118] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    1.001710] TCP: Hash tables configured (established 1024 bind 1024)
[    1.014493] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.026011] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.038685] NET: Registered protocol family 1
[    1.049988] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    1.062734] Crashlog allocated RAM at address 0x3f00000
[    1.074984] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    1.093443] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.104948] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.134261] io scheduler noop registered
[    1.141907] io scheduler deadline registered (default)
[    1.152969] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.166616] console [ttyS0] disabled
[    1.173609] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[    1.193384] console [ttyS0] enabled
[    1.193384] console [ttyS0] enabled
[    1.207155] bootconsole [early0] disabled
[    1.207155] bootconsole [early0] disabled
[    1.223589] cacheinfo: Failed to find cpu0 device node
[    1.233860] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    1.250494] spi spi0.0: force spi mode3
[    1.258992] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    1.268831] 9 fixed-partitions partitions found on MTD device spi0.0
[    1.281492] Creating 9 MTD partitions on "spi0.0":
[    1.291053] 0x000000000000-0x000000030000 : "u-boot"
[    1.301893] 0x000000030000-0x000000040000 : "u-boot-env"
[    1.313411] 0x000000040000-0x000000048000 : "Factory"
[    1.324481] 0x000000048000-0x000000050000 : "iNIC_rf"
[    1.335451] 0x000000050000-0x000000070000 : "NoUsed"
[    1.346240] 0x000000070000-0x000000724000 : "firmware"
[    1.361495] 2 uimage-fw partitions found on MTD device firmware
[    1.373360] Creating 2 MTD partitions on "firmware":
[    1.383268] 0x000000000000-0x00000017ff00 : "kernel"
[    1.394103] 0x00000017ff00-0x0000006b4000 : "rootfs"
[    1.404891] mtd: device 7 (rootfs) set to be root filesystem
[    1.417780] 1 squashfs-split partitions found on MTD device rootfs
[    1.430170] 0x00000051c000-0x0000006b4000 : "rootfs_data"
[    1.441868] 0x000000724000-0x0000007b0000 : "manufacture"
[    1.453527] 0x0000007b0000-0x0000007c0000 : "backup"
[    1.464422] 0x0000007c0000-0x000000800000 : "storage"
[    1.476152] libphy: Fixed MDIO Bus: probed
[    1.494665] libphy: mdio: probed
[    1.505816] mtk_soc_eth 10100000.ethernet: using fixed link parameters
[    1.520905] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[    1.543657] mtk_soc_eth 10100000.ethernet: loaded mt7530 driver
[    1.556146] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    1.573158] rt2880_wdt 10000120.watchdog: Initialized
[    1.584634] NET: Registered protocol family 10
[    1.598207] Segment Routing with IPv6
[    1.605689] NET: Registered protocol family 17
[    1.614607] 8021q: 802.1Q VLAN Support v1.8
[    1.640878] VFS: Mounted root (squashfs filesystem) readonly on device 31:7.
[    1.655983] Freeing unused kernel memory: 184K
[    1.664861] This architecture does not have kernel memory protection.
[    2.884162] random: fast init done
[    3.376096] init: Console is alive
[    3.383103] init: - watchdog -
[    5.216454] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    5.602456] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.618831] init: - preinit -
[    7.679126] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex)
[    7.695385] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    7.707063] 8021q: adding VLAN 0 to HW filter on device eth0
[    7.718617] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3[    7.881440] random: procd: uninitialized urandom read (4 bytes read)
] or [4] key and hit [enter] to select the debug level
[    8.333303] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    8.382482] urandom-seed: Seed file not found (/etc/urandom.seed)
[    8.477085] mtk_soc_eth 10100000.ethernet eth0: port 5 link down
[    8.500674] procd: - early -
[    8.506519] procd: - watchdog -
[    8.720075] procd: - watchdog -
[    8.726625] procd: - ubus -
[    8.995261] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.119153] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.132436] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.146130] procd: - init -
Please press Enter to activate this console.
[    9.687288] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.912282] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    9.936696] Loading modules backported from Linux version v4.19.7-0-g61c68f2a2af0
[    9.951681] Backport generated by backports.git v4.19.7-1-0-g148b072d
[    9.969253] ip_tables: (C) 2000-2006 Netfilter Core Team
[    9.991331] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[   10.240395] xt_time: kernel timezone is -0000
[   10.405310] mt76x2e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[   10.417917] mt76x2e 0000:01:00.0: ASIC revision: 76120044
[   10.616088] mt76x2e 0000:01:00.0: ROM patch build: 20141115060606a
[   10.634389] mt76x2e 0000:01:00.0: Firmware Version: 0.0.00
[   10.645359] mt76x2e 0000:01:00.0: Build: 1
[   10.653512] mt76x2e 0000:01:00.0: Build Time: 201507311614____
[   10.670106] mt76x2e 0000:01:00.0: Firmware running!
[   10.706126] PPP generic driver version 2.4.2
[   10.723773] NET: Registered protocol family 24
[   10.833645] rt2800_wmac 10180000.wmac: loaded eeprom from mtd device "Factory"
[   10.848119] ieee80211 phy1: rt2x00_set_rt: Info - RT chipset 6352, rev 0500 detected
[   10.863584] ieee80211 phy1: rt2x00_set_rf: Info - RF chipset 7620 detected
[   10.976473] kmodloader: done loading kernel modules from /etc/modules.d/*
[   12.379026] urandom_read: 5 callbacks suppressed
[   12.379035] random: jshn: uninitialized urandom read (4 bytes read)
[   29.231715] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   29.285994] jffs2_build_filesystem(): unlocking the mtd device... 
[   29.286009] done.
[   29.302226] jffs2_build_filesystem(): erasing all blocks after the end marker... 
[   29.579476] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex)
[   29.610524] 8021q: adding VLAN 0 to HW filter on device eth0
[   29.805068] br-lan: port 1(eth0.1) entered blocking state
[   29.815907] br-lan: port 1(eth0.1) entered disabled state
[   29.827089] device eth0.1 entered promiscuous mode
[   29.836692] device eth0 entered promiscuous mode
[   30.020666] br-lan: port 1(eth0.1) entered blocking state
[   30.031498] br-lan: port 1(eth0.1) entered forwarding state
[   30.042845] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   30.611535] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   53.338536] done.
[   53.342445] jffs2: notice: (1277) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   54.227888] overlayfs: upper fs does not support tmpfile.
[   66.595958] random: crng init done



