カテゴリー: QCA/Atheros

WR8175N

ふらっと花小金井のハードオフに行った際に見つけ、5chの情報からAR9341ということを把握しており確保したもの。有線はFEながらUSBポートを搭載しており、また2.4GHz帯のみのためWR8750N等の様な複雑さは無いと思われる。
弄っていくのでメモ。

Switch

未確認。

MAC

  • LAN: 1C:B1:7F:xx:xx:54 (config, 0x6 (hex))
  • WAN: 1C:B1:7F:xx:xx:55 (config, 0xc (hex))
  • 2.4G: 1C:B1:7F:xx:xx:56 (config, 0x0 (hex) / art, 0x1002 (hex))

Bootloader

chiron

  • help
    boot> help
    support commands ...
    load             load module
    boot             boot loaded module
    tftpd            start tftpd [tftpd [IP] [bfn]]
    dlmode           set tftpd download mode [bfn]
    reboot           reboot system
    help             help command
    macaddr          macaddr read/write
    configid         configid read/write
    randomkey        randomkey read/write
    serial           serial number read/write
    pkg_info         show package information
    presetid         preset id read/write
    version          show boot version
    mhx              mhx utility
    tp               test program
    errorlog         errorlog command
    additional       additional command
    rf-serial        rf-serial command
    time             Time command
    debug            debug command
    ?                help command
    

  • version
    boot> version
    boot version: 1.0.0
    system version: 2.54.5
    TP Version = 1.0.0
    

  • pkg_info
    boot> pkg_info
      PKG NAME : SkyU-HP
      CPU   : Atheros/AR9341
      RAM   : 64Mbyte
      Flash : 4Mbyte
        Device         : MX25L3205DMI(Macronix)
        Top Address    : 0xbfc00000
        Config Address : 0xbfc20000
        System Address : 0xbfc40000
      Ether PHY : Atheros/AR934x(SW)
      DIPSW : 0x1
    

  • debug ?
    boot> debug ?
    support commands ...
    memory           memory read/write
    flash            flash driver r/w
    fs               file system r/w
    load             load test (calc chksum)
    exception        exception
    register         display register
    watchdog         do watchdog reset
    tlb              tlb register
    cache            cache control
    mii              mii control
    l2sw             l2sw control
    ether            ether control
    btimer_start     test btimer
    btimer_stop      test btimer
    

  • debug fs ls
    boot> debug fs ls
    Firmware            3406168 bytes
    config.har             1052 bytes
    total 3932160, avail 392832 bytes
    

  • debug memory read 0xb8040000 70
    boot> debug memory read 0xb8040000 70
    b8040000:00030b01 0063ee3f 0064e01e 00000000 .....c.?.d......
    b8040010:00000000 00000000 00000000 00000000 ................
    b8040020:00000000 00000000 000f8000 2a2b2c00 ............*+,.
    b8040030:0b0a0929 00180000 00000000 2f2e0000 ...)......../...
    b8040040:002d0000 00000908 00000000 00000000 .-..............
    b8040050:00000c0b 00000000 00000000 00000000 ................
    b8040060:00000000 0d0f110e 00000000 00000002 ................
    boot> tftpd
    phy1.0: "Atheros/AR934x(SW)"
    phy1.4: "Atheros/AR934x(phy)"
    active ch:1
    tftpd start 192.168.0.1
    boot> debug memory read 0xb8040000 70
    b8040000:00030b01 0063ee37 0064e01e 00000000 .....c.7.d......
    b8040010:00000000 00000000 00000000 00000000 ................
    b8040020:00000000 00000000 00068000 2a2b2c00 ............*+,.
    b8040030:0b0a0929 00180000 00000000 2f2e0000 ...)......../...
    b8040040:002d0000 00000908 00000000 00000000 .-..............
    b8040050:00000c0b 00000000 00000000 00000000 ................
    b8040060:00000000 0d0f110e 00000000 00000002 ................
    

  • debug memory read 0xb8070000 4
    boot> debug memory read 0xb8070000 4 
    b8070000:00003000                            ..0.
    

  • debug memory read 0xb8060000 bc
    (before tp usb)

    boot> debug memory read 0xb8060000 bc
    b8060000:000207dc 00061a80 00000003 09896140 ..............a@
    b8060010:003fffdd 00000000 00000020 24044830 .?......... $.H0
    b8060020:00000000 00000000 00000000 00000000 ................
    b8060030:00000000 00000000 00000000 00000000 ................
    b8060040:00000000 00000000 00000000 00000000 ................
    b8060050:00000000 00000000 00000000 00000000 ................
    b8060060:00000000 00000000 00000000 00000000 ................
    b8060070:00000000 00000000 00000000 00000000 ................
    b8060080:00000000 00000000 00000000 00000000 ................
    b8060090:00000121 00000000 00000000 00000000 ...!............
    b80600a0:00000000 00000000 00000000 00000000 ................
    b80600b0:00bf0556 00000000 00000000          ...V........
    

    (aftertp usb)

    boot> debug memory read 0xb8060000 bc
    b8060000:00017cd8 00061a80 00000003 09896124 ..|...........a$
    b8060010:003fffdd 00000000 00000020 24044008 .?......... $.@.
    b8060020:00000000 00000000 00000000 00000000 ................
    b8060030:00000000 00000000 00000000 00000000 ................
    b8060040:00000000 00000000 00000000 00000000 ................
    b8060050:00000000 00000000 00000000 00000000 ................
    b8060060:00000000 00000000 00000000 00000000 ................
    b8060070:00000000 00000000 00000000 00000000 ................
    b8060080:00000000 00000000 00000000 00000000 ................
    b8060090:00000121 00000000 00000000 00000000 ...!............
    b80600a0:00000000 00000000 00000000 00000000 ................
    b80600b0:00bf0556 00000000 00000000          ...V........
    

Kernel (NetBSD)

  • Bootlog
    IPL:HARD-RESET
    memory test ... ok
    flinstall OK
    
    boot version: 1.0.0
    
    PKG "SkyU-HP"
    CPU "Atheros/AR9341"
    Revision 12.1 CLOCK 535.0 MHz
    HEAP MEMORY 262144 bytes
    Boot:InitFilesystem
    phy1.0: "Atheros/AR934x(SW)"
    phy1.4: "Atheros/AR934x(phy)"
    active ch:1
    post start
    DRAM Test ..... PASS
    Timer test .... PASS
    FLASH CHKSUM .. PASS
    LAN Test ..... 
    LoopBack count 0 .. 
    phy1.0: "Atheros/AR934x(SW)"
    phy1.4: "Atheros/AR934x(phy)"
    active ch:0
    active ch:1
    phy1.0: "Atheros/AR934x(SW)"
    phy1.4: "Atheros/AR934x(phy)"
    active ch:1
    PASS
    Package TYPE = 0x00
    post success
    now booting Firmware ...
    loaded Firmware
    config=0x80208483 status=0x00000000
    mips_pdcache_write_through=0
    mips_picache_line_size=32 mips_pdcache_line_size=32
      pagemask: 0x00000000
      status: 0x00000000
      config: 0x80208483
      cause: 0x00000000
    load memory 0x176d000, 0x2893000
    load memory 0x1000, 0x5f000
    Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002
        The NetBSD Foundation, Inc.  All rights reserved.
    Copyright (c) 1982, 1986, 1989, 1991, 1993
        The Regents of the University of California.  All rights reserved.
    
    NetBSD 1.6.1 (SKYU.tmp) #0: 2012-03-13 17:00:31 JST
        ******@***-**-*****:/home/******/skyu/git/hituji/build/skyu/kernel-obj/SKYU.tmp
    
    total memory = 65536 KB
    avail memory = 36368 KB
    using 1024 buffers containing 4096 KB of memory
    mainbus0 (root)
    cpu0 at mainbus0: MIPS 74Kc (0x1974c) Rev. 76 with software emulated floating point
    cpu0: 64KB/32B 4-way set-associative L1 Instruction cache, 32 TLB entries
    cpu0: 32KB/32B 4-way set-associative write-back L1 Data cache
    arspi0 at mainbus0
    arflash0 at mainbus0 addr 0xbfc00000 size 4194304 bytes
    flash: id 0xc2 type 0x15 addr 0xbfc00000 size 4194304 bytes
    pfmg: carrier mode 0 pkgid 0x900 configid 0xff
    arrtc0 at mainbus0
    argiu0 at mainbus0
    arled0 at argiu0
    btnu0 at argiu0 port 0
    btnu1 at argiu0 port 16
    btnu2 at argiu0 port 17
    athq0 at mainbus0
    athq0: WLAN MAC ADDRESS (1c:b1:7f:4c:b1:56)
    Restoring Cal data from Flash
    dfs_attach: use DFS enhancements
    DFS min filter rssiThresh = 18
    DFS max pulse dur = 151 ticks
    ath_get_caps[5049] rx chainmask mismatch actual 3 sc_chainmak 0
    ath_get_caps[5024] tx chainmask mismatch actual 3 sc_chainmak 0
    athq0: LSDK-9.2.0_U8.834 mac 768.0 phy 534.0 radio 0.0
     chan  Freq     HT                       DFS
     1     2412nbg  HT20 HT40PLUS            N
     2     2417nbg  HT20 HT40PLUS            N
     3     2422nbg  HT20 HT40PLUS            N
     4     2427nbg  HT20 HT40PLUS            N
     5     2432nbg  HT20 HT40PLUS HT40MINUS  N
     6     2437nbg  HT20 HT40PLUS HT40MINUS  N
     7     2442nbg  HT20 HT40PLUS HT40MINUS  N
     8     2447nbg  HT20 HT40PLUS HT40MINUS  N
     9     2452nbg  HT20 HT40PLUS HT40MINUS  N
     10    2457nbg  HT20          HT40MINUS  N
     11    2462nbg  HT20          HT40MINUS  N
     12    2467nbg  HT20          HT40MINUS  N
     13    2472nbg  HT20          HT40MINUS  N
    athq0: Atheros 9340: memt=0x80364b00, memh=0xb8100000 
    com0 at mainbus0: ns16550a, working fifo
    com0: console
    ehci0 at mainbus0ehci0: EHCI version 1.0
    usb0 at ehci0: USB revision 2.0
    uhub0 at usb0
    uhub0: AR7100 EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
    uhub0: 1 port with 1 removable, self powered
    ageth1 at mainbus0
    ath2swlphy0 at ageth1 phy 0: Atheros AR934x 10/100 L2SW, rev. 2
    ath2swlphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto, 100baseTX-FDX FLAG0, 100baseTX-FDX FLAG1
    ageth0 at mainbus0
    ath2swsphy0 at ageth0 phy 4: Atheros AR934x 10/100 L2SW, rev. 2
    ath2swsphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
    rtc: CLOCK INITIALIZED 
    kevt0: 
    logbuf: using 655360 bytes logging area
    md0: internal 19456 KB image area
    uhub1 at uhub0 port 1
    uhub1: vendor 0x0409 product 0x005a, class 9/0, rev 2.00/1.00, addr 2
    uhub1: single transaction translator
    uhub1: 4 ports with 4 removable, self powered
    boot device: 
    root on md0a dumps on md0b
    root file system type: ffs
    Sun Jan  1 00:00:02 JST 2012
    /usr/local/www/.htpasswd file not exists.(ignore)
    Setting tty flags.
    Building databases...
    wlan_vap_create : enter. devhandle=0x817456e0, opmode=IEEE80211_M_HOSTAP, flags=0x1
    wlan_vap_create : exit. devhandle=0x817456e0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
    wlan_vap_create : enter. devhandle=0x817456e0, opmode=IEEE80211_M_HOSTAP, flags=0x1
    wlan_vap_create : exit. devhandle=0x817456e0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
    Starting wificonfig
    encrypt key mode AES
    Starting evtmgr.
    Starting dlnamgr.
    Starting clid.
    Starting inetd.
    Starting procmon.
    Starting wzcm.
    Sun Jan  1 00:00:06 JST 2012
    
    NetBSD/messimips (Amnesiac) (console)
    
    login: 
    

広告

WG1200CR stock -> OpenWrt (ath79)

1つ前の記事で書いた通り、Cのプログラムをでっち上げたのでそれを利用してfactoryを生成。メーカーファームからの投入を試行したのでメモ。

log

[ephp.c read_operand_list 1234] PHP operator precedence issue at: /htdocs/webinc/js/tools_fw_rlt.php, operand_qty: 6, add_qty: 2, mul_qty: 3
SERVD: event [PREFWUPDATE/default]
[/etc/scripts/prefwupdate.sh] ....
SERVD: stop service [THERMAL]
Stop THERMAL service ..
SERVD: event [STATUS.CRITICAL] not found!
SERVD: stop service [WAN]
SERVD: stop service [WIFI]
SERVD: service [WIFI] is already stopped.
SERVD: stop service [LAN]
SERVD: stop service [INET.WAN-1]
[/var/servd/INET.WAN-1_stop.sh]: stopping WAN-1...
[/var/servd/WAN-1-udhcpc.sh]: deconfig eth0.2 ...
SERVD: event [WAN-1.DOWN/default]
[/var/servd/INET.WAN-1_stop.sh]: stopping WAN-1 done !!!
SERVD: stop service [INET.WAN-2]
SERVD: service [INET.WAN-2] is already stopped.
SERVD: stop service [INET.WAN-3]
SERVD: service [INET.WAN-3] is already stopped.
SERVD: stop service [INET.WAN-4]
SERVD: service [INET.WAN-4] is already stopped.
SERVD: stop service [INET.WAN-5]
SERVD: service [INET.WAN-5] is already stopped.
SERVD: stop service [IPT.WAN-1]
SERVD: stop service [IPT.WAN-2]
SERVD: stop service [IPT.WAN-3]
SERVD: stop service [IPT.WAN-4]
SERVD: stop service [IPT.WAN-5]
SERVD: service [IPT.WAN-5] is already stopped.
SERVD: stop service [IPTDMZ]
SERVD: stop service [IPTPORTT]
SERVD: stop service [IPTPFWD]
SERVD: stop service [IPTVSVR]
iptables: No chain/target/match by that name.
SERVD: stop service [IPTMASQ]
SERVD: stop service [INET.LAN-1]
[/var/servd/INET.LAN-1_stop.sh]: stopping LAN-1...
SERVD: event [LAN-1.DOWN/default]
/var/run/phpsh-14632.sh: line 6: can't create /proc/nf_accelerate_to_local: nonexistent directory
[/var/servd/INET.LAN-1_stop.sh]: stopping LAN-1 done !!!
SERVD: stop service [INET.LAN-2]
SERVD: service [INET.LAN-2] is already stopped.
SERVD: stop service [INET.LAN-4]
SERVD: service [INET.LAN-4] is already stopped.
SERVD: stop service [INET.LAN-5]
SERVD: service [INET.LAN-5] is already stopped.
SERVD: stop service [INET.LAN-6]
SERVD: service [INET.LAN-6] is already stopped.
SERVD: stop service [IPT.LAN-1]
SERVD: stop service [IPT.LAN-2]
SERVD: stop service [IPT.LAN-3]
SERVD: service [IPT.LAN-3] is already stopped.
SERVD: stop service [IPT.LAN-4]
SERVD: service [IPT.LAN-4] is already stopped.
SERVD: stop service [IPT.LAN-5]
SERVD: service [IPT.LAN-5] is already stopped.
SERVD: stop service [IPT.LAN-6]
SERVD: service [IPT.LAN-6] is already stopped.
SERVD: stop service [ACCESSCTRL]
SERVD: stop service [INFSVCS.WAN-1]
SERVD: event [INFSVCS.WAN-1.DOWN] not found!
SERVD: event [UPNP.IGD.NOTIFY.WANIPCONN1/default]
SERVD: event [UPDATERESOLV/default]
SERVD: event [WAN-1.DISCONNECTED/default]
SERVD: stop service [HTTP]
SERVD: event [HTTP.DOWN/default]
SERVD: stop service [INFSVCS.LAN-1]
[/etc/events/FWUPDATER.sh] ...
kill servd, xmldb, watchdog, and load.sh
copy upgrade needed file to ramfs
remout /www /htdocs /etc /usr /bin /sbin to empty ramfs avoid someone access rootfs
FWUPDATER: about to write 4259844 bytes data to /dev/mtdblock/6
[  539.180000] ATT:001[SYN-ACK]:IN=br0 OUT= MAC=98:f1:99:f2:1d:24:5c:9a:d8:e6:3f:b3:08:00 SRC=192.168.10.101 DST=88.99.186.153 LEN=263 TOS=0x00 PREC=0x00 TTL=129 ID=23596 PROTO=TCP SPT=49877 DPT=443 WINDOW=65535 RES=0x00 ACK PSH URGP=0 
[  539.410000] ATT:001[SYN-ACK]:IN=br0 OUT= MAC=98:f1:99:f2:1d:24:5c:9a:d8:e6:3f:b3:08:00 SRC=192.168.10.101 DST=88.99.186.153 LEN=263 TOS=0x00 PREC=0x00 TTL=129 ID=23597 PROTO=TCP SPT=49876 DPT=443 WINDOW=65535 RES=0x00 ACK PSH URGP=0 
[  554.070000] ATT:001[SYN-ACK]:IN=br0 OUT= MAC=98:f1:99:f2:1d:24:5c:9a:d8:e6:3f:b3:08:00 SRC=192.168.10.101 DST=88.99.186.153 LEN=263 TOS=0x00 PREC=0x00 TTL=129 ID=23598 DF PROTO=TCP SPT=49877 DPT=443 WINDOW=65535 RES=0x00 ACK PSH URGP=0 
[  554.380000] ATT:001[SYN-ACK]:IN=br0 OUT= MAC=98:f1:99:f2:1d:24:5c:9a:d8:e6:3f:b3:08:00 SRC=192.168.10.101 DST=88.99.186.153 LEN=263 TOS=0x00 PREC=0x00 TTL=129 ID=23599 DF PROTO=TCP SPT=49876 DPT=443 WINDOW=65535 RES=0x00 ACK PSH URGP=0 
[  556.070000] ATT:001[SYN-ACK]:IN=eth0.2 OUT= MAC=98:f1:99:f2:1d:25:00:25:36:14:e9:8c:08:00:45:00:00:47 SRC=178.63.70.146 DST=192.168.1.65 LEN=71 TOS=0x00 PREC=0x00 TTL=51 ID=33765 DF PROTO=TCP SPT=443 DPT=49879 WINDOW=26800 RES=0x00 ACK PSH URGP=0 
FWUPDATER: cost 32.573702 seconds
fwupdate: unable to read SEAMA header!
/etc/events/FWUPDATER.sh: line 44: ca[  571.750000] ath_vap_stopping=1
n't create /proc/driver/system_reset: nonexistent directory
/etc/events/FWUPDATER.sh: line 45: can't create /proc/system_reset: nonexistent directory
The system is going down NOW!
Sent SIGTERM to all processes
[  571.790000] mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
[  571.830000] __ieee80211_smart_ant_init: Smart Antenna is not supported 
[  571.840000] ol_ath_vap_stopping=1
[  571.840000] STOPPED EVENT for vap 0 (8788c000)
[  571.850000] send_vdev_down_cmd_non_tlv for vap 0
[  571.880000] OL vap_start +
[  571.880000] VDEV START
[  571.880000] OL vap_start -
[  571.880000] ol_vdev_start_resp_ev for vap 0 (8788c000)
[  571.890000] su bfee 1 mu bfee 0 su bfer 1 mu bfer 1 impl bf 0 sounding dim 1
[  571.900000] send_vdev_up_cmd_non_tlv for vap 0
[  571.900000] ol_ath_vap_up=1
[  571.900000] __ieee80211_smart_ant_init: Smart Antenna is not supported 
[  571.910000] ol_ath_vap_set_param: Now supported MGMT RATE is 6000(kbps) and rate code: 0x3
[  571.920000] ol_ath_vap_set_param: Now supported MCAST RATE is 6000(kbps) and rate code: 0x3
[  572.630000] [wifi1] FWLOG: [593155] WAL_DBGID_SECURITY_MCAST_KEY_SET ( 0x1 )
[  572.640000] [wifi1] FWLOG: [593171] RESMGR_OCS_GEN_PERIODIC_NOA ( 0x0 )
[  572.640000] [wifi1] FWLOG: [593171] RESMGR_OCS_GEN_PERIODIC_NOA ( 0x0 )
[  572.650000] [wifi1] FWLOG: [593200] vap-0 VDEV_MGR_VDEV_START ( 0x1450, 0x2, 0x0, 0x0 )
[  572.660000] [wifi1] FWLOG: [593200] UNKNOWN 14:20 ( 0x0 )
[  572.660000] [wifi1] FWLOG: [593221] VDEV_MGR_HP_START_TIME ( 0x0, 0x1450, 0x21534000 )
[  572.670000] [wifi1] FWLOG: [593221] RESMGR_OCS_GEN_PERIODIC_NOA ( 0x1 )
[  572.680000] [wifi1] FWLOG: [593221] RESMGR_OCS_GEN_PERIODIC_NOA ( 0x0 )
[  572.690000] [wifi1] FWLOG: [593221] VDEV_MGR_AP_TBTT_CONFIG ( 0x0, 0x1450, 0x0, 0x0 )
Sent SIGKILL to all processes
Requesting system reboot
[  573.770000] Restarting system.


