カテゴリー: MediaTek

WRC-1167GHBK2-I

ハードオフ東久留米店で、WR9500Nと一緒に確保したもの。以前よりMT7620を搭載していることを把握していたものの、少々懸念する点があり購入は見送っていたが、ジャンクで非常に安価に出ていたので衝動的に購入してしまった。
upstreamへマージできるかは不明なものの、弄っていくのでメモ。

Switch

zone WAN LAN
port
(WRC-1167GHBK-I)
INTERNET LAN4 LAN3 LAN2 LAN1
port
(MT7530)
port0 port1 port2 port3 port4

MAC

5G (MT7612E)のEEPROMにMACアドレスが埋め込まれていないため、openwrt/openwrtへのPRは行わない。

  • LAN: BC:5C:4C:xx:xx:51 (hwconfig, HW.LAN.MAC.Address (text))
  • WAN: BC:5C:4C:xx:xx:50 (hwconfig, HW.LAN.MAC.Address (text))
  • 2G: BC:5C:4C:xx:xx:52 (hwconfig, HW.LAN.2G.0.MAC.Address (text))
  • 5G: BC:5C:4C:xx:xx:53 (hwconfig, HW.LAN.5G.0.MAC.Address (text))

U-Boot

  • help
    MT7620 # help
    ?       - alias for 'help'
    bootm   - boot application image from memory
    cp      - memory copy
    erase   - erase SPI FLASH memory
    go      - start application at address 'addr'
    help    - print online help
    loadb   - load binary file over serial line (kermit mode)
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    nm      - memory modify (constant address)
    printenv- print environment variables
    reset   - Perform RESET of the CPU
    rf      - read/write rf register
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version
    MT7620 # version
    
    U-Boot 1.1.3 (Mar 27 2015 - 15:25:08)
    

  • printenv
    MT7620 # printenv
    bootcmd=tftp
    bootdelay=3
    baudrate=57600
    ethaddr="00:AA:BB:CC:DD:10"
    ipaddr=192.168.2.81
    serverip=192.168.2.89
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 151/4092 bytes
    

Kernel

パスワードが掛けられており、ログイン不可。

  • bootlog
    U-Boot 1.1.3 (Mar 27 2015 - 15:25:08)
    
    Board: Ralink APSoC DRAM:  64 MB
    relocate_code Pointer at: 83fb4000
    enable ephy clock...done. rf reg 29 = 5
    SSC disabled.
    ******************************
    Software System Reset Occurred
    ******************************
    spi_wait_nsec: 29 
    spi device id: c2 20 17 c2 20 (2017c220)
    find flash: MX25L6405D
    raspi_read: from:30000 len:1000 
    *** Warning - bad CRC, using default environment
    
    ============================================ 
    Ralink UBoot Version: 4.1.2.0
    -------------------------------------------- 
    ASIC 7620_MP (Port5GigaSW)
    DRAM component: 512 Mbits DDR, width 16
    DRAM bus: 16 bit
    Total memory: 64 MBytes
    Flash component: SPI Flash
    Date:Mar 27 2015  Time:15:25:08
    ============================================ 
    icache: sets:512, ways:4, linesz:32 ,total:65536
    dcache: sets:256, ways:4, linesz:32 ,total:32768 
    
     ##### The CPU freq = 580 MHZ #### 
     estimate memory size =64 Mbytes
    #Reset_MT7530
    
    Please choose the operation: 
       1: Load system code to SDRAM via TFTP. 
       2: Load system code then write to Flash via TFTP. 
       3: Boot system code via Flash (default).
       4: Entr boot command line interface.
       5: Load ucos code to SDRAM via TFTP Client. 
       7: Load Boot Loader code then write to Flash via Serial. 
       9: Load Boot Loader code then write to Flash via TFTP. 
                                                                                                                              0  
       
    3: System Boot system code via Flash.
    ## Booting image at bc070000 ...
    raspi_read: from:70000 len:40 
    Magic number at 0xBC070000 
    raspi_read: from:70014 len:40 
       Image Name:   Linux Kernel Image
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    4165548 Bytes =  4 MB
       Load Address: 80000000
       Entry Point:  8000c2f0
    raspi_read: from:70054 len:3f8fac 
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 8000c2f0) ...
    ## Giving linux memsize in MB, 64
    
    Starting kernel ...
    
    
    LINUX started...
    
     THIS IS ASIC
    Linux version 2.6.36 (root@localhost.localdomain) (gcc version 3.4.2) #119 Fri Mar 27 15:23:29 CST 2015
    
     The CPU feqenuce set to 580 MHz
     PCIE: bypass PCIe DLL.
     PCIE: Elastic buffer control: Addr:0x68 -> 0xB4
     disable all power about PCIe
    CPU revision is: 00019650 (MIPS 24Kc)
    Software DMA cache coherency
    Determined physical RAM map:
     memory: 04000000 @ 00000000 (usable)
    Zone PFN ranges:
      Normal   0x00000000 -> 0x00004000
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
        0: 0x00000000 -> 0x00004000
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
    Kernel command line: console=ttyS1,57600n8 root=1f05 console=ttyS0
    PID hash table entries: 256 (order: -2, 1024 bytes)
    Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
    Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
    Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    Writing ErrCtl register=0006ee20
    Readback ErrCtl register=0006ee20
    Memory: 61840k/65536k available (2266k kernel code, 3696k reserved, 397k data, 176k init, 0k highmem)
    Hierarchical RCU implementation.
            Verbose stalled-CPUs detection is disabled.
    NR_IRQS:128
    Console: colour dummy device 80x25
    console [ttyS1] enabled
    Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
    pid_max: default: 32768 minimum: 301
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    RALINK_GPIOMODE = 1a301d
    RALINK_GPIOMODE = 18301d
    PPLL_CFG1=0xe50000
    MT7620 PPLL lock
    PPLL_DRV =0x80080504
    start PCIe register access
    RALINK_RSTCTRL = 2400000
    RALINK_CLKCFG1 = 75afffc0
    
    *************** MT7620 PCIe RC mode *************
    PCIE0 enabled
    init_rt2880pci done
    bio: create slab  at 0
    vgaarb: loaded
    pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
    pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
    pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
    pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
    pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff]
    pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
    pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff 64bit] (PCI address [0x20000000-0x200fffff]
    pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
    pci 0000:00:00.0: PCI bridge to [bus 01-01]
    pci 0000:00:00.0:   bridge window [io  disabled]
    pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
    pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
    BAR0 at slot 0 = 0
    bus=0x0, slot = 0x0
    res[0]->start = 0
    res[0]->end = 0
    res[1]->start = 20200000
    res[1]->end = 2020ffff
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    bus=0x1, slot = 0x0
    res[0]->start = 20000000
    res[0]->end = 200fffff
    res[1]->start = 0
    res[1]->end = 0
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    Switching to clocksource MIPS
    NET: Registered protocol family 2
    IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    TCP established hash table entries: 2048 (order: 2, 16384 bytes)
    TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
    TCP: Hash tables configured (established 2048 bind 2048)
    TCP reno registered
    UDP hash table entries: 256 (order: 0, 4096 bytes)
    UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    NET: Registered protocol family 1
    Load Kernel WDG Timer Module
    Load Ralink Timer0 Module
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    msgmni has been set to 120
    io scheduler noop registered (default)
    Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
    serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
    serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
    brd: module loaded
    deice id : c2 20 17 c2 20 (2017c220)
    MX25L6405D(c2 2017c220) (8192 Kbytes)
    mtd .name = raspi, .size = 0x00800000 (0M) .erasesize = 0x00000008 (0K) .numeraseregions = 65536
    Creating 8 MTD partitions on "raspi":
    0x000000000000-0x000000030000 : "Bootloader"
    0x000000030000-0x000000040000 : "Config"
    0x000000040000-0x000000050000 : "Factory"
    0x000000050000-0x000000070000 : "nvram"
    0x000000070000-0x000000170000 : "Kernel"
    0x000000170000-0x0000007f0000 : "RootFS"
    0x0000007f0000-0x000000800000 : "hwconfig"
    0x000000070000-0x0000007f0000 : "Uimage"
    rdm_major = 254
    SMACCR1 -- : 0x0000000c
    SMACCR0 -- : 0x43762077
    Ralink APSoC Ethernet Driver Initilization. v3.0  256 rx/tx descriptors allocated, mtu = 1500!
    SMACCR1 -- : 0x0000000c
    SMACCR0 -- : 0x43762077
    PROC INIT OK!
    PPP generic driver version 2.4.2
    PPP BSD Compression module registered
    NET: Registered protocol family 24
    PPTP driver version 0.8.5
    i8042.c: i8042 controller self test timeout.
    Trying to free nonexistent resource 
    mice: PS/2 mouse device common for all mice
    Ralink APSoC Hardware Watchdog Timer
    u32 classifier
        Performance counters on
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (966 buckets, 3864 max)
    ctnetlink v0.93: registering with nfnetlink.
    matchsize=264
    xt_time: kernel timezone is -0000
    GRE over IPv4 demultiplexor driver
    gre: can't add protocol
    ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
    TCP cubic registered
    NET: Registered protocol family 17
    dnshijack
    802.1Q VLAN Support v1.8 Ben Greear 
    All bugs added by David S. Miller 
    VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
    Freeing unused kernel memory: 176k freed
    init started: BusyBox v1.12.1 (2015-01-27 11:57:03 CST)
    starting pid 23, tty '': '/etc/init.d/rcS sysinit'
    rc ver. 1.0.3
    Initializing...Success!
    Mounting file systems...Success!
    Creating devices...Success!
    Creating loopback device...Success!
    starting pid 30, tty '': '/etc/init.d/rcS start'
    rc ver. 1.0.3
    Initializing...Success!
    Loading dynamic libraries...Success!
    edx_gpio: module license 'unspecified' taints kernel.
    Disabling lock debugging due to kernel taint
    Initializing EDX GPIO...Done
    Acelink events notification ver. 1.6
    argv[0]=/sbin/ev_broker i=5 class=2 paction=NETDEV_REGISTER hold=
    NVRAM access daemon Ver. 1.0 Build 2argv[0]=/sbin/ev_broker i=5 class=2 paction=NETDEV_UP hold=
    0150127115621
    daemonize process
    Algorithmics/MIPS FPU Emulator v1.5
    argv[0]=/sbin/ev_broker i=5 class=2 paction=NETDEV_REGISTER hold=
    Starting L0000Config.so...binfile link OK!
    Done ! (ret=0)
    Starting L0100WLANInterface.so...Done ! (ret=0)
    Starting L0130EthInterface.so...Done ! (ret=0)
    Starting L0200LANConfig.so...Done ! (ret=0)
    1970-01-01 00:00:19: (server.c.915) can't have more connections than fds/2:  1024 824 
    start lld2d...
    udhcpd: max_leases=235 is too big, setting to 101
    start child_net...
    start Router mode accesscontrol...
    starting firewall...
    start house_keeper...
    Starting L0230LANServices.so...Done ! (ret=0)
    Starting L0300WANConfig.so...Done ! (ret=0)
    
    Please press Enter to activate this console. starting wan_event...
    wan_event done !
    Notice: caching turned off
    Notice: caching turned off
    insmod: cannot insert '/sbin/hw_nat.ko': File exists
    starting wan_event...
    wan_event done !
    starting wan_event...
    udhcpc receive a leasefail for eth2.2
    wan_event done !
    

広告

WNPR2600G

以前ファームウェアを調べた際にMT7621を搭載していることを把握しており、つい最近某フリマサイトで安価な出品を見かけて衝動的に購入してしまった。
弄っていくのでメモ。

Switch

zone WAN LAN
port
(WNPR2600G)
インターネット LAN4 LAN3 LAN2 LAN1
port
(MT7530)
port0 port1 port2 port3 port4

MAC

Config (u-boot-env), eeprom内に有。

  • LAN: 34:76:C5:xx:xx:1E (Config, ethaddr (text))
  • WAN: 34:76:C5:xx:xx:1D (Config, wanaddr (text))
  • 2G: 34:76:C5:xx:xx:1E (Factory, 0x4 (hex))
  • 5G: 34:76:C5:xx:xx:1F (Factory, 0x8004 (hex))

U-Boot

  • help
    U-Boot 1.1.3 (May 25 2016 - 17:17:58)
    MT7621 # help
    ?       - alias for 'help'
    bootm   - boot application image from memory
    cp      - memory copy
    elx_check      - check ELX image
    erase   - erase SPI FLASH memory
    go      - start application at address 'addr'
    help    - print online help
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    mw      - memory write (fill)
    nm      - memory modify (constant address)
    printenv- print environment variables
    reset   - Perform RESET of the CPU
    rf      - read/write rf register
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    spi     - spi command
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version
    MT7621 # version
    
    U-Boot 1.1.3 (May 25 2016 - 17:17:58)
    

  • printenv
    ELECOM機関連の設定値が散見される

    MT7621 # printenv
    bootcmd=tftp
    baudrate=57600
    ethaddr="34:76:C5:**:**:1E"
    ramargs=setenv bootargs root=/dev/ram rw
    addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
    addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
    flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
    kernel_addr=BFC40000
    u-boot=u-boot.bin
    load=tftp 8A100000 $(u-boot)
    u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
    loadfs=tftp 8A100000 root.cramfs
    u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
    test_tftp=tftp 8A100000 root.cramfs;run test_tftp
    ethact=Eth0 (10/100-M)
    language_code=jp
    domain=1
    pincode=********
    wlanaddr=BC:5C:4C:**:**:**
    kver=1.04   
    sn=12345678901234567890123456789012
    usboot=0
    bver=4.0.1.5
    dom2=1
    wanaddr=34:76:C5:**:**:1D
    bootdelay=2
    filesize=52a000
    fileaddr=80A00000
    ipaddr=192.168.99.9
    serverip=192.168.99.8
    autostart=no
    bootfile=uImage_ELECOM-WRC-2533GHBK-I
    hw_id=0104003a
    op_mode=0
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 1051/4092 bytes
    

Kernel

コンソールにパスワードが掛けられている

  • uname -a
    # uname -a
    Linux WNPR2600G 3.2.9 #3 SMP Tue Oct 31 18:12:39 CST 2017 mips GNU/Linux
    

  • cat /proc/version
    # cat /proc/version
    Linux version 3.2.9 (root@***-pc) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Tue Oct 31 18:12:39 CST 2017
    

  • cat /proc/cpuinfo
    # cat /proc/version
    Linux version 3.2.9 (root@jim-pc) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Tue Oct 31 18:12:39 CST 2017
    # cat /proc/cpuinfo
    system type             : Mediatek MT7621 ver:1 eco:3
    machine                 : Ralink MT7621
    processor               : 0
    cpu model               : MIPS 1004Kc V2.15
    BogoMIPS                : 583.68
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
    ASEs implemented        : mips16 dsp mt
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 0
    VCED exceptions         : not available
    VCEI exceptions         : not available
    
    processor               : 1
    cpu model               : MIPS 1004Kc V2.15
    BogoMIPS                : 583.68
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
    ASEs implemented        : mips16 dsp mt
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 0
    VCED exceptions         : not available
    VCEI exceptions         : not available
    
    processor               : 2
    cpu model               : MIPS 1004Kc V2.15
    BogoMIPS                : 583.68
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
    ASEs implemented        : mips16 dsp mt
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 1
    VCED exceptions         : not available
    VCEI exceptions         : not available
    
    processor               : 3
    cpu model               : MIPS 1004Kc V2.15
    BogoMIPS                : 583.68
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
    ASEs implemented        : mips16 dsp mt
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 1
    VCED exceptions         : not available
    VCEI exceptions         : not available
    

  • cat /proc/meminfo
    # cat /proc/meminfo
    MemTotal:         125776 kB
    MemFree:           78028 kB
    Buffers:            3396 kB
    Cached:            12056 kB
    SwapCached:            0 kB
    Active:             4536 kB
    Inactive:          13272 kB
    Active(anon):       2412 kB
    Inactive(anon):      852 kB
    Active(file):       2124 kB
    Inactive(file):    12420 kB
    Unevictable:           0 kB
    Mlocked:               0 kB
    SwapTotal:             0 kB
    SwapFree:              0 kB
    Dirty:                 0 kB
    Writeback:             0 kB
    AnonPages:          2400 kB
    Mapped:             1912 kB
    Shmem:               904 kB
    Slab:              15696 kB
    SReclaimable:        844 kB
    SUnreclaim:        14852 kB
    KernelStack:         808 kB
    PageTables:          428 kB
    NFS_Unstable:          0 kB
    Bounce:                0 kB
    WritebackTmp:          0 kB
    CommitLimit:       62888 kB
    Committed_AS:     349380 kB
    VmallocTotal:    1048372 kB
    VmallocUsed:        7548 kB
    VmallocChunk:    1024940 kB
    

  • cat /proc/mtd
    # cat /proc/mtd
    dev:    size   erasesize  name
    mtd0: 01000000 00010000 "ALL"
    mtd1: 00030000 00010000 "Bootloader"
    mtd2: 00010000 00010000 "Config"
    mtd3: 00010000 00010000 "Factory"
    mtd4: 00da0000 00010000 "Kernel"
    mtd5: 00bd0000 00010000 "user"
    mtd6: 00190000 00010000 "manufacture"
    mtd7: 00080000 00010000 "storage"
    

  • ls -al /sys/class/leds/
    # ls -al /sys/class/leds/
    lrwxrwxrwx    1         0 Sep  1 00:05 PoE -> ../../devices/platform/leds-gpio/leds/PoE
    lrwxrwxrwx    1         0 Sep  1 00:00 2g_led -> ../../devices/platform/leds-gpio/leds/2g_led
    lrwxrwxrwx    1         0 Sep  1 00:00 5g_led -> ../../devices/platform/leds-gpio/leds/5g_led
    lrwxrwxrwx    1         0 Sep  1 00:00 DIAG -> ../../devices/platform/leds-gpio/leds/DIAG
    lrwxrwxrwx    1         0 Sep  1 00:00 power_led -> ../../devices/platform/leds-gpio/leds/power_led
    drwxr-xr-x   20         0 Sep  1 00:00 ..
    drwxr-xr-x    2         0 Sep  1 00:00 .
    

