WRC-1167FS fwhandleコマンドメモ

メーカーファームウェアにて、投入されたファームウェアのdecodeを行う fwhandle コマンドのメモ。

/tmp # tftp -r wrc-1167fs_v1.03.bin 192.168.1.133 -g
wrc-1167fs_v1.03.bin 100% |*******************************|  6080k  0:00:00 ETA
/tmp # ls -alh
drwxrwxrwx    3 root     root           0 Sep 14 22:38 .
drwxr-xr-x   17 root     root           0 Sep 14 22:38 ..
-rw-r--r--    1 root     root           5 Sep 14 22:36 dhcpc.lease
-rw-r--r--    1 root     root           3 Sep 14 22:36 dns.suffix
drwxr-xr-x    5 root     root           0 Jan  1  2017 nginx
-rw-r--r--    1 root     root        5.9M Sep 14 22:38 wrc-1167fs_v1.03.bin
/tmp # fwhandle
usage:    head    [-h?]      -h This help
  -s    Source filename
  -d    Destination filename
  -a    Auto set parameter
  -t    Types:    
            bootloader (0)
            state_config (2)
            kernel (3)
            kernel_elecom1700 (5)
            kernel_elecom1701 (6)
            config (1)
            token (4)
  -x    Recovery MD5 file [-u ih_magic]
  -v    FW Version
 -D     Build date
/tmp # fwhandle -t kernel_elecom1701 -x wrc-1167fs_v1.03.bin 
------- ELECOM1701 Header Info
Image Header Size      : 0x0038
Image Header ID        : ELECOM
Image Product Name     : WRC-1167FS
Image Version          : 1.03
------------------------------
------- Header Info
Image Header Size      : 0x0074
Image Header Magic Code: 0x031d6129
Image Data Size        : 6225920
Image Type             : 0x6 [kernel_elecom1701]
Compression Type       : 0x0
Model ID               : 0x00228000
Build Date             : 2017-10-16
Version Firmware       : 1.03
Version Code SCM       : 0abafddb6
Version Config         : e46a8e6df70adbb54129ee057f1ffd35
Data CRC Checksum      : 0x30C2B056
Header CRC Checksum    : 0xff9
------------------------------
FWHANDLE, DECODE PASS
/tmp # ls -alh
drwxrwxrwx    3 root     root           0 Sep 14 22:39 .
drwxr-xr-x   17 root     root           0 Sep 14 22:38 ..
-rw-r--r--    1 root     root           5 Sep 14 22:36 dhcpc.lease
-rw-r--r--    1 root     root           3 Sep 14 22:36 dns.suffix
drwxr-xr-x    5 root     root           0 Jan  1  2017 nginx
-rw-r--r--    1 root     root        5.9M Sep 14 22:39 wrc-1167fs_v1.03.bin.bin

WRC-1167FS

以前から気になってはいた機種。FE止まりであること、最近製造終了となったことから躊躇していたが、Twitterでアンケートを取ってみたところWN-AG600DGRよりも先に票が入ったので今回やることにして確保した。
弄っていくのでメモ。

Switch

zone WAN LAN
port
(WRC-1167FS)
INTERNET LAN
port
(MT7628A)
port4 port3

MAC

  • LAN: BC:5C:4C:xx:xx:68 (Config, ethaddr (text) / Factory, 0x28 (hex))
  • WAN: BC:5C:4C:xx:xx:69 (Config, wanaddr (text) / Factory, 0x22 (hex))
  • 2.4G: BC:5C:4C:xx:xx:6A (Config, rmac (text) / Factory, 0x4 (hex))
  • 5G: BC:5C:4C:xx:xx:6B (Config, rmac2 (text) / Factory, 0x8004 (hex))

U-Boot

help

MT7628 # help
?       - alias for 'help'
bootm   - boot application image from memory
cp      - memory copy
erase   - erase SPI FLASH memory
go      - start application at address 'addr'
help    - print online help
loadb   - load binary file over serial line (kermit mode)
md      - memory display
mdio   - Ralink PHY register R/W command !!
mm      - memory modify (auto-incrementing)
nm      - memory modify (constant address)
printenv- print environment variables
reset   - Perform RESET of the CPU
rf      - read/write rf register
saveenv - save environment variables to persistent storage
setenv  - set environment variables
spi     - spi command
tftpboot- boot image via network using TFTP protocol
version - print monitor version

version

MT7628 # version

U-Boot 1.1.3 (Oct 23 2017 - 16:14:35)

printenv

MT7628 # printenv
state=N
sn=7BL087007847A
ethaddr=BC:5C:4C:**:**:68
wanaddr=BC:5C:4C:**:**:69
rmac=BC:5C:4C:**:**:6A
rmac2=BC:5C:4C:**:**:6B
rdn=1
rdn2=1
rkey=************
rkey2=************
hver=1.0
BootType=3
bootdelay=1
ipaddr=192.168.2.1
serverip=192.168.2.10
bootfile=WRC-1167FS_uImage
rcn=JP
rcn2=JP
stdin=serial
stdout=serial
stderr=serial

Environment size: 330/4092 bytes

Kernel

コンソールにパスワードが掛けられている。

uname -a

/ # uname -a
sh: uname: not found

cat /proc/version

/ # cat /proc/version
Linux version 3.10.14 (root@***-DEV-****) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 Wed Oct 11 21:04:36 CST 2017

cat /proc/cpuinfo

/ # cat /proc/cpuinfo
system type             : MT7628
machine                 : Unknown
processor               : 0
cpu model               : MIPS 24KEc V5.5
BogoMIPS                : 382.46
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

cat /proc/meminfo

/ # cat /proc/meminfo
MemTotal:          61440 kB
MemFree:           31888 kB
Buffers:            2744 kB
Cached:             9328 kB
SwapCached:            0 kB
Active:             4224 kB
Inactive:          10416 kB
Active(anon):       2568 kB
Inactive(anon):      224 kB
Active(file):       1656 kB
Inactive(file):    10192 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          2584 kB
Mapped:             1552 kB
Shmem:               224 kB
Slab:               3576 kB
SReclaimable:        536 kB
SUnreclaim:         3040 kB
KernelStack:         376 kB
PageTables:          404 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       30720 kB
Committed_AS:       7312 kB
VmallocTotal:    1048372 kB
VmallocUsed:        7304 kB
VmallocChunk:    1036944 kB

cat /proc/mtd

/ # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 01000000 00010000 "all"
mtd1: 00030000 00010000 "Boot"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00730000 00010000 "Kernel"
mtd5: 00590000 00010000 "user"
mtd6: 00080000 00010000 "storage"

switch vlan dump

/ # switch vlan dump
idx   vid  portmap
  0     1  ----1-1
  1     2  1111-11
  2     3  1111111
  3     4  1111111
  4     5  1111111
  5     6  1111111
  6     7  1111111
  7     8  1111111
  8     9  1111111
  9    10  1111111
 10    11  1111111
 11    12  1111111
 12    13  1111111
 13    14  1111111
 14    15  1111111
 15    16  1111111

ls -alh /sys/class/leds/

/ # ls -alh /sys/class/leds/
drwxr-xr-x    2 root     root           0 Sep 13 21:33 .
drwxr-xr-x   17 root     root           0 Sep 13 21:33 ..
lrwxrwxrwx    1 root     root           0 Sep 13 21:33 lan_led -> ../../devices/platform/leds-gpio/leds/lan_led
lrwxrwxrwx    1 root     root           0 Sep 13 21:33 power_led -> ../../devices/platform/leds-gpio/leds/power_led
lrwxrwxrwx    1 root     root           0 Sep 13 21:33 radio1_led -> ../../devices/platform/leds-gpio/leds/radio1_led
lrwxrwxrwx    1 root     root           0 Sep 13 21:33 radio2_led -> ../../devices/platform/leds-gpio/leds/radio2_led
lrwxrwxrwx    1 root     root           0 Sep 13 21:33 wan_led -> ../../devices/platform/leds-gpio/leds/wan_led
lrwxrwxrwx    1 root     root           0 Sep 13 21:33 wps_led -> ../../devices/platform/leds-gpio/leds/wps_led

ls -alh /sys/devices/platform/gpio-keys-polled/

/ # ls -alh /sys/devices/platform/gpio-keys-polled/
drwxr-xr-x    2 root     root           0 Jan  1  2017 .
drwxr-xr-x    7 root     root           0 Jan  1  2017 ..
lrwxrwxrwx    1 root     root           0 Sep 13 21:36 driver -> ../../../bus/platform/drivers/gpio-keys-polled
-r--r--r--    1 root     root        4.0K Sep 13 21:36 modalias
-r--r--r--    1 root     root        4.0K Jan  1  2017 op1
-r--r--r--    1 root     root        4.0K Sep 13 21:36 reset
lrwxrwxrwx    1 root     root           0 Sep 13 21:36 subsystem -> ../../../bus/platform
-rw-r--r--    1 root     root        4.0K Sep 13 21:36 uevent
-r--r--r--    1 root     root        4.0K Sep 13 21:36 wps

bootlog

[04050C09][04050C09]
DDR Calibration DQS reg = 00008787


U-Boot 1.1.3 (Oct 23 2017 - 16:14:35)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fa0000
******************************
Software System Reset Occurred
******************************
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
============================================ 
Ralink UBoot Version: 5.0.0.0
-------------------------------------------- 
ASIC 7628_MP (Port5None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Oct 23 2017  Time:16:14:35
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 580 MHZ #### 
 estimate memory size = 64 Mbytes
RESET MT7628 PHY!!!!!!
Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP. 
default: 3                                                                                                                 0 
   