U-Boot 1.1.4 (Nov  1 2017 - 20:40:33)

SVN revision: 1501
ap152 - Dragonfly 1.0DRAM:  
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0x10, 0x10, 0x10, 0x10)
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 304k for U-Boot at: 87fb0000
Reserving 160k for malloc() at: 87f88000
Reserving 44 Bytes for Board Info at: 87f87fd4
Reserving 36 Bytes for Global Data at: 87f87fb0
Reserving 128k for boot params() at: 87f67fb0
Stack Pointer at: 87f67f98
Now running in RAM - U-Boot at: 87fb0000
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Power up PLL with outdiv = 0 then switch to 3
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200 
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x40802100
Trying eth0
eth0 link down
FAIL
Using eth0 device
listen from server 192.168.1.10; our IP address is 192.168.1.1
monitor_packet_result 0
Hit any key to stop autoboot:  0 
## Booting image at 9f080040 ...
   Image Name:   MIPS OpenWrt Linux-4.14.105
   Created:      2019-03-13  17:14:02 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1615472 Bytes =  1.5 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f080080 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 4.14.105 (jenkins@tofu-z77hvub18_openwrt) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r0+9537-e6d28b4fee)) #0 Wed Mar 13 17:14:02 2019
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is NEC Aterm WG1200CR
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] random: get_random_bytes called from start_kernel+0x8c/0x474 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 123184K/131072K available (3779K kernel code, 149K rwdata, 912K rodata, 1232K init, 204K bss, 7888K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000007] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008215] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074760] pid_max: default: 32768 minimum: 301
[    0.079783] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.086764] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.097654] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.108047] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.114544] pinctrl core: initialized pinctrl subsystem
[    0.120867] NET: Registered protocol family 16
[    0.131277] PCI host bridge /ahb/apb/pcie-controller@18250000 ranges:
[    0.138077]  MEM 0x0000000012000000..0x0000000013ffffff
[    0.143610]   IO 0x0000000000000000..0x0000000000000000
[    0.164196] PCI host bridge to bus 0000:00
[    0.168525] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    0.175802] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.181671] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.188827] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.197596] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    0.207577] clocksource: Switched to clocksource MIPS
[    0.213804] NET: Registered protocol family 2
[    0.219068] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.226424] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.233172] TCP: Hash tables configured (established 1024 bind 1024)
[    0.239999] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.246163] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.253036] NET: Registered protocol family 1
[    0.260391] Crashlog allocated RAM at address 0x3f00000
[    0.266999] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[    0.277860] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.284004] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.302195] io scheduler noop registered
[    0.306326] io scheduler deadline registered (default)
[    0.313452] pinctrl-single 1804002c.pinmux: 544 pins at pa b804002c size 68
[    0.321751] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.329101] console [ttyS0] disabled
[    0.332902] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 8, base_baud = 1562500) is a 16550A
[    0.342032] console [ttyS0] enabled
[    0.342032] console [ttyS0] enabled
[    0.349582] bootconsole [early0] disabled
[    0.349582] bootconsole [early0] disabled
[    0.363588] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    0.368723] 7 fixed-partitions partitions found on MTD device spi0.0
[    0.375279] Creating 7 MTD partitions on "spi0.0":
[    0.380249] 0x000000000000-0x000000040000 : "u-boot"
[    0.386055] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.392231] 0x000000050000-0x000000060000 : "devconf"
[    0.398130] 0x000000060000-0x000000070000 : "misc"
[    0.403683] 0x000000070000-0x000000080000 : "wifimngdata"
[    0.409954] 0x000000080000-0x0000007f0000 : "firmware"
[    0.416207] 2 seama-fw partitions found on MTD device firmware
[    0.422277] Creating 2 MTD partitions on "firmware":
[    0.427416] 0x000000000040-0x000000190000 : "kernel"
[    0.433161] 0x000000190000-0x000000770000 : "rootfs"
[    0.438924] mtd: device 7 (rootfs) set to be root filesystem
[    0.444806] 1 squashfs-split partitions found on MTD device rootfs
[    0.451235] 0x000000410000-0x000000770000 : "rootfs_data"
[    0.457428] 0x0000007f0000-0x000000800000 : "art"
[    0.463938] libphy: Fixed MDIO Bus: probed
[    0.807938] libphy: ag71xx_mdio: probed
[    0.814908] switch0: Atheros AR8337 rev. 2 switch registered on mdio-bus.0
[    1.469348] ag71xx 19000000.eth: invalid MAC address, using random address
[    1.808736] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    1.820327] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[    1.828446] NET: Registered protocol family 10
[    1.836389] Segment Routing with IPv6
[    1.840310] NET: Registered protocol family 17
[    1.844943] 8021q: 802.1Q VLAN Support v1.8
[    1.854680] VFS: Mounted root (squashfs filesystem) readonly on device 31:7.
[    1.868869] Freeing unused kernel memory: 1232K
[    1.873551] This architecture does not have kernel memory protection.
[    2.520873] init: Console is alive
[    2.524572] init: - watchdog -
[    2.547589] random: fast init done
[    3.559875] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.672369] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.690250] init: - preinit -
[    4.342977] random: jshn: uninitialized urandom read (4 bytes read)
[    4.438282] random: jshn: uninitialized urandom read (4 bytes read)
[    4.731136] random: jshn: uninitialized urandom read (4 bytes read)
[    5.812413] urandom_read: 4 callbacks suppressed
[    5.812420] random: procd: uninitialized urandom read (4 bytes read)
[    5.828955] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    5.835036] IPv6: ADDRCONF(NETDEV_UP): eth0.1: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    6.908954] eth0: link up (1000Mbps/Full duplex)
[    6.913811] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    6.920616] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[    9.041438] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    9.069225] urandom-seed: Seed file not found (/etc/urandom.seed)
[    9.146253] eth0: link down
[    9.164727] procd: - early -
[    9.168571] procd: - watchdog -
[    9.772570] procd: - watchdog -
[    9.776058] procd: - ubus -
[    9.806263] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.829662] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.837391] procd: - init -
Please press Enter to activate this console.
[   10.109815] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.121855] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   10.135151] Loading modules backported from Linux version v4.19.23-0-g67d52fae61c1
[   10.143016] Backport generated by backports.git v4.19.23-1-0-g480a925a
[   10.152281] ip_tables: (C) 2000-2006 Netfilter Core Team
[   10.164807] nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
[   10.220111] xt_time: kernel timezone is -0000
[   10.273835] PPP generic driver version 2.4.2
[   10.280431] NET: Registered protocol family 24
[   10.311894] ath10k 4.19 driver, optimized for CT firmware, probing pci device: 0x56.
[   10.321293] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[   10.327446] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[   10.519504] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/fwcfg-pci-0000:00:00.0.txt failed with error -2
[   10.530407] ath10k_pci 0000:00:00.0: Falling back to user helper
[   10.681152] firmware ath10k!fwcfg-pci-0000:00:00.0.txt: firmware_loading_store: map pages failed
[   10.690516] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/pre-cal-pci-0000:00:00.0.bin failed with error -2
[   10.701599] ath10k_pci 0000:00:00.0: Falling back to user helper
[   11.007662] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA9888/hw2.0/ct-firmware-5.bin failed with error -2
[   11.019002] ath10k_pci 0000:00:00.0: Falling back to user helper
[   11.151281] firmware ath10k!QCA9888!hw2.0!ct-firmware-5.bin: firmware_loading_store: map pages failed
[   11.161105] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA9888/hw2.0/ct-firmware-2.bin failed with error -2
[   11.172457] ath10k_pci 0000:00:00.0: Falling back to user helper
[   11.346084] firmware ath10k!QCA9888!hw2.0!ct-firmware-2.bin: firmware_loading_store: map pages failed
[   11.355906] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA9888/hw2.0/firmware-6.bin failed with error -2
[   11.366987] ath10k_pci 0000:00:00.0: Falling back to user helper
[   11.540529] firmware ath10k!QCA9888!hw2.0!firmware-6.bin: firmware_loading_store: map pages failed
[   12.133436] ath10k_pci 0000:00:00.0: qca9888 hw2.0 target 0x01000000 chip_id 0x00000000 sub 0000:0000
[   12.142996] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   12.162949] ath10k_pci 0000:00:00.0: firmware ver 10.4b-ct-9888-fW-012-38a5514c api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT crc32 2a31e1c4
[   12.497483] ath10k_pci 0000:00:00.0: board_file api 2 bmi_id 0:18 crc32 d65c17b1
[   14.534673] ath10k_pci 0000:00:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   14.542446] ath10k_pci 0000:00:00.0: msdu-desc: 2500  skid: 32
[   14.572900] ath10k_pci 0000:00:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   14.584209] ath10k_pci 0000:00:00.0: wmi print 'free: 121744 iram: 25908 sram: 30092'
[   14.795616] ath10k_pci 0000:00:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1
[   14.967346] ath9k 18100000.wmac: Direct firmware load for ath9k-eeprom-ahb-18100000.wmac.bin failed with error -2
[   14.977998] ath9k 18100000.wmac: Falling back to user helper
[   15.638153] ieee80211 phy1: Atheros AR9561 Rev:0 mem=0xb8100000, irq=2
[   15.669357] kmodloader: done loading kernel modules from /etc/modules.d/*
[   23.345884] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   23.386281] jffs2_build_filesystem(): unlocking the mtd device... 
[   23.386289] done.
[   23.394701] jffs2_build_filesystem(): erasing all blocks after the end marker... 
[   27.811454] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   27.879284] device eth0 entered promiscuous mode
[   27.897902] br-lan: port 1(eth0.1) entered blocking state
[   27.903483] br-lan: port 1(eth0.1) entered disabled state
[   27.909370] device eth0.1 entered promiscuous mode
[   28.001388] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   28.078789] IPv6: ADDRCONF(NETDEV_UP): eth0.2: link is not ready
[   28.829239] eth0: link up (1000Mbps/Full duplex)
[   28.834089] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   28.918449] br-lan: port 1(eth0.1) entered blocking state
[   28.924038] br-lan: port 1(eth0.1) entered forwarding state
[   28.930093] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.2: link becomes ready
[   29.077660] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   43.297671] done.
[   43.299695] jffs2: notice: (1248) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   43.749646] overlayfs: upper fs does not support tmpfile.
[  120.177615] random: crng init done



BusyBox v1.30.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r0+9611-6087c7b9da
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#

WG1200CR デコード用スクリプト

C言語の知識が皆無なので、とりあえずShellScriptで強引にでっち上げたもの。めっちゃ遅い。
OpenWrt内の “xorimage” バイナリが必要。

整理する余裕が無いので、雑に書いたモノそのまま。変数名など色々アレなのは勘弁。

2019/03/13 追記: OpenWrtのxorimage.cから大部分を流用してNECファームウェア用エンコード/デコードプログラムでっち上げを試行。スクリプトで変換するよりも速い。
musashino205/nec-enc

2019/07/10 追記: nec-encは、多少修正が施された後OpenWrtのリポジトリにWG1200CRのサポートと一緒にマージ済み。通常は上記リポジトリよりもOpenWrtのnec-encの利用を推奨。
openwrt/nec-enc.c at master · openwrt/openwrt
また、Windows用のencode/decodeプログラムもC#で雑に作った。
musashino205/nec-wintools
Windows用ツールは、現在nec-enc以外にもOpenWrtの他のfirmware-utilsも取り込むべく別途作業中。

“KEY”

  • WF1200CR: ryztfyutcrqqo69d
  • WG1200CR: 9gsiy9nzep452pad
  • WG2600HS: met186zxlobyao3p
#!/bin/bash

KEY="9gsiy9nzep452pad"		# for WG1200CR
KEY2_MAX="251"			# 0x01 - 0xFB

# ================ #
#   Environment    #
# ================ #
TOOLS_DIR="/home/tofu/router/firmware-utils"
WORK_DIR="./tmp"
DEF_OUTPUT_DIR="./bin"
DEF_OUTPUT_BIN="${DEF_OUTPUT_DIR}/firmware.dec"
PRINT_INFO="0"

key2_generate()
{
	local max=${1:-251}
	local vals=""

	for i in $(seq 1 $max); do
		vals="${vals}\x$(printf '%02x' ${i})"
	done

	echo -ne "$vals"
}

# input file
INPUT_BIN=$1

[ -z "$INPUT_BIN" ] && echo "input file is not specified!!" && exit 1
[ ! -r "$INPUT_BIN" ] && echo "input file does not exist or cannot read!!" && exit 1

LEN="$(stat -c%s $INPUT_BIN)"
BLOCKS="$(($LEN / $KEY2_MAX))"
BLOCKS2="$(($LEN / 128))"
FOOTER_LEN="$(($LEN % $KEY2_MAX))"
FOOTER2_LEN="$(($LEN % 128))"

#if [ "$PRINT_INFO" -eq "1" ]; then
	echo ""
	echo "=== file info ==="
	echo "input file: $1"
	echo "file length: $LEN bytes"
	echo "blocks: $BLOCKS"
	echo "footer_len: $FOOTER_LEN bytes"
	echo "blocks2: $BLOCKS2"
	echo "footer2_len: $FOOTER2_LEN bytes"
	echo "================="
#fi

#exit 0

if [ "$BLOCKS" -gt "0" ]; then
	[ "$PRINT_INFO" -eq "1" ] && echo "\$BLOCKS > 0"
	value="$(key2_generate)"
fi

[ ! -e "$WORK_DIR" ] && mkdir "$WORK_DIR"

if [ -e "${WORK_DIR}/key2_gen.bin" ]; then
	[ ! -w "${WORK_DIR}/key2_gen.bin" ] && echo "cannot write to \"${WORK_DIR}/key2_gen.bin\" !!" && exit 1
	echo -n "" > "${WORK_DIR}/key2_gen.bin"
fi

for i in $(seq 1 $BLOCKS); do
	echo -n "$value" >> "${WORK_DIR}/key2_gen.bin"
done

# append footer
if [ "$FOOTER_LEN" -gt "0" ]; then
	value="$(key2_generate $FOOTER_LEN)"
	echo -n "$value" >> "${WORK_DIR}/key2_gen.bin"
fi

# xor by xorimage
${TOOLS_DIR}/xorimage \
	-i "${WORK_DIR}/key2_gen.bin" -o "${WORK_DIR}/key2_gen.xor" \
	-p "$KEY"

# xor by xorimage (stage2)
if [ -e "${WORK_DIR}/fw_tmp.bin" ]; then
	[ ! -w "${WORK_DIR}/fw_tmp.bin" ] && echo "cannot write to \"${WORK_DIR}/fw_tmp.bin\" !!" && exit 1
	echo -n "" > "${WORK_DIR}/fw_tmp.bin"
fi

for blk in $(seq 1 $BLOCKS2); do
	ptn="$(hexdump -v -n 128 -s $((($blk - 1) * 128)) -e '/1 "%02x"' ${WORK_DIR}/key2_gen.xor)"

	[ "$PRINT_INFO" -eq "1" ] && echo "seq: $blk, ptn: $ptn"

	dd if="$INPUT_BIN" bs=128 count=1 skip=$(($blk - 1)) 2> /dev/null | \
		${TOOLS_DIR}/xorimage -p "$ptn" -x >> "${WORK_DIR}/fw_tmp.bin"
	
done

if [ "$FOOTER2_LEN" -gt "0" ]; then
	ptn="$(hexdump -v -n $FOOTER2_LEN -s $(($blk * 128)) -e '/1 "%02x"' ${WORK_DIR}/key2_gen.xor)"

	echo "seq: (last block), ptn: $ptn"

	dd if="$INPUT_BIN" bs=1 count=$FOOTER2_LEN skip=$(($blk * 128)) 2> /dev/null | \
		${TOOLS_DIR}/xorimage -p "$ptn" -x >> "${WORK_DIR}/fw_tmp.bin"
fi

DECODE_LEN="$(stat -c%s ${WORK_DIR}/fw_tmp.bin)"

echo "file len: $LEN"
echo "decode len: $DECODE_LEN"
[ ! "$LEN" -eq "$DECODE_LEN" ] && echo "the length of decoded file is wrong!!" && exit 1

[ ! -e "$DEF_OUTPUT_DIR" ] && mkdir "$DEF_OUTPUT_DIR"

cp "${WORK_DIR}/fw_tmp.bin" "$DEF_OUTPUT_BIN"

echo "===== completed ====="

exit 0

WG1200CR

縁があって提供頂いたもの。本当に感謝。
早速シリアルを取って覗いてみたところ、予想通りU-BootもKernelもパスワードが掛けられているほか、U-BootのパスワードはWG2600HPなどとは別のものだった(WG800HPも違っていたが)。
OpenWrtサポートのため弄るのでメモ。

Switch

zone WAN LAN
port
(WG1200CR)
WAN LAN
port
(QCA8334)
port3 port2

MAC

  • LAN: 98:F1:99:xx:xx:24 (u-boot-env, lanmac (text))
  • WAN: 98:F1:99:xx:xx:25 (u-boot-env, wanmac (text))
  • 2.4G: 98:F1:99:xx:xx:26 (u-boot-env, wlan24mac (text))
  • 5G: 98:F1:99:xx:xx:27 (u-boot-env, wlan5mac (text))

U-Boot

autobootをCtrl+Cで止めた場合、192.168.1.1でtelnetdがパスワード無しで開始される。ただし、利用できるコマンドは本来のコマンド群のうち3種類 (boot, bootm, tp) のみ。
パスワードを調べられないかとテストクリップとライタを用いてSPI-NOR Flashのダンプを試みたが、ルータの回路の関係かライタの問題か、データの乱れが著しい。読み取る度にそこかしこの値が変化する。最終的に、なんとか必要部分のダンプに成功しU-Bootのパスワードが判明。

  • help
    ath> help
    ?       - alias for 'help'
    autoscr - run script from memory
    base    - print or set address offset
    bdinfo  - print Board Info structure
    boot    - boot default, i.e., run 'bootcmd'
    bootd   - boot default, i.e., run 'bootcmd'
    bootelf - Boot from an ELF image in memory
    bootm   - boot application image from memory
    bootp   - boot image via network using BootP/TFTP protocol
    bootvx  - Boot vxWorks from an ELF image
    clearenv - clear environment variables to persistent storage
    cmp     - memory compare
    coninfo - print console devices and information
    cp      - memory copy
    crc32   - checksum calculation
    dhcp    - invoke DHCP client to obtain IP/boot params
    echo    - echo args to console
    erase   - erase FLASH memory
    ethreg  - Switch/PHY Reg rd/wr  utility
    exit    - exit script
    flinfo  - print FLASH memory information
    go      - start application at address 'addr'
    help    - print online help
    httpsvr - Start HTTP server to load image
    iminfo  - print header information for application image
    itest   - return true/false on integer compare
    loop    - infinite loop on address range
    mct   - simple RAM test
    md      - memory display
    mii     - MII utility commands
    mm      - memory modify (auto-incrementing)
    mtest   - simple RAM test
    mw      - memory write (fill)
    nfs     - boot image via network using NFS protocol
    nm      - memory modify (constant address)
    pci     - list and access PCI Configuration Space
    ping    - send ICMP ECHO_REQUEST to network host
    pll cpu-pll dither ddr-pll dither - Set to change CPU & DDR speed
    pll erase
    pll get
    printenv- print environment variables
    progmac - Set ethernet MAC addresses
    progmac2 - Set ethernet MAC addresses
    protect - enable or disable FLASH write protection
    rarpboot- boot image via network using RARP/TFTP protocol
    reset   - Perform RESET of the CPU
    run     - run commands in an environment variable
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    sleep   - delay execution for some time
    stop_boot - stop boot test
    telnetd - start telnetd
    test    - minimal test like /bin/sh
    tftpboot- boot image via network using TFTP protocol
    tp      - test program
    version - print monitor version
    

  • version
    ath> version
    
    U-Boot 1.1.4 (Nov  1 2017 - 20:40:33)
    

  • tp ?
    ath> tp ?
    support commands ...
    pulse      Ethernet 1000M Pulse Test
    link       Ethernet Link Status
    reset      RESET Test
    test sdram        SDRAM Test
    test timer       TIMER Test
    lan        LAN Test 
    wan        WAN Test
    test checksum      CHECK SUM Test
    test post       Power On Self Test
    get        GET env 
    set        SET env 
    btn        Button Test [reset | wps]
    aging     Aging Test
    err        ERR DISPLAY
    test sw         Switch confirm Test
    

  • printenv
    ath> printenv
    bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),6336k(rootfs),1408k(uImage),64k(mib0),64k(ART)
    bootcmd=bootm 0x9f080040
    bootdelay=2
    baudrate=115200
    ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
    ipaddr=192.168.1.1
    serverip=192.168.1.10
    seattle=setenv bootcmd 'bootm 0x9f080040' && saveenv
    bc=ap152-8M
    lof=tftp 0x80060000 openwrt-ar71xx-generic-${bc}-rootfs-squashfs.bin && erase 0x9f050000 +${filesize} && cp.b $fileaddr 0x9f050000 $filesize
    lok=tftp 0x80060000 openwrt-ar71xx-generic-${bc}-kernel.bin && erase 0x9f6e0000 +${filesize} && cp.b $fileaddr 0x9f6e0000 $filesize
    lqsdk=setenv bootcmd 'bootm 0x9f6e0000' && saveenv && run lof && run lok
    telnetd=1
    dir=
    lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
    lf=tftp 0x80060000 ${dir}ap152${bc}-jffs2&&erase 0x9f050000 +0x630000&&cp.b $fileaddr 0x9f050000 $filesize
    lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize&&cp.b $fileaddr 0x9f680000 $filesize
    mfcmode=0
    calmode=0
    stop_boot=0
    atelnetd=0
    stdin=serial
    stdout=serial
    stderr=serial
    ethact=eth0
    
    Environment size: 1147/32764 bytes
    

  • mii device
    ath> mii device
    MII devices: 'eth0' 
    Current device: 'eth0'
    

  • md.l 0x18050048 1
    ath> md.l 0x18050048 1
    18050048: 03000101    ....
    

  • ethreg
    ath> ethreg 0x4
    Read Reg: 0x00000004 = 0x00000080
    ath> ethreg 0x50
    Read Reg: 0x00000050 = 0xcc35cc35
    ath> ethreg 0x54
    Read Reg: 0x00000054 = 0xca35ca35
    ath> ethreg 0x58
    Read Reg: 0x00000058 = 0xc935c935
    ath> ethreg 0x5c
    Read Reg: 0x0000005c = 0x03ffff00
    ath> ethreg 0x7c
    Read Reg: 0x0000007c = 0x0000007e
    

Kernel

パスワードが掛けられており、またfailsafeも潰されている(or 元々無い)ためどうにもログイン不可。
ファーム本体はseama形式の模様。

  • uname -a
    U-Boot 1.1.4 (Nov  1 2017 - 20:40:33)
    
    SVN revision: 1501
    ap152 - Dragonfly 1.0DRAM:  
    sri
    ath_ddr_initial_config(278): (ddr2 init)
    ath_sys_frequency: cpu 775 ddr 650 ahb 258
    Tap values = (0x10, 0x10, 0x10, 0x10)
    128 MB
    Top of RAM usable for U-Boot at: 88000000
    Reserving 304k for U-Boot at: 87fb0000
    Reserving 160k for malloc() at: 87f88000
    Reserving 44 Bytes for Board Info at: 87f87fd4
    Reserving 36 Bytes for Global Data at: 87f87fb0
    Reserving 128k for boot params() at: 87f67fb0
    Stack Pointer at: 87f67f98
    Now running in RAM - U-Boot at: 87fb0000
    Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x17
    flash size 8MB, sector count = 128
    Flash:  8 MB
    Power up PLL with outdiv = 0 then switch to 3
    In:    serial
    Out:   serial
    Err:   serial
    Net:   ath_gmac_enet_initialize...
    No valid address in Flash. Using fixed address
    ath_gmac_enet_initialize: reset mask:c02200 
    athr_mgmt_init ::done
    Dragonfly  ----> S17 PHY *
    athrs17_reg_init: complete
    SGMII in forced mode
    athr_gmac_sgmii_setup SGMII done
    : cfg1 0x80000000 cfg2 0x7114
    eth0: 00:03:7f:09:0b:ad
    eth0 up
    eth0
    Setting 0x181162c0 to 0x40802100
    Trying eth0
    eth0 link down
    FAIL
    Using eth0 device
    listen from server 192.168.1.10; our IP address is 192.168.1.1
    monitor_packet_result 0
    Hit any key to stop autoboot:  0 
    ## Booting image at 9f080040 ...
       Image Name:   MIPS Seattle Linux-3.3.8
       Created:      2018-11-05   9:39:44 UTC
       Image Type:   MIPS Linux Multi-File Image (lzma compressed)
       Data Size:    1064192 Bytes =  1 MB
       Load Address: 80060000
       Entry Point:  80060000
       Contents:
       Image 0:  1064184 Bytes =  1 MB
       Verifying Checksum at 0x9f080080 ...OK
       Uncompressing Multi-File Image ... OK
    No initrd
    ## Transferring control to Linux (at address 80060000) ...
    ## Giving linux memsize in bytes, 134217728
    
    Starting kernel ...
    