  • bootlog
    MT7615関連のログがあまりに多すぎるため、無線をオフにした状態のログ。

    
    ===================================================================
                    MT7621   stage1 code Mar 12 2015 14:43:30 (ASIC)
                    CPU=500000000 HZ BUS=125000000 HZ
    ==================================================================
    Change MPLL source from XTAL to CR...
    do MEMPLL setting..
    MEMPLL Config : 0x11000000
    3PLL mode + External loopback
    === XTAL-40Mhz === DDR-1200Mhz ===
    PLL4 FB_DL: 0x3, 1/0 = 567/457 0D000000
    PLL2 FB_DL: 0x11, 1/0 = 665/359 45000000
    PLL3 FB_DL: 0x14, 1/0 = 691/333 51000000
    do DDR setting..[01F40000]
    Apply DDR3 Setting...(use default AC)
              0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
          --------------------------------------------------------------------------------
    0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000E:|    0    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1
    000F:|    0    0    0    0    0    1    1    1    1    1    1    1    1    1    1    1
    0010:|    1    1    1    1    1    1    1    1    1    1    1    0    0    0    0    0
    0011:|    1    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0
    0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    DRAMC_DQSCTL1[0e0]=14000000
    DRAMC_DQSGCTL[124]=80000000
    rank 0 coarse = 16
    rank 0 fine = 40
    B:|    0    0    0    0    0    0    0    1    1    1    0    0    0    0    0    0
    opt_dle value:8
    DRAMC_DDR2CTL[07c]=C287220D
    DRAMC_PADCTL4[0e4]=000022B3
    DRAMC_DQIDLY1[210]=0B08070A
    DRAMC_DQIDLY2[214]=05070708
    DRAMC_DQIDLY3[218]=0C070705
    DRAMC_DQIDLY4[21c]=0A070B08
    DRAMC_R0DELDLY[018]=00002222
    ==================================================================
                    RX      DQS perbit delay software calibration 
    ==================================================================
    1.0-15 bit dq delay value
    ==================================================================
    bit|     0  1  2  3  4  5  6  7  8  9
    --------------------------------------
    0 |    9 5 7 8 6 6 6 5 1 7 
    10 |    6 9 7 8 6 9 
    --------------------------------------
    
    ==================================================================
    2.dqs window
    x=pass dqs delay value (min~max)center 
    y=0-7bit DQ of every group
    input delay:DQS0 =34 DQS1 = 34
    ==================================================================
    bit     DQS0     bit      DQS1
    0  (1~66)33  8  (1~60)30
    1  (1~64)32  9  (1~68)34
    2  (1~66)33  10  (1~66)33
    3  (1~62)31  11  (1~62)31
    4  (1~64)32  12  (1~66)33
    5  (1~66)33  13  (0~63)31
    6  (1~65)33  14  (1~66)33
    7  (1~67)34  15  (1~66)33
    ==================================================================
    3.dq delay value last
    ==================================================================
    bit|    0  1  2  3  4  5  6  7  8   9
    --------------------------------------
    0 |    10 7 8 11 8 7 7 5 5 7 
    10 |    7 12 8 11 7 10 
    ==================================================================
    ==================================================================
         TX  perbyte calibration 
    ==================================================================
    DQS loop = 15, cmp_err_1 = ffff0000 
    dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 
    dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 
    DQ loop=15, cmp_err_1 = ffff0000
    dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1 
    dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2 
    byte:0, (DQS,DQ)=(8,8)
    byte:1, (DQS,DQ)=(8,8)
    DRAMC_DQODLY1[200]=88888888
    DRAMC_DQODLY2[204]=88888888
    20,data:88
    [EMI] DRAMC calibration passed
    
    ===================================================================
                    MT7621   stage1 code done 
                    CPU=500000000 HZ BUS=125000000 HZ
    ===================================================================
    
    
    U-Boot 1.1.3 (May 25 2016 - 17:17:58)
    
    Board: Ralink APSoC DRAM:  128 MB
    relocate_code Pointer at: 87fb4000
    
    Config XHCI 40M PLL 
    flash manufacture id: c2, device id 20 18
    find flash: MX25L12805D
    ============================================ 
    Ralink UBoot Version: 4.0.1.0
    ELX UBoot Version: 1.0.3
    -------------------------------------------- 
    ASIC 7621_MP (MAC to MT7530 Mode)
    DRAM_CONF_FROM: Auto-Detection 
    DRAM_TYPE: DDR3 
    DRAM bus: 16 bit
    Xtal Mode=3 OCP Ratio=1/4
    Flash component: SPI Flash
    Date:May 25 2016  Time:17:17:58
    ============================================ 
    icache: sets:256, ways:4, linesz:32 ,total:32768
    dcache: sets:256, ways:4, linesz:32 ,total:32768 
    
     ##### The CPU freq = 880 MHZ #### 
     estimate memory size =128 Mbytes
    #Reset_MT7530
    
    Please choose the operation: 
       1: Load system code to SDRAM via TFTP. 
       2: Load system code then write to Flash via TFTP. 
       3: Boot system code via Flash (default).
       4: Entr boot command line interface.
       9: Load Boot Loader code then write to Flash via TFTP. 
                                                                                                                              0  
       
    3: System Boot system code via Flash.
    ## Booting image at bfc50000 ...
       Image Name:   Linux Kernel Image
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    1879274 Bytes =  1.8 MB
       Load Address: 80001000
       Entry Point:  803123e0
       Verifying Checksum ... OK
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 803123e0) ...
    ## Giving linux memsize in MB, 128
    
    Starting kernel ...
    
    Linux version 3.2.9 (root@***-pc) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Tue Oct 31 18:12:39 CST 2017
    GCMP present
    bootconsole [early0] enabled
    CPU revision is: 0001992f (MIPS 1004Kc)
    Mediatek MT7621 ver:1 eco:3 running at 880.00 MHz
    Software DMA cache coherency
    Determined physical RAM map:
     memory: 08000000 @ 00000000 (usable)
    Initrd not found or empty - disabling initrd
    Zone PFN ranges:
      Normal   0x00000000 -> 0x00008000
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
        0: 0x00000000 -> 0x00008000
    Detected 3 available secondary CPU(s)
    PERCPU: Embedded 7 pages/cpu @81103000 s4800 r8192 d15680 u32768
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
    Kernel command line:  console=ttyS0,57600 root=/dev/ram0 rootfstype=squashfs,jffs2
    PID hash table entries: 512 (order: -1, 2048 bytes)
    Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
    Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
    Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
    Writing ErrCtl register=00048800
    Readback ErrCtl register=00048800
    Memory: 123988k/131072k available (3186k kernel code, 7084k reserved, 729k data, 1788k init, 0k highmem)
    SLUB: Genslabs=9, HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
    Hierarchical RCU implementation.
    NR_IRQS:128
    gic: revision 3.0
    CPU0: status register was 11000000
    CPU0: status register now 11001800
    CPU0: status register frc 1100dc00
    console [ttyS0] enabled, bootconsole disabled
    console [ttyS0] enabled, bootconsole disabled
    Calibrating delay loop... 574.46 BogoMIPS (lpj=1148928)
    pid_max: default: 32768 minimum: 301
    Mount-cache hash table entries: 512
    CPU revision is: 0001992f (MIPS 1004Kc)
    Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
    CPU revision is: 0001992f (MIPS 1004Kc)
    Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
    CPU revision is: 0001992f (MIPS 1004Kc)
    Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
    Brought up 4 CPUs
    Synchronize counters across 4 CPUs: done.
    NET: Registered protocol family 16
    MIPS: machine is Ralink MT7621
    before gpio setting:407ac
    after gpio setting:405ac
    release PCIe RST: RALINK_RSTCTRL = 3000000
    PCIE PHY initialize
    ***** Xtal 40MHz *****
    start MT7621 PCIe register access
    RALINK_RSTCTRL = 3000000
    RALINK_CLKCFG1 = 77ffeff8
    
    *************** MT7621 PCIe RC mode *************
    pcie_link status = 0x3
    RALINK_RSTCTRL= 3000000
    *** Configure Device number setting of Virtual PCI-PCI bridge ***
    RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2
    PCIE0 enabled
    PCIE1 enabled
    interrupt enable status: 300000
    Port 1 N_FTS = 1b105000
    Port 0 N_FTS = 1b105000
    config reg done
    init_rt2880pci done
    bio: create slab  at 0
    SCSI subsystem initialized
    pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
    pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000)
    pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
    pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff]
    pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff]
    pci 0000:00:00.0: BAR 1: set to [mem 0x60200000-0x6020ffff] (PCI address [0x60200000-0x6020ffff])
    pci 0000:00:01.0: BAR 1: assigned [mem 0x60210000-0x6021ffff]
    pci 0000:00:01.0: BAR 1: set to [mem 0x60210000-0x6021ffff] (PCI address [0x60210000-0x6021ffff])
    pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
    pci 0000:01:00.0: BAR 0: set to [mem 0x60000000-0x600fffff 64bit] (PCI address [0x60000000-0x600fffff])
    pci 0000:00:00.0: PCI bridge to [bus 01-01]
    pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
    pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff 64bit]
    pci 0000:02:00.0: BAR 0: set to [mem 0x60100000-0x601fffff 64bit] (PCI address [0x60100000-0x601fffff])
    pci 0000:00:01.0: PCI bridge to [bus 02-02]
    pci 0000:00:01.0:   bridge window [mem 0x60100000-0x601fffff]
    PCI: Enabling device 0000:00:00.0 (0004 -> 0006)
    PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
    BAR0 at slot 0 = 0
    bus=0x0, slot = 0x0
    res[0]->start = 0
    res[0]->end = 0
    res[1]->start = 60200000
    res[1]->end = 6020ffff
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    BAR0 at slot 1 = 0
    bus=0x0, slot = 0x1
    res[0]->start = 0
    res[0]->end = 0
    res[1]->start = 60210000
    res[1]->end = 6021ffff
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    bus=0x1, slot = 0x0, irq=0x4
    res[0]->start = 60000000
    res[0]->end = 600fffff
    res[1]->start = 0
    res[1]->end = 0
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    bus=0x2, slot = 0x1, irq=0x18
    res[0]->start = 60100000
    res[0]->end = 601fffff
    res[1]->start = 0
    res[1]->end = 0
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    Switching to clocksource MIPS
    NET: Registered protocol family 2
    IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    TCP established hash table entries: 4096 (order: 3, 32768 bytes)
    TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
    TCP: Hash tables configured (established 4096 bind 4096)
    TCP reno registered
    UDP hash table entries: 128 (order: 0, 4096 bytes)
    UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
    NET: Registered protocol family 1
    4 CPUs re-calibrate udelay(lpj = 1167360)
    Load Ralink Timer0 Module
    Load Ralink Timer1 Module
    Load Ralink Timer2 Module
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
    msgmni has been set to 242
    io scheduler noop registered
    io scheduler deadline registered
    io scheduler cfq registered (default)
    Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
    serial8250: ttyS0 at MMIO 0x1e000c00 (irq = 26) is a 16550A
    serial8250: ttyS1 at MMIO 0x1e000e00 (irq = 28) is a 16550A
    loop: module loaded
    flash manufacture id: c2, device id 20 18
    MX25L12805D(c2 2018c220) (16384 Kbytes)
    mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
    Creating 8 MTD partitions on "raspi":
    0x000000000000-0x000001000000 : "ALL"
    0x000000000000-0x000000030000 : "Bootloader"
    0x000000030000-0x000000040000 : "Config"
    0x000000040000-0x000000050000 : "Factory"
    0x000000050000-0x000000df0000 : "Kernel"
    0x000000220000-0x000000df0000 : "user"
    0x000000df0000-0x000000f80000 : "manufacture"
    0x000000f80000-0x000001000000 : "storage"
    rdm_major = 253
    IMQ driver loaded successfully. (numdevs = 2, numqueues = 1)
            Hooking IMQ after NAT on PREROUTING.
            Hooking IMQ before NAT on POSTROUTING.
    GMAC1_MAC_ADRH -- : 0x0000000c
    GMAC1_MAC_ADRL -- : 0x43288002
    Ralink APSoC Ethernet Driver Initilization. v3.1  512 rx/tx descriptors allocated, mtu = 1500!
    GMAC1_MAC_ADRH -- : 0x0000000c
    GMAC1_MAC_ADRL -- : 0x432880c9
    PROC INIT OK!
    PPP generic driver version 2.4.2
    PPP BSD Compression module registered
    PPP Deflate Compression module registered
    PPP MPPE Compression module registered
    NET: Registered protocol family 24
    Registered button device:reset, gpio:16,code:408,index:10
    Registered button device:wps, gpio:18,code:529,index:11
    Registered button device:op_mode_1, gpio:13,code:263,index:7
    GACT probability on
    Mirror/redirect action on
    Simple TC action Loaded
    netem: version 1.3
    u32 classifier
        Performance counters on
        input device check on
        Actions configured
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (2500 buckets, 17500 max, 2500 max0, 20000 reserved)
    xt_time: kernel timezone is -0000
    ip_tables: (C) 2000-2006 Netfilter Core Team
    TCP westwood registered
    NET: Registered protocol family 10
    ip6_tables: (C) 2000-2006 Netfilter Core Team
    IPv6 over IPv4 tunneling driver
    NET: Registered protocol family 17
    NET: Registered protocol family 2
    L2TP core driver, V2.0
    8021q: 802.1Q VLAN Support v1.8
    Freeing unused kernel memory: 1788k freed
    System Init version: 1.1 date: 1
    Setting up file systems ...
    Setting up /mnt/tmpfs directory with tmpfs/16384KB
    Setting up FLASH storage partition ...
    JFFS2 notice: (345) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    Setting up /apps directory ...apps is in FLASH ...
    Setting up loopback device ...
    FINISHED
    Start Normal Operation Mode ...
    ************************************************************************
    *                                ---ELX---                             *
    ************************************************************************
    
    KernelApp version: 1.4.0 build date: 2017/10/31 build time: 18:06:42
    cmd> ln: /sbin/./start_all: File exists
    Share memory created:  keyid 6888 shm_id 0 size 208(KB)
    Warning: dbox_destroy_share_memory p_dbox_cfg is NULL!
    nat_session_manager: module license 'unspecified' taints kernel.
    Disabling lock debugging due to kernel taint
    Start nat_session_reservation_init_driver
    __create_share_mem keyid 6888 shm_id 0
     0:1F: 0: 0: 0: 0
    Raeth v3.1 (Tasklet)
    phy_free_head is 0x6c00000!!!
    phy_free_tail_phy is 0x6c01ff0!!!
    txd_pool=a6c1a000 phy_txd_pool=06C1A000
    ei_local->skb_free start address is 0x8703d45c.
    free_txd: 06c1a010, ei_local->cpu_ptr: 06C1A000
     POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
    ----------------+---------+--------
         0xa6c1a000 0x06C1A000 0x06C1A000
    
    phy_qrx_ring = 0x06c02000, qrx_ring = 0xa6c02000
    
    phy_rx_ring0 = 0x073ea000, rx_ring0 = 0xa73ea000
    GMAC1_MAC_ADRH -- : 0x0000001f
    GMAC1_MAC_ADRL -- : 0x00000000
    GDMA2_MAC_ADRH -- : 0x000000aa
    GDMA2_MAC_ADRL -- : 0xbbccdd20
    eth3: ===> VirtualIF_open
    CDMA_CSG_CFG = 81000000
    GDMA1_FWD_CFG = 20710000
    GDMA2_FWD_CFG = 20710000
    ra2880stop()...Done
    eth3: ===> VirtualIF_close
    Free TX/RX Ring Memory!
     0:1F: 0: 0: 0: 0
    Raeth v3.1 (Tasklet)
    phy_free_head is 0x6c24000!!!
    phy_free_tail_phy is 0x6c25ff0!!!
    txd_pool=a733c000 phy_txd_pool=0733C000
    ei_local->skb_free start address is 0x8703d45c.
    free_txd: 0733c010, ei_local->cpu_ptr: 0733C000
     POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
    ----------------+---------+--------
         0xa733c000 0x0733C000 0x0733C000
    
    phy_qrx_ring = 0x07359000, qrx_ring = 0xa7359000
    
    phy_rx_ring0 = 0x073f2000, rx_ring0 = 0xa73f2000
    GMAC1_MAC_ADRH -- : 0x0000001f
    GMAC1_MAC_ADRL -- : 0x00000000
    eth3: ===> VirtualIF_open
    CDMA_CSG_CFG = 81000000
    GDMA1_FWD_CFG = 20710000
    GDMA2_FWD_CFG = 20710000
    GDMA2_MAC_ADRH -- : 0x00003476
    GDMA2_MAC_ADRL -- : 0xc583ba1d
    eth3: ===> VirtualIF_open
    ADDRCONF(NETDEV_UP): br0: link is not ready
    device eth2 entered promiscuous mode
    br0: port 1(eth2) entering forwarding state
    br0: port 1(eth2) entering forwarding state
    
    
    ********************
    Initialize Radio_(24G) setting ... 
    rd[0]==1
    OK
    
    
    Configuring Ralink WiFi device ...Wlan is in
     AP Mode
    CMD[insmod /lib/rlt_wifi.ko]
    register mt_drv
    
    
    === pAd = c0601000, size = 2378520 ===
    
    PciHif.CSRBaseAddress =0xc0500000, csr_addr=0xc0500000!
    RTMPInitPCIeDevice():device_id=0x7615
    DriverOwn()::Try to Clear FW Own...
    DriverOwn()::Success to clear FW Own
    mt_pci_chip_cfg(): HWVer=0x8a10, FWVer=0x8a10, pAd->ChipID=0x7615
    mt_pci_chip_cfg(): HIF_SYS_REV=0x76150001
    RtmpChipOpsHook(492): Not support for HIF_MT yet! MACVersion=0x0
    mt7615_init()-->
    Use 1st ePAeLNA default bin.
    
    Use 2nd ePAeLNA default bin.
    rxq = c0843d84
    ctl->ackq = c0843d90
    ctl->kickq = c0843d9c
    ctl->tx_doneq = c0843da8
    ctl->rx_doneq = c0843db4
    mt7615_fw_prepare():FW(8a10), HW(8a10), CHIPID(7615))
    mt7615_fw_prepare(2356): MT7615_E3, USE E3 patch and ram code binary image
    AndesMTLoadRomMethodFwDlRing(1035), cap->rom_patch_len(3150)
    AndesRestartCheck: Current TOP_MISC2(0x1)
    AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
    20160419154809a
    
    platform = 
    ALPS
    hw/sw version = 
    8a108a10
    patch version = 
    00000010
    Patch SEM Status=2
    MtCmdPatchSemGet:(ret = 0)
    
    Patch is not ready && get semaphore success, SemStatus(2)
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    MtCmdPatchFinishReq
    EventGenericEventHandler: CMD Success
    Send checksum req..
    Patch SEM Status=3
    MtCmdPatchSemGet:(ret = 0)
    
    Release patch semaphore, SemStatus(3)
    AndesMTEraseRomPatch
    AndesMTLoadFwMethodFwDlRing(809), cap->fw_len(452248)
    Build Date:_201609021732
    Build Date:_201609021732
    AndesRestartCheck: Current TOP_MISC2(0x1)
    AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    MtCmdFwStartReq: override = 1, address = 540672
    EventGenericEventHandler: CMD Success
    Build Date:_201607011611
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    MtCmdFwStartReq: override = 4, address = 0
    EventGenericEventHandler: CMD Success
    MCU Init Done!
    efuse_probe: efuse = 10000212
    RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5
    RtmpEepromGetDefault::e2p_dafault=1
    RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1
    NVM is FLASH mode. dev_idx [0] FLASH OFFSET [0x40000]
    NICReadEEPROMParameters: EEPROM 0x52 b307
    MtCmdSetTxLpfCal:(ret = 0)
    MtCmdSetTxIqCal:(ret = 0)
    MtCmdSetTxDcCal:(ret = 0)
    MtCmdSetRxFiCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    Country Region from e2p = 1
    mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4
    rtmp_read_txpwr_from_eeprom(224): Don't Support this now!
    RTMPReadTxPwrPerRate(1381): Don't Support this now!
    RcRadioInit(): DbdcMode=0, ConcurrentBand=1
    RcRadioInit(): pRadioCtrl=878e9438,Band=0,rfcap=3,channel=1,PhyMode=2
    MtCmdSetDbdcCtrl:(ret = 0)
    Band Rf: 1, Phy Mode: 2
    AntCfgInit(2618): Not support for HIF_MT yet!
    MtSingleSkuLoadParam: RF_LOCKDOWN Feature OFF !!!
    MtBfBackOffLoadTable: RF_LOCKDOWN Feature OFF !!!
    EEPROM Init Done!
    mt_mac_init()-->
    mt_mac_pse_init(2715): Don't Support this now!
    mt7615_init_mac_cr()-->
    mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c
    mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c
    MtAsicSetMacMaxLen(1288): Not finish Yet!
    
    ApAutoChannelAtBootUprxq = c0bc3d84
    ctl->ackq = c0bc3d90
    ctl->kickq = c0bc3d9c
    ctl->tx_doneq = c0bc3da8
    ctl->rx_doneq = c0bc3db4
    mt7615_fw_prepare():FW(8a10), HW(8a10), CHIPID(7615))
    mt7615_fw_prepare(2356): MT7615_E3, USE E3 patch and ram code binary image
    AndesMTLoadRomMethodFwDlRing(1035), cap->rom_patch_len(3150)
    AndesRestartCheck: Current TOP_MISC2(0x1)
    AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
    20160419154809a
    
    platform = 
    ALPS
    hw/sw version = 
    8a108a10
    patch version = 
    00000010
    Patch SEM Status=2
    MtCmdPatchSemGet:(ret = 0)
    
    Patch is not ready && get semaphore success, SemStatus(2)
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    MtCmdPatchFinishReq
    EventGenericEventHandler: CMD Success
    Send checksum req..
    Patch SEM Status=3
    MtCmdPatchSemGet:(ret = 0)
    
    Release patch semaphore, SemStatus(3)
    AndesMTEraseRomPatch
    AndesMTLoadFwMethodFwDlRing(809), cap->fw_len(452248)
    Build Date:_201609021732
    Build Date:_201609021732
    AndesRestartCheck: Current TOP_MISC2(0x1)
    AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    MtCmdFwStartReq: override = 1, address = 540672
    EventGenericEventHandler: CMD Success
    Build Date:_201607011611
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    MtCmdFwStartReq: override = 4, address = 0
    EventGenericEventHandler: CMD Success
    MCU Init Done!
    efuse_probe: efuse = 10000212
    RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5
    RtmpEepromGetDefault::e2p_dafault=1
    RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1
    NVM is FLASH mode. dev_idx [1] FLASH OFFSET [0x48000]
    NICReadEEPROMParameters: EEPROM 0x52 b307
    MtCmdSetTxLpfCal:(ret = 0)
    MtCmdSetTxIqCal:(ret = 0)
    MtCmdSetTxDcCal:(ret = 0)
    MtCmdSetRxFiCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    Country Region from e2p = 1
    mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4
    rtmp_read_txpwr_from_eeprom(224): Don't Support this now!
    RTMPReadTxPwrPerRate(1381): Don't Support this now!
    RcRadioInit(): DbdcMode=0, ConcurrentBand=1
    RcRadioInit(): pRadioCtrl=878eb438,Band=0,rfcap=3,channel=1,PhyMode=2
    MtCmdSetDbdcCtrl:(ret = 0)
    Band Rf: 1, Phy Mode: 2
    AntCfgInit(2618): Not support for HIF_MT yet!
    MtSingleSkuLoadParam: RF_LOCKDOWN Feature OFF !!!
    MtBfBackOffLoadTable: RF_LOCKDOWN Feature OFF !!!
    EEPROM Init Done!
    mt_mac_init()-->
    mt_mac_pse_init(2715): Don't Support this now!
    mt7615_init_mac_cr()-->
    mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c
    mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c
    MtAsicSetMacMaxLen(1288): Not finish Yet!
    