3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1646919 Bytes =  1.6 MB
   Load Address: 80000000
   Entry Point:  802b04a0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 802b04a0) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 3.10.14 (root@***-DEV-****) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 Wed Oct 11 21:04:36 CST 2017
[    0.000000] 
[    0.000000]  The CPU feqenuce set to 575 MHz
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] Software DMA cache coherency
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00057710
[    0.000000] Readback ErrCtl register=00057710
[    0.000000] Memory: 59744k/65536k available (2784k kernel code, 5792k reserved, 447k data, 1696k init, 0k highmem)
[    0.000000] NR_IRQS:128
[    0.000000] console [ttyS1] enabled
[    0.096000] Calibrating delay loop... 382.46 BogoMIPS (lpj=764928)
[    0.128000] pid_max: default: 32768 minimum: 301
[    0.132000] Mount-cache hash table entries: 512
[    0.136000] NET: Registered protocol family 16
[    0.140000] RALINK_GPIOMODE = 54050444 
[    0.144000] RALINK_GPIOMODE = 54044444 
[    0.244000] ***** Xtal 40MHz *****
[    0.248000] start PCIe register access
[    0.748000] RALINK_RSTCTRL = 2400000
[    0.752000] RALINK_CLKCFG1 = fdbfffc0
[    0.756000] 
[    0.756000] *************** MT7628 PCIe RC mode *************
[    1.256000] PCIE0 enabled
[    1.260000] Port 0 N_FTS = 1b105000
[    1.264000] init_rt2880pci done
[    1.280000] bio: create slab  at 0
[    1.284000] PCI host bridge to bus 0000:00
[    1.288000] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    1.292000] pci_bus 0000:00: root bus resource [io  0x10160000-0x1016ffff]
[    1.296000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.300000] pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
[    1.304000] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    1.308000] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[    1.312000] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    1.316000] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[    1.320000] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[    1.324000] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.328000] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
[    1.332000] pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
[    1.336000] BAR0 at slot 0 = 0
[    1.340000] bus=0x0, slot = 0x0
[    1.344000] res[0]->start = 0
[    1.348000] res[0]->end = 0
[    1.352000] res[1]->start = 20200000
[    1.356000] res[1]->end = 2020ffff
[    1.360000] res[2]->start = 0
[    1.364000] res[2]->end = 0
[    1.368000] res[3]->start = 0
[    1.372000] res[3]->end = 0
[    1.376000] res[4]->start = 0
[    1.380000] res[4]->end = 0
[    1.384000] res[5]->start = 0
[    1.388000] res[5]->end = 0
[    1.392000] bus=0x1, slot = 0x0
[    1.396000] res[0]->start = 20000000
[    1.400000] res[0]->end = 200fffff
[    1.404000] res[1]->start = 0
[    1.408000] res[1]->end = 0
[    1.412000] res[2]->start = 0
[    1.416000] res[2]->end = 0
[    1.420000] res[3]->start = 0
[    1.424000] res[3]->end = 0
[    1.428000] res[4]->start = 0
[    1.432000] res[4]->end = 0
[    1.436000] res[5]->start = 0
[    1.440000] res[5]->end = 0
[    1.444000] cfg80211: Calling CRDA to update world regulatory domain
[    1.448000] Switching to clocksource MIPS
[    1.452000] NET: Registered protocol family 2
[    1.464000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    1.476000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    1.488000] TCP: Hash tables configured (established 512 bind 512)
[    1.500000] TCP: reno registered
[    1.508000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.520000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.532000] NET: Registered protocol family 1
[    1.568000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.580000] jffs2: version 2.2. (NAND) (ZLIB) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.596000] msgmni has been set to 116
[    1.604000] io scheduler noop registered (default)
[    1.620000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.636000] serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
[    1.648000] serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
[    1.676000] brd: module loaded
[    1.684000] flash manufacture id: ef, device id 40 18
[    1.692000] W25Q128BV(ef 40180000) (16384 Kbytes)
[    1.700000] mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
[    1.720000] Creating 7 MTD partitions on "raspi":
[    1.732000] 0x000000000000-0x000001000000 : "all"
[    1.740000] 0x000000000000-0x000000030000 : "Boot"
[    1.752000] 0x000000030000-0x000000040000 : "Config"
[    1.764000] 0x000000040000-0x000000050000 : "Factory"
[    1.776000] 0x000000050000-0x000000780000 : "Kernel"
[    1.788000] 0x0000001f0000-0x000000780000 : "user"
[    1.800000] 0x000000780000-0x000000800000 : "storage"
[    1.812000] IMQ driver loaded successfully. (numdevs = 2, numqueues = 1)
[    1.828000]  Hooking IMQ before NAT on PREROUTING.
[    1.836000]  Hooking IMQ after NAT on POSTROUTING.
[    1.844000] PPP generic driver version 2.4.2
[    1.856000] PPP MPPE Compression module registered
[    1.864000] NET: Registered protocol family 24
[    1.872000] rdm_major = 253
[    1.880000] nf_conntrack version 0.5.0 (933 buckets, 3732 max)
[    1.892000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.904000] Type=Linux
[    1.908000] TCP: cubic registered
[    1.916000] NET: Registered protocol family 17
[    1.924000] 8021q: 802.1Q VLAN Support v1.8
[    1.944000] Freeing unused kernel memory: 1696K (80328000 - 804d0000)
[    1.964000] Algorithmics/MIPS FPU Emulator v1.5
Sun Jan  1 00:00:00 UTC 2017
[    2.152000] Registered button device:reset, gpio:5,code:408,index:1
[    2.164000] Registered button device:wps, gpio:38,code:529,index:0
[    2.176000] Registered button device:opmode_1, gpio:4,code:747,index:2
[    2.196000] CLI_EXCHANGE, Load cli_exchange[v0.1.0] ready.
[    2.276000] GMAC1_MAC_ADRH -- : 0x0000bc5c
[    2.284000] GMAC1_MAC_ADRL -- : 0x4cb02368
[    2.292000] Ralink APSoC Ethernet Driver Initilization. v3.1  512 rx/tx descriptors allocated, mtu = 1500!
[    2.312000] GMAC1_MAC_ADRH -- : 0x0000bc5c
[    2.320000] GMAC1_MAC_ADRL -- : 0x4cb02368
[    2.340000] PROC INIT OK!
[    2.396000] FFFFFFBC:5C:4C:FFFFFFB0:23:68
[    2.404000] Raeth v3.1 ()
[    2.412000] 
[    2.412000] phy_tx_ring = 0x03556000, tx_ring = 0xa3556000
[    2.428000] 
[    2.428000] phy_rx_ring0 = 0x03580000, rx_ring[0] = 0xa3580000
[    2.440000] 
[    2.440000] phy_rx_ring0 = 0x03580000, rx_ring[0] = 0xa3580000
[    2.472000] GMAC1_MAC_ADRH -- : 0x0000bc5c
[    2.480000] GMAC1_MAC_ADRL -- : 0x4cb02368
[    2.488000] RT305x_ESW: Link Status Changed
[    2.500000] Set Port 0 Disabled
[    2.508000] Set Port 1 Disabled
[    2.520000] Set Port 2 Disabled
[    2.528000] Set Port 3 Disabled
[    2.540000] Set Port 4 Disabled
[    2.548000] Set Port 4 Enabled, 1000 Mbps
[    2.560000] Set Port 3 Enabled, 1000 Mbps
ln: /lib/./modules: File exists
### Radio 1 wps ----> 1
### Radio 2 wps ----> 1
/sbin/uwcd: '/lib/' is not an ELF file
Vendor Probe Success --> MTK API v0.1
Radio Number from CFG --> [2]
UWCD ctrl iface: /var/sysuwcd/if0
SEM_GETID got id -1
Sun Jan  1 00:00:00 UTC 2017
[    3.196000] device eth2 entered promiscuous mode
sysctl: write error: Invalid argument
ra0       no private ioctls.

ra1       no private ioctls.

ra2       no private ioctls.

rai0      no private ioctls.

rai1      no private ioctls.

[    3.340000] device eth2.2 entered promiscuous mode
[    3.352000] br0: port 1(eth2.2) entered forwarding state
[    3.360000] br0: port 1(eth2.2) entered forwarding state
[    3.380000] device eth2.1 entered promiscuous mode
[    3.388000] br0: port 2(eth2.1) entered forwarding state
[    3.400000] br0: port 2(eth2.1) entered forwarding state
info, udhcpc (v0.9.9-pre) started
debug, Entering released state
debug, Performing a DHCP renew
[Recv CMD] open_radio all
[Reply CMD] OK

crontab: can't open 'root': No such file or directory
[lltd_open:53] lltd_open.
[lltd_open:58] finish the upnpd open .
    ________________________________________________________________________________

     .-') _                   (`\ .-') /`      .-. .-')                ) (`-.   
    (  OO) )    .-----.        `.( OO ),'      \  ( OO )                ( OO ).   
    /     '._  /  .-.  \    ,--./  .--.         ;-----.\   .-'),-----. (_/.  \_)-. 
    |'--...__) |  \_.' /    |      |  |         | .-.  |  ( OO'  .-.  ' \  `.'  /  
    '--.  .--' /  .-. ',-.  |  |   |  |,        | '-' /_) /   |  | |  |  \     /\  
       |  |    | |   | . /_ |  |.'.|  |_)       | .-. `.  \_) |  |\|  |   \   \ |  
       |  |    \  '-'  _.__)|         |         | |  \  |   \ |  | |  |  .'    \_) 
       |  |     `----''     |   ,'.   |         | '--'  /    `'  '-'  ' /  .'.  \  
       `--'                 '--'   '--'         `------'       `-----' '--'   '--' 
    ________________________________________________________________________________

