WNPR2600G

以前ファームウェアを調べた際にMT7621を搭載していることを把握しており、つい最近某フリマサイトで安価な出品を見かけて衝動的に購入してしまった。
弄っていくのでメモ。

Switch

zone WAN LAN
port
(WNPR2600G)
インターネット LAN4 LAN3 LAN2 LAN1
port
(MT7530)
port0 port1 port2 port3 port4

MAC

Config (u-boot-env), eeprom内に有。

  • LAN: 34:76:C5:xx:xx:1E (Config, ethaddr (text))
  • WAN: 34:76:C5:xx:xx:1D (Config, wanaddr (text))
  • 2G: 34:76:C5:xx:xx:1E (Factory, 0x4 (hex))
  • 5G: 34:76:C5:xx:xx:1F (Factory, 0x8004 (hex))

U-Boot

  • help
    U-Boot 1.1.3 (May 25 2016 - 17:17:58)
    MT7621 # help
    ?       - alias for 'help'
    bootm   - boot application image from memory
    cp      - memory copy
    elx_check      - check ELX image
    erase   - erase SPI FLASH memory
    go      - start application at address 'addr'
    help    - print online help
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    mw      - memory write (fill)
    nm      - memory modify (constant address)
    printenv- print environment variables
    reset   - Perform RESET of the CPU
    rf      - read/write rf register
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    spi     - spi command
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version
    MT7621 # version
    
    U-Boot 1.1.3 (May 25 2016 - 17:17:58)
    

  • printenv
    ELECOM機関連の設定値が散見される

    MT7621 # printenv
    bootcmd=tftp
    baudrate=57600
    ethaddr="34:76:C5:**:**:1E"
    ramargs=setenv bootargs root=/dev/ram rw
    addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
    addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
    flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
    kernel_addr=BFC40000
    u-boot=u-boot.bin
    load=tftp 8A100000 $(u-boot)
    u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
    loadfs=tftp 8A100000 root.cramfs
    u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
    test_tftp=tftp 8A100000 root.cramfs;run test_tftp
    ethact=Eth0 (10/100-M)
    language_code=jp
    domain=1
    pincode=********
    wlanaddr=BC:5C:4C:**:**:**
    kver=1.04   
    sn=12345678901234567890123456789012
    usboot=0
    bver=4.0.1.5
    dom2=1
    wanaddr=34:76:C5:**:**:1D
    bootdelay=2
    filesize=52a000
    fileaddr=80A00000
    ipaddr=192.168.99.9
    serverip=192.168.99.8
    autostart=no
    bootfile=uImage_ELECOM-WRC-2533GHBK-I
    hw_id=0104003a
    op_mode=0
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 1051/4092 bytes
    

Kernel

コンソールにパスワードが掛けられている

  • uname -a
    # uname -a
    Linux WNPR2600G 3.2.9 #3 SMP Tue Oct 31 18:12:39 CST 2017 mips GNU/Linux
    

  • cat /proc/version
    # cat /proc/version
    Linux version 3.2.9 (root@***-pc) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Tue Oct 31 18:12:39 CST 2017
    

  • cat /proc/cpuinfo
    # cat /proc/version
    Linux version 3.2.9 (root@jim-pc) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Tue Oct 31 18:12:39 CST 2017
    # cat /proc/cpuinfo
    system type             : Mediatek MT7621 ver:1 eco:3
    machine                 : Ralink MT7621
    processor               : 0
    cpu model               : MIPS 1004Kc V2.15
    BogoMIPS                : 583.68
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
    ASEs implemented        : mips16 dsp mt
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 0
    VCED exceptions         : not available
    VCEI exceptions         : not available
    
    processor               : 1
    cpu model               : MIPS 1004Kc V2.15
    BogoMIPS                : 583.68
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
    ASEs implemented        : mips16 dsp mt
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 0
    VCED exceptions         : not available
    VCEI exceptions         : not available
    
    processor               : 2
    cpu model               : MIPS 1004Kc V2.15
    BogoMIPS                : 583.68
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
    ASEs implemented        : mips16 dsp mt
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 1
    VCED exceptions         : not available
    VCEI exceptions         : not available
    
    processor               : 3
    cpu model               : MIPS 1004Kc V2.15
    BogoMIPS                : 583.68
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
    ASEs implemented        : mips16 dsp mt
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 1
    VCED exceptions         : not available
    VCEI exceptions         : not available
    

  • cat /proc/meminfo
    # cat /proc/meminfo
    MemTotal:         125776 kB
    MemFree:           78028 kB
    Buffers:            3396 kB
    Cached:            12056 kB
    SwapCached:            0 kB
    Active:             4536 kB
    Inactive:          13272 kB
    Active(anon):       2412 kB
    Inactive(anon):      852 kB
    Active(file):       2124 kB
    Inactive(file):    12420 kB
    Unevictable:           0 kB
    Mlocked:               0 kB
    SwapTotal:             0 kB
    SwapFree:              0 kB
    Dirty:                 0 kB
    Writeback:             0 kB
    AnonPages:          2400 kB
    Mapped:             1912 kB
    Shmem:               904 kB
    Slab:              15696 kB
    SReclaimable:        844 kB
    SUnreclaim:        14852 kB
    KernelStack:         808 kB
    PageTables:          428 kB
    NFS_Unstable:          0 kB
    Bounce:                0 kB
    WritebackTmp:          0 kB
    CommitLimit:       62888 kB
    Committed_AS:     349380 kB
    VmallocTotal:    1048372 kB
    VmallocUsed:        7548 kB
    VmallocChunk:    1024940 kB
    

  • cat /proc/mtd
    # cat /proc/mtd
    dev:    size   erasesize  name
    mtd0: 01000000 00010000 "ALL"
    mtd1: 00030000 00010000 "Bootloader"
    mtd2: 00010000 00010000 "Config"
    mtd3: 00010000 00010000 "Factory"
    mtd4: 00da0000 00010000 "Kernel"
    mtd5: 00bd0000 00010000 "user"
    mtd6: 00190000 00010000 "manufacture"
    mtd7: 00080000 00010000 "storage"
    

  • ls -al /sys/class/leds/
    # ls -al /sys/class/leds/
    lrwxrwxrwx    1         0 Sep  1 00:05 PoE -> ../../devices/platform/leds-gpio/leds/PoE
    lrwxrwxrwx    1         0 Sep  1 00:00 2g_led -> ../../devices/platform/leds-gpio/leds/2g_led
    lrwxrwxrwx    1         0 Sep  1 00:00 5g_led -> ../../devices/platform/leds-gpio/leds/5g_led
    lrwxrwxrwx    1         0 Sep  1 00:00 DIAG -> ../../devices/platform/leds-gpio/leds/DIAG
    lrwxrwxrwx    1         0 Sep  1 00:00 power_led -> ../../devices/platform/leds-gpio/leds/power_led
    drwxr-xr-x   20         0 Sep  1 00:00 ..
    drwxr-xr-x    2         0 Sep  1 00:00 .
    

  • bootlog
    MT7615関連のログがあまりに多すぎるため、無線をオフにした状態のログ。

    
    ===================================================================
                    MT7621   stage1 code Mar 12 2015 14:43:30 (ASIC)
                    CPU=500000000 HZ BUS=125000000 HZ
    ==================================================================
    Change MPLL source from XTAL to CR...
    do MEMPLL setting..
    MEMPLL Config : 0x11000000
    3PLL mode + External loopback
    === XTAL-40Mhz === DDR-1200Mhz ===
    PLL4 FB_DL: 0x3, 1/0 = 567/457 0D000000
    PLL2 FB_DL: 0x11, 1/0 = 665/359 45000000
    PLL3 FB_DL: 0x14, 1/0 = 691/333 51000000
    do DDR setting..[01F40000]
    Apply DDR3 Setting...(use default AC)
              0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
          --------------------------------------------------------------------------------
    0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    000E:|    0    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1
    000F:|    0    0    0    0    0    1    1    1    1    1    1    1    1    1    1    1
    0010:|    1    1    1    1    1    1    1    1    1    1    1    0    0    0    0    0
    0011:|    1    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0
    0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
    DRAMC_DQSCTL1[0e0]=14000000
    DRAMC_DQSGCTL[124]=80000000
    rank 0 coarse = 16
    rank 0 fine = 40
    B:|    0    0    0    0    0    0    0    1    1    1    0    0    0    0    0    0
    opt_dle value:8
    DRAMC_DDR2CTL[07c]=C287220D
    DRAMC_PADCTL4[0e4]=000022B3
    DRAMC_DQIDLY1[210]=0B08070A
    DRAMC_DQIDLY2[214]=05070708
    DRAMC_DQIDLY3[218]=0C070705
    DRAMC_DQIDLY4[21c]=0A070B08
    DRAMC_R0DELDLY[018]=00002222
    ==================================================================
                    RX      DQS perbit delay software calibration 
    ==================================================================
    1.0-15 bit dq delay value
    ==================================================================
    bit|     0  1  2  3  4  5  6  7  8  9
    --------------------------------------
    0 |    9 5 7 8 6 6 6 5 1 7 
    10 |    6 9 7 8 6 9 
    --------------------------------------
    
    ==================================================================
    2.dqs window
    x=pass dqs delay value (min~max)center 
    y=0-7bit DQ of every group
    input delay:DQS0 =34 DQS1 = 34
    ==================================================================
    bit     DQS0     bit      DQS1
    0  (1~66)33  8  (1~60)30
    1  (1~64)32  9  (1~68)34
    2  (1~66)33  10  (1~66)33
    3  (1~62)31  11  (1~62)31
    4  (1~64)32  12  (1~66)33
    5  (1~66)33  13  (0~63)31
    6  (1~65)33  14  (1~66)33
    7  (1~67)34  15  (1~66)33
    ==================================================================
    3.dq delay value last
    ==================================================================
    bit|    0  1  2  3  4  5  6  7  8   9
    --------------------------------------
    0 |    10 7 8 11 8 7 7 5 5 7 
    10 |    7 12 8 11 7 10 
    ==================================================================
    ==================================================================
         TX  perbyte calibration 
    ==================================================================
    DQS loop = 15, cmp_err_1 = ffff0000 
    dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 
    dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 
    DQ loop=15, cmp_err_1 = ffff0000
    dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1 
    dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2 
    byte:0, (DQS,DQ)=(8,8)
    byte:1, (DQS,DQ)=(8,8)
    DRAMC_DQODLY1[200]=88888888
    DRAMC_DQODLY2[204]=88888888
    20,data:88
    [EMI] DRAMC calibration passed
    
    ===================================================================
                    MT7621   stage1 code done 
                    CPU=500000000 HZ BUS=125000000 HZ
    ===================================================================
    
    
    U-Boot 1.1.3 (May 25 2016 - 17:17:58)
    
    Board: Ralink APSoC DRAM:  128 MB
    relocate_code Pointer at: 87fb4000
    
    Config XHCI 40M PLL 
    flash manufacture id: c2, device id 20 18
    find flash: MX25L12805D
    ============================================ 
    Ralink UBoot Version: 4.0.1.0
    ELX UBoot Version: 1.0.3
    -------------------------------------------- 
    ASIC 7621_MP (MAC to MT7530 Mode)
    DRAM_CONF_FROM: Auto-Detection 
    DRAM_TYPE: DDR3 
    DRAM bus: 16 bit
    Xtal Mode=3 OCP Ratio=1/4
    Flash component: SPI Flash
    Date:May 25 2016  Time:17:17:58
    ============================================ 
    icache: sets:256, ways:4, linesz:32 ,total:32768
    dcache: sets:256, ways:4, linesz:32 ,total:32768 
    
     ##### The CPU freq = 880 MHZ #### 
     estimate memory size =128 Mbytes
    #Reset_MT7530
    
    Please choose the operation: 
       1: Load system code to SDRAM via TFTP. 
       2: Load system code then write to Flash via TFTP. 
       3: Boot system code via Flash (default).
       4: Entr boot command line interface.
       9: Load Boot Loader code then write to Flash via TFTP. 
                                                                                                                              0  
       
    3: System Boot system code via Flash.
    ## Booting image at bfc50000 ...
       Image Name:   Linux Kernel Image
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    1879274 Bytes =  1.8 MB
       Load Address: 80001000
       Entry Point:  803123e0
       Verifying Checksum ... OK
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 803123e0) ...
    ## Giving linux memsize in MB, 128
    
    Starting kernel ...
    
    Linux version 3.2.9 (root@***-pc) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Tue Oct 31 18:12:39 CST 2017
    GCMP present
    bootconsole [early0] enabled
    CPU revision is: 0001992f (MIPS 1004Kc)
    Mediatek MT7621 ver:1 eco:3 running at 880.00 MHz
    Software DMA cache coherency
    Determined physical RAM map:
     memory: 08000000 @ 00000000 (usable)
    Initrd not found or empty - disabling initrd
    Zone PFN ranges:
      Normal   0x00000000 -> 0x00008000
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
        0: 0x00000000 -> 0x00008000
    Detected 3 available secondary CPU(s)
    PERCPU: Embedded 7 pages/cpu @81103000 s4800 r8192 d15680 u32768
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
    Kernel command line:  console=ttyS0,57600 root=/dev/ram0 rootfstype=squashfs,jffs2
    PID hash table entries: 512 (order: -1, 2048 bytes)
    Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
    Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
    Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
    Writing ErrCtl register=00048800
    Readback ErrCtl register=00048800
    Memory: 123988k/131072k available (3186k kernel code, 7084k reserved, 729k data, 1788k init, 0k highmem)
    SLUB: Genslabs=9, HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
    Hierarchical RCU implementation.
    NR_IRQS:128
    gic: revision 3.0
    CPU0: status register was 11000000
    CPU0: status register now 11001800
    CPU0: status register frc 1100dc00
    console [ttyS0] enabled, bootconsole disabled
    console [ttyS0] enabled, bootconsole disabled
    Calibrating delay loop... 574.46 BogoMIPS (lpj=1148928)
    pid_max: default: 32768 minimum: 301
    Mount-cache hash table entries: 512
    CPU revision is: 0001992f (MIPS 1004Kc)
    Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
    CPU revision is: 0001992f (MIPS 1004Kc)
    Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
    CPU revision is: 0001992f (MIPS 1004Kc)
    Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
    Brought up 4 CPUs
    Synchronize counters across 4 CPUs: done.
    NET: Registered protocol family 16
    MIPS: machine is Ralink MT7621
    before gpio setting:407ac
    after gpio setting:405ac
    release PCIe RST: RALINK_RSTCTRL = 3000000
    PCIE PHY initialize
    ***** Xtal 40MHz *****
    start MT7621 PCIe register access
    RALINK_RSTCTRL = 3000000
    RALINK_CLKCFG1 = 77ffeff8
    
    *************** MT7621 PCIe RC mode *************
    pcie_link status = 0x3
    RALINK_RSTCTRL= 3000000
    *** Configure Device number setting of Virtual PCI-PCI bridge ***
    RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2
    PCIE0 enabled
    PCIE1 enabled
    interrupt enable status: 300000
    Port 1 N_FTS = 1b105000
    Port 0 N_FTS = 1b105000
    config reg done
    init_rt2880pci done
    bio: create slab  at 0
    SCSI subsystem initialized
    pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
    pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000)
    pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
    pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff]
    pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff]
    pci 0000:00:00.0: BAR 1: set to [mem 0x60200000-0x6020ffff] (PCI address [0x60200000-0x6020ffff])
    pci 0000:00:01.0: BAR 1: assigned [mem 0x60210000-0x6021ffff]
    pci 0000:00:01.0: BAR 1: set to [mem 0x60210000-0x6021ffff] (PCI address [0x60210000-0x6021ffff])
    pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
    pci 0000:01:00.0: BAR 0: set to [mem 0x60000000-0x600fffff 64bit] (PCI address [0x60000000-0x600fffff])
    pci 0000:00:00.0: PCI bridge to [bus 01-01]
    pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
    pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff 64bit]
    pci 0000:02:00.0: BAR 0: set to [mem 0x60100000-0x601fffff 64bit] (PCI address [0x60100000-0x601fffff])
    pci 0000:00:01.0: PCI bridge to [bus 02-02]
    pci 0000:00:01.0:   bridge window [mem 0x60100000-0x601fffff]
    PCI: Enabling device 0000:00:00.0 (0004 -> 0006)
    PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
    BAR0 at slot 0 = 0
    bus=0x0, slot = 0x0
    res[0]->start = 0
    res[0]->end = 0
    res[1]->start = 60200000
    res[1]->end = 6020ffff
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    BAR0 at slot 1 = 0
    bus=0x0, slot = 0x1
    res[0]->start = 0
    res[0]->end = 0
    res[1]->start = 60210000
    res[1]->end = 6021ffff
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    bus=0x1, slot = 0x0, irq=0x4
    res[0]->start = 60000000
    res[0]->end = 600fffff
    res[1]->start = 0
    res[1]->end = 0
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    bus=0x2, slot = 0x1, irq=0x18
    res[0]->start = 60100000
    res[0]->end = 601fffff
    res[1]->start = 0
    res[1]->end = 0
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    Switching to clocksource MIPS
    NET: Registered protocol family 2
    IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    TCP established hash table entries: 4096 (order: 3, 32768 bytes)
    TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
    TCP: Hash tables configured (established 4096 bind 4096)
    TCP reno registered
    UDP hash table entries: 128 (order: 0, 4096 bytes)
    UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
    NET: Registered protocol family 1
    4 CPUs re-calibrate udelay(lpj = 1167360)
    Load Ralink Timer0 Module
    Load Ralink Timer1 Module
    Load Ralink Timer2 Module
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
    msgmni has been set to 242
    io scheduler noop registered
    io scheduler deadline registered
    io scheduler cfq registered (default)
    Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
    serial8250: ttyS0 at MMIO 0x1e000c00 (irq = 26) is a 16550A
    serial8250: ttyS1 at MMIO 0x1e000e00 (irq = 28) is a 16550A
    loop: module loaded
    flash manufacture id: c2, device id 20 18
    MX25L12805D(c2 2018c220) (16384 Kbytes)
    mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
    Creating 8 MTD partitions on "raspi":
    0x000000000000-0x000001000000 : "ALL"
    0x000000000000-0x000000030000 : "Bootloader"
    0x000000030000-0x000000040000 : "Config"
    0x000000040000-0x000000050000 : "Factory"
    0x000000050000-0x000000df0000 : "Kernel"
    0x000000220000-0x000000df0000 : "user"
    0x000000df0000-0x000000f80000 : "manufacture"
    0x000000f80000-0x000001000000 : "storage"
    rdm_major = 253
    IMQ driver loaded successfully. (numdevs = 2, numqueues = 1)
            Hooking IMQ after NAT on PREROUTING.
            Hooking IMQ before NAT on POSTROUTING.
    GMAC1_MAC_ADRH -- : 0x0000000c
    GMAC1_MAC_ADRL -- : 0x43288002
    Ralink APSoC Ethernet Driver Initilization. v3.1  512 rx/tx descriptors allocated, mtu = 1500!
    GMAC1_MAC_ADRH -- : 0x0000000c
    GMAC1_MAC_ADRL -- : 0x432880c9
    PROC INIT OK!
    PPP generic driver version 2.4.2
    PPP BSD Compression module registered
    PPP Deflate Compression module registered
    PPP MPPE Compression module registered
    NET: Registered protocol family 24
    Registered button device:reset, gpio:16,code:408,index:10
    Registered button device:wps, gpio:18,code:529,index:11
    Registered button device:op_mode_1, gpio:13,code:263,index:7
    GACT probability on
    Mirror/redirect action on
    Simple TC action Loaded
    netem: version 1.3
    u32 classifier
        Performance counters on
        input device check on
        Actions configured
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (2500 buckets, 17500 max, 2500 max0, 20000 reserved)
    xt_time: kernel timezone is -0000
    ip_tables: (C) 2000-2006 Netfilter Core Team
    TCP westwood registered
    NET: Registered protocol family 10
    ip6_tables: (C) 2000-2006 Netfilter Core Team
    IPv6 over IPv4 tunneling driver
    NET: Registered protocol family 17
    NET: Registered protocol family 2
    L2TP core driver, V2.0
    8021q: 802.1Q VLAN Support v1.8
    Freeing unused kernel memory: 1788k freed
    System Init version: 1.1 date: 1
    Setting up file systems ...
    Setting up /mnt/tmpfs directory with tmpfs/16384KB
    Setting up FLASH storage partition ...
    JFFS2 notice: (345) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    Setting up /apps directory ...apps is in FLASH ...
    Setting up loopback device ...
    FINISHED
    Start Normal Operation Mode ...
    ************************************************************************
    *                                ---ELX---                             *
    ************************************************************************
    
    KernelApp version: 1.4.0 build date: 2017/10/31 build time: 18:06:42
    cmd> ln: /sbin/./start_all: File exists
    Share memory created:  keyid 6888 shm_id 0 size 208(KB)
    Warning: dbox_destroy_share_memory p_dbox_cfg is NULL!
    nat_session_manager: module license 'unspecified' taints kernel.
    Disabling lock debugging due to kernel taint
    Start nat_session_reservation_init_driver
    __create_share_mem keyid 6888 shm_id 0
     0:1F: 0: 0: 0: 0
    Raeth v3.1 (Tasklet)
    phy_free_head is 0x6c00000!!!
    phy_free_tail_phy is 0x6c01ff0!!!
    txd_pool=a6c1a000 phy_txd_pool=06C1A000
    ei_local->skb_free start address is 0x8703d45c.
    free_txd: 06c1a010, ei_local->cpu_ptr: 06C1A000
     POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
    ----------------+---------+--------
         0xa6c1a000 0x06C1A000 0x06C1A000
    
    phy_qrx_ring = 0x06c02000, qrx_ring = 0xa6c02000
    
    phy_rx_ring0 = 0x073ea000, rx_ring0 = 0xa73ea000
    GMAC1_MAC_ADRH -- : 0x0000001f
    GMAC1_MAC_ADRL -- : 0x00000000
    GDMA2_MAC_ADRH -- : 0x000000aa
    GDMA2_MAC_ADRL -- : 0xbbccdd20
    eth3: ===> VirtualIF_open
    CDMA_CSG_CFG = 81000000
    GDMA1_FWD_CFG = 20710000
    GDMA2_FWD_CFG = 20710000
    ra2880stop()...Done
    eth3: ===> VirtualIF_close
    Free TX/RX Ring Memory!
     0:1F: 0: 0: 0: 0
    Raeth v3.1 (Tasklet)
    phy_free_head is 0x6c24000!!!
    phy_free_tail_phy is 0x6c25ff0!!!
    txd_pool=a733c000 phy_txd_pool=0733C000
    ei_local->skb_free start address is 0x8703d45c.
    free_txd: 0733c010, ei_local->cpu_ptr: 0733C000
     POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
    ----------------+---------+--------
         0xa733c000 0x0733C000 0x0733C000
    
    phy_qrx_ring = 0x07359000, qrx_ring = 0xa7359000
    
    phy_rx_ring0 = 0x073f2000, rx_ring0 = 0xa73f2000
    GMAC1_MAC_ADRH -- : 0x0000001f
    GMAC1_MAC_ADRL -- : 0x00000000
    eth3: ===> VirtualIF_open
    CDMA_CSG_CFG = 81000000
    GDMA1_FWD_CFG = 20710000
    GDMA2_FWD_CFG = 20710000
    GDMA2_MAC_ADRH -- : 0x00003476
    GDMA2_MAC_ADRL -- : 0xc583ba1d
    eth3: ===> VirtualIF_open
    ADDRCONF(NETDEV_UP): br0: link is not ready
    device eth2 entered promiscuous mode
    br0: port 1(eth2) entering forwarding state
    br0: port 1(eth2) entering forwarding state
    
    
    ********************
    Initialize Radio_(24G) setting ... 
    rd[0]==1
    OK
    
    
    Configuring Ralink WiFi device ...Wlan is in
     AP Mode
    CMD[insmod /lib/rlt_wifi.ko]
    register mt_drv
    
    
    === pAd = c0601000, size = 2378520 ===
    
    PciHif.CSRBaseAddress =0xc0500000, csr_addr=0xc0500000!
    RTMPInitPCIeDevice():device_id=0x7615
    DriverOwn()::Try to Clear FW Own...
    DriverOwn()::Success to clear FW Own
    mt_pci_chip_cfg(): HWVer=0x8a10, FWVer=0x8a10, pAd->ChipID=0x7615
    mt_pci_chip_cfg(): HIF_SYS_REV=0x76150001
    RtmpChipOpsHook(492): Not support for HIF_MT yet! MACVersion=0x0
    mt7615_init()-->
    Use 1st ePAeLNA default bin.
    
    Use 2nd ePAeLNA default bin.
    rxq = c0843d84
    ctl->ackq = c0843d90
    ctl->kickq = c0843d9c
    ctl->tx_doneq = c0843da8
    ctl->rx_doneq = c0843db4
    mt7615_fw_prepare():FW(8a10), HW(8a10), CHIPID(7615))
    mt7615_fw_prepare(2356): MT7615_E3, USE E3 patch and ram code binary image
    AndesMTLoadRomMethodFwDlRing(1035), cap->rom_patch_len(3150)
    AndesRestartCheck: Current TOP_MISC2(0x1)
    AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
    20160419154809a
    
    platform = 
    ALPS
    hw/sw version = 
    8a108a10
    patch version = 
    00000010
    Patch SEM Status=2
    MtCmdPatchSemGet:(ret = 0)
    
    Patch is not ready && get semaphore success, SemStatus(2)
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    MtCmdPatchFinishReq
    EventGenericEventHandler: CMD Success
    Send checksum req..
    Patch SEM Status=3
    MtCmdPatchSemGet:(ret = 0)
    
    Release patch semaphore, SemStatus(3)
    AndesMTEraseRomPatch
    AndesMTLoadFwMethodFwDlRing(809), cap->fw_len(452248)
    Build Date:_201609021732
    Build Date:_201609021732
    AndesRestartCheck: Current TOP_MISC2(0x1)
    AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    MtCmdFwStartReq: override = 1, address = 540672
    EventGenericEventHandler: CMD Success
    Build Date:_201607011611
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    MtCmdFwStartReq: override = 4, address = 0
    EventGenericEventHandler: CMD Success
    MCU Init Done!
    efuse_probe: efuse = 10000212
    RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5
    RtmpEepromGetDefault::e2p_dafault=1
    RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1
    NVM is FLASH mode. dev_idx [0] FLASH OFFSET [0x40000]
    NICReadEEPROMParameters: EEPROM 0x52 b307
    MtCmdSetTxLpfCal:(ret = 0)
    MtCmdSetTxIqCal:(ret = 0)
    MtCmdSetTxDcCal:(ret = 0)
    MtCmdSetRxFiCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    Country Region from e2p = 1
    mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4
    rtmp_read_txpwr_from_eeprom(224): Don't Support this now!
    RTMPReadTxPwrPerRate(1381): Don't Support this now!
    RcRadioInit(): DbdcMode=0, ConcurrentBand=1
    RcRadioInit(): pRadioCtrl=878e9438,Band=0,rfcap=3,channel=1,PhyMode=2
    MtCmdSetDbdcCtrl:(ret = 0)
    Band Rf: 1, Phy Mode: 2
    AntCfgInit(2618): Not support for HIF_MT yet!
    MtSingleSkuLoadParam: RF_LOCKDOWN Feature OFF !!!
    MtBfBackOffLoadTable: RF_LOCKDOWN Feature OFF !!!
    EEPROM Init Done!
    mt_mac_init()-->
    mt_mac_pse_init(2715): Don't Support this now!
    mt7615_init_mac_cr()-->
    mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c
    mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c
    MtAsicSetMacMaxLen(1288): Not finish Yet!
    
    ApAutoChannelAtBootUprxq = c0bc3d84
    ctl->ackq = c0bc3d90
    ctl->kickq = c0bc3d9c
    ctl->tx_doneq = c0bc3da8
    ctl->rx_doneq = c0bc3db4
    mt7615_fw_prepare():FW(8a10), HW(8a10), CHIPID(7615))
    mt7615_fw_prepare(2356): MT7615_E3, USE E3 patch and ram code binary image
    AndesMTLoadRomMethodFwDlRing(1035), cap->rom_patch_len(3150)
    AndesRestartCheck: Current TOP_MISC2(0x1)
    AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
    20160419154809a
    
    platform = 
    ALPS
    hw/sw version = 
    8a108a10
    patch version = 
    00000010
    Patch SEM Status=2
    MtCmdPatchSemGet:(ret = 0)
    
    Patch is not ready && get semaphore success, SemStatus(2)
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    MtCmdPatchFinishReq
    EventGenericEventHandler: CMD Success
    Send checksum req..
    Patch SEM Status=3
    MtCmdPatchSemGet:(ret = 0)
    
    Release patch semaphore, SemStatus(3)
    AndesMTEraseRomPatch
    AndesMTLoadFwMethodFwDlRing(809), cap->fw_len(452248)
    Build Date:_201609021732
    Build Date:_201609021732
    AndesRestartCheck: Current TOP_MISC2(0x1)
    AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    MtCmdFwStartReq: override = 1, address = 540672
    EventGenericEventHandler: CMD Success
    Build Date:_201607011611
    EventGenericEventHandler: CMD Success
    MtCmdAddressLenReq:(ret = 0)
    MtCmdFwStartReq: override = 4, address = 0
    EventGenericEventHandler: CMD Success
    MCU Init Done!
    efuse_probe: efuse = 10000212
    RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5
    RtmpEepromGetDefault::e2p_dafault=1
    RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1
    NVM is FLASH mode. dev_idx [1] FLASH OFFSET [0x48000]
    NICReadEEPROMParameters: EEPROM 0x52 b307
    MtCmdSetTxLpfCal:(ret = 0)
    MtCmdSetTxIqCal:(ret = 0)
    MtCmdSetTxDcCal:(ret = 0)
    MtCmdSetRxFiCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    MtCmdSetRxFdCal:(ret = 0)
    Country Region from e2p = 1
    mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4
    rtmp_read_txpwr_from_eeprom(224): Don't Support this now!
    RTMPReadTxPwrPerRate(1381): Don't Support this now!
    RcRadioInit(): DbdcMode=0, ConcurrentBand=1
    RcRadioInit(): pRadioCtrl=878eb438,Band=0,rfcap=3,channel=1,PhyMode=2
    MtCmdSetDbdcCtrl:(ret = 0)
    Band Rf: 1, Phy Mode: 2
    AntCfgInit(2618): Not support for HIF_MT yet!
    MtSingleSkuLoadParam: RF_LOCKDOWN Feature OFF !!!
    MtBfBackOffLoadTable: RF_LOCKDOWN Feature OFF !!!
    EEPROM Init Done!
    mt_mac_init()-->
    mt_mac_pse_init(2715): Don't Support this now!
    mt7615_init_mac_cr()-->
    mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c
    mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c
    MtAsicSetMacMaxLen(1288): Not finish Yet!
    
    ApAutoChannelAtBootUp VirtualIF_open
    Ebtables v2.0 registered
    __create_share_mem keyid 6888 shm_id 0
    __create_share_mem keyid 6888 shm_id 0
    __create_share_mem keyid 6888 shm_id 0
    Start wps_led driver
    Err: read_to_buf failed to open file /proc/523/status!
    br0: port 1(eth2) entering forwarding state
    eth3: ===> VirtualIF_close
    eth3: ===> VirtualIF_open
    eth3: ===> VirtualIF_close
    eth3: ===> VirtualIF_open
    br0: port 2(ra0) entering forwarding state
    br0: port 3(rai0) entering forwarding state
    
    

広告

WN-AC733GR3

WN-AC1167GRの作業にあたり、factoryファームの生成コードをある程度汎用化したく、おおよそヘッダが似通っているこの機種を確保。基板は9割方ELECOM WRC-733GHBKと同一だった。
弄るにあたってメモ。

Switch

zone WAN LAN
port
(WN-AC733GR3)
インターネット LAN4 LAN3 LAN2 LAN1
port
(RTL8367RB)
port0 port1 port2 port3 port4

MAC

Config (u-boot-env), eeprom内に有。

  • LAN: 34:76:C5:xx:xx:66 (Config, ethaddr (text))
  • WAN: 34:76:C5:xx:xx:65 (Config, wanaddr (text))
  • 2G: 34:76:C5:xx:xx:66 (Factory, 0x4 (hex))
  • 5G: 34:76:C5:xx:xx:67 (iNIC_rf, 0x4 (hex))

U-Boot

  • help
    MT7620 # help
    ?       - alias for 'help'
    bootm   - boot application image from memory
    elx_check      - check ELX image
    go      - start application at address 'addr'
    help    - print online help
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    mw      - memory write (fill)
    nm      - memory modify (constant address)
    printenv- print environment variables
    reset   - Perform RESET of the CPU
    rf      - read/write rf register
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version
    MT7620 # version
    
    U-Boot 1.1.3 (Jan 28 2013 - 19:01:11)
    

  • printenv
    MT7620 # printenv
    bootcmd=tftp
    baudrate=57600
    ethaddr="34:76:C5:**:**:66"
    ramargs=setenv bootargs root=/dev/ram rw
    addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
    addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
    flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
    kernel_addr=BFC40000
    u-boot=u-boot.bin
    load=tftp 8A100000 $(u-boot)
    u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
    loadfs=tftp 8A100000 root.cramfs
    u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
    test_tftp=tftp 8A100000 root.cramfs;run test_tftp
    ethact=Eth0 (10/100-M)
    language_code=jp
    hw_id=01040006
    domain=1
    pincode=01977608
    wlanaddr=00:aa:bb:cc:dd:10
    kver=2.00   
    sn=12345678901234567890123456789012
    usboot=0
    op_mode=1
    bver=4.0.1.5
    dom2=1
    wanaddr=34:76:C5:**:**:65
    bootdelay=2
    filesize=320000
    fileaddr=80A00000
    ipaddr=192.168.99.9
    serverip=192.168.99.8
    autostart=no
    bootfile=uImage_WN-AC733GR
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 1040/4092 bytes
    

Kernel

パスワードが掛けられている。

  • uname -a
    # uname -a
    Linux WN-AC733GR 3.2.9 #3 Mon Dec 2 17:57:37 CST 2013 mips GNU/Linux
    

  • cat /proc/version
    # cat /proc/version
    Linux version 3.2.9 (root@***-pc) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #3 Mon Dec 2 17:57:37 CST 2013
    

  • cat /proc/cpuinfo
    # cat /proc/cpuinfo
    system type             : Ralink MT7620   ver:2 eco:3
    machine                 : Ralink MT7620
    processor               : 0
    cpu model               : MIPS 24Kc V5.0
    BogoMIPS                : 385.02
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
    ASEs implemented        : mips16
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 0
    VCED exceptions         : not available
    VCEI exceptions         : not available
    

  • cat /proc/meminfo
    # cat /proc/meminfo
    MemTotal:          61928 kB
    MemFree:           36104 kB
    Buffers:            2112 kB
    Cached:             8716 kB
    SwapCached:            0 kB
    Active:             5028 kB
    Inactive:           8248 kB
    Active(anon):       2640 kB
    Inactive(anon):      732 kB
    Active(file):       2388 kB
    Inactive(file):     7516 kB
    Unevictable:           0 kB
    Mlocked:               0 kB
    SwapTotal:             0 kB
    SwapFree:              0 kB
    Dirty:                 0 kB
    Writeback:             0 kB
    AnonPages:          2464 kB
    Mapped:             1952 kB
    Shmem:               924 kB
    Slab:               6316 kB
    SReclaimable:        604 kB
    SUnreclaim:         5712 kB
    KernelStack:         672 kB
    PageTables:          452 kB
    NFS_Unstable:          0 kB
    Bounce:                0 kB
    WritebackTmp:          0 kB
    CommitLimit:       30964 kB
    Committed_AS:     349664 kB
    VmallocTotal:    1048372 kB
    VmallocUsed:        3448 kB
    VmallocChunk:    1034964 kB
    

  • cat /proc/mtd
    # cat /proc/mtd
    dev:    size   erasesize  name
    mtd0: 00800000 00001000 "ALL"
    mtd1: 00030000 00001000 "Bootloader"
    mtd2: 00010000 00001000 "Config"
    mtd3: 00008000 00001000 "Factory"
    mtd4: 00008000 00001000 "iNIC_rf"
    mtd5: 006d4000 00001000 "Kernel"
    mtd6: 00584000 00001000 "user"
    mtd7: 0008c000 00001000 "manufacture"
    mtd8: 00010000 00001000 "backup"
    mtd9: 00040000 00001000 "storage"
    

  • ls -al /sys/class/leds/
    # ls -al /sys/class/leds/
    lrwxrwxrwx    1         0 Jan  1  2012 2g_led -> ../../devices/platform/leds-gpio/leds/2g_led
    lrwxrwxrwx    1         0 Jan  1  2012 5g_led -> ../../devices/platform/leds-gpio/leds/5g_led
    lrwxrwxrwx    1         0 Jan  1  2012 status -> ../../devices/platform/leds-gpio/leds/status
    lrwxrwxrwx    1         0 Jan  1  2012 power_led -> ../../devices/platform/leds-gpio/leds/power_led
    drwxr-xr-x   18         0 Jan  1  2012 ..
    drwxr-xr-x    2         0 Jan  1  2012 .
    

  • bootlog (op_mode=1)
    U-Boot 1.1.3 (Jan 28 2013 - 19:01:11)
    
    Board: Ralink APSoC DRAM:  64 MB
    
     Realtek giga Mac init!
    Disable port 0
    Ralink UBoot ver: 4.0.1.0
    ELX UBoot ver: 4.0.1.5 (Jan 28 2013 19:01:11)
    Date:Jan 28 2013  Time:19:01:11
    CPU: 580 MHz, MEM: 64 MB
    
    Please choose the operation: 1, 2, 3, 4, 9
                                                                                                                              0  
       
    3: System Boot system code via Flash.
    ## Booting image at bc050000 ...
       Image Name:   Linux Kernel Image
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    1374857 Bytes =  1.3 MB
       Load Address: 80000000
       Entry Point:  80246300
       Verifying Checksum ... OK
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 80246300) ...
    ## Giving linux memsize in MB, 64
    
    Starting kernel ...
    
    Ralink MT7620   ver:2 eco:3 running at 580.00 MHz
    console [ttyS1] enabled
    System Init version: 1.1 date: 1
    Setting up file systems ...
    Setting up /mnt/tmpfs directory with tmpfs/16384KB
    Setting up FLASH storage partition ...
    Setting up /apps directory ...apps is in FLASH ...
    Setting up loopback device ...
    FINISHED
    Start Normal Operation with Debug Messages ...
    cmd [start_all&]
    cmd [echo 0 > /sys/devices/platform/gpio-keys-polled/disable_intp]
    Application version:2.0.0.1              Date:2013/12/02
    
    ************************************************************************
    *                                ---ELX---                             *
    ************************************************************************
    
    KernelApp version: 2.0.0 build date: 2013/12/02 build time: 17:52:39
    cmd> cmd [sh /tmp/link_apps_to_root_dir.sh $1 $2 > /dev/null]
    ln: /sbin/./start_all: File exists
    cmd [rm -rf /tmp/link_apps_to_root_dir.sh]
    cmd [/sbin/dbox_init]
    ===  DBox Init start ==
    Dbox: used token len/max token len: 23/24, longest one is [wl1qos_priority_control]
    Dbox: used item len/max item len: 187/200
    Share memory created:  keyid 6888 shm_id 0 size 219(KB)
    Warning: dbox_destroy_share_memory p_dbox_cfg is NULL!
    cmd [/sbin/sd  &]
    CMD[mkdir -p /var/sd]
    __create_share_mem keyid 6888 shm_id 0
    CTRL_INTERFACE:[/var/sd_if]  CTRL_INTERFACE_IF:[if0]
    
    System Monitoring
    cmd [/sbin/sd_ctrl start_all]
    name [all]
    name [default]
    name [lo]
    name [imq0]
    name [imq1]
    name [eth2]
    name [eth2.1]
    name [eth2.2]
    name [br0]
    
    
    ********************
    Initialize Radio_(24G) setting ... rd[0]==1
    OK
    
    
    Configuring Ralink WiFi device ...Wlan is in AP Mode
    CMD[insmod /lib/rt2860v2_ap.ko]
    CMD[ifconfig ra0 0.0.0.0 up]
    CMD[iwpriv ra0 set RadioOn=0]
    CMD[ifconfig ra1 0.0.0.0 up]
    CMD[brctl addif br0 ra0]
    CMD[brctl addif br0 ra1]
    CMD[mkdir -p /etc/wsc_xml]
    CMD[ln -s /apps/etc/xml/* /etc/wsc_xml]
    CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
    CMD[wscd -i ra0 -m 1 -w /etc/wsc_xml -a 192.168.0.1&]
    CMD[iwpriv ra0 set IgmpSnEnable=0]
    CMD[iwpriv ra1 set IgmpSnEnable=0]
    CMD[iwpriv ra0 set RadioOn=1]
    CMD[iwpriv ra0 set WscConfMode=7]
    CMD[echo netdev > /sys/class/leds/2g_led/trigger]
    CMD[echo "ra0" > /sys/class/leds/2g_led/device_name]
    CMD[echo "link tx rx"> /sys/class/leds/2g_led/mode]
    CMD[iwpriv ra0 set WscMaxPinAttack=5]
    CMD[iwpriv ra0 set HtMIMOPS=3]
    
    
    ********************
    Initialize Radio_(5G) setting ... rd[1]==1
    OK
    Configuring 5G radio setting ... 
    
    Configuring Ralink WiFi device ...Wlan is in AP Mode
    CMD[insmod /lib/mt7610_ap.ko]
    wscd: SSDP UDP PORT = 1900
    CMD[ifconfig rai0 0.0.0.0 up]
    CMD[iwpriv rai0 set RadioOn=0]
    CMD[brctl addif br0 rai0]
    CMD[mkdir -p /etc/wsc_xml]
    CMD[ln -s /apps/etc/xml/* /etc/wsc_xml]
    ln: /etc/wsc_xml/WFAWLANConfigSCPD.xml: File exists
    CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
    route: SIOCADDRT: File exists
    CMD[wscd -i rai0 -m 1 -w /etc/wsc_xml -a 192.168.0.1&]
    CMD[iwpriv rai0 set IgmpSnEnable=0]
    wscd: SSDP UDP PORT = 1900
    CMD[iwpriv rai0 set RadioOn=1]
    CMD[iwpriv rai0 set WscConfMode=7]
    CMD[echo netdev > /sys/class/leds/5g_led/trigger]
    CMD[echo "rai0" > /sys/class/leds/5g_led/device_name]
    CMD[echo "link tx rx"> /sys/class/leds/5g_led/mode]
    CMD[iwpriv rai0 set WscMaxPinAttack=5]
    CMD[iwpriv rai0 set HtMIMOPS=3]
    --> default
    --> pppoeUnnumberMode 0
    --> DHCP_AR_MODE lan_dhcpd_enable
    WAN Speed = 1000 Mbps
    CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
    route: SIOCADDRT: File exists
    CMD[mkdir -p /etc/linuxigd]
    CMD[ln -sf /apps/etc/linuxigd/* /etc/linuxigd/.]
    CMD[upnpd -f  eth2.2 br0&]
    FAILED
    cmd [/sbin/taskmanager &]
    cmd [/sbin/xcontrol 2>/dev/null &]
    SEM_GETID got id -1
    Err: read_to_buf failed to open file /proc/454/status!
    Err: read_to_buf failed to open file /proc/455/status!
    XControl version: 1.0.0
    [XCONTROL DBG] if_dev_name:[eth2]
    We are using default MAC [00:AA:BB:CC:DD:10]
    server_socket 3
    socket timeout is 300
    WAN Speed = 1000 Mbps
    CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
    route: SIOCADDRT: File exists
    CMD[mkdir -p /etc/linuxigd]
    CMD[ln -sf /apps/etc/linuxigd/* /etc/linuxigd/.]
    send 15 to pid:1076
    CMD[upnpd -f  eth2.2 br0&]
    OK
    *** Task manager starts ***
    taskmanager update modules
    Err: read_to_buf failed to open file /proc/1153/status!
    taskmanager update modules
    failed to read /tmp/task_mgr.conf, use backup file!
    