BusyBox v1.29.3 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r0+8851-5827264d5b
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# ubus call system board
{
        "kernel": "4.14.89",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7620A ver:2 eco:6",
        "model": "I-O DATA WN-AC1167GR",
        "board_name": "iodata,wn-ac1167gr",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r0+8851-5827264d5b",
                "target": "ramips\/mt7620",
                "description": "OpenWrt SNAPSHOT r0+8851-5827264d5b"
        }
}

WN-GX300GR offload (MT7621 HW NAT)

WN-GX300GRで雑にoffloadを使用しての速度をテストしたメモ。

環境

  • Server: Fujitsu S751/C (Ubuntu 18.04 LTS), Intel 82579V
  • Client: Lenovo X230 (Windows 10), Intel 82579LM
  • Router: WN-GX300GR (MT7621S (1C2T), RAM 64MB)
  • X230 (192.168.12.10) -> WN-GX300GR (192.168.12.1, 192.168.15.1) -> S751/C (192.168.15.10)

ログ

WN-GX300GR senao fw

メーカー公式サイトで配布されているWN-GX300GR用アップデートファームの考察
参考: Senao – WikiDevi

ramipsのimage/Makefileでmksenaofwを使用してWN-GX300GR用factoryを作る際の記述は、以下のどちらかになると予想。mksenaofwの-t (type)オプションがWN-GX300GRではkernelとkernelappのどちらであるか、知識不足で判別がつかない。

  • senao-header -r 0x30A -p 0x1056 -t 2
  • senao-header -r 0x30A -p 0x1056 -t 3
  • 追記: メーカーファームでのアップデートログを確認したら、typeは4だった。
    以下でメーカーファームでのファームチェックをパスできることを確認。ただし、WN-GX300GRではメーカーファームでのKernel + Rootfs領域が4MB弱しかないためにOpenWrtファームを焼ききれず正常にブートできないため、factoryは断念。
    senao-header -r 0x30a -p 0x1056 -t 4
  • 追記: 某氏から “mksenaofw.cを読み解けばtypeの値もわかる” ということ、”ファーム内0x1Fの値がtypeに該当する” という指摘を頂いた。Cをまともに読めるようにしたい…