    ApAutoChannelAtBootUp VirtualIF_open
    Ebtables v2.0 registered
    __create_share_mem keyid 6888 shm_id 0
    __create_share_mem keyid 6888 shm_id 0
    __create_share_mem keyid 6888 shm_id 0
    Start wps_led driver
    Err: read_to_buf failed to open file /proc/523/status!
    br0: port 1(eth2) entering forwarding state
    eth3: ===> VirtualIF_close
    eth3: ===> VirtualIF_open
    eth3: ===> VirtualIF_close
    eth3: ===> VirtualIF_open
    br0: port 2(ra0) entering forwarding state
    br0: port 3(rai0) entering forwarding state
    
    

WN-AC733GR3

WN-AC1167GRの作業にあたり、factoryファームの生成コードをある程度汎用化したく、おおよそヘッダが似通っているこの機種を確保。基板は9割方ELECOM WRC-733GHBKと同一だった。
弄るにあたってメモ。

Switch

zone WAN LAN
port
(WN-AC733GR3)
インターネット LAN4 LAN3 LAN2 LAN1
port
(RTL8367RB)
port0 port1 port2 port3 port4

MAC

Config (u-boot-env), eeprom内に有。

  • LAN: 34:76:C5:xx:xx:66 (Config, ethaddr (text))
  • WAN: 34:76:C5:xx:xx:65 (Config, wanaddr (text))
  • 2G: 34:76:C5:xx:xx:66 (Factory, 0x4 (hex))
  • 5G: 34:76:C5:xx:xx:67 (iNIC_rf, 0x4 (hex))

U-Boot

  • help
    MT7620 # help
    ?       - alias for 'help'
    bootm   - boot application image from memory
    elx_check      - check ELX image
    go      - start application at address 'addr'
    help    - print online help
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    mw      - memory write (fill)
    nm      - memory modify (constant address)
    printenv- print environment variables
    reset   - Perform RESET of the CPU
    rf      - read/write rf register
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version
    MT7620 # version
    
    U-Boot 1.1.3 (Jan 28 2013 - 19:01:11)
    

  • printenv
    MT7620 # printenv
    bootcmd=tftp
    baudrate=57600
    ethaddr="34:76:C5:**:**:66"
    ramargs=setenv bootargs root=/dev/ram rw
    addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
    addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
    flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
    kernel_addr=BFC40000
    u-boot=u-boot.bin
    load=tftp 8A100000 $(u-boot)
    u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
    loadfs=tftp 8A100000 root.cramfs
    u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
    test_tftp=tftp 8A100000 root.cramfs;run test_tftp
    ethact=Eth0 (10/100-M)
    language_code=jp
    hw_id=01040006
    domain=1
    pincode=01977608
    wlanaddr=00:aa:bb:cc:dd:10
    kver=2.00   
    sn=12345678901234567890123456789012
    usboot=0
    op_mode=1
    bver=4.0.1.5
    dom2=1
    wanaddr=34:76:C5:**:**:65
    bootdelay=2
    filesize=320000
    fileaddr=80A00000
    ipaddr=192.168.99.9
    serverip=192.168.99.8
    autostart=no
    bootfile=uImage_WN-AC733GR
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 1040/4092 bytes
    

Kernel

パスワードが掛けられている。

  • uname -a
    # uname -a
    Linux WN-AC733GR 3.2.9 #3 Mon Dec 2 17:57:37 CST 2013 mips GNU/Linux
    

  • cat /proc/version
    # cat /proc/version
    Linux version 3.2.9 (root@***-pc) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #3 Mon Dec 2 17:57:37 CST 2013
    

  • cat /proc/cpuinfo
    # cat /proc/cpuinfo
    system type             : Ralink MT7620   ver:2 eco:3
    machine                 : Ralink MT7620
    processor               : 0
    cpu model               : MIPS 24Kc V5.0
    BogoMIPS                : 385.02
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
    ASEs implemented        : mips16
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 0
    VCED exceptions         : not available
    VCEI exceptions         : not available
    

  • cat /proc/meminfo
    # cat /proc/meminfo
    MemTotal:          61928 kB
    MemFree:           36104 kB
    Buffers:            2112 kB
    Cached:             8716 kB
    SwapCached:            0 kB
    Active:             5028 kB
    Inactive:           8248 kB
    Active(anon):       2640 kB
    Inactive(anon):      732 kB
    Active(file):       2388 kB
    Inactive(file):     7516 kB
    Unevictable:           0 kB
    Mlocked:               0 kB
    SwapTotal:             0 kB
    SwapFree:              0 kB
    Dirty:                 0 kB
    Writeback:             0 kB
    AnonPages:          2464 kB
    Mapped:             1952 kB
    Shmem:               924 kB
    Slab:               6316 kB
    SReclaimable:        604 kB
    SUnreclaim:         5712 kB
    KernelStack:         672 kB
    PageTables:          452 kB
    NFS_Unstable:          0 kB
    Bounce:                0 kB
    WritebackTmp:          0 kB
    CommitLimit:       30964 kB
    Committed_AS:     349664 kB
    VmallocTotal:    1048372 kB
    VmallocUsed:        3448 kB
    VmallocChunk:    1034964 kB
    

  • cat /proc/mtd
    # cat /proc/mtd
    dev:    size   erasesize  name
    mtd0: 00800000 00001000 "ALL"
    mtd1: 00030000 00001000 "Bootloader"
    mtd2: 00010000 00001000 "Config"
    mtd3: 00008000 00001000 "Factory"
    mtd4: 00008000 00001000 "iNIC_rf"
    mtd5: 006d4000 00001000 "Kernel"
    mtd6: 00584000 00001000 "user"
    mtd7: 0008c000 00001000 "manufacture"
    mtd8: 00010000 00001000 "backup"
    mtd9: 00040000 00001000 "storage"
    

  • ls -al /sys/class/leds/
    # ls -al /sys/class/leds/
    lrwxrwxrwx    1         0 Jan  1  2012 2g_led -> ../../devices/platform/leds-gpio/leds/2g_led
    lrwxrwxrwx    1         0 Jan  1  2012 5g_led -> ../../devices/platform/leds-gpio/leds/5g_led
    lrwxrwxrwx    1         0 Jan  1  2012 status -> ../../devices/platform/leds-gpio/leds/status
    lrwxrwxrwx    1         0 Jan  1  2012 power_led -> ../../devices/platform/leds-gpio/leds/power_led
    drwxr-xr-x   18         0 Jan  1  2012 ..
    drwxr-xr-x    2         0 Jan  1  2012 .
    

  • bootlog (op_mode=1)
    U-Boot 1.1.3 (Jan 28 2013 - 19:01:11)
    
    Board: Ralink APSoC DRAM:  64 MB
    
     Realtek giga Mac init!
    Disable port 0
    Ralink UBoot ver: 4.0.1.0
    ELX UBoot ver: 4.0.1.5 (Jan 28 2013 19:01:11)
    Date:Jan 28 2013  Time:19:01:11
    CPU: 580 MHz, MEM: 64 MB
    
    Please choose the operation: 1, 2, 3, 4, 9
                                                                                                                              0  
       
    3: System Boot system code via Flash.
    ## Booting image at bc050000 ...
       Image Name:   Linux Kernel Image
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    1374857 Bytes =  1.3 MB
       Load Address: 80000000
       Entry Point:  80246300
       Verifying Checksum ... OK
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 80246300) ...
    ## Giving linux memsize in MB, 64
    
    Starting kernel ...
    
    Ralink MT7620   ver:2 eco:3 running at 580.00 MHz
    console [ttyS1] enabled
    System Init version: 1.1 date: 1
    Setting up file systems ...
    Setting up /mnt/tmpfs directory with tmpfs/16384KB
    Setting up FLASH storage partition ...
    Setting up /apps directory ...apps is in FLASH ...
    Setting up loopback device ...
    FINISHED
    Start Normal Operation with Debug Messages ...
    cmd [start_all&]
    cmd [echo 0 > /sys/devices/platform/gpio-keys-polled/disable_intp]
    Application version:2.0.0.1              Date:2013/12/02
    
    ************************************************************************
    *                                ---ELX---                             *
    ************************************************************************
    
    KernelApp version: 2.0.0 build date: 2013/12/02 build time: 17:52:39
    cmd> cmd [sh /tmp/link_apps_to_root_dir.sh $1 $2 > /dev/null]
    ln: /sbin/./start_all: File exists
    cmd [rm -rf /tmp/link_apps_to_root_dir.sh]
    cmd [/sbin/dbox_init]
    ===  DBox Init start ==
    Dbox: used token len/max token len: 23/24, longest one is [wl1qos_priority_control]
    Dbox: used item len/max item len: 187/200
    Share memory created:  keyid 6888 shm_id 0 size 219(KB)
    Warning: dbox_destroy_share_memory p_dbox_cfg is NULL!
    cmd [/sbin/sd  &]
    CMD[mkdir -p /var/sd]
    __create_share_mem keyid 6888 shm_id 0
    CTRL_INTERFACE:[/var/sd_if]  CTRL_INTERFACE_IF:[if0]
    
    System Monitoring
    cmd [/sbin/sd_ctrl start_all]
    name [all]
    name [default]
    name [lo]
    name [imq0]
    name [imq1]
    name [eth2]
    name [eth2.1]
    name [eth2.2]
    name [br0]
    
    
    ********************
    Initialize Radio_(24G) setting ... rd[0]==1
    OK
    
    
    Configuring Ralink WiFi device ...Wlan is in AP Mode
    CMD[insmod /lib/rt2860v2_ap.ko]
    CMD[ifconfig ra0 0.0.0.0 up]
    CMD[iwpriv ra0 set RadioOn=0]
    CMD[ifconfig ra1 0.0.0.0 up]
    CMD[brctl addif br0 ra0]
    CMD[brctl addif br0 ra1]
    CMD[mkdir -p /etc/wsc_xml]
    CMD[ln -s /apps/etc/xml/* /etc/wsc_xml]
    CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
    CMD[wscd -i ra0 -m 1 -w /etc/wsc_xml -a 192.168.0.1&]
    CMD[iwpriv ra0 set IgmpSnEnable=0]
    CMD[iwpriv ra1 set IgmpSnEnable=0]
    CMD[iwpriv ra0 set RadioOn=1]
    CMD[iwpriv ra0 set WscConfMode=7]
    CMD[echo netdev > /sys/class/leds/2g_led/trigger]
    CMD[echo "ra0" > /sys/class/leds/2g_led/device_name]
    CMD[echo "link tx rx"> /sys/class/leds/2g_led/mode]
    CMD[iwpriv ra0 set WscMaxPinAttack=5]
    CMD[iwpriv ra0 set HtMIMOPS=3]
    
    
    ********************
    Initialize Radio_(5G) setting ... rd[1]==1
    OK
    Configuring 5G radio setting ... 
    
    Configuring Ralink WiFi device ...Wlan is in AP Mode
    CMD[insmod /lib/mt7610_ap.ko]
    wscd: SSDP UDP PORT = 1900
    CMD[ifconfig rai0 0.0.0.0 up]
    CMD[iwpriv rai0 set RadioOn=0]
    CMD[brctl addif br0 rai0]
    CMD[mkdir -p /etc/wsc_xml]
    CMD[ln -s /apps/etc/xml/* /etc/wsc_xml]
    ln: /etc/wsc_xml/WFAWLANConfigSCPD.xml: File exists
    CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
    route: SIOCADDRT: File exists
    CMD[wscd -i rai0 -m 1 -w /etc/wsc_xml -a 192.168.0.1&]
    CMD[iwpriv rai0 set IgmpSnEnable=0]
    wscd: SSDP UDP PORT = 1900
    CMD[iwpriv rai0 set RadioOn=1]
    CMD[iwpriv rai0 set WscConfMode=7]
    CMD[echo netdev > /sys/class/leds/5g_led/trigger]
    CMD[echo "rai0" > /sys/class/leds/5g_led/device_name]
    CMD[echo "link tx rx"> /sys/class/leds/5g_led/mode]
    CMD[iwpriv rai0 set WscMaxPinAttack=5]
    CMD[iwpriv rai0 set HtMIMOPS=3]
    --> default
    --> pppoeUnnumberMode 0
    --> DHCP_AR_MODE lan_dhcpd_enable
    WAN Speed = 1000 Mbps
    CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
    route: SIOCADDRT: File exists
    CMD[mkdir -p /etc/linuxigd]
    CMD[ln -sf /apps/etc/linuxigd/* /etc/linuxigd/.]
    CMD[upnpd -f  eth2.2 br0&]
    FAILED
    cmd [/sbin/taskmanager &]
    cmd [/sbin/xcontrol 2>/dev/null &]
    SEM_GETID got id -1
    Err: read_to_buf failed to open file /proc/454/status!
    Err: read_to_buf failed to open file /proc/455/status!
    XControl version: 1.0.0
    [XCONTROL DBG] if_dev_name:[eth2]
    We are using default MAC [00:AA:BB:CC:DD:10]
    server_socket 3
    socket timeout is 300
    WAN Speed = 1000 Mbps
    CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
    route: SIOCADDRT: File exists
    CMD[mkdir -p /etc/linuxigd]
    CMD[ln -sf /apps/etc/linuxigd/* /etc/linuxigd/.]
    send 15 to pid:1076
    CMD[upnpd -f  eth2.2 br0&]
    OK
    *** Task manager starts ***
    taskmanager update modules
    Err: read_to_buf failed to open file /proc/1153/status!
    taskmanager update modules
    failed to read /tmp/task_mgr.conf, use backup file!
    

WN-AC1167GRメモ headerチェック

WN-AC1167GR内の header でファームのヘッダが問題無くチェックをパスできるか確認。

# tftp -r openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin -g 192.168.0.100
# header -x openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin 
### Decoding  image ####
Decode source file [openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin]
------- Header Info -------
Vendor  id:  0x0104
Product id:  0x0016
Hardware id:  0x01040016
Version id:  
Code Version:  
Type: 0x3 [kernel]
comp_file_len:  5505028
comp_file_sum:  0x0
Header sum:  0x0
Magic key:  0x0
MD5 chksum:  90ba7450183602a7cbe542bc1a9b436
------------------------------
Decode finished, got file [openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin.bin] with size 5505028 bytes
header: Return OK

header付加スクリプト

  • TOOLDIRは環境に合わせて書き換え
  • mkhashとxorimageはOpenWrtのfirmware-utilsを使用
  • ファイルサイズとmd5sumの埋め込みはxxd利用するともう少し簡略化できる(たぶん)
  • create_headerの hw_id を変更することで、WN-AC733GRxやWNPR2600G、ELECOMの同様のヘッダを持つ機種にも利用できるかもしれない
#!/bin/bash

TOOLDIR="/home/tofu/routers/firmware-utils"

create_header(){
	fw_bin="$1"
	hw_id="01040016"

	[ -d "$(pwd)/tmp" ] || mkdir $(pwd)/tmp
	( \
		echo -ne "\x00\x00\x00\x00\x00\x00\x00\x03" | \
			dd bs=42 count=1 conv=sync; \
		echo -ne "\x${hw_id:0:2}\x${hw_id:2:2}\x${hw_id:4:2}\x${hw_id:6:2}" | \
			dd bs=20 count=1 conv=sync; \
		echo -ne "$(printf '%08x' $(stat -c%s $fw_bin) | fold -s2 | xargs -I {} echo \\x{} | tr -d '\n')" | \
			dd bs=8 count=1 conv=sync; \
		echo -ne "$(${TOOLDIR}/mkhash md5 $fw_bin | fold -s2 | xargs -I {} echo \\x{} | tr -d '\n')" | \
			dd bs=58 count=1 conv=sync; \
	 ) > ./tmp/header.bin
}

xor_fw(){
	fw_bin="$1"
	xor_key="8844A2D168B45A2D"

	${TOOLDIR}/xorimage -i $fw_bin -o ./tmp/${fw_bin}.xor -p "$xor_key" -x
}

concat_header(){
	fw_bin="$1"
	cat ./tmp/header.bin ./tmp/${fw_bin}.xor > ./tmp/${fw_bin}.new
}

fw_bin=$1

[ -r "$fw_bin" ] && \
create_header $fw_bin && \
xor_fw $fw_bin && \
concat_header $fw_bin && \
cp ./tmp/${fw_bin}.new ./ || \
echo "ERROR"

実行例

./header.sh openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-plain.bin

WN-AC1167GR stock -> OpenWrt

それっぽい感じにヘッダを作り、投げ込めたのでメモ。
“wnac1167gr_v000.bin” というようなファイル名にリネームして放り込む必要がありそうな? → 特にリネームする必要は無かった。

br0: port 4(rai0) entering forwarding state
br0: port 3(ra1) entering forwarding state
br0: port 2(ra0) entering forwarding state
br0: port 1(eth2.1) entering forwarding state
device eth2.1 left promiscuous mode
br0: port 1(eth2.1) entering disabled state
sh: can't kill pid 719: No such process
route: SIOCDELRT: No such process
device ra0 left promiscuous mode
br0: port 2(ra0) entering disabled state
device ra1 left promiscuous mode
br0: port 3(ra1) entering disabled state
device wds0 is not a slave of br0
device wds1 is not a slave of br0
device wds2 is not a slave of br0
device wds3 is not a slave of br0
sh: can't kill pid 811: No such process
route: SIOCDELRT: No such process
device rai0 left promiscuous mode
br0: port 4(rai0) entering disabled state
interface wds4 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
interface wds5 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
interface wds6 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
interface wds7 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
Interface doesn't accept private ioctl...
set (8BE2): Network is down
Interface doesn't accept private ioctl...
set (8BE2): Network is down
Sent SIGKILL to all processes
Requesting system reboot
Restarting system.
Hardware reset!!