    [    0.000000] Linux version 3.3.8 (kevin_huang@ub1204) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Mon Nov 5 17:13:14 CST 2018
    [    0.000000] bootconsole [early0] enabled
    [    0.000000] CPU revision is: 00019750 (MIPS 74Kc)
    [    0.000000] SoC: Qualcomm Atheros QCA956X rev 0
    [    0.000000] Clocks: CPU:775.000MHz, DDR:650.000MHz, AHB:258.333MHz, Ref:25.000MHz
    [    0.000000] Determined physical RAM map:
    [    0.000000]  memory: 08000000 @ 00000000 (usable)
    [    0.000000] Initrd not found or empty - disabling initrd
    [    0.000000] Zone PFN ranges:
    [    0.000000]   Normal   0x00000000 -> 0x00008000
    [    0.000000] Movable zone start PFN for each node
    [    0.000000] Early memory PFN ranges
    [    0.000000]     0: 0x00000000 -> 0x00008000
    [    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
    [    0.000000] Kernel command line: board=AP152 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env),64k@256k(devdata),64k(devconf),64k(misc),64k(wifimngdata),7616k(upgrade),64k(art),8m@0(rootfs)ro,8m@0(firmware)ro root=/dev/mtdblock8 init=/sbin/init noinitrd crashkernel=10M@20M
    [    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
    [    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
    [    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
    [    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
    [    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
    [    0.000000] Writing ErrCtl register=00000000
    [    0.000000] Readback ErrCtl register=00000000
    [    0.000000] Memory: 126284k/131072k available (2256k kernel code, 4788k reserved, 579k data, 188k init, 0k highmem)
    [    0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
    [    0.000000] NR_IRQS:83
    [    0.000000] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
    [    0.060000] pid_max: default: 32768 minimum: 301
    [    0.060000] Mount-cache hash table entries: 512
    [    0.060000] Performance counters: mips/74K PMU enabled, 4 32-bit counters available to each CPU, irq 13
    [    0.070000] NET: Registered protocol family 16
    [    0.080000] gpiochip_add: registered GPIOs 0 to 22 on device: ath79
    [    0.080000] MIPS: machine is Qualcomm Atheros AP152 reference board
    [    0.090000] 
    [    0.090000] WLAN firmware dump buffer allocation of 2097152 bytes @ address 0x87a00000- SUCCESS !!!
    [    0.100000] registering PCI controller with io_map_base unset
    [    0.310000] bio: create slab  at 0
    [    0.310000] PCI host bridge to bus 0000:00
    [    0.320000] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
    [    0.320000] pci_bus 0000:00: root bus resource [io  0x0001]
    [    0.330000] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
    [    0.330000] pci 0000:00:00.0: using irq 40 for pin 1
    [    0.340000] Switching to clocksource MIPS
    [    0.340000] NET: Registered protocol family 2
    [    0.350000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    [    0.350000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
    [    0.360000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
    [    0.360000] TCP: Hash tables configured (established 4096 bind 4096)
    [    0.370000] TCP reno registered
    [    0.370000] UDP hash table entries: 256 (order: 0, 4096 bytes)
    [    0.380000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    [    0.380000] NET: Registered protocol family 1
    [    0.400000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
    [    0.400000] msgmni has been set to 246
    [    0.410000] io scheduler noop registered
    [    0.410000] io scheduler deadline registered (default)
    [    0.530000] HDLC line discipline maxframe=4096
    [    0.530000] N_HDLC line discipline registered.
    [    0.540000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
    [    0.560000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
    [    0.570000] console [ttyS0] enabled, bootconsole disabled
    [    0.570000] console [ttyS0] enabled, bootconsole disabled
    [    0.580000] m25p80 spi0.0: found mx25l6405d, expected m25p80
    [    0.590000] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
    [    0.590000] 10 cmdlinepart partitions found on MTD device spi0.0
    [    0.600000] spi0.0: the flash image has SEAMA header
    [    0.610000] spi0.0: squashfs filesystem found at offset 0x00190060
    [    0.610000] spi0.0: the flash image has SEAMA header
    [    0.620000] Creating 11 MTD partitions on "spi0.0":
    [    0.620000] 0x000000000000-0x000000040000 : "u-boot"
    [    0.630000] 0x000000040000-0x000000050000 : "u-boot-env"
    [    0.640000] 0x000000040000-0x000000050000 : "devdata"
    [    0.640000] 0x000000050000-0x000000060000 : "devconf"
    [    0.650000] 0x000000060000-0x000000070000 : "misc"
    [    0.660000] 0x000000070000-0x000000080000 : "wifimngdata"
    [    0.660000] 0x000000080000-0x0000007f0000 : "upgrade"
    [    0.670000] 0x0000007f0000-0x000000800000 : "art"
    [    0.670000] 0x000000190060-0x000000797060 : "rootfs"
    [    0.680000] mtd: partition "rootfs" set to be root filesystem
    [    0.690000] 0x000000080040-0x000000797060 : "firmware"
    [    0.690000] 0x000000000000-0x000000800000 : "flash"
    [    0.700000] m25p80 spi0.1: found pm25lv512, expected m25p80
    [    0.710000] m25p80 spi0.1: pm25lv512 (64 Kbytes)
    [    0.850000] ag71xx_mdio: probed
    [    0.850000] eth0: Atheros AG71xx at 0xb9000000, irq 4
    [    1.430000] eth0: Atheros AR8327 switch driver attached.
    [    4.370000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
    [    4.380000] PPP generic driver version 2.4.2
    [    4.380000] PPP BSD Compression module registered
    [    4.390000] PPP MPPE Compression module registered
    [    4.390000] NET: Registered protocol family 24
    [    4.400000] Netfilter messages via NETLINK v0.30.
    [    4.400000] nf_conntrack version 0.5.0 (1973 buckets, 7892 max)
    [    4.410000] xt_time: kernel timezone is -0000
    [    4.410000] ip_tables: (C) 2000-2006 Netfilter Core Team
    [    4.420000] TCP cubic registered
    [    4.420000] NET: Registered protocol family 17
    [    4.430000] 8021q: 802.1Q VLAN Support v1.8
    [    4.430000] ### of_selftest(): No testcase data in device tree; not running tests
    [    4.450000] VFS: Mounted root (squashfs filesystem) readonly on device 31:8.
    [    4.450000] Freeing unused kernel memory: 188k freed
    starting pid 825, tty '': '/etc/init.d/rcS'
    [/etc/init.d/S10init.sh]
    [/etc/init.d/S15udevd.sh]
    [/etc/init.d/S19init.sh]
    [/etc/init.d/S19wifi.sh]
    System is starting
    377+0 records in
    377+0 records out
    377+0 records in
    377+0 records out
    [    6.600000] mem_manager: module license 'unspecified' taints kernel.
    [    6.610000] Disabling lock debugging due to kernel taint
    [    6.810000] ath_dfs: Version 2.0.0
    [    6.810000] Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
    [    6.880000] ath_spectral: Version 2.0.0
    [    6.880000] Copyright (c) 2005-2009 Atheros Communications, Inc. All Rights Reserved
    [    8.090000] ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, PRIVATE_DIAG, WRITE_EEPROM, 11D)
    [    8.110000] ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
    [    8.140000] ath_tx99: Version 2.0
    [    8.140000] Copyright (c) 2010 Atheros Communications, Inc, All Rights Reserved
    [    8.340000] ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
    [    8.470000] __ath_attach: Set global_scn[0]
    [    8.480000] *** All the minfree values should be ic_wrap_com=869d1000 &wrap_com->wc_devt=869d1000 
    [    8.740000] ath_tx_paprd_init sc 873e0000 PAPRD Enabled
    [    8.750000] wifi0: Atheros 956X: mem_start: =0xb8100000, mem_end: =0xb8120000, irq=47
    [    8.760000] ath_da_pci:  (Atheros/multi-bss)
    [    9.330000] ath_ol_pci:  (Atheros/multi-bss)
    [    9.330000] hif_pci_enable_bus: con_mode = 0x0, device_id = 0x56
    [    9.340000] ath_ol_pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
    [    9.350000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
    [    9.350000] hif_pci_enable_bus: hif_enable_pci done *********** QCA9888 *************hif_pci_enable_bus: hif_type = 0xe, target_type = 0xchif_pci_enable_bus: hif_pci_probe_tgt_wakeup donehif_target_sync: Loop checking FW signalhif_target_sync: Got FW signal, retries = 0hif_config_ce: ce_init donehif_config_ce: X, ret = 0hif_set_hia: Ehif_set_hia_extnd: E
    [    9.400000] chip_id 0xc chip_revision 0x0
    [    9.400000] 
    [    9.400000]  CLOCK PLL skipped
    [    9.410000] hif_set_hia_extnd: setting the target pll frac ffffffff intval ffffffff
    [    9.410000] hif_set_hia_extnd: no frac provided, skipping pre-configuring PLL
    [    9.420000] hif_pci_bus_configure: hif_set_hia donehif_configure_irq: Ehif_pci_configure_legacy_irq: Ehif_pci_configure_legacy_irq: X, ret = 0hif_enable: X OKhif_napi_create: NAPI structures initializedhif_napi_create: NAPI id 6 created for pipe 5qca_napi_create: napi instance 32 created on pipe 4
    [    9.450000] hif_napi_event: received evnt: CONF cmd; v = 1 (state=0x1)hif_napi_event: setting configuration to ON
    [    9.460000] __ol_ath_attach() Allocated scn 86600380
    [    9.470000] __ol_ath_attach: dev name wifi1
    [    9.470000] ol_ath_attach interface_id 1
    [    9.480000] ol_target_init() BMI inited.
    [    9.480000] ol_target_init() BMI Get Target Info.
    [    9.490000] Chip id: 0xc, chip version: 0x1000000
    [    9.490000] 
    [    9.490000]  CE WAR Disabled
    [    9.500000] NUM_DEV=1 FWMODE=0x2 FWSUBMODE=0x0 FWBR_BUF 0
    [    9.500000] ol_target_init() configure Target .
    [    9.510000] 
    [    9.510000]  Target Version is 1000000
    [    9.510000] 
    [    9.510000]  Flash Download Address  c0000 
    [    9.520000] ol_transfer_bin_file: flash data file defined
    [    9.520000] ol_transfer_bin_file[3807] Get Caldata for wifi1.
    [    9.530000] qdf_fs_read[59], Open File /tmp/wifi1.caldata SUCCESS!!file system magic:-2054924042super blocksize:4096inode 1230file size:12064qc98xx_verify_checksum: flash checksum passed: 0x97b9
    [    9.550000] ol_transfer_bin_file 3868: Download Flash data len 12064
    [    9.550000] Board extended Data download address: 0x0
    [    9.580000] 
    [    9.580000]  Board data initialized
    [    9.590000] ol_ath_download_firmware: Download OTP, flash download ADDRESS 0xc0000
    [    9.600000] 
    [    9.600000]  Selecting  OTP binary for CHIP Version 0
    [    9.670000] ol_transfer_bin_file 3688: downloading file 0, Download data len 9080
    [    9.710000] 
    [    9.710000]  First OTP send param 8000
    [    9.950000] ol_ath_download_firmware :First OTP download and Execute is good address:0x4800 return param 4660
    [    9.960000] ol_ath_download_firmware:##Board Id 18 , CHIP Id 0
    [    9.970000] ol_ath_download_firmware: BOARDDATA DOWNLOAD TO address 0xc0000
    [    9.980000] 
    [    9.980000]  wifi1: Selecting board data file name boardData_2_0_QCA9888_5G_Y9582.bin
    [    9.990000] ol_transfer_bin_file: Board Data File download to address=0xc0000 file name=QCA9888/hw.2/boardData_2_0_QCA9888_5G_Y9582.bin
    [   10.010000] ol_transfer_bin_file 3688: downloading file 3, Download data len 12064
    [   10.020000] Board extended Data download address: 0x0
    [   10.050000] ol_ath_download_firmware: Using 0x1234 for the remainder of init
    [   10.050000] 
    [   10.050000]  Selecting  OTP binary for CHIP Version 0
    [   10.070000] ol_transfer_bin_file 3688: downloading file 0, Download data len 9080
    [   10.110000] 
    [   10.110000]  [Flash] : Ignore Module param
    [   10.120000] 
    [   10.120000]  Second otp download Param 10000 
    [   10.370000] ol_ath_download_firmware : Second OTP download and Execute is good, param=0x0 
    [   10.380000] 
    [   10.380000]  Mission mode: Firmware CHIP Version 0
    [   10.550000] ol_swap_seg_alloc: Successfully allocated memory for SWAP size=262144 
    [   10.570000] ol_swap_wlan_memory_expansion: length:239071 size_left:239091 dma_size_left:262144 fw_temp:c05be004 fw_entry_size:239095
    [   10.580000] ol_swap_wlan_memory_expansion: dma_virt_addr :a6580000 fw_temp: c05be008 length: 239071
    [   10.590000] Swap: bytes_left to copy: fw:16; dma_page:23073
    [   10.600000] ol_swap_wlan_memory_expansion: length:0 size_left:12 dma_size_left:23073 fw_temp:c05f85eb fw_entry_size:239095
    [   10.610000] Swap: wrong length read:0
    [   10.610000] ol_swap_wlan_memory_expansion: Swap total_bytes copied: 239071 Target address 41a928 
    [   10.620000] scn=86600380  target_write_addr=41a928 seg_info=8667d610 
    [   10.630000] ol_transfer_swap_struct:Code swap structure successfully downloaded for bin type =2 
    [   10.640000] bin_filename=QCA9888/hw.2/athwlan.bin swap_filename=/lib/firmware/QCA9888/hw.2/athwlan.codeswap.bin 
    [   10.650000] ol_transfer_bin_file: Downloading firmware file: QCA9888/hw.2/athwlan.bin
    [   11.040000] ol_transfer_bin_file 3688: downloading file 1, Download data len 377960
    [   12.500000] ol_target_init() Download FW done. 
    [   12.500000] ol_ath_attach() WMI attached. wmi_handle 8788c000 
    [   12.510000] wmi_unified_register_event_handler: Event id 62 is unavailable
    [   12.520000] +htc_create ..  HIF :86684000-htc_create: (0x879de800)
    [   12.520000] htc_wmi_init() HT Create . 879de800
    [   12.530000] htc_wmi_init 7563 host_enable 0 nss_nwifi_offload 0
    [   12.540000] ol_ath_set_default_tgt_config : AC Minfree buffer allocation through module param (umac.ko)
    [   12.540000]  OL_ACBKMinfree : 0
    [   12.550000]  OL_ACBEMinfree : 0
    [   12.550000]  OL_ACVIMinfree : 0
    [   12.550000]  OL_ACVOMinfree : 0
    [   12.560000] hif_enable_fastpath, Enabling fastpath mode
    [   12.560000] +HWT
    [   12.570000] hif_completion_thread_startup: pipe_num:0 pipe_info:0x8668705chif_completion_thread_startup: pipe_num:3 pipe_info:0x8668711chif_completion_thread_startup: pipe_num:4 pipe_info:0x8668715c
    [   12.590000] -HWT
    [   12.590000] Startup Mode-0 set
    [   12.590000] 
    [   12.590000] 
    [   12.600000] htt_peer_map_timer_init Enter pdev 85880000 hrtimer 85884960
    [   12.610000] 
    [   12.610000]  htt_alloc_peer_map_mem : Alloc Success : host q vaddr 866a6000 paddr 66a6000
    [   12.620000] 
    [   12.620000]  htt_alloc_peer_map_mem : Flush Interval Configured to 256 pkts
    [   12.630000] ol_txrx_pdev_attach: 2500 tx desc's allocated ; range starts from 85520000
    [   12.640000] Firmware_Build_Number:10 
    [   12.640000] FW wireless modes: 0x7f9001
    [   12.650000] num_rf_chain:0x00000002  ht_cap_info:0x0000085b  vht_cap_info:0x339979fa  vht_supp_mcs:0x0000fffa
    [   12.660000] wmi_service_coex_gpio 0, wmi_service_4_wire_coex_support 0, coex_version 0
    [   12.670000] 
    [   12.670000] Sending Ext resource cfg: HOST PLATFORM as 1
    [   12.670000] fw_feature_bitmap as 50 to TGT
    [   12.680000] ol_ath_service_ready_event: tt_support: 1
    [   12.680000] ol_ath_service_ready_event: periodic_chan_stats: 1
    [   12.690000] ol_ath_service_ready_event: sw_cal_support_check_flag: 1
    [   12.700000] Peer Caching Enabled ; num_peers = 530, num_active_peers = 52 num_tids = 104, num_vdevs = 17
    [   12.710000] EXT NSS Supported
    [   12.710000] idx 1 req 2  num_units 1 num_unit_info 12 unit size 256 actual units 53 
    [   12.720000] ol_ath_alloc_host_mem_chunk req_id 2 idx 0 num_units 53 unit_len 256,
    [   12.720000] idx 2 req 3  num_units 1 num_unit_info 12 unit size 1024 actual units 53 
    [   12.730000] ol_ath_alloc_host_mem_chunk req_id 3 idx 1 num_units 53 unit_len 1024,
    [   12.740000] idx 3 req 4  num_units 1 num_unit_info 12 unit size 4096 actual units 53 
    [   12.750000] ol_ath_alloc_host_mem_chunk req_id 4 idx 2 num_units 53 unit_len 4096,
    [   12.760000] idx 0 req 1  num_units 0 num_unit_info 2 unit size 896 actual units 531 
    [   12.770000] ol_ath_alloc_host_mem_chunk req_id 1 idx 3 num_units 531 unit_len 896,
    [   12.780000] idx 4 req 5  num_units 0 num_unit_info 2 unit size 1940 actual units 531 
    [   12.790000] ol_ath_alloc_host_mem_chunk req_id 5 idx 4 num_units 531 unit_len 1940,
    [   12.800000] Support not added yet for Service 91
    [   12.800000] Support not added yet for Service 92
    [   12.810000] No EXT_MSG send INIT now
    [   12.810000] chunk 0 len 13568 requested , ptr  0x5588000
    [   12.820000] chunk 1 len 54272 requested , ptr  0x5590000
    [   12.820000] chunk 2 len 217088 requested , ptr  0x55c0000
    [   12.830000] chunk 3 len 475776 requested , ptr  0x5600000
    [   12.830000] chunk 4 len 1030140 requested , ptr  0x5700000
    [   12.840000] ol_ath_service_ready_event[4253] WAPI MBSSID 2 
    [   12.850000] smart_log_init: Smart logging Enabled buf=855a0000 (size=65536)
    [   12.860000] Version = 16777216 3  status = 0
    [   12.870000] ol_ath_connect_htc() WMI is ready
    [   12.870000] htt_h2t_frag_desc_bank_cfg_msg - HTT_H2T_MSG_TYPE_FRAG_DESC_BANK_CFG sent to FW for radio ID = 1
    [   12.880000] target uses HTT version 2.2; host uses 2.2
    [   12.890000] ol_ath_attach() connect HTC. 
    [   12.900000] bypasswmi : 0
    [   12.900000] ol_regdmn_start: reg-domain param: regdmn=0, countryName=, wModeSelect=FFFFFFFF, netBand=FFFFFFFF, extendedChanMode=0.
    [   12.910000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x2) flags 0x2150
    [   12.920000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x4) flags 0xa0
    [   12.930000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x8) flags 0xc0
    [   12.930000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x20) flags 0xd0
    [   12.940000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x40) flags 0x150
    [   12.950000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x800) flags 0x10080
    [   12.960000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x2000) flags 0x20080
    [   12.960000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x4000) flags 0x40080
    [   12.970000] Add VHT80 channel: 5210
    [   12.980000] Add VHT80 channel: 5290
    [   12.980000] Add VHT80 channel: 5530
    [   12.980000] Add VHT80 channel: 5610
    [   12.990000] Skipping VHT80 channel 5660
    [   12.990000] Skipping VHT80 channel 5680
    [   12.990000] Skipping VHT80 channel 5700
    [   13.000000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5210 in case of VHT80+80
    [   13.010000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5290 in case of VHT80+80
    [   13.020000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5210 in case of VHT80+80
    [   13.030000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5290 in case of VHT80+80
    [   13.030000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5210 in case of VHT80+80
    [   13.040000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5290 in case of VHT80+80
    [   13.050000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5210 in case of VHT80+80
    [   13.060000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5290 in case of VHT80+80
    [   13.070000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5210 in case of VHT80+80
    [   13.080000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5290 in case of VHT80+80
    [   13.090000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5210 in case of VHT80+80
    [   13.100000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5290 in case of VHT80+80
    [   13.110000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5210 in case of VHT80+80
    [   13.120000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5290 in case of VHT80+80
    [   13.130000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5210 in case of VHT80+80
    [   13.130000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5290 in case of VHT80+80
    [   13.140000] freq=58 
    [   13.150000] freq=106 
    [   13.150000] freq=122 
    [   13.150000] OL Resmgr Init-ed
    [   13.160000] ieee80211_bsteering_attach: Band steering initialized
    [   13.160000] acfg_attach: using existing sock 872ae800
    [   13.170000] SPECTRAL : get_capability not registered
    [   13.170000] HAL_CAP_PHYDIAG : Capable
    [   13.180000] SPECTRAL : Need to fix the capablity check for RADAR (spectral_attach : 237)
    [   13.180000] SPECTRAL : get_capability not registered
    [   13.190000] HAL_CAP_RADAR   : Capable
    [   13.190000] SPECTRAL : Need to fix the capablity check for SPECTRAL
    [   13.190000]  (spectral_attach : 242)
    [   13.200000] SPECTRAL : get_capability not registered
    [   13.210000] HAL_CAP_SPECTRAL_SCAN : Capable
    [   13.210000] SPECTRAL : get_tsf64 not registered
    [   13.220000] spectral_init_netlink 78 NULL SKB
    [   13.220000] Green-AP : Green-AP : Attached
    [   13.220000] 
    [   13.230000] Green-AP : Attached
    [   13.230000] rate power table override is only supported for AR98XX
    [   13.240000] ol_ath_smart_ant_attach: Hardware doest not support Smart Antenna.
    [   13.250000] ol_if_dfs_attach: called; ptr=855b997c, radar_info=871bfb40
    [   13.250000] dfs_attach: event log enabled by default
    [   13.260000] >>>> CB Set   (null)
    [   13.260000] 
    [   13.260000] INIT WIFI LEDs
    [   13.270000] ol_ath_attach() UMAC attach . 
    [   13.270000] 
    [   13.270000]  BURSTING enabled by default
    [   13.280000] ol_ath_attach: Set global_ic[2] ..ptr:86946c00
    [   13.280000] ath_lowi_if_netlink_init LOWI Netlink successfully created
    [   13.290000] osif_wrap_attach:443 osif wrap attached
    [   13.290000] osif_wrap_devt_init:404 osif wrap dev table init done
    [   13.300000]  Wrap Attached: Wrap_com =85034200 ic->ic_wrap_com=85034200 &wrap_com->wc_devt=85034200 
    [   13.310000] __ol_ath_attach: needed_headroom reservation 60
    [   13.320000] ol_ath_thermal_mitigation_attach: --
    [   13.330000] ol_ath_pci_probe num_radios=0, wifi_radios[0].sc = 86600380 wifi_radio_type = 2
    [   13.340000] ath_sysfs_diag_init: diag_fsattr 
    [   13.370000]  pktlog_init: Initializing Pktlog for AR900B, pktlog_hdr_size = 16
    [   13.380000] +hif_update_pipe_callback pipeid 8
    [   13.390000] -hif_update_pipe_callback
    [   13.400000] __sa_init_module 
    [   13.540000] [wifi1] FWLOG: [20789] WAL_DBGID_TX_AC_BUFFER_SET ( 0x3, 0x1e, 0x94c, 0x94c, 0x0 )
    [   13.550000] [wifi1] FWLOG: [20789] WAL_DBGID_TX_AC_BUFFER_SET ( 0x12, 0x1e, 0x94c, 0x94c, 0x0 )
    [   13.560000] [wifi1] FWLOG: [20789] WAL_DBGID_TX_AC_BUFFER_SET ( 0x45, 0x1e, 0x94c, 0x94c, 0x0 )
    [   13.560000] [wifi1] FWLOG: [20789] WAL_DBGID_TX_AC_BUFFER_SET ( 0x67, 0x1e, 0x94c, 0x94c, 0x0 )
    [   13.570000] [wifi1] FWLOG: [20789] WAL_DBGID_TX_AC_BUFFER_SET ( 0x100, 0x11e1a300 )
    [   13.580000] [wifi1] FWLOG: [21079] UNKNOWN 22:55 ( 0x88, 0xa50, 0x540, 0x40, 0x0 )
    [   13.590000] [wifi1] FWLOG: [21079] UNKNOWN 22:55 ( 0x88, 0x40, 0x0, 0x40, 0x0 )
    [   14.500000] ath_net80211_dfs_clist_update: called, cmd=1, nollist=  (null), nentries=0
    [   14.510000] ath_attach_dfs[12614] dfsdomain 3
    [   14.510000] dfs_attach: event log enabled by default
    [   14.550000] isCountryCodeValid: EEPROM regdomain 0x88
    [   14.550000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x2) flags 0x2150
    [   14.560000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x4) flags 0xa0
    [   14.570000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x8) flags 0xc0
    [   14.570000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x20) flags 0xd0
    [   14.580000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x40) flags 0x150
    [   14.590000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x800) flags 0x10080
    [   14.600000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x2000) flags 0x20080
    [   14.600000] ol_regdmn_init_channels: !avail mode 0x7f9001 (0x4000) flags 0x40080
    [   14.610000] Add VHT80 channel: 5210
    [   14.610000] Add VHT80 channel: 5290
    [   14.620000] Add VHT80 channel: 5530
    [   14.620000] Add VHT80 channel: 5610
    [   14.630000] Skipping VHT80 channel 5660
    [   14.630000] Skipping VHT80 channel 5680
    [   14.630000] Skipping VHT80 channel 5700
    [   14.640000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5210 in case of VHT80+80
    [   14.650000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5290 in case of VHT80+80
    [   14.660000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5210 in case of VHT80+80
    [   14.660000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5290 in case of VHT80+80
    [   14.670000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5210 in case of VHT80+80
    [   14.680000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5290 in case of VHT80+80
    [   14.690000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5210 in case of VHT80+80
    [   14.700000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5530, cfreq2:5290 in case of VHT80+80
    [   14.710000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5210 in case of VHT80+80
    [   14.720000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5290 in case of VHT80+80
    [   14.730000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5210 in case of VHT80+80
    [   14.740000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5290 in case of VHT80+80
    [   14.750000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5210 in case of VHT80+80
    [   14.760000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5290 in case of VHT80+80
    [   14.760000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5210 in case of VHT80+80
    [   14.770000] EMI WAR rejecting fc1 > fc2 Combination cfreq1:5610, cfreq2:5290 in case of VHT80+80
    [   14.780000] freq=58 
    [   14.790000] freq=106 
    [   14.790000] freq=122 
    [/etc/init.d/S20init.sh]
    [   15.540000] [wifi1] FWLOG: [22757] UNKNOWN 22:55 ( 0x88, 0xa50, 0x540, 0x40, 0x0 )
    [   15.550000] [wifi1] FWLOG: [22757] UNKNOWN 22:55 ( 0x88, 0x40, 0x0, 0x40, 0x0 )
      DEFNODE[/etc/defnodes/S11devdata.xml]
      DEFNODE[/etc/defnodes/S12bootdata.sh]
    [   15.860000] Switching to Tx Mode-0
      DEFNODE[/etc/defnodes/S12flashspeed.php]
      DEFNODE[/etc/defnodes/S13dfs.php]
      DEFNODE[/etc/defnodes/S14setchlist.php]
      DEFNODE[/etc/defnodes/S15wifi.sh]
      DEFNODE[/etc/defnodes/S20device.xml]
      DEFNODE[/etc/defnodes/S22timezone.php]
    [/etc/scripts/setdate.sh] 10/01/2017 ...
    Sun Oct  1 09:00:16 GMT 2017
      DEFNODE[/etc/defnodes/S30device.php]
      DEFNODE[/etc/defnodes/S30device.xml]
      DEFNODE[/etc/defnodes/S31diagnostic.xml]
      DEFNODE[/etc/defnodes/S31locale.php]
      DEFNODE[/etc/defnodes/S40device.xml]
      DEFNODE[/etc/defnodes/S40links.php]
      DEFNODE[/etc/defnodes/S80mtfwu.php]
      DEFNODE[/etc/defnodes/S90opendns.php]
      DEFNODE[/etc/defnodes/S90sessions.php]
      DEFNODE[/etc/defnodes/S90sessions_privatekey.php]
      DEFNODE[/etc/defnodes/S90upnpigd.php]
      DEFNODE[/etc/defnodes/S90upnpwfa.php]
    SERVD: start service [LOGD]
    [/etc/init.d/S20interfaces.sh]
    [   17.110000] ssdk_plat_init start
    [   17.120000] Register QCA PHY driver
    [   17.130000] PHY ID is 0x4dd036
    [   17.230000] qca probe f1 phy driver succeeded!
    [   17.240000] qca-ssdk module init succeeded!
    [   17.270000] fast-classifier: starting up
    [   17.270000] fast-classifier: registered
    [/etc/init.d/S21setnode.sh]
    [/etc/init.d/S23udevd.sh]
    [/etc/init.d/S45gpiod.sh]
    [/etc/init.d/S49wlc.sh]
    [/etc/init.d/S50wzcm.sh]
    [/etc/init.d/S90wssctl.sh]
    WSS: starting wssctl
    [/etc/init.d/rcS] done!
    [/etc/init0.d/S21layout.sh]: start ...
    SERVD: start service [LAYOUT]
    [/etc/init0.d/S40event.sh]: start ...
    SERVD: event [SEALPAC.LOAD/default]
    [/etc/init0.d/S40gpioevent.sh]: start ...
    SEAMA: need meta for searching image.
    [/etc/init0.d/S41autowan.sh]: start ...
    [/etc/init0.d/S41event.sh]: start ...
    [/etc/init0.d/S41inf.sh]: start ...
    [/etc/init0.d/S42napt.sh]: start ...
    [/etc/init0.d/S42pthrough.sh]: start ...
    [/etc/init0.d/S43checkfw.sh]: start ...
    [/etc/init0.d/S43netchk.sh]: start ...
    [/etc/init0.d/S51wlan.sh]: start ...
    [/etc/init0.d/S65ddnsd.sh]: start ...
    [/etc/init0.d/S65logd.sh]: start ...
    /etc/init0.d/S65ddnsd.sh: line 7: ddnsd: not found
    [/etc/init0.d/S65user.sh]: start ...
    