WHR-G300N TFTPによるOpenWrt化

少し前にWHR-G300Nのイメージ生成コードを修正してopenwrt/openwrtに投げてマージされたものの、それについて特に書いてなかったのでメモ。この修正により、コードは存在するのに生成されなくなっていたTFTP用イメージが生成されるようになった。

基本的には、WHR-G301NのTFTPによるOpenWrt化と同様。ただし、デバッグ用のWebUI等でU-Bootの環境変数は特に設定する必要無し。
Windows環境で行う場合、パブリックのファイアウォールは一旦停止しておく。

試したときから時間が経ってしまったため、少し曖昧になっている箇所がいくらか。そのうち確認します。確認できたら、記事を書き直してメインのブログに移すかも。

手順

OS: Windows 10, WHR-G300Nとは直結で実施

  • PCのNICを 192.168.11.0/24 のいずれかに設定
  • WHR-G300Nをブート
  • ブート後、1秒程度おいてから 
    tftp -i 192.168.11.1 put firmware.bin

    を実行してtftpイメージを投げつけ

  • WHR-G300Nがうまく受け付ければFlashに書き込まれる
  • しばらくして完了

ログ

U-Boot 1.1.3 for BUFFALO AIRSTATION (Aug 26 2008 - 13:08:44)

Board: Ralink APSoC DRAM:  32 MB
Top of RAM usable for U-Boot at: 82000000
Stack Pointer at: 81f4ff98
relocate_code Pointer at: 81fa0000
Now running in RAM - U-Boot at: 81fa0000

FLASH ID : 00h=[0xc2], 01h=[0x22a8], 0Eh=[0x0], 0Fh=[0x19]

 Set info->start[0]=BF000000
flash_protect ON: from 0xBF000000 to 0xBF02B84F
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
flash_protect ON: from 0xBF040000 to 0xBF04FFFF
protect on 11
uboot use  81F4FFB0 - 82000000
Memory Test start(80000000) end(81F00000) size(01F00000)
Pattern 00000000  Writing...  Reading...
Memory Test OK
### buf_ver=[1.09] U-Boot Ver.=[1.09]
### build_date(env)=[Aug 26 2008 - 13:08:44] build_date(bin)=[Aug 26 2008 - 13:08:44]
============================================ 
Ralink UBoot Version: 3.1
-------------------------------------------- 
ASIC 3052_MP2 (MAC to GigaMAC Mode)
DRAM COMPONENT: 256Mbits 
DRAM BUS: 32BIT 
Total memory: 64 MBytes
Date:Aug 26 2008  Time:13:08:44
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 384 MHZ #### 

 SDRAM bus set to 32 bit 
 SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 
                                                                                                                           0 
Net:   
 eth_register  
Eth0 (10/100-M)
 enetvar=ethaddr,Eth addr:00:AA:BB:CC:DD:19
 00:AA:BB:CC:DD:19:

 eth_current->name = Eth0 (10/100-M)

   
6: System Load Linux Kernel then write to Flash via TFTP Server. 

 netboot_common, argc= 2 
 *************buf = 0x81fcb9e0
 **********NexTxPacket = 81fe3ac0

 NetTxPacket = 0x81FE3AC0 

 NetRxPackets[0] = 0x81FE40C0

 NetRxPackets[1] = 0x81FE46C0

 NetRxPackets[2] = 0x81FE4CC0

 NetRxPackets[3] = 0x81FE52C0

 NetRxPackets[4] = 0x81FE58C0

 NetRxPackets[5] = 0x81FE5EC0

 NetRxPackets[6] = 0x81FE64C0

 NetRxPackets[7] = 0x81FE6AC0

 NetRxPackets[8] = 0x81FE70C0

 NetRxPackets[9] = 0x81FE76C0

 NetRxPackets[10] = 0x81FE7CC0

 NetRxPackets[11] = 0x81FE82C0

 NetRxPackets[12] = 0x81FE88C0

 NetRxPackets[13] = 0x81FE8EC0

 NetRxPackets[14] = 0x81FE94C0

 NetRxPackets[15] = 0x81FE9AC0

 NetRxPackets[16] = 0x81FEA0C0

 NetRxPackets[17] = 0x81FEA6C0

 NetRxPackets[18] = 0x81FEACC0

 NetRxPackets[19] = 0x81FEB2C0

 KSEG1ADDR(NetTxPacket) = 0xA1FE3AC0 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done

 Mac to giga Mac mode  

 rx_ring = A1FCBE00, tx_ring0 = A1FCBCC0

 Header Payload scatter function is Disable !! 