U-Boot 1.1.3 (Jul 30 2014 - 21:26:23)

Board: Ralink APSoC DRAM:  64 MB
Ralink UBoot ver: 4.0.1.0
ELX UBoot ver: 4.0.1.6 (Jul 30 2014 21:26:23)
Date:Jul 30 2014  Time:21:26:23
CPU: 580 MHz, MEM: 64 MB
#Reset_MT7530
MT7620N disable wan port phy 0

Please choose the operation: 1, 2, 3, 4, 9
                                                                                                                          0  
   
3: System Boot system code via Flash.
## Booting image at bc070000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.89
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1572544 Bytes =  1.5 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 4.14.89 (musashino205@Taiha.Net) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r0+8844-8b0f1087cc)) #0 Wed Dec 19 14:20:51 2018
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620A ver:2 eco:6
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is I-O DATA WN-AC1167GR
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] random: get_random_bytes called from start_kernel+0x8c/0x474 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=0001af06
[    0.000000] Readback ErrCtl register=0001af06
[    0.000000] Memory: 59792K/65536K available (3650K kernel code, 169K rwdata, 852K rodata, 184K init, 207K bss, 5744K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000011] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015469] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087708] pid_max: default: 32768 minimum: 301
[    0.097110] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.110134] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.130733] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.150215] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.162391] pinctrl core: initialized pinctrl subsystem
[    0.173240] NET: Registered protocol family 16
[    0.664925] PCI host bridge /pcie@10140000 ranges:
[    0.674322]  MEM 0x0000000020000000..0x000000002fffffff
[    0.684696]   IO 0x0000000010160000..0x000000001016ffff
[    0.711848] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.722885] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.735975] PCI host bridge to bus 0000:00
[    0.743971] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.757691] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    0.769418] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.782919] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.799126] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.815680] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.828738] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.842549] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    0.856050] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[    0.870415] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.883925] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[    0.898470] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[    0.912817] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.922669] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
[    0.936186] pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
[    0.954220] clocksource: Switched to clocksource systick
[    0.965893] NET: Registered protocol family 2
[    0.975340] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.989118] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    1.001710] TCP: Hash tables configured (established 1024 bind 1024)
[    1.014493] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.026011] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.038685] NET: Registered protocol family 1
[    1.049988] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    1.062734] Crashlog allocated RAM at address 0x3f00000
[    1.074984] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    1.093443] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.104948] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.134261] io scheduler noop registered
[    1.141907] io scheduler deadline registered (default)
[    1.152969] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.166616] console [ttyS0] disabled
[    1.173609] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[    1.193384] console [ttyS0] enabled
[    1.193384] console [ttyS0] enabled
[    1.207155] bootconsole [early0] disabled
[    1.207155] bootconsole [early0] disabled
[    1.223589] cacheinfo: Failed to find cpu0 device node
[    1.233860] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    1.250494] spi spi0.0: force spi mode3
[    1.258992] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    1.268831] 9 fixed-partitions partitions found on MTD device spi0.0
[    1.281492] Creating 9 MTD partitions on "spi0.0":
[    1.291053] 0x000000000000-0x000000030000 : "u-boot"
[    1.301893] 0x000000030000-0x000000040000 : "u-boot-env"
[    1.313411] 0x000000040000-0x000000048000 : "Factory"
[    1.324481] 0x000000048000-0x000000050000 : "iNIC_rf"
[    1.335451] 0x000000050000-0x000000070000 : "NoUsed"
[    1.346240] 0x000000070000-0x000000724000 : "firmware"
[    1.361495] 2 uimage-fw partitions found on MTD device firmware
[    1.373360] Creating 2 MTD partitions on "firmware":
[    1.383268] 0x000000000000-0x00000017ff00 : "kernel"
[    1.394103] 0x00000017ff00-0x0000006b4000 : "rootfs"
[    1.404891] mtd: device 7 (rootfs) set to be root filesystem
[    1.417780] 1 squashfs-split partitions found on MTD device rootfs
[    1.430170] 0x00000051c000-0x0000006b4000 : "rootfs_data"
[    1.441868] 0x000000724000-0x0000007b0000 : "manufacture"
[    1.453527] 0x0000007b0000-0x0000007c0000 : "backup"
[    1.464422] 0x0000007c0000-0x000000800000 : "storage"
[    1.476152] libphy: Fixed MDIO Bus: probed
[    1.494665] libphy: mdio: probed
[    1.505816] mtk_soc_eth 10100000.ethernet: using fixed link parameters
[    1.520905] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[    1.543657] mtk_soc_eth 10100000.ethernet: loaded mt7530 driver
[    1.556146] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    1.573158] rt2880_wdt 10000120.watchdog: Initialized
[    1.584634] NET: Registered protocol family 10
[    1.598207] Segment Routing with IPv6
[    1.605689] NET: Registered protocol family 17
[    1.614607] 8021q: 802.1Q VLAN Support v1.8
[    1.640878] VFS: Mounted root (squashfs filesystem) readonly on device 31:7.
[    1.655983] Freeing unused kernel memory: 184K
[    1.664861] This architecture does not have kernel memory protection.
[    2.884162] random: fast init done
[    3.376096] init: Console is alive
[    3.383103] init: - watchdog -
[    5.216454] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    5.602456] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.618831] init: - preinit -
[    7.679126] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex)
[    7.695385] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    7.707063] 8021q: adding VLAN 0 to HW filter on device eth0
[    7.718617] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3[    7.881440] random: procd: uninitialized urandom read (4 bytes read)
] or [4] key and hit [enter] to select the debug level
[    8.333303] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    8.382482] urandom-seed: Seed file not found (/etc/urandom.seed)
[    8.477085] mtk_soc_eth 10100000.ethernet eth0: port 5 link down
[    8.500674] procd: - early -
[    8.506519] procd: - watchdog -
[    8.720075] procd: - watchdog -
[    8.726625] procd: - ubus -
[    8.995261] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.119153] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.132436] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.146130] procd: - init -
Please press Enter to activate this console.
[    9.687288] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.912282] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    9.936696] Loading modules backported from Linux version v4.19.7-0-g61c68f2a2af0
[    9.951681] Backport generated by backports.git v4.19.7-1-0-g148b072d
[    9.969253] ip_tables: (C) 2000-2006 Netfilter Core Team
[    9.991331] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[   10.240395] xt_time: kernel timezone is -0000
[   10.405310] mt76x2e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[   10.417917] mt76x2e 0000:01:00.0: ASIC revision: 76120044
[   10.616088] mt76x2e 0000:01:00.0: ROM patch build: 20141115060606a
[   10.634389] mt76x2e 0000:01:00.0: Firmware Version: 0.0.00
[   10.645359] mt76x2e 0000:01:00.0: Build: 1
[   10.653512] mt76x2e 0000:01:00.0: Build Time: 201507311614____
[   10.670106] mt76x2e 0000:01:00.0: Firmware running!
[   10.706126] PPP generic driver version 2.4.2
[   10.723773] NET: Registered protocol family 24
[   10.833645] rt2800_wmac 10180000.wmac: loaded eeprom from mtd device "Factory"
[   10.848119] ieee80211 phy1: rt2x00_set_rt: Info - RT chipset 6352, rev 0500 detected
[   10.863584] ieee80211 phy1: rt2x00_set_rf: Info - RF chipset 7620 detected
[   10.976473] kmodloader: done loading kernel modules from /etc/modules.d/*
[   12.379026] urandom_read: 5 callbacks suppressed
[   12.379035] random: jshn: uninitialized urandom read (4 bytes read)
[   29.231715] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   29.285994] jffs2_build_filesystem(): unlocking the mtd device... 
[   29.286009] done.
[   29.302226] jffs2_build_filesystem(): erasing all blocks after the end marker... 
[   29.579476] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex)
[   29.610524] 8021q: adding VLAN 0 to HW filter on device eth0
[   29.805068] br-lan: port 1(eth0.1) entered blocking state
[   29.815907] br-lan: port 1(eth0.1) entered disabled state
[   29.827089] device eth0.1 entered promiscuous mode
[   29.836692] device eth0 entered promiscuous mode
[   30.020666] br-lan: port 1(eth0.1) entered blocking state
[   30.031498] br-lan: port 1(eth0.1) entered forwarding state
[   30.042845] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   30.611535] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   53.338536] done.
[   53.342445] jffs2: notice: (1277) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   54.227888] overlayfs: upper fs does not support tmpfile.
[   66.595958] random: crng init done



BusyBox v1.29.3 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r0+8851-5827264d5b
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# ubus call system board
{
        "kernel": "4.14.89",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7620A ver:2 eco:6",
        "model": "I-O DATA WN-AC1167GR",
        "board_name": "iodata,wn-ac1167gr",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r0+8851-5827264d5b",
                "target": "ramips\/mt7620",
                "description": "OpenWrt SNAPSHOT r0+8851-5827264d5b"
        }
}

WN-AC1167GR

MT7620機というのをしばらく前に把握し、そのうちやりたいなーと思っていた機種。某所で偶然900円で出品されているのを見つけてしまい、衝動的に購入してしまった。
弄るのでメモ。

Switch

zone WAN LAN
port
(WN-AC1167GR)
インターネット LAN4 LAN3 LAN2 LAN1
port
(MT7530)
port0 port1 port2 port3 port4

MAC

  • Factory, 0x4 (2.4G)
  • iNIC_rf, 0x4 (5G)
  • LAN: 34:76:C5:xx:xx:9A
  • WAN: 34:76:C5:xx:xx:99
  • 2.4G: 34:76:C5:xx:xx:9A
  • 5G: 34:76:C5:xx:xx:9B

U-Boot

  • help
    MT7620 # help
    ?       - alias for 'help'
    bootm   - boot application image from memory
    elx_check      - check ELX image
    go      - start application at address 'addr'
    help    - print online help
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    mw      - memory write (fill)
    nm      - memory modify (constant address)
    printenv- print environment variables
    reset   - Perform RESET of the CPU
    rf      - read/write rf register
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version
    MT7620 # version
    
    U-Boot 1.1.3 (Jul 30 2014 - 21:26:23)
    

  • printenv
    MT7620 # printenv
    bootcmd=tftp
    baudrate=57600
    ethaddr="34:76:C5:**:**:9A"
    ramargs=setenv bootargs root=/dev/ram rw
    addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
    addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
    flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
    kernel_addr=BFC40000
    u-boot=u-boot.bin
    load=tftp 8A100000 $(u-boot)
    u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
    loadfs=tftp 8A100000 root.cramfs
    u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
    test_tftp=tftp 8A100000 root.cramfs;run test_tftp
    ethact=Eth0 (10/100-M)
    language_code=jp
    hw_id=01040016
    domain=1
    pincode=01977608
    wlanaddr=34:76:C5:**:**:9B
    kver=1.02   
    sn=12345678901234567890123456789012
    usboot=0
    dom2=1
    wanaddr=34:76:C5:**:**:99
    bootdelay=2
    filesize=320000
    fileaddr=80A00000
    ipaddr=192.168.99.9
    serverip=192.168.99.8
    autostart=no
    bootfile=uImage_WN-AC1167GR
    op_mode=0
    bver=4.0.1.6
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 1041/4092 bytes
    

Kernel

  • bootlog
    U-Boot 1.1.3 (Jul 30 2014 - 21:26:23)
    
    Board: Ralink APSoC DRAM:  64 MB
    Ralink UBoot ver: 4.0.1.0
    ELX UBoot ver: 4.0.1.6 (Jul 30 2014 21:26:23)
    Date:Jul 30 2014  Time:21:26:23
    CPU: 580 MHz, MEM: 64 MB
    #Reset_MT7530
    MT7620N disable wan port phy 0
    
    Please choose the operation: 1, 2, 3, 4, 9
                                                                                                                                   0  
       
    3: System Boot system code via Flash.
    ## Booting image at bc070000 ...
       Image Name:   Linux Kernel Image
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    1429145 Bytes =  1.4 MB
       Load Address: 80000000
       Entry Point:  80256840
       Verifying Checksum ... OK
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 80256840) ...
    ## Giving linux memsize in MB, 64
    
    Starting kernel ...
    
    Linux version 3.2.9 (root@jim-pc) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #3 Thu Oct 23 09:38:46 CST 2014
     PCIE: bypass PCIe DLL.
     disable all power about PCIe
    CPU revision is: 00019650 (MIPS 24Kc)
    Ralink MT7620   ver:2 eco:6 running at 580.00 MHz
    Determined physical RAM map:
     memory: 04000000 @ 00000000 (usable)
    Initrd not found or empty - disabling initrd
    Zone PFN ranges:
      Normal   0x00000000 -> 0x00004000
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
        0: 0x00000000 -> 0x00004000
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
    Kernel command line:  console=ttyS1,57600 root=/dev/ram0 rootfstype=squashfs,jffs2
    PID hash table entries: 256 (order: -2, 1024 bytes)
    Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
    Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
    Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    Writing ErrCtl register=0001ad00
    Readback ErrCtl register=0001ad00
    Memory: 60672k/65536k available (2428k kernel code, 4864k reserved, 616k data, 1104k init, 0k highmem)
    SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
    NR_IRQS:128
    console [ttyS1] enabled
    Calibrating delay loop... 385.02 BogoMIPS (lpj=770048)
    pid_max: default: 32768 minimum: 301
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    MIPS: machine is Ralink MT7620
    PPLL_CFG1=0xeb4000
    MT7620 PPLL lock
    PPLL_DRV =0x80080504
    start PCIe register access
    mt7620_pci_rr(MT7620_PCI_REG_PCICFG_ADDR):1000f0
    i=0,1
    registering PCI controller with io_map_base unset
    bio: create slab  at 0
    SCSI subsystem initialized
    pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
    pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
    pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
    pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff])
    pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
    pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff 64bit] (PCI address [0x20000000-0x200fffff])
    pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
    pci 0000:00:00.0: PCI bridge to [bus 01-01]
    pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
    pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
    Switching to clocksource MIPS
    NET: Registered protocol family 2
    IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    TCP established hash table entries: 2048 (order: 2, 16384 bytes)
    TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
    TCP: Hash tables configured (established 2048 bind 2048)
    TCP reno registered
    UDP hash table entries: 256 (order: 0, 4096 bytes)
    UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    NET: Registered protocol family 1
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
    msgmni has been set to 118
    io scheduler noop registered
    io scheduler deadline registered
    io scheduler cfq registered (default)
    Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
    serial8250: ttyS0 at MMIO 0x10000500 (irq = 13) is a 16550A
    serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
    loop: module loaded
    deice id : c2 20 17 c2 20 (2017c220)
    MX25L6405D(c2 2017c220) (8192 Kbytes)
    mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00001000 (4K) .numeraseregions = 0
    Creating 11 MTD partitions on "raspi":
    0x000000000000-0x000000800000 : "ALL"
    0x000000000000-0x000000030000 : "Bootloader"
    0x000000030000-0x000000040000 : "Config"
    0x000000040000-0x000000048000 : "Factory"
    0x000000048000-0x000000050000 : "iNIC_rf"
    0x000000050000-0x000000070000 : "NoUsed"
    0x000000070000-0x000000744000 : "Kernel"
    0x0000001cd000-0x000000744000 : "user"
    0x000000724000-0x0000007b0000 : "manufacture"
    0x0000007b0000-0x0000007c0000 : "backup"
    0x0000007c0000-0x000000800000 : "storage"
    IMQ driver loaded successfully. (numdevs = 2, numqueues = 1)
            Hooking IMQ after NAT on PREROUTING.
            Hooking IMQ before NAT on POSTROUTING.
    SMACCR1 -- : 0x000000aa
    SMACCR0 -- : 0xbbccdd10
    Ralink APSoC Ethernet Driver Initilization. v3.1  512 rx/tx descriptors allocated, mtu = 1500!
    SMACCR1 -- : 0x000000aa
    SMACCR0 -- : 0xbbccdd10
    PROC INIT OK!
    PPP generic driver version 2.4.2
    PPP BSD Compression module registered
    PPP Deflate Compression module registered
    PPP MPPE Compression module registered
    NET: Registered protocol family 24
    Registered button device:reset, gpio:2,code:408,index:10
    Registered button device:wps, gpio:1,code:529,index:11
    Registered button device:opmode_1, gpio:12,code:263,index:7
    Registered button device:, gpio:0,code:264,index:8
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (2500 buckets, 19800 max, 200 max0, 20000 reserved)
    xt_time: kernel timezone is -0000
    ip_tables: (C) 2000-2006 Netfilter Core Team
    TCP westwood registered
    NET: Registered protocol family 17
    L2TP core driver, V2.0
    8021q: 802.1Q VLAN Support v1.8
    Freeing unused kernel memory: 1104k freed
    System Init version: 1.1 date: 1
    Setting up file systems ...
    Setting up /mnt/tmpfs directory with tmpfs/16384KB
    Setting up FLASH storage partition ...
    JFFS2 notice: (320) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    Setting up /apps directory ...apps is in FLASH ...
    Setting up loopback device ...
    FINISHED
    Start Normal Operation Mode ...
    ************************************************************************
    *                                ---ELX---                             *
    ************************************************************************
    
    KernelApp version: 1.2.1 build date: 2014/10/23 build time: 09:36:45
    cmd> ln: /sbin/./start_all: File exists
    nat_session_manager: module license 'unspecified' taints kernel.
    Disabling lock debugging due to kernel taint
    Start nat_session_reservation_init_driver
    Raeth v3.1 (Tasklet)
    
    phy_tx_ring = 0x032c6000, tx_ring = 0xa32c6000
    
    phy_rx_ring0 = 0x032dc000, rx_ring0 = 0xa32dc000
    SMACCR1 -- : 0x000000aa
    SMACCR0 -- : 0xbbccdd10
    ESW: Link Status Changed - Port5 Link UP
    CDMA_CSG_CFG = 81000000
    GDMA1_FWD_CFG = 20710000
    device eth2 entered promiscuous mode
    device eth2.1 entered promiscuous mode
    br0: port 1(eth2.1) entering forwarding state
    br0: port 1(eth2.1) entering forwarding state
    device eth2.2 entered promiscuous mode
    br0: port 2(eth2.2) entering forwarding state
    br0: port 2(eth2.2) entering forwarding state
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    0x1300 = 00064380
    device ra0 entered promiscuous mode
    br0: port 3(ra0) entering forwarding state
    br0: port 3(ra0) entering forwarding state
    device ra1 entered promiscuous mode
    br0: port 4(ra1) entering forwarding state
    br0: port 4(ra1) entering forwarding state
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
    create [wsc_5g] proc!
    device rai0 entered promiscuous mode
    br0: port 5(rai0) entering forwarding state
    br0: port 5(rai0) entering forwarding state
    ln: /etc/wsc_xml/WFAWLANConfigSCPD.xml: File exists
    route: SIOCADDRT: File exists
    
    
    
    
    
    
    
    
    
    
    
    Ebtables v2.0 registered
    Start wps_led driver
    br0: port 1(eth2.1) entering forwarding state
    br0: port 2(eth2.2) entering forwarding state
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    br0: port 3(ra0) entering forwarding state
    br0: port 4(ra1) entering forwarding state
    br0: port 5(rai0) entering forwarding state
    cat: can't open '/var/run/upnpd.pid': No such file or directory
    route: SIOCDELRT: No such process
    device ra0 left promiscuous mode
    br0: port 3(ra0) entering forwarding state
    device ra1 left promiscuous mode
    br0: port 4(ra1) entering forwarding state
    device wds0 is not a slave of br0
    device wds1 is not a slave of br0
    device wds2 is not a slave of br0
    device wds3 is not a slave of br0
    RtmpOSNetDevDetach(): RtmpOSNetDeviceDetach(), dev->name=ra0!
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    0x1300 = 00064380
    device ra0 entered promiscuous mode
    br0: port 3(ra0) entering forwarding state
    br0: port 3(ra0) entering forwarding state
    device ra1 entered promiscuous mode
    br0: port 4(ra1) entering forwarding state
    br0: port 4(ra1) entering forwarding state
    ln: /etc/wsc_xml/WFAWLANConfigSCPD.xml: File exists
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    device rai0 left promiscuous mode
    br0: port 5(rai0) entering forwarding state
    interface wds4 does not exist!
    ifconfig: SIOCGIFFLAGS: No such device
    interface wds5 does not exist!
    ifconfig: SIOCGIFFLAGS: No such device
    interface wds6 does not exist!
    ifconfig: SIOCGIFFLAGS: No such device
    interface wds7 does not exist!
    ifconfig: SIOCGIFFLAGS: No such device
    RtmpOSNetDevDetach(): RtmpOSNetDeviceDetach(), dev->name=rai0!
    Unregister PCI device driver
    create [wsc_5g] proc!
    device rai0 entered promiscuous mode
    br0: port 5(rai0) entering forwarding state
    br0: port 5(rai0) entering forwarding state
    ln: /etc/wsc_xml/WFAWLANConfigSCPD.xml: File exists
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    br0: port 3(ra0) entering forwarding state
    br0: port 4(ra1) entering forwarding state
    br0: port 5(rai0) entering forwarding state
    

WRC-733GHBK

10/05にフラッと行ったハードオフ越谷花田店で、偶然見つけたもの。以前調べてMT7620ということを把握しており、GbEということもあってそのうちやっておこうかなーと思っていたため、衝動的に購入してしまった。税込540円、ACアダプタ付。
弄っていくのでメモ。

Switch

zone WAN LAN
port
(WRC-733GHBK)
INTERNET LAN4 LAN3 LAN2 LAN1
port
(RTL8367RB)
port0 port1 port2 port3 port4

MAC

hwconfigパーティション内に格納されている

  • LAN: HW.LAN.MAC.Address
  • WAN: HW.WAN.MAC.Address
  • 2G: HW.LAN.2G.0.MAC.Address
  • 5G: HW.LAN.5G.0.MAC.Address
  • LAN: xx:xx:xx:xx:xx:E5
  • WAN: xx:xx:xx:xx:xx:E4
  • 2G: xx:xx:xx:xx:xx:E6
  • 5G: xx:xx:xx:xx:xx:E7

U-Boot

  • help
    MT7620 # help
    ?       - alias for 'help'
    bootm   - boot application image from memory
    cp      - memory copy
    erase   - erase SPI FLASH memory
    go      - start application at address 'addr'
    help    - print online help
    loadb   - load binary file over serial line (kermit mode)
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    nm      - memory modify (constant address)
    printenv- print environment variables
    reset   - Perform RESET of the CPU
    rf      - read/write rf register
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version
    MT7620 # version
    
    U-Boot 1.1.3 (Jul 10 2014 - 16:50:54)
    

  • printenv
    MT7620 # printenv
    bootcmd=tftp
    bootdelay=3
    baudrate=57600
    ethaddr="00:AA:BB:CC:DD:10"
    ipaddr=192.168.2.81
    serverip=192.168.2.89
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 151/4092 bytes
    

Kernel

パスワードが掛けられており、コンソールにログインできない

  • bootlog
    U-Boot 1.1.3 (Jul 10 2014 - 16:50:54)
    
    Board: Ralink APSoC DRAM:  64 MB
    relocate_code Pointer at: 83fac000
    enable ephy clock...done. rf reg 29 = 5
    SSC disabled.
    ******************************
    Software System Reset Occurred
    ******************************
    spi_wait_nsec: 29 
    spi device id: c2 20 17 c2 20 (2017c220)
    find flash: MX25L6405D
    raspi_read: from:30000 len:1000 
    *** Warning - bad CRC, using default environment
    
    ============================================ 
    Ralink UBoot Version: 4.1.2.0
    -------------------------------------------- 
    ASIC 7620_MP (Port5GigaSW)
    DRAM component: 512 Mbits DDR, width 16
    DRAM bus: 16 bit
    Total memory: 64 MBytes
    Flash component: SPI Flash
    Date:Jul 10 2014  Time:16:50:54
    ============================================ 
    icache: sets:512, ways:4, linesz:32 ,total:65536
    dcache: sets:256, ways:4, linesz:32 ,total:32768 
    
     ##### The CPU freq = 580 MHZ #### 
     estimate memory size =64 Mbytes
    
     Realtek giga Mac init!
    