     SSDK Init OK!
    operation done.
    
    
     SSDK Init OK!
    operation done.
    
    [   19.130000] device eth0 entered promiscuous mode
    [   19.170000] device eth0.1 entered promiscuous mode
    [   19.190000] device eth0.2 entered promiscuous mode
    [/etc/init0.d/S91proclink.sh]: start ...
    Create /var/proc/alpha symbolic link...
    [/etc/init0.d/S93cpuload.sh]: start ...
    [/etc/init0.d/S94aim.sh]: start ...
    AIM: starting aim
    [/etc/init0.d/S94dnsnquery.sh]: start ...
    Enable pause frame function of port LAN1 (0x1)
    
     SSDK Init OK!
    operation done.
    
    
     SSDK Init OK![/etc/init0.d/S94watchdog.sh]: start ...
    [   19.510000] AR71XX_RESET_REG_WDOG_CTRL: 0x80000000
    [   19.510000]  
    [   19.520000] Last system reboot was due to WDOG
    [   19.560000] br0: port 1(eth0.1) entered forwarding state
    [   19.560000] br0: port 1(eth0.1) entered forwarding state
    [   19.570000] br0: port 2(eth0.2) entered forwarding state
    [   19.580000] br0: port 2(eth0.2) entered forwarding state
    [   19.580000] eth0: link up (1000Mbps/Full duplex)
    
    operation done.
    
    Disable eee function of port LAN1 (0x1)
    
     SSDK Init OK!
    operation done.
    
    
     SSDK Init OK!
    operation done.
    
    
     SSDK Init OK!
    operation done.
    
    
     SSDK Init OK!
    operation done.
    
    
     SSDK Init OK!
    operation done.
    
    SERVD: start service [BRIDGE]
    SERVD: start service [LAN]
    LAN: The device is not in the router mode.
    SERVD: start service [WAN]
    WAN: The device is not in the router mode.
    SERVD: start service [DEVICE.NAPT]
    SERVD: start service [DEVICE.PASSTHROUGH]
    SERVD: start service [DEVICE.NETCHK]
    SERVD: start service [WIFI.PHYINF]
    SERVD: service [WIFI.PHYINF] return error 108.
    SERVD: start service [PHYINF.WIFI]
    [/etc/init0.d/S95password.sh]: start ...
    [   21.600000] br0: port 1(eth0.1) entered disabled state
    [   21.600000] br0: port 2(eth0.2) entered disabled state
    [   23.620000] br0: port 1(eth0.1) entered forwarding state
    [   23.620000] br0: port 1(eth0.1) entered forwarding state
    SERVD: event [WPS.NONE/default]
    [   25.310000] dfs_control ignore cac = 0xffffffff 
    [   25.350000] dfs_control ignore cac = 0xffffffff 
    [   25.370000] dfs_control ignore cac = 0xffffffff 
    [   25.400000] dfs_control ignore cac = 0xffffffff 
    SERVD: stop service [LOGD]
    SERVD: start service [LOGD]
    SERVD: start service [DEVICE.ACCOUNT]
    Password for 'admin' has been updated
    Password for 'root' has been updated
    SERVD: stop service [HTTP]
    SERVD: service [HTTP] is already stopped.
    SERVD: start service [HTTP]
    SERVD: event [HTTP.UP] not found!
    SERVD: start service [ENLAN]
    SERVD: start service [PHYINF.ETH-1]
    SERVD: start service [DNS]
    killall: dnsmasq: no process killed
    SERVD: start service [IPTABLES]
    CONNTRACK_MAX=30000
    CONNTRACK_MIN=15000
    SERVD: start service [INET.BRIDGE-1]
    [/var/servd/INET.BRIDGE-1_start.sh]: starting BRIDGE-1...
    [/var/servd/INET.BRIDGE-1_start.sh]: starting BRIDGE-1 done !!!
    SERVD: start service [IPTABLES]
    SERVD: service [IPTABLES] is already started.
    SERVD: start service [IPTABLES]
    SERVD: service [IPTABLES] is already started.
    SERVD: stop service [IPT.LAN-1]
    SERVD: service [IPT.LAN-1] is already stopped.
    SERVD: start service [IPT.LAN-1]
    SERVD: stop service [IPT.LAN-2]
    SERVD: service [IPT.LAN-2] is already stopped.
    SERVD: start service [IPT.LAN-2]
    SERVD: stop service [IPT.LAN-3]
    SERVD: service [IPT.LAN-3] is already stopped.
    SERVD: start service [IPT.LAN-3]
    SERVD: service [IPT.LAN-3] return error 108.
    SERVD: stop service [IPT.LAN-4]
    SERVD: service [IPT.LAN-4] is already stopped.
    SERVD: start service [IPT.LAN-4]
    SERVD: service [IPT.LAN-4] return error 108.
    SERVD: stop service [IPT.LAN-5]
    SERVD: service [IPT.LAN-5] is already stopped.
    SERVD: start service [IPT.LAN-5]
    SERVD: service [IPT.LAN-5] return error 108.
    SERVD: stop service [IPT.LAN-6]
    SERVD: service [IPT.LAN-6] is already stopped.
    SERVD: start service [IPT.LAN-6]
    SERVD: service [IPT.LAN-6] return error 108.
    SERVD: start service [PHYINF.WIFISTA-1.1]
    killall: wpa_supplicant: no process killed
    [   27.580000] wlan_vap_create : enter. devhandle=0x872f0380, opmode=IEEE80211_M_STA, flags=0x1
    [   27.590000] wlan_vap_create : exit. devhandle=0x872f0380, vap=0x85398000, opmode=IEEE80211_M_STA, flags=0x1.
    [   27.600000] __ieee80211_smart_ant_init: Smart Antenna is not supported 
    [   27.610000] VAP device ath0 created osifp: (85178b80) os_if: (85398000)
    ath0
    [   27.700000]  
    [   27.700000]  DES SSID SET=aterm 
    [   27.710000]  ieee80211_ioctl_siwmode: imr.ifm_active=131200, new mode=2, valid=1 
    [   27.710000] siwfreq
    Error for wireless request "Set Frequency" (8B04) :
        SET failed on device ath0 ; Invalid argument.
    [   27.730000] Setting nec dual creds ie state 1
    [   27.740000] Setting nec tv mode ie state 2
    [   27.750000] device ath0 entered promiscuous mode
    SERVD: event [WLAN.CONNECTED] not found!
    SERVD: start service [PHYINF.WIFISTA-2.1]
    [   28.030000] wlan_vap_create : enter. devhandle=0x86600380, opmode=IEEE80211_M_STA, flags=0x1
    [   28.040000] send_vdev_create_cmd_non_tlv: ID = 0 Type = 2, Subtype = 0 VAP Addr = 98:f1:99:f2:1d:26:
    [   28.050000] send_set_ps_mode_cmd_non_tlv:set psmode=1
    [   28.050000] wlan_vap_create : exit. devhandle=0x86600380, vap=0x853c0000, opmode=IEEE80211_M_STA, flags=0x1.
    [   28.060000] __ieee80211_smart_ant_init: Smart Antenna is not supported 
    [   28.070000] Enabling TX checksum bit for the vap ath1 features 4000 
    [   28.080000] Enabling SG bit for the vap ath1 features 4000 
    [   28.080000] Enabling SG bit for the vap ath1 features 4000 
    [   28.090000] Enabling TSO bit for the vap ath1 features 4000 
    [   28.090000] Enabling LRO bit for the vap ath1 features 4000 
    [   28.100000] VAP device ath1 created osifp: (8517a380) os_if: (853c0000)
    ath1
    [   28.120000] send_set_ps_mode_cmd_non_tlv:set psmode=0
    [   28.120000] send_set_ps_mode_cmd_non_tlv:set psmode=0
    [   28.160000]  
    [   28.160000]  DES SSID SET=aterm 
    [   28.170000]  ieee80211_ioctl_siwmode: imr.ifm_active=65664, new mode=2, valid=1 
    [   28.170000] siwfreq
    Error for wireless request "Set Frequency" (8B04) :
        SET failed on device ath1 ; Invalid argument.
    [   28.190000] Setting nec dual creds ie state 1
    [   28.200000] Setting nec tv mode ie state 2
    [   28.210000] device ath1 entered promiscuous mode
    SERVD: event [WLAN.CONNECTED] not found!
    SERVD: stop service [WEBACCESS]
    SERVD: service [WEBACCESS] is already stopped.
    SERVD: start service [WEBACCESS]
    SERVD: service [WEBACCESS] return error 108.
    SERVD: stop service [ADP]
    SERVD: service [ADP] is already stopped.
    SERVD: start service [ADP]
    Successfully ini[   32.800000] ieee80211_ucfg_getparam : parameter 0x284 not supported 
    tialized wpa_sup[   32.810000] ieee80211_ucfg_getparam : parameter 0x284 not supported 
    plicant
    Success[   32.820000] br0: port 4(ath1) entered forwarding state
    fully initialize[   32.820000] br0: port 4(ath1) entered forwarding state
    d wpa_supplicant[   32.830000] Sending SCAN START cmd
    
    [   32.840000] 8021q: adding VLAN 0 to HW filter on device ath1
    [   32.880000] br0: port 3(ath0) entered forwarding state
    [   32.890000] br0: port 3(ath0) entered forwarding state
    [   32.890000] 8021q: adding VLAN 0 to HW filter on device ath0
    [   32.910000] send_vdev_down_cmd_non_tlv for vap 0
    ath1: CTRL-EVENT-REGDOM-CHANGE init=CORE type=UNKNOWN
    [   32.930000] Sending SCAN START cmd
    [   33.540000] [wifi1] FWLOG: [41242] WAL channel change freq=5260, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   33.550000] [wifi1] FWLOG: [41318] RESMGR_OCS_GEN_PERIODIC_NOA ( 0x0 )
    [   33.560000] [wifi1] FWLOG: [41318] RESMGR_OCS_GEN_PERIODIC_NOA ( 0x0 )
    [   33.560000] [wifi1] FWLOG: [41651] WAL channel change freq=5280, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   34.540000] [wifi1] FWLOG: [41965] WAL channel change freq=5300, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   34.550000] [wifi1] FWLOG: [42278] WAL channel change freq=5320, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   34.560000] [wifi1] FWLOG: [42591] WAL channel change freq=5180, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   34.570000] [wifi1] FWLOG: [42802] WAL channel change freq=5200, mode=0 flags=0 rx_ok=1 tx_ok=1
    ath0: CTRL-EVENT-REGDOM-CHANGE init=CORE type=UNKNOWN
    [   35.540000] [wifi1] FWLOG: [43013] WAL channel change freq=5220, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   35.550000] [wifi1] FWLOG: [43224] WAL channel change freq=5240, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   35.560000] [wifi1] FWLOG: [43435] WAL channel change freq=5500, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   35.570000] [wifi1] FWLOG: [43749] WAL channel change freq=5520, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   36.540000] [wifi1] FWLOG: [44062] WAL channel change freq=5540, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   36.550000] [wifi1] FWLOG: [44376] WAL channel change freq=5560, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   36.560000] [wifi1] FWLOG: [44689] WAL channel change freq=5580, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   36.570000] [wifi1] FWLOG: [45002] WAL channel change freq=5600, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   37.540000] [wifi1] FWLOG: [45316] WAL channel change freq=5620, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   37.550000] [wifi1] FWLOG: [45629] WAL channel change freq=5640, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   37.560000] [wifi1] FWLOG: [45942] WAL channel change freq=5660, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   38.340000] send_vdev_down_cmd_non_tlv for vap 0
    [   38.350000] br0: port 4(ath1) entered disabled state
    [   38.540000] [wifi1] FWLOG: [46256] WAL channel change freq=5680, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   38.550000] [wifi1] FWLOG: [46569] WAL channel change freq=5700, mode=0 flags=0 rx_ok=1 tx_ok=1
    [   38.560000] [wifi1] FWLOG: [46888] RESMGR_OCS_GEN_PERIODIC_NOA ( 0x0 )
    [   38.570000] [wifi1] FWLOG: [46888] RESMGR_OCS_GEN_PERIODIC_NOA ( 0x0 )
    [   51.670000] br0: port 3(ath0) entered disabled state
    