 RT2880_PDMA_GLO_CFG=00000020 

 ************************************************* 

 RX_CALC_IDX0=19 

 RX_DRX_IDX0 = 0 

 ************************************************* 

 ETH_STATE_ACTIVE!! 

tftp server(receive) go, waiting:4[sec]
Trying Eth0 (10/100-M)

 ETH_STATE_ACTIVE!! 
Load address: 0x81000000
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REQUEST, return our IP
Got ARP REPLY, set server/gtwy eth addr (5c:9a:d8:e6:3f:b3)
Got it
checksum bad
checksum bad
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
tftp server done
Bytes transferred = 3277316 (320204 hex)
NetBootFileXferSize= 00320204
tftp server received buffalo F/W.
buf="# Airstation FirmWare
run u_fw
r"
Encript Airstation FirmWare header
begin commands
cmd:# Airstation FirmWare
cmd:run u_fw

 b_end =BF3FFFFF
Erase Flash from 0xbf050000 to 0xbf3fffff in Bank # 1 

 erase sector  = 12 
sect = 12,s_last = 70,erase poll = 806018

 erase sector  = 13 
sect = 13,s_last = 70,erase poll = 806709

 erase sector  = 14 
*sect = 14,s_last = 70,erase poll = 818244

 erase sector  = 15 
sect = 15,s_last = 70,erase poll = 797581

 erase sector  = 16 
sect = 16,s_last = 70,erase poll = 814609
.
 erase sector  = 17 
sect = 17,s_last = 70,erase poll = 825964

 erase sector  = 18 
sect = 18,s_last = 70,erase poll = 807269

 erase sector  = 19 
*sect = 19,s_last = 70,erase poll = 817820

 erase sector  = 20 
sect = 20,s_last = 70,erase poll = 807149

 erase sector  = 21 
*sect = 21,s_last = 70,erase poll = 817876

 erase sector  = 22 
sect = 22,s_last = 70,erase poll = 824256

 erase sector  = 23 
sect = 23,s_last = 70,erase poll = 822237

 erase sector  = 24 
*sect = 24,s_last = 70,erase poll = 824219

 erase sector  = 25 
sect = 25,s_last = 70,erase poll = 768322

 erase sector  = 26 
sect = 26,s_last = 70,erase poll = 647356

 erase sector  = 27 
*sect = 27,s_last = 70,erase poll = 825006

 erase sector  = 28 
sect = 28,s_last = 70,erase poll = 807684

 erase sector  = 29 
*sect = 29,s_last = 70,erase poll = 818392

 erase sector  = 30 
sect = 30,s_last = 70,erase poll = 835490

 erase sector  = 31 
sect = 31,s_last = 70,erase poll = 822679

 erase sector  = 32 
*sect = 32,s_last = 70,erase poll = 808126

 erase sector  = 33 
sect = 33,s_last = 70,erase poll = 812402

 erase sector  = 34 
*sect = 34,s_last = 70,erase poll = 830256

 erase sector  = 35 
sect = 35,s_last = 70,erase poll = 830251

 erase sector  = 36 
*sect = 36,s_last = 70,erase poll = 819203

 erase sector  = 37 
sect = 37,s_last = 70,erase poll = 818390

 erase sector  = 38 
sect = 38,s_last = 70,erase poll = 821800

 erase sector  = 39 
*sect = 39,s_last = 70,erase poll = 798328

 erase sector  = 40 
sect = 40,s_last = 70,erase poll = 810145

 erase sector  = 41 
*sect = 41,s_last = 70,erase poll = 807579

 erase sector  = 42 
sect = 42,s_last = 70,erase poll = 833192

 erase sector  = 43 
sect = 43,s_last = 70,erase poll = 823897

 erase sector  = 44 
*sect = 44,s_last = 70,erase poll = 822087

 erase sector  = 45 
sect = 45,s_last = 70,erase poll = 805076

 erase sector  = 46 
*sect = 46,s_last = 70,erase poll = 818297

 erase sector  = 47 
sect = 47,s_last = 70,erase poll = 825913

 erase sector  = 48 
sect = 48,s_last = 70,erase poll = 807648

 erase sector  = 49 
*sect = 49,s_last = 70,erase poll = 808872

 erase sector  = 50 
sect = 50,s_last = 70,erase poll = 818297

 erase sector  = 51 
*sect = 51,s_last = 70,erase poll = 818381

 erase sector  = 52 
sect = 52,s_last = 70,erase poll = 818391

 erase sector  = 53 
sect = 53,s_last = 70,erase poll = 827549

 erase sector  = 54 
*sect = 54,s_last = 70,erase poll = 818384

 erase sector  = 55 
sect = 55,s_last = 70,erase poll = 808554

 erase sector  = 56 
*sect = 56,s_last = 70,erase poll = 809249

 erase sector  = 57 
sect = 57,s_last = 70,erase poll = 823322

 erase sector  = 58 
sect = 58,s_last = 70,erase poll = 834501

 erase sector  = 59 
*sect = 59,s_last = 70,erase poll = 832884

 erase sector  = 60 
sect = 60,s_last = 70,erase poll = 659309

 erase sector  = 61 
sect = 61,s_last = 70,erase poll = 669044
.
 erase sector  = 62 
sect = 62,s_last = 70,erase poll = 664953

 erase sector  = 63 
sect = 63,s_last = 70,erase poll = 660409

 erase sector  = 64 
sect = 64,s_last = 70,erase poll = 674214

 erase sector  = 65 
*sect = 65,s_last = 70,erase poll = 662003

 erase sector  = 66 
sect = 66,s_last = 70,erase poll = 661061

 erase sector  = 67 
sect = 67,s_last = 70,erase poll = 704263
.
 erase sector  = 68 
sect = 68,s_last = 70,erase poll = 658360

 erase sector  = 69 
sect = 69,s_last = 70,erase poll = 658304

 erase sector  = 70 
*sect = 70,s_last = 70,erase poll = 818988
 done
Erased 59 sectors

 Copy linux image[3277316 byte] to Flash[0xBF050000].... 
Copy to Flash... 
 Copy 3277316 byte to Flash... 
 addr = 0xBF0A34F8 ,cnt=2936076 
 addr = 0xBF0F69F0 ,cnt=2594836 
 addr = 0xBF149EEA ,cnt=2253594 
 addr = 0xBF19D3E4 ,cnt=1912352 
 addr = 0xBF1F08DE ,cnt=1571110 
 addr = 0xBF243DD8 ,cnt=1229868 
 addr = 0xBF2972D2 ,cnt=888626 
 addr = 0xBF2EA7CA ,cnt=547386 
 addr = 0xBF33DCC4 ,cnt=206144 done
cmd:reset


U-Boot 1.1.3 for BUFFALO AIRSTATION (Aug 26 2008 - 13:08:44)

Board: Ralink APSoC DRAM:  32 MB
Top of RAM usable for U-Boot at: 82000000
Stack Pointer at: 81f4ff98
relocate_code Pointer at: 81fa0000
Now running in RAM - U-Boot at: 81fa0000

FLASH ID : 00h=[0xc2], 01h=[0x22a8], 0Eh=[0x0], 0Fh=[0x19]

 Set info->start[0]=BF000000
flash_protect ON: from 0xBF000000 to 0xBF02B84F
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
flash_protect ON: from 0xBF040000 to 0xBF04FFFF
protect on 11
uboot use  81F4FFB0 - 82000000
Memory Test start(80000000) end(81F00000) size(01F00000)
Pattern 00000000  Writing...  Reading...
Memory Test OK
### buf_ver=[1.09] U-Boot Ver.=[1.09]
### build_date(env)=[Aug 26 2008 - 13:08:44] build_date(bin)=[Aug 26 2008 - 13:08:44]
============================================ 
Ralink UBoot Version: 3.1
-------------------------------------------- 
ASIC 3052_MP2 (MAC to GigaMAC Mode)
DRAM COMPONENT: 256Mbits 
DRAM BUS: 32BIT 
Total memory: 64 MBytes
Date:Aug 26 2008  Time:13:08:44
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 384 MHZ #### 

 SDRAM bus set to 32 bit 
 SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 
                                                                                                                           0 
Net:   
 eth_register  
Eth0 (10/100-M)
 enetvar=ethaddr,Eth addr:00:AA:BB:CC:DD:19
 00:AA:BB:CC:DD:19:

 eth_current->name = Eth0 (10/100-M)

   
6: System Load Linux Kernel then write to Flash via TFTP Server. 

 netboot_common, argc= 2 
 *************buf = 0x81fcb9e0
 **********NexTxPacket = 81fe3ac0

 NetTxPacket = 0x81FE3AC0 

 NetRxPackets[0] = 0x81FE40C0

 NetRxPackets[1] = 0x81FE46C0

 NetRxPackets[2] = 0x81FE4CC0

 NetRxPackets[3] = 0x81FE52C0

 NetRxPackets[4] = 0x81FE58C0

 NetRxPackets[5] = 0x81FE5EC0

 NetRxPackets[6] = 0x81FE64C0

 NetRxPackets[7] = 0x81FE6AC0

 NetRxPackets[8] = 0x81FE70C0

 NetRxPackets[9] = 0x81FE76C0

 NetRxPackets[10] = 0x81FE7CC0

 NetRxPackets[11] = 0x81FE82C0

 NetRxPackets[12] = 0x81FE88C0

 NetRxPackets[13] = 0x81FE8EC0

 NetRxPackets[14] = 0x81FE94C0

 NetRxPackets[15] = 0x81FE9AC0

 NetRxPackets[16] = 0x81FEA0C0

 NetRxPackets[17] = 0x81FEA6C0

 NetRxPackets[18] = 0x81FEACC0

 NetRxPackets[19] = 0x81FEB2C0

 KSEG1ADDR(NetTxPacket) = 0xA1FE3AC0 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done

 Mac to giga Mac mode  

 rx_ring = A1FCBE00, tx_ring0 = A1FCBCC0

 Header Payload scatter function is Disable !! 

 RT2880_PDMA_GLO_CFG=00000020 

 ************************************************* 

 RX_CALC_IDX0=19 

 RX_DRX_IDX0 = 0 

 ************************************************* 

 ETH_STATE_ACTIVE!! 

tftp server(receive) go, waiting:4[sec]
Trying Eth0 (10/100-M)

 ETH_STATE_ACTIVE!! 
Load address: 0x81000000

TftpServer Timeout;
Trying Eth0 (10/100-M)

 ETH_STATE_ACTIVE!! 
no file was loaded.
   
3: System Boot system code via Flash.
## Booting image at bf050000 ...
   Image Name:   MIPS OpenWrt Linux-4.9.77
   Created:      2018-02-12   9:57:22 UTC

 System Control Status = 0x20440000 
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1306525 Bytes =  1.2 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 32

Starting kernel ...