     Realtek giga Mac done!
    
    Please choose the operation: 
       1: Load system code to SDRAM via TFTP. 
       2: Load system code then write to Flash via TFTP. 
       3: Boot system code via Flash (default).
       4: Entr boot command line interface.
       5: Load ucos code to SDRAM via TFTP Client. 
       7: Load Boot Loader code then write to Flash via Serial. 
       9: Load Boot Loader code then write to Flash via TFTP. 
                                                                                                                              0  
       
    3: System Boot system code via Flash.
    ## Booting image at bc070000 ...
    raspi_read: from:70000 len:40 
    Magic number at 0xBC070000 
    raspi_read: from:70014 len:40 
       Image Name:   Linux Kernel Image
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    4313004 Bytes =  4.1 MB
       Load Address: 80000000
       Entry Point:  8000c3b0
    raspi_read: from:70054 len:41cfac 
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 8000c3b0) ...
    ## Giving linux memsize in MB, 64
    
    Starting kernel ...
    
    
    LINUX started...
    
     THIS IS ASIC
    Linux version 2.6.36 (root@localhost.localdomain) (gcc version 3.4.2) #425 Fri Sep 19 17:53:19 CST 2014
    
     The CPU feqenuce set to 580 MHz
    
     MIPS CPU sleep mode enabled.
     PCIE: bypass PCIe DLL.
     PCIE: Elastic buffer control: Addr:0x68 -> 0xB4
     disable all power about PCIe
    CPU revision is: 00019650 (MIPS 24Kc)
    Software DMA cache coherency
    Determined physical RAM map:
     memory: 04000000 @ 00000000 (usable)
    Zone PFN ranges:
      Normal   0x00000000 -> 0x00004000
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
        0: 0x00000000 -> 0x00004000
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
    Kernel command line: console=ttyS1,57600n8 root=1f05 console=ttyS0
    PID hash table entries: 256 (order: -2, 1024 bytes)
    Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
    Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
    Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    Writing ErrCtl register=00078974
    Readback ErrCtl register=00078974
    Memory: 61456k/65536k available (2385k kernel code, 4080k reserved, 646k data, 180k init, 0k highmem)
    NR_IRQS:128
    Console: colour dummy device 80x25
    console [ttyS1] enabled
    Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
    pid_max: default: 32768 minimum: 301
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    RALINK_GPIOMODE = 1a311d
    RALINK_GPIOMODE = 18311d
    PPLL_CFG1=0xf14000
    MT7620 PPLL lock
    PPLL_DRV =0x80080504
    start PCIe register access
    RALINK_RSTCTRL = 2400000
    RALINK_CLKCFG1 = 75afffc0
    
    *************** MT7620 PCIe RC mode *************
    PCIE0 enabled
    init_rt2880pci done
    bio: create slab  at 0
    vgaarb: loaded
    pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
    pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
    pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
    pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff]
    pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
    pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff] (PCI address [0x20000000-0x200fffff]
    pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff]
    pci 0000:01:00.1: BAR 0: set to [mem 0x20100000-0x201fffff] (PCI address [0x20100000-0x201fffff]
    pci 0000:00:00.0: PCI bridge to [bus 01-01]
    pci 0000:00:00.0:   bridge window [io  disabled]
    pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
    pci 0000:00:00.0:   bridge window [mem pref disabled]
    BAR0 at slot 0 = 0
    bus=0x0, slot = 0x0
    res[0]->start = 0
    res[0]->end = 0
    res[1]->start = 20200000
    res[1]->end = 2020ffff
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    bus=0x1, slot = 0x0
    res[0]->start = 20000000
    res[0]->end = 200fffff
    res[1]->start = 0
    res[1]->end = 0
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    bus=0x1, slot = 0x0
    res[0]->start = 20100000
    res[0]->end = 201fffff
    res[1]->start = 0
    res[1]->end = 0
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    Switching to clocksource Ralink Systick timer
    NET: Registered protocol family 2
    IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    TCP established hash table entries: 2048 (order: 2, 16384 bytes)
    TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
    TCP: Hash tables configured (established 2048 bind 2048)
    TCP reno registered
    UDP hash table entries: 256 (order: 0, 4096 bytes)
    UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    NET: Registered protocol family 1
    Load Kernel WDG Timer Module
    Load Ralink Timer0 Module
    VFS: Disk quotas dquot_6.5.2
    Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    msgmni has been set to 120
    alg: No test for stdrng (krng)
    io scheduler noop registered (default)
    Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
    serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
    serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
    brd: module loaded
    deice id : c2 20 17 c2 20 (2017c220)
    MX25L6405D(c2 2017c220) (8192 Kbytes)
    mtd .name = raspi, .size = 0x00800000 (0M) .erasesize = 0x00000008 (0K) .numeraseregions = 65536
    Creating 8 MTD partitions on "raspi":
    0x000000000000-0x000000030000 : "Bootloader"
    0x000000030000-0x000000040000 : "Config"
    0x000000040000-0x000000050000 : "Factory"
    0x000000050000-0x000000070000 : "nvram"
    0x000000070000-0x000000180000 : "Kernel"
    0x000000180000-0x0000007f0000 : "RootFS"
    0x0000007f0000-0x000000800000 : "hwconfig"
    0x000000070000-0x0000007f0000 : "Uimage"
    rdm_major = 254
    SMACCR1 -- : 0x0000000c
    SMACCR0 -- : 0x43762077
    Ralink APSoC Ethernet Driver Initilization. v3.0  256 rx/tx descriptors allocated, mtu = 1500!
    SMACCR1 -- : 0x0000000c
    SMACCR0 -- : 0x43762077
    PROC INIT OK!
    PPP generic driver version 2.4.2
    PPP BSD Compression module registered
    NET: Registered protocol family 24
    PPTP driver version 0.8.5
    i8042.c: i8042 controller self test timeout.
    Trying to free nonexistent resource 
    mice: PS/2 mouse device common for all mice
    Ralink APSoC Hardware Watchdog Timer
    u32 classifier
        Performance counters on
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (960 buckets, 3840 max)
    ctnetlink v0.93: registering with nfnetlink.
    matchsize=264
    xt_time: kernel timezone is -0000
    GRE over IPv4 demultiplexor driver
    gre: can't add protocol
    ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
    TCP cubic registered
    NET: Registered protocol family 17
    dnshijack
    802.1Q VLAN Support v1.8 Ben Greear 
    All bugs added by David S. Miller 
    VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
    Freeing unused kernel memory: 180k freed
    init started: BusyBox v1.12.1 (2014-04-28 14:42:24 CST)
    starting pid 27, tty '': '/etc/init.d/rcS sysinit'
    rc ver. 1.0.3
    Initializing...Success!
    Mounting file systems...Success!
    Creating devices...Success!
    Creating loopback device...Success!
    starting pid 34, tty '': '/etc/init.d/rcS start'
    rc ver. 1.0.3
    Initializing...Success!
    Loading dynamic libraries...Success!
    edx_gpio: module license 'unspecified' taints kernel.
    Disabling lock debugging due to kernel taint
    Initializing EDX GPIO...Done
    Acelink events notification ver. 1.6
    argv[0]=/sbin/ev_broker i=5 class=2 paction=NETDEV_REGISTER hold=
    NVRAM access daemon Ver. 1.0 Build 20140919151150
    daemonizAlgorithmics/MIPS FPU Emulator v1.5
    e process
    argv[0]=/sbin/ev_broker i=5 class=2 paction=NETDEV_UP hold=
    argv[0]=/sbin/ev_broker i=5 class=2 paction=NETDEV_REGISTER hold=
    Starting L0000Config.so...Done ! (ret=0)
    Starting L0100WLANInterface.so...Done ! (ret=0)
    Starting L0130EthInterface.so...Done ! (ret=0)
    Starting L0200LANConfig.so...Done ! (ret=0)
    1970-01-01 00:00:25: (server.c.915) can't have more connections than fds/2:  1024 824 
    start lld2d...
    udhcpd: max_leases=235 is too big, setting to 101
    start child_net...
    start house_keeper...
    Starting L0230LANServices.so...Done ! (ret=0)
    Starting L0300WANConfig.so...Done ! (ret=0)
    
    Please press Enter to activate this console. starting wan_event...
    wan_event done !
    Notice: caching turned off
    Notice: caching turned off
    starting wan_event...
    wan_event done !
    starting wan_event...
    udhcpc receive a leasefail for eth2.2
    wan_event done !
    

CG-WLR300GNE

三郷のハードオフで、USB搭載かつGbE対応ながらジャンク税込540円と安かったので購入。

U-Boot

  • help
    RT3052 # help
    loopback   - Ralink eth loopback test !!
    ?       - alias for 'help'
    boot    - boot default, i.e., run 'bootcmd'
    bootd   - boot default, i.e., run 'bootcmd'
    bootm   - boot application image from memory
    bootp   - boot image via network using BootP/TFTP protocol
    cp      - memory copy
    echo    - echo args to console
    erase   - erase FLASH memory
    go      - start application at address 'addr'
    help    - print online help
    httpd - Gemtek httpd
    loadb   - load binary file over serial line (kermit mode)
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    mw      - memory write (fill)
    nm      - memory modify (constant address)
    printenv- print environment variables
    protect - enable or disable FLASH write protection
    reset   - Perform RESET of the CPU
    run     - run commands in an environment variable
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    spicmd  - read/write data from/to eeprom or vtss
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version
    RT3052 # version
    
    U-Boot 1.1.3 (Jan 21 2010 - 20:51:46)
    

  • printenv
    RT3052 # printenv
    bootcmd=tftp
    bootdelay=1
    baudrate=57600
    ethaddr="00:AA:BB:CC:DD:10"
    ipaddr=192.168.1.1
    serverip=192.168.1.5
    preboot=echo;echo
    bootfile="uboot.bin"
    ramargs=setenv bootargs root=/dev/ram rw
    addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
    addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
    flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
    kernel_addr=BFC40000
    u-boot=u-boot.bin
    load=tftp 8A100000 $(u-boot)
    u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
    loadfs=tftp 8A100000 root.cramfs
    u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
    test_tftp=tftp 8A100000 root.cramfs;run test_tftp
    stdin=serial
    stdout=serial
    stderr=serial
    ethact=Eth0 (10/100-M)
    
    Environment size: 804/65532 bytes
    

Kernel

  • uname -a
    # uname -a
    Linux CG-WLR300GNE 2.6.21 #30 Thu Mar 3 11:39:19 CST 2011 mips unknown
    

  • cat /proc/version
    # cat /proc/version
    Linux version 2.6.21 (*****_***@cvs4) (gcc version 3.4.2) #30 Thu Mar 3 11:39:19 CST 2011
    

  • cat /proc/cpuinfo
    # cat /proc/cpuinfo
    system type             : Ralink SoC
    processor               : 0
    cpu model               : MIPS 24K V4.12
    BogoMIPS                : 212.99
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes
    ASEs implemented        : mips16 dsp
    VCED exceptions         : not available
    VCEI exceptions         : not available
    

  • cat /proc/meminfo
    # cat /proc/meminfo
    MemTotal:        60764 kB
    MemFree:         45804 kB
    Buffers:          1568 kB
    Cached:           5520 kB
    SwapCached:          0 kB
    Active:           3664 kB
    Inactive:         4888 kB
    SwapTotal:           0 kB
    SwapFree:            0 kB
    Dirty:               0 kB
    Writeback:           0 kB
    AnonPages:        1496 kB
    Mapped:           2084 kB
    Slab:             4876 kB
    SReclaimable:     1100 kB
    SUnreclaim:       3776 kB
    PageTables:        288 kB
    NFS_Unstable:        0 kB
    Bounce:              0 kB
    CommitLimit:     30380 kB
    Committed_AS:     8044 kB
    VmallocTotal:  1048404 kB
    VmallocUsed:     17132 kB
    VmallocChunk:  1031236 kB
    

  • cat /proc/mtd
    # cat /proc/mtd
    dev:    size   erasesize  name
    mtd0: 00060000 00010000 "uBoot"
    mtd1: 00180000 00010000 "Linux Kernel"
    mtd2: 00600000 00010000 "RootFS"
    mtd3: 00010000 00010000 "NVRAM"
    mtd4: 00010000 00010000 "NVRAM_FACTORY"
    

  • bootlog
    U-Boot 1.1.3 (Jan 21 2010 - 20:51:46)
    
    Board: Ralink APSoC DRAM:  64 MB
    relocate_code Pointer at: 83f98000
    board.c->board_init_r(1168),isolate WAN Port traffic from LAN Port
    flash_protect ON: from 0xBF000000 to 0xBF03446B
    protect on 0
    protect on 1
    protect on 2
    protect on 3
    protect on 4
    protect on 5
    protect on 6
    protect on 7
    protect on 8
    protect on 9
    protect on 10
    flash_protect ON: from 0xBF040000 to 0xBF04FFFF
    protect on 11
    *** Warning - bad CRC, using default environment
    
    ============================================ 
    Ralink UBoot Version : 3.3
    UBoot Release Version: 1.0.4_20100121
    -------------------------------------------- 
    ASIC 3052_MP2 (Port5GigaSW)
    DRAM COMPONENT: 256Mbits 
    DRAM BUS: 32BIT 
    Total memory: 64 MBytes
    Date:Jan 21 2010  Time:20:51:46
    ============================================ 
    icache: sets:256, ways:4, linesz:32 ,total:32768
    dcache: sets:128, ways:4, linesz:32 ,total:16384 
    
     ##### The CPU freq = 320 MHZ #### 
    
     SDRAM bus set to 32 bit 
     SDRAM size =64 Mbytes
    
    Please choose the operation: 
       1: Load system code to SDRAM via TFTP. 
       2: Load system code then write to Flash via TFTP. 
       3: Boot system code via Flash (default).
       4: Entr boot command line interface.
       9: Load Boot Loader code then write to Flash via TFTP. 
                                                                                                                               0 
       
    3: System Boot system code via Flash.
    
     eth_register  
    Eth0 (10/100-M)
     enetvar=ethaddr,Eth addr:00:AA:BB:CC:DD:10
     00:AA:BB:CC:DD:10:
    
     eth_current->name = Eth0 (10/100-M)
    
    ## Booting image at bf060000 ...
       Image Name:   Linux Kernel Image
       Created:      2011-03-03   3:43:41 UTC
    
     System Control Status = 0x10400000 
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    6598592 Bytes =  6.3 MB
       Load Address: 80000000
       Entry Point:  803e1000
       Verifying Checksum ... OK
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 803e1000) ...
    ## Giving linux memsize in MB, 64
    
    Starting kernel ...
    
    
    LINUX started...
    
     THIS IS ASIC
    Linux version 2.6.21 (terry_kuo@cvs4) (gcc version 3.4.2) #30 Thu Mar 3 11:39:19 CST 2011
    
     The CPU feqenuce set to 320 MHz
    CPU revision is: 0001964c
    Determined physical RAM map:
     memory: 04000000 @ 00000000 (usable)
    Built 1 zonelists.  Total pages: 16256
    Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock2
    Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
    Primary data cache 16kB, 4-way, linesize 32 bytes.
    Synthesized TLB refill handler (20 instructions).
    Synthesized TLB load handler fastpath (32 instructions).
    Synthesized TLB store handler fastpath (32 instructions).
    Synthesized TLB modify handler fastpath (31 instructions).
    Cache parity protection disabled
    cause = 800000, status = 1100ff00
    PID hash table entries: 256 (order: 8, 1024 bytes)
    calculating r4koff... 00138800(1280000)
    CPU frequency 320.00 MHz
    Using 160.000 MHz high precision timer.
    Console: colour dummy device 80x25
    Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
    Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
    Memory: 60580k/65536k available (3299k kernel code, 4900k reserved, 668k data, 128k init, 0k highmem)
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    SCSI subsystem initialized
    usbcore: registered new interface driver usbfs
    usbcore: registered new interface driver hub
    usbcore: registered new device driver usb
    NET: Registered protocol family 2
    Time: MIPS clocksource has been installed.
    IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    TCP established hash table entries: 2048 (order: 2, 16384 bytes)
    TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
    TCP: Hash tables configured (established 2048 bind 2048)
    TCP reno registered
    squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
    squashfs: LZMA suppport for slax.org by jro
    NTFS driver 2.1.28 [Flags: R/O].
    fuse init (API version 7.8)
    io scheduler noop registered (default)
    FLASH_API: MAN_ID=C2 DEV_ID=22CB SIZE=8MB
    Ralink gpio driver initialized
    StatusLEDThread pid : 125
    Initialziing the INTERNET LED control module ... successful
    Initialziing the WSC LED control module ... successful
    Initialziing the LED control module ... successful
    Initialziing the USB LED control module ... successful
    Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
    serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
    serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
    loop: loaded (max 8 devices)
    smi_major=249
    0 smi_init check[0x05c]1=0x5937
    rdm_major = 254
    GDMA1_MAC_ADRH -- : 0x00000000
    GDMA1_MAC_ADRL -- : 0x00000000
    Ralink APSoC Ethernet Driver Initilization. v1.60  128 rx/tx descriptors allocated, mtu = 1500!
    NAPI enable, weight = 0, Tx Ring = 128, Rx Ring = 128
    GDMA1_MAC_ADRH -- : 0x0000000c
    GDMA1_MAC_ADRL -- : 0x43305277
    PROC INIT OK!
    PPP generic driver version 2.4.2
    PPP BSD Compression module registered
    NET: Registered protocol family 24
    
    
    === pAd = c0000000, size = 501392 ===
    
    <-- RTMPAllocAdapterBlock, Status=0
    ralink flash device: 0x1000000 at 0xbf000000
    Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
     Amd/Fujitsu Extended Query Table at 0x0040
    number of CFI chips: 1
    cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
    Creating 5 MTD partitions on "Ralink SoC physically mapped flash":
    0x00000000-0x00060000 : "uBoot"
    0x00060000-0x001e0000 : "Linux Kernel"
    0x001e0000-0x007e0000 : "RootFS"
    0x007e0000-0x007f0000 : "NVRAM"
    0x007f0000-0x00800000 : "NVRAM_FACTORY"
    block2mtd: version $Revision: 1.1.1.1 $
    usbmon: debugfs is not available
    116x: driver isp116x-hcd, 03 Nov 2005
    sl811: driver sl811-hcd, 19 May 2005
    Initializing USB Mass Storage driver...
    usbcore: registered new interface driver usb-storage
    USB Mass Storage support registered.
    usbcore: registered new interface driver usbhid
    drivers/usb/input/hid-core.c: v2.6:USB HID core driver
    dwc_otg: version 2.60a 22-NOV-2006
    DWC_otg: Using DMA mode
    dwc_otg lm0: DWC OTG Controller
    dwc_otg lm0: new USB bus registered, assigned bus number 1
    dwc_otg lm0: irq 18, io mem 0x00000000
    DWC_otg: Init: Port Power? op_state=1
    DWC_otg: Init: Power Port (0)
    usb usb1: configuration #1 chosen from 1 choice
    hub 1-0:1.0: USB hub found
    hub 1-0:1.0: 1 port detected
    nf_conntrack version 0.5.0 (512 buckets, 4096 max)
    GRE over IPv4 tunneling driver
    ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Fully Cone
    ClusterIP Version 0.8 loaded successfully
    arp_tables: (C) 2002 David S. Miller
    TCP cubic registered
    NET: Registered protocol family 1
    NET: Registered protocol family 17
    802.1Q VLAN Support v1.8 Ben Greear 
    All bugs added by David S. Miller 
    VFS: Mounted root (squashfs filesystem) readonly.
    Freeing unused kernel memory: 128k freed
    (main)336
    Algorithmics/MIPS FPU Emulator v1.5
    init: cannot open inittab
    toks= /bin/sh (null) (null) (null)
    tty= console
    termcap= linux
    
    
    BusyBox v1.8.2 (2011-03-03 11:39:42 CST) built-in shell (ash)
    Enter 'help' for a list of built-in commands.
    