  • firmware update log
    [/etc/scripts/upwifistatshlper_A_band.sh] CONNSTATUS ath1 1 ....
    not support [CONNSTATUS] ...
    [ephp.c read_operand_list 1234] PHP operator precedence issue at: /htdocs/webinc/js/tools_fw_rlt.php, operand_qty: 6, add_qty: 2, mul_qty: 3
    SERVD: event [PREFWUPDATE/default]
    [/etc/scripts/prefwupdate.sh] ....
    SERVD: stop service [THERMAL]
    Stop THERMAL service ..
    SERVD: event [STATUS.CRITICAL] not found!
    SERVD: stop service [WAN]
    SERVD: stop service [WIFI]
    SERVD: service [WIFI] is already stopped.
    SERVD: stop service [LAN]
    SERVD: stop service [INET.WAN-1]
    [/var/servd/INET.WAN-1_stop.sh]: stopping WAN-1...
    [/var/servd/INET.WAN-1_stop.sh]: stopping WAN-1 done !!!
    SERVD: stop service [INET.WAN-2]
    SERVD: service [INET.WAN-2] is already stopped.
    SERVD: stop service [INET.WAN-3]
    SERVD: service [INET.WAN-3] is already stopped.
    SERVD: stop service [INET.WAN-4]
    SERVD: service [INET.WAN-4] is already stopped.
    SERVD: stop service [INET.WAN-5]
    SERVD: service [INET.WAN-5] is already stopped.
    SERVD: stop service [IPT.WAN-1]
    SERVD: stop service [IPT.WAN-2]
    SERVD: stop service [IPT.WAN-3]
    SERVD: stop service [IPT.WAN-4]
    SERVD: stop service [IPT.WAN-5]
    SERVD: service [IPT.WAN-5] is already stopped.
    SERVD: stop service [IPTDMZ]
    SERVD: stop service [IPTPORTT]
    SERVD: stop service [IPTPFWD]
    SERVD: stop service [IPTVSVR]
    iptables: No chain/target/match by that name.
    SERVD: stop service [IPTMASQ]
    SERVD: stop service [INET.LAN-1]
    [/var/servd/INET.LAN-1_stop.sh]: stopping LAN-1...
    SERVD: event [LAN-1.DOWN/default]
    /var/run/phpsh-4653.sh: line 6: can't create /proc/nf_accelerate_to_local: nonexistent directory
    [/var/servd/INET.LAN-1_stop.sh]: stopping LAN-1 done !!!
    SERVD: stop service [INET.LAN-2]
    SERVD: service [INET.LAN-2] is already stopped.
    SERVD: stop service [INET.LAN-4]
    SERVD: service [INET.LAN-4] is already stopped.
    SERVD: stop service [INET.LAN-5]
    SERVD: service [INET.LAN-5] is already stopped.
    SERVD: stop service [INET.LAN-6]
    SERVD: service [INET.LAN-6] is already stopped.
    SERVD: stop service [IPT.LAN-1]
    SERVD: stop service [IPT.LAN-2]
    SERVD: stop service [IPT.LAN-3]
    SERVD: service [IPT.LAN-3] is already stopped.
    SERVD: stop service [IPT.LAN-4]
    SERVD: service [IPT.LAN-4] is already stopped.
    SERVD: stop service [IPT.LAN-5]
    SERVD: service [IPT.LAN-5] is already stopped.
    SERVD: stop service [IPT.LAN-6]
    SERVD: service [IPT.LAN-6] is already stopped.
    SERVD: stop service [ACCESSCTRL]
    SERVD: stop service [HTTP]
    SERVD: event [HTTP.DOWN/default]
    [/etc/events/FWUPDATER.sh] ...
    kill servd, xmldb, watchdog, and load.sh
    copy upgrade needed file to ramfs
    remout /www /htdocs /etc /usr /bin /sbin to empty ramfs avoid someone access rootfs
    FWUPDATER: about to write 7434336 bytes data to /dev/mtdblock/6
    FWUPDATER: cost 58.500600 seconds
    fwupdate: unable to read SEAMA header!
    /etc/events/FWUPDATER.sh: line 44: ca[  146.890000] ath_vap_stopping=1
    n't create /proc/driver/system_reset: nonexistent directory
    /etc/events/FWUPDATER.sh: line 45: can't create /proc/system_reset: nonexistent directory
    The system is going down NOW!
    Sent SIGTERM to all processes
    [  146.930000] mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
    [  146.970000] __ieee80211_smart_ant_init: Smart Antenna is not supported 
    [  146.980000] ol_ath_vap_stopping=1
    [  146.980000] STOPPED EVENT for vap 0 (8788c000)
    [  146.990000] send_vdev_down_cmd_non_tlv for vap 0
    [  147.020000] OL vap_start +
    [  147.020000] VDEV START
    [  147.020000] OL vap_start -
    [  147.020000] ol_vdev_start_resp_ev for vap 0 (8788c000)
    [  147.030000] su bfee 1 mu bfee 0 su bfer 1 mu bfer 1 impl bf 0 sounding dim 1
    [  147.040000] send_vdev_up_cmd_non_tlv for vap 0
    [  147.040000] ol_ath_vap_up=1
    [  147.040000] __ieee80211_smart_ant_init: Smart Antenna is not supported 
    [  147.050000] ol_ath_vap_set_param: Now supported MGMT RATE is 6000(kbps) and rate code: 0x3
    [  147.060000] ol_ath_vap_set_param: Now supported MCAST RATE is 6000(kbps) and rate code: 0x3
    [  147.580000] [wifi1] FWLOG: [158118] WAL_DBGID_SECURITY_MCAST_KEY_SET ( 0x1 )
    [  147.580000] [wifi1] FWLOG: [158134] RESMGR_OCS_GEN_PERIODIC_NOA ( 0x0 )
    [  147.590000] [wifi1] FWLOG: [158134] RESMGR_OCS_GEN_PERIODIC_NOA ( 0x0 )
    [  147.600000] [wifi1] FWLOG: [158163] vap-0 VDEV_MGR_VDEV_START ( 0x1464, 0x2, 0x0, 0x0 )
    [  147.610000] [wifi1] FWLOG: [158163] UNKNOWN 14:20 ( 0x0 )
    [  147.610000] [wifi1] FWLOG: [158183] VDEV_MGR_HP_START_TIME ( 0x0, 0x1464, 0x8007000 )
    [  147.620000] [wifi1] FWLOG: [158183] RESMGR_OCS_GEN_PERIODIC_NOA ( 0x1 )
    [  147.630000] [wifi1] FWLOG: [158183] RESMGR_OCS_GEN_PERIODIC_NOA ( 0x0 )
    [  147.630000] [wifi1] FWLOG: [158183] VDEV_MGR_AP_TBTT_CONFIG ( 0x0, 0x1464, 0x0, 0x0 )
    Sent SIGKILL to all processes
    Requesting system reboot
    [  148.900000] Restarting system.
    

WG1400HP GPIOメモ

WG1400HPでのGPIOのレジスタを調べたメモ。整理するのが面倒なのでテキストのメモそのまま。

boot> debug memory read 0xb8040000 70
b8040000:00a6031f 20bcee2d 0000ec00 00000000 .... ..-........
b8040010:00000000 00000000 00000000 00000000 ................
b8040020:00000000 00000000 00000000 00000000 ................
b8040030:0c080900 00160000 00000000 07000000 ................
b8040040:00000006 00000908 00000000 00000000 ................
b8040050:00000000 14130000 80808080 80808080 ................
b8040060:80808080 80808080 00000000 00000002 ................

# Output Enable
val: 0xa6031f

IN: 0, 1, 2, 3, 4, 8, 9, 17, 18, 21, 23
OUT: 5, 6, 7, 10, 11, 12, 13, 14, 15, 16, 19, 20, 22

# Input Value
val: 0x20bcee2d

INPUT=1: 0, 2, 3, 5, 9, 10, 11, 13, 14, 15, 18, 19, 20, 21, 23
INPUT=0: 1, 4, 6, 7, 8, 12, 16, 17, 22

# Output Value
val: 0xec00 (kernel: 0x40ec00)

OUTPUT=1: 10, 11, 13, 14, 15

### Used
GPIO IN: 2, 3, 8, 9, 17, 18, 19, 20, 23
GPIO OUT: 5, 6, 7, 10, 11, 22

?: 19 (FUNCTION: reserved (7))
?: 20 (FUNCTION: reserved (6))
I2C_DATA: 0x14 (20)
I2C_CLK: 0x13 (19)

WG1400HP I2C expanderメモ

WG1400HPでLEDとUSB HubのRESETがぶら下がっているらしいI2C接続のExpander (Texas Instruments TCA6416)がBootloaderから制御できたので、割り当てを確認したメモ。

コマンド実行例

Read value:

boot> debug i2c ioexp read P08

Write value:

boot> debug i2c ioexp write P08 1

割り当て

  • P00: USB Hub (μPD720114) RESET
  • P01: ?
  • P02: ?
  • P03: ?
  • P04: CONVERTER (Red)
  • P05: CONVERTER (Green)
  • P06: TV (Red)
  • P07: TV (Green)
  • P10: 5 GHz (Red)
  • P11: 5 GHZ (Green)
  • P12: 2.4 GHz (Red)
  • P13: 2.4 GHz (Green)
  • P14: ACTIVE (Red)
  • P15: ACTIVE (Green)
  • P16: POWER (Red)
  • P17: POWER (Green)

WG1400HP

豊四季のハードオフで偶然1.5k + 税のモノを見つけ、衝動的に購入したもの。
NetBSD機であるためBootloaderの置き換えが必要になると思われるが、搭載しているSoCがQCA9558であり、これはpepe2k/u-boot_modで未サポートであるためどうするか未定。
とりあえず弄っていくのでメモ。

Switch

zone WAN LAN
port
(WG1400HP)
WAN LAN1 LAN2 LAN3 LAN4
port
(AR8327)
port1 port2 port3 port4 port5

MAC

  • LAN: 10:66:82:xx:xx:20 (config, 0x6 (hex))
  • WAN: 10:66:82:xx:xx:21 (config, 0xc (hex))
  • 2.4G: 10:66:82:xx:xx:22 (config, 0x0 (hex))
  • 5G: 10:66:82:xx:xx:23 (config, 0x12 (hex))

Bootloader

chiron

  • help
    boot> help
    support commands ...
    load             load module
    boot             boot loaded module
    tftpd            start tftpd [tftpd [IP] [bfn]]
    dlmode           set tftpd download mode [bfn]
    reboot           reboot system
    help             help command
    macaddr          macaddr read/write
    configid         configid read/write
    randomkey        randomkey read/write
    serial           serial number read/write
    pkg_info         show package information
    presetid         preset id read/write
    version          show boot version
    mhx              mhx utility
    tp               test program
    errorlog         errorlog command
    additional       additional command
    rf-serial        rf-serial command
    time             Time command
    debug            debug command
    ?                help command
    
  • version
    boot> version
    boot version: 1.0.0
    system version: 2.80.24
    TP Version = 1.0.0
    
  • pkg_info
    boot> pkg_info
      PKG NAME : 2x2LIGHTNING
      CPU   : Atheros/QCA9558
      RAM   : 128Mbyte
      Flash : 16Mbyte
        Device         : MX25L12845E(Macronix)
        Top Address    : 0xbf000000
        Config Address : 0xbf020000
        System Address : 0xbf040000
      Ether PHY : Atheros/AR8327(SW)
      DIPSW : 0x2
    
  • debug ?
    boot> debug ?
    support commands ...
    memory           memory read/write
    flash            flash driver r/w
    fs               file system r/w
    load             load test (calc chksum)
    exception        exception
    register         display register
    watchdog         do watchdog reset
    tlb              tlb register
    cache            cache control
    mii              mii control
    l2sw             l2sw control
    ether            ether control
    pci              pci control
    btimer_start     test btimer
    btimer_stop      test btimer
    usb              usb control
    i2c              i2c control
    
  • debug fs ls
    boot> debug fs ls
    Firmware            4457912 bytes
    total 16515072, avail 11981376 bytes
    
  • debug l2sw register dump ?
    boot> debug l2sw register dump ?
    PHY:
    00 : 1000 1000 1000 1000 1000 
    01 : 7949 7949 7949 7949 7949 
    02 : 004d 004d 004d 004d 004d 
    03 : d034 d034 d034 d034 d034 
    04 : 1de1 1de1 1de1 1de1 1de1 
    05 : 0000 0000 0000 0000 0000 
    06 : 0004 0004 0004 0004 0004 
    07 : 2801 2801 2801 2801 2801 
    08 : 0000 0000 0000 0000 0000 
    09 : 0200 0200 0200 0200 0200 
    0a : 0000 0000 0000 0000 0000 
    0b : 0000 0000 0000 0000 0000 
    0c : 0000 0000 0000 0000 0000 
    0d : 4003 4003 4003 4003 4003 
    0e : 003f 003f 003f 003f 003f 
    0f : 2000 2000 2000 2000 2000 
    10 : 0862 0862 0862 0862 0862 
    11 : 0010 0010 0010 0010 0010 
    12 : 0000 0000 0000 0000 0000 
    13 : 0000 0000 0000 0000 0000 
    14 : 002c 002c 002c 002c 002c 
    15 : 0000 0000 0000 0000 0000 
    16 : 04e8 04e8 04e8 04e8 04e8 
    17 : 0000 0000 0000 0000 0000 
    18 : 3200 3200 3200 3200 3200 
    19 : 0000 0000 0000 0000 0000 
    1a : 0000 0000 0000 0000 0000 
    1b : 0000 0000 0000 0000 0000 
    1c : 0000 0000 0000 0000 0000 
    1d : 003f 003f 003f 003f 003f 
    1e : 0000 0000 0000 0000 0000 
    1f : 0000 0000 0000 0000 0000 
    
    DEBUG:
    00 : 02ee 02ee 02ee 02ee 02ee 
    01 : 02b2 01b1 02b2 01b1 01b1 
    02 : 3110 3110 3220 3220 3220 
    03 : 3f11 3f22 3f11 3f11 3f22 
    04 : bbbb bbbb bbbb bbbb bbbb 
    05 : 3c06 3c06 3c06 3c06 3c06 
    06 : 0000 0000 0000 0000 0000 
    07 : 0000 0000 0000 0000 0000 
    08 : 1c00 1c00 1c00 1c00 1c00 
    09 : 8000 8000 8000 8000 8000 
    0a : 3000 3000 3000 b000 3000 
    0b : bc00 bc00 bc00 bc00 bc00 
    0c : 6001 6001 6001 6001 6001 
    0d : c820 2820 c820 2820 2820 
    0e : 0003 0003 0003 0003 0003 
    0f : 0030 0030 0030 0030 0030 
    10 : 0000 0000 0000 0000 0000 
    11 : 7552 7552 7552 7552 7552 
    12 : 4c04 4c04 4c04 4c04 4c04 
    13 : c01b c01b c01b c01b c01b 
    14 : 0752 0752 0752 0752 0752 
    15 : 3220 3220 3220 3220 3220 
    16 : 8000 8000 8000 8000 8000 
    17 : 0000 0000 0000 0000 0000 
    18 : 62ea 62ea 62ea 62ea 62ea 
    19 : 01f4 01f4 01f4 01f4 01f4 
    1a : 01d7 01d7 01d7 01d7 01d7 
    1b : 0176 0176 0176 0176 0176 
    1c : 3cbb 3cbb 3cbb 3cbb 3cbb 
    1d : 00ec 00ec 00ec 00ec 00ec 
    1e : 0076 0076 0076 0076 0076 
    1f : 0000 0000 0000 0000 0000 
    20 : 0000 0000 0000 0000 0000 
    21 : 2d15 2d15 2d15 2d15 2d15 
    22 : 1f6a 1f6a 1f6a 1f6a 1f6a 
    23 : a200 a200 a200 a200 a200 
    24 : 1000 1000 1000 1000 1000 
    25 : 0000 0000 0000 0000 0000 
    26 : 0000 0000 0000 0000 0000 
    27 : 1000 1000 1000 1000 1000 
    28 : 0000 0000 0000 0000 0000 
    29 : b6dd b6dd b6dd b6dd b6dd 
    2a : 0000 0000 0000 0000 0000 
    2b : 3a98 3a98 3a98 3a98 3a98 
    2c : 0000 0000 0000 0000 0000 
    2d : 0000 0000 0000 0000 0000 
    2e : 0000 0000 0000 0000 0000 
    2f : 0000 0000 0000 0000 0000 
    30 : 0000 0000 0000 0000 0000 
    31 : 0000 0000 0000 0000 0000 
    32 : 2200 2200 2200 2200 2200 
    33 : 2200 2200 2200 2200 2200 
    34 : 2200 2200 2200 2200 2200 
    35 : 0000 0000 0000 0000 0000 
    36 : e12c e12c e12c e12c e12c 
    37 : 6040 6040 6040 6040 6040 
    38 : 1111 1111 1111 1111 1111 
    39 : 7359 7359 7359 7359 7359 
    3a : ee6b ee6b ee6b ee6b ee6b 
    3b : 4646 4646 4646 4646 4646 
    3c : 4646 4646 4646 4646 4646 
    3d : 6820 6820 6820 6820 6820 
    3e : e0d8 e0d8 e0d8 e0d8 e0d8 
    3f : 0000 0000 0000 0000 0000 
    
    MMD3:
    
    MMD7:
    
    L2SW:
    
    0000 : 00001204 00080080 00000000 07600000 
    0010 : 202613a0 f0107650 0000690e 00003f1f 
    0020 : 3f500000 00010000 00000000 00000000 
    0030 : 80000301 00000000 0f000000 00000000 
    0040 : 00700000 00000000 000088a8 00000000 
    0050 : cc36cc36 ca36ca36 c936c936 03ffff00 
    0060 : 00000001 00000000 00000000 00000000 
    0070 : b00e6060 03707f07 000005ee 0000004e 
    0080 : 00001280 00001280 00001280 00001280 
    0090 : 00001280 0000004e 00000000 00000000 
    00a0 : 00000000 00000000 00000000 00000000 
    00b0 : 00000000 00000000 00000000 00000000 
    00c0 : 00000000 00000000 80901040 00000000 
    00d0 : 7fff7ff7 00003fff 00000100 00000000 
    00e0 : c74164d0 0002a545 2dc11c9c 00000000 
    00f0 : 00000000 00000000 00000000 00000000 
    
    0100 : 00001550 00000000 00000000 00000000 
    0110 : 00000000 00000000 00000000 00000000 
    0120 : 00240024 00000000 00240024 00000000 
    0130 : 00240024 00000000 00240024 00000000 
    0140 : 00240024 00000000 00240024 00000000 
    0150 : 00240024 00000000 00240024 00000000 
    0160 : 00240024 00000000 00240024 00000000 
    0170 : 00000000 00000000 00000000 00000000 
    0180 : 00000000 00000000 00000000 00000000 
    0190 : 00000000 00000000 00000000 00000000 
    01a0 : 00000000 00000000 00000000 00000000 
    01b0 : 00000000 00000000 00000000 00000000 
    01c0 : 00000000 00000000 00000000 00000000 
    01d0 : 00000000 00000000 00000000 00000000 
    01e0 : 00000000 00000000 00000000 00000000 
    01f0 : 00000000 00000000 00000000 00000000 
    
    0200 : 00000001 00005000 00400040 00000000 
    0210 : 00000000 00000000 00000000 00000000 
    0220 : 00000000 00000000 00000000 00000000 
    0230 : 00000000 00000000 00000000 00000000 
    0240 : 00000000 00000000 00000000 00000000 
    0250 : 00000000 00000000 00000000 00000000 
    0260 : 00000000 00000000 00000000 00000000 
    0270 : 0000000f 00000000 00000000 00000000 
    0280 : 00000000 00000000 00000000 00000000 
    0290 : 00000000 00000000 00000000 00000000 
    02a0 : 00000000 00000000 00000000 00000000 
    02b0 : 00000000 00000000 00000000 00000000 
    02c0 : 00000000 00000000 00000000 00000000 
    02d0 : 00000000 00000000 00000000 00000000 
    02e0 : 00000000 00000000 00000000 00000000 
    02f0 : 00000000 00000000 00000000 00000000 
    
    0400 : 00000000 00000000 00000000 00000000 
    0410 : 00000000 00000000 000c0a80 00000000 
    0420 : 00010001 00003040 00020001 00003040 
    0430 : 00010001 00003040 00010001 00003040 
    0440 : 00010001 00003040 00010001 00003040 
    0450 : 00020001 00003040 00000000 00000000 
    0460 : 00000000 00000000 00000000 00000000 
    0470 : 00000000 00000000 00000000 00000000 
    0480 : 00000000 00000000 00000000 00000000 
    0490 : 00000000 00000000 00000000 00000000 
    04a0 : 00000000 00000000 00000000 00000000 
    04b0 : 00000000 00000000 00000000 00000000 
    04c0 : 00000000 00000000 00000000 00000000 
    04d0 : 00000000 00000000 00000000 00000000 
    04e0 : 00000000 00000000 00000000 00000000 
    04f0 : 00000000 00000000 00000000 00000000 
    
    0600 : 00000000 00000000 00000000 00000006 
    0610 : 0003fff0 00000005 50e8002b 00000000 
    0620 : 000000f0 007f7f7f 00000000 00000000 
    0630 : 00000000 11111111 22222222 33333333 
    0640 : 44444444 55555555 66666666 77777777 
    0650 : 76543210 00000000 00000000 00000000 
    0660 : 0014003c 00000018 00007000 00140040 
    0670 : 00000018 00007000 00140039 00000018 
    0680 : 00007000 00140035 00000018 00007000 
    0690 : 0014002d 00000018 00007000 0014001d 
    06a0 : 00000018 00007000 00140002 00000018 
    06b0 : 00007000 00000000 00000000 00000000 
    06c0 : 00000000 00000000 00000000 00000000 
    06d0 : 00000000 00000000 00000000 00000000 
    06e0 : 00000000 00000000 00000000 00000000 
    06f0 : 00000000 00000000 00000000 00000000 
    0700 : 00000000 00000000 00000000 00000000 
    0710 : 00000000 00000000 00000000 00000000 
    
    0800 : 01200188 00000000 0000000e 00000000 
    0810 : 54332201 33221100 00000000 00000000 
    0820 : 00000000 00000000 00000000 00000000 
    0830 : 10841041 00041041 00041041 00041041 
    0840 : 00041041 10841041 10841041 00000000 
    0850 : 00000000 00000000 00000000 00000000 
    0860 : 00000000 00000000 00000000 00000000 
    0870 : 00000000 00000000 00000000 00000000 
    0880 : 00000000 00000000 00000000 00000000 
    0890 : 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    08a0 : 7fff7fff 7fff7fff 00000000 00000002 
    08b0 : 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    08c0 : 7fff7fff 7fff7fff 00000000 00000002 
    08d0 : 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    08e0 : 7fff7fff 7fff7fff 00000000 00000002 
    08f0 : 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    0900 : 7fff7fff 7fff7fff 00000000 00000002 
    0910 : 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    0920 : 7fff7fff 7fff7fff 00000000 00000002 
    0930 : 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    0940 : 7fff7fff 7fff7fff 00000000 00000002 
    0950 : 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    0960 : 7fff7fff 7fff7fff 00000000 00000002 
    0970 : 28000000 000000c0 28000000 000000c2 
    0980 : 28000000 000000c2 28000000 000000c2 
    0990 : 28000000 000000c2 28000000 000000c2 
    09a0 : 28000000 000000c0 00000000 00000000 
    09b0 : 003a004a 003a004a 003a004a 003a004a 
    09c0 : 003a004a 003a004a 003a004a 00000000 
    09d0 : 00000000 00000000 00000000 00000000 
    09e0 : 00000000 00000000 00000000 00000000 
    09f0 : 00000000 00000000 00000000 00000000 
    
    VTU:
    
    ATU:
    
  • debug memory read 0xb8040000 70
    (switch uninitialized)

    boot> debug memory read 0xb8040000 70
    b8040000:00a6031f 20bce62d 0000e400 00000000 .... ..-........
    b8040010:00000000 00000000 00000000 00000000 ................
    b8040020:00000000 00000000 00000000 00000000 ................
    b8040030:0c080900 00160000 00000000 07000000 ................
    b8040040:00000006 00000908 00000000 00000000 ................
    b8040050:00000000 14130000 80808080 80808080 ................
    b8040060:80808080 80808080 00000000 00000002 ................
    

    (switch initialized)

    boot> debug memory read 0xb8040000 70
    b8040000:00a6031f 20bcee2d 0000ec00 00000000 .... ..-........
    b8040010:00000000 00000000 00000000 00000000 ................
    b8040020:00000000 00000000 00000000 00000000 ................
    b8040030:0c080900 00160000 00000000 07000000 ................
    b8040040:00000006 00000908 00000000 00000000 ................
    b8040050:00000000 14130000 80808080 80808080 ................
    b8040060:80808080 80808080 00000000 00000002 ................
    
  • debug memory read 0xb8050028 4
    boot> debug memory read 0xb8050028 4
    b8050028:5a000000                            Z...
    
  • debug memory read 0xb8050048 4
    boot> debug memory read 0xb8050048 4
    b8050048:03000000                            ....
    
  • debug memory read 0xb8070000 4
    boot> debug memory read 0xb8070000 4  
    b8070000:00028001                            ....
    
  • debug memory read 0xb806001c d0
    (before tp usb)

    boot> debug memory read 0xb8060000 d0
    b8060000:0002ccc8 00061a80 00000003 0989637c ..............c|
    b8060010:077fffdd 00000000 00000020 2c044830 ........... ,.H0
    b8060020:00000000 00000000 00000000 00000000 ................
    b8060030:00000000 00000000 00000000 00000000 ................
    b8060040:00000000 00000000 00000000 00000000 ................
    b8060050:00000000 00000000 00000000 00000000 ................
    b8060060:00000000 00000000 00000000 00000000 ................
    b8060070:00000000 00000000 00000000 00000000 ................
    b8060080:00000000 00000000 00000000 00000000 ................
    b8060090:00001130 00000000 00000000 00000000 ...0............
    b80600a0:00000000 00000000 00000000 00000000 ................
    b80600b0:00031e5e 00033fc0 00000000 000a6000 ...^..?.......`.
    b80600c0:00000000 00030831 00000000 000003ff .......1........
    