FW version: 1.02, SCM version: 129e08ebd, Date: 2017-10-11
Login > spawn-fcgi: child spawned successfully: PID: 525
spawn-fcgi: child spawned successfully: PID: 527
spawn-fcgi: child spawned successfully: PID: 528
spawn-fcgi: child spawned successfully: PID: 529
spawn-fcgi: child spawned successfully: PID: 530
spawn-fcgi: child spawned successfully: PID: 531
[    4.960000] register rt2860
[    4.976000] 
[    4.976000] 
[    4.976000] === pAd = c0501000, size = 2166808 ===
[    4.976000] 
[    4.996000] rlt_wlan_chip_onoff(): OnOff:1, Reset= 1, pAd->WlanFunCtrl:0x0, Reg-WlanFunCtrl=0x20a
[    5.052000] RtmpChipOpsEepromHook::e2p_type=0, inf_Type=5
[    5.064000] RtmpEepromGetDefault::e2p_dafault=2
[    5.076000] RtmpEepromTypeAdjust:: eeFlashId = 0x7662.
[    5.084000] NVM is FLASH mode (pAd->flash_offset = 0x8000)
[    5.096000] get_dev_name_prefix(): dev_idx = 1, dev_name_prefix=rai
[    6.196000] build time = 
[    6.200000] 20141115060606a
[    6.208000] rom patch for E3 IC
[    6.212000] 
[    6.216000] platform = 
[    6.220000] ALPS
[    6.224000] hw/sw version = 
[    6.228000] 
[    6.232000] patch version = 
[    6.240000] 
[    6.256000] FW Version:0.0.00 Build:1
[    6.260000] Build Time:201507311614____
[    6.268000] fw for E3 IC
[    6.292000] RX[0] DESC a3778000 size = 4096
[    6.300000] RX[1] DESC a3779000 size = 4096
[    6.316000] E2pAccessMode=2
[    6.324000] cfg_mode=14
[    6.328000] cfg_mode=14
[    6.332000] wmode_band_equal(): Band Not Equal!
[    6.572000] 1. Phy Mode = 49
[    6.576000] get_chl_grp:illegal channel (167)
[    6.588000] get_chl_grp:illegal channel (167)
[    6.596000] get_chl_grp:illegal channel (169)
[    6.604000] get_chl_grp:illegal channel (169)
[    6.612000] get_chl_grp:illegal channel (171)
[    6.620000] get_chl_grp:illegal channel (171)
[    6.628000] /builds/f13216d0/0/TNW/TWB1709/PKGS_MTK/MT76x2E_V3.0.4.x/rlt_wifi_ap/../rlt_wifi/chips/mt76x2.c:2899 assert (ad->TxPower[choffset].Channel == 42)failed
[    6.660000] Country Region from e2p = ffff
[    6.668000] mt76x2_read_temp_info_from_eeprom:: is_temp_tx_alc=0, temp_tx_alc_enable=0
[    6.684000] mt76x2_read_tx_alc_info_from_eeprom:: is_ePA_mode=0, ePA_type=3
[    6.696000] mt76x2_read_tx_alc_info_from_eeprom:: [5G band] high_temp_slope=0, low_temp_slope=0
[    6.716000] mt76x2_read_tx_alc_info_from_eeprom:: [2G band] high_temp_slope=0, low_temp_slope=0
[    6.732000] mt76x2_read_tx_alc_info_from_eeprom:: [5G band] tc_lower_bound=0, tc_upper_bound=0
[    6.748000] mt76x2_read_tx_alc_info_from_eeprom:: [2G band] tc_lower_bound=0, tc_upper_bound=0
[    6.764000] mt76x2_get_external_lna_gain::LNA type=0x11, BLNAGain=0x0, ALNAGain0=0x0, ALNAGain1=0x0, ALNAGain2=0x0
[    6.788000] 2. Phy Mode = 49
[    6.792000] 3. Phy Mode = 49
[    6.800000] andes_pci_fw_init
[    6.804000] 0x1300 = 00073200
[    6.836000] AntCfgInit: primary/secondary ant 0/1
[    6.844000] andes_load_cr:cr_type(2)
[    6.864000] ChipStructAssign(): MT76x2 hook !
[    6.872000] RTMPSetPhyMode: channel is out of range, use first channel=36 
[    6.884000] MCS Set = ff ff 00 00 01
[    6.992000] TX0 power compensation = 0x38
[    7.000000] TX1 power compensation = 0x38
[   12.060000] mt76x2_bbp_adjust():rf_bw=2, ext_ch=1, PrimCh=52, HT-CentCh=54, VHT-CentCh=58
[   12.124000] APStartUp(): AP Set CentralFreq at 58(Prim=52, HT-CentCh=54, VHT-CentCh=58, BBP_BW=2)
[   12.148000] mt76x2_calibration():RDMode  is in Silent State, do not calibration.
[   12.164000] The 4-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 4
[   12.180000] Main bssid = bc:5c:4c:b0:23:6b
[   12.188000] mt76x2_reinit_agc_gain:original agc_vga0 = 0x5c, agc_vga1 = 0x5c
[   12.200000] mt76x2_reinit_agc_gain:updated agc_vga0 = 0x5c, agc_vga1 = 0x5c
[   12.216000] mt76x2_reinit_hi_lna_gain:original hi_lna0 = 0x27, hi_lna1 = 0x27
[   12.228000] mt76x2_reinit_hi_lna_gain:updated hi_lna0 = 0x27, hi_lna1 = 0x27
[   12.244000] original vga value(chain0) = 5c
[   12.252000] original vga value(chain1) = 5c
[   12.260000] 
[   15.168000] MtAsicInitMac()-->
[   15.176000] mt7628_init_mac_cr()-->
[   15.180000] MtAsicSetMacMaxLen(1276): Set the Max RxPktLen=1024!
[   15.192000]  Initialize FT KDP Module...
[   20.724000] Main bssid = bc:5c:4c:b0:23:6a
[   20.732000] 
[   20.752000] @@@ ed_monitor_exit : CommonCfg.CountryCode = JP  
[   20.788000] mt7628_set_ed_cca: TURN OFF NBID mac 0x10610 = 0x36a1282a
[   20.800000] WiFi Startup Cost (ra0): 6.516s
[   20.816000] device ra0 entered promiscuous mode
[   20.824000] br0: port 4(ra0) entered forwarding state
[   20.836000] br0: port 4(ra0) entered forwarding state
brctl: bridge br_guest0: No such device
ubox_if_is_existed: interface is NULL!
[   20.872000] Set_ed_chk_proc()::ed_chk=1
[   20.880000] mt7628_set_ed_cca: TURN ON EDCCA mac 0x10618 = 0xd7c87d0f, EDCCA_Status=1
[   20.896000] mt7628_set_ed_cca: pAd->CommonCfg.CountryCode = JP  
[   20.908000] mt7628_set_ed_cca: TURN OFF NBID mac 0x10610 = 0x36a1282a
[   20.944000] 
[   20.944000] ====
[   20.944000] @@@ ed_status_read: EDCCA TH - H
[   20.944000] pAd->ed_trigger_cnt : 1 > 20 ||  pAd->ed_big_rssi_stat : 0 < 50
[   20.944000] ====
ntp.nict.jp: Unknown host
[   27.360000] br0: port 3(rai0) entered forwarding state
[   35.872000] br0: port 4(ra0) entered forwarding state
ntp.nict.jp: Unknown host
ntp.nict.jp: Unknown host
[   79.120000] mt76x2_calibration(channel = 58)
ntp.nict.jp: Unknown host
ntp.nict.jp: Unknown host

Firmware Upgrade Log

43719 53987.583   31024.0      0.8  -974121.6      0.0         0
------- ELECOM1701 Header Info
Image Header Size      : 0x0038
Image Header ID        : ELECOM
Image Product Name     : WRC-1167FS
Image Version          : 1.03
------------------------------
------- Header Info
Image Header Size      : 0x0074
Image Header Magic Code: 0x031d6129
Image Data Size        : 6225920
Image Type             : 0x6 [kernel_elecom1701]
Compression Type       : 0x0
Model ID               : 0x00228000
Build Date             : 2017-10-16
Version Firmware       : 1.03
Version Code SCM       : 0abafddb6
Version Config         : e46a8e6df70adbb54129ee057f1ffd35
Data CRC Checksum      : 0x30C2B056
Header CRC Checksum    : 0xff9
------------------------------
FWHANDLE, DECODE PASS
Erasing blocks: 95/95 (100%)
Writing data: 6080k/6080k (100%)
Verifying data: 6080k/6080k (100%)
The system is going down NOW!
Received a SIGTERM
debug, Received SIGTERM
Sent SIGKILL to all processes
Requesting system reboot
[  243.244000] Restarting system.

WXR-2533DHPのブート不可問題あれこれ

5chでの報告によって気付き対処にあたった、WXR-2533DHPが最近のファームではブートしなくなっていた問題についての備忘録。

発端

5chのOpenWrt現行スレにて、 “最新のsnapshotでブートできない” と書き込みがあり、2019/09/06 0時頃スレを見に行った際それに気付いた。

原因予想

そこから寝るまで、あれこれ思考開始。とりあえず思い当たるところを色々考えつつ、 openwrt/openwrt のcommitを target/linux/ipq806x 中心に見てみる。
が、特にブートを阻害するような変更は見つからず。

WXR-2533DHPはブート時にU-BootがRootFSの末尾に付加されるchecksumをチェックし、それがRootFSから実際に算出した値と一致していれば正常としてブートを行う。全く確証は無いものの、これで問題が起きている可能性もあるかなーとぼんやり。

しかしながら、 downloads.openwrt.org からダウンロードしてきたイメージをtarで展開し、 “root” を確認しても末尾のチェックサムは正しく付加されており、手元で実際に算出した値とも一致した。わけわかめ。

実機検証

2019/09/06は外出から帰宅後気力が尽きており、検証は7日に持ち越し。

翌7日にWXR-2533DHPを引っ張り出し、OpenWrt公式のイメージを使用してFlashに書き込みブートを試行。すると、以下のエラーによりU-BootがOpenWrtのブートに失敗していた。

Hit any key to stop autoboot:  0 
Checking Bank1 Image ... 
Creating 1 MTD partitions on "nand0":
0x000000000000-0x000004000000 : "mtd=0"
Rootfs Checksum Error
Bank1 Image is fail

U-BootがNAND Flashに2組格納されているOSイメージのうち最初の “Bank1” をチェックした際、RootFSのchecksumが正しくないとしてエラーを吐いていた。
本来ならば “Bank2” も存在するためメーカーファームではBank2から正常なファームウェアがBank1へ書き込まれて復旧しブートするが、OpenWrtでは諸事情によりファームウェアのアップグレード時にBank2については消去を行っている。このため、上記ログの後Bank2のチェックに移るが、Bank2も正常ではないため結局どうにもできず、WXR-2533DHPのLANポートに何らかの接続がある場合はTFTPによる待ち受けが開始され、無ければそのまま再起動される。

原因探し/特定

ブートできない問題が何故引き起こされているのかは分かったが、それの原因についてはこの時点では未だ不明。
NAND Flash内にUBIによってボリュームが作成される際、checksumがボリューム内の最後に来なければならないのかと推測したものの、WXR-2533DHPのサポート作業初期に取ったメーカーファームのバックアップを確認したところ、特に最後ではなかった。残念。

とここで、問題のあるOpenWrtファームウェアとバックアップ済みのメーカーファームで、RootFS内のchecksumの位置が異なることに気付く。メーカーファームではRootFSのデータ本体と思われる部分のすぐ後にchecksumが付加されていた

WXR-2533DHP Ver.1.33
末尾 D3 がchecksum

        00010203 04050607 08090A0B 0C0D0E0F  0123456789ABCDEF
E864A0  87A841C7 D8E8DCF2 046C4252 669CC63B  ..A......lBRf..;
E864B0  164BDAC2 3D59E88F A96CD931 92BAF43D  .K..=Y...l.1...=
E864C0  B9EFD51F 0E747DE0 7B5081FC 985296CC  .....t}.{P...R..
E864D0  A245A256 CA52D000 000052A7 91A50001  .E.V.R....R.....
E864E0  9608D020 00003B95 03263E30 0D8B0200  ... ..;..&>0....
E864F0  00000001 595ABC41 E8000000 00006649  ....YZ.A......fI
E86500  E8000000 0000D050 E8000000 00000659  .......P.......Y
E86510  E8000000 0000B860 E8000000 00000480  .......`........
E86520  00000000 1E65E800 00000000 D3        .....e.......   

が、OpenWrtファームウェアではデータ本体部分と思われる後、さらにpaddingと思われる部分が続き、その後ろにchecksumが付加されていた。

問題のあるOpenWrtファームウェア(再現)
末尾 A3 がchecksum

        00010203 04050607 08090A0B 0C0D0E0F  0123456789ABCDEF
BDD4F0  00000000 00000000 00000000 00000000  ................
BDD500  00000000 00000000 00000000 00000000  ................
BDD510  00000000 00000000 00000000 00000000  ................
BDD520  00000000 00000000 00000000 00000000  ................
BDD530  00000000 00000000 00000000 00000000  ................
BDD540  00000000 00000000 00000000 00000000  ................
BDD550  00000000 00000000 00000000 00000000  ................
BDD560  00000000 00000000 00000000 00000000  ................
BDD570  A3                                   .       