    # #sysinit: [sysinit] 
    ftok: No such file or directory
    msgget: No such file or directory
    [sighandler]: No more events to be processed, quitting.
    [cleanup]: Waiting for children.
    [cleanup]: All children terminated.
    WriteDataIntoFileUnderProc : open file (/proc/LED_Force_Mode) ... failed
    !!!!!!!!!!!! WriteDataIntoFileUnderProc : /proc/LED_Force_Mode ... failed !!!!!!!!!!!!
    # update nvram with default list!
    Fri Jan  1 00:00:00 UTC 2010
    RTL8366 reg 0x5C=[0x5937]
    wan enabled : Init RTL8366RB!!
    switch reg write offset=98, value=7f40
    switch reg write offset=e4, value=20
    rmmod: rtl8366RB
    0 smi_init check[0x0105]=0x0000
    0 smi_init check[0x0105]=0x0000
    0 smi_init check[0x0509]=0x5937
    0 rtl8366rb_initChip
    0 smi_init check[0x0509]1=0x5937
    0 smi_init check[0x050a]1=0x0003
    Gemtek Link status init.
    Gemtek Ethernet Port control init.
    Gemtek LED control init.
    rtl8368s_setAsicMaxLengthInRx(3) SUCCESS!
    RTL_GET_GREEN_ETHERNET Success!!!
    RTL_GET_GREEN_ETHERNET : tx is 0, rx is -2084296544
    RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.0, enabled : 1 !!!
    RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.1, enabled : 1 !!!
    RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.2, enabled : 1 !!!
    RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.3, enabled : 1 !!!
    RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.4, enabled : 1 !!!
    rtl:rtl_ge_read : 0
    RTL_SET_GREEN_ETHERNET Success!!!
    RTL_GET_GREEN_ETHERNET Success!!!
    RTL_GET_GREEN_ETHERNET : tx is 1, rx is -2129651776
    RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.0, enabled : 1 !!!
    RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.1, enabled : 1 !!!
    RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.2, enabled : 1 !!!
    RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.3, enabled : 1 !!!
    RTL_GET_GREEN_ETHERNET : rtl8368s_getAsicPowerSaving is phyNo.4, enabled : 1 !!!
    rtl:rtl_ge_read : 0
    switch reg write offset=94, value=7f00
    switch reg write offset=90, value=f807f7f
    Enter LAN parsing ...
    Set LAN MAC=00:26:87:11:2C:8C
    Setting ra0 ra1 configuration...
    ra0       mac:
    [0x0000102c]:44031e46  
    rt2860apd: no 'radius' string found, no need to start...
    Start cat ====================
    iwpriv ra0 set Debug=0 
    End cat ======================
    wps_utility : init mode
    rmmod: hw_nat
    libupnp: using UDP SSDP_PORT = 1900
    Get Chipset from flash:AR2318
    iptbl: creating tables..
    iptbl: created tables!
    LANPortPriority Disabled
    write_proc_LANPortPriority = 00000
    Start UPnP
    dnsmasq: started, version 2.33 cachesize 150
    dnsmasq: compile time options: IPv6 GNU-getopt no-ISC-leasefile no-DBus no-I18N 
    dnsmasq: read /tmp/CustomerDotHomeIP - 1 addresses
    dlna_autoip_coordinator: failed to locate udhcpc...
    ifconfig: ioctl 0x8914 failed: Cannot assign requested address
    httpd : This is httpd...no SSL support
    mac clone is disabled, mac_clone_mac=00:26:87:11:2C:8D
    killall: DMS: no process killed
    off
    AP/Router DIP Switch : on
    on
    

WRC-2533GST

何かあるかなーと訪れたハードオフ花小金井店で、WRC-1750GS辺りかなと思った¥5,000のルータがWRC-2533GSTだったので、衝動的に購入。弄るにあたってメモ。

Switch

zone WAN LAN
port
(WRC-2533GST)
INTERNET LAN4 LAN3 LAN2 LAN1
port
(MT7530)
port0 port1 port2 port3 port4

MAC

  • LAN: xx:xx:xx:xx:xx:23
  • WAN: xx:xx:xx:xx:xx:24
  • 2.4G: xx:xx:xx:xx:xx:25
  • 5G: xx:xx:xx:xx:xx:26

U-Boot

  • help
    MT7621 # help
    ?       - alias for 'help'
    bootm   - boot application image from memory
    cp      - memory copy
    erase   - erase SPI FLASH memory
    go      - start application at address 'addr'
    help    - print online help
    httpboot- entering the backup mode.
    loadb   - load binary file over serial line (kermit mode)
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    nm      - memory modify (constant address)
    printenv- print environment variables
    reset   - Perform RESET of the CPU
    rf      - read/write rf register
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    spi     - spi command
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version
    MT7621 # version
    
    U-Boot 1.1.3 (Aug 11 2017 - 22:15:36)
    

  • printenv
    MT7621 # printenv
    bootcmd=tftp
    bootdelay=5
    baudrate=57600
    ethaddr="00:AA:BB:CC:DD:10"
    ipaddr=192.168.2.1
    serverip=192.168.2.2
    model_id=WRC-2533GST
    board_id=201791707070
    wlan0_guest_ssid=e-tomo-aa9323
    wlan0_guest_key=********
    wlan0_ssid=elecom2g-aa9323
    wlan1_ssid=elecom5g-aa9323
    wlan0_key=************
    wlan1_key=************
    wps_pin=********
    hw_version=A1
    wlan0_domain=0x41
    stdin=serial
    stdout=serial
    stderr=serial
    ethact=Eth0 (10/100-M)
    
    Environment size: 420/4092 bytes
    

Kernel

  • uname -a
    root@WRC-2533GST:/# uname -a
    Linux WRC-2533GST 3.10.14+ #1 SMP Tue Dec 26 17:12:40 CST 2017 mips GNU/Linux

  • cat /proc/version
    root@WRC-2533GST:/# cat /proc/version
    Linux version 3.10.14+ (*****@ubuntu) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 SMP Tue Dec 26 17:12:40 CST 2017
    

  • cat /proc/cpuinfo
    root@WRC-2533GST:/# cat /proc/cpuinfo
    system type             : MT7621
    machine                 : Unknown
    processor               : 0
    cpu model               : MIPS 1004Kc V2.15
    BogoMIPS                : 583.68
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
    isa                     : mips1 mips2 mips32r1 mips32r2
    ASEs implemented        : mips16 dsp mt
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 0
    VPE                     : 0
    VCED exceptions         : not available
    VCEI exceptions         : not available
    
    processor               : 1
    cpu model               : MIPS 1004Kc V2.15
    BogoMIPS                : 583.68
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
    isa                     : mips1 mips2 mips32r1 mips32r2
    ASEs implemented        : mips16 dsp mt
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 0
    VPE                     : 1
    VCED exceptions         : not available
    VCEI exceptions         : not available
    
    processor               : 2
    cpu model               : MIPS 1004Kc V2.15
    BogoMIPS                : 583.68
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
    isa                     : mips1 mips2 mips32r1 mips32r2
    ASEs implemented        : mips16 dsp mt
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 1
    VPE                     : 0
    VCED exceptions         : not available
    VCEI exceptions         : not available
    
    processor               : 3
    cpu model               : MIPS 1004Kc V2.15
    BogoMIPS                : 583.68
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
    isa                     : mips1 mips2 mips32r1 mips32r2
    ASEs implemented        : mips16 dsp mt
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 1
    VPE                     : 1
    VCED exceptions         : not available
    VCEI exceptions         : not available
    

  • cat /proc/meminfo
    root@WRC-1167GHBK2-S:/# cat /proc/meminfo 
    root@WRC-2533GST:/# cat /proc/meminfo
    MemTotal:         124024 kB
    MemFree:           69872 kB
    Buffers:            3928 kB
    Cached:            11476 kB
    SwapCached:            0 kB
    Active:             6304 kB
    Inactive:          11180 kB
    Active(anon):       2124 kB
    Inactive(anon):      156 kB
    Active(file):       4180 kB
    Inactive(file):    11024 kB
    Unevictable:           0 kB
    Mlocked:               0 kB
    SwapTotal:             0 kB
    SwapFree:              0 kB
    Dirty:                 0 kB
    Writeback:             0 kB
    AnonPages:          2108 kB
    Mapped:             1300 kB
    Shmem:               200 kB
    Slab:              17668 kB
    SReclaimable:       1864 kB
    SUnreclaim:        15804 kB
    KernelStack:         616 kB
    PageTables:          348 kB
    NFS_Unstable:          0 kB
    Bounce:                0 kB
    WritebackTmp:          0 kB
    CommitLimit:       62012 kB
    Committed_AS:       6700 kB
    VmallocTotal:    1048372 kB
    VmallocUsed:       16068 kB
    VmallocChunk:    1018556 kB
    

  • cat /proc/mtd
    root@WRC-2533GST:/# cat /proc/mtd
    dev:    size   erasesize  name
    mtd0: 01000000 00010000 "ALL"
    mtd1: 00030000 00010000 "Bootloader"
    mtd2: 00010000 00010000 "Config"
    mtd3: 00010000 00010000 "Factory"
    mtd4: 00b00000 00010000 "firmware"
    mtd5: 00200000 00010000 "kernel"
    mtd6: 00900000 00010000 "rootfs"
    mtd7: 00380000 00010000 "tm_pattern"
    mtd8: 00080000 00010000 "tm_key"
    mtd9: 00030000 00010000 "art_block"
    mtd10: 00080000 00010000 "rootfs_data"
    

  • bootlog
    ===================================================================
                    MT7621   stage1 code 10:33:55 (ASIC)
                    CPU=500000000 HZ BUS=166666666 HZ
    ==================================================================
    Change MPLL source from XTAL to CR...
    do MEMPLL setting..
    MEMPLL Config : 0x11000000
    3PLL mode + External loopback
    === XTAL-40Mhz === DDR-1200Mhz ===
    PLL4 FB_DL: 0x10, 1/0 = 722/302 41000000
    PLL3 FB_DL: 0x12, 1/0 = 775/249 49000000
    PLL2 FB_DL: 0x1a, 1/0 = 555/469 69000000
    do DDR setting..[01F40000]
    Apply DDR3 Setting...(use default AC)
              0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
          --------------------------------------------------------------------------------
    0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    1    1
    000E:|    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1    1
    000F:|    0    0    0    0    1    1    1    1    1    1    1    1    1    1    0    0
    0010:|    1    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0
    0011:|    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0
    0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    rank 0 coarse = 15
    rank 0 fine = 72
    B:|    0    0    0    0    0    0    0    0    0    0    1    1    1    0    0    0
    opt_dle value:11
    DRAMC_R0DELDLY[018]=00001E1E
    ==================================================================
                    RX      DQS perbit delay software calibration 
    ==================================================================
    1.0-15 bit dq delay value
    ==================================================================
    bit|     0  1  2  3  4  5  6  7  8  9
    --------------------------------------
    0 |    12 10 10 12 7 9 9 8 8 9 
    10 |    10 11 9 12 10 10 
    --------------------------------------
    
    ==================================================================
    2.dqs window
    x=pass dqs delay value (min~max)center 
    y=0-7bit DQ of every group
    input delay:DQS0 =30 DQS1 = 30
    ==================================================================
    bit     DQS0     bit      DQS1
    0  (1~58)29  8  (1~55)28
    1  (1~57)29  9  (1~56)28
    2  (1~56)28  10  (1~59)30
    3  (1~59)30  11  (1~58)29
    4  (1~56)28  12  (1~57)29
    5  (1~58)29  13  (1~56)28
    6  (1~55)28  14  (1~59)30
    7  (1~58)29  15  (1~58)29
    ==================================================================
    3.dq delay value last
    ==================================================================
    bit|    0  1  2  3  4  5  6  7  8   9
    --------------------------------------
    0 |    13 11 12 12 9 10 11 9 10 11 
    10 |    10 12 10 14 10 11 
    ==================================================================
    ==================================================================
         TX  perbyte calibration 
    ==================================================================
    DQS loop = 15, cmp_err_1 = ffff0000 
    dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 
    dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 
    DQ loop=15, cmp_err_1 = ffff0000
    dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1 
    dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2 
    byte:0, (DQS,DQ)=(8,8)
    byte:1, (DQS,DQ)=(8,8)
    20,data:88
    [EMI] DRAMC calibration passed
    
    ===================================================================
                    MT7621   stage1 code done 
                    CPU=500000000 HZ BUS=166666666 HZ
    ===================================================================
    
    
    U-Boot 1.1.3 (Aug 11 2017 - 22:15:36)
    
    Board: Ralink APSoC DRAM:  128 MB
    relocate_code Pointer at: 87fb4000
    
    Config XHCI 40M PLL 
    ******************************
    Software System Reset Occurred
    ******************************
    flash manufacture id: c2, device id 20 18
    find flash: MX25L12805D
    ============================================ 
    Ralink UBoot Version: 5.0.0.0
    -------------------------------------------- 
    ASIC MT7621A DualCore (MAC to MT7530 Mode)
    DRAM_CONF_FROM: Auto-Detection 
    DRAM_TYPE: DDR3 
    DRAM bus: 16 bit
    Xtal Mode=3 OCP Ratio=1/3
    Flash component: SPI Flash
    Date:Aug 11 2017  Time:22:15:36
    ============================================ 
    icache: sets:256, ways:4, linesz:32 ,total:32768
    dcache: sets:256, ways:4, linesz:32 ,total:32768 
    
     ##### The CPU freq = 880 MHZ #### 
     estimate memory size =128 Mbytes
    #Reset_MT7530
    set LAN/WAN WLLLL
    
    Please choose the operation: 
       1: Load system code to SDRAM via TFTP. 
       2: Load system code then write to Flash via TFTP. 
       3: Boot system code via Flash (default).
       4: Entr boot command line interface.
       7: Load Boot Loader code then write to Flash via Serial. 
       9: Load Boot Loader code then write to Flash via TFTP. 
    
    You choosed 3
    
                                                                                                                               0 
       
    3: System Boot system code via Flash.
    ## Booting image at bc050000 ...
       Image Name:   MIPS OpenWrt Linux-3.10
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    9306048 Bytes =  8.9 MB
       Load Address: 81001000
       Entry Point:  8143aab0
       Verifying Checksum ... OK
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 8143aab0) ...
    ## Giving linux memsize in MB, 128
    
    Starting kernel ...
    
    
    LINUX started...
    