    (after tp usb)

    boot> debug memory read 0xb8060000 d0
    b8060000:00016ccc 00061a80 00000003 098961b8 ..l...........a.
    b8060010:077fffdd 00000000 00000020 2c044008 ........... ,.@.
    b8060020:00000000 00000000 00000000 00000000 ................
    b8060030:00000000 00000000 00000000 00000000 ................
    b8060040:00000000 00000000 00000000 00000000 ................
    b8060050:00000000 00000000 00000000 00000000 ................
    b8060060:00000000 00000000 00000000 00000000 ................
    b8060070:00000000 00000000 00000000 00000000 ................
    b8060080:00000000 00000000 00000000 00000000 ................
    b8060090:00001130 00000000 00000000 00000000 ...0............
    b80600a0:00000000 00000000 00000000 00000000 ................
    b80600b0:00031e5e 00033fc0 00000000 000a6000 ...^..?.......`.
    b80600c0:00000000 00030831 00000000 000003ff .......1........
    
  • debug memory read 0xb8018000 84
    boot> debug memory read 0xb8018000 84
    b8018000:00000025 00000020 00000055 00000001 ...%... ...U....
    b8018010:000000ff 000000a0 000000bc 00000028 ...............(
    b8018020:0000003e 00000006 0000000d 00000000 ...>............
    b8018030:00000000 00000711 00000000 00000000 ................
    b8018040:00000001 00000000 00000000 00000000 ................
    b8018050:00000000 00000000 00000000 00000000 ................
    b8018060:00000000 00000000 00000000 00000001 ................
    b8018070:00000006 00000000 00000000 00000000 ................
    b8018080:00000000                            ....
    

Kernel (NetBSD)

  • Bootlog
    IPL:HARD-RESET
    memory test ... ok
    flinstall OK
    
    boot version: 1.0.0
    
    PKG "2x2LIGHTNING"
    CPU "Atheros/QCA9558"
    Revision 113.0 CLOCK 720.0 MHz
    HEAP MEMORY 262144 bytes
    Boot:InitFilesystem
    RGMII calibration GE0 ... ETH_CFG: 00028001 ETH_XMII: 5a000000
    phy0.0: "Atheros/AR8327(phy)"
    phy0.1: "Atheros/AR8327(SW)"
    active ch:1
    post start
    DRAM Test ..... PASS
    Timer test .... PASS
    FLASH CHKSUM .. PASS
    LAN Test ...... 
    LoopBack count 0 .. 
    phy0.0: "Atheros/AR8327(phy)"
    phy0.1: "Atheros/AR8327(SW)"
    active ch:0
    active ch:1
    phy0.0: "Atheros/AR8327(phy)"
    phy0.1: "Atheros/AR8327(SW)"
    active ch:1
    PASS
    Package TYPE = 0x01
    post success
    now booting Firmware ...
    loaded Firmware
    config=0x80208483 status=0x00000000
    mips_pdcache_write_through=0
    mips_picache_line_size=32 mips_pdcache_line_size=32
      pagemask: 0x00000000
      status: 0x00000000
      config: 0x80208483
      cause: 0x40008000
    load memory 0x1f0e000, 0x60f2000
    load memory 0x1000, 0x5f000
    Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002
        The NetBSD Foundation, Inc.  All rights reserved.
    Copyright (c) 1982, 1986, 1989, 1991, 1993
        The Regents of the University of California.  All rights reserved.
    
    NetBSD 1.6.1 (LIGHTNING2x2.tmp) #0: 2013-10-24 12:31:40 JST
        kubota@A00-30-04938:/home/kubota/lightning/git/hituji/build/lightning2x2/kernel-obj/LIGHTNING2x2.tmp
    
    total memory = 128 MB
    avail memory = 92692 KB
    using 1024 buffers containing 4096 KB of memory
    mainbus0 (root)
    cpu0 at mainbus0: MIPS 74Kc (0x19750) Rev. 80 with software emulated floating point
    cpu0: 64KB/32B 4-way set-associative L1 Instruction cache, 32 TLB entries
    cpu0: 32KB/32B 4-way set-associative write-back L1 Data cache
    arspi0 at mainbus0
    arflash0 at mainbus0 addr 0xbf000000 size 16777216 bytes
    flash: id 0xc2 type 0x17 addr 0xbf000000 size 16777216 bytes
    pfmg: carrier mode 0 pkgid 0x20a01 configid 0xff
    arrtc0 at mainbus0
    argiu0 at mainbus0
    btnu0 at argiu0 port 18
    btnu1 at argiu0 port 2
    btnu2 at argiu0 port 3
    ari2c0 at mainbus0: clk_sel=0(REFCLK), hcnt=0x28, lcnt=0x3e
    iic0 at ari2c0: I2C bus
    tca6416gpio0 at iic0 addr 0x20
    tcaled0 at tca6416gpio0
    athq0 at mainbus0
    LSDK DRV Version = 10.1.357_0909P
    
    athq0: WLAN MAC ADDRESS (10:66:82:e0:02:22)
    pfmg_read_scan_upper_2_4g: 11
    nbuf_hdr_init: struct nbuf(120 bytes) mallocsize(917504 bytes)
    mbuf_freeq_setup: mbuf_freeq_bufcount = 0
    mbuf_freeq_setup: mbuf_freeq_bufcount(6144,6144)
    Enterprise mode: 0x33fc0000
    Restoring Cal data from Flash
    Green-AP : Green-AP : Attached
    
    ath_get_caps[6155] rx chainmask mismatch actual 7 sc_chainmak 0
    ath_get_caps[6130] tx chainmask mismatch actual 7 sc_chainmak 0
    ath_attach_dfs[12110] dfsdomain 3
    ath_tx_paprd_init sc 0xc0179000 PAPRD disabled in HAL
     chan  Freq     HT                       DFS
     1     2412nbg  HT20 HT40PLUS            N
     2     2417nbg  HT20 HT40PLUS            N
     3     2422nbg  HT20 HT40PLUS            N
     4     2427nbg  HT20 HT40PLUS            N
     5     2432nbg  HT20 HT40PLUS HT40MINUS  N
     6     2437nbg  HT20 HT40PLUS HT40MINUS  N
     7     2442nbg  HT20 HT40PLUS HT40MINUS  N
     8     2447nbg  HT20 HT40PLUS HT40MINUS  N
     9     2452nbg  HT20 HT40PLUS HT40MINUS  N
     10    2457nbg  HT20          HT40MINUS  N
     11    2462nbg  HT20          HT40MINUS  N
     12    2467nbg  HT20          HT40MINUS  N
     13    2472nbg  HT20          HT40MINUS  N
    athq0: Atheros 955X: memt=0x80440120, memh=0xb8100000 
    com0 at mainbus0: ns16550a, working fifo
    com0: console
    ehci0 at mainbus0ehci0: EHCI version 1.0
    usb0 at ehci0: USB revision 2.0
    uhub0 at usb0
    uhub0: QCA9558 EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
    uhub0: 1 port with 1 removable, self powered
    qcaled0 at mainbus0
    ageth0 at mainbus0
    ath8327swsphy0 at ageth0 phy 0: Atheros AR8327 10/100/1000 L2SW, rev. 4
    ath8327swsphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, auto
    ageth1 at mainbus0
    ath8327swlphy0 at ageth1 phy 1: Atheros AR8327 10/100/1000 L2SW, rev. 4
    ath8327swlphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, auto, 1000baseT-FDX FLAG0, 1000baseT-FDX FLAG1
    arpcieu0 at mainbus0:
    pci0 at arpcieu0 bus 0
    pci0: memory space enabled
    athq1 at pci0 dev 0 function 0
    LSDK PCI Version = 10.1.357_0909P
    ath_pci_probe
    disable ASPM on peregrine[0x80] lcr(0x10110000) --> (0x10110000)
    athten1: WLAN MAC ADDRESS (10:66:82:e0:02:23)
    __ol_ath_attach: WLAN MAC ADDRESS (10:66:82:e0:02:23) ic(0xc025d000)
    
     Using PCI Legacy Interrupt
    __ol_ath_attach: ath_attach TODO
    arpcieu1 at mainbus0:
    pci1 at arpcieu1 bus 1
    pci1: memory space enabled
    rtc: CLOCK INITIALIZED 
    kevt0: 
    logbuf: using 655360 bytes logging area
    md0: internal 25600 KB image area
    uhub1 at uhub0 port 1
    uhub1: vendor 0x0409 product 0x005a, class 9/0, rev 2.00/1.00, addr 2
    uhub1: single transaction translator
    uhub1: 4 ports with 4 removable, self powered
    boot device: 
    root on md0a dumps on md0b
    root file system type: ffs
    Tue Jan  1 00:00:02 JST 2013
    /usr/local/www/.htpasswd file not exists.(ignore)
    Setting tty flags.
    net.inet6.ip6.forwarding: 0 -> 1
    net.inet6.ip6.accept_rtadv: 0 -> 0
    Building databases...
    mode switch: rt
    vathten0
    vathten1
    vathten4
    ol_transfer_bin_file 1562: Download Board data in flash len:0x0844(0x0844)
    vathten2
    vathten3
    Starting wificonfig
    encrypt key mode AES
    encrypt key mode AES
    Starting evtmgr.
    Starting dlnamgr.
    Starting clid.
    DDR Activity - HIGH
    Starting inetd.
    Starting procmon.
    Starting wzcm.
    DDR Activity - HIGH
    Tue Jan  1 00:00:13 JST 2013
    DDR Activity - HIGH
    DDR Activity - HIGH
    
    NetBSD/scorpimips (Amnesiac) (console)
    
    login: 
    

WG300HP

OSC 2019 Tokyo/Spring 2日目、帰り支度中に偶然お借りすることができたので、弄っていくメモ。
SoCはAR9342でath9kチップを追加搭載しないものの、その他の構成はおおよそWR8750Nなどと同じではないかと予想。

Switch

zone WAN LAN
port
(WG300HP)
WAN LAN1 LAN2 LAN3 LAN4
port
(QCA8337)
port1 port2 port3 port4 port5

MAC

  • LAN: 10:66:82:xx:xx:A8 (config, 0x6 (hex))
  • WAN: 10:66:82:xx:xx:A9 (config, 0xc (hex))
  • 2.4G: 10:66:82:xx:xx:AA (config, 0x0 (hex))

Bootloader

chiron

  • help
    boot> help
    support commands ...
    load             load module
    boot             boot loaded module
    tftpd            start tftpd [tftpd [IP] [bfn]]
    dlmode           set tftpd download mode [bfn]
    reboot           reboot system
    help             help command
    macaddr          macaddr read/write
    configid         configid read/write
    randomkey        randomkey read/write
    serial           serial number read/write
    pkg_info         show package information
    presetid         preset id read/write
    version          show boot version
    mhx              mhx utility
    tp               test program
    errorlog         errorlog command
    additional       additional command
    rf-serial        rf-serial command
    time             Time command
    debug            debug command
    ?                help command
    

  • version
    boot> version
    boot version: 1.0.0
    system version: 2.91.5
    TP Version = 1.0.0
    

  • pkg_info
    boot> pkg_info
    phy0.1: "Atheros/AR8327(SW)"
    phy0.0: "Atheros/AR8327(phy)"
    active ch:0
      PKG NAME : PAVO-HP
      CPU   : Atheros/AR9342
      RAM   : 64Mbyte
      Flash : 4Mbyte
        Device         : MX25L3205DMI(Macronix)
        Top Address    : 0xbf000000
        Config Address : 0xbf020000
        System Address : 0xbf040000
      Ether PHY : Atheros/AR8327(SW)
      DIPSW : 0x1
    

  • debug ?
    boot> debug ?
    support commands ...
    memory           memory read/write
    flash            flash driver r/w
    fs               file system r/w
    load             load test (calc chksum)
    exception        exception
    register         display register
    watchdog         do watchdog reset
    tlb              tlb register
    cache            cache control
    mii              mii control
    l2sw             l2sw control
    ether            ether control
    btimer_start     test btimer
    btimer_stop      test btimer
    

  • debug fs ls
    boot> debug fs ls
    Firmware            3485416 bytes
    config.har             2080 bytes
    total 3932160, avail 327360 bytes
    

  • debug l2sw register dump ?
    boot> debug l2sw register dump ?
    PHY:
    00 1000 1000 1000 1000 1000 
    01 7949 7949 7949 7949 7949 
    02 004d 004d 004d 004d 004d 
    03 d036 d036 d036 d036 d036 
    04 1de1 1de1 1de1 1de1 1de1 
    05 0000 0000 0000 0000 0000 
    06 0004 0004 0004 0004 0004 
    07 2801 2801 2801 2801 2801 
    08 0000 0000 0000 0000 0000 
    09 0200 0200 0200 0200 0200 
    0a 0000 0000 0000 0000 0000 
    0b 0000 0000 0000 0000 0000 
    0c 0000 0000 0000 0000 0000 
    0d 0000 0000 0000 0000 0000 
    0e 0000 0000 0000 0000 0000 
    0f 2000 2000 2000 2000 2000 
    10 0862 0862 0862 0862 0862 
    11 0010 0010 0010 0010 0010 
    12 0000 0000 0000 0000 0000 
    13 0000 0000 0000 0000 0000 
    14 082c 082c 082c 082c 082c 
    15 0000 0000 0000 0000 0000 
    16 2400 2400 2400 2400 2400 
    17 0000 0000 0000 0000 0000 
    18 3200 3200 3200 3200 3200 
    19 1000 1000 1000 1000 1000 
    1a 0000 0000 0000 0000 0000 
    1b 0000 0000 0000 0000 0000 
    1c 0000 0000 0000 0000 0000 
    1d 0000 0000 0000 0000 0000 
    1e 02ee 02ee 02ee 02ee 02ee 
    1f 0000 0000 0000 0000 0000 
    
    DEBUG:
    00 02ee 02ee 02ee 02ee 02ee 
    01 01b1 02b2 02b2 01b1 02b2 
    02 3220 3220 3220 3220 3110 
    03 3e22 3e11 3e11 3e11 3e11 
    04 fbbb fbbb fbbb fbbb fbbb 
    05 1c47 1c47 1c47 1c47 1c47 
    06 0000 0000 0000 0000 0000 
    07 0000 0000 0000 0000 0000 
    08 1c00 1c00 1c00 1c00 1c00 
    09 8000 8000 8000 8000 8000 
    0a 3000 3000 3000 3000 3000 
    0b bc40 bc40 bc40 bc40 bc40 
    0c 6001 6001 6001 6001 6001 
    0d 2820 2820 a820 2820 2820 
    0e 0003 0003 0003 0003 0003 
    0f 0030 0030 0030 0030 0030 
    10 0000 0000 0000 0000 0000 
    11 7552 7552 7552 7552 7552 
    12 4c04 4c04 4c04 4c04 4c04 
    13 c01b c01b c01b c01b c01b 
    14 0752 0752 0752 0752 0752 
    15 b220 b220 b220 b220 b220 
    16 8000 8000 8000 8000 8000 
    17 0000 0000 0000 0000 0000 
    18 62ea 62ea 62ea 62ea 62ea 
    19 01f4 01f4 01f4 01f4 01f4 
    1a 01d7 01d7 01d7 01d7 01d7 
    1b 0176 0176 0176 0176 0176 
    1c 3cbb 3cbb 3cbb 3cbb 3cbb 
    1d 00ec 00ec 00ec 00ec 00ec 
    1e 0076 0076 0076 0076 0076 
    1f 0000 0000 0000 0000 0000 
    20 0000 0000 0000 0000 0000 
    21 2d15 2d15 2d15 2d15 2d15 
    22 1f6a 1f6a 1f6a 1f6a 1f6a 
    23 a200 a200 a200 a200 a200 
    24 1000 1000 1000 1000 1000 
    25 0000 0000 0000 0000 0000 
    26 002c 0000 0012 0000 0000 
    27 1000 1000 1000 1000 1000 
    28 0000 0000 0000 0000 0000 
    29 36dd 36dd 36dd 36dd 36dd 
    2a 0000 0000 0000 0000 0000 
    2b 3a98 3a98 3a98 3a98 3a98 
    2c 0000 0000 0000 0000 0000 
    2d 0000 0000 0000 0000 0000 
    2e 0000 0000 0000 0000 0000 
    2f 0000 0000 0000 0000 0000 
    30 0000 0000 0000 0000 0000 
    31 0000 0000 0000 0000 0000 
    32 2200 2200 2200 2200 2200 
    33 2200 2200 2200 2200 2200 
    34 2200 2200 2200 2200 2200 
    35 0000 0000 0000 0000 0000 
    36 e1ec e1ec e1ec e1ec e1ec 
    37 6000 6000 6000 6000 6000 
    38 1111 1111 1111 1111 1111 
    39 7359 7359 7359 7359 7359 
    3a ee6b ee6b ee6b ee6b ee6b 
    3b 5a5a 5a5a 5a5a 5a5a 5a5a 
    3c 5a5a 5a5a 5a5a 5a5a 5a5a 
    3d 6860 6860 6860 6860 6860 
    3e e0d8 e0d8 e0d8 e0d8 e0d8 
    3f 8000 8000 8000 8000 8000 
    
    L2SW:
    0000 00011302 07a00000 00000000 00000000 
    0010 00261320 f0107650 00002587 00003f1f 
    0020 3f500000 0001007e 00000000 00000000 
    0030 80000701 00000000 0f000000 00000000 
    0040 00700000 00000000 000088a8 00000000 
    0050 cc36cc36 ca36ca36 c936c936 03ffff00 
    0060 00000001 00000000 00000000 00000000 
    0070 b00ee060 03707f07 000005ee 0000004e 
    0080 00000200 00000200 00000200 00000200 
    0090 00000200 00001080 00000000 00000000 
    00a0 00000000 00000000 00000000 00000000 
    00b0 00000000 00000000 00000000 00000000 
    00c0 00000000 00000000 80901040 00000000 
    00d0 fffbff7e 00000001 00000100 000303ff 
    00e0 c70164c0 0002a545 2dc11c9c 00000000 
    00f0 ff000083 00000000 a0000000 0000d600 
    0100 00001550 00000000 00000000 00000000 
    0110 00000000 00000000 00000000 00000000 
    0120 00240024 00000000 00240024 00000000 
    0130 00240024 00000000 00240024 00000000 
    0140 00240024 00000000 00240024 00000000 
    0150 00240024 00000000 00240024 00000000 
    0160 00240024 00000000 00240024 00000000 
    0170 00000000 00000000 00000000 00000000 
    0180 00000000 00000000 00000000 00000000 
    0190 00000000 00000000 00000000 00000000 
    01a0 00000000 00000000 00000000 00000000 
    01b0 00000000 00000000 00000000 00000000 
    01c0 00000000 00000000 00000000 00000000 
    01d0 00000000 00000000 00000000 00000000 
    01e0 00000000 00000000 00000000 00000000 
    01f0 00000000 00000000 00000000 00000000 
    0200 00000001 00005000 00400040 00000000 
    0210 00000000 00000000 00000000 00000000 
    0220 00000000 00000000 00000000 00000000 
    0230 00000000 00000000 00000000 00000000 
    0240 00000000 00000000 00000000 00000000 
    0250 00000000 00000000 00000000 00000000 
    0260 00000000 00000000 00000000 00000000 
    0270 0000000f 00000000 00000000 00000000 
    0280 00000000 00000000 00000000 00000000 
    0290 00000000 00000000 00000000 00000000 
    02a0 00000000 00000000 00000000 00000000 
    02b0 00000000 00000000 00000000 00000000 
    02c0 00000000 00000000 00000000 00000000 
    02d0 00000000 00000000 00000000 00000000 
    02e0 00000000 00000000 00000000 00000000 
    02f0 00000000 00000000 00000000 00000000 
    0400 00000000 00000000 00000000 00000000 
    0410 00000000 00000000 00000000 00000000 
    0420 00010001 00002040 00020001 00001040 
    0430 00010001 00001040 00010001 00001040 
    0440 00010001 00001040 00010001 00001040 
    0450 00010001 00003040 00000000 00000000 
    0460 00000000 00000000 00000000 00000000 
    0470 c0a80000 ffff0000 00000000 00000000 
    0480 00000000 00000000 00000000 00000000 
    0490 00000000 00000000 00000000 00000000 
    04a0 00000000 00000000 00000000 00000000 
    04b0 00000000 00000000 00000000 00000000 
    04c0 00000000 00000000 00000000 00000000 
    04d0 00000000 00000000 00000000 00000000 
    04e0 00000000 00000000 00000000 00000000 
    04f0 00000000 00000000 00000000 00000000 
    0600 00000000 00000000 00000000 00000001 
    0610 00000000 00000002 d0e8002b 00000000 
    0620 001000f0 003f3f3f 00000000 00000000 
    0630 00000000 11111111 22222222 33333333 
    0640 44444444 55555555 66666666 77777777 
    0650 76543210 00000000 00000000 00000000 
    0660 0014027e 00000018 00007000 0004027d 
    0670 00000018 00007000 0014027b 00000018 
    0680 00007000 00140277 00000018 00007000 
    0690 0014026f 00000018 00007000 0014025f 
    06a0 00000018 00007000 00000000 00000018 
    06b0 00007000 00000000 00000000 00000000 
    06c0 00000000 00000000 00000000 00000000 
    06d0 00000000 00000000 00000000 00000000 
    06e0 00000000 00000000 00000000 00000000 
    06f0 00000000 00000000 00000000 00000000 
    0800 01200188 00000000 007f000e 00000000 
    0810 54332201 33221100 00000000 00000000 
    0820 00000000 00000000 00000000 00000000 
    0830 10841041 00041041 00041041 00041041 
    0840 00041041 10841041 10841041 00000000 
    0850 00000000 00000000 00000000 00000000 
    0860 00000000 00000000 00000000 00000000 
    0870 00000000 00000000 00000000 00000000 
    0880 00000000 00000000 00000000 00000000 
    0890 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    08a0 7fff7fff 7fff7fff 00000000 00000002 
    08b0 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    08c0 7fff7fff 7fff7fff 00000000 00000002 
    08d0 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    08e0 7fff7fff 7fff7fff 00000000 00000002 
    08f0 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    0c00 00000000 00000000 00000000 00000000 
    0c10 00000000 00000000 00000000 00000000 
    0c20 00000000 00000000 00000000 00000000 
    0c30 00000000 05000000 00000000 00000000 
    0c40 00000000 00000000 00000000 00000000 
    0c50 00000000 00000000 00000000 00000000 
    0c60 00000000 00000000 00000000 00000000 
    0c70 00010001 00010001 00010001 00000001 
    0c80 00000000 00000000 00000000 00000000 
    0c90 00000000 00000000 00000000 00000000 
    0ca0 00000000 00000000 00000000 00000000 
    0cb0 00000000 00000000 00000000 00000000 
    0cc0 00000000 00000000 00000000 00000000 
    0cd0 00000000 00000000 00000000 00000000 
    0ce0 00000000 00000000 00000000 00000000 
    0cf0 00000000 00000000 00000000 00000000 
    0e00 00072401 00000000 00000000 007f0000 
    0e10 00000000 00000000 00000000 00000000 
    0e20 00000000 00000000 00000000 00000000 
    0e30 00000000 00000000 00200a53 00000000 
    0e40 00000000 00000000 00000000 00000000 
    0e50 00000000 00000000 00000000 00000000 
    0e60 00000000 00000000 00000000 00000000 
    0e70 00000000 00000000 00000000 00000000 
    0e80 00000000 00000000 00000000 00000000 
    0e90 00000000 00000000 00000000 00000000 
    0ea0 00000000 00000000 00000000 00000000 
    0eb0 00000000 00000000 00000000 00000000 
    0ec0 00000000 00000000 00000000 00000000 
    0ed0 00000000 00000000 00000000 00000000 
    0ee0 00000000 00000000 00000000 00000000 
    0ef0 00000000 00000000 00000000 00000000 
    
    VTU:
    0: 001b55e0 00010005
    1: 001bff60 00020005
    
    ATU:
    

  • debug memory read 0xb8040000 70
    (switch uninitialized)

    boot> debug memory read 0xb8040000 70
    b8040000:00000b07 00022e3f 00026018 00000000 .......?..`.....
    b8040010:00000000 00000000 00000000 00000000 ................
    b8040020:00000000 00000000 000f8000 00000000 ................
    b8040030:0b0a0900 00180000 2f2e0000 00000000 ......../.......
    b8040040:00000000 00000908 00000000 00000000 ................
    b8040050:00000c0b 00000000 00000000 00000000 ................
    b8040060:00000000 0d0f110e 00000000 00000002 ................
    