[    0.000000] Linux version 4.9.77 (musashino205@Taiha.Net) (gcc version 5.5.0 (OpenWrt GCC 5.5.0 r0+6059-05677f0) ) #0 Mon Feb 12 09:57:22 2018
[    0.000000] SoC Type: Ralink RT3052 id:1 rev:2
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001964c (MIPS 24KEc)
[    0.000000] MIPS: machine is Buffalo WHR-G300N
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 28092K/32768K available (3051K kernel code, 145K rwdata, 708K rodata, 184K init, 204K bss, 4676K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:256
[    0.000000] CPU Clock: 384MHz
[    0.000000] clocksource_probe: no matching clocksources found
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9954481493 ns
[    0.000014] sched_clock: 32 bits at 192MHz, resolution 5ns, wraps every 11184811005ns
[    0.015678] Calibrating delay loop... 255.59 BogoMIPS (lpj=1277952)
[    0.100968] pid_max: default: 32768 minimum: 301
[    0.110378] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.123474] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.144844] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.164410] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.176633] pinctrl core: initialized pinctrl subsystem
[    0.187905] NET: Registered protocol family 16
[    0.228898] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.239995] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.257596] clocksource: Switched to clocksource MIPS
[    0.269288] NET: Registered protocol family 2
[    0.279239] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.293104] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.305721] TCP: Hash tables configured (established 1024 bind 1024)
[    0.318517] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.330101] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.342938] NET: Registered protocol family 1
[    0.355327] rt-timer 10000100.timer: maximum frequency is 3906Hz
[    0.368542] Crashlog allocated RAM at address 0x1f00000
[    0.380952] workingset: timestamp_bits=30 max_order=13 bucket_order=0
[    0.405462] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.417039] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.453168] io scheduler noop registered
[    0.460919] io scheduler deadline registered (default)
[    0.471785] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.485920] console [ttyS0] disabled
[    0.493036] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 8000000) is a Palmchip BK-3103
[    0.512770] console [ttyS0] enabled
[    0.512770] console [ttyS0] enabled
[    0.526712] bootconsole [early0] disabled
[    0.526712] bootconsole [early0] disabled
[    0.544278] 1f000000.cfi: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0022a8
[    0.564542] Amd/Fujitsu Extended Query Table at 0x0040
[    0.574936]   Amd/Fujitsu Extended Query version 1.1.
[    0.585144] number of CFI chips: 1
[    0.596235] 5 ofpart partitions found on MTD device 1f000000.cfi
[    0.608416] Creating 5 MTD partitions on "1f000000.cfi":
[    0.619150] 0x000000000000-0x000000030000 : "u-boot"
[    0.631537] 0x000000030000-0x000000040000 : "u-boot-env"
[    0.645139] 0x000000040000-0x000000050000 : "factory"
[    0.658269] 0x000000050000-0x0000003f0000 : "firmware"
[    0.672788] 2 uimage-fw partitions found on MTD device firmware
[    0.684819] 0x000000050000-0x00000018efdd : "kernel"
[    0.697542] 0x00000018efdd-0x0000003f0000 : "rootfs"
[    0.710434] mtd: device 5 (rootfs) set to be root filesystem
[    0.721955] 1 squashfs-split partitions found on MTD device rootfs
[    0.734469] 0x000000370000-0x0000003f0000 : "rootfs_data"
[    0.748343] 0x0000003f0000-0x000000400000 : "user"
[    0.761684] libphy: Fixed MDIO Bus: probed
[    0.773383] rt3050-esw 10110000.esw: link changed 0x18
[    0.786555] mtk_soc_eth 10100000.ethernet: generated random MAC address b2:22:c7:30:4d:55
[    0.804287] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    0.821766] rt2880_wdt 10000120.watchdog: Initialized
[    0.833520] NET: Registered protocol family 10
[    0.847329] NET: Registered protocol family 17
[    0.856492] 8021q: 802.1Q VLAN Support v1.8
[    0.873605] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    0.889239] Freeing unused kernel memory: 184K
[    0.898254] This architecture does not have kernel memory protection.
[    1.638197] init: Console is alive
[    1.645438] init: - watchdog -
[    2.034199] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.186265] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.211564] init: - preinit -
[    2.517612] random: fast init done
[    3.543740] 8021q: adding VLAN 0 to HW filter on device eth0
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    6.989255] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    7.044167] urandom-seed: Seed file not found (/etc/urandom.seed)
[    7.217139] procd: - early -
[    7.223245] procd: - watchdog -
[    7.924664] procd: - watchdog -
[    7.931652] procd: - ubus -
[    8.077062] procd: - init -
Please press Enter to activate this console.
[    8.681612] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.829515] nat46: module (version 683fbd2b765506332a1af141545652bf58f03166) loaded.
[    8.859243] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    8.903286] u32 classifier
[    8.908836]     input device check on
[    8.916198]     Actions configured
[    8.926855] Mirror/redirect action on
[    8.945238] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[    8.990249] ip_tables: (C) 2000-2006 Netfilter Core Team
[    9.274762] xt_time: kernel timezone is -0000
[    9.318461] PPP generic driver version 2.4.2
[    9.354753] NET: Registered protocol family 24
[    9.395545] kmodloader: done loading kernel modules from /etc/modules.d/*
[   23.202959] 8021q: adding VLAN 0 to HW filter on device eth0
[   23.305109] br-lan: port 1(eth0.1) entered blocking state
[   23.316076] br-lan: port 1(eth0.1) entered disabled state
[   23.327698] device eth0.1 entered promiscuous mode
[   23.337354] device eth0 entered promiscuous mode
[   23.566627] br-lan: port 1(eth0.1) entered blocking state
[   23.577596] br-lan: port 1(eth0.1) entered forwarding state
[   23.589154] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   24.207878] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   34.487979] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   34.544126] jffs2_build_filesystem(): unlocking the mtd device... [   34.556302] done.
[   34.560209] jffs2_build_filesystem(): erasing all blocks after the end marker... [   38.893944] done.
[   38.897962] jffs2: notice: (1516) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.

Axing W06のFlashを飛ばした

DTSのSPIのノードで

m25p,chunked-io

が必要なのかよくわからず一旦消してみたところ、ブート時にカーネルパニックを引き起こすようになった。慌てて1つ前のビルドに戻したところ、起動はするがfactoryパーティションを破損したのかLANのMACアドレスが正しくないものになっていた。
そのため直接SPI Flashのライタでまるごとバックアップから書き戻そうとしたものの、クリップの取り付けを誤っておりPCに接続後ズレる事故が発生。その後、書き換えツール上でFlashの型番等を認識できないほか書き込みもできなくなり、また、外して電源に接続してみても全くブートしなくなってしまった。

損傷範囲は最低でもSPI Flash、最大でMT7688ANや周辺回路も破損というところか。1回休み。

WN-G300DGRのMTDパーティション

前に書いた WN-G300DGRメモ に関して、Kernelの前に本来存在するらしき0xB0000のパーティションを追加する修正を行い、実機で動作確認した。

が。

どうも再起動すると設定が保存されない。そこでコンソールを確認すると、

jffs2: Too few erase blocks (2)

のログが。これは、Flashに空きスペースが無く、空き領域を確保できない場合に出る。
と、ここで重大なことに気付く。

そりゃ修正前の “firmware” パーティション（Kernel+RootFS）が0x3B0000（≒3,866KB？）で空き領域200KB程度だったのに、Kernelの前に存在するらしきパーティションで0xB0000（≒720KB？）も持っていかれて “firmware” パーティションが0x300000（≒3,145KB？）では全く足りてないよな…

という。
上記の修正を行った場合、ramips + U-BootにおけるLEDE (OpenWrt) ファームのお馴染み “27 05 19 56” が公式ファームと同じ位置に来るためU-BootにBad Magic Numberを出されないほか、公式ファームへ戻す際にも0xB0000分paddingする必要が無く簡単なものの、このままではLEDE (OpenWrt)で設定が保存できない。
そのため、再起動するたびにリセットされ設定し直す羽目になるので、パーティション修正は諦め変更を破棄して元の構成に差し戻した。

やはりFlash 4MBでは厳しい。正直パーティション構成を正確に調べたかったものの、Flashのサイズや筐体の形（湾曲していて扱いづらい）など厳しい点がどうしても多いため追加で購入するのは見送って、この機種に関してはあとUSB周り調べる程度かな、と思う。

WN-G300DGRメモ

弄る中で気付いたことメモ

  • Kernelの前にパーティション有
    • シリアルコンソール用のシェルが存在？
  • GPIO#7はrebootに使用
  • U-Bootの環境変数op_modeをデフォルトの0から1に変更すると、Kernelが起動後詳細なログをコンソールに吐く
  • console pass: admin ?

パーティション構成
現状での予想。これ以外にも存在する可能性あり

パーティション名 領域 (HEX) サイズ (HEX)
u-boot 0x0 – 0x30000 0x30000
u-boot-env 0x30000 – 0x40000 0x10000
factory 0x40000 – 0x50000 0x10000
console? 0x50000 – 0x100000 0xb0000
firmware (Kernel + RootFS) 0x100000 – 0x400000 0x300000
————- ↓firmware ————– ——————————— ———————-
kernel 0x100000 – 0x2c0000 0x1c0000
rootfs 0x2c0000 – 0x400000 0x140000