WN-AC1167GRメモ headerチェック

WN-AC1167GR内の header でファームのヘッダが問題無くチェックをパスできるか確認。

# tftp -r openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin -g 192.168.0.100
# header -x openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin 
### Decoding  image ####
Decode source file [openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin]
------- Header Info -------
Vendor  id:  0x0104
Product id:  0x0016
Hardware id:  0x01040016
Version id:  
Code Version:  
Type: 0x3 [kernel]
comp_file_len:  5505028
comp_file_sum:  0x0
Header sum:  0x0
Magic key:  0x0
MD5 chksum:  90ba7450183602a7cbe542bc1a9b436
------------------------------
Decode finished, got file [openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin.bin] with size 5505028 bytes
header: Return OK

header付加スクリプト

  • TOOLDIRは環境に合わせて書き換え
  • mkhashとxorimageはOpenWrtのfirmware-utilsを使用
  • ファイルサイズとmd5sumの埋め込みはxxd利用するともう少し簡略化できる(たぶん)
  • create_headerの hw_id を変更することで、WN-AC733GRxやWNPR2600G、ELECOMの同様のヘッダを持つ機種にも利用できるかもしれない
#!/bin/bash

TOOLDIR="/home/tofu/routers/firmware-utils"

create_header(){
	fw_bin="$1"
	hw_id="01040016"

	[ -d "$(pwd)/tmp" ] || mkdir $(pwd)/tmp
	( \
		echo -ne "\x00\x00\x00\x00\x00\x00\x00\x03" | \
			dd bs=42 count=1 conv=sync; \
		echo -ne "\x${hw_id:0:2}\x${hw_id:2:2}\x${hw_id:4:2}\x${hw_id:6:2}" | \
			dd bs=20 count=1 conv=sync; \
		echo -ne "$(printf '%08x' $(stat -c%s $fw_bin) | fold -s2 | xargs -I {} echo \\x{} | tr -d '\n')" | \
			dd bs=8 count=1 conv=sync; \
		echo -ne "$(${TOOLDIR}/mkhash md5 $fw_bin | fold -s2 | xargs -I {} echo \\x{} | tr -d '\n')" | \
			dd bs=58 count=1 conv=sync; \
	 ) > ./tmp/header.bin
}

xor_fw(){
	fw_bin="$1"
	xor_key="8844A2D168B45A2D"

	${TOOLDIR}/xorimage -i $fw_bin -o ./tmp/${fw_bin}.xor -p "$xor_key" -x
}

concat_header(){
	fw_bin="$1"
	cat ./tmp/header.bin ./tmp/${fw_bin}.xor > ./tmp/${fw_bin}.new
}

fw_bin=$1

[ -r "$fw_bin" ] && \
create_header $fw_bin && \
xor_fw $fw_bin && \
concat_header $fw_bin && \
cp ./tmp/${fw_bin}.new ./ || \
echo "ERROR"

実行例

./header.sh openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-plain.bin

WXR-2533DHP AR8337 register

WXR-2533DHPにはAtheros/Qualcomm Atheros/Qualcomm機に入っていることが多い ethreg コマンドが存在せず、stock firmwareにおけるAR8327系switchのレジスタを確認できていなかったが、偶然 /proc のsysfsでレジスタのread/writeが行えるようになっていることに気付いた。
これを利用し、dts内の ar8327-initvals に必要なレジスタ値を取得。

シェルスクリプトで必要なレジスタ値をガッと取得

root@AP7403BD****98:/# for reg in 0x4 0x8 0xc 0x50 0x54 0x58 0x5c 0xe0 0xe4 0x7c 0x94; do echo r $reg > /proc/ar8xxx/reg; done
[ 2213.914058] Read command : subcmd=r
[ 2213.916526] Read command : regval=4
[ 2213.921180] reg 0x4=0x7600000
[ 2213.923242] Read command : subcmd=r
[ 2213.926616] Read command : regval=8
[ 2213.931271] reg 0x8=0x1000000
[ 2213.933395] Read command : subcmd=r
[ 2213.936707] Read command : regval=c
[ 2213.941362] reg 0xc=0x80
[ 2213.942986] Read command : subcmd=r
[ 2213.946360] Read command : regval=50
[ 2213.951109] reg 0x50=0xcc35cc35
[ 2213.953389] Read command : subcmd=r
[ 2213.956701] Read command : regval=54
[ 2213.961449] reg 0x54=0xca35ca35
[ 2213.963698] Read command : subcmd=r
[ 2213.967041] Read command : regval=58
[ 2213.971852] reg 0x58=0xc935c935
[ 2213.974133] Read command : subcmd=r
[ 2213.977444] Read command : regval=5c
[ 2213.982193] reg 0x5c=0x3ffff00
[ 2213.984411] Read command : subcmd=r
[ 2213.987847] Read command : regval=e0
[ 2213.992502] reg 0xe0=0xc74164de
[ 2213.994907] Read command : subcmd=r
[ 2213.998094] Read command : regval=e4
[ 2214.003030] reg 0xe4=0x6a545
[ 2214.004998] Read command : subcmd=r
[ 2214.008341] Read command : regval=7c
[ 2214.013152] reg 0x7c=0x7e
[ 2214.014932] Read command : subcmd=r
[ 2214.018244] Read command : regval=94
[ 2214.022992] reg 0x94=0x7e

WI-U3-866D on WXR-2533DHP

OpenWrtにRTL8812AUドライバが追加されていたので試しに。ただ、以前と変わらず不安定な印象。
WI-U3-866D固有の問題である可能性も無きにしも非ず。

接続

普通にUSB 3.0ポートへ接続。何故かUSB 2.0デバイスとして認識され、そのままUSB 3.0接続への切り替え等は発生しない。
iwinfo ではwlan2がWI-U3-866Dに該当。

root@OpenWrt:/# [   84.616036] usb 1-1: new high-speed USB device number 2 using xhci-hcd
[   85.267793] RTL871X: rtw_ndev_init(wlan2)

root@OpenWrt:/# iwinfo
wlan0     ESSID: unknown
          Access Point: 74:03:BD:BC:1D:9B
          Mode: Client  Channel: unknown (unknown)
          Tx-Power: 0 dBm  Link Quality: unknown/70
          Signal: unknown  Noise: unknown
          Bit Rate: unknown
          Encryption: unknown
          Type: nl80211  HW Mode(s): 802.11nac
          Hardware: 168C:0040 168C:0002 [Generic MAC80211]
          TX power offset: unknown
          Frequency offset: unknown
          Supports VAPs: yes  PHY name: phy0

wlan1     ESSID: unknown
          Access Point: 74:03:BD:BC:1D:9A
          Mode: Client  Channel: unknown (unknown)
          Tx-Power: 0 dBm  Link Quality: unknown/70
          Signal: unknown  Noise: unknown
          Bit Rate: unknown
          Encryption: unknown
          Type: nl80211  HW Mode(s): 802.11bgn
          Hardware: 168C:0040 168C:0002 [Generic MAC80211]
          TX power offset: unknown
          Frequency offset: unknown
          Supports VAPs: yes  PHY name: phy1

wlan2     ESSID: unknown
          Access Point: 74:03:BD:8F:DF:59
          Mode: Client  Channel: unknown (unknown)
          Tx-Power: 12 dBm  Link Quality: unknown/70
          Signal: unknown  Noise: unknown
          Bit Rate: unknown
          Encryption: unknown
          Type: nl80211  HW Mode(s): 802.11abg
          Hardware: unknown [Generic MAC80211]
          TX power offset: unknown
          Frequency offset: unknown
          Supports VAPs: no  PHY name: phy2

root@OpenWrt:/# lsusb
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 002: ID 0411:025d BUFFALO INC. (formerly MelCo., Inc.) 
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
root@OpenWrt:/# lsusb -t
/:  Bus 04.Port 1: Dev 1, Class=root_hub, Driver=xhci-hcd/1p, 5000M
/:  Bus 03.Port 1: Dev 1, Class=root_hub, Driver=xhci-hcd/1p, 480M
/:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci-hcd/1p, 5000M
/:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci-hcd/1p, 480M
    |__ Port 1: Dev 2, If 0, Class=Vendor Specific Class, Driver=rtl8812au, 480M

AP接続試行時

LuCI上からスキャン / 接続操作。何故か uninit が走る。この時点で iwinfoiw dev の情報からドングルが消える。

root@OpenWrt:/# [  200.594440] IPv6: ADDRCONF(NETDEV_UP): wlan2: link is not ready
[  250.955660] RTL871X: rtw_ndev_uninit(wlan2)

root@OpenWrt:/# iwinfo
wlan0     ESSID: unknown
          Access Point: 74:03:BD:BC:1D:9B
          Mode: Client  Channel: unknown (unknown)
          Tx-Power: 0 dBm  Link Quality: unknown/70
          Signal: unknown  Noise: unknown
          Bit Rate: unknown
          Encryption: unknown
          Type: nl80211  HW Mode(s): 802.11nac
          Hardware: 168C:0040 168C:0002 [Generic MAC80211]
          TX power offset: unknown
          Frequency offset: unknown
          Supports VAPs: yes  PHY name: phy0

wlan1     ESSID: unknown
          Access Point: 74:03:BD:BC:1D:9A
          Mode: Client  Channel: unknown (unknown)
          Tx-Power: 0 dBm  Link Quality: unknown/70
          Signal: unknown  Noise: unknown
          Bit Rate: unknown
          Encryption: unknown
          Type: nl80211  HW Mode(s): 802.11bgn
          Hardware: 168C:0040 168C:0002 [Generic MAC80211]
          TX power offset: unknown
          Frequency offset: unknown
          Supports VAPs: yes  PHY name: phy1

ドングル取り外し

上のスキャン / 接続操作の後ドングルをUSB 3.0ポートから引き抜く。Oopsを吐いた後、そのままKernel Panicを起こしてお亡くなりになり、reboot。

root@OpenWrt:/# [  304.981232] usb 1-1: USB disconnect, device number 2
[  304.981804] Internal error: Oops - undefined instruction: 0 [#1] SMP ARM
[  304.985272] Modules linked in: pppoe ppp_async ath10k_pci ath10k_core ath rtl8812au pppox ppp_generic nf_conntrack_ipv6 mac80211 iptable_nat ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_recent xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_helper xt_ecn xt_dscp xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_TCPMSS xt_REDIRECT xt_LOG xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CT xt_CLASSIFY ums_usbat ums_sddr55 ums_sddr09 ums_karma ums_jumpshot ums_isd200 ums_freecom ums_datafab ums_cypress ums_alauda slhc nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_conntrack_ipv4 nf_nat_ipv4 nf_nat nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack_netlink iptable_raw iptable_mangle
[  305.040299]  iptable_filter ipt_ECN ip_tables crc_ccitt compat fuse act_connmark nf_conntrack act_skbedit act_mirred em_u32 cls_u32 cls_tcindex cls_flow cls_route cls_fw sch_tbf sch_htb sch_hfsc sch_ingress ledtrig_usbport ledtrig_heartbeat xt_set ip_set_list_set ip_set_hash_netiface ip_set_hash_netport ip_set_hash_netnet ip_set_hash_net ip_set_hash_netportnet ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink ip6t_REJECT nf_reject_ipv6 nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables x_tables ifb ip6_tunnel tunnel6 vfat fat ntfs nls_utf8 nls_iso8859_1 nls_cp437 uas usb_storage leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_of_simple ohci_platform
[  305.111300]  ohci_hcd phy_qcom_dwc3 ahci ehci_platform sd_mod ahci_platform libahci_platform libahci libata scsi_mod ehci_hcd gpio_button_hotplug ext4 jbd2 mbcache crc32c_generic
[  305.133559] CPU: 0 PID: 17 Comm: kworker/0:1 Not tainted 4.14.89 #0
[  305.149420] Hardware name: Generic DT based system
[  305.155611] Workqueue: usb_hub_wq hub_event
[  305.160445] task: dd465900 task.stack: dd4ea000
[  305.164540] PC is at rollback_registered_many+0xc4/0x474
[  305.169044] LR is at rollback_registered_many+0x40/0x474
[  305.174594] pc : []    lr : []    psr: 20000013
[  305.179892] sp : dd4ebd58  ip : dd465900  fp : dc9e2200
[  305.185877] r10: c08b1eb4  r9 : 00000001  r8 : dd4ebd90
[  305.191086] r7 : dd4ebd68  r6 : dca45844  r5 : dca45800  r4 : dd4ebd4c
[  305.196298] r3 : 00000003  r2 : 00000000  r1 : 00000000  r0 : 00000001
[  305.202898] Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
[  305.209407] Control: 10c5787d  Table: 5c12806a  DAC: 00000051
[  305.216610] Process kworker/0:1 (pid: 17, stack limit = 0xdd4ea210)
[  305.222339] Stack: (0xdd4ebd58 to 0xdd4ec000)
[  305.228422] bd40:                                                       00000001 c079764c
[  305.232966] bd60: dd2fc850 dc33b3c0 dd4ebd68 dd4ebd68 dca45800 00000000 dca43000 dc9e2220
[  305.241127] bd80: 00000034 c0b5c648 dc9e2228 c068b194 dca45844 dca45844 dc33b3c0 dca45800
[  305.249285] bda0: dca43124 c068b208 e0ea1000 bf720628 00000000 bf72066c e0ea1000 dc9e2200
[  305.257444] bdc0: 00000000 bf721ad8 bf78799c db9e3c70 00000000 c06127e4 db9e3c00 ffffffed
[  305.265605] bde0: dc9e2220 dc9e2220 dc9e2254 bf78799c 00000000 00000034 c0b5c648 dc9e2228
[  305.273766] be00: db9e3c70 c058fd60 dd550f30 dc9e2220 c0b1d7c8 dc9e2278 c0b03c08 c058ecf0
[  305.281923] be20: 00008d84 dc9e2220 00000001 c058bacc dc9e2200 c03e4ff8 00000001 c0793bc4
[  305.290083] be40: dcca6400 dc9e3ae0 00000118 00040e59 dc9e2200 db9e3c00 00000000 00000001
[  305.298243] be60: dcea9000 dc9e2200 dcca6400 dc873904 00000100 c0611334 00000000 db9e3c00
[  305.306404] be80: dc9e3e00 db9e3ca4 db9e3c70 dcca6400 dc873904 c0609554 00000000 00000000
[  305.314563] bea0: 40000000 00000001 dc875800 00000001 00000001 dc873904 00000100 c060ad00
[  305.322722] bec0: dd4ebf0a 00000000 dc873800 dc873834 dcca6400 dc875800 dcca652c dc8758a4
[  305.330882] bee0: 00000001 dcea9000 dc873620 c0b1d690 00000000 c0b4ea14 dcca652c dd465900
[  305.339042] bf00: db5e7c00 00000000 00010100 dd465c70 dd4ebf4c dc873904 dd4c1580 ddc07500
[  305.347201] bf20: ddc0b300 00000000 00000000 00000008 ddc07500 c032fc14 ddc07518 ffffe000
[  305.355361] bf40: dd4c1580 ddc07500 dd4c1598 ddc07518 ffffe000 c0b02d00 00000008 c0330cc0
[  305.363521] bf60: dd44debc dd4dd000 dd4ea000 dd4c5340 dd44debc dd4dd01c dd4c1580 c033097c
[  305.371681] bf80: 00000000 c0335884 00000000 dd4c5340 c0335744 00000000 00000000 00000000
[  305.379841] bfa0: 00000000 00000000 00000000 c0307f48 00000000 00000000 00000000 00000000
[  305.388000] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  305.396160] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
[  305.404312] [] (rollback_registered_many) from [] (unregister_netdevice_queue+0x88/0xe0)
[  305.412466] [] (unregister_netdevice_queue) from [] (unregister_netdev+0x1c/0x2c)
[  305.422653] [] (unregister_netdev) from [] (rtw_unregister_netdev+0x2c/0x44 [rtl8812au])
[  305.431988] [] (rtw_unregister_netdev [rtl8812au]) from [] (rtw_unregister_netdevs+0x2c/0x4c [rtl8812au])
[  305.441797] [] (rtw_unregister_netdevs [rtl8812au]) from [] (rtw_dev_remove+0x24/0x84 [rtl8812au])
[  305.452786] [] (rtw_dev_remove [rtl8812au]) from [] (usb_unbind_interface+0x94/0x1dc)
[  305.463169] [] (usb_unbind_interface) from [] (device_release_driver_internal+0x128/0x1f0)
[  305.472797] [] (device_release_driver_internal) from [] (bus_remove_device+0xe0/0x118)
[  305.482689] [] (bus_remove_device) from [] (device_del+0x190/0x344)
[  305.492320] [] (device_del) from [] (usb_disable_device+0x88/0x1bc)
[  305.500223] [] (usb_disable_device) from [] (usb_disconnect+0x88/0x210)
[  305.508208] [] (usb_disconnect) from [] (hub_event+0xee4/0xf20)
[  305.516545] [] (hub_event) from [] (process_one_work+0x24c/0x404)
[  305.524180] [] (process_one_work) from [] (worker_thread+0x344/0x58c)
[  305.532172] [] (worker_thread) from [] (kthread+0x140/0x14c)
[  305.540332] [] (kthread) from [] (ret_from_fork+0x14/0x2c)
[  305.547802] Code: ea000003 e3530001 e5c59311 0a000000 (e7f001f2) 
[  305.554814] ---[ end trace 3133cf18efab4894 ]---
[  305.560968] Kernel panic - not syncing: Fatal exception
[  305.565672] CPU1: stopping
[  305.570611] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G      D         4.14.89 #0
[  305.573384] Hardware name: Generic DT based system
[  305.580629] [] (unwind_backtrace) from [] (show_stack+0x14/0x20)
[  305.585400] [] (show_stack) from [] (dump_stack+0x88/0x9c)
[  305.593286] [] (dump_stack) from [] (handle_IPI+0xf4/0x1a8)
[  305.600310] [] (handle_IPI) from [] (gic_handle_irq+0x9c/0xb8)
[  305.607514] [] (gic_handle_irq) from [] (__irq_svc+0x6c/0x90)
[  305.615140] Exception stack(0xdd461f80 to 0xdd461fc8)
[  305.622727] 1f80: 00000001 00000000 00000000 c0315300 ffffe000 c0b03c74 c0b03c28 00000000
[  305.627767] 1fa0: 00000000 512f04d0 00000000 00000000 dd461fc8 dd461fd0 c030884c c0308850
[  305.635897] 1fc0: 60000013 ffffffff
[  305.644057] [] (__irq_svc) from [] (arch_cpu_idle+0x38/0x44)
[  305.647366] [] (arch_cpu_idle) from [] (do_idle+0xe8/0x1bc)
[  305.654998] [] (do_idle) from [] (cpu_startup_entry+0x1c/0x20)
[  305.662025] [] (cpu_startup_entry) from [] (0x423017cc)
[  305.669669] Rebooting in 3 seconds..

LAN-W451NGR & OpenWrt

MACアドレスが独自フォーマットで格納されているなど、色々と厳しいのでupstream (openwrt/openwrt) へ投げるのはやめました。そのため、musashino-build/openwrtで持つだけになります。
以下OpenWrtインストール手順。

UARTを接続
LAN-W451NGRの筐体を開けてUART(シリアル)を接続。ピンは最初から立っていた。
並びは RJ-45ポート側から Vcc, TX, RX, GND。
U-Bootの環境変数を変更
ブートを中断してU-Bootのコンソールに入り、bootcmd の変更とMACアドレス設定の追加を行う。
bootcmdは以下の通り変更する。

set bootcmd "bootm 0x9f0a0010 || bootm 0x9f0a0000"


MACアドレスは筐体のラベルを参照し、以下の通りに変更する。

set wanaddr "MAC address"


例(MACアドレスが 00:aa:bb:cc:dd:ee の場合)

set wanaddr "00:aa:bb:cc:dd:ee"


最後に saveenv を実行して変更を保存。

initramfsファームでブート
192.168.1.50でTFTPサーバを実行して 0201A8C0.img にリネームしたinitramfsファームを用意し、コンソールで tftppboottftpでも可)を実行してinitramfsファームをTFTPサーバからダウンロード、bootm を実行してinitramfsファームによるブートを行う。
ブート後、mtdパーティションのバックアップを取っておくと良い。
sysupgrade
initramfsファーム上でsysupgradeファームを用いてsysupgrade、完了して再起動され、Flash内のOpenWrtファームウェアで起動する。

以上。

LAN-W451NGR

Atheros SoCを搭載しており、以前より気になっていた機種。最寄りのハードオフで ¥1,080 で置かれており、散々迷った挙句に確保。
発売時期に対してSoCが古く、RAMも少ないが折角なので進める。作業にあたってのメモ。

Switch

zone WAN LAN
port
(LAN-W451NGR)
WAN LAN1 LAN2 LAN3 LAN4
port
(AR8327)
port1 port2 port3 port4 port5

MAC

未確認

  • LAN: 34:95:DB:xx:xx:09
  • WAN: 34:95:DB:xx:xx:0F
  • 2.4G: 34:95:DB:xx:xx:0E

U-Boot

  • help
    ar7240> help
    autoscr - run script from memory
    ?       - alias for 'help'
    base    - print or set address offset
    bdinfo  - print Board Info structure
    boot    - boot default, i.e., run 'bootcmd'
    bootd   - boot default, i.e., run 'bootcmd'
    bootelf - Boot from an ELF image in memory
    bootm   - boot application image from memory
    bootp   - boot image via network using BootP/TFTP protocol
    bootvx  - Boot vxWorks from an ELF image
    cmp     - memory compare
    coninfo - print console devices and information
    cp      - memory copy
    crc32   - checksum calculation
    dhcp    - invoke DHCP client to obtain IP/boot params
    echo    - echo args to console
    erase   - erase FLASH memory
    ethreg    - Switch/PHY Reg rd/wr  utility
    exit    - exit script
    flinfo  - print FLASH memory information
    go      - start application at address 'addr'
    help    - print online help
    iminfo  - print header information for application image
    imls    - list all images found in flash
    itest   - return true/false on integer compare
    loadb   - load binary file over serial line (kermit mode)
    loads   - load S-Record file over serial line
    loady   - load binary file over serial line (ymodem mode)
    loop    - infinite loop on address range
    md      - memory display
    mii     - MII utility commands
    mm      - memory modify (auto-incrementing)
    mtest   - simple RAM test
    mw      - memory write (fill)
    nfs     - boot image via network using NFS protocol
    nm      - memory modify (constant address)
    pci     - list and access PCI Configuration Space
    ping    - send ICMP ECHO_REQUEST to network host
    pll [] - Set to change CPU/AHB/DDR speeds
    printenv- print environment variables
    progmac - Set ethernet MAC addresses
    protect - enable or disable FLASH write protection
    rarpboot- boot image via network using RARP/TFTP protocol
    reset   - Perform RESET of the CPU
    run     - run commands in an environment variable
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    sleep   - delay execution for some time
    test    - minimal test like /bin/sh
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    
  • version
    ar7240> version
    
    U-Boot 1.1.4 (Aug 29 2012 - 11:46:03)
    
  • printenv
    ar7240> printenv
    baudrate=115200
    ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
    ipaddr=192.168.1.2
    ethact=eth0
    bootcmd=bootm 0x9f0a0010
    bootargs=console=ttyS0,115200 root=1f02 rw rootfstype=jffs2 noinitrd mtdparts=ar7240-nor0:320k(u-boot)ro,3712k(web-cfg-linux),4032k(rootfs),64k(NVRAM),64k(ART)
    serverip=192.168.1.50
    bootdelay=2
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 345/65532 bytes
    
  • mii device
    ar7240> mii device
    MII devices: 'eth0' 'eth1' 
    Current device: 'eth0'
    
  • md.l 0x1805002c 1
    tftpboot前(恐らくpll_100)

    ar7240> md.l 0x1805002c 1
    1805002c: 00000101    ....
    

    tftpboot後(恐らくpll_1000)

    ar7240> md.l 0x1805002c 1
    1805002c: 1c000000    ....
    

Kernel

  • uname -a
    # uname -a
    Linux rlx-linux 2.6.31--LSDK-9.2.0_U10.5.13 #83 Thu Jan 31 19:33:31 CST 2013 mips GNU/Linux
    
  • cat /proc/version
    # cat /proc/version
    Linux version 2.6.31--LSDK-9.2.0_U10.5.13 (netronix@netronix-U46SV) (gcc version 4.5.2 (Linaro GCC 4.5-2011.02-0) ) #83 Thu Jan 31 19:33:31 CST 2013
    
  • cat /proc/cpuinfo
    実際にはAR7242

    # cat /proc/cpuinfo
    system type             : Atheros AR7240 (Python)
    processor               : 0
    cpu model               : MIPS 24Kc V7.4
    BogoMIPS                : 266.24
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 16
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
    ASEs implemented        : mips16
    shadow register sets    : 1
    core                    : 0
    VCED exceptions         : not available
    VCEI exceptions         : not available
    
  • cat /proc/meminfo
    # cat /proc/meminfo
    MemTotal:          29740 kB
    MemFree:           16680 kB
    Buffers:               0 kB
    Cached:             2724 kB
    SwapCached:            0 kB
    Active:             1320 kB
    Inactive:           2100 kB
    Active(anon):        720 kB
    Inactive(anon):        0 kB
    Active(file):        600 kB
    Inactive(file):     2100 kB
    Unevictable:           0 kB
    Mlocked:               0 kB
    SwapTotal:             0 kB
    SwapFree:              0 kB
    Dirty:                 0 kB
    Writeback:             0 kB
    AnonPages:           740 kB
    Mapped:              688 kB
    Slab:               7220 kB
    SReclaimable:        184 kB
    SUnreclaim:         7036 kB
    PageTables:          120 kB
    NFS_Unstable:          0 kB
    Bounce:                0 kB
    WritebackTmp:          0 kB
    CommitLimit:       14868 kB
    Committed_AS:       2036 kB
    VmallocTotal:    1048404 kB
    VmallocUsed:        2024 kB
    VmallocChunk:    1043032 kB
    
  • cat /proc/mtd
    # cat /proc/mtd
    dev:    size   erasesize  name
    mtd0: 00050000 00010000 "u-boot"
    mtd1: 003a0000 00010000 "web-cfg-linux"
    mtd2: 003f0000 00010000 "rootfs"
    mtd3: 00010000 00010000 "NVRAM"
    mtd4: 00010000 00010000 "ART"
    
  • ethreg
    # ethreg 0x4
    Read Reg: 0x00000004 = 0x07600000
    # ethreg 0xc
    Read Reg: 0x0000000c = 0x01000000
    # ethreg 0x50
    Read Reg: 0x00000050 = 0xffb7ffb7
    # ethreg 0x54
    Read Reg: 0x00000054 = 0xffb7ffb7
    # ethreg 0x58
    Read Reg: 0x00000058 = 0xffb7ffb7
    # ethreg 0x5c
    Read Reg: 0x0000005c = 0x03ffff00
    # ethreg 0x7c
    Read Reg: 0x0000007c = 0x0000007e
    # ethreg 0x94
    Read Reg: 0x00000094 = 0x00001080
    
  • bootlog
    U-Boot 1.1.4 (Aug 29 2012 - 11:46:03)
    
    AP111 (ar7241 - Virian) U-boot
    DRAM:  
    sri
    ar7240_ddr_initial_config(133): virian ddr1 init
    #### TAP VALUE 1 = 0x2, 2 = 0x2 [0x7061636b: 0x61676520]
    32 MB
    Top of RAM usable for U-Boot at: 82000000
    Reserving 224k for U-Boot at: 81fc4000
    Reserving 192k for malloc() at: 81f94000
    Reserving 44 Bytes for Board Info at: 81f93fd4
    Reserving 36 Bytes for Global Data at: 81f93fb0
    Reserving 128k for boot params() at: 81f73fb0
    Stack Pointer at: 81f73f98
    Now running in RAM - U-Boot at: 81fc4000
    Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x17
    sector count = 128
    Flash:  8 MB
    In:    serial
    Out:   serial
    Err:   serial
    Net:   ag7240_enet_initialize...
    No valid address in Flash. Using fixed address
    No valid address in Flash. Using fixed address
     wasp  reset mask:c03300 
    Virian MDC CFG Value ==> 4
    : cfg1 0xf cfg2 0x7114
    eth0: 00:03:7f:09:0b:ad
    athrs17_reg_init: complete
    eth0 up
    Virian MDC CFG Value ==> 4
    : cfg1 0xf cfg2 0x7214
    eth1: 00:03:7f:09:0b:ad
    eth1 up
    eth0, eth1
    Hit any key to stop autoboot:  0 
    ## Booting image at 9f0a0010 ...
       Image Name:   Linux Kernel Image
       Created:      2013-02-19   1:31:53 UTC
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    1011308 Bytes = 987.6 kB
       Load Address: 80002000
       Entry Point:  802040c0
       Verifying Checksum at 0x9f0a0050 ...OK
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 802040c0) ...
    ## Giving linux memsize in bytes, 33554432
    
    Starting kernel ...
    
    Booting AR7240(Python)...
    Linux version 2.6.31--LSDK-9.2.0_U10.5.13 (netronix@netronix-U46SV) (gcc version 4.5.2 (Linaro GCC 4.5-2011.02-0) ) #83 Thu Jan 31 19:33:31 CST 2013
    flash_size passed from bootloader = 8
    arg 1: console=ttyS0,115200
    arg 2: root=1f02
    arg 3: rw
    arg 4: rootfstype=jffs2
    arg 5: noinitrd
    arg 6: mtdparts=ar7240-nor0:320k(u-boot)ro,3712k(web-cfg-linux),4032k(rootfs),64k(NVRAM),64k(ART)
    arg 7: mem=32M
    CPU revision is: 00019374 (MIPS 24Kc)
    Determined physical RAM map:
     memory: 02000000 @ 00000000 (usable)
    User-defined physical RAM map:
     memory: 02000000 @ 00000000 (usable)
    Zone PFN ranges:
      Normal   0x00000000 -> 0x00002000
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
        0: 0x00000000 -> 0x00002000
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
    Kernel command line: console=ttyS0,115200 root=1f02 rw rootfstype=jffs2 noinitrd mtdparts=ar7240-nor0:320k(u-boot)ro,3712k(web-cfg-linux),4032k(rootfs),64k(NVRAM),64k(ART) mem=32M 
    PID hash table entries: 128 (order: 7, 512 bytes)
    Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
    Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
    Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
    Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
    Writing ErrCtl register=00000000
    Readback ErrCtl register=00000000
    Memory: 29608k/32768k available (2073k kernel code, 3160k reserved, 567k data, 132k init, 0k highmem)
    NR_IRQS:128
    plat_time_init: plat time init done - ar7240_cpu_freq=400000000 
    Calibrating delay loop... 266.24 BogoMIPS (lpj=532480) HZ=250
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    ===== ar7240_platform_init: 0
    PCI init:ar7240_pcibios_init
    ar7240_pcibios_init(305): PCI CMD write: 0x356
    registering PCI controller with io_map_base unset
    bio: create slab  at 0
    SCSI subsystem initialized
    pci 0000:00:00.0: PME# supported from D0 D1 D3hot
    pci 0000:00:00.0: PME# disabled
    Returning IRQ 48
    NET: Registered protocol family 2
    IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    TCP established hash table entries: 1024 (order: 1, 8192 bytes)
    TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
    TCP: Hash tables configured (established 1024 bind 1024)
    TCP reno registered
    NET: Registered protocol family 1
    AR7240 GPIOC major 0
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    JFFS2 version 2.2 (NAND) (ZLIB) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
    msgmni has been set to 57
    alg: No test for lzma (lzma-generic)
    alg: No test for stdrng (krng)
    io scheduler noop registered
    io scheduler deadline registered (default)
    Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
    serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
    console [ttyS0] enabled
    brd: module loaded
    PPP generic driver version 2.4.2
    PPP MPPE Compression module registered
    NET: Registered protocol family 24
    5 cmdlinepart partitions found on MTD device ar7240-nor0
    Creating 5 MTD partitions on "ar7240-nor0":
    0x000000000000-0x000000050000 : "u-boot"
    0x000000050000-0x0000003f0000 : "web-cfg-linux"
    0x0000003f0000-0x0000007e0000 : "rootfs"
    0x0000007e0000-0x0000007f0000 : "NVRAM"
    0x0000007f0000-0x000000800000 : "ART"
    nf_conntrack version 0.5.0 (512 buckets, 2048 max)
    nf_conntrack_l2tp version 3.1 loaded
    nf_conntrack_rtsp v0.6.21 loading
    nf_conntrack_ipsec loaded
    nf_nat_ipsec loaded
    nf_nat_rtsp v0.6.21 loading
    ip_tables: (C) 2000-2006 Netfilter Core Team
    TCP cubic registered
    NET: Registered protocol family 17
    802.1Q VLAN Support v1.8 Ben Greear 
    All bugs added by David S. Miller 
    arch/mips/ar7240/gpio.c (ar7240_simple_config_init) JUMPSTART_GPIO: 1
    
    ar7240: simple_config callback..sc 1, irq 0, ignorepb 0, jiffies 4294892466
    
    ar7240: calling simple_config callback.. push dur in sec 0
    
    ar7240: simple_config callback..sc 1, irq 0, ignorepb 1, jiffies 4294892470
    ar7240wdt_init: Registering WDT success
    VFS: Mounted root (jffs2 filesystem) on device 31:2.
    Freeing unused kernel memory: 132k freed
    slide mode is 1
    ATHR_GMAC: Length per segment 1536
    ATHR_GMAC: fifo cfg 3 01f00140
    ATHR_GMAC: Mac address for unit 0:bfff0000
    ATHR_GMAC: ff:ff:ff:ff:ff:ff 
    ATHR_GMAC: Max segments per packet :   1
    ATHR_GMAC: Max tx descriptor count :   40
    ATHR_GMAC: Max rx descriptor count :   252
    ATHR_GMAC: Mac capability flags    :   4381
    athr_gmac_ring_alloc Allocated 640 at 0x81ed0400
    athr_gmac_ring_alloc Allocated 4032 at 0x81d79000
    Virian MDC CFG Value ==> 4
    Setting Drop CRC Errors, Pause Frames and Length Error frames 
    athrs17_reg_init:done
    Setting PHY...
    Phy setup Complete
    [az] 802.3az init done.. 
    [az] 802.3az init done.. 
    [az] 802.3az init done.. 
    [az] 802.3az init done.. 
    [az] 802.3az init done.. 
    Write Reg: 0x00000624: Oldval = 0x003f3f3f Newval = 0x007f7f7f
    Write Reg: 0x00000010: Oldval = 0x40000000 Newval = 0x40000000
    Write Reg: 0x00000004: Oldval = 0x07500000 Newval = 0x07600000
    Write Reg: 0x0000000c: Oldval = 0x01000000 Newval = 0x01000000
    Write Reg: 0x0000007c: Oldval = 0x000000fe Newval = 0x0000007e
    Write Reg: 0x00000420: Oldval = 0x00010001 Newval = 0x00010001
    Write Reg: 0x00000430: Oldval = 0x00010001 Newval = 0x00010001
    Write Reg: 0x00000438: Oldval = 0x00010001 Newval = 0x00010001
    Write Reg: 0x00000440: Oldval = 0x00010001 Newval = 0x00010001
    Write Reg: 0x00000448: Oldval = 0x00010001 Newval = 0x00010001
    Write Reg: 0x00000428: Oldval = 0x00010001 Newval = 0x00020001
    Write Reg: 0x00000424: Oldval = 0x00003040 Newval = 0x00002040
    Write Reg: 0x0000042c: Oldval = 0x00003040 Newval = 0x00001040
    Write Reg: 0x00000434: Oldval = 0x00003040 Newval = 0x00001040
    Write Reg: 0x0000043c: Oldval = 0x00003040 Newval = 0x00001040
    Write Reg: 0x00000444: Oldval = 0x00003040 Newval = 0x00001040
    Write Reg: 0x0000044c: Oldval = 0x00003040 Newval = 0x00001040
    Write Reg: 0x00000620: Oldval = 0x000000f0 Newval = 0x000004f0
    Write Reg: 0x00000660: Oldval = 0x0014007e Newval = 0x0014017e
    Write Reg: 0x0000066c: Oldval = 0x0014007d Newval = 0x0014017d
    Write Reg: 0x00000678: Oldval = 0x0014007b Newval = 0x0014017b
    Write Reg: 0x00000684: Oldval = 0x00140077 Newval = 0x00140177
    Write Reg: 0x00000690: Oldval = 0x0014006f Newval = 0x0014016f
    Write Reg: 0x0000069c: Oldval = 0x0014005f Newval = 0x0014015f
    Write Reg: 0x00000610: Oldval = 0x00000000 Newval = 0x001b55e0
    Write Reg: 0x00000614: Oldval = 0x00000000 Newval = 0x80010002
    Write Reg: 0x00000610: Oldval = 0x00000000 Newval = 0x001bff60
    Write Reg: 0x00000614: Oldval = 0x00000002 Newval = 0x80020002
    ifconfig: ioctl 0x8913 failed: No such device
    bridge br0 doesn't exist; can't delete it
    Init Start...
    !!!!!!!!!!!! [1] !!!!!!!!!!!!!!
    open /proc/br_igmpProxy: No such file or directory
    open /proc/sw_nat: No such file or directory
    The macbuf is flash set DEF_WLAN0_SSID logitec-0a040f  
    
    Enet:0 port1 up
    ATH_MAC_TIMER: enet unit:0 is up...
    RGMii 1000Mbps full duplex
    ATH_MAC_TIMER: done cfg2 0x7215 ifctl 0x0 miictrl  
    The macbuf is flash set DEF_WLAN0_VAP0_SSID logitec2nd-0a040f  
    Init bridge interface...
    device eth0.1 entered promiscuous mode
    device eth0 entered promiscuous mode
    br0: port 1(eth0.1) entering forwarding state
    open /proc/gpio: No such file or directory
    0
    Disable
    ath0      no private ioctls.
    
    ath1      no private ioctls.
    
    ath2      no private ioctls.
    
    ath3      no private ioctls.
    
    ===================== 0 =============== 
    wifi0     no private ioctls.
    
    device eth1 entered promiscuous mode
    br0: port 2(eth1) entering forwarding state
    Write Reg: 0x00000030: Oldval = 0x80000300 Newval = 0x80000300
    killall: pppoe-relay: no process killed
    open /proc/custom_Passthru: No such file or directory
    open /proc/custom_Passthru_wlan: No such file or directory
    open /proc/br_igmpVersion: No such file or directory
    open /proc/br_igmpsnoop: No such file or directory
    open /proc/br_igmpquery: No such file or directory
    **** drop_caches_sysctl_handler: all done timer added ...**** 
    ln: /usr/www/ath_www: File exists
    +makeVAP ap logitec-0a040f 0:RF:11ng:11NGHT40 200 1
    0
    lo        no wireless extensions.
    
    eth0      no wireless extensions.
    
    eth0.1    no wireless extensions.
    
    eth1      no wireless extensions.
    
    br0       no wireless extensions.
    
    Args: 1
    asf: module license 'Proprietary' taints kernel.
    Disabling lock debugging due to kernel taint
    ath_hal: 0.9.17.1 (AR5416, AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
    ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
    insmod: ath_spectral.ko: module not found
    insmod: ath_dfs.ko: module not found
    insmod: hst_tx99.ko: module not found
    ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
    ath_pci: 9.2.0_U11.14 (Atheros/multi-bss)
    This is CAL_IN_FLASH_PCI__ath_attach: Set global_scn[0]
    ACBKMinfree = 48
    ACBEMinfree = 32
    ACVIMinfree = 16
    ACVOMinfree = 0
    CABMinfree = 48
    UAPSDMinfree = 0
    ar9300RadioAttach: Need analog access recipe!!
    Restoring Cal data from Flash
    Using Cal data from Flash 0xbf7f0000
    ath_get_caps[5184] rx chainmask mismatch actual 7 sc_chainmak 0
    ath_get_caps[5159] tx chainmask mismatch actual 7 sc_chainmak 0
    SC Callback Registration for wifi0
    wifi0: Atheros 9380: mem=0x10000000, irq=48 hw_base=0xb0000000
    wifi1     no private ioctls.
    
    Creating ap for logitec-0a040f on
    wlanconfig ath0 create wlandev wifi0 wlanmode ap
    wlan_vap_create : enter. devhandle=0x816082c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
    wlan_vap_create : exit. devhandle=0x816082c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
    Added ath0 mode master
    Configuring RF . . .
    Error for wireless request "Set Tx Power" (8B26) :
        SET failed on device wifi0 ; Invalid argument.
     ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 
    Invalid command : setVowExt
    Invalid command : setKeySrchAlways
    Invalid command : set_vsp_enable
    Interface doesn't accept private ioctl...
    setPhyRestartWar (8BE0): Operation not permitted
    Invalid command : setVowExtStats
    WARNING: Fragmentation with HT mode NOT ALLOWED!!
    Created ath0 mode ap for logitec-0a040f
    +makeVAP ap logitec2nd-0a040f 0::11ng:11NGHT40 300 2
    0
    lo        no wireless extensions.
    
    eth0      no wireless extensions.
    
    eth0.1    no wireless extensions.
    
    eth1      no wireless extensions.
    
    br0       no wireless extensions.
    
    wifi0     no wireless extensions.
    
    Modules already loaded
    Creating ap for logitec2nd-0a040f on
    wlanconfig ath1 create wlandev wifi0 wlanmode ap
    Added ath1 mode master
    Non RF Configuration . . .
     ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 
    Invalid command : setVowExt
    Invalid command : setKeySrchAlways
    Invalid command : set_vsp_enable
    Interface doesn't accept private ioctl...
    setPhyRestartWar (8BE0): Operation not permitted
    Invalid command : setVowExtStats
    WARNING: Fragmentation with HT mode NOT ALLOWED!!
    Created ath1 mode ap for logitec2nd-0a040f
      activateVAP ath0 br0 WPA PSK 2 
    >>>2
    ************1**************************AP_CYPHER2
    lo        no wireless extensions.
    
    eth0      no wireless extensions.
    
    eth0.1    no wireless extensions.
    
    eth1      no wireless extensions.
    
    br0       no wireless extensions.
    
    wifi0     no wireless extensions.
    
    device br0 already exists; can't create bridge with the same name
    device ath0 entered promiscuous mode
    br0: port 3(ath0) entering forwarding state
    /etc/ath/activateVAP: line 209: arping: not found
    >>>>> WPS MODE, 2
    >>>>> WPS ENABLED, PSK
    The command noackpolicy needs exactly 3 argument(s)...
    The command noackpolicy needs exactly 3 argument(s)...
    The command noackpolicy needs exactly 3 argument(s)...
    The command noackpolicy needs exactly 3 argument(s)...
    Create DHCP and multi bridge...
      activateVAP ath1 br0 WEP PSK 0 
    >>>0
    sh: 1: unknown operand
    sh: 2: unknown operand
    sh: 3: unknown operand
    lo        no wireless extensions.
    
    eth0      no wireless extensions.
    
    eth0.1    no wireless extensions.
    
    eth1      no wireless extensions.
    
    br0       no wireless extensions.
    
    wifi0     no wireless extensions.
    
    device br0 already exists; can't create bridge with the same name
    device ath1 entered promiscuous mode
    br0: port 4(ath1) entering forwarding state
    /etc/ath/activateVAP: line 209: arping: not found
    >>>>> WPS MODE, 0
    The command noackpolicy needs exactly 3 argument(s)...
    The command noackpolicy needs exactly 3 argument(s)...
    The command noackpolicy needs exactly 3 argument(s)...
    The command noackpolicy needs exactly 3 argument(s)...
    Create DHCP and multi bridge...
    CHH: System Configuration
    AP_MODE:=ap
    AP_MODE_2:=ap
    AP_MODE_3:=ap
    AP_MODE_4:=ap
    AP_IPADDR:=192.168.1.2
    AP_NETMASK:=255.255.255.0
    WAN_MODE:=bridged
    WAN_IPADDR:=192.168.2.1
    WAN_NETMASK:=255.255.255.0
    WAN_IF:=eth0
    LAN_IF:=eth0
    WLAN_ON_BOOT:=y
    AP_STARTMODE:=multi
    AP_PRIMARY_CH:=11ng
    AP_CHMODE:=11NGHT40
    PUREG:=0
    PUREN:=0
    TXQUEUELEN:=1000
    SHORTGI:=1
    AMPDUENABLE:=1
    AMPDUFRAMES:=32
    AMPDULIMIT:=50000
    AMPDUMIN:=32768
    CWMMODE:=1
    RATECTL:=auto
    MANRATE:=0x8c8c8c8c
    MANRETRIES:=0x04040404
    RX_CHAINMASK:=7
    TX_CHAINMASK:=7
    LED_CUSTOM:=3
    COEXTENABLE:=0
    AP_SSID:=logitec-0a040f
    AP_SSID_2:=logitec2nd-0a040f
    ATH_countrycode:=392
    AP_MODE_5:=ap
    AP_MODE_6:=ap
    AP_MODE_7:=ap
    AP_MODE_8:=ap
    AP_SECMODE:=WPA
    AP_SECMODE_2:=WEP
    AP_SECMODE_3:=None
    AP_SECMODE_4:=None
    AP_SECMODE_5:=None
    AP_SECMODE_6:=None
    AP_SECMODE_7:=None
    AP_SECMODE_8:=None
    AP_SECFILE:=PSK
    AP_SECFILE_2:=PSK
    AP_SECFILE_3:=PSK
    AP_SECFILE_4:=PSK
    AP_SECFILE_5:=PSK
    AP_SECFILE_6:=PSK
    AP_SECFILE_7:=PSK
    AP_SECFILE_8:=PSK
    WPS_ENABLE:=2
    WPS_ENABLE_2:=0
    WPS_ENABLE_3:=0
    WPS_ENABLE_4:=0
    WPS_ENABLE_5:=0
    WPS_ENABLE_6:=0
    WPS_ENABLE_7:=0
    WPS_ENABLE_8:=0
    BEACON_INT:=100
    FRAG_THRESHOLD:=2346
    RTS_THRESHOLD:=2347
    PREAMBLE:=0
    RFPower:=100
    WE ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 
    PLEN:=2
    WEPLEN_ Scan in progress.. Cancelling it 
    2:=2
    WEPLEN_3:=2
    WEPLEN_4:=2
    WEPFORMAT:=1
    WEPFORMAT_2:=1
    WEPFORMAT_3:=1
    WEPFORMAT_4:=1
    AP_WEP_MODE:=1
    AP_WEP_MODE_2:=1
    AP_WEP_MODE_3:=1
    AP_WEP_MODE_4:=1
    AP_WPA:=2
    AP_WPA_2:=1
    AP_WPA_3:=1
    AP_WPA_4:=1
    AP_ENCRYPT:=2
    AP_CYPHER:=br0: port 3(ath0) entering disabled state
    CCMP
    WLAN_DISAB DEVICE IS DOWN ifname=ath0
    LED:=0
    WLAN_DIS DEVICE IS DOWN ifname=ath0
    ABLED_2:=0
    WLAN_DISABLED_3:=1
    WLAN_DISABLED_4:=1
    HIDDEN_SSID:=0
    HIDDEN_SSID_2:=0
    HIDDEN_SSID_3:=0
    HIDDEN_SSID_4:=0
    WLAN_WMM:=1
    WLAN_WMM_2:=1
    WLAN_WMM_3:=1
    WLAN_WMM_4:=1
    WLAN_DHCP:=0
    WLAN_DHCP_2:=0
    WLAN_DHCP_3:=0
    WLAN_DHCP_4:=0
    TX_RATE:=0
    TX_RATE_2:=0
    TX_RATE_3:=0
    TX_RATE_4:=0
    WLAN_PRIVATE_SEPARATE:=1
    WLAN_PRIVATE_SEPARATE_2:=1
    WLAN_PRIVATE_SEPARATE_3:=1
    WLAN_PRIVATE_SEPARATE_4:=1
    WLAN_SSID_SEPARATE:=1
    WLAN_SSID_SEPARATE_2:=1
    WLAN_SSID_SEPARATE_3:=1
    WLAN_SSID_SEPARATE_4:=1
    ACCESS_CONTROL_WEB:=1
    ACCESS_CONTROL_WEB_2:=1
    ACCESS_CONTROL_WEB_3:=1
    ACCESS_CONTROL_WEB_4:=1
    enablePIN:=1
    pskFormat:=0
    pskFormat_2:=0
    pskFormat_3:=0
    pskFormat_4:=0
    SLIDEMODE_TYPE:=1
    PSK_KEY:=9052797528282
    WSC_PIN:=90527975
    AP_PRIMARY_KEY:=2
    WEPKEY_1:=9052797528282
    WEPKEY_2:=9052797528282
    WEPKEY_3:=9052797528282
    WEPKEY_4:=9052797528282
    Add randomness: count=1 entropy=0
    random pool - hexdump(len=128): [REMOVED]
    random_mix_pool - hexdump(len=8): [REMOVED]
    random_mix_pool - hexdump(len=20): [REMOVED]
    random pool - hexdump(len=128): [REMOVED]
    random: Added entropy from /etc/wpa2/entropy (own_pool_ready=2)
    random: Trying to read entropy from /dev/random
    Get randomness: len=20 entropy=1
    random from os_get_random - hexdump(len=20): [REMOVED]
    random_mix_pool - hexdump(len=20): [REMOVED]
    random from internal pool - hexdump(len=16): [REMOVED]
    random_mix_pool - hexdump(len=20): [REMOVED]
    random from internal pool - hexdump(len=16): [REMOVED]
    mixed random - hexdump(len=20): [REMOVED]
    random: Updated entropy file /etc/wpa2/entropy (own_pool_ready=2)
    Configuration file: /etc/wpa2/WSC_ath0.conf
    Configure bridge br0 for EAPOL traffic.
    atheros_set_privacy: enabled=0
    atheros_receive_pkt Enter
    SIOCGIWRANGE: WE(compiled)=22 WE(source)=13 enc_capa=0xf
    BSS count 1, BSSID mask 00:00:00:00:00:00 (0 bits)
    Completing interface initialization
    Flushing old station entries
    atheros_sta_deauth: addr=ff:ff:ff:ff:ff:ff reason_code=3
    atheros: set80211priv: ath0: ioctl op=0x8be6 (SETMLME) len=42 failed: 22 (Invalid argument)
    atheros_sta_deauth: Failed to deauth STA (addr ff:ff:ff:ff:ff:ff reason 3)
    Could not connect to kernel driver.
    Deauthenticate all stations
    atheros_sta_deauth: addr=ff:ff:ff:ff:ff:ff reason_code=2
    atheros: set80211priv: ath0: ioctl op=0x8be6 (SETMLME) len=42 failed: 22 (Invalid argument)
    atheros_sta_deauth: Failed to deauth STA (addr ff:ff:ff:ff:ff:ff reason 2)
    atheros_set_privacy: enabled=0
    atheros_del_key: addr=00:00:00:00:00:00 key_idx=0
    atheros_del_key: addr=00:00:00:00:00:00 key_idx=1
    atheros_del_key: addr=00:00:00:00:00:00 key_idx=2
    atheros_del_key: addr=00:00:00:00:00:00 key_idx=3
    Using interface ath0 with hwaddr 34:95:db:0a:04:0e and ssid 'logitec-0a040f'
    Deriving WPA PSK based on passphrase
    SSID - hexdump_ascii(len=14):
         6c 6f 67 69 74 65 63 2d 30 61 30 34 30 66         logitec-0a040f  
    PSK (ASCII passphrase) - hexdump_ascii(len=13): [REMOVED]
    PSK (from passphrase) - hexdump(len=32): [REMOVED]
    WPS: UUID based on MAC address - hexdump(len=16): bc 90 be 5br0: port 3(ath0) entering forwarding state
    7 1f de 57 01 b2 a8 b8 86 78 c3 de 97
    WPS: Build Beacon IEs
    WPS:  * Version (hardcoded 0x10)
    WPS:  * Wi-Fi Protected Setup State (2)
    WPS:  * Version2 (0x20)
    WPS: Build Probe Response IEs
    WPS:  * Version (hardcoded 0x10)
    WPS:  * Wi-Fi Protected Setup State (2)
    WPS:  * Response Type (3)
    WPS:  * UUID-E
    WPS:  * Manufacturer
    WPS:  * Model Name
    WPS:  * Model Number
    WPS:  * Serial Number
    WPS:  * Primary Device Type
    WPS:  * Device Name
    WPS:  * Config Methods (2688)
    WPS:  * RF Bands (1)
    WPS:  * Version2 (0x20)
    WPS: Building WPS IE for (Re)Association Response
    WPS:  * Version (hardcoded 0x10)
    WPS:  * Response Type (3)
    WPS:  * Version2 (0x20)
    atheros_set_wps_ie buflen = 26
    atheros_set_wps_ie buflen = 26
    atheros_set_wps_ie buflen = 157
    WPS: David add
    hapd->wps=47de68
    atheros_set_ieee8021x: enabled=1
    atheros_configure_wpa: group key cipher=3
    atheros_configure_wpa: pairwise key ciphers=0x8
    atheros_configure_wpa: key management algorithms=0x2
    atheros_configure_wpa: rsn capabilities=0x0
    atheros_configure_wpa: enable WPA=0x2
    random: Got 20/20 bytes from /dev/random
    Get randomness: len=20 entropy=0
    random from os_get_random - hexdump(len=20): [REMOVED]
    random_mix_pool - hexdump(len=20): [REMOVED]
    random from internal pool - hexdump(len=16): [REMOVED]
    random_mix_pool - hexdump(len=20): [REMOVED]
    random from internal pool - hexdump(len=16): [REMOVED]
    mixed random - hexdump(len=20): [REMOVED]
    random: Updated entropy file /etc/wpa2/entropy (own_pool_ready=2)
    Get randomness: len=32 entropy=0
    random from os_get_random - hexdump(len=32): [REMOVED]
    random_mix_pool - hexdump(len=20): [REMOVED]
    random from internal pool - hexdump(len=16): [REMOVED]
    random_mix_pool - hexdump(len=20): [REMOVED]
    random from internal pool - hexdump(len=16): [REMOVED]
    mixed random - hexdump(len=32): [REMOVED]
    GMK - hexdump(len=32): [REMOVED]
    Get randomness: len=32 entropy=0
    random from os_get_random - hexdump(len=32): [REMOVED]
    random_mix_pool - hexdump(len=20): [REMOVED]
    random from internal pool - hexdump(len=16): [REMOVED]
    random_mix_pool - hexdump(len=20): [REMOVED]
    random from internal pool - hexdump(len=16): [REMOVED]
    mixed random - hexdump(len=32): [REMOVED]
    Key Counter - hexdump(len=32): [REMOVED]
    WPA: group state machine entering state GTK_INIT (VLAN-ID 0)
    Get randomness: len=16 entropy=0
    random from os_get_random - hexdump(len=16): [REMOVED]
    random_mix_pool - hexdump(len=20): [REMOVED]
    random from internal pool - hexdump(len=16): [REMOVED]
    mixed random - hexdump(len=16): [REMOVED]
    GTK - hexdump(len=16): [REMOVED]
    WPA: group state machine entering state SETKEYSDONE (VLAN-ID 0)
    atheros_set_key: alg=3 addr=ff:ff:ff:ff:ff:ff key_idx=1
    atheros_set_privacy: enabled=1
    atheros_set_opt_ie buflen = 22
    WPS UPnP: Init interface instance 0x47e4b8
    WPS UPnP: Initialize device context
    HTTP: Started server on 192.168.2.1:49152
    ath0: Setup of interface done.
    sh: bad number
    iwpriv ath0 disablecoext 0
    # 128+0 records in
    128+0 records out
    boa: server version Boa/0.94.14rc21
    boa: server built Feb 19 2013 at 09:30:09.
    boa: starting server pid=1875, port 80
    

WXR-2533DHP stock -> OpenWrt (2)

以前のstock -> OpenWrt化の記事を書いた時点から、内部的な挙動を変更したのでメモ。

WXR-2533DHPのデフォルトパッケージとして squashfs-tools-mksquashfs を持たせて mksquashfs コマンドを使用できるようにし、WXR-2533DHPのブートに必要なダミーのUBIボリュームをsysupgrade時に作成するようにした。
これにより、factoryを投入後UBIのイメージを使用して sysupgrade -F する必要が無くなり、squashfs-sysupgrade イメージでsysupgradeするのみで良くなった。

Bootlog

stock → OpenWrt (initramfs) → OpenWrt (squashfs)
ハイライトは入力個所

Killed
Monitor.sh starting.......
Start of fw_blink_cnt.sh -------------------------------------------------
End of fw_blink_cnt.sh -------------------------------------------------
do ubi firmware upgrade ...
[  416.083692] UBI: attaching mtd1 to ubi1
[  416.086504] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[  416.093095] UBI: logical eraseblock size:    126976 bytes
[  416.098125] UBI: smallest flash I/O unit:    2048
[  416.103124] UBI: VID header offset:          2048 (aligned 2048)
[  416.108809] UBI: data offset:                4096
[  416.668822] UBI: empty MTD device detected
[  416.672133] UBI: max. sequence number:       0
[  416.676382] UBI: create volume table (copy #1)
[  416.693252] UBI: create volume table (copy #2)
[  416.710059] UBI: attached mtd1 to ubi1
[  416.712808] UBI: MTD device name:            "rootfs_1"
[  416.717994] UBI: MTD device size:            64 MiB
[  416.723149] UBI: number of good PEBs:        512
[  416.727460] UBI: number of bad PEBs:         0
[  416.732083] UBI: number of corrupted PEBs:   0
[  416.736301] UBI: max. allowed volumes:       128
[  416.741080] UBI: wear-leveling threshold:    4096
[  416.745610] UBI: number of internal volumes: 1
[  416.750265] UBI: number of user volumes:     0
[  416.754545] UBI: available PEBs:             503
[  416.759044] UBI: total number of reserved PEBs: 9
[  416.764011] UBI: number of PEBs reserved for bad PEB handling: 5
[  416.769853] UBI: max/mean erase counter: 0/0
[  416.774039] UBI: image sequence number:  1171577802
[  416.778881] UBI: background thread "ubi_bgt1d" started, PID 7267
ubiupdatevol /dev/ubi1_0 /tmp/uhttp-upgrade.img -o 128 -s 4819470
ubiupdatevol /dev/ubi1_1 /tmp/uhttp-upgrade.img -o 4819598 -s 158
$Shutting down pppd: 
disable_ipv4_dns
IPv6_dns = nameserver 240b:12:500:6500:225:36ff:fe14:e98c
reload_servers_safe
######policy stop
Stop DS-Lite Tunnel ...
Stop DS-Lite Tunnel done...
Stop MAP E ...
Stop DS-Lite Tunnel ...
Stop DS-Lite Tunnel done...
Stop MAP E ...
Stop RADVD ...
ip -6 addr delet 240b:12:500:6500:7603:bdff:febc:1d99/64 dev eth0
TMP_WAN_IPV6= 
[  447.302061] Restarting system.
[  447.304092] Going down for restart now


BUFFALO WXR-2533DHP U-Boot Ver 1.14 (May 18 2015 - 13:24:36)

CPU:   IPQ8064 clock 1.4 GHz
DRAM:  DDR3 512 MiB clock 533 MHz
NAND:  ECC 4 bits, 256 MiB
SF: Detected W25Q32 with page size 64 KiB, total 4 MiB
MMC:   
In:    serial
Out:   serial
Err:   serial
cdp: get part failed for 0:HLOS
cdp: get part failed for rootfs
Net:   MAC2 addr:74:3:bd:bc:1d:98
athrs17_reg_init: complete
athrs17_vlan_config ...done
S17c init  done
eth1
Memory Test Start
Pattern: 55555555
Pattern: AAAAAAAA
Pattern: 00000000
Memory Test Pass 

Hit any key to stop autoboot:  0 
Checking Bank1 Image ... 
Creating 1 MTD partitions on "nand0":
0x000000000000-0x000004000000 : "mtd=0"
Bank1 Image is good
kernel_checksum is 0x4d51f25f , rootfs_checksum is 0xd3 
Checking Bank2 Image ... 
Creating 1 MTD partitions on "nand0":
0x000004000000-0x000008000000 : "mtd=0"
Bank2 Image is good
kernel_checksum is 0x4acf4726 , rootfs_checksum is 0xc9 
Bank1 Image not the same as Bank2 Image 
Cpoy to Bank1 image from Bank2 image 
Creating 1 MTD partitions on "nand0":
0x000000000000-0x000004000000 : "mtd=0"
4819470 bytes written to volume kernel
158 bytes written to volume ubi_rootfs
MMC Device 0 not found

dmagic1 0 dmagic2 0 
 
MMC Device 0 not found
Using nand device 1
Device 1: nand1... is now current device
bootargs=console=ttyHSL1,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs
Booting from flash
set mtdids nand0=nand0 && set mtdparts mtdparts=nand0:0x4000000@0x0(fs),${msmparts} && ubi part fs && ubi read 0x44000000 kernel && bootm 0x44000000
Creating 1 MTD partitions on "nand0":
0x000000000000-0x000004000000 : "mtd=0"
   Image Name:   ARM OpenWrt Linux-4.14.89
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    4819406 Bytes = 4.6 MiB
   Load Address: 42208000
   Entry Point:  42208000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK
Setting up atags for msm partition: rootfs

device nand0 , # parts = 1
 #: name                size            offset          mask_flags
 0: fs                  0x04000000      0x00000000      0

active partition: nand0,0 - (fs) 0x04000000 @ 0x00000000

defaults:
mtdids  : none
mtdparts: none
Using machid 0x1260 from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.14.89 (jenkins@tofu-z77hvub18_openwrt) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r0+8849-8f8ac4c3dc)) #0 SMP Thu Dec 20 13:01:38 2018
[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5787d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] OF: fdt: Machine model: Buffalo WXR-2533DHP
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] random: get_random_bytes called from start_kernel+0x88/0x408 with crng_init=0
[    0.000000] percpu: Embedded 15 pages/cpu @ddc01000 s29324 r8192 d23924 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 121920
[    0.000000] Kernel command line: 
[    0.000000] Bootloader command line (ignored): console=ttyHSL1,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Memory: 472264K/491520K available (4745K kernel code, 152K rwdata, 1260K rodata, 8192K init, 228K bss, 19256K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xde800000 - 0xff800000   ( 528 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xde000000   ( 480 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0208000 - 0xc07a25f8   (5738 kB)
[    0.000000]       .init : 0xc0900000 - 0xc1100000   (8192 kB)
[    0.000000]       .data : 0xc1100000 - 0xc11261c0   ( 153 kB)
[    0.000000]        .bss : 0xc1128000 - 0xc11610d8   ( 229 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] clocksource: dg_timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 305801671480 ns
[    0.000006] sched_clock: 32 bits at 6MHz, resolution 160ns, wraps every 343597383600ns
[    0.000020] Switching to timer-based delay loop, resolution 160ns
[    0.000233] Calibrating delay loop (skipped), value calculated using timer frequency.. 12.50 BogoMIPS (lpj=62500)
[    0.000258] pid_max: default: 32768 minimum: 301
[    0.000381] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000397] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000981] CPU: Testing write buffer coherency: ok
[    0.001752] Setting up static identity map for 0x42300000 - 0x42300060
[    0.001912] Hierarchical SRCU implementation.
[    0.002650] smp: Bringing up secondary CPUs ...
[    0.004459] smp: Brought up 1 node, 2 CPUs
[    0.004478] SMP: Total of 2 processors activated (25.00 BogoMIPS).
[    0.004491] CPU: All CPU(s) started in SVC mode.
[    0.014986] VFP support v0.3: implementor 51 architecture 64 part 4d variant 2 rev 0
[    0.015147] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.015173] futex hash table entries: 512 (order: 3, 32768 bytes)
[    0.015284] pinctrl core: initialized pinctrl subsystem
[    0.016308] NET: Registered protocol family 16
[    0.016556] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.017914] cpuidle: using governor ladder
[    0.017980] cpuidle: using governor menu
[    0.039275] msm_bus_fabric_init_driver
[    0.040686] usbcore: registered new interface driver usbfs
[    0.040777] usbcore: registered new interface driver hub
[    0.040867] usbcore: registered new device driver usb
[    0.040929] pps_core: LinuxPPS API ver. 1 registered
[    0.040941] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti 
[    0.040972] PTP clock support registered
[    0.042787] clocksource: Switched to clocksource dg_timer
[    0.046101] NET: Registered protocol family 2
[    0.046616] TCP established hash table entries: 4096 (order: 2, 16384 bytes)
[    0.046660] TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
[    0.046713] TCP: Hash tables configured (established 4096 bind 4096)
[    0.046805] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.046835] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.047035] NET: Registered protocol family 1
[    0.187062] No memory allocated for crashlog
[    0.187376] workingset: timestamp_bits=30 max_order=17 bucket_order=0
[    0.192028] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.192043] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.198948] io scheduler noop registered
[    0.198967] io scheduler deadline registered (default)
[    0.200358] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda not found, using dummy regulator
[    0.200465] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda_phy not found, using dummy regulator
[    0.200562] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda_refclk not found, using dummy regulator
[    0.201344] OF: PCI: host bridge /soc/pci@1b500000 ranges:
[    0.201388] OF: PCI:    IO 0x0fe00000..0x0fefffff -> 0x0fe00000
[    0.201413] OF: PCI:   MEM 0x08000000..0x0fdfffff -> 0x08000000
[    0.309447] qcom-pcie 1b500000.pci: link up
[    0.309631] qcom-pcie 1b500000.pci: PCI host bridge to bus 0000:00
[    0.309655] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.309674] pci_bus 0000:00: root bus resource [io  0x0000-0xfffff] (bus address [0xfe00000-0xfefffff])
[    0.309689] pci_bus 0000:00: root bus resource [mem 0x08000000-0x0fdfffff]
[    0.310219] PCI: bus0: Fast back to back transfers disabled
[    0.312458] PCI: bus1: Fast back to back transfers disabled
[    0.312557] pci 0000:00:00.0: BAR 8: assigned [mem 0x08000000-0x081fffff]
[    0.312581] pci 0000:01:00.0: BAR 0: assigned [mem 0x08000000-0x081fffff 64bit]
[    0.312711] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    0.312736] pci 0000:00:00.0:   bridge window [mem 0x08000000-0x081fffff]
[    0.313417] pcieport 0000:00:00.0: AER enabled with IRQ 34
[    0.313991] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda not found, using dummy regulator
[    0.314095] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_phy not found, using dummy regulator
[    0.314199] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_refclk not found, using dummy regulator
[    0.314953] OF: PCI: host bridge /soc/pci@1b700000 ranges:
[    0.314994] OF: PCI:    IO 0x31e00000..0x31efffff -> 0x31e00000
[    0.315017] OF: PCI:   MEM 0x2e000000..0x31dfffff -> 0x2e000000
[    0.424937] qcom-pcie 1b700000.pci: link up
[    0.425090] qcom-pcie 1b700000.pci: PCI host bridge to bus 0001:00
[    0.425109] pci_bus 0001:00: root bus resource [bus 00-ff]
[    0.425124] pci_bus 0001:00: root bus resource [mem 0x2e000000-0x31dfffff]
[    0.425579] PCI: bus0: Fast back to back transfers disabled
[    0.427926] PCI: bus1: Fast back to back transfers disabled
[    0.428011] pci 0001:00:00.0: BAR 8: assigned [mem 0x2e000000-0x2e1fffff]
[    0.428033] pci 0001:01:00.0: BAR 0: assigned [mem 0x2e000000-0x2e1fffff 64bit]
[    0.428164] pci 0001:00:00.0: PCI bridge to [bus 01-ff]
[    0.428184] pci 0001:00:00.0:   bridge window [mem 0x2e000000-0x2e1fffff]
[    0.428672] pcieport 0001:00:00.0: AER enabled with IRQ 67
[    0.430956] L2 @ QSB rate. Forcing new rate.
[    0.431159] L2 @ 384000 KHz
[    0.431329] CPU0 @ 800000 KHz
[    0.431343] CPU1 @ QSB rate. Forcing new rate.
[    0.431461] CPU1 @ 384000 KHz
[    0.435536] gsbi 16300000.gsbi: GSBI port protocol: 6 crci: 0
[    0.436941] gsbi 1a200000.gsbi: GSBI port protocol: 3 crci: 0
[    0.438421] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.439246] msm_serial 16340000.serial: msm_serial: detected port #0
[    0.439344] msm_serial 16340000.serial: uartclk = 7372800
[    0.439423] 16340000.serial: ttyMSM0 at MMIO 0x16340000 (irq = 100, base_baud = 460800) is a MSM
[    0.439460] msm_serial: console setup on port #0
[    1.172231] console [ttyMSM0] enabled
[    1.177094] msm_serial: driver initialized
[    1.185782] loop: module loaded
[    1.187920] nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xaa
[    1.187957] nand: Micron MT29F2G08ABBEAH4
[    1.194439] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.198290] 2 fixed-partitions partitions found on MTD device qcom_nand.0
[    1.205774] Creating 2 MTD partitions on "qcom_nand.0":
[    1.212567] 0x000000000000-0x000004000000 : "ubi"
[    1.225487] random: fast init done
[    1.392922] 0x000004000000-0x000008000000 : "rootfs_1"
[    1.569415] spi_qup 1a280000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    1.584327] m25p80 spi0.0: w25q32dw (4096 Kbytes)
[    1.584484] 13 fixed-partitions partitions found on MTD device spi0.0
[    1.588013] Creating 13 MTD partitions on "spi0.0":
[    1.594534] 0x000000000000-0x000000010000 : "SBL1"
[    1.599973] 0x000000010000-0x000000030000 : "MIBIB"
[    1.604812] 0x000000030000-0x000000060000 : "SBL2"
[    1.609504] 0x000000060000-0x000000090000 : "SBL3"
[    1.614492] 0x000000090000-0x0000000a0000 : "DDRCONFIG"
[    1.619144] 0x0000000a0000-0x0000000b0000 : "SSD"
[    1.624328] 0x0000000b0000-0x0000000e0000 : "TZ"
[    1.629113] 0x0000000e0000-0x000000100000 : "RPM"
[    1.633933] 0x000000100000-0x000000170000 : "APPSBL"
[    1.638405] 0x000000170000-0x000000180000 : "APPSBLENV"
[    1.643537] 0x000000180000-0x0000001c0000 : "ART"
[    1.648408] 0x0000001c0000-0x0000001d0000 : "BOOTCONFIG"
[    1.653341] 0x0000001d0000-0x000000240000 : "APPSBL_1"
[    1.659584] libphy: GPIO Bitbanged MDIO: probed
[    1.704291] switch0: Atheros AR8337 rev. 2 switch registered on gpio-0
[    2.564122] ar8327: qca,phy-rgmii-en is not specified
[    2.564543] libphy: Fixed MDIO Bus: probed
[    2.588350] ipq806x-gmac-dwmac 37200000.ethernet: PTP uses main clock
[    2.588708] stmmac - user ID: 0x10, Synopsys ID: 0x37
[    2.593890] ipq806x-gmac-dwmac 37200000.ethernet: Ring mode enabled
[    2.598812] ipq806x-gmac-dwmac 37200000.ethernet: DMA HW capability register supported
[    2.604960] ipq806x-gmac-dwmac 37200000.ethernet: Enhanced/Alternate descriptors
[    2.612873] ipq806x-gmac-dwmac 37200000.ethernet: Enabled extended descriptors
[    2.620515] ipq806x-gmac-dwmac 37200000.ethernet: RX Checksum Offload Engine supported
[    2.627544] ipq806x-gmac-dwmac 37200000.ethernet: COE Type 2
[    2.635414] ipq806x-gmac-dwmac 37200000.ethernet: TX Checksum insertion supported
[    2.641173] ipq806x-gmac-dwmac 37200000.ethernet: Wake-Up On Lan supported
[    2.648633] ipq806x-gmac-dwmac 37200000.ethernet: Enable RX Mitigation via HW Watchdog Timer
[    2.676057] ipq806x-gmac-dwmac 37400000.ethernet: PTP uses main clock
[    2.676305] stmmac - user ID: 0x10, Synopsys ID: 0x37
[    2.681486] ipq806x-gmac-dwmac 37400000.ethernet: Ring mode enabled
[    2.686596] ipq806x-gmac-dwmac 37400000.ethernet: DMA HW capability register supported
[    2.692597] ipq806x-gmac-dwmac 37400000.ethernet: Enhanced/Alternate descriptors
[    2.700643] ipq806x-gmac-dwmac 37400000.ethernet: Enabled extended descriptors
[    2.708206] ipq806x-gmac-dwmac 37400000.ethernet: RX Checksum Offload Engine supported
[    2.715232] ipq806x-gmac-dwmac 37400000.ethernet: COE Type 2
[    2.723142] ipq806x-gmac-dwmac 37400000.ethernet: TX Checksum insertion supported
[    2.728880] ipq806x-gmac-dwmac 37400000.ethernet: Wake-Up On Lan supported
[    2.736323] ipq806x-gmac-dwmac 37400000.ethernet: Enable RX Mitigation via HW Watchdog Timer
[    2.743794] i2c /dev entries driver
[    2.752462] Calibration not found.
[    2.754913] qcom-tsens 900000.thermal-sensor: tsens calibration failed
[    2.759430] Speed bin: 0
[    2.764883] PVS bin: 1
[    2.768865] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    2.769743] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    2.777474] sdhci: Secure Digital Host Controller Interface driver
[    2.784238] sdhci: Copyright(c) Pierre Ossman
[    2.790419] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.796529] NET: Registered protocol family 10
[    2.801830] Segment Routing with IPv6
[    2.805015] NET: Registered protocol family 17
[    2.809219] 8021q: 802.1Q VLAN Support v1.8
[    2.812936] Registering SWP/SWPB emulation handler
[    2.829454] qcom_rpm 108000.rpm: RPM firmware 3.0.16777342
[    2.844830] s1a: supplied by regulator-dummy
[    2.844916] s1a: Bringing 0uV into 1050000-1050000uV
[    2.848468] s1b: supplied by regulator-dummy
[    2.853240] s1b: Bringing 0uV into 1050000-1050000uV
[    2.857613] s2a: supplied by regulator-dummy
[    2.862367] s2a: Bringing 0uV into 800000-800000uV
[    2.866890] s2b: supplied by regulator-dummy
[    2.871231] s2b: Bringing 0uV into 800000-800000uV
[    2.881060] UBI: auto-attach mtd0
[    2.881095] ubi0: attaching mtd0
[    2.977065] random: crng init done
[    3.911204] ubi0: scanning is finished
[    3.931436] ubi0: attached mtd0 (name "ubi", size 64 MiB)
[    3.931457] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.935876] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.942576] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.949486] ubi0: good PEBs: 512, bad PEBs: 0, corrupted PEBs: 0
[    3.956265] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[    3.962455] ubi0: max/mean erase counter: 12/1, WL threshold: 4096, image sequence number: 0
[    3.969542] ubi0: available PEBs: 136, total reserved PEBs: 376, PEBs reserved for bad PEB handling: 40
[    3.978153] hctosys: unable to open rtc device[    4.009139] Freeing unused kernel memory: 8192K
[    4.045472] init: Console is alive
[    4.045767] init: - watchdog -
[    4.063289] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.069988] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    4.071844] SCSI subsystem initialized
[    4.080623] ehci-platform: EHCI generic platform driver
[    4.083152] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    4.085039] ohci-platform: OHCI generic platform driver
[    4.221365] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    4.221461] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
[    4.226232] xhci-hcd xhci-hcd.0.auto: hcc params 0x0228f065 hci version 0x100 quirks 0x0000000002010010
[    4.233519] xhci-hcd xhci-hcd.0.auto: irq 110, io mem 0x11000000
[    4.243461] hub 1-0:1.0: USB hub found
[    4.248960] hub 1-0:1.0: 1 port detected
[    4.252779] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    4.256657] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
[    4.261871] xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0  SuperSpeed
[    4.269581] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    4.276422] hub 2-0:1.0: USB hub found
[    4.284436] hub 2-0:1.0: 1 port detected
[    4.288146] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    4.291995] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 3
[    4.297499] xhci-hcd xhci-hcd.1.auto: hcc params 0x0228f065 hci version 0x100 quirks 0x0000000002010010
[    4.304929] xhci-hcd xhci-hcd.1.auto: irq 111, io mem 0x10000000
[    4.314673] hub 3-0:1.0: USB hub found
[    4.320479] hub 3-0:1.0: 1 port detected
[    4.324313] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    4.328102] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 4
[    4.333466] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0  SuperSpeed
[    4.341015] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM.
[    4.347971] hub 4-0:1.0: USB hub found
[    4.355984] hub 4-0:1.0: 1 port detected
[    4.361164] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.364940] init: - preinit -
[    5.693942] Generic PHY fixed-0:01: attached PHY driver [Generic PHY] (mii_bus:phy_addr=fixed-0:01, irq=POLL)
[    5.695341] dwmac1000: Master AXI performs any burst length
[    5.702849] ipq806x-gmac-dwmac 37400000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported
[    5.708490] ipq806x-gmac-dwmac 37400000.ethernet eth1: registered PTP clock
[    5.718340] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    6.793200] ipq806x-gmac-dwmac 37400000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off
[    6.793275] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[    8.899424] procd: - early -
[    8.899562] procd: - watchdog -
[    9.550522] procd: - watchdog -
[    9.551021] procd: - ubus -
[    9.605286] procd: - init -
Please press Enter to activate this console.
[    9.709522] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.711344] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    9.718577] Loading modules backported from Linux version v4.19.7-0-g61c68f2a2af0
[    9.720232] Backport generated by backports.git v4.19.7-1-0-g148b072d
[    9.728596] ip_tables: (C) 2000-2006 Netfilter Core Team
[    9.736682] nf_conntrack version 0.5.0 (8192 buckets, 32768 max)
[    9.761616] xt_time: kernel timezone is -0000
[    9.779861] PPP generic driver version 2.4.2
[    9.781661] NET: Registered protocol family 24
[    9.795285] ath10k 4.16 driver, optimized for CT firmware, probing pci device: 0x40.
[    9.795996] ath10k_pci 0000:01:00.0: enabling device (0140 -> 0142)
[    9.802675] ath10k_pci 0000:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0
[    9.975599] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/fwcfg-pci-0000:01:00.0.txt failed with error -2
[    9.975643] ath10k_pci 0000:01:00.0: Falling back to user helper
[   10.013864] firmware ath10k!fwcfg-pci-0000:01:00.0.txt: firmware_loading_store: map pages failed
[   10.014180] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/pre-cal-pci-0000:01:00.0.bin failed with error -2
[   10.021726] ath10k_pci 0000:01:00.0: Falling back to user helper
[   14.259017] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/QCA99X0/hw2.0/ct-firmware-5.bin failed with error -2
[   14.259057] ath10k_pci 0000:01:00.0: Falling back to user helper
[   14.307517] firmware ath10k!QCA99X0!hw2.0!ct-firmware-5.bin: firmware_loading_store: map pages failed
[   14.307788] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/QCA99X0/hw2.0/ct-firmware-2.bin failed with error -2
[   14.315843] ath10k_pci 0000:01:00.0: Falling back to user helper
[   14.367096] firmware ath10k!QCA99X0!hw2.0!ct-firmware-2.bin: firmware_loading_store: map pages failed
[   14.367442] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/QCA99X0/hw2.0/firmware-6.bin failed with error -2
[   14.375449] ath10k_pci 0000:01:00.0: Falling back to user helper
[   14.421036] firmware ath10k!QCA99X0!hw2.0!firmware-6.bin: firmware_loading_store: map pages failed
[   14.422707] ath10k_pci 0000:01:00.0: qca99x0 hw2.0 target 0x01000000 chip_id 0x003b01ff sub 168c:0002
[   14.429027] ath10k_pci 0000:01:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   14.441474] ath10k_pci 0000:01:00.0: firmware ver 10.4b-ct-9980-fW-012-620ae964 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT crc32 52695766
[   14.507362] ath10k_pci 0000:01:00.0: board_file api 2 bmi_id 1:1 crc32 08fa09f2
[   15.694480] ath10k_pci 0000:01:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   15.694508] ath10k_pci 0000:01:00.0: msdu-desc: 2500  skid: 32
[   15.770280] ath10k_pci 0000:01:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   15.771030] ath10k_pci 0000:01:00.0: wmi print 'free: 35468 iram: 35780 sram: 12808'
[   16.013030] ath10k_pci 0000:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1
[   16.121879] ath10k 4.16 driver, optimized for CT firmware, probing pci device: 0x40.
[   16.123055] ath10k_pci 0001:01:00.0: enabling device (0140 -> 0142)
[   16.129615] ath10k_pci 0001:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0
[   16.304899] ath10k_pci 0001:01:00.0: Direct firmware load for ath10k/fwcfg-pci-0001:01:00.0.txt failed with error -2
[   16.304937] ath10k_pci 0001:01:00.0: Falling back to user helper
[   16.424350] firmware ath10k!fwcfg-pci-0001:01:00.0.txt: firmware_loading_store: map pages failed
[   16.424542] ath10k_pci 0001:01:00.0: Direct firmware load for ath10k/pre-cal-pci-0001:01:00.0.bin failed with error -2
[   16.432201] ath10k_pci 0001:01:00.0: Falling back to user helper
[   21.382164] ath10k_pci 0001:01:00.0: Direct firmware load for ath10k/QCA99X0/hw2.0/ct-firmware-5.bin failed with error -2
[   21.382212] ath10k_pci 0001:01:00.0: Falling back to user helper
[   21.436034] firmware ath10k!QCA99X0!hw2.0!ct-firmware-5.bin: firmware_loading_store: map pages failed
[   21.436331] ath10k_pci 0001:01:00.0: Direct firmware load for ath10k/QCA99X0/hw2.0/ct-firmware-2.bin failed with error -2
[   21.444355] ath10k_pci 0001:01:00.0: Falling back to user helper
[   21.497140] firmware ath10k!QCA99X0!hw2.0!ct-firmware-2.bin: firmware_loading_store: map pages failed
[   21.497481] ath10k_pci 0001:01:00.0: Direct firmware load for ath10k/QCA99X0/hw2.0/firmware-6.bin failed with error -2
[   21.505501] ath10k_pci 0001:01:00.0: Falling back to user helper
[   21.555474] firmware ath10k!QCA99X0!hw2.0!firmware-6.bin: firmware_loading_store: map pages failed
[   21.555602] ath10k_pci 0001:01:00.0: qca99x0 hw2.0 target 0x01000000 chip_id 0x003b01ff sub 168c:0002
[   21.563391] ath10k_pci 0001:01:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   21.574658] ath10k_pci 0001:01:00.0: firmware ver 10.4b-ct-9980-fW-012-620ae964 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT crc32 52695766
[   21.641838] ath10k_pci 0001:01:00.0: board_file api 2 bmi_id 1:2 crc32 08fa09f2
[   22.823399] ath10k_pci 0001:01:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   22.823426] ath10k_pci 0001:01:00.0: msdu-desc: 2500  skid: 32
[   22.901850] ath10k_pci 0001:01:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   22.902632] ath10k_pci 0001:01:00.0: wmi print 'free: 35468 iram: 35780 sram: 12808'
[   23.150497] ath10k_pci 0001:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1
[   23.262587] kmodloader: done loading kernel modules from /etc/modules.d/*
[   26.720854] Generic PHY fixed-0:01: attached PHY driver [Generic PHY] (mii_bus:phy_addr=fixed-0:01, irq=POLL)
[   26.721558] dwmac1000: Master AXI performs any burst length
[   26.729828] ipq806x-gmac-dwmac 37400000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported
[   26.735282] ipq806x-gmac-dwmac 37400000.ethernet eth1: registered PTP clock
[   26.744309] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
[   26.771635] br-lan: port 1(eth1.1) entered blocking state
[   26.771663] br-lan: port 1(eth1.1) entered disabled state
[   26.776270] device eth1.1 entered promiscuous mode
[   26.781386] device eth1 entered promiscuous mode
[   26.796647] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   26.807719] Generic PHY fixed-0:00: attached PHY driver [Generic PHY] (mii_bus:phy_addr=fixed-0:00, irq=POLL)
[   26.808427] dwmac1000: Master AXI performs any burst length
[   26.816694] ipq806x-gmac-dwmac 37200000.ethernet eth0: IEEE 1588-2008 Advanced Timestamp supported
[   26.822087] ipq806x-gmac-dwmac 37200000.ethernet eth0: registered PTP clock
[   26.831530] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   26.844112] IPv6: ADDRCONF(NETDEV_UP): eth0.2: link is not ready
[   27.754759] ipq806x-gmac-dwmac 37400000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off
[   27.757885] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[   27.763657] br-lan: port 1(eth1.1) entered blocking state
[   27.768708] br-lan: port 1(eth1.1) entered forwarding state
[   27.777502] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   27.913229] ipq806x-gmac-dwmac 37200000.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
[   27.913372] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   27.921991] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.2: link becomes ready



BusyBox v1.29.3 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r0+8855-dbecc23962
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# sysupgrade http://taiha.net/jenkins/job/OpenWrt-master-BUFFALO-W
XR-2533DHP/lastSuccessfulBuild/artifact/bin/targets/ipq806x/generic/openwrt-ipq8
06x-buffalo_wxr-2533dhp-squashfs-sysupgrade.bin
Downloading 'http://taiha.net/jenkins/job/OpenWrt-master-BUFFALO-WXR-2533DHP/lastSuccessfulBuild/artifact/bin/targets/ipq806x/generic/openwrt-ipq806x-buffalo_wxr-2533dhp-squashfs-sysupgrade.bin'
Connecting to 240b:12:500:65f0:c822:64a3:7e11:4961:80
Writing to '/tmp/sysupgrade.img'
/tmp/sysupgrade.img  100% |*******************************|  4890k  0:00:00 ETA
Download completed (5008076 bytes)
Cannot save config while running from ramdisk.
Commencing upgrade. Closing all shell sessions.
Watchdog handover: fd=3
- watchdog -
killall: telnetd: no process killed
Sending TERM to remaining processes ... ntpd odhcp6c udhcpc dnsmasq ubusd logd netifd odhcpd 
Sending KILL to remaining processes ... 
Performing system upgrade...

created fake-rootfs data: /tmp/fkroot.bin
fake-rootfs data checksum: 0xd0
[   65.679406] ubi1: attaching mtd1
[   66.865186] ubi1: scanning is finished
[   66.888168] ubi1: attached mtd1 (name "rootfs_1", size 64 MiB)
[   66.888194] ubi1: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[   66.892972] ubi1: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[   66.899747] ubi1: VID header offset: 2048 (aligned 2048), data offset: 4096
[   66.906698] ubi1: good PEBs: 512, bad PEBs: 0, corrupted PEBs: 0
[   66.913461] ubi1: user volume: 3, internal volumes: 1, max. volumes count: 128
[   66.919625] ubi1: max/mean erase counter: 6/1, WL threshold: 4096, image sequence number: 1171577802
[   66.926740] ubi1: available PEBs: 136, total reserved PEBs: 376, PEBs reserved for bad PEB handling: 40
[   66.936144] ubi1: background thread "ubi_bgt1d" started, PID 1766
UBI device number 1, total 512 LEBs (65011712 bytes, 62.0 MiB), available 136 LEBs (17268736 bytes, 16.4 MiB), LEB size 126976 bytes (124.0 KiB)
Volume ID 0, size 18 LEBs (2285568 bytes, 2.1 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
Volume ID 1, size 1 LEBs (126976 bytes, 124.0 KiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "ubi_rootfs", alignment 1
write fake-rootfs data to ubi0_1
Volume ID 2, size 22 LEBs (2793472 bytes, 2.6 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 54218752
Volume ID 3, size 427 LEBs (54218752 bytes, 51.7 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
umount: can't unmount /: Invalid argument
[   71.331901] reboot: Restarting system


BUFFALO WXR-2533DHP U-Boot Ver 1.14 (May 18 2015 - 13:24:36)

CPU:   IPQ8064 clock 1.4 GHz
DRAM:  DDR3 512 MiB clock 533 MHz
NAND:  ECC 4 bits, 256 MiB
SF: Detected W25Q32 with page size 64 KiB, total 4 MiB
MMC:   
In:    serial
Out:   serial
Err:   serial
cdp: get part failed for 0:HLOS
cdp: get part failed for rootfs
Net:   MAC2 addr:74:3:bd:bc:1d:98
athrs17_reg_init: complete
athrs17_vlan_config ...done
S17c init  done
eth1
Memory Test Start
Pattern: 55555555
Pattern: AAAAAAAA
Pattern: 00000000
Memory Test Pass 

Hit any key to stop autoboot:  0 
Checking Bank1 Image ... 
Creating 1 MTD partitions on "nand0":
0x000000000000-0x000004000000 : "mtd=0"
Bank1 Image is good
kernel_checksum is 0xef770a57 , rootfs_checksum is 0xd0 
Checking Bank2 Image ... 
Creating 1 MTD partitions on "nand0":
0x000004000000-0x000008000000 : "mtd=0"
UBI Volume is empty 
Bank2 Image is fail

NAND erase: device 0 offset 0x4000000, size 0x4000000
Erasing at 0x7fe0000 -- 100% complete.
OK
Creating 1 MTD partitions on "nand0":
0x000004000000-0x000008000000 : "mtd=0"
UBI: empty MTD device detected
UBI: create volume table (copy #1)
UBI: create volume table (copy #2)
Creating dynamic volume kernel of size 5332992
Creating dynamic volume ubi_rootfs of size 31490048
Creating dynamic volume ubi_rootfs_data of size 5332992
Bank2 UBI Partition is Broken
Cpoy to Bank2 Image from Bank1 Image 
Creating 1 MTD partitions on "nand0":
0x000004000000-0x000008000000 : "mtd=0"
2265046 bytes written to volume kernel
158 bytes written to volume ubi_rootfs
MMC Device 0 not found

dmagic1 0 dmagic2 0 
 
MMC Device 0 not found
Using nand device 1
Device 1: nand1... is now current device
bootargs=console=ttyHSL1,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs
Booting from flash
set mtdids nand0=nand0 && set mtdparts mtdparts=nand0:0x4000000@0x0(fs),${msmparts} && ubi part fs && ubi read 0x44000000 kernel && bootm 0x44000000
Creating 1 MTD partitions on "nand0":
0x000000000000-0x000004000000 : "mtd=0"
   Image Name:   ARM OpenWrt Linux-4.14.89
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2264982 Bytes = 2.2 MiB
   Load Address: 42208000
   Entry Point:  42208000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK
Setting up atags for msm partition: rootfs

device nand0 , # parts = 1
 #: name                size            offset          mask_flags
 0: fs                  0x04000000      0x00000000      0

active partition: nand0,0 - (fs) 0x04000000 @ 0x00000000

defaults:
mtdids  : none
mtdparts: none
Using machid 0x1260 from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.14.89 (jenkins@tofu-z77hvub18_openwrt) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r0+8849-8f8ac4c3dc)) #0 SMP Thu Dec 20 13:01:38 2018
[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5787d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] OF: fdt: Machine model: Buffalo WXR-2533DHP
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] random: get_random_bytes called from start_kernel+0x88/0x408 with crng_init=0
[    0.000000] percpu: Embedded 15 pages/cpu @ddc01000 s29324 r8192 d23924 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 121920
[    0.000000] Kernel command line: 
[    0.000000] Bootloader command line (ignored): console=ttyHSL1,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Memory: 479436K/491520K available (4745K kernel code, 152K rwdata, 1260K rodata, 1024K init, 228K bss, 12084K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xde800000 - 0xff800000   ( 528 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xde000000   ( 480 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0208000 - 0xc07a25f8   (5738 kB)
[    0.000000]       .init : 0xc0900000 - 0xc0a00000   (1024 kB)
[    0.000000]       .data : 0xc0a00000 - 0xc0a261c0   ( 153 kB)
[    0.000000]        .bss : 0xc0a28000 - 0xc0a610d8   ( 229 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] clocksource: dg_timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 305801671480 ns
[    0.000006] sched_clock: 32 bits at 6MHz, resolution 160ns, wraps every 343597383600ns
[    0.000020] Switching to timer-based delay loop, resolution 160ns
[    0.000233] Calibrating delay loop (skipped), value calculated using timer frequency.. 12.50 BogoMIPS (lpj=62500)
[    0.000258] pid_max: default: 32768 minimum: 301
[    0.000380] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000397] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000971] CPU: Testing write buffer coherency: ok
[    0.001739] Setting up static identity map for 0x42300000 - 0x42300060
[    0.001898] Hierarchical SRCU implementation.
[    0.002637] smp: Bringing up secondary CPUs ...
[    0.004460] smp: Brought up 1 node, 2 CPUs
[    0.004478] SMP: Total of 2 processors activated (25.00 BogoMIPS).
[    0.004490] CPU: All CPU(s) started in SVC mode.
[    0.015005] VFP support v0.3: implementor 51 architecture 64 part 4d variant 2 rev 0
[    0.015167] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.015193] futex hash table entries: 512 (order: 3, 32768 bytes)
[    0.015304] pinctrl core: initialized pinctrl subsystem
[    0.016317] NET: Registered protocol family 16
[    0.016566] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.017921] cpuidle: using governor ladder
[    0.017988] cpuidle: using governor menu
[    0.039324] msm_bus_fabric_init_driver
[    0.040786] usbcore: registered new interface driver usbfs
[    0.040880] usbcore: registered new interface driver hub
[    0.040971] usbcore: registered new device driver usb
[    0.041031] pps_core: LinuxPPS API ver. 1 registered
[    0.041044] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti 
[    0.041075] PTP clock support registered
[    0.042920] clocksource: Switched to clocksource dg_timer
[    0.046232] NET: Registered protocol family 2
[    0.046750] TCP established hash table entries: 4096 (order: 2, 16384 bytes)
[    0.046792] TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
[    0.046845] TCP: Hash tables configured (established 4096 bind 4096)
[    0.046939] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.046970] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.047163] NET: Registered protocol family 1
[    0.048321] No memory allocated for crashlog
[    0.048588] workingset: timestamp_bits=30 max_order=17 bucket_order=0
[    0.053527] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.053545] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.062791] io scheduler noop registered
[    0.062810] io scheduler deadline registered (default)
[    0.064424] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda not found, using dummy regulator
[    0.064537] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda_phy not found, using dummy regulator
[    0.064633] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda_refclk not found, using dummy regulator
[    0.065410] OF: PCI: host bridge /soc/pci@1b500000 ranges:
[    0.065454] OF: PCI:    IO 0x0fe00000..0x0fefffff -> 0x0fe00000
[    0.065479] OF: PCI:   MEM 0x08000000..0x0fdfffff -> 0x08000000
[    0.173117] qcom-pcie 1b500000.pci: link up
[    0.173301] qcom-pcie 1b500000.pci: PCI host bridge to bus 0000:00
[    0.173325] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.173344] pci_bus 0000:00: root bus resource [io  0x0000-0xfffff] (bus address [0xfe00000-0xfefffff])
[    0.173359] pci_bus 0000:00: root bus resource [mem 0x08000000-0x0fdfffff]
[    0.173882] PCI: bus0: Fast back to back transfers disabled
[    0.176115] PCI: bus1: Fast back to back transfers disabled
[    0.176213] pci 0000:00:00.0: BAR 8: assigned [mem 0x08000000-0x081fffff]
[    0.176238] pci 0000:01:00.0: BAR 0: assigned [mem 0x08000000-0x081fffff 64bit]
[    0.176367] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    0.176392] pci 0000:00:00.0:   bridge window [mem 0x08000000-0x081fffff]
[    0.176940] pcieport 0000:00:00.0: AER enabled with IRQ 34
[    0.177494] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda not found, using dummy regulator
[    0.177588] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_phy not found, using dummy regulator
[    0.177701] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_refclk not found, using dummy regulator
[    0.178452] OF: PCI: host bridge /soc/pci@1b700000 ranges:
[    0.178491] OF: PCI:    IO 0x31e00000..0x31efffff -> 0x31e00000
[    0.178514] OF: PCI:   MEM 0x2e000000..0x31dfffff -> 0x2e000000
[    0.288419] qcom-pcie 1b700000.pci: link up
[    0.288582] qcom-pcie 1b700000.pci: PCI host bridge to bus 0001:00
[    0.288603] pci_bus 0001:00: root bus resource [bus 00-ff]
[    0.288617] pci_bus 0001:00: root bus resource [mem 0x2e000000-0x31dfffff]
[    0.289088] PCI: bus0: Fast back to back transfers disabled
[    0.291458] PCI: bus1: Fast back to back transfers disabled
[    0.291542] pci 0001:00:00.0: BAR 8: assigned [mem 0x2e000000-0x2e1fffff]
[    0.291564] pci 0001:01:00.0: BAR 0: assigned [mem 0x2e000000-0x2e1fffff 64bit]
[    0.291696] pci 0001:00:00.0: PCI bridge to [bus 01-ff]
[    0.291716] pci 0001:00:00.0:   bridge window [mem 0x2e000000-0x2e1fffff]
[    0.292223] pcieport 0001:00:00.0: AER enabled with IRQ 67
[    0.294675] L2 @ QSB rate. Forcing new rate.
[    0.294885] L2 @ 384000 KHz
[    0.295056] CPU0 @ 800000 KHz
[    0.295069] CPU1 @ QSB rate. Forcing new rate.
[    0.295188] CPU1 @ 384000 KHz
[    0.299157] gsbi 16300000.gsbi: GSBI port protocol: 6 crci: 0
[    0.300554] gsbi 1a200000.gsbi: GSBI port protocol: 3 crci: 0
[    0.301994] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.302840] msm_serial 16340000.serial: msm_serial: detected port #0
[    0.302940] msm_serial 16340000.serial: uartclk = 7372800
[    0.303021] 16340000.serial: ttyMSM0 at MMIO 0x16340000 (irq = 100, base_baud = 460800) is a MSM
[    0.303058] msm_serial: console setup on port #0
[    1.035919] console [ttyMSM0] enabled
[    1.040612] msm_serial: driver initialized
[    1.049290] loop: module loaded
[    1.051437] nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xaa
[    1.051472] nand: Micron MT29F2G08ABBEAH4
[    1.057952] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.061800] 2 fixed-partitions partitions found on MTD device qcom_nand.0
[    1.069289] Creating 2 MTD partitions on "qcom_nand.0":
[    1.076174] 0x000000000000-0x000004000000 : "ubi"
[    1.088958] random: fast init done
[    1.255704] 0x000004000000-0x000008000000 : "rootfs_1"
[    1.430904] spi_qup 1a280000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    1.445696] m25p80 spi0.0: w25q32dw (4096 Kbytes)
[    1.445850] 13 fixed-partitions partitions found on MTD device spi0.0
[    1.449382] Creating 13 MTD partitions on "spi0.0":
[    1.455890] 0x000000000000-0x000000010000 : "SBL1"
[    1.461335] 0x000000010000-0x000000030000 : "MIBIB"
[    1.466187] 0x000000030000-0x000000060000 : "SBL2"
[    1.470890] 0x000000060000-0x000000090000 : "SBL3"
[    1.475866] 0x000000090000-0x0000000a0000 : "DDRCONFIG"
[    1.480512] 0x0000000a0000-0x0000000b0000 : "SSD"
[    1.485713] 0x0000000b0000-0x0000000e0000 : "TZ"
[    1.490482] 0x0000000e0000-0x000000100000 : "RPM"
[    1.495268] 0x000000100000-0x000000170000 : "APPSBL"
[    1.499769] 0x000000170000-0x000000180000 : "APPSBLENV"
[    1.504920] 0x000000180000-0x0000001c0000 : "ART"
[    1.509760] 0x0000001c0000-0x0000001d0000 : "BOOTCONFIG"
[    1.514742] 0x0000001d0000-0x000000240000 : "APPSBL_1"
[    1.520974] libphy: GPIO Bitbanged MDIO: probed
[    1.545534] switch0: Atheros AR8337 rev. 2 switch registered on gpio-0
[    2.386085] ar8327: qca,phy-rgmii-en is not specified
[    2.386473] libphy: Fixed MDIO Bus: probed
[    2.391822] ipq806x-gmac-dwmac 37200000.ethernet: PTP uses main clock
[    2.394538] stmmac - user ID: 0x10, Synopsys ID: 0x37
[    2.400628] ipq806x-gmac-dwmac 37200000.ethernet: Ring mode enabled
[    2.405749] ipq806x-gmac-dwmac 37200000.ethernet: DMA HW capability register supported
[    2.411743] ipq806x-gmac-dwmac 37200000.ethernet: Enhanced/Alternate descriptors
[    2.419796] ipq806x-gmac-dwmac 37200000.ethernet: Enabled extended descriptors
[    2.427360] ipq806x-gmac-dwmac 37200000.ethernet: RX Checksum Offload Engine supported
[    2.434388] ipq806x-gmac-dwmac 37200000.ethernet: COE Type 2
[    2.442204] ipq806x-gmac-dwmac 37200000.ethernet: TX Checksum insertion supported
[    2.448100] ipq806x-gmac-dwmac 37200000.ethernet: Wake-Up On Lan supported
[    2.455477] ipq806x-gmac-dwmac 37200000.ethernet: Enable RX Mitigation via HW Watchdog Timer
[    2.463990] ipq806x-gmac-dwmac 37400000.ethernet: PTP uses main clock
[    2.470947] stmmac - user ID: 0x10, Synopsys ID: 0x37
[    2.477195] ipq806x-gmac-dwmac 37400000.ethernet: Ring mode enabled
[    2.482136] ipq806x-gmac-dwmac 37400000.ethernet: DMA HW capability register supported
[    2.488278] ipq806x-gmac-dwmac 37400000.ethernet: Enhanced/Alternate descriptors
[    2.496272] ipq806x-gmac-dwmac 37400000.ethernet: Enabled extended descriptors
[    2.503832] ipq806x-gmac-dwmac 37400000.ethernet: RX Checksum Offload Engine supported
[    2.510784] ipq806x-gmac-dwmac 37400000.ethernet: COE Type 2
[    2.518765] ipq806x-gmac-dwmac 37400000.ethernet: TX Checksum insertion supported
[    2.524575] ipq806x-gmac-dwmac 37400000.ethernet: Wake-Up On Lan supported
[    2.531878] ipq806x-gmac-dwmac 37400000.ethernet: Enable RX Mitigation via HW Watchdog Timer
[    2.539407] i2c /dev entries driver
[    2.548166] Calibration not found.
[    2.550450] qcom-tsens 900000.thermal-sensor: tsens calibration failed
[    2.555169] Speed bin: 0
[    2.560427] PVS bin: 1
[    2.564487] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    2.565363] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    2.573013] sdhci: Secure Digital Host Controller Interface driver
[    2.579873] sdhci: Copyright(c) Pierre Ossman
[    2.586116] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.592084] NET: Registered protocol family 10
[    2.597514] Segment Routing with IPv6
[    2.600515] NET: Registered protocol family 17
[    2.605008] 8021q: 802.1Q VLAN Support v1.8
[    2.608556] Registering SWP/SWPB emulation handler
[    2.625077] qcom_rpm 108000.rpm: RPM firmware 3.0.16777342
[    2.640317] s1a: supplied by regulator-dummy
[    2.640403] s1a: Bringing 0uV into 1050000-1050000uV
[    2.644025] s1b: supplied by regulator-dummy
[    2.648651] s1b: Bringing 0uV into 1050000-1050000uV
[    2.653105] s2a: supplied by regulator-dummy
[    2.657935] s2a: Bringing 0uV into 800000-800000uV
[    2.662294] s2b: supplied by regulator-dummy
[    2.666815] s2b: Bringing 0uV into 800000-800000uV
[    2.676585] UBI: auto-attach mtd0
[    2.676620] ubi0: attaching mtd0
[    2.771894] random: crng init done
[    3.703369] ubi0: scanning is finished
[    3.723698] ubi0: attached mtd0 (name "ubi", size 64 MiB)
[    3.723720] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.728068] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.734906] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.741697] ubi0: good PEBs: 512, bad PEBs: 0, corrupted PEBs: 0
[    3.748528] ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
[    3.754767] ubi0: max/mean erase counter: 13/1, WL threshold: 4096, image sequence number: 0
[    3.761753] ubi0: available PEBs: 0, total reserved PEBs: 512, PEBs reserved for bad PEB handling: 40
[    3.770525] ubi0: background thread "ubi_bgt0d" started, PID 62
[    3.771636] block ubiblock0_2: created from ubi0:2(rootfs)
[    3.785256] ubiblock: device ubiblock0_2 (rootfs) set to be root file[    3.807236] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    3.809550] Freeing unused kernel memory: 1024K
[    4.218765] init: Console is alive
[    4.218896] init: - watchdog -
[    5.275578] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    5.338958] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    5.340910] SCSI subsystem initialized
[    5.349699] ehci-platform: EHCI generic platform driver
[    5.352287] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    5.354237] ohci-platform: OHCI generic platform driver
[    5.491947] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    5.492026] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
[    5.496767] xhci-hcd xhci-hcd.0.auto: hcc params 0x0228f065 hci version 0x100 quirks 0x0000000002010010
[    5.504092] xhci-hcd xhci-hcd.0.auto: irq 110, io mem 0x11000000
[    5.514065] hub 1-0:1.0: USB hub found
[    5.519531] hub 1-0:1.0: 1 port detected
[    5.523408] xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
[    5.527152] xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
[    5.532445] xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0  SuperSpeed
[    5.540162] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    5.547031] hub 2-0:1.0: USB hub found
[    5.555000] hub 2-0:1.0: 1 port detected
[    5.558742] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    5.562572] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 3
[    5.568088] xhci-hcd xhci-hcd.1.auto: hcc params 0x0228f065 hci version 0x100 quirks 0x0000000002010010
[    5.575500] xhci-hcd xhci-hcd.1.auto: irq 111, io mem 0x10000000
[    5.585269] hub 3-0:1.0: USB hub found
[    5.591058] hub 3-0:1.0: 1 port detected
[    5.594878] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    5.598678] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 4
[    5.604030] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0  SuperSpeed
[    5.611594] usb usb4: We don't know the algorithms for LPM for this host, disabling LPM.
[    5.618544] hub 4-0:1.0: USB hub found
[    5.626539] hub 4-0:1.0: 1 port detected
[    5.631817] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.644966] init: - preinit -
[    7.476861] Generic PHY fixed-0:01: attached PHY driver [Generic PHY] (mii_bus:phy_addr=fixed-0:01, irq=POLL)
[    7.478368] dwmac1000: Master AXI performs any burst length
[    7.485848] ipq806x-gmac-dwmac 37400000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported
[    7.491337] ipq806x-gmac-dwmac 37400000.ethernet eth1: registered PTP clock
[    7.501189] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    8.553642] ipq806x-gmac-dwmac 37400000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off
[    8.553713] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[   10.773291] UBIFS (ubi0:3): default file-system created
[   11.003900] UBIFS (ubi0:3): background thread "ubifs_bgt0_3" started, PID 146
[   11.259172] UBIFS (ubi0:3): UBIFS: mounted UBI device 0, volume 3, name "rootfs_data"
[   11.259220] UBIFS (ubi0:3): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   11.266118] UBIFS (ubi0:3): FS size: 52948992 bytes (50 MiB, 417 LEBs), journal size 2666496 bytes (2 MiB, 21 LEBs)
[   11.275967] UBIFS (ubi0:3): reserved for root: 2500911 bytes (2442 KiB)
[   11.286250] UBIFS (ubi0:3): media format: w4/r0 (latest is w5/r0), UUID CDD1044B-1045-48AF-83BC-80C1B67A1394, small LPT model
[   11.296754] mount_root: overlay filesystem has not been fully initialized yet
[   11.304594] mount_root: switching to ubifs overlay
[   11.337665] urandom-seed: Seed file not found (/etc/urandom.seed)
[   11.462077] procd: - early -
[   11.462255] procd: - watchdog -
[   12.136573] procd: - watchdog -
[   12.137066] procd: - ubus -
[   12.228244] procd: - init -
Please press Enter to activate this console.
[   12.437084] kmodloader: loading kernel modules from /etc/modules.d/*
[   12.439432] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   12.446643] Loading modules backported from Linux version v4.19.7-0-g61c68f2a2af0
[   12.447797] Backport generated by backports.git v4.19.7-1-0-g148b072d
[   12.456178] ip_tables: (C) 2000-2006 Netfilter Core Team
[   12.464372] nf_conntrack version 0.5.0 (8192 buckets, 32768 max)
[   12.492337] xt_time: kernel timezone is -0000
[   12.518176] PPP generic driver version 2.4.2
[   12.519623] NET: Registered protocol family 24
[   12.532410] ath10k 4.16 driver, optimized for CT firmware, probing pci device: 0x40.
[   12.532920] ath10k_pci 0000:01:00.0: enabling device (0140 -> 0142)
[   12.539874] ath10k_pci 0000:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0
[   12.715891] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/fwcfg-pci-0000:01:00.0.txt failed with error -2
[   12.715934] ath10k_pci 0000:01:00.0: Falling back to user helper
[   12.748124] firmware ath10k!fwcfg-pci-0000:01:00.0.txt: firmware_loading_store: map pages failed
[   12.748456] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/pre-cal-pci-0000:01:00.0.bin failed with error -2
[   12.756101] ath10k_pci 0000:01:00.0: Falling back to user helper
[   16.824798] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/QCA99X0/hw2.0/ct-firmware-5.bin failed with error -2
[   16.824843] ath10k_pci 0000:01:00.0: Falling back to user helper
[   16.867820] firmware ath10k!QCA99X0!hw2.0!ct-firmware-5.bin: firmware_loading_store: map pages failed
[   16.868131] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/QCA99X0/hw2.0/ct-firmware-2.bin failed with error -2
[   16.876143] ath10k_pci 0000:01:00.0: Falling back to user helper
[   16.925109] firmware ath10k!QCA99X0!hw2.0!ct-firmware-2.bin: firmware_loading_store: map pages failed
[   16.925458] ath10k_pci 0000:01:00.0: Direct firmware load for ath10k/QCA99X0/hw2.0/firmware-6.bin failed with error -2
[   16.933433] ath10k_pci 0000:01:00.0: Falling back to user helper
[   16.969418] firmware ath10k!QCA99X0!hw2.0!firmware-6.bin: firmware_loading_store: map pages failed
[   17.409313] ath10k_pci 0000:01:00.0: qca99x0 hw2.0 target 0x01000000 chip_id 0x003b01ff sub 168c:0002
[   17.409344] ath10k_pci 0000:01:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   17.419486] ath10k_pci 0000:01:00.0: firmware ver 10.4b-ct-9980-fW-012-620ae964 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT crc32 52695766
[   17.486698] ath10k_pci 0000:01:00.0: board_file api 2 bmi_id 1:1 crc32 08fa09f2
[   18.664895] ath10k_pci 0000:01:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   18.664922] ath10k_pci 0000:01:00.0: msdu-desc: 2500  skid: 32
[   18.740771] ath10k_pci 0000:01:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   18.741519] ath10k_pci 0000:01:00.0: wmi print 'free: 35468 iram: 35780 sram: 12808'
[   18.983955] ath10k_pci 0000:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1
[   19.079243] ath10k 4.16 driver, optimized for CT firmware, probing pci device: 0x40.
[   19.080186] ath10k_pci 0001:01:00.0: enabling device (0140 -> 0142)
[   19.086998] ath10k_pci 0001:01:00.0: pci irq msi oper_irq_mode 2 irq_mode 0 reset_mode 0
[   19.255173] ath10k_pci 0001:01:00.0: Direct firmware load for ath10k/fwcfg-pci-0001:01:00.0.txt failed with error -2
[   19.255209] ath10k_pci 0001:01:00.0: Falling back to user helper
[   19.580424] firmware ath10k!fwcfg-pci-0001:01:00.0.txt: firmware_loading_store: map pages failed
[   19.580627] ath10k_pci 0001:01:00.0: Direct firmware load for ath10k/pre-cal-pci-0001:01:00.0.bin failed with error -2
[   19.588378] ath10k_pci 0001:01:00.0: Falling back to user helper
[   21.231532] ath10k_pci 0001:01:00.0: Direct firmware load for ath10k/QCA99X0/hw2.0/ct-firmware-5.bin failed with error -2
[   21.231577] ath10k_pci 0001:01:00.0: Falling back to user helper
[   21.274512] firmware ath10k!QCA99X0!hw2.0!ct-firmware-5.bin: firmware_loading_store: map pages failed
[   21.274782] ath10k_pci 0001:01:00.0: Direct firmware load for ath10k/QCA99X0/hw2.0/ct-firmware-2.bin failed with error -2
[   21.282722] ath10k_pci 0001:01:00.0: Falling back to user helper
[   21.352406] firmware ath10k!QCA99X0!hw2.0!ct-firmware-2.bin: firmware_loading_store: map pages failed
[   21.352671] ath10k_pci 0001:01:00.0: Direct firmware load for ath10k/QCA99X0/hw2.0/firmware-6.bin failed with error -2
[   21.360763] ath10k_pci 0001:01:00.0: Falling back to user helper
[   21.411628] firmware ath10k!QCA99X0!hw2.0!firmware-6.bin: firmware_loading_store: map pages failed
[   21.411830] ath10k_pci 0001:01:00.0: qca99x0 hw2.0 target 0x01000000 chip_id 0x003b01ff sub 168c:0002
[   21.419580] ath10k_pci 0001:01:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   21.431185] ath10k_pci 0001:01:00.0: firmware ver 10.4b-ct-9980-fW-012-620ae964 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT crc32 52695766
[   21.498050] ath10k_pci 0001:01:00.0: board_file api 2 bmi_id 1:2 crc32 08fa09f2
[   22.680151] ath10k_pci 0001:01:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   22.680183] ath10k_pci 0001:01:00.0: msdu-desc: 2500  skid: 32
[   22.757948] ath10k_pci 0001:01:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   22.758726] ath10k_pci 0001:01:00.0: wmi print 'free: 35468 iram: 35780 sram: 12808'
[   23.007042] ath10k_pci 0001:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-file max-sta 32 raw 0 hwcrypto 1
[   23.112941] kmodloader: done loading kernel modules from /etc/modules.d/*
[   27.460773] Generic PHY fixed-0:01: attached PHY driver [Generic PHY] (mii_bus:phy_addr=fixed-0:01, irq=POLL)
[   27.461478] dwmac1000: Master AXI performs any burst length
[   27.469761] ipq806x-gmac-dwmac 37400000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported
[   27.475195] ipq806x-gmac-dwmac 37400000.ethernet eth1: registered PTP clock
[   27.484226] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
[   27.510929] br-lan: port 1(eth1.1) entered blocking state
[   27.510958] br-lan: port 1(eth1.1) entered disabled state
[   27.515560] device eth1.1 entered promiscuous mode
[   27.520682] device eth1 entered promiscuous mode
[   27.551804] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   27.558909] Generic PHY fixed-0:00: attached PHY driver [Generic PHY] (mii_bus:phy_addr=fixed-0:00, irq=POLL)
[   27.559615] dwmac1000: Master AXI performs any burst length
[   27.567874] ipq806x-gmac-dwmac 37200000.ethernet eth0: IEEE 1588-2008 Advanced Timestamp supported
[   27.573330] ipq806x-gmac-dwmac 37200000.ethernet eth0: registered PTP clock
[   27.582682] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   27.600269] IPv6: ADDRCONF(NETDEV_UP): eth0.2: link is not ready
[   28.563399] ipq806x-gmac-dwmac 37400000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off
[   28.566617] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
[   28.571700] br-lan: port 1(eth1.1) entered blocking state
[   28.577429] br-lan: port 1(eth1.1) entered forwarding state
[   28.595765] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   28.633401] ipq806x-gmac-dwmac 37200000.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
[   28.633475] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   28.649836] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.2: link becomes ready



BusyBox v1.29.3 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r0+8855-dbecc23962
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# ubus call system board
{
        "kernel": "4.14.89",
        "hostname": "OpenWrt",
        "system": "ARMv7 Processor rev 0 (v7l)",
        "model": "Buffalo WXR-2533DHP",
        "board_name": "buffalo,wxr-2533dhp",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r0+8855-dbecc23962",
                "target": "ipq806x\/generic",
                "description": "OpenWrt SNAPSHOT r0+8855-dbecc23962"
        }
}

WXR-2533DHP ubinfo -a (stock)

stock firmwareにおける ubinfo -a のメモ。メーカーファームへの復旧用情報というような感じ。

root@AP7403BDBC1D98:/# ubinfo -a
UBI version:                    1
Count of UBI devices:           1
UBI control device major/minor: 10:58
Present UBI devices:            ubi0

ubi0
Volumes count:                           3
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     512 (65011712 bytes, 62.0 MiB)
Amount of available logical eraseblocks: 171 (21712896 bytes, 20.7 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  5
Current maximum erase counter value:     8
Minimum input/output unit size:          2048 bytes
Character device major/minor:            248:0
Present volumes:                         0, 1, 2

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        42 LEBs (5332992 bytes, 5.1 MiB)
State:       OK
Name:        kernel
Character device major/minor: 248:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        248 LEBs (31490048 bytes, 30.0 MiB)
State:       OK
Name:        ubi_rootfs
Character device major/minor: 248:2
-----------------------------------
Volume ID:   2 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        42 LEBs (5332992 bytes, 5.1 MiB)
State:       OK
Name:        ubi_rootfs_data
Character device major/minor: 248:3

WN-AC1167GR stock -> OpenWrt

それっぽい感じにヘッダを作り、投げ込めたのでメモ。
“wnac1167gr_v000.bin” というようなファイル名にリネームして放り込む必要がありそうな? → 特にリネームする必要は無かった。

br0: port 4(rai0) entering forwarding state
br0: port 3(ra1) entering forwarding state
br0: port 2(ra0) entering forwarding state
br0: port 1(eth2.1) entering forwarding state
device eth2.1 left promiscuous mode
br0: port 1(eth2.1) entering disabled state
sh: can't kill pid 719: No such process
route: SIOCDELRT: No such process
device ra0 left promiscuous mode
br0: port 2(ra0) entering disabled state
device ra1 left promiscuous mode
br0: port 3(ra1) entering disabled state
device wds0 is not a slave of br0
device wds1 is not a slave of br0
device wds2 is not a slave of br0
device wds3 is not a slave of br0
sh: can't kill pid 811: No such process
route: SIOCDELRT: No such process
device rai0 left promiscuous mode
br0: port 4(rai0) entering disabled state
interface wds4 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
interface wds5 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
interface wds6 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
interface wds7 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
Interface doesn't accept private ioctl...
set (8BE2): Network is down
Interface doesn't accept private ioctl...
set (8BE2): Network is down
Sent SIGKILL to all processes
Requesting system reboot
Restarting system.
Hardware reset!!


U-Boot 1.1.3 (Jul 30 2014 - 21:26:23)

Board: Ralink APSoC DRAM:  64 MB
Ralink UBoot ver: 4.0.1.0
ELX UBoot ver: 4.0.1.6 (Jul 30 2014 21:26:23)
Date:Jul 30 2014  Time:21:26:23
CPU: 580 MHz, MEM: 64 MB
#Reset_MT7530
MT7620N disable wan port phy 0

Please choose the operation: 1, 2, 3, 4, 9
                                                                                                                          0  
   
3: System Boot system code via Flash.
## Booting image at bc070000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.89
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1572544 Bytes =  1.5 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 4.14.89 (musashino205@Taiha.Net) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r0+8844-8b0f1087cc)) #0 Wed Dec 19 14:20:51 2018
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620A ver:2 eco:6
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is I-O DATA WN-AC1167GR
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] random: get_random_bytes called from start_kernel+0x8c/0x474 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=0001af06
[    0.000000] Readback ErrCtl register=0001af06
[    0.000000] Memory: 59792K/65536K available (3650K kernel code, 169K rwdata, 852K rodata, 184K init, 207K bss, 5744K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000011] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015469] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087708] pid_max: default: 32768 minimum: 301
[    0.097110] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.110134] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.130733] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.150215] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.162391] pinctrl core: initialized pinctrl subsystem
[    0.173240] NET: Registered protocol family 16
[    0.664925] PCI host bridge /pcie@10140000 ranges:
[    0.674322]  MEM 0x0000000020000000..0x000000002fffffff
[    0.684696]   IO 0x0000000010160000..0x000000001016ffff
[    0.711848] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.722885] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.735975] PCI host bridge to bus 0000:00
[    0.743971] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.757691] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    0.769418] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.782919] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.799126] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.815680] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.828738] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.842549] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    0.856050] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[    0.870415] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.883925] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[    0.898470] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[    0.912817] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.922669] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
[    0.936186] pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
[    0.954220] clocksource: Switched to clocksource systick
[    0.965893] NET: Registered protocol family 2
[    0.975340] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.989118] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    1.001710] TCP: Hash tables configured (established 1024 bind 1024)
[    1.014493] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.026011] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.038685] NET: Registered protocol family 1
[    1.049988] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    1.062734] Crashlog allocated RAM at address 0x3f00000
[    1.074984] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    1.093443] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.104948] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.134261] io scheduler noop registered
[    1.141907] io scheduler deadline registered (default)
[    1.152969] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.166616] console [ttyS0] disabled
[    1.173609] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[    1.193384] console [ttyS0] enabled
[    1.193384] console [ttyS0] enabled
[    1.207155] bootconsole [early0] disabled
[    1.207155] bootconsole [early0] disabled
[    1.223589] cacheinfo: Failed to find cpu0 device node
[    1.233860] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    1.250494] spi spi0.0: force spi mode3
[    1.258992] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    1.268831] 9 fixed-partitions partitions found on MTD device spi0.0
[    1.281492] Creating 9 MTD partitions on "spi0.0":
[    1.291053] 0x000000000000-0x000000030000 : "u-boot"
[    1.301893] 0x000000030000-0x000000040000 : "u-boot-env"
[    1.313411] 0x000000040000-0x000000048000 : "Factory"
[    1.324481] 0x000000048000-0x000000050000 : "iNIC_rf"
[    1.335451] 0x000000050000-0x000000070000 : "NoUsed"
[    1.346240] 0x000000070000-0x000000724000 : "firmware"
[    1.361495] 2 uimage-fw partitions found on MTD device firmware
[    1.373360] Creating 2 MTD partitions on "firmware":
[    1.383268] 0x000000000000-0x00000017ff00 : "kernel"
[    1.394103] 0x00000017ff00-0x0000006b4000 : "rootfs"
[    1.404891] mtd: device 7 (rootfs) set to be root filesystem
[    1.417780] 1 squashfs-split partitions found on MTD device rootfs
[    1.430170] 0x00000051c000-0x0000006b4000 : "rootfs_data"
[    1.441868] 0x000000724000-0x0000007b0000 : "manufacture"
[    1.453527] 0x0000007b0000-0x0000007c0000 : "backup"
[    1.464422] 0x0000007c0000-0x000000800000 : "storage"
[    1.476152] libphy: Fixed MDIO Bus: probed
[    1.494665] libphy: mdio: probed
[    1.505816] mtk_soc_eth 10100000.ethernet: using fixed link parameters
[    1.520905] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[    1.543657] mtk_soc_eth 10100000.ethernet: loaded mt7530 driver
[    1.556146] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    1.573158] rt2880_wdt 10000120.watchdog: Initialized
[    1.584634] NET: Registered protocol family 10
[    1.598207] Segment Routing with IPv6
[    1.605689] NET: Registered protocol family 17
[    1.614607] 8021q: 802.1Q VLAN Support v1.8
[    1.640878] VFS: Mounted root (squashfs filesystem) readonly on device 31:7.
[    1.655983] Freeing unused kernel memory: 184K
[    1.664861] This architecture does not have kernel memory protection.
[    2.884162] random: fast init done
[    3.376096] init: Console is alive
[    3.383103] init: - watchdog -
[    5.216454] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    5.602456] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.618831] init: - preinit -
[    7.679126] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex)
[    7.695385] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    7.707063] 8021q: adding VLAN 0 to HW filter on device eth0
[    7.718617] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3[    7.881440] random: procd: uninitialized urandom read (4 bytes read)
] or [4] key and hit [enter] to select the debug level
[    8.333303] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    8.382482] urandom-seed: Seed file not found (/etc/urandom.seed)
[    8.477085] mtk_soc_eth 10100000.ethernet eth0: port 5 link down
[    8.500674] procd: - early -
[    8.506519] procd: - watchdog -
[    8.720075] procd: - watchdog -
[    8.726625] procd: - ubus -
[    8.995261] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.119153] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.132436] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.146130] procd: - init -
Please press Enter to activate this console.
[    9.687288] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.912282] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    9.936696] Loading modules backported from Linux version v4.19.7-0-g61c68f2a2af0
[    9.951681] Backport generated by backports.git v4.19.7-1-0-g148b072d
[    9.969253] ip_tables: (C) 2000-2006 Netfilter Core Team
[    9.991331] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[   10.240395] xt_time: kernel timezone is -0000
[   10.405310] mt76x2e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[   10.417917] mt76x2e 0000:01:00.0: ASIC revision: 76120044
[   10.616088] mt76x2e 0000:01:00.0: ROM patch build: 20141115060606a
[   10.634389] mt76x2e 0000:01:00.0: Firmware Version: 0.0.00
[   10.645359] mt76x2e 0000:01:00.0: Build: 1
[   10.653512] mt76x2e 0000:01:00.0: Build Time: 201507311614____
[   10.670106] mt76x2e 0000:01:00.0: Firmware running!
[   10.706126] PPP generic driver version 2.4.2
[   10.723773] NET: Registered protocol family 24
[   10.833645] rt2800_wmac 10180000.wmac: loaded eeprom from mtd device "Factory"
[   10.848119] ieee80211 phy1: rt2x00_set_rt: Info - RT chipset 6352, rev 0500 detected
[   10.863584] ieee80211 phy1: rt2x00_set_rf: Info - RF chipset 7620 detected
[   10.976473] kmodloader: done loading kernel modules from /etc/modules.d/*
[   12.379026] urandom_read: 5 callbacks suppressed
[   12.379035] random: jshn: uninitialized urandom read (4 bytes read)
[   29.231715] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   29.285994] jffs2_build_filesystem(): unlocking the mtd device... 
[   29.286009] done.
[   29.302226] jffs2_build_filesystem(): erasing all blocks after the end marker... 
[   29.579476] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex)
[   29.610524] 8021q: adding VLAN 0 to HW filter on device eth0
[   29.805068] br-lan: port 1(eth0.1) entered blocking state
[   29.815907] br-lan: port 1(eth0.1) entered disabled state
[   29.827089] device eth0.1 entered promiscuous mode
[   29.836692] device eth0 entered promiscuous mode
[   30.020666] br-lan: port 1(eth0.1) entered blocking state
[   30.031498] br-lan: port 1(eth0.1) entered forwarding state
[   30.042845] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   30.611535] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   53.338536] done.
[   53.342445] jffs2: notice: (1277) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   54.227888] overlayfs: upper fs does not support tmpfile.
[   66.595958] random: crng init done



BusyBox v1.29.3 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r0+8851-5827264d5b
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# ubus call system board
{
        "kernel": "4.14.89",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7620A ver:2 eco:6",
        "model": "I-O DATA WN-AC1167GR",
        "board_name": "iodata,wn-ac1167gr",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r0+8851-5827264d5b",
                "target": "ramips\/mt7620",
                "description": "OpenWrt SNAPSHOT r0+8851-5827264d5b"
        }
}