    (switch initialized)

    boot> debug memory read 0xb8040000 70
    b8040000:00000b07 00022e3f 00026018 00000000 .......?..`.....
    b8040010:00000000 00000000 00000000 00000000 ................
    b8040020:00000000 00000000 000f8000 00000000 ................
    b8040030:0b0a0900 00180000 2f2e0000 00000000 ......../.......
    b8040040:00000000 00000908 00000000 00000000 ................
    b8040050:00000c0b 00000000 00000000 00000000 ................
    b8040060:00000000 0d0f110e 00000000 00000002 ................
    

  • debug memory read 0xb805002c 4
    boot> debug memory read 0xb805002c 4
    b805002c:06000000                            ....
    

  • debug memory read 0xb8070000 4
    boot> debug memory read 0xb8070000 4
    b8070000:00000001                            ....
    

  • debug memory read 0xb8060000 c0
    (before tp usb)

    boot> debug memory read 0xb8060000 c0
    b8060000:00000000 00000000 00000003 098961cc ..............a.
    b8060010:00000701 00000000 00000020 24846830 ........... $.h0
    b8060020:00000000 00000000 00000000 00000000 ................
    b8060030:00000000 00000000 00000000 00000000 ................
    b8060040:00000000 00000000 00000000 00000000 ................
    b8060050:00000000 00000000 00000000 00000000 ................
    b8060060:00000000 00000000 00000000 00000000 ................
    b8060070:00000000 00000000 00000000 00000000 ................
    b8060080:00000000 00000000 00000000 00000000 ................
    b8060090:00011123 00000000 00000000 00000000 ...#............
    b80600a0:00000000 00000000 00000000 00000000 ................
    b80600b0:00bf0576 00000000 00000000 00086000 ...v..........`.
    

    (after tp usb)

    boot> debug memory read 0xb8060000 c0
    b8060000:00000000 00000000 00000003 09895ec4 ..............^.
    b8060010:00000701 00000000 00000020 24846008 ........... $.`.
    b8060020:00000000 00000000 00000000 00000000 ................
    b8060030:00000000 00000000 00000000 00000000 ................
    b8060040:00000000 00000000 00000000 00000000 ................
    b8060050:00000000 00000000 00000000 00000000 ................
    b8060060:00000000 00000000 00000000 00000000 ................
    b8060070:00000000 00000000 00000000 00000000 ................
    b8060080:00000000 00000000 00000000 00000000 ................
    b8060090:00011123 00000000 00000000 00000000 ...#............
    b80600a0:00000000 00000000 00000000 00000000 ................
    b80600b0:00bf0576 00000000 00000000 00086000 ...v..........`.
    

Kernel (NetBSD)

  • Bootlog
    IPL:HARD-RESET
    memory test ... ok
    flinstall OK
    
    boot version: 1.0.0
    
    PKG "PAVO-HP"
    CPU "Atheros/AR9342"
    Revision 112.3 CLOCK 560.0 MHz
    HEAP MEMORY 262144 bytes
    Boot:InitFilesystem
    phy0.1: "Atheros/AR8327(SW)"
    phy0.0: "Atheros/AR8327(phy)"
    active ch:0
    post start
    DRAM Test ..... PASS
    Timer test .... PASS
    FLASH CHKSUM .. PASS
    LAN Test ..... 
    LoopBack count 0 .. 
    phy0.1: "Atheros/AR8327(SW)"
    phy0.0: "Atheros/AR8327(phy)"
    active ch:0
    active ch:1
    phy0.1: "Atheros/AR8327(SW)"
    phy0.0: "Atheros/AR8327(phy)"
    active ch:0
    PASS
    Package TYPE = 0x00
    post success
    now booting Firmware ...
    loaded Firmware
    config=0x80208483 status=0x00000000
    mips_pdcache_write_through=0
    mips_picache_line_size=32 mips_pdcache_line_size=32
      pagemask: 0x00000000
      status: 0x00000000
      config: 0x80208483
      cause: 0x00000000
    load memory 0x1972000, 0x268e000
    load memory 0x1000, 0x5f000
    Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002
        The NetBSD Foundation, Inc.  All rights reserved.
    Copyright (c) 1982, 1986, 1989, 1991, 1993
        The Regents of the University of California.  All rights reserved.
    
    NetBSD 1.6.1 (PAVO.tmp) #0: 2013-06-07 09:52:40 JST
        ******@***-**-*****:/home/******/pavo/git/hituji/build/pavo/kernel-obj/PAVO.tmp
    
    total memory = 65536 KB
    avail memory = 34336 KB
    using 1024 buffers containing 4096 KB of memory
    mainbus0 (root)
    cpu0 at mainbus0: MIPS 74Kc (0x1974c) Rev. 76 with software emulated floating point
    cpu0: 64KB/32B 4-way set-associative L1 Instruction cache, 32 TLB entries
    cpu0: 32KB/32B 4-way set-associative write-back L1 Data cache
    arspi0 at mainbus0
    arflash0 at mainbus0 addr 0xbf000000 size 4194304 bytes
    flash: id 0xc2 type 0x15 addr 0xbf000000 size 4194304 bytes
    pfmg: carrier mode 0 pkgid 0xb00 configid 0xff
    arrtc0 at mainbus0
    argiu0 at mainbus0
    arled0 at argiu0
    btnu0 at argiu0 port 0
    btnu1 at argiu0 port 2
    btnu2 at argiu0 port 1
    athq0 at mainbus0
    athq0: WLAN MAC ADDRESS (10:66:82:4d:9f:aa)
    Restoring Cal data from Flash
    dfs_attach: use DFS enhancements
    DFS min filter rssiThresh = 18
    DFS max pulse dur = 151 ticks
    ath_get_caps[5308] rx chainmask mismatch actual 3 sc_chainmak 0
    ath_get_caps[5283] tx chainmask mismatch actual 3 sc_chainmak 0
    athq0: LSDK-9.2.0_U10.1020 mac 768.0 phy 64.13 radio 0.0
     chan  Freq     HT                       DFS
     1     2412nbg  HT20 HT40PLUS            N
     2     2417nbg  HT20 HT40PLUS            N
     3     2422nbg  HT20 HT40PLUS            N
     4     2427nbg  HT20 HT40PLUS            N
     5     2432nbg  HT20 HT40PLUS HT40MINUS  N
     6     2437nbg  HT20 HT40PLUS HT40MINUS  N
     7     2442nbg  HT20 HT40PLUS HT40MINUS  N
     8     2447nbg  HT20 HT40PLUS HT40MINUS  N
     9     2452nbg  HT20 HT40PLUS HT40MINUS  N
     10    2457nbg  HT20          HT40MINUS  N
     11    2462nbg  HT20          HT40MINUS  N
     12    2467nbg  HT20          HT40MINUS  N
     13    2472nbg  HT20          HT40MINUS  N
    athq0: Atheros 9340: memt=0x8036a860, memh=0xb8100000 
    com0 at mainbus0: ns16550a, working fifo
    com0: console
    ehci0 at mainbus0ehci0: EHCI version 1.0
    usb0 at ehci0: USB revision 2.0
    uhub0 at usb0
    uhub0: AR7100 EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
    uhub0: 1 port with 1 removable, self powered
    ageth0 at mainbus0
    ath27swlphy0 at ageth0 phy 1: Atheros QCA8337 10/100/1000 L2SW, rev. 6
    ath27swlphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, auto, 1000baseT-FDX FLAG0, 1000baseT-FDX FLAG1
    ageth1 at mainbus0
    ath27swsphy0 at ageth1 phy 0: Atheros QCA8337 10/100/1000 L2SW, rev. 6
    ath27swsphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, auto
    rtc: CLOCK INITIALIZED 
    kevt0: 
    logbuf: using 655360 bytes logging area
    md0: internal 21504 KB image area
    uhub1 at uhub0 port 1
    uhub1: vendor 0x0409 product 0x005a, class 9/0, rev 2.00/1.00, addr 2
    uhub1: single transaction translator
    uhub1: 4 ports with 4 removable, self powered
    boot device: 
    root on md0a dumps on md0b
    root file system type: ffs
    Tue Jan  1 00:00:02 JST 2013
    Setting tty flags.
    Building databases...
    wlan_vap_create : enter. devhandle=0x8194abe0, opmode=IEEE80211_M_HOSTAP, flags=0x1
    wlan_vap_create : exit. devhandle=0x8194abe0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
    wlan_vap_create : enter. devhandle=0x8194abe0, opmode=IEEE80211_M_HOSTAP, flags=0x1
    wlan_vap_create : exit. devhandle=0x8194abe0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
    Starting wificonfig
    encrypt key mode AES
    Starting evtmgr.
    Starting dlnamgr.
    Starting clid.
    Starting inetd.
    Starting procmon.
    Starting wzcm.
    Tue Jan  1 00:00:07 JST 2013
    
    NetBSD/messimips (Amnesiac) (console)
    
    login: 
    

WR8750N fixed-regulatorメモ

WR8750N/WR9500N/WG600HPではいくつかGPIOをHIGHで出さなければ機能しないデバイスがあり、それらについてfixed-regulatorのDeviceTree binding (compatible = "regulator-fixed") を使用する場合の挙動確認用メモ。

USB-Vbus
ath79内の他のdtsでは問題無いようではあるものの、Aterm 3機種ではブート中に無効化されてしまった。こうなると、USBポートにDC 5V電源が供給されずデバイスが使用できない。
ノード内に regulator-always-on; を付加した場合は無効化されず有効なまま。

無効化される場合のログ

IPL:HARD-RESET
memory test ... ok
flinstall OK

boot version: 1.0.0

PKG "Orthos-HP"
CPU "Atheros/AR9344"
Revision 212.1 CLOCK 560.0 MHz
HEAP MEMORY 262144 bytes
Boot:InitFilesystem
phy0.1: "Atheros/AR8327(SW)"
phy0.0: "Atheros/AR8327(phy)"
active ch:0
post start
DRAM Test ..... PASS
Timer test .... PASS
FLASH CHKSUM .. PASS
LAN Test ..... 
LoopBack count 0 .. 
phy0.1: "Atheros/AR8327(SW)"
phy0.0: "Atheros/AR8327(phy)"
active ch:0
active ch:1
phy0.1: "Atheros/AR8327(SW)"
phy0.0: "Atheros/AR8327(phy)"
active ch:0
PASS
Package TYPE = 0x01
post success

welcome to boot console
Password:
boot> tftpd
tftpd start 192.168.0.1
boot> start tftp load openwrt-ath79-tiny-nec_wr8750n-i
end tftp load length = 3442316
start memory load ... 
memory load complete
  begin  : 0x80060000
  length : 3442292
  startup: 0x80060000
boot
begin  : 0x80060000
length : 3442292
startup: 0x80060000
option: 0x0


OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos 
Decompressing kernel... done!
Starting kernel at 80060000...

[    0.000000] Linux version 4.14.101 (musashino205@Taiha.Net) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r0+9362-3cf839bf27)) #0 Sun Feb 17 11:18:45 2019
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[    0.000000] MIPS: machine is NEC Aterm WR8750N
[    0.000000] SoC: Atheros AR9344 rev 1
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] random: get_random_bytes called from 0x8045d72c with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,9600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 117812K/131072K available (3467K kernel code, 136K rwdata, 472K rodata, 7372K init, 195K bss, 13260K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 560.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6825930166 ns
[    0.000010] sched_clock: 32 bits at 280MHz, resolution 3ns, wraps every 7669584382ns
[    0.092710] Calibrating delay loop... 278.93 BogoMIPS (lpj=1394688)
[    0.237626] pid_max: default: 32768 minimum: 301
[    0.293067] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.372218] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.461311] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.579001] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.651956] pinctrl core: initialized pinctrl subsystem
[    0.715407] NET: Registered protocol family 16
[    0.769307] Can't analyze schedule() prologue at 803beb1c
[    0.836254] PCI host bridge /ahb/apb/pcie-controller@180c0000 ranges:
[    0.913369]  MEM 0x0000000010000000..0x0000000013ffffff
[    0.975830]   IO 0x0000000000000000..0x0000000000000000
[    1.059606] PCI host bridge to bus 0000:00
[    1.108577] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[    1.190796] pci_bus 0000:00: root bus resource [io  0x0000]
[    1.257459] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    1.338683] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.433994] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1001ffff 64bit]
[    1.521455] pci 0000:00:00.0: BAR 6: assigned [mem 0x10020000-0x1002ffff pref]
[    1.608447] clocksource: Switched to clocksource MIPS
[    1.670048] NET: Registered protocol family 2
[    1.722993] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    1.806319] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    1.882308] TCP: Hash tables configured (established 1024 bind 1024)
[    1.958477] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    2.028229] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    2.103447] NET: Registered protocol family 1
[    2.300316] Crashlog allocated RAM at address 0x3f00000
[    2.364123] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[    2.446224] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.515993] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    2.706900] io scheduler noop registered
[    2.753847] io scheduler deadline registered (default)
[    2.815602] ar7200-usb-phy usb-phy: phy reset is missing
[    2.881456] pinctrl-single 1804002c.pinmux: 544 pins at pa b804002c size 68
[    2.965880] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    3.042684] console [ttyS0] disabled
[    3.085437] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 8, base_baud = 2500000) is a 16550A
[    3.188462] console [ttyS0] enabled
[    3.188462] console [ttyS0] enabled
[    3.271732] bootconsole [early0] disabled
[    3.271732] bootconsole [early0] disabled
[    3.373903] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    3.432289] 4 fixed-partitions partitions found on MTD device spi0.0
[    3.508338] Creating 4 MTD partitions on "spi0.0":
[    3.565649] 0x000000000000-0x000000020000 : "u-boot"
[    3.625861] 0x000000020000-0x000000030000 : "config"
[    3.686072] 0x000000030000-0x000000040000 : "art"
[    3.743173] 0x000000040000-0x000000800000 : "firmware"
[    3.814900] libphy: Fixed MDIO Bus: probed
[    4.198841] libphy: ag71xx_mdio: probed
[    4.269237] switch0: Atheros AR8327 rev. 2 switch registered on mdio-bus.0
[    5.339625] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:00 [uid=004dd033, driver=Atheros AR8216/AR8236/AR8316]
[    5.468299] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:RGMII
[    5.543245] NET: Registered protocol family 10
[    5.600101] Segment Routing with IPv6
[    5.644025] NET: Registered protocol family 17
[    5.697555] 8021q: 802.1Q VLAN Support v1.8
[    5.750794] usb_vbus: disabling
[    5.823669] Freeing unused kernel memory: 7372K
[    5.877886] This architecture does not have kernel memory protection.
[    5.968851] init: Console is alive
[    6.009792] init: - watchdog -
[    6.068664] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    6.160539] usbcore: registered new interface driver usbfs
[    6.226283] usbcore: registered new interface driver hub
[    6.289932] usbcore: registered new device driver usb
[    6.356625] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    6.436541] ehci-platform: EHCI generic platform driver
[    6.499101] random: fast init done
[    6.540019] ehci-platform 1b000000.usb: EHCI Host Controller
[    6.607799] ehci-platform 1b000000.usb: new USB bus registered, assigned bus number 1
[    6.701547] ehci-platform 1b000000.usb: irq 3, io mem 0x1b000000
[    6.798491] ehci-platform 1b000000.usb: USB 2.0 started, EHCI 1.00
[    6.873338] hub 1-0:1.0: USB hub found
[    6.918714] hub 1-0:1.0: 1 port detected
[    6.967320] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    7.064183] init: - preinit -
[    7.322505] random: jshn: uninitialized urandom read (4 bytes read)
[    7.397627] usb 1-1: new high-speed USB device number 2 using ehci-platform
[    7.571547] random: jshn: uninitialized urandom read (4 bytes read)
[    7.759977] random: procd: uninitialized urandom read (4 bytes read)
[    7.836445] hub 1-1:1.0: USB hub found
[    7.928501] hub 1-1:1.0: 4 ports detected
[    8.377822] urandom_read: 4 callbacks suppressed
[    8.377831] random: jshn: uninitialized urandom read (4 bytes read)
[    9.265951] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    9.335906] IPv6: ADDRCONF(NETDEV_UP): eth0.1: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   10.449722] eth0: link up (1000Mbps/Full duplex)
[   10.506481] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   10.586000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[   12.652859] eth0: link down
[   12.705540] procd: - early -
[   12.740359] procd: - watchdog -
[   13.324256] procd: - watchdog -
[   13.362195] procd: - ubus -
[   13.402672] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.479944] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.557503] procd: - init -
Please press Enter to activate this console.
[   13.784410] kmodloader: loading kernel modules from /etc/modules.d/*
[   13.864552] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   13.940076] Loading modules backported from Linux version v4.19.7-0-g61c68f2a2af0
[   14.029655] Backport generated by backports.git v4.19.7-1-0-g148b072d
[   14.109759] ip_tables: (C) 2000-2006 Netfilter Core Team
[   14.182075] nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
[   14.311244] xt_time: kernel timezone is -0000
[   14.419646] PPP generic driver version 2.4.2
[   14.473306] NET: Registered protocol family 24
[   14.586672] ieee80211 phy0: Atheros AR9340 Rev:1 mem=0xb8100000, irq=11
[   14.669780] ath9k 0000:00:00.0: Direct firmware load for ath9k-eeprom-pci-0000:00:00.0.bin failed with error -2
[   14.790514] ath9k 0000:00:00.0: Falling back to user helper
[   15.283757] ieee80211 phy1: Atheros AR9300 Rev:3 mem=0xb0000000, irq=13
[   15.468860] kmodloader: done loading kernel modules from /etc/modules.d/*
[   27.496202] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   27.738887] br-lan: port 1(eth0.1) entered blocking state
[   27.803513] br-lan: port 1(eth0.1) entered disabled state
[   27.868396] device eth0.1 entered promiscuous mode
[   27.925703] device eth0 entered promiscuous mode
[   28.309978] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   28.490322] IPv6: ADDRCONF(NETDEV_UP): eth0.2: link is not ready
[   28.609772] eth0: link up (1000Mbps/Full duplex)
[   28.858530] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   29.364321] br-lan: port 1(eth0.1) entered blocking state
[   29.428925] br-lan: port 1(eth0.1) entered forwarding state
[   29.496037] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.2: link becomes ready
[   30.938550] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[  125.446530] random: crng init done

WG600HP

春日部方面のハードオフに行った際に見つけ、WR8750N/WR9500Nと同様AR9344搭載機であることを把握していたため、衝動的に購入したもの。
購入直後に開けて確認した限りではほぼWR8750Nと同一であると予想されたものの、念のためメモしていく。
なお、WR8750N用のOpenWrtファームでブートすることも可能だった。

Switch

zone WAN LAN
port
(WG600HP)
WAN LAN1 LAN2 LAN3 LAN4
port
(AR8327)
port1 port2 port3 port4 port5

MAC

  • LAN: A4:12:42:xx:xx:A0 (config, 0x6 (hex))
  • WAN: A4:12:42:xx:xx:A1 (config, 0xc (hex))
  • 2.4G: A4:12:42:xx:xx:A2 (config, 0x0 (hex))
  • 5G: A4:12:42:xx:xx:A3 (config, 0x12 (hex))

Bootloader

chiron

  • help
    boot> help
    support commands ...
    load             load module
    boot             boot loaded module
    tftpd            start tftpd [tftpd [IP] [bfn]]
    dlmode           set tftpd download mode [bfn]
    reboot           reboot system
    help             help command
    macaddr          macaddr read/write
    configid         configid read/write
    randomkey        randomkey read/write
    serial           serial number read/write
    pkg_info         show package information
    presetid         preset id read/write
    version          show boot version
    mhx              mhx utility
    tp               test program
    errorlog         errorlog command
    additional       additional command
    rf-serial        rf-serial command
    time             Time command
    debug            debug command
    ?                help command
    
  • version
    boot> version
    boot version: 1.0.0
    system version: 2.95.12
    TP Version = 1.0.0
    
  • pkg_info
    boot> pkg_info
      PKG NAME : Orthos-HP
      CPU   : Atheros/AR9344
      RAM   : 128Mbyte
      Flash : 8Mbyte
        Device         : MX25L6405D(Macronix)
        Top Address    : 0xbf000000
        Config Address : 0xbf020000
        System Address : 0xbf040000
      Ether PHY : Atheros/AR8327(SW)
      DIPSW : 0x1
    
  • debug ?
    boot> debug ?
    support commands ...
    memory           memory read/write
    flash            flash driver r/w
    fs               file system r/w
    load             load test (calc chksum)
    exception        exception
    register         display register
    watchdog         do watchdog reset
    tlb              tlb register
    cache            cache control
    mii              mii control
    l2sw             l2sw control
    ether            ether control
    pci              pci control
    btimer_start     test btimer
    btimer_stop      test btimer
    
  • debug fs ls
    boot> debug fs ls
    Firmware            3534816 bytes
    total 8126464, avail 4583040 bytes
    