で、確かsquashfsはヘッダ内にsquashfsのサイズ値を持っていたはず…と思い出し、binwalkで確認したところ、メーカーファームではsquashfsのサイズ値とchecksumのoffsetが一致していた。対照的に問題のあるOpenWrtファームウェアでは、サイズ値とoffsetが一致しない。どうも、paddingされているサイズだけchecksumのoffsetが後ろにズレているのでは…とぼんやり。

とぼんやりしていたら、最近というか少し前くらいにML (openwrt-devel) 辺りで “squashfsのpaddingがどうのこうの” というやり取りがされていたことを思い出した。
たぶん自分には関係ないなと特段気にしてはいなかったが、しばらく見かけていなかったから気になりopenwrt/openwrtのcommitを確認。すると、以下のcommitを見つけた。

build: remove harmful -nopad option from mksquashfs
Fri, 30 Aug 2019 16:52:25 +0200
commit: 1c0290c5cc6258c48b8ba46b4f9c85a21de4f875

機種によっては正しくsquashfsが読み取れずにマウントに失敗し、ブートが止まるらしく、これの解決の為mksquashfsから -nopad オプションが削除されていた。この結果、mksquashfsによりsquashfsが生成される際に、出力データが4KiBで割り切れるサイズまでpaddingされるようになった模様。
ただし、この際問題になるのがsquashfsのヘッダに記録されるサイズ値であり、paddingの有無にかかわらず実データのサイズを格納する模様。その結果、paddingが行われるようになってもpadding前のサイズでサイズ値が記録されてしまい、WXR-2533DHPで必要なRootFS末尾のchecksumのoffsetと合わなくなってしまっていた。
雑に表すと以下のような感じ。

       OpenWrt (incorrect state)                                stock firmware
+---------------------------------------+         +---------------------------------------+
|                                       |         |                                       |
|                                       |         |                                       |
|            squashfs data              |         |            squashfs data              |
|                                       |         |                                       |
|                                       |         |                                       |
|                   +-------------------+         |                   +-------------------+
|                   |                   |         |                   |  |  <- checksum
+-------------------+                   |         +-------------------+--+
|                padding                |
+---------------------------------------+         size value      = data size
|  |  <- checksum                                 checksum offset = data size
+--+
                                                  size value = checksum offset
size value      = data size
checksum offset = data size + padding size

squashfs size ≠ checksum offset

このため、WXR-2533DHPのU-Bootがsquashfsのヘッダに格納されているサイズ値を元に取得したchecksumは末尾に付加された正しいものではなく、paddingにより付加された “0x00” であり、その結果不正なchecksumであるとしてBankのイメージが正しくないと判定されていた。
一旦当該commitをrevertしてビルドしたところ正常にブートしたため、これが原因となっていると確定。

対処

原因となったcommitもトラブルを起こす機種の修正という目的をもって取り込まれたものであり、どちらかというとchecksumを必要とするWXR-2533DHPが特殊であるため、-nopadオプションを削除したcommitはそのままで対処する方針とした。

結局のところsquashfsのヘッダ内に格納されるサイズ値をoffsetとした場所にchecksumが存在していれば良いのであり、その結果ビルド時にsquashfsヘッダからサイズ値を読み取って、そのoffsetにddコマンドでchecksumを埋め込むこととした。

以下は変更内容

WXR-2533DHPのsysupgradeイメージを生成する際squashfsにchecksumを付加するために用意した、既存の Build/buffalo-rootfs-cksum に改変を加える

 target/linux/ipq806x/image/Makefile | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/linux/ipq806x/image/Makefile b/target/linux/ipq806x/image/Makefile
index 81f14b47567..0d704cf8e95 100644
--- a/target/linux/ipq806x/image/Makefile
+++ b/target/linux/ipq806x/image/Makefile
@@ -5,9 +5,11 @@ include $(INCLUDE_DIR)/image.mk
 
 define Build/buffalo-rootfs-cksum
 	( \
-		echo -ne "\x$$(od -A n -t u1 $@ | tr -s ' ' '\n' | \
-			$(STAGING_DIR_HOST)/bin/awk '{s+=$$0}END{printf "%x", 255-s%256}')"; \
-	) >> $@
+		squashfs_size="$$(dd if=$@ bs=4 skip=10 count=1 2> /dev/null | od -An -tu4 | tr -d ' \n')"; \
+		od -An -tu1 $@ | tr -s ' ' '\n' | \
+			$(STAGING_DIR_HOST)/bin/awk '{s+=$$0}END{printf "%c", 255-s%256}' | \
+				dd of=$@ bs=1 seek=$${squashfs_size} count=1 conv=notrunc 2> /dev/null; \
+	)
 endef
 
 define Device/Default

上記を実際にビルドして確認の上、openwrt/openwrtのPRに投げ込んだ。

その後

PRを投げ込んだまでは良かったが、その後なんとなくopenwrt/openwrtのcommitを見に行ったら、なんとまぁ、今回の問題の原因になった -nopad オプションを削除するcommitがrevertされていた。なんてこったい。
どうもsquashfsをpaddingされると今度は別でトラブルが引き起こされる環境が出てくるらしく、それでrevertとなった模様。

結局、投げたPRの方は特段何も無いまま原因が消失してしまったので、そのままクローズ。
あっけなく解決してしまい、えぇ…という感じだけれども、まあ問題は無くなったのだから良し。以上。

WN-AX1167GR2 bootnum, debugflagメモ

WN-DX1167Rとそれぞれ格納場所が同じ

root@WN-AX1167GR2:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 07f80000 00020000 "ALL"
mtd1: 00100000 00020000 "Bootloader"
mtd2: 00100000 00020000 "Ubootenv"
mtd3: 00100000 00020000 "Factory"
mtd4: 03200000 00020000 "firmware"
mtd5: 00100000 00020000 "Config"
mtd6: 03200000 00020000 "firmware_2"
mtd7: 03078908 00020000 "rootfs"
mtd8: 00100000 00020000 "Config_2"
mtd9: 00100000 00020000 "persist"
mtd10: 01480000 00020000 "Backup"
mtd11: 00100000 00020000 "SecondBoot"

bootnum

0x4

root@WN-AX1167GR2:~# mstc_persist read bootnum
2
root@WN-AX1167GR2:~# hexdump -n 128 -C /dev/mtd9
00000000  1b 05 ce 17 02 00 00 00  5d 4b 00 00 66 11 c7 bc  |........]K..f...|
00000010  5d 4b 00 00 66 11 c7 bc  00 00 00 00 00 00 00 00  |]K..f...........|
00000020  00 00 00 00 00 00 00 00  ff ff ff ff ff ff ff ff  |................|
00000030  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000080
root@WN-AX1167GR2:~# mstc_persist write bootnum 1
Unlocking persist ...
root@WN-AX1167GR2:~# hexdump -n 128 -C /dev/mtd9
00000000  1b 05 ce 17 01 00 00 00  5d 4b 00 00 66 11 c7 bc  |........]K..f...|
00000010  5d 4b 00 00 66 11 c7 bc  00 00 00 00 00 00 00 00  |]K..f...........|
00000020  00 00 00 00 00 00 00 00  ff ff ff ff ff ff ff ff  |................|
00000030  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000080

debugflag

0xFE75

root@WN-AX1167GR2:~# sys debugflag
DebugFlag: 0
root@WN-AX1167GR2:~# hexdump -n 128 -C -s $((0xFE00)) /dev/mtd3
0000fe00  4d 69 74 72 61 73 74 61  72 00 54 65 63 68 6e 6f  |Mitrastar.Techno|
0000fe10  6c 6f 67 79 20 43 6f 72  70 2e 00 00 00 00 00 00  |logy Corp.......|
0000fe20  4d 69 43 41 50 2d 33 33  34 30 43 00 00 00 00 00  |MiCAP-3340C.....|
0000fe30  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fe40  31 39 35 36 30 35 32 37  00 00 00 00 00 00 00 00  |19560527........|
0000fe50  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fe60  53 30 39 30 59 30 30 30  30 30 30 30 30 00 00 13  |S090Y00000000...|
0000fe70  49 55 aa 00 04 00 ff ff  5a 59 ff ff 00 00 00 00  |IU......ZY......|
0000fe80
root@WN-AX1167GR2:~# sys debugflag 1
PASS
root@WN-AX1167GR2:~# hexdump -n 128 -C -s $((0xFE00)) /dev/mtd3
0000fe00  4d 69 74 72 61 73 74 61  72 00 54 65 63 68 6e 6f  |Mitrastar.Techno|
0000fe10  6c 6f 67 79 20 43 6f 72  70 2e 00 00 00 00 00 00  |logy Corp.......|
0000fe20  4d 69 43 41 50 2d 33 33  34 30 43 00 00 00 00 00  |MiCAP-3340C.....|
0000fe30  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fe40  31 39 35 36 30 35 32 37  00 00 00 00 00 00 00 00  |19560527........|
0000fe50  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0000fe60  53 30 39 30 59 30 30 30  30 30 30 30 30 00 00 13  |S090Y00000000...|
0000fe70  49 55 aa 00 04 01 ff ff  5a 59 ff ff 00 00 00 00  |IU......ZY......|
0000fe80

WN-AX1167GR2

I-O DATAのMT7621を搭載する(と予想される)現行ミドルレンジ機として、以前より気になっていたもの。某所で2k弱の出品があり、衝動的に購入してしまった。

Switch

zone WAN LAN
port
(WN-AX1167GR2)
インターネット (LAN番号刻印無し)
port
(MT7530)
port0 port1 port2 port3 port4

MAC

  • LAN: 34:76:C5:xx:xx:B0 (Ubootenv, ethaddr (text) / Factory, 0xE000 (hex))
  • WAN: 34:76:C5:xx:xx:B2 (Factory, 0xE006 (hex))
  • 2.4G: 34:76:C5:xx:xx:B0 (Factory, 0x4 (hex))
  • 5G: 34:76:C5:xx:xx:B1 (Factory, 0x8004 (hex))

U-Boot

5chの情報を参考に強引にKernelへログインしたうえでブート時のmtdロックを回避、
sys debugflag 1
を設定してデバッグモードを有効化しZ-Loaderを停止できるように変更。再度ブート時にZ-Loaderに入り、
ATGU
でU-Bootへ移動する

log:

U-Boot 1.1.3 (Dec  9 2016 - 10:20:35)

Board: Ralink APSoC DRAM:  128 MB
relocate_code Pointer at: 87fac000

Config XHCI 40M PLL 
******************************
Software System Reset Occurred
******************************
Allocate 16 byte aligned buffer: 87fdf010
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [01 F1 80 1D 01]
Device found in MTK table, ID: 1f1, EXT_ID: 801d01
Support this Device in MTK table! 1f1 
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
....============================================ 
Ralink UBoot Version: 5.0.0.0
-------------------------------------------- 
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection 
DRAM_TYPE: DDR3 
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Dec  9 2016  Time:10:20:35
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 880 MHZ #### 
 estimate memory size =128 Mbytes
#Reset_MT7530
set LAN/WAN WLLLL
.## Starting application at 0x81E00000 ...


Z-LOADER V1.24 | 12/09/2016 10:20:37


..Hit ESC key to stop autoboot: 1
ZLB> 
ATGO              boot up the whole system
ATGU              go back to U-Boot command line
ATUR              upgrade ras image by console
ATUF              upgrade factory by console
ATNR    x,y       upgrade image by TFTP (x=type[1:ras, 2:bootloader, 3:config, 4:romd 6:factory], y=filename)
ATUX              upgrade bootloader
ATBT    x         block0 write enable (1=enable, 0=disable)
ATEN    x,(y)     set BootExtension Debug Flag (y=password)
ATSE    x         show the seed of password generator
ATWZ    a,(b,c,d) write MAC , Country code, EngDbgFlag, MAC Quantity to FLASH
ATSH              dump manufacturer related data in FLASH
ATBU              dump manufacturer related data in working buffer
ATCB              copy FLASH MRD to working buffer
ATSN    x         set serial number to flash
ATSB              save working buffer to FLASH
ATQY    x         set MAC Quantity to working buffer
ATFL    x         set EngDebugFlag to working buffer
ATCO    x         set country code to working buffer
ATSR              reset
ATRT    (x,y,z,u) RAM read/write test (x=level, y=start addr, z=end addr, u=interations)
ATRM              restore default MRD
ATBR              reset to default Romfile
ATER              erase ROM-D data
ATHV    x         set hardware version to flash
ATGP    x,y       led control
ZLB> ATGU


=>## Application terminated, rc = 0x0

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP.                                                                  4 
You choosed 4
                                                                                                                           0 

   
4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Dec  9 2016 - 10:20:35)
MSTC #

help

MSTC # help
Unknown command 'help' - try 'help'

version

MSTC # version
Unknown command 'version' - try 'help'

printenv

MSTC # printenv
bootcmd=tftp
ipaddr=10.10.10.123
serverip=10.10.10.3
serialnum=BCV0003117O5
countrycode=EA
ethaddr=34:76:C5:**:**:B0
nfLicense=************
wifi2ssid1=IODATA-****b0-2G
wifi2ssid2=IO-Guest-****b0-2G
wifi1ssid1=IODATA-****b0-5G
wifiwpapsk=*************
wifiwpspin=********
wifi1ssid2=IO-Guest-****b0-5G
stdin=serial
stdout=serial
stderr=serial
ethact=Eth0 (10/100-M)

Environment size: 365/131068 bytes

tftp

MSTC # tftp

 KSEG1ADDR(NetTxPacket) = 0xA7FE2FC0 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 ETH_STATE_ACTIVE!! 
*** Warning: no boot file name; using 'test.bin'
Using Eth0 (10/100-M) device
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'test.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80200000
Loading: *
Abort

Kernel

パスワードが設定されており、ログイン不可。
5chの情報を基に強引にログインし、情報を引き出し。

uname -a

root@WN-AX1167GR2:~# uname -a
Linux WN-AX1167GR2 3.10.14 #1 SMP Mon Jun 24 12:41:36 CST 2019 mips GNU/Linux

cat /proc/version

root@WN-AX1167GR2:~# cat /proc/version
Linux version 3.10.14 (*******@srv17) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #1 SMP Mon Jun 24 12:41:36 CST 2019

cat /proc/cpuinfo

root@WN-AX1167GR2:~# cat /proc/cpuinfo
system type             : MT7621
machine                 : Unknown
processor               : 0
cpu model               : MIPS 1004Kc V2.15
BogoMIPS                : 583.68
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VPE                     : 0
VCED exceptions         : not available
VCEI exceptions         : not available

processor               : 1
cpu model               : MIPS 1004Kc V2.15
BogoMIPS                : 583.68
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VPE                     : 1
VCED exceptions         : not available
VCEI exceptions         : not available

processor               : 2
cpu model               : MIPS 1004Kc V2.15
BogoMIPS                : 583.68
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
core                    : 1
VPE                     : 0
VCED exceptions         : not available
VCEI exceptions         : not available

processor               : 3
cpu model               : MIPS 1004Kc V2.15
BogoMIPS                : 583.68
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp mt
shadow register sets    : 1
kscratch registers      : 0
core                    : 1
VPE                     : 1
VCED exceptions         : not available
VCEI exceptions         : not available

cat /proc/meminfo

root@WN-AX1167GR2:~# cat /proc/meminfo
MemTotal:         125220 kB
MemFree:           72232 kB
Buffers:            5508 kB
Cached:            17316 kB
SwapCached:            0 kB
Active:             8824 kB
Inactive:          16244 kB
Active(anon):       3172 kB
Inactive(anon):     1248 kB
Active(file):       5652 kB
Inactive(file):    14996 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          2272 kB
Mapped:             2476 kB
Shmem:              2168 kB
Slab:              12016 kB
SReclaimable:       1820 kB
SUnreclaim:        10196 kB
KernelStack:         528 kB
PageTables:          328 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       62608 kB
Committed_AS:       7996 kB
VmallocTotal:    1048372 kB
VmallocUsed:       11356 kB
VmallocChunk:     987852 kB

cat /proc/mtd

root@WN-AX1167GR2:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 07f80000 00020000 "ALL"
mtd1: 00100000 00020000 "Bootloader"
mtd2: 00100000 00020000 "Ubootenv"
mtd3: 00100000 00020000 "Factory"
mtd4: 03200000 00020000 "firmware"
mtd5: 00100000 00020000 "Config"
mtd6: 03200000 00020000 "firmware_2"
mtd7: 03078908 00020000 "rootfs"
mtd8: 00100000 00020000 "Config_2"
mtd9: 00100000 00020000 "persist"
mtd10: 01480000 00020000 "Backup"
mtd11: 00100000 00020000 "SecondBoot"

ubus call system board

root@WN-AX1167GR2:~# ubus call system board
{
        "kernel": "3.10.14",
        "hostname": "WN-AX1167GR2",
        "system": "MT7621",
        "model": "MiCAP-3323C",
        "release": {
                "distribution": "OpenWrt",
                "version": "1.21.001",
                "revision": "unknown",
                "codename": "barrier_breaker",
                "target": "ramips\/generic",
                "description": "OpenWrt Barrier Breaker 1.21.001"
        }
}

fw_printenv

root@WN-AX1167GR2:~# fw_printenv
bootcmd=tftp
ipaddr=10.10.10.123
serverip=10.10.10.3
stdin=serial
stdout=serial
stderr=serial
serialnum=BCV0003117O5
countrycode=EA
ethaddr=34:76:C5:**:**:B0
nfLicense=************
wifi2ssid1=IODATA-****b0-2G
wifi2ssid2=IO-Guest-****b0-2G
wifi1ssid1=IODATA-****b0-5G
wifiwpapsk=*************
wifiwpspin=********
wifi1ssid2=IO-Guest-****b0-5G

switch –help

root@WN-AX1167GR2:~# switch --help
Usage:
 switch acl etype add [ethtype] [portmap]              - drop etherytype packets
 switch acl dip add [dip] [portmap]                    - drop dip packets
 switch acl dip meter [dip] [portmap][meter:kbps]      - rate limit dip packets
 switch acl dip trtcm [dip] [portmap][CIR:kbps][CBS][PIR][PBS] - TrTCM dip packets
 switch acl port add [sport] [portmap]           - drop src port packets
 switch acl L4 add [2byes] [portmap]             - drop L4 packets with 2bytes payload
 switch add [mac] [portmap]                  - add an entry to switch table
 switch add [mac] [portmap] [vlan id]        - add an entry to switch table
 switch add [mac] [portmap] [vlan id] [age]  - add an entry to switch table
 switch clear                                - clear switch table
 switch del [mac]                            - delete an entry from switch table
 switch del [mac] [fid]                  - delete an entry from switch table
 switch dip add [dip] [portmap]                  - add a dip entry to switch table
 switch dip del [dip]                        - del a dip entry to switch table
 switch dip dump                                 - dump switch dip table
 switch dip clear                                - clear switch dip table
 switch dump            - dump switch table
 switch ingress-rate on [port] [Kbps]        - set ingress rate limit on port 0~4 
 switch egress-rate on [port] [Kbps]         - set egress rate limit on port 0~4 
 switch ingress-rate off [port]              - del ingress rate limit on port 0~4 
 switch egress-rate off [port]               - del egress rate limit on port 0~4
 switch filt [mac]                           - add a SA filtering entry (with portmap 1111111) to switch table
 switch filt [mac] [portmap]                 - add a SA filtering entry to switch table
 switch filt [mac] [portmap] [vlan id]       - add a SA filtering entry to switch table
 switch filt [mac] [portmap] [vlan id] [age] - add a SA filtering entry to switch table
 switch igmpsnoop on [Query Interval] [default router portmap] - turn on IGMP snoop and  router port learning (Query Interval 1~255)
 switch igmpsnoop off                                  - turn off IGMP snoop and router port learning
 switch igmpsnoop enable [port#]                       - enable IGMP HW leave/join/Squery/Gquery
 switch igmpsnoop disable [port#]                      - disable IGMP HW leave/join/Squery/Gquery
 switch mymac [mac] [portmap]                  - add a mymac entry to switch table
 switch mirror monitor [portnumber]            - enable port mirror and indicate monitor port number
 switch mirror target [portnumber] [0:off, 1:rx, 2:tx, 3:all]  - set port mirror target
 switch phy [phy_addr]                   - dump phy register of specific port
 switch phy mt7530                       - dump mt7530 phy registers
 switch phy                                      - dump all phy registers
 switch pvid [port] [pvid]                - set pvid on port 0~4 
 switch reg r [offset]                       - register read from offset
 switch reg w [offset] [value]               - register write value to offset
 switch reg d [offset]                       - register dump
 switch sip add [sip] [dip] [portmap]            - add a sip entry to switch table
 switch sip del [sip] [dip]                          - del a sip entry to switch table
 switch sip dump                                 - dump switch sip table
 switch sip clear                                - clear switch sip table
 switch tag on [port]                        - keep vlan tag for egress packet on prot 0~4
 switch tag off [port]                       - remove vlan tag for egress packet on port 0~4
 switch vlan dump                            - dump switch table
 switch vlan set [vlan idx (NULL)][vid] [portmap]  - set vlan id and associated member

switch vlan dump

root@WN-AX1167GR2:~# switch vlan dump
  vid  fid  portmap    s-tag
    1    0  -1111-11       0
    2    0  1----1--       0
    3    0  invalid
    4    0  invalid
    5    0  invalid
    6    0  invalid
    7    0  invalid
    8    0  invalid
    9    0  invalid
   10    0  invalid
   11    0  invalid
   12    0  invalid
   13    0  invalid
   14    0  invalid
   15    0  invalid
   16    0  invalid

sys

root@WN-AX1167GR2:~# sys
Usage:
         sys atsh 
         sys atwz  []
         sys atsn 
         sys athwver 
         sys debugflag 
         sys ledctl 
         sys loadrom 
         sys mrd [0:Check default MRD(default option) | 1:Reset default MRD]
         sys romreset 

sys atsh

root@WN-AX1167GR2:~# sys atsh
Firmware Version              : 3.10(XBC.2)b10                
Boot Version                  : 1.24.06 | 12/09/2016 10:20:37 
Product Model                 : WN-AX1167GR2                  
First MAC Address             : 34:76:C5:**:**:B0             
MAC Quantity                  : 4                             
Serial Number                 : BCV0003117O5                  
firmware Checksum             : 7cbe484e                      
Kernel2 Checksum              : 6c4b3062                      
RomFile Checksum              : bcc71166                      
Country Code                  : EA                            
Boot Number                   : 2

mstc_persist

root@WN-AX1167GR2:~# mstc_persist 
Usage: mstc_persist read  ; mstc_persist write  

mstc_persist read/write recognizes these parameters in persist partition:
        magic_num          magic num
        bootnum            boot from which partition
        cfgapply           config apply flag
        fwapply            firmware apply flag
        padding            padding
        cfg1Size           configuration 1 size
        cfg1Chksum         configuration 1 checksum
        cfg2Size           configuration 2 size
        cfg2Chksum         configuration 2 checksum
        fw1Size            firmware 1 size
        fw1Chksum          firmware 1 checksum
        fw2Size            firmware 2 size
        fw2Chksum          firmware 2 checksum

Example: Read bootnum from persist partition.
         mstc_persist read bootnum

Example: Write bootnum with value 2 to persist partition.
         mstc_persist write bootnum 2

mstc_persist read bootnum

root@WN-AX1167GR2:~# mstc_persist read bootnum
2

bootlog

===================================================================
                MT7621   stage1 code 10:33:11 (ASIC)
                CPU=50000000 HZ BUS=16666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL3 FB_DL: 0x4, 1/0 = 576/448 11000000
PLL4 FB_DL: 0x7, 1/0 = 552/472 1D000000
PLL2 FB_DL: 0x18, 1/0 = 609/415 61000000
do DDR setting..[00320381]
Apply DDR3 Setting...(use customer AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
      --------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000E:|    0    0    0    0    0    0    0    0    0    0    0    1    1    1    1    1
000F:|    0    0    0    0    0    0    1    1    1    1    1    1    1    1    1    1
0010:|    1    1    1    1    1    1    1    1    1    1    1    0    0    0    0    0
0011:|    1    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
rank 0 coarse = 16
rank 0 fine = 40
B:|    0    0    0    0    0    0    0    0    1    1    1    0    0    0    0    0
opt_dle value:9
DRAMC_R0DELDLY[018]=00002121
==================================================================
                RX      DQS perbit delay software calibration 
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    9 9 9 10 6 7 8 6 7 6 
10 |    9 8 9 10 7 9 
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center 
y=0-7bit DQ of every group
input delay:DQS0 =33 DQS1 = 33
==================================================================
bit     DQS0     bit      DQS1
0  (0~64)32  8  (1~64)32
1  (1~66)33  9  (1~60)30
2  (1~64)32  10  (1~63)32
3  (1~65)33  11  (1~61)31
4  (1~64)32  12  (1~65)33
5  (1~66)33  13  (1~63)32
6  (1~64)32  14  (1~64)32
7  (1~66)33  15  (1~65)33
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    10 9 10 10 7 7 9 6 8 9 
10 |    10 10 9 11 8 9 
==================================================================
==================================================================
     TX  perbyte calibration 
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000 
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 
DQ loop=15, cmp_err_1 = ffff0082
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=1 
DQ loop=14, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=14,  finish count=2 
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
20,data:88
[EMI] DRAMC calibration passed

===================================================================
                MT7621   stage1 code done 
                CPU=50000000 HZ BUS=16666666 HZ
===================================================================


U-Boot 1.1.3 (Dec  9 2016 - 10:20:35)

Board: Ralink APSoC DRAM:  128 MB
relocate_code Pointer at: 87fac000

Config XHCI 40M PLL 
******************************
Software System Reset Occurred
******************************
Allocate 16 byte aligned buffer: 87fdf010
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [01 F1 80 1D 01]
Device found in MTK table, ID: 1f1, EXT_ID: 801d01
Support this Device in MTK table! 1f1 
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
....============================================ 
Ralink UBoot Version: 5.0.0.0
-------------------------------------------- 
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection 
DRAM_TYPE: DDR3 
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Dec  9 2016  Time:10:20:35
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 880 MHZ #### 
 estimate memory size =128 Mbytes
#Reset_MT7530
set LAN/WAN WLLLL
.## Starting application at 0x81E00000 ...


Z-LOADER V1.24 | 12/09/2016 10:20:37


..
Checking image 2...
   Image Name:   3.10(XBC.2)b10
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1603256 Bytes =  1.5 MB
   Load Address: 80001000
   Entry Point:  80001000
.........................   Verifying Combo Checksum ... ..................................................................................................................................................## Booting image at bf700000 ...
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80001000) ...
## Giving linux memsize in MB, 128

Starting kernel ...


LINUX started...

 THIS IS ASIC

SDK 5.0.S.0
[    0.000000] Linux version 3.10.14 (*******@srv17) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #1 SMP Mon Jun 24 12:41:36 CST 2019
[    0.000000] 
[    0.000000]  The CPU feqenuce set to 880 MHz
[    0.000000] GCMP present
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] Software DMA cache coherency
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x07ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x07ffffff]
[    0.000000] Detected 3 available secondary CPU(s)
[    0.000000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] PERCPU: Embedded 7 pages/cpu @81103000 s6464 r8192 d14016 u32768
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS1,57600n8 BootImage=2 root=/dev/mtdblock7 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=0002e000
[    0.000000] Readback ErrCtl register=0002e000
[    0.000000] Memory: 125008k/131072k available (3536k kernel code, 6064k reserved, 852k data, 212k init, 0k highmem)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:128
[    0.000000] console [ttyS1] enabled
[    0.116000] Calibrating delay loop... 562.17 BogoMIPS (lpj=1124352)
[    0.148000] pid_max: default: 32768 minimum: 301
[    0.152000] Mount-cache hash table entries: 512
[    0.156000] launch: starting cpu1
[    0.160000] launch: cpu1 gone!
[    0.160000] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.160000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.160000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.160000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.192000] Synchronize counters for CPU 1: done.
[    0.200000] launch: starting cpu2
[    0.204000] launch: cpu2 gone!
[    0.204000] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.204000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.204000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.204000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.232000] Synchronize counters for CPU 2: done.
[    0.240000] launch: starting cpu3
[    0.244000] launch: cpu3 gone!
[    0.244000] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.244000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.244000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.244000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.272000] Synchronize counters for CPU 3: done.
[    0.280000] Brought up 4 CPUs
[    0.284000] NET: Registered protocol family 16
[    0.576000] release PCIe RST: RALINK_RSTCTRL = 7000000
[    0.580000] PCIE PHY initialize
[    0.584000] ***** Xtal 40MHz *****
[    0.588000] start MT7621 PCIe register access
[    1.164000] RALINK_RSTCTRL = 7000000
[    1.168000] RALINK_CLKCFG1 = 77ffeff8
[    1.172000] 
[    1.172000] *************** MT7621 PCIe RC mode *************
[    1.652000] PCIE0 no card, disable it(RST&CLK)
[    1.656000] PCIE2 no card, disable it(RST&CLK)
[    1.660000] pcie_link status = 0x2
[    1.664000] RALINK_RSTCTRL= 2000000
[    1.668000] *** Configure Device number setting of Virtual PCI-PCI bridge ***
[    1.672000] RALINK_PCI_PCICFG_ADDR = 21007f2 -> 20107f2
[    1.676000] PCIE1 enabled
[    1.680000] interrupt enable status: 200000
[    1.684000] Port 0 N_FTS = 1b105000
[    1.688000] config reg done
[    1.692000] init_rt2880pci done
[    1.712000] bio: create slab  at 0
[    1.716000] SCSI subsystem initialized
[    1.720000] usbcore: registered new interface driver usbfs
[    1.724000] usbcore: registered new interface driver hub
[    1.728000] usbcore: registered new device driver usb
[    1.732000] PCI host bridge to bus 0000:00
[    1.736000] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    1.740000] pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
[    1.744000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.748000] pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
[    1.752000] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    1.756000] pci 0000:00:00.0: BAR 1: assigned [mem 0x60100000-0x6010ffff]
[    1.760000] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
[    1.764000] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.768000] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    1.772000] BAR0 at slot 0 = 0
[    1.776000] bus=0x0, slot = 0x0
[    1.780000] res[0]->start = 0
[    1.784000] res[0]->end = 0
[    1.788000] res[1]->start = 60100000
[    1.792000] res[1]->end = 6010ffff
[    1.796000] res[2]->start = 0
[    1.800000] res[2]->end = 0
[    1.804000] res[3]->start = 0
[    1.808000] res[3]->end = 0
[    1.812000] res[4]->start = 0
[    1.816000] res[4]->end = 0
[    1.820000] res[5]->start = 0
[    1.824000] res[5]->end = 0
[    1.828000] bus=0x1, slot = 0x0, irq=0x18
[    1.832000] res[0]->start = 60000000
[    1.836000] res[0]->end = 600fffff
[    1.840000] res[1]->start = 0
[    1.844000] res[1]->end = 0
[    1.848000] res[2]->start = 0
[    1.852000] res[2]->end = 0
[    1.856000] res[3]->start = 0
[    1.860000] res[3]->end = 0
[    1.864000] res[4]->start = 0
[    1.868000] res[4]->end = 0
[    1.872000] res[5]->start = 0
[    1.876000] res[5]->end = 0
[    1.880000] Switching to clocksource MIPS
[    1.884000] NET: Registered protocol family 2
[    1.892000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    1.908000] TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
[    1.920000] TCP: Hash tables configured (established 1024 bind 1024)
[    1.932000] TCP: reno registered
[    1.940000] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    1.952000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    1.964000] NET: Registered protocol family 1
[    2.060000] 4 CPUs re-calibrate udelay(lpj = 1167360)
[    2.072000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.084000] jffs2: version 2.2. (NAND) (SUMMARY)  (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    2.108000] io scheduler noop registered (default)
[    2.116000] reg_int_mask=0, INT_MASK= 0 
[    2.124000] HSDMA_init
[    2.128000] 
[    2.128000]  hsdma_phy_tx_ring0 = 0x0fe38000, hsdma_tx_ring0 = 0xafe38000
[    2.148000] 
[    2.148000]  hsdma_phy_rx_ring0 = 0x0fe34000, hsdma_rx_ring0 = 0xafe34000
[    2.164000] TX_CTX_IDX0 = 0
[    2.168000] TX_DTX_IDX0 = 0
[    2.172000] RX_CRX_IDX0 = 3ff
[    2.180000] RX_DRX_IDX0 = 0
[    2.184000] set_fe_HSDMA_glo_cfg
[    2.192000] HSDMA_GLO_CFG = 465
[    2.204000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    2.216000] serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A
[    2.228000] serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A
[    2.244000] Ralink gpio driver initialized
[    2.252000] MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
[    2.264000] Allocate 16 byte aligned buffer: 80491c20
[    2.276000] Enable NFI Clock
[    2.280000] # MTK NAND # : Use HW ECC
[    2.288000] NAND ID [01 F1 80 1D 01, 00801d01]
[    2.296000] Device found in MTK table, ID: 1f1, EXT_ID: 801d01
[    2.308000] Support this Device in MTK table! 1f1 
[    2.320000] NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD/Spansion NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[    2.344000] [NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
[    2.356000] Scanning device for bad blocks
[    2.652000] Signature matched and data read!
[    2.660000] load_fact_bbt success 1023
[    2.668000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[    2.688000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[    2.708000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[    2.728000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[    2.748000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[    2.768000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[    2.788000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[    2.804000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[    2.824000] Creating 11 MTD partitions on "MT7621-NAND":
[    2.836000] 0x000000000000-0x000007f80000 : "ALL"
[    2.848000] 0x000000000000-0x000000100000 : "Bootloader"
[    2.860000] 0x000000100000-0x000000200000 : "Ubootenv"
[    2.868000] 0x000000200000-0x000000300000 : "Factory"
[    2.880000] 0x000000400000-0x000003600000 : "firmware"
[    2.892000] 0x000003600000-0x000003700000 : "Config"
[    2.904000] 0x000003700000-0x000006900000 : "firmware_2"
[    2.916000] 0x0000038876f8-0x000006900000 : "rootfs"
[    2.928000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    2.960000] 0x000006900000-0x000006a00000 : "Config_2"
[    2.972000] 0x000006a00000-0x000006b00000 : "persist"
[    2.984000] 0x000006b00000-0x000007f80000 : "Backup"
[    2.996000] 0x000000300000-0x000000400000 : "SecondBoot"
[    3.008000] [mtk_nand] probe successfully!
[    3.016000] rootfs = 38876f8 to 4020000
[    3.024000] PPP generic driver version 2.4.2
[    3.032000] NET: Registered protocol family 24
[    3.040000] PPTP driver version 0.8.5
[    3.048000] rdm_major = 253
[    3.052000] GMAC1_MAC_ADRH -- : 0x00003476
[    3.064000] GMAC1_MAC_ADRL -- : 0xc59ba0b0
[    3.072000] Ralink APSoC Ethernet Driver Initilization. v3.1  1024 rx/tx descriptors allocated, mtu = 1500!
[    3.088000] GMAC1_MAC_ADRH -- : 0x00003476
[    3.096000] GMAC1_MAC_ADRL -- : 0xc59ba0b0
[    3.108000] register mt7530
[    3.112000] PROC INIT OK!
[    3.116000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    3.132000] ehci-pci: EHCI PCI platform driver
[    3.140000] *****run project phy.
[    3.160000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.176000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.196000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.216000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.236000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.256000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.276000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.296000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.316000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.336000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.380000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.400000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.420000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.440000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.460000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.480000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.500000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.520000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.540000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.560000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.700000] xhci-hcd xhci-hcd: xHCI Host Controller
[    3.708000] xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 1
[    3.724000] xhci-hcd xhci-hcd: irq 22, io mem 0x1e1c0000
[    3.736000] hub 1-0:1.0: USB hub found
[    3.744000] hub 1-0:1.0: 2 ports detected
[    3.752000] xhci-hcd xhci-hcd: xHCI Host Controller
[    3.760000] xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 2
[    3.776000] hub 2-0:1.0: USB hub found
[    3.784000] hub 2-0:1.0: 1 port detected
[    3.792000] usbcore: registered new interface driver usb-storage
[    3.804000] gre: GRE over IPv4 demultiplexor driver
[    3.812000] TCP: cubic registered
[    3.820000] NET: Registered protocol family 10
[    3.832000] NET: Registered protocol family 17
[    3.840000] Bridge firewalling registered
[    3.848000] 8021q: 802.1Q VLAN Support v1.8
[    3.864000] VFS: Mounted root (squashfs filesystem) readonly on device 31:7.
[    3.880000] Freeing unused kernel memory: 212K (8044b000 - 80480000)
procd: Console is alive
procd: - preinit -
[    5.200000] 34:76:FFFFFFC5:FFFFFF9B:FFFFFFA0:FFFFFFB0
[    5.212000] Raeth v3.1 (Tasklet)
[    5.220000] set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1
[    5.236000] phy_free_head is 0xf732000!!!
[    5.244000] phy_free_tail_phy is 0xf733ff0!!!
[    5.252000] txd_pool=af740000 phy_txd_pool=0F740000
[    5.260000] ei_local->skb_free start address is 0x87eca6dc.
[    5.272000] free_txd: 0f740010, ei_local->cpu_ptr: 0F740000
[    5.284000]  POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
[    5.292000] ----------------+---------+--------
[    5.300000]      0xaf740000 0x0F740000 0x0F740000
[    5.312000] 
[    5.312000] phy_qrx_ring = 0x0f6e5000, qrx_ring = 0xaf6e5000
[    5.328000] 
[    5.328000] phy_rx_ring0 = 0x0f734000, rx_ring0 = 0xaf734000
[    5.364000] MT7530 Reset Completed!!
[    5.376000] change HW-TRAP to 0x117c8f
[    5.384000] set LAN/WAN WLLLL
[    5.396000] GMAC1_MAC_ADRH -- : 0x00003476
[    5.404000] GMAC1_MAC_ADRL -- : 0xc59ba0b0
[    5.412000] GDMA2_MAC_ADRH -- : 0x00003476
[    5.420000] GDMA2_MAC_ADRL -- : 0xc59ba0b2
[    5.428000] eth1: ===> VirtualIF_open
[    5.436000] MT7621 GE2 link rate to 1G
[    5.436000] CDMA_CSG_CFG = 81000000
[    5.436000] GDMA1_FWD_CFG = 20710000
[    5.436000] GDMA2_FWD_CFG = 20710000
[    5.560000] led=9, on=1, off=1, blinks,=1, reset=1, time=4000 low_trigger=1
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    8.668000] led=9, on=1, off=1, blinks,=1, reset=1, time=4000 low_trigger=1
Could not open mtd device: /dev/mtd7
reading ro[    8.780000] ra2880stop()...otfs failed
mouDone
[    8.792000] eth1: ===> VirtualIF_close

[    8.800000] Free TX/RX Ring Memory!
procd: - early -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
[   10.696000] jffs2: notice: (757) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   10.828000] jffs2: notice: (760) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
##### Skip Checking Config. #####
Mode Switch: Router/AP
[   11.448000] Initializing XFRM netlink socket
[   11.460000] NET: Registered protocol family 15
[   11.468000] sbdev driver(major: 254) installed.
[   11.480000] wpdev driver(major: 250) installed.
[   11.500000] l2tp_core: L2TP core driver, V2.0
[   11.512000] l2tp_netlink: L2TP netlink interface
[   11.524000] ip_gre: GRE over IPv4 tunneling driver
[   11.544000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   11.552000] Type=Restricted Cone
[   11.564000] nf_conntrack version 0.5.0 (1956 buckets, 7824 max)
[   11.584000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   11.616000] ebt_time: kernel timezone is -0000
[   11.628000] Ebtables v2.0 registered
[   11.640000] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[   11.788000] Netfilter messages via NETLINK v0.30.
[   11.800000] PPP MPPE Compression module registered
[   11.812000] Ralink APSoC Hardware Watchdog Timer
[   11.844000] xt_time: kernel timezone is -0000
[   11.864000] ctnetlink v0.93: registering with nfnetlink.
[   14.764000] mtd: ALL locked
[   14.768000] mtd: Bootloader locked
[   14.776000] mtd: Ubootenv locked
[   14.780000] mtd: Factory locked
[   14.788000] mtd_locked init
[   16.276000] 34:76:FFFFFFC5:FFFFFF9B:FFFFFFA0:FFFFFFB0
[   16.288000] Raeth v3.1 (Tasklet)
[   16.296000] set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1
[   16.312000] phy_free_head is 0xf31a000!!!
[   16.320000] phy_free_tail_phy is 0xf31bff0!!!
[   16.328000] txd_pool=af338000 phy_txd_pool=0F338000
[   16.336000] ei_local->skb_free start address is 0x87eca6dc.
[   16.348000] free_txd: 0f338010, ei_local->cpu_ptr: 0F338000
[   16.360000]  POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
[   16.368000] ----------------+---------+--------
[   16.380000]      0xaf338000 0x0F338000 0x0F338000
[   16.388000] 
[   16.388000] phy_qrx_ring = 0x0f0e7000, qrx_ring = 0xaf0e7000
[   16.404000] 
[   16.404000] phy_rx_ring0 = 0x0f32c000, rx_ring0 = 0xaf32c000
[   16.448000] MT7530 Reset Completed!!
[   16.460000] change HW-TRAP to 0x117c8f
[   16.468000] set LAN/WAN WLLLL
[   16.480000] GMAC1_MAC_ADRH -- : 0x00003476
[   16.488000] GMAC1_MAC_ADRL -- : 0xc59ba0b0
[   16.496000] eth1: ===> VirtualIF_open
[   16.504000] MT7621 GE2 link rate to 1G
[   16.512000] CDMA_CSG_CFG = 81000000
[   16.520000] GDMA1_FWD_CFG = 20710000
[   16.528000] GDMA2_FWD_CFG = 20710000
[   16.536000] device eth0 entered promiscuous mode
[   16.548000] br-lan: port 1(eth0) entered forwarding state
[   16.560000] br-lan: port 1(eth0) entered forwarding state
[   16.572000] eth1: ===> VirtualIF_open
[   16.580000] device eth1 entered promiscuous mode
[   16.592000] br-lan: port 2(eth1) entered forwarding state
[   16.604000] br-lan: port 2(eth1) entered forwarding state
[   18.564000] br-lan: port 1(eth0) entered forwarding state
[   18.608000] br-lan: port 2(eth1) entered forwarding state
[   22.288000] register mt_drv
[   22.308000] 
[   22.308000] 
[   22.308000] === pAd = c2381000, size = 3627760 ===
[   22.308000] 
[   22.328000] PciHif.CSRBaseAddress =0xc2280000, csr_addr=0xc2280000!
[   22.356000] get_wdev_by_idx: invalid idx(0)
[   22.368000] RTMPInitPCIeDevice():device_id=0x7615
[   22.376000] DriverOwn()::Try to Clear FW Own...
[   22.716000] DriverOwn()::Success to clear FW Own
[   22.728000] mt_pci_chip_cfg(): HWVer=0x8a10, FWVer=0x8a10, pAd->ChipID=0x7615
[   22.740000] mt_pci_chip_cfg(): HIF_SYS_REV=0x76150001
[   22.752000] RtmpChipOpsHook(493): Not support for HIF_MT yet! MACVersion=0x0
[   22.764000] mt7615_init()-->
[   22.772000] Use the default ePAeLNA bin image!
[   22.780000] Use the default /etc_ro/wlan/MT7615E_EEPROM1.bin bin image!
[   22.792000] rxq = c26f26f4
[   24.272000] ctl->ackq = c26f2700
[   24.280000] ctl->kickq = c26f270c
[   24.288000] ctl->tx_doneq = c26f2718
[   24.292000] ctl->rx_doneq = c26f2724
[   24.300000] mt7615_fw_prepare():FW(8a10), HW(8a10), CHIPID(7615))
[   24.312000] mt7615_fw_prepare(2701): MT7615_E3, USE E3 patch and ram code binary image
[   24.328000] AndesMTLoadRomMethodFwDlRing(1036), cap->rom_patch_len(10206)
[   24.344000] AndesRestartCheck: Current TOP_MISC2(0x1)
[   24.352000] AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
[   24.368000] 20161013140927a
[   24.372000] 
[   24.376000] platform = 
[   24.380000] ALPS
[   24.384000] hw/sw version = 
[   24.388000] 8a108a10
[   24.396000] patch version = 
[   24.400000] 00000010
[   24.404000] Patch SEM Status=2
[   24.412000] MtCmdPatchSemGet:(ret = 0)
[   24.416000] 
[   24.416000] Patch is not ready && get semaphore success, SemStatus(2)
[   24.432000] EventGenericEventHandler: CMD Success
[   24.444000] MtCmdAddressLenReq:(ret = 0)
[   24.452000] MtCmdPatchFinishReq
[   24.468000] EventGenericEventHandler: CMD Success
[   24.480000] Send checksum req..
[   24.484000] Patch SEM Status=3
[   24.492000] MtCmdPatchSemGet:(ret = 0)
[   24.496000] 
[   24.496000] Release patch semaphore, SemStatus(3)
[   24.512000] AndesMTEraseRomPatch
[   24.516000] WfMcuHwInit: Before NICLoadFirmware, check IcapMode=0
[   24.528000] AndesMTLoadFwMethodFwDlRing(810), cap->fw_len(460360)
[   24.540000] Build Date:_201701111925
[   24.548000] Build Date:_201701111925
[   24.556000] AndesRestartCheck: Current TOP_MISC2(0x1)
[   24.564000] AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
[   24.580000] EventGenericEventHandler: CMD Success
[   24.588000] MtCmdAddressLenReq:(ret = 0)
[   24.600000] EventGenericEventHandler: CMD Success
[   24.612000] MtCmdAddressLenReq:(ret = 0)
[   24.620000] MtCmdFwStartReq: override = 1, address = 540672
[   24.628000] EventGenericEventHandler: CMD Success
[   24.640000] Build Date:_201612301011
[   24.648000] EventGenericEventHandler: CMD Success
[   24.656000] MtCmdAddressLenReq:(ret = 0)
[   24.664000] MtCmdFwStartReq: override = 4, address = 0
[   24.740000] EventGenericEventHandler: CMD Success
[   24.780000] WfMcuHwInit: NICLoadFirmware OK, Check IcapMode=0
[   24.792000] MCU Init Done!
[   24.796000]  MtCmdSetRlmPorCal: (ret = 0) 
[   24.804000] efuse_probe: efuse = 10000212
[   24.812000] RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5
[   24.824000] RtmpEepromGetDefault::e2p_dafault=1
[   24.832000] RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1
[   24.848000] NVM is FLASH mode. dev_idx [0] FLASH OFFSET [0x0]
[   24.860000] NICReadEEPROMParameters():Calling eeinit
[   24.880000] NICReadEEPROMParameters: EEPROM 0x52 b317
[   24.896000] MtCmdSetTxLpfCal:(ret = 0)
[   24.904000] MtCmdSetTxIqCal:(ret = 0)
[   24.912000] MtCmdSetTxDcCal:(ret = 0)
[   24.920000] MtCmdSetRxFiCal:(ret = 0)
[   24.928000] MtCmdSetRxFdCal:(ret = 0)
[   24.932000] MtCmdSetRxFdCal:(ret = 0)
[   24.940000] MtCmdSetRxFdCal:(ret = 0)
[   24.948000] MtCmdSetRxFdCal:(ret = 0)
[   24.956000] MtCmdSetRxFdCal:(ret = 0)
[   24.964000] MtCmdSetRxFdCal:(ret = 0)
[   24.972000] MtCmdSetRxFdCal:(ret = 0)
[   24.976000] MtCmdSetRxFdCal:(ret = 0)
[   24.984000] MtCmdSetRxFdCal:(ret = 0)
[   24.992000] NICReadEEPROMParameters: EEPROM 0x52 b317
[   25.556000] Country Region from e2p = 101
[   25.564000] mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4
[   25.580000] mt7615_antenna_default_reset(): DBDC 2G TxPath = 2, 2G RxPath = 2
[   25.592000] mt7615_antenna_default_reset(): DBDC 5G TxPath = 2, 2G RxPath = 2
[   25.608000] rtmp_read_txpwr_from_eeprom(235): Don't Support this now!
[   25.620000] RTMPReadTxPwrPerRate(1382): Don't Support this now!
[   25.632000] RcRadioInit(): DbdcMode=1, ConcurrentBand=2
[   25.640000] RcRadioInit(): pRadioCtrl=87563444,Band=0,rfcap=1,channel=1,PhyMode=2
[   25.656000] RcRadioInit(): pRadioCtrl=87563530,Band=1,rfcap=2,channel=36,PhyMode=1
[   25.672000] MtCmdSetDbdcCtrl:(ret = 0)
[   25.680000] Band Rf: 1, Phy Mode: 2
[   25.688000] Band Rf: 2, Phy Mode: 1
[   25.692000] AntCfgInit(2700): Not support for HIF_MT yet!
[   25.704000] MtSingleSkuLoadParam: RF_LOCKDOWN Feature OFF !!!
[   25.716000] MtBfBackOffLoadTable: RF_LOCKDOWN Feature OFF !!!
[   25.728000] EEPROM Init Done!
[   25.736000] mt_mac_init()-->
[   25.740000] mt_mac_pse_init(2716): Don't Support this now!
[   25.752000] mt7615_init_mac_cr()-->
[   25.760000] mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c
[   25.768000] mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c
[   25.780000] MtAsicSetMacMaxLen(1290): Not finish Yet!
[   25.788000] 
[   25.952000] MtCmdSetMacTxRx:(ret = 0)
[   25.960000] MtCmdSetMacTxRx:(ret = 0)
[   25.968000] [DfsSwitchCheck]: DFS ByPass TX calibration.
[   25.980000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
[   26.000000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   26.008000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98] 
[   26.028000] MtCmdGetTXDPDCalResult:(ret = 0)
[   26.036000] MtCmdChannelSwitch: control_chl = 36,control_ch2=0, central_chl = 42 DBDCIdx= 1, Band= 0 
[   26.052000] BW = 2,TXStream = 2, RXStream = 2, scan(1)
[   26.288000] [DfsSwitchCheck]: DFS ByPass TX calibration.
[   26.296000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
[   26.316000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   26.324000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98] 
[   26.344000] MtCmdGetTXDPDCalResult:(ret = 0)
[   26.352000] MtCmdChannelSwitch: control_chl = 40,control_ch2=0, central_chl = 42 DBDCIdx= 1, Band= 0 
[   26.372000] BW = 2,TXStream = 2, RXStream = 2, scan(1)
[   26.604000] [DfsSwitchCheck]: DFS ByPass TX calibration.
[   26.612000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
[   26.632000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   26.640000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98] 
[   26.660000] MtCmdGetTXDPDCalResult:(ret = 0)
[   26.668000] MtCmdChannelSwitch: control_chl = 44,control_ch2=0, central_chl = 42 DBDCIdx= 1, Band= 0 
[   26.688000] BW = 2,TXStream = 2, RXStream = 2, scan(1)
[   26.976000] [DfsSwitchCheck]: DFS ByPass TX calibration.
[   26.984000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
[   27.004000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   27.012000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98] 
[   27.032000] MtCmdGetTXDPDCalResult:(ret = 0)
[   27.040000] MtCmdChannelSwitch: control_chl = 48,control_ch2=0, central_chl = 42 DBDCIdx= 1, Band= 0 
[   27.060000] BW = 2,TXStream = 2, RXStream = 2, scan(1)
[   27.292000] ====================================================================
[   27.304000] Channel  36 : Busy Time =      0, Skip Channel = FALSE, BwCap = TRUE
[   27.320000] Channel  40 : Busy Time =      0, Skip Channel = FALSE, BwCap = TRUE
[   27.336000] Channel  44 : Busy Time =      0, Skip Channel = FALSE, BwCap = TRUE
[   27.348000] Channel  48 : Busy Time =      0, Skip Channel = FALSE, BwCap = TRUE
[   27.364000] ====================================================================
[   27.380000] Rule 3 Channel Busy time value : Select Primary Channel 36 
[   27.392000] Rule 3 Channel Busy time value : Min Channel Busy = 0
[   27.404000] Rule 3 Channel Busy time value : BW = 80
[   27.412000]  AutoChSelUpdateChannel(): Update channel for wdev0 for this band PhyMode = 49,Channel = 36  
[   27.436000]  AutoChSelUpdateChannel(): Update channel for wdev1 for this band PhyMode = 49,Channel = 36  
[   27.456000]  AutoChSelUpdateChannel(): Update channel for wdev2 for this band PhyMode = 49,Channel = 36  
[   27.476000]  AutoChSelUpdateChannel(): Update channel for wdev3 for this band PhyMode = 49,Channel = 36  
[   27.496000]  AutoChSelUpdateChannel(): Update channel for wdev4 for this band PhyMode = 14,Channel = 0  
[   27.516000]  AutoChSelUpdateChannel(): Update channel for wdev5 for this band PhyMode = 14,Channel = 0  
[   27.536000]  AutoChSelUpdateChannel(): Update channel for wdev6 for this band PhyMode = 14,Channel = 0  
[   27.556000]  AutoChSelUpdateChannel(): Update channel for wdev7 for this band PhyMode = 14,Channel = 0  
[   27.576000] mt7615_apply_dcoc() : reload Central CH [1] BW [