     THIS IS ASIC
    
    SDK 5.0.S.0
    [    0.000000] Linux version 3.10.14+ (eason@ubuntu) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 SMP Tue Dec 26 17:12:40 CST 2017
    [    0.000000] 
    [    0.000000]  The CPU feqenuce set to 880 MHz
    [    0.000000] GCMP present
    [    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
    [    0.000000] Software DMA cache coherency
    [    0.000000] Determined physical RAM map:
    [    0.000000]  memory: 08000000 @ 00000000 (usable)
    [    0.000000] Initrd not found or empty - disabling initrd
    [    0.000000] Zone ranges:
    [    0.000000]   DMA      [mem 0x00000000-0x00ffffff]
    [    0.000000]   Normal   [mem 0x01000000-0x07ffffff]
    [    0.000000] Movable zone start for each node
    [    0.000000] Early memory node ranges
    [    0.000000]   node   0: [mem 0x00000000-0x07ffffff]
    [    0.000000] Detected 3 available secondary CPU(s)
    [    0.000000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
    [    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    [    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
    [    0.000000] PERCPU: Embedded 7 pages/cpu @816e7000 s6592 r8192 d13888 u32768
    [    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
    [    0.000000] Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock6 init=/etc/preinit
    [    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
    [    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
    [    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
    [    0.000000] Writing ErrCtl register=00014700
    [    0.000000] Readback ErrCtl register=00014700
    [    0.000000] Memory: 123780k/131072k available (4367k kernel code, 7292k reserved, 1205k data, 244k init, 0k highmem)
    [    0.000000] Hierarchical RCU implementation.
    [    0.000000] NR_IRQS:128
    [    0.000000] console [ttyS1] enabled
    [    0.120000] Calibrating delay loop... 577.53 BogoMIPS (lpj=1155072)
    [    0.160000] pid_max: default: 32768 minimum: 301
    [    0.164000] Mount-cache hash table entries: 512
    [    0.168000] launch: starting cpu1
    [    0.172000] launch: cpu1 gone!
    [    0.172000] CPU1 revision is: 0001992f (MIPS 1004Kc)
    [    0.172000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
    [    0.172000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    [    0.172000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
    [    0.204000] Synchronize counters for CPU 1: done.
    [    0.212000] launch: starting cpu2
    [    0.216000] launch: cpu2 gone!
    [    0.216000] CPU2 revision is: 0001992f (MIPS 1004Kc)
    [    0.216000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
    [    0.216000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    [    0.216000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
    [    0.248000] Synchronize counters for CPU 2: done.
    [    0.256000] launch: starting cpu3
    [    0.260000] launch: cpu3 gone!
    [    0.260000] CPU3 revision is: 0001992f (MIPS 1004Kc)
    [    0.260000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
    [    0.260000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    [    0.260000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
    [    0.288000] Synchronize counters for CPU 3: done.
    [    0.296000] Brought up 4 CPUs
    [    0.300000] devtmpfs: initialized
    [    0.304000] NET: Registered protocol family 16
    [    0.604000] release PCIe RST: RALINK_RSTCTRL = 7000000
    [    0.608000] PCIE PHY initialize
    [    0.612000] ***** Xtal 40MHz *****
    [    0.616000] start MT7621 PCIe register access
    [    1.208000] RALINK_RSTCTRL = 7000000
    [    1.212000] RALINK_CLKCFG1 = 77ffeff8
    [    1.216000] 
    [    1.216000] *************** MT7621 PCIe RC mode *************
    [    1.712000] PCIE2 no card, disable it(RST&CLK)
    [    1.716000] pcie_link status = 0x3
    [    1.720000] RALINK_RSTCTRL= 3000000
    [    1.724000] *** Configure Device number setting of Virtual PCI-PCI bridge ***
    [    1.728000] RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2
    [    1.732000] PCIE0 enabled
    [    1.736000] PCIE1 enabled
    [    1.740000] interrupt enable status: 300000
    [    1.744000] Port 1 N_FTS = 1b105000
    [    1.748000] Port 0 N_FTS = 1b105000
    [    1.752000] config reg done
    [    1.756000] init_rt2880pci done
    [    1.772000] bio: create slab  at 0
    [    1.776000] vgaarb: loaded
    [    1.780000] SCSI subsystem initialized
    [    1.784000] PCI host bridge to bus 0000:00
    [    1.788000] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
    [    1.792000] pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
    [    1.796000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
    [    1.800000] pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
    [    1.804000] pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000)
    [    1.808000] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
    [    1.812000] pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff]
    [    1.816000] pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff]
    [    1.820000] pci 0000:00:01.0: BAR 1: assigned [mem 0x60210000-0x6021ffff]
    [    1.824000] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
    [    1.828000] pci 0000:00:00.0: PCI bridge to [bus 01]
    [    1.832000] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
    [    1.836000] pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff 64bit]
    [    1.840000] pci 0000:00:01.0: PCI bridge to [bus 02]
    [    1.844000] pci 0000:00:01.0:   bridge window [mem 0x60100000-0x601fffff]
    [    1.848000] BAR0 at slot 0 = 0
    [    1.852000] bus=0x0, slot = 0x0
    [    1.856000] res[0]->start = 0
    [    1.860000] res[0]->end = 0
    [    1.864000] res[1]->start = 60200000
    [    1.868000] res[1]->end = 6020ffff
    [    1.872000] res[2]->start = 0
    [    1.876000] res[2]->end = 0
    [    1.880000] res[3]->start = 0
    [    1.884000] res[3]->end = 0
    [    1.888000] res[4]->start = 0
    [    1.892000] res[4]->end = 0
    [    1.896000] res[5]->start = 0
    [    1.900000] res[5]->end = 0
    [    1.904000] BAR0 at slot 1 = 0
    [    1.908000] bus=0x0, slot = 0x1
    [    1.912000] res[0]->start = 0
    [    1.916000] res[0]->end = 0
    [    1.920000] res[1]->start = 60210000
    [    1.924000] res[1]->end = 6021ffff
    [    1.928000] res[2]->start = 0
    [    1.932000] res[2]->end = 0
    [    1.936000] res[3]->start = 0
    [    1.940000] res[3]->end = 0
    [    1.944000] res[4]->start = 0
    [    1.948000] res[4]->end = 0
    [    1.952000] res[5]->start = 0
    [    1.956000] res[5]->end = 0
    [    1.960000] bus=0x1, slot = 0x0, irq=0x4
    [    1.964000] res[0]->start = 60000000
    [    1.968000] res[0]->end = 600fffff
    [    1.972000] res[1]->start = 0
    [    1.976000] res[1]->end = 0
    [    1.980000] res[2]->start = 0
    [    1.984000] res[2]->end = 0
    [    1.988000] res[3]->start = 0
    [    1.992000] res[3]->end = 0
    [    1.996000] res[4]->start = 0
    [    2.000000] res[4]->end = 0
    [    2.004000] res[5]->start = 0
    [    2.008000] res[5]->end = 0
    [    2.012000] bus=0x2, slot = 0x1, irq=0x18
    [    2.016000] res[0]->start = 60100000
    [    2.020000] res[0]->end = 601fffff
    [    2.024000] res[1]->start = 0
    [    2.028000] res[1]->end = 0
    [    2.032000] res[2]->start = 0
    [    2.036000] res[2]->end = 0
    [    2.040000] res[3]->start = 0
    [    2.044000] res[3]->end = 0
    [    2.048000] res[4]->start = 0
    [    2.052000] res[4]->end = 0
    [    2.056000] res[5]->start = 0
    [    2.060000] res[5]->end = 0
    [    2.064000] Switching to clocksource MIPS
    [    2.068000] NET: Registered protocol family 2
    [    2.076000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
    [    2.092000] TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
    [    2.104000] TCP: Hash tables configured (established 1024 bind 1024)
    [    2.116000] TCP: reno registered
    [    2.124000] UDP hash table entries: 256 (order: 1, 8192 bytes)
    [    2.136000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
    [    2.148000] NET: Registered protocol family 1
    [    2.156000] RPC: Registered named UNIX socket transport module.
    [    2.168000] RPC: Registered udp transport module.
    [    2.176000] RPC: Registered tcp transport module.
    [    2.188000] RPC: Registered tcp NFSv4.1 backchannel transport module.
    [    2.288000] 4 CPUs re-calibrate udelay(lpj = 1167360)
    [    2.300000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
    [    2.312000] jffs2: version 2.2. (NAND) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
    [    2.332000] fuse init (API version 7.22)
    [    2.340000] msgmni has been set to 241
    [    2.348000] io scheduler noop registered (default)
    [    2.360000] reg_int_mask=0, INT_MASK= 0 
    [    2.368000] HSDMA_init
    [    2.372000] 
    [    2.372000]  hsdma_phy_tx_ring0 = 0x00c00000, hsdma_tx_ring0 = 0xa0c00000
    [    2.388000] 
    [    2.388000]  hsdma_phy_rx_ring0 = 0x00c04000, hsdma_rx_ring0 = 0xa0c04000
    [    2.404000] TX_CTX_IDX0 = 0
    [    2.412000] TX_DTX_IDX0 = 0
    [    2.416000] RX_CRX_IDX0 = 3ff
    [    2.424000] RX_DRX_IDX0 = 0
    [    2.428000] set_fe_HSDMA_glo_cfg
    [    2.436000] HSDMA_GLO_CFG = 465
    [    2.444000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
    [    2.456000] serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A
    [    2.468000] serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A
    [    2.484000] Ralink gpio driver initialized
    [    2.496000] brd: module loaded
    [    2.504000] flash manufacture id: c2, device id 20 18
    [    2.512000] MX25L12805D(c2 2018c220) (16384 Kbytes)
    [    2.524000] mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
    [    2.544000] Creating 11 MTD partitions on "raspi":
    [    2.552000] 0x000000000000-0x000001000000 : "ALL"
    [    2.564000] 0x000000000000-0x000000030000 : "Bootloader"
    [    2.572000] 0x000000030000-0x000000040000 : "Config"
    [    2.584000] 0x000000040000-0x000000050000 : "Factory"
    [    2.596000] 0x000000050000-0x000000b50000 : "firmware"
    [    2.604000] 0x000000050000-0x000000250000 : "kernel"
    [    2.616000] 0x000000250000-0x000000b50000 : "rootfs"
    [    2.628000] 0x000000b50000-0x000000ed0000 : "tm_pattern"
    [    2.636000] 0x000000ed0000-0x000000f50000 : "tm_key"
    [    2.648000] 0x000000f50000-0x000000f80000 : "art_block"
    [    2.660000] 0x000000f80000-0x000001000000 : "rootfs_data"
    [    2.672000] PPP generic driver version 2.4.2
    [    2.680000] PPP BSD Compression module registered
    [    2.688000] PPP MPPE Compression module registered
    [    2.700000] NET: Registered protocol family 24
    [    2.708000] PPTP driver version 0.8.5
    [    2.716000] rdm_major = 253
    [    2.720000] GMAC1_MAC_ADRH -- : 0x0000bc5c
    [    2.728000] GMAC1_MAC_ADRL -- : 0x4caa9323
    [    2.736000] Ralink APSoC Ethernet Driver Initilization. v3.1  1024 rx/tx descriptors allocated, mtu = 1500!
    [    2.756000] [LOG]|WIRE| LAN Starting
    [    2.764000] GMAC1_MAC_ADRH -- : 0x0000bc5c
    [    2.772000] GMAC1_MAC_ADRL -- : 0x4caa9323
    [    2.780000] PROC INIT OK!
    [    2.784000] nf_conntrack version 0.5.0 (1934 buckets, 7736 max)
    [    2.796000] xt_time: kernel timezone is -0000
    [    2.808000] gre: GRE over IPv4 demultiplexor driver
    [    2.816000] ip_tables: (C) 2000-2006 Netfilter Core Team
    [    2.828000] Type=Restricted Cone
    [    2.832000] TCP: cubic registered
    [    2.840000] NET: Registered protocol family 10
    [    2.848000] sit: IPv6 over IPv4 tunneling driver
    [    2.860000] NET: Registered protocol family 17
    [    2.868000] Bridge firewalling registered
    [    2.876000] Ebtables v2.0 registered
    [    2.884000] l2tp_core: L2TP core driver, V2.0
    [    2.892000] l2tp_ppp: PPPoL2TP kernel driver, V2.0
    [    2.900000] l2tp_netlink: L2TP netlink interface
    [    2.912000] 8021q: 802.1Q VLAN Support v1.8
    [    2.928000] VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
    [    2.944000] devtmpfs: mounted
    [    2.952000] Freeing unused kernel memory: 244K (81573000 - 815b0000)
    - preinit -
    Press the [f] key and hit [enter] to enter failsafe mode
    - regular preinit -
    [    7.164000] jffs2: notice: (119) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 17 of xref (0 dead, 9 orphan) found.
    switching to jffs2
    - init -
    
    Please press Enter to activate this console. [   10.316000] ip_gre: GRE over IPv4 tunneling driver
    [   10.388000] bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
    [   10.704000] /proc/router_ip created
    [   10.844000] nf_nat_amanda: Unknown symbol nf_nat_amanda_hook (err 0)
    [   10.964000] Netfilter messages via NETLINK v0.30.
    [   11.140000] ip6_tables: (C) 2000-2006 Netfilter Core Team
    [   11.248000] ctnetlink v0.93: registering with nfnetlink.
    [   14.932000] #########>> ei_open 3378: -2014085120 call work scheduler   FFFFFFBC:5C:4C:FFFFFFAA:FFFFFF93:23
    [   14.952000] Raeth v3.1 (Tasklet)
    [   14.960000] set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1
    [   14.976000] phy_free_head is 0xc08000!!!
    [   14.984000] phy_free_tail_phy is 0xc09ff0!!!
    [   14.992000] txd_pool=a0c10000 phy_txd_pool=00C10000
    [   15.000000] ei_local->skb_free start address is 0x87f3a6dc.
    [   15.012000] free_txd: 00c10010, ei_local->cpu_ptr: 00C10000
    [   15.024000]  POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
    [   15.032000] ----------------+---------+--------
    [   15.040000]      0xa0c10000 0x00C10000 0x00C10000
    [   15.052000] 
    [   15.052000] phy_qrx_ring = 0x00c0a000, qrx_ring = 0xa0c0a000
    [   15.068000] 
    [   15.068000] phy_rx_ring0 = 0x00c0c000, rx_ring0 = 0xa0c0c000
    [   15.104000] MT7530 Reset Completed!!
    [   15.116000] change HW-TRAP to 0x117c8f
    [   15.124000] set LAN/WAN WLLLL
    [   15.136000] GMAC1_MAC_ADRH -- : 0x0000bc5c
    [   15.144000] GMAC1_MAC_ADRL -- : 0x4caa9323
    [   15.152000] GDMA2_MAC_ADRH -- : 0x0000bc5c
    [   15.160000] GDMA2_MAC_ADRL -- : 0x4caa9324
    [   15.168000] eth3: ===> VirtualIF_open
    [   15.176000] MT7621 GE2 link rate to 1G
    [   15.184000] CDMA_CSG_CFG = 81000000
    [   15.192000] GDMA1_FWD_CFG = 20710000
    [   15.196000] GDMA2_FWD_CFG = 20710000
    [   15.204000] #########>> int_gpio_workqueue 3335: return 0[   15.224000] eth3: ===> VirtualIF_open
    [   16.380000] IPv6: ADDRCONF(NETDEV_UP): lo: link is not ready
    [   16.392000] eth3: ===> VirtualIF_close
    [   16.400000] IPv6: ADDRCONF(NETDEV_UP): eth3: link is not ready
    
    [   16.420000] ra2880stop()...Done
    [   16.424000] eth3: ===> VirtualIF_close
    [   16.436000] Free TX/RX Ring Memory!
    [   16.444000] IPv6: ADDRCONF(NETDEV_UP): eth2: link is not ready
    [   16.460000] #########>> ei_open 3378: -2014085120 call work scheduler   FFFFFFBC:5C:4C:FFFFFFAA:FFFFFF93:23
    [   16.480000] Raeth v3.1 (Tasklet)
    [   16.488000] set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1
    [   16.504000] phy_free_head is 0xc08000!!!
    [   16.512000] phy_free_tail_phy is 0xc09ff0!!!
    [   16.520000] txd_pool=a0c10000 phy_txd_pool=00C10000
    [   16.528000] ei_local->skb_free start address is 0x87f3a6dc.
    [   16.540000] free_txd: 00c10010, ei_local->cpu_ptr: 00C10000
    [   16.552000]  POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
    [   16.560000] ----------------+---------+--------
    [   16.572000]      0xa0c10000 0x00C10000 0x00C10000
    [   16.580000] 
    [   16.580000] phy_qrx_ring = 0x00c0a000, qrx_ring = 0xa0c0a000
    [   16.596000] 
    [   16.596000] phy_rx_ring0 = 0x00c0c000, rx_ring0 = 0xa0c0c000
    [   16.632000] MT7530 Reset Completed!!
    [   16.644000] change HW-TRAP to 0x117c8f
    [   16.652000] set LAN/WAN WLLLL
    [   16.664000] GMAC1_MAC_ADRH -- : 0x0000bc5c
    [   16.672000] GMAC1_MAC_ADRL -- : 0x4caa9323
    [   16.680000] eth3: ===> VirtualIF_open
    [   16.688000] MT7621 GE2 link rate to 1G
    [   16.688000] CDMA_CSG_CFG = 81000000
    [   16.688000] GDMA1_FWD_CFG = 20710000
    [   16.688000] GDMA2_FWD_CFG = 20710000
    [   16.688000] device eth2 entered promiscuous mode
    [   16.688000] br-lan: port 1(eth2) entered forwarding state
    [   16.688000] br-lan: port 1(eth2) entered forwarding state
    [   16.688000] eth3: ===> VirtualIF_open
    [   18.696000] br-lan: port 1(eth2) entered forwarding state
    [   19.620000] [LOG]|WIRE| LAN - Port4 Link UP
    [   16.688000] #########>> int_gpio_workqueue 3335: return 0KERNEL_PANIC_COUNT=
    dnsmasq
    dnsmasq [br-lan]
    [   25.952000] mt_wifi: module license 'Proprietary' taints kernel.
    [   25.964000] Disabling lock debugging due to kernel taint
    [   26.076000] register mt_drv
    [   26.096000] pAd->PciHif.CSRBaseAddress =0xc1380000, csr_addr=0xc1380000!
    [   26.108000] DriverOwn()::Try to Clear FW Own...
    [   26.472000] DriverOwn()::Success to clear FW Own
    [   26.484000] ChipOpsMCUHook
    [   26.516000] pAd->PciHif.CSRBaseAddress =0xc1980000, csr_addr=0xc1980000!
    [   26.528000] DriverOwn()::Try to Clear FW Own...
    [   26.884000] DriverOwn()::Success to clear FW Own
    [   26.892000] ChipOpsMCUHook
    UHTTP crt Checked
    main init
    main init
    page=[/setup/index.html]
    count=[43]
    page=[/setup/index.html]
    count=[43]
    ip6d.c[94] XXXXXXXXXXX  Starting ip6d  XXXXXXXXXXXX
    firewall.c[563] Start IPv6 Firewall
    firewall.c[831] flush_ip6tables
    route.c[33] Start IPv6 Static Routing
    wlan_wps.c:get_wifi_pin_code:132:ioctl error
    wlan_wps.c:get_wifi_pin_code:132:ioctl error
    [   33.612000] Ralink HW NAT Module Enabled
    [   33.624000] eth2 ifindex =2
    [   33.628000] eth3 ifindex =7
    ip6d.c[145] create IP6D_READY
    connect.c[168] XXX disconnect
    connect.c[227] IPv6 Link Local Mode
    connect.c[168] XXX disconnect
    [   37.820000] jffs2: notice: (3159) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    [   38.896000] jffs2: notice: (3232) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    [   39.844000] DriverOwn()::Return since already in Driver Own...
    [   39.860000] RT_CfgSetMacAddress : invalid length (0)
    [   39.880000] default ApCliAPSDCapable[0]=0
    [   39.888000] default ApCliAPSDCapable[1]=0
    [   39.916000] [PMF]Set_PMFMFPC_Proc:: apidx=0, Desired MFPC=0
    [   39.940000] AndesSendCmdMsg: Could not send in band command due to diablefRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD
    [   40.016000] AndesRestartCheck: Current TOP_MISC2(0x1)
    [   40.040000] WfMcuHwInit: Before NICLoadFirmware, check IcapMode=0
    [   40.052000] AndesRestartCheck: Current TOP_MISC2(0x1)
    [   40.176000] WfMcuHwInit: NICLoadFirmware OK, Check IcapMode=0
    [   40.188000] efuse_probe: efuse = 10000212
    start ddns
    [   40.748000] mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4
    [   40.760000] mt7615_antenna_default_reset(): DBDC 2G TxPath = 2, 2G RxPath = 2
    [   40.776000] mt7615_antenna_default_reset(): DBDC 5G TxPath = 2, 2G RxPath = 2
    [   40.788000] RcRadioInit(): DbdcMode=0, ConcurrentBand=1
    [   40.800000] RcRadioInit(): pRadioCtrl=867d2434,Band=0,rfcap=3,channel=1,PhyMode=2 extCha=0xf
    [   40.824000] CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0
    [   40.840000] CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0
    [   40.852000] CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0
    [   40.864000] MT7615BBPInit():BBP Initialization.....
    [   40.876000]  Band 0: valid=1, isDBDC=0, Band=2, CBW=1, CentCh/PrimCh=1/1, prim_ch_idx=0, txStream=2
    [   40.892000]  Band 1: valid=0, isDBDC=0, Band=0, CBW=0, CentCh/PrimCh=0/0, prim_ch_idx=0, txStream=0
    [   40.912000] MT7615BBPInit() todo 
    [   40.920000] mt7615_apply_dcoc() : reload Central CH [1] BW [0] from cetral freq [2417]  offset [2200] 
    [   40.940000] mt7615_apply_dpd() : reload Central CH [1] BW [0] from cetral freq [2422] i[44] offset [4b20] 
    [   40.956000] MtCmdChannelSwitch: control_chl = 1,control_ch2=0, central_chl = 1 DBDCIdx= 0, Band= 0 
    [   40.976000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   41.304000] mt7615_apply_dcoc() : reload Central CH [2] BW [0] from cetral freq [2417]  offset [2200] 
    [   41.320000] mt7615_apply_dpd() : reload Central CH [2] BW [0] from cetral freq [2422] i[44] offset [4b20] 
    [   41.340000] MtCmdChannelSwitch: control_chl = 2,control_ch2=0, central_chl = 2 DBDCIdx= 0, Band= 0 
    [   41.360000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   41.580000] mt7615_apply_dcoc() : reload Central CH [3] BW [0] from cetral freq [2417]  offset [2200] 
    [   41.596000] mt7615_apply_dpd() : reload Central CH [3] BW [0] from cetral freq [2422] i[44] offset [4b20] 
    [   41.616000] MtCmdChannelSwitch: control_chl = 3,control_ch2=0, central_chl = 3 DBDCIdx= 0, Band= 0 
    [   41.636000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   41.884000] mt7615_apply_dcoc() : reload Central CH [4] BW [0] from cetral freq [2432]  offset [2300] 
    [   41.900000] mt7615_apply_dpd() : reload Central CH [4] BW [0] from cetral freq [2422] i[44] offset [4b20] 
    [   41.920000] MtCmdChannelSwitch: control_chl = 4,control_ch2=0, central_chl = 4 DBDCIdx= 0, Band= 0 
    [   41.940000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   42.160000] mt7615_apply_dcoc() : reload Central CH [5] BW [0] from cetral freq [2432]  offset [2300] 
    [   42.176000] mt7615_apply_dpd() : reload Central CH [5] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
    [   42.196000] MtCmdChannelSwitch: control_chl = 5,control_ch2=0, central_chl = 5 DBDCIdx= 0, Band= 0 
    [   42.216000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   42.612000] mt7615_apply_dcoc() : reload Central CH [6] BW [0] from cetral freq [2432]  offset [2300] 
    [   42.628000] mt7615_apply_dpd() : reload Central CH [6] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
    [   42.648000] MtCmdChannelSwitch: control_chl = 6,control_ch2=0, central_chl = 6 DBDCIdx= 0, Band= 0 
    [   42.668000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   42.948000] mt7615_apply_dcoc() : reload Central CH [7] BW [0] from cetral freq [2447]  offset [2400] 
    [   42.964000] mt7615_apply_dpd() : reload Central CH [7] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
    [   42.984000] MtCmdChannelSwitch: control_chl = 7,control_ch2=0, central_chl = 7 DBDCIdx= 0, Band= 0 
    [   43.004000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   43.224000] mt7615_apply_dcoc() : reload Central CH [8] BW [0] from cetral freq [2447]  offset [2400] 
    [   43.240000] mt7615_apply_dpd() : reload Central CH [8] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
    [   43.260000] MtCmdChannelSwitch: control_chl = 8,control_ch2=0, central_chl = 8 DBDCIdx= 0, Band= 0 
    [   43.280000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   43.500000] mt7615_apply_dcoc() : reload Central CH [9] BW [0] from cetral freq [2447]  offset [2400] 
    [   43.516000] mt7615_apply_dpd() : reload Central CH [9] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
    [   43.536000] MtCmdChannelSwitch: control_chl = 9,control_ch2=0, central_chl = 9 DBDCIdx= 0, Band= 0 
    [   43.556000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   43.776000] mt7615_apply_dcoc() : reload Central CH [10] BW [0] from cetral freq [2467]  offset [2500] 
    [   43.792000] mt7615_apply_dpd() : reload Central CH [10] BW [0] from cetral freq [2462] i[46] offset [4cd0] 
    [   43.812000] MtCmdChannelSwitch: control_chl = 10,control_ch2=0, central_chl = 10 DBDCIdx= 0, Band= 0 
    [   43.832000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   44.052000] mt7615_apply_dcoc() : reload Central CH [11] BW [0] from cetral freq [2467]  offset [2500] 
    [   44.068000] mt7615_apply_dpd() : reload Central CH [11] BW [0] from cetral freq [2462] i[46] offset [4cd0] 
    [   44.088000] MtCmdChannelSwitch: control_chl = 11,control_ch2=0, central_chl = 11 DBDCIdx= 0, Band= 0 
    [   44.108000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   44.328000]  AutoChSelUpdateChannel(): Update channel for wdev0 for this band PhyMode = 14,Channel = 4  
    [   44.348000] Current Channel is 4. DfsZeroWaitSupport=0
    [   44.356000] [PMF]APPMFInit:: apidx=0, MFPC=0, MFPR=0, SHA256=0
    [   44.368000] [PMF]WPAMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
    [   44.380000] mt7615_apply_dcoc() : reload Central CH [1] BW [0] from cetral freq [2417]  offset [2200] 
    [   44.400000] mt7615_apply_dpd() : reload Central CH [1] BW [0] from cetral freq [2422] i[44] offset [4b20] 
    [   44.420000] MtCmdChannelSwitch: control_chl = 1,control_ch2=0, central_chl = 1 DBDCIdx= 0, Band= 0 
    [   44.436000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   44.460000] AP OBSS SYNC - BBP R4 to 20MHz.l
    [   44.980000] mt7615_apply_dcoc() : reload Central CH [2] BW [0] from cetral freq [2417]  offset [2200] 
    [   44.996000] mt7615_apply_dpd() : reload Central CH [2] BW [0] from cetral freq [2422] i[44] offset [4b20] 
    [   45.016000] MtCmdChannelSwitch: control_chl = 2,control_ch2=0, central_chl = 2 DBDCIdx= 0, Band= 0 
    [   45.036000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   45.056000] AP OBSS SYNC - BBP R4 to 20MHz.l
    [   45.400000] mt7615_apply_dcoc() : reload Central CH [3] BW [0] from cetral freq [2417]  offset [2200] 
    [   45.416000] mt7615_apply_dpd() : reload Central CH [3] BW [0] from cetral freq [2422] i[44] offset [4b20] 
    [   45.436000] MtCmdChannelSwitch: control_chl = 3,control_ch2=0, central_chl = 3 DBDCIdx= 0, Band= 0 
    [   45.456000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   45.476000] AP OBSS SYNC - BBP R4 to 20MHz.l
    [   46.012000] mt7615_apply_dcoc() : reload Central CH [4] BW [0] from cetral freq [2432]  offset [2300] 
    [   46.028000] mt7615_apply_dpd() : reload Central CH [4] BW [0] from cetral freq [2422] i[44] offset [4b20] 
    [   46.048000] MtCmdChannelSwitch: control_chl = 4,control_ch2=0, central_chl = 4 DBDCIdx= 0, Band= 0 
    [   46.068000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   46.088000] AP OBSS SYNC - BBP R4 to 20MHz.l
    [   46.396000] mt7615_apply_dcoc() : reload Central CH [5] BW [0] from cetral freq [2432]  offset [2300] 
    [   46.412000] mt7615_apply_dpd() : reload Central CH [5] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
    [   46.432000] MtCmdChannelSwitch: control_chl = 5,control_ch2=0, central_chl = 5 DBDCIdx= 0, Band= 0 
    [   46.452000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   46.472000] AP OBSS SYNC - BBP R4 to 20MHz.l
    [   46.996000] mt7615_apply_dcoc() : reload Central CH [6] BW [0] from cetral freq [2432]  offset [2300] 
    [   47.012000] mt7615_apply_dpd() : reload Central CH [6] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
    [   47.032000] MtCmdChannelSwitch: control_chl = 6,control_ch2=0, central_chl = 6 DBDCIdx= 0, Band= 0 
    [   47.052000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   47.072000] AP OBSS SYNC - BBP R4 to 20MHz.l
    [   47.380000] mt7615_apply_dcoc() : reload Central CH [7] BW [0] from cetral freq [2447]  offset [2400] 
    [   47.396000] mt7615_apply_dpd() : reload Central CH [7] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
    [   47.416000] MtCmdChannelSwitch: control_chl = 7,control_ch2=0, central_chl = 7 DBDCIdx= 0, Band= 0 
    [   47.436000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   47.456000] AP OBSS SYNC - BBP R4 to 20MHz.l
    [   47.960000] mt7615_apply_dcoc() : reload Central CH [8] BW [0] from cetral freq [2447]  offset [2400] 
    [   47.976000] mt7615_apply_dpd() : reload Central CH [8] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
    [   47.996000] MtCmdChannelSwitch: control_chl = 8,control_ch2=0, central_chl = 8 DBDCIdx= 0, Band= 0 
    [   48.016000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   48.036000] AP OBSS SYNC - BBP R4 to 20MHz.l
    [   48.344000] mt7615_apply_dcoc() : reload Central CH [9] BW [0] from cetral freq [2447]  offset [2400] 
    [   48.360000] mt7615_apply_dpd() : reload Central CH [9] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
    [   48.380000] MtCmdChannelSwitch: control_chl = 9,control_ch2=0, central_chl = 9 DBDCIdx= 0, Band= 0 
    [   48.400000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   48.420000] AP OBSS SYNC - BBP R4 to 20MHz.l
    [   48.868000] mt7615_apply_dcoc() : reload Central CH [10] BW [0] from cetral freq [2467]  offset [2500] 
    [   48.884000] mt7615_apply_dpd() : reload Central CH [10] BW [0] from cetral freq [2462] i[46] offset [4cd0] 
    [   48.904000] MtCmdChannelSwitch: control_chl = 10,control_ch2=0, central_chl = 10 DBDCIdx= 0, Band= 0 
    [   48.924000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   48.944000] AP OBSS SYNC - BBP R4 to 20MHz.l
    [   49.252000] mt7615_apply_dcoc() : reload Central CH [11] BW [0] from cetral freq [2467]  offset [2500] 
    [   49.268000] mt7615_apply_dpd() : reload Central CH [11] BW [0] from cetral freq [2462] i[46] offset [4cd0] 
    [   49.288000] MtCmdChannelSwitch: control_chl = 11,control_ch2=0, central_chl = 11 DBDCIdx= 0, Band= 0 
    [   49.308000] BW = 0,TXStream = 4, RXStream = 4, scan(1)
    [   49.328000] AP OBSS SYNC - BBP R4 to 20MHz.l
    [   49.636000] wtc_acquire_groupkey_wcid: Found a non-occupied wtbl_idx:127 for WDEV_TYPE:1
    [   49.636000]  LinkToOmacIdx = 0, LinkToWdevType = 1
    [   49.788000] mt7615_apply_dcoc() : reload Central CH [4] BW [0] from cetral freq [2432]  offset [2300] 
    [   49.808000] mt7615_apply_dpd() : reload Central CH [4] BW [0] from cetral freq [2422] i[44] offset [4b20] 
    [   49.828000] MtCmdChannelSwitch: control_chl = 4,control_ch2=0, central_chl = 4 DBDCIdx= 0, Band= 0 
    [   49.844000] BW = 0,TXStream = 4, RXStream = 4, scan(0)
    [   49.900000] wlan_operate_set_vht_bw(): new vht_bw:1 > cap_vht_bw: 0, correct to cap_vht_bw
    [   49.920000] wlan_operate_set_vht_bw(): new vht_bw:1 > cap_vht_bw: 0, correct to cap_vht_bw
    [   49.936000] wlan_operate_set_vht_bw(): new vht_bw:1 > cap_vht_bw: 0, correct to cap_vht_bw
    [   49.956000] wlan_operate_set_vht_bw(): new vht_bw:1 > cap_vht_bw: 0, correct to cap_vht_bw
    [   49.972000] wlan_operate_set_vht_bw(): new vht_bw:1 > cap_vht_bw: 0, correct to cap_vht_bw
    [   49.988000] wlan_operate_set_vht_bw(): new vht_bw:1 > cap_vht_bw: 0, correct to cap_vht_bw
    [   50.044000] red_is_enabled: set CR4/N9 RED Enable to 1.
    [   50.052000] cp_support_is_enabled: set CR4 CP_SUPPORT to Mode 2.
    [   50.064000] ***********dev->ifindex = 9
    [   50.132000] device ra0 entered promiscuous mode
    [   50.140000] br-lan: port 2(ra0) entered forwarding state
    [   50.152000] br-lan: port 2(ra0) entered forwarding state
    [   50.320000] DriverOwn()::Return since already in Driver Own...
    [   50.336000] RT_CfgSetMacAddress : invalid length (0)
    [   50.352000] default ApCliAPSDCapable[0]=0
    [   50.360000] default ApCliAPSDCapable[1]=0
    [   50.396000] [PMF]Set_PMFMFPC_Proc:: apidx=0, Desired MFPC=0
    [   50.416000] AndesSendCmdMsg: Could not send in band command due to diablefRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD
    [   50.480000] AndesRestartCheck: Current TOP_MISC2(0x1)
    [   50.504000] WfMcuHwInit: Before NICLoadFirmware, check IcapMode=0
    [   50.516000] AndesRestartCheck: Current TOP_MISC2(0x1)
    [   50.640000] WfMcuHwInit: NICLoadFirmware OK, Check IcapMode=0
    [   50.648000] efuse_probe: efuse = 10000212
    [   51.208000] mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4
    [   51.220000] mt7615_antenna_default_reset(): DBDC 2G TxPath = 2, 2G RxPath = 2
    [   51.236000] mt7615_antenna_default_reset(): DBDC 5G TxPath = 2, 2G RxPath = 2
    [   51.248000] RcRadioInit(): DbdcMode=0, ConcurrentBand=1
    [   51.260000] RcRadioInit(): pRadioCtrl=84aaf434,Band=0,rfcap=3,channel=1,PhyMode=2 extCha=0xf
    [   51.284000] CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0
    [   51.296000] CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0
    [   51.308000] CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0
    [   51.320000] MT7615BBPInit():BBP Initialization.....
    [   51.332000]  Band 0: valid=1, isDBDC=0, Band=2, CBW=1, CentCh/PrimCh=1/1, prim_ch_idx=0, txStream=2
    [   51.348000]  Band 1: valid=0, isDBDC=0, Band=0, CBW=0, CentCh/PrimCh=0/0, prim_ch_idx=0, txStream=0
    [   51.368000] MT7615BBPInit() todo 
    [   51.376000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
    [   51.396000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98] 
    [   51.416000] MtCmdChannelSwitch: control_chl = 36,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0 
    [   51.432000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   51.796000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
    [   51.812000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98] 
    [   51.832000] MtCmdChannelSwitch: control_chl = 40,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0 
    [   51.852000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   52.072000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
    [   52.088000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98] 
    [   52.108000] MtCmdChannelSwitch: control_chl = 44,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0 
    [   52.128000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   52.156000] br-lan: port 2(ra0) entered forwarding state
    [   52.512000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
    [   52.528000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98] 
    [   52.548000] MtCmdChannelSwitch: control_chl = 48,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0 
    [   52.568000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   52.844000] mt7615_apply_dcoc() : reload Central CH [58] BW [2] from cetral freq [5290]  offset [1a00] 
    [   52.860000] mt7615_apply_dpd() : reload Central CH [58] BW [2] from cetral freq [5300] i[13] offset [30f8] 
    [   52.880000] MtCmdChannelSwitch: control_chl = 52,control_ch2=0, central_chl = 58 DBDCIdx= 0, Band= 0 
    [   52.900000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   53.120000] mt7615_apply_dcoc() : reload Central CH [58] BW [2] from cetral freq [5290]  offset [1a00] 
    [   53.136000] mt7615_apply_dpd() : reload Central CH [58] BW [2] from cetral freq [5300] i[13] offset [30f8] 
    [   53.156000] MtCmdChannelSwitch: control_chl = 56,control_ch2=0, central_chl = 58 DBDCIdx= 0, Band= 0 
    [   53.176000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   53.396000] mt7615_apply_dcoc() : reload Central CH [58] BW [2] from cetral freq [5290]  offset [1a00] 
    [   53.412000] mt7615_apply_dpd() : reload Central CH [58] BW [2] from cetral freq [5300] i[13] offset [30f8] 
    [   53.432000] MtCmdChannelSwitch: control_chl = 60,control_ch2=0, central_chl = 58 DBDCIdx= 0, Band= 0 
    [   53.452000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   53.788000] mt7615_apply_dcoc() : reload Central CH [58] BW [2] from cetral freq [5290]  offset [1a00] 
    [   53.804000] mt7615_apply_dpd() : reload Central CH [58] BW [2] from cetral freq [5300] i[13] offset [30f8] 
    [   53.824000] MtCmdChannelSwitch: control_chl = 64,control_ch2=0, central_chl = 58 DBDCIdx= 0, Band= 0 
    [   53.844000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   54.064000] mt7615_apply_dcoc() : reload Central CH [106] BW [2] from cetral freq [5530]  offset [1d00] 
    [   54.080000] mt7615_apply_dpd() : reload Central CH [106] BW [2] from cetral freq [5540] i[25] offset [3b18] 
    [   54.100000] MtCmdChannelSwitch: control_chl = 100,control_ch2=0, central_chl = 106 DBDCIdx= 0, Band= 0 
    [   54.120000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   54.340000] mt7615_apply_dcoc() : reload Central CH [106] BW [2] from cetral freq [5530]  offset [1d00] 
    [   54.356000] mt7615_apply_dpd() : reload Central CH [106] BW [2] from cetral freq [5540] i[25] offset [3b18] 
    [   54.376000] MtCmdChannelSwitch: control_chl = 104,control_ch2=0, central_chl = 106 DBDCIdx= 0, Band= 0 
    [   54.396000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   54.616000] mt7615_apply_dcoc() : reload Central CH [106] BW [2] from cetral freq [5530]  offset [1d00] 
    [   54.632000] mt7615_apply_dpd() : reload Central CH [106] BW [2] from cetral freq [5540] i[25] offset [3b18] 
    [   54.652000] MtCmdChannelSwitch: control_chl = 108,control_ch2=0, central_chl = 106 DBDCIdx= 0, Band= 0 
    [   54.672000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   54.952000] mt7615_apply_dcoc() : reload Central CH [106] BW [2] from cetral freq [5530]  offset [1d00] 
    [   54.968000] mt7615_apply_dpd() : reload Central CH [106] BW [2] from cetral freq [5540] i[25] offset [3b18] 
    [   54.988000] MtCmdChannelSwitch: control_chl = 112,control_ch2=0, central_chl = 106 DBDCIdx= 0, Band= 0 
    [   55.008000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   55.228000] mt7615_apply_dcoc() : reload Central CH [122] BW [2] from cetral freq [5610]  offset [1e00] 
    [   55.244000] mt7615_apply_dpd() : reload Central CH [122] BW [2] from cetral freq [5620] i[29] offset [3e78] 
    [   55.264000] MtCmdChannelSwitch: control_chl = 116,control_ch2=0, central_chl = 122 DBDCIdx= 0, Band= 0 
    [   55.284000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   55.532000] mt7615_apply_dcoc() : reload Central CH [122] BW [2] from cetral freq [5610]  offset [1e00] 
    [   55.548000] mt7615_apply_dpd() : reload Central CH [122] BW [2] from cetral freq [5620] i[29] offset [3e78] 
    [   55.568000] MtCmdChannelSwitch: control_chl = 120,control_ch2=0, central_chl = 122 DBDCIdx= 0, Band= 0 
    [   55.588000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   55.856000] mt7615_apply_dcoc() : reload Central CH [122] BW [2] from cetral freq [5610]  offset [1e00] 
    [   55.872000] mt7615_apply_dpd() : reload Central CH [122] BW [2] from cetral freq [5620] i[29] offset [3e78] 
    [   55.892000] MtCmdChannelSwitch: control_chl = 124,control_ch2=0, central_chl = 122 DBDCIdx= 0, Band= 0 
    [   55.912000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   56.132000] mt7615_apply_dcoc() : reload Central CH [122] BW [2] from cetral freq [5610]  offset [1e00] 
    [   56.148000] mt7615_apply_dpd() : reload Central CH [122] BW [2] from cetral freq [5620] i[29] offset [3e78] 
    [   56.168000] MtCmdChannelSwitch: control_chl = 128,control_ch2=0, central_chl = 122 DBDCIdx= 0, Band= 0 
    [   56.188000] BW = 2,TXStream = 4, RXStream = 4, scan(1)
    [   56.500000]  AutoChSelUpdateChannel(): Update channel for wdev0 for this band PhyMode = 49,Channel = 100  
    [   56.520000] Current Channel is 100. DfsZeroWaitSupport=0
    [   56.528000] [PMF]APPMFInit:: apidx=0, MFPC=0, MFPR=0, SHA256=0
    [   56.540000] [PMF]WPAMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
    [   56.552000] wtc_acquire_groupkey_wcid: Found a non-occupied wtbl_idx:127 for WDEV_TYPE:1
    [   56.552000]  LinkToOmacIdx = 0, LinkToWdevType = 1
    [   56.724000] mt7615_apply_dcoc() : reload Central CH [106] BW [2] from cetral freq [5530]  offset [1d00] 
    [   56.740000] mt7615_apply_dpd() : reload Central CH [106] BW [2] from cetral freq [5540] i[25] offset [3b18] 
    [   56.760000] MtCmdChannelSwitch: control_chl = 100,control_ch2=0, central_chl = 106 DBDCIdx= 0, Band= 0 
    [   56.780000] BW = 2,TXStream = 4, RXStream = 4, scan(0)
    [   56.876000] red_is_enabled: set CR4/N9 RED Enable to 1.
    [   56.888000] cp_support_is_enabled: set CR4 CP_SUPPORT to Mode 2.
    [   56.900000] ***********dev->ifindex = a
    [   56.964000] device rai0 entered promiscuous mode
    [   56.972000] br-lan: port 3(rai0) entered forwarding state
    [   56.984000] br-lan: port 3(rai0) entered forwarding state
    [   58.988000] br-lan: port 3(rai0) entered forwarding state
    [   59.056000] 
    [   59.056000]  Set_Led_Proc ==> arg = 00-00-00-00-02-00-00-00
    [   59.068000] 
    [   59.068000] Set_Led_Proc
    [   59.076000] 00
    [   59.080000] 00
    [   59.084000] 00
    [   59.088000] 00
    [   59.092000] 02
    [   59.096000] 00
    [   59.096000] 00
    [   59.100000] 00
    [   59.104000] AndesLedEnhanceOP: Success!
    [   59.136000] 
    [   59.136000]  Set_Led_Proc ==> arg = 00-00-00-00-02-00-00-00
    [   59.152000] 
    [   59.152000] Set_Led_Proc
    [   59.160000] 00
    [   59.164000] 00
    [   59.168000] 00
    [   59.172000] 00
    [   59.172000] 02
    [   59.176000] 00
    [   59.180000] 00
    [   59.184000] 00
    [   59.188000] AndesLedEnhanceOP: Success!
    FC start
    [   70.616000] u32 classifier
    [   70.620000]     Performance counters on
    [   70.628000]     Actions configured
    FC Disable
    

WN-AX1167GR

WN-GX300GRのサポート作業をした際、某氏から基板が共通のWN-AX1167GRについても色々と情報を頂いてある程度手を加えたため、どうせならということでこちらも購入して作業開始。
内部は基本的な設計が共通のため、同じ部分が多い。

U-Boot

Kernel