  • debug l2sw register dump ?
    boot> debug l2sw register dump ?
    PHY:
    00 1000 1000 1000 1000 1000 
    01 796d 7949 7949 7949 796d 
    02 004d 004d 004d 004d 004d 
    03 d034 d034 d034 d034 d034 
    04 1de1 1de1 1de1 1de1 1de1 
    05 cde1 0000 0000 0000 cde1 
    06 000f 0004 0004 0004 000f 
    07 2801 2801 2801 2801 2801 
    08 0000 0000 0000 0000 0000 
    09 0200 0200 0200 0200 0200 
    0a 3800 0000 0000 0000 7800 
    0b 0000 0000 0000 0000 0000 
    0c 0000 0000 0000 0000 0000 
    0d 0000 0000 0000 0000 0000 
    0e 0000 0000 0000 0000 0000 
    0f 2000 2000 2000 2000 2000 
    10 0862 0862 0862 0862 0862 
    11 bc1c 0010 0010 0010 bc1e 
    12 0000 0000 0000 0000 0000 
    13 7400 0000 0000 0000 7400 
    14 002c 002c 002c 002c 002c 
    15 0000 0000 0000 0000 0000 
    16 04e8 04e8 04e8 04e8 04e8 
    17 0000 0000 0000 0000 0000 
    18 3200 3200 3200 3200 3200 
    19 0000 0000 0000 0000 0000 
    1a 0000 0000 0000 0000 0000 
    1b 0000 0000 0000 0000 0000 
    1c 0000 0000 0000 0000 0000 
    1d 0000 0000 0000 0000 0000 
    1e 02ee 02ee 02ee 02ee 02ee 
    1f 0000 0000 0000 0000 0000 
    
    DEBUG:
    00 02ee 02ee 02ee 02ee 02ee 
    01 ffd0 02b2 02b2 01b1 ffd0 
    02 3f0f 3110 3110 3220 3f0f 
    03 3eff 3e22 3e22 3e22 3eff 
    04 babb bbbb bbbb bbbb babb 
    05 3c47 3c47 3c47 3c47 3c47 
    06 0000 0000 0000 0000 0000 
    07 0000 0000 0000 0000 0000 
    08 1c00 1c00 1c00 1c00 1c00 
    09 8000 8000 8000 8000 8000 
    0a 3000 3000 3000 3000 3000 
    0b bc40 bc40 bc40 bc40 bc40 
    0c 0800 6001 6001 6001 0800 
    0d 0100 c820 2820 2820 0100 
    0e 0023 0003 0003 0003 0020 
    0f 0030 0030 0030 0030 0030 
    10 0000 0000 0000 0000 0000 
    11 7552 7552 7552 7552 7552 
    12 4c04 4c04 4c04 4c04 4c04 
    13 c01b c01b c01b c01b c01b 
    14 0752 0752 0752 0752 0752 
    15 3220 3220 3220 3220 3220 
    16 8000 8000 8000 8000 ffff 
    17 1506 0000 0000 0000 0f11 
    18 62ea 62ea 62ea 62ea 62ea 
    19 01f4 01f4 01f4 01f4 01f4 
    1a 01d7 01d7 01d7 01d7 01d7 
    1b 0176 0176 0176 0176 0176 
    1c 3cbb 3cbb 3cbb 3cbb 3cbb 
    1d 00ec 00ec 00ec 00ec 00ec 
    1e 0076 0076 0076 0076 0076 
    1f 7c00 0000 0000 0000 b000 
    20 0000 0000 0000 0000 7fff 
    21 2d15 2d15 2d15 2d15 2d15 
    22 1f6a 1f6a 1f6a 1f6a 1f6a 
    23 a400 a200 a200 a200 9880 
    24 0ede 1000 1000 1000 0e05 
    25 0000 0000 0000 0000 0000 
    26 001e 0000 0000 0000 0000 
    27 1000 1000 1000 1000 1000 
    28 0000 0000 0000 0000 0000 
    29 b6dd b6dd b6dd b6dd b6dd 
    2a 0000 0000 0000 0000 0000 
    2b 3a98 3a98 3a98 3a98 3a98 
    2c 0000 0000 0000 0000 0000 
    2d effa 0000 0000 0000 00ff 
    2e 0304 0000 0000 0000 fcfe 
    2f 0000 0000 0000 0000 7fff 
    30 ecfe 0000 0000 0000 0500 
    31 f9fc 0000 0000 0000 0bf1 
    32 25f1 2200 2200 2200 1880 
    33 252d 2200 2200 2200 1780 
    34 2402 2200 2200 2200 1880 
    35 0000 0000 0000 0000 0000 
    36 e12c e12c e12c e12c e12c 
    37 6080 6000 6000 6000 6080 
    38 1121 1111 1111 1111 1111 
    39 7359 7359 7359 7359 7359 
    3a ee6b ee6b ee6b ee6b ee6b 
    3b 4646 4646 4646 4646 4646 
    3c 4646 4646 4646 4646 4646 
    3d 68e0 68e0 68e0 68e0 68e0 
    3e 2058 e0d8 e0d8 e0d8 2058 
    3f 8000 8000 8000 8000 ffff 
    
    L2SW:
    0000 00001204 07a00000 00000000 00000000 
    0010 20261320 f0107650 00002d0e 00003f1f 
    0020 3f500a00 00010000 00000000 00000000 
    0030 80000301 00000000 0f000000 00000000 
    0040 00700000 00000000 000088a8 00000000 
    0050 cc36cc36 ca36ca36 c936c936 03ffff00 
    0060 00000001 00000000 00000000 00000000 
    0070 b00e6060 03707f07 000005ee 0000004e 
    0080 00000f4e 00000200 00000200 00000200 
    0090 00000f4e 00001080 00000000 00000000 
    00a0 00000000 00000000 00000000 00000000 
    00b0 00000000 00000000 00000000 00000000 
    00c0 00000000 00000000 80901040 00000000 
    00d0 7fff7ff7 00003fff 00000100 00000000 
    00e0 c70164ce 0002a545 2dc11c9c 00000000 
    00f0 00000000 00000000 00000000 00000000 
    0100 00000000 00000000 00000000 00000000 
    0110 00000000 00000000 00000000 00000000 
    0120 00110011 00000000 00240024 00000000 
    0130 00240024 00000000 00240024 00000000 
    0140 00240024 00000000 00240024 00000000 
    0150 00240024 00000000 00240024 00000000 
    0160 00110011 00000000 00240024 00000000 
    0170 00000000 00000000 00000000 00000000 
    0180 00000000 00000000 00000000 00000000 
    0190 00000000 00000000 00000000 00000000 
    01a0 00000000 00000000 00000000 00000000 
    01b0 00000000 00000000 00000000 00000000 
    01c0 00000000 00000000 00000000 00000000 
    01d0 00000000 00000000 00000000 00000000 
    01e0 00000000 00000000 00000000 00000000 
    01f0 00000000 00000000 00000000 00000000 
    0200 00000001 00005000 00400040 00000000 
    0210 00000000 00000000 00000000 00000000 
    0220 00000000 00000000 00000000 00000000 
    0230 00000000 00000000 00000000 00000000 
    0240 00000000 00000000 00000000 00000000 
    0250 00000000 00000000 00000000 00000000 
    0260 00000000 00000000 00000000 00000000 
    0270 0000000f 00000000 00000000 00000000 
    0280 00000000 00000000 00000000 00000000 
    0290 00000000 00000000 00000000 00000000 
    02a0 00000000 00000000 00000000 00000000 
    02b0 00000000 00000000 00000000 00000000 
    02c0 00000000 00000000 00000000 00000000 
    02d0 00000000 00000000 00000000 00000000 
    02e0 00000000 00000000 00000000 00000000 
    02f0 00000000 00000000 00000000 00000000 
    0400 00000000 00000000 00000000 00000000 
    0410 00000000 00000000 000c0a80 00000000 
    0420 00010001 00002040 00020001 00001040 
    0430 00010001 00001040 00010001 00001040 
    0440 00010001 00001040 00010001 00001040 
    0450 00010001 00003040 00000000 00000000 
    0460 00000000 00000000 00000000 00000000 
    0470 00000000 00000000 00000000 00000000 
    0480 00000000 00000000 00000000 00000000 
    0490 00000000 00000000 00000000 00000000 
    04a0 00000000 00000000 00000000 00000000 
    04b0 00000000 00000000 00000000 00000000 
    04c0 00000000 00000000 00000000 00000000 
    04d0 00000000 00000000 00000000 00000000 
    04e0 00000000 00000000 00000000 00000000 
    04f0 00000000 00000000 00000000 00000000 
    0600 00000000 00000000 00000000 00000001 
    0610 00000000 00000002 50e8002b 00000000 
    0620 000000f0 003f3f3f 00000000 00000000 
    0630 00000000 11111111 22222222 33333333 
    0640 44444444 55555555 66666666 77777777 
    0650 76543210 00000000 00000000 00000000 
    0660 0014027e 00000018 00007000 0004027d 
    0670 00000018 00007000 0014027b 00000018 
    0680 00007000 00140277 00000018 00007000 
    0690 0014026f 00000018 00007000 0014025f 
    06a0 00000018 00007000 00000000 00000018 
    06b0 00007000 00000000 00000000 00000000 
    06c0 00000000 00000000 00000000 00000000 
    06d0 00000000 00000000 00000000 00000000 
    06e0 00000000 00000000 00000000 00000000 
    06f0 00000000 00000000 00000000 00000000 
    0800 01200188 00000000 0000000e 00000000 
    0810 54332201 33221100 00000000 00000000 
    0820 00000000 00000000 00000000 00000000 
    0830 10841041 00041041 00041041 00041041 
    0840 00041041 10841041 10841041 00000000 
    0850 00000000 00000000 00000000 00000000 
    0860 00000000 00000000 00000000 00000000 
    0870 00000000 00000000 00000000 00000000 
    0880 00000000 00000000 00000000 00000000 
    0890 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    08a0 7fff7fff 7fff7fff 00000000 00000002 
    08b0 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    08c0 7fff7fff 7fff7fff 00000000 00000002 
    08d0 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    08e0 7fff7fff 7fff7fff 00000000 00000002 
    08f0 7fff7fff 7fff7fff 7fff7fff 7fff7fff 
    0c00 00000000 00000000 00000000 00000000 
    0c10 00000000 00000000 00000000 00000000 
    0c20 00000000 00000000 00000000 00000000 
    0c30 00000000 00000000 00000000 00000000 
    0c40 00000000 00000000 00000000 00000000 
    0c50 00000000 00000000 00000000 00000000 
    0c60 00000000 00000000 00000000 00000000 
    0c70 00010001 00010001 00010001 00000001 
    0c80 00000000 00000000 00000000 00000000 
    0c90 00000000 00000000 00000000 00000000 
    0ca0 00000000 00000000 00000000 00000000 
    0cb0 00000000 00000000 00000000 00000000 
    0cc0 00000000 00000000 00000000 00000000 
    0cd0 00000000 00000000 00000000 00000000 
    0ce0 00000000 00000000 00000000 00000000 
    0cf0 00000000 00000000 00000000 00000000 
    0e00 00072401 00000000 00000000 007f0000 
    0e10 00000000 00000000 00000000 00000000 
    0e20 00000000 00000000 00000000 00000000 
    0e30 00000000 00000000 00200a53 00000000 
    0e40 00000000 00000000 00000000 00000000 
    0e50 00000000 00000000 00000000 000c0a80 
    0e60 00000000 00000000 00000000 00000000 
    0e70 00000000 00000000 00000000 00000000 
    0e80 00000000 00000000 00000000 00000000 
    0e90 00000000 00000000 00000000 00000000 
    0ea0 00000000 00000000 00000000 00000000 
    0eb0 00000000 00000000 00000000 00000000 
    0ec0 00000000 00000000 00000000 00000000 
    0ed0 00000000 00000000 00000000 00000000 
    0ee0 00000000 00000000 00000000 00000000 
    0ef0 00000000 00000000 00000000 00000000 
    
    VTU:
    0: 001b55e0 00010005
    1: 001bff60 00020005
    
    ATU:
    0: d8e63fb3 80205c9a 00000106 00000006 m:5c:9a:d8:**:**:** p:.....o. v:1
    
  • debug memory read 0xb8040000 70
    (switch initialized)

    boot> debug memory read 0xb8040000 70
    b8040000:0003db1f 0003be39 00042000 00000000 .......9.. .....
    b8040010:00000000 00000000 00000000 00000000 ................
    b8040020:00000000 00000000 000f8000 00000000 ................
    b8040030:0b0a0900 00180000 00000000 2f2e0000 ............/...
    b8040040:00000000 00000908 00000000 00000000 ................
    b8040050:00000c0b 00000000 00000000 00000000 ................
    b8040060:00000000 0d0f110e 00000000 00000002 ................
    
  • debug memory read 0xb805002c 4
    boot> debug memory read 0xb805002c 4
    b805002c:06000000                            ....
    
  • debug memory read 0xb8070000 4
    boot> debug memory read 0xb8070000 4 
    b8070000:00000001                            ....
    
  • debug memory read 0xb8060000 c0
    boot> debug memory read 0xb8060000 c0
    b8060000:0005565c 00061a80 00000003 098961e4 ..V\..........a.
    b8060010:003fffdd 00000000 00000020 24044830 .?......... $.H0
    b8060020:00000000 00000000 00000000 00000000 ................
    b8060030:00000000 00000000 00000000 00000000 ................
    b8060040:00000000 00000000 00000000 00000000 ................
    b8060050:00000000 00000000 00000000 00000000 ................
    b8060060:00000000 00000000 00000000 00000000 ................
    b8060070:00000000 00000000 00000000 00000000 ................
    b8060080:00000000 00000000 00000000 00000000 ................
    b8060090:00002121 00000000 00000000 00000000 ..!!............
    b80600a0:00000000 00000000 00000000 00000000 ................
    b80600b0:00bf057e 00000000 00000000 00086000 ...~..........`.
    

Kernel (NetBSD)

  • Bootlog
    IPL:HARD-RESET
    memory test ... ok
    flinstall OK
    
    boot version: 1.0.0
    
    PKG "Orthos-HP"
    CPU "Atheros/AR9344"
    Revision 212.1 CLOCK 560.0 MHz
    HEAP MEMORY 262144 bytes
    Boot:InitFilesystem
    phy0.1: "Atheros/AR8327(SW)"
    phy0.0: "Atheros/AR8327(phy)"
    active ch:0
    post start
    DRAM Test ..... PASS
    Timer test .... PASS
    FLASH CHKSUM .. PASS
    LAN Test ..... 
    LoopBack count 0 .. 
    phy0.1: "Atheros/AR8327(SW)"
    phy0.0: "Atheros/AR8327(phy)"
    active ch:0
    active ch:1
    phy0.1: "Atheros/AR8327(SW)"
    phy0.0: "Atheros/AR8327(phy)"
    active ch:0
    PASS
    Package TYPE = 0x01
    post success
    now booting Firmware ...
    loaded Firmware
    config=0x80208483 status=0x00000000
    mips_pdcache_write_through=0
    mips_picache_line_size=32 mips_pdcache_line_size=32
      pagemask: 0x00000000
      status: 0x00000000
      config: 0x80208483
      cause: 0x00000000
    load memory 0x197f000, 0x6681000
    load memory 0x1000, 0x5f000
    Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002
        The NetBSD Foundation, Inc.  All rights reserved.
    Copyright (c) 1982, 1986, 1989, 1991, 1993
        The Regents of the University of California.  All rights reserved.
    
    NetBSD 1.6.1 (ORTHOS2.tmp) #0: 2014-09-19 17:54:33 JST
        ******@A00-30-04938:/home/******/skyhp2_orthos2/git/hituji/build/orthos2/kernel-obj/ORTHOS2.tmp
    
    total memory = 128 MB
    avail memory = 98288 KB
    using 1024 buffers containing 4096 KB of memory
    mainbus0 (root)
    cpu0 at mainbus0: MIPS 74Kc (0x1974c) Rev. 76 with software emulated floating point
    cpu0: 64KB/32B 4-way set-associative L1 Instruction cache, 32 TLB entries
    cpu0: 32KB/32B 4-way set-associative write-back L1 Data cache
    arspi0 at mainbus0
    arflash0 at mainbus0 addr 0xbf000000 size 8388608 bytes
    flash: id 0xc2 type 0x16 addr 0xbf000000 size 8388608 bytes
    pfmg: carrier mode 0 pkgid 0x10701 configid 0xff
    arrtc0 at mainbus0
    argiu0 at mainbus0
    btnu0 at argiu0 port 15
    btnu1 at argiu0 port 16
    btnu2 at argiu0 port 3
    athq0 at mainbus0
    athq0: WLAN MAC ADDRESS (a4:12:42:78:82:a2)
    Restoring Cal data from Flash
    dfs_attach: use DFS enhancements
    DFS min filter rssiThresh = 18
    DFS max pulse dur = 151 ticks
    ath_get_caps[5308] rx chainmask mismatch actual 3 sc_chainmak 0
    ath_get_caps[5283] tx chainmask mismatch actual 3 sc_chainmak 0
    athq0: LSDK-9.2.0_U10.1020 mac 768.0 phy 0.0 radio 0.0
     chan  Freq     HT                       DFS
     1     2412nbg  HT20 HT40PLUS            N
     2     2417nbg  HT20 HT40PLUS            N
     3     2422nbg  HT20 HT40PLUS            N
     4     2427nbg  HT20 HT40PLUS            N
     5     2432nbg  HT20 HT40PLUS HT40MINUS  N
     6     2437nbg  HT20 HT40PLUS HT40MINUS  N
     7     2442nbg  HT20 HT40PLUS HT40MINUS  N
     8     2447nbg  HT20 HT40PLUS HT40MINUS  N
     9     2452nbg  HT20 HT40PLUS HT40MINUS  N
     10    2457nbg  HT20          HT40MINUS  N
     11    2462nbg  HT20          HT40MINUS  N
     12    2467nbg  HT20          HT40MINUS  N
     13    2472nbg  HT20          HT40MINUS  N
    athq0: Atheros 9340: memt=0x80372470, memh=0xb8100000 
    com0 at mainbus0: ns16550a, working fifo
    com0: console
    ehci0 at mainbus0ehci0: EHCI version 1.0
    usb0 at ehci0: USB revision 2.0
    uhub0 at usb0
    uhub0: AR7100 EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
    uhub0: 1 port with 1 removable, self powered
    ageth0 at mainbus0
    ath27swlphy0 at ageth0 phy 1: Atheros AR8327 10/100/1000 L2SW, rev. 4
    ath27swlphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, auto, 1000baseT-FDX FLAG0, 1000baseT-FDX FLAG1
    ageth1 at mainbus0
    ath27swsphy0 at ageth1 phy 0: Atheros AR8327 10/100/1000 L2SW, rev. 4
    ath27swsphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, auto
    arpcieu0 at mainbus0:
    pci0 at arpcieu0 bus 0
    pci0: memory space enabled
    athq1 at pci0 dev 0 function 0
    athq1: WLAN MAC ADDRESS (a4:12:42:78:82:a3)
    __ath_attach: Set global_scn[1]
    ACBKMinfree = 48
    ACBEMinfree = 32
    ACVIMinfree = 16
    ACVOMinfree = 0
    CABMinfree = 48
    UAPSDMinfree = 0
    Restoring Cal data from Flash
    dfs_attach: use DFS enhancements
    DFS min filter rssiThresh = 18
    DFS max pulse dur = 151 ticks
    ath_get_caps[5308] rx chainmask mismatch actual 3 sc_chainmak 0
    ath_get_caps[5283] tx chainmask mismatch actual 3 sc_chainmak 0
    athq1: LSDK-9.2.0_U10.1020 mac 448.3 phy 0.0 radio 0.0
     chan  Freq     HT                       DFS
     36    5180na   HT20 HT40PLUS            N
     40    5200na   HT20          HT40MINUS  N
     44    5220na   HT20 HT40PLUS            N
     48    5240na   HT20          HT40MINUS  N
     52    5260na   HT20 HT40PLUS            Y
     56    5280na   HT20          HT40MINUS  Y
     60    5300na   HT20 HT40PLUS            Y
     64    5320na   HT20          HT40MINUS  Y
     100   5500na   HT20 HT40PLUS            Y
     104   5520na   HT20          HT40MINUS  Y
     108   5540na   HT20 HT40PLUS            Y
     112   5560na   HT20          HT40MINUS  Y
     116   5580na   HT20 HT40PLUS            Y
     120   5600na   HT20          HT40MINUS  Y
     124   5620na   HT20 HT40PLUS            Y
     128   5640na   HT20          HT40MINUS  Y
     132   5660na   HT20 HT40PLUS            Y
     136   5680na   HT20          HT40MINUS  Y
     140   5700na   HT20                     Y
    athq1: Atheros 9380: memt=0x80372470, memh=0xb0000000 
    rtc: CLOCK INITIALIZED 
    kevt0: 
    logbuf: using 655360 bytes logging area
    md0: internal 21504 KB image area
    uhub1 at uhub0 port 1
    uhub1: vendor 0x0409 product 0x005a, class 9/0, rev 2.00/1.00, addr 2
    uhub1: single transaction translator
    uhub1: 4 ports with 4 removable, self powered
    umass0 at uhub1 port 1 configuration 1 interface 0
    umass0: ADATA ADATA USB Flash Drive, rev 2.10/11.00, addr 3
    umass0: using SCSI over Bulk-Only
    scsibus0 at umass0: 2 targets, 1 luns per target
    sd0 at scsibus0 target 0 lun 0:  SCSI6 0/direct removable
    
    sd0 WriteProtect Disable
    sd0: 29600 MB, 29600 cyl, 64 head, 32 sec, 512 bytes/sect x 60620800 sectors
    boot device: 
    root on md0a dumps on md0b
    root file system type: ffs
    Tue Jan  1 00:00:02 JST 2013
    /usr/local/www/.htpasswd file not exists.(ignore)
    Setting tty flags.
    Building databases...
    wlan_vap_create : enter. devhandle=0x81952be0, opmode=IEEE80211_M_HOSTAP, flags=0x1
    wlan_vap_create : exit. devhandle=0x81952be0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
    wlan_vap_create : enter. devhandle=0x81952be0, opmode=IEEE80211_M_HOSTAP, flags=0x1
    wlan_vap_create : exit. devhandle=0x81952be0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
    wlan_vap_create : enter. devhandle=0xc00f4030, opmode=IEEE80211_M_HOSTAP, flags=0x1
    wlan_vap_create : exit. devhandle=0xc00f4030, opmode=IEEE80211_M_HOSTAP, flags=0x1.
    wlan_vap_create : enter. devhandle=0xc00f4030, opmode=IEEE80211_M_HOSTAP, flags=0x1
    wlan_vap_create : exit. devhandle=0xc00f4030, opmode=IEEE80211_M_HOSTAP, flags=0x1.
    Starting wificonfig
    encrypt key mode AES
    encrypt key mode AES
    Starting evtmgr.
    Starting dlnamgr.
    Starting clid.
    Starting inetd.
    Starting procmon.
    Starting wzcm.
    Tue Jan  1 00:00:08 JST 2013
    
    NetBSD/messimips (Amnesiac) (console)
    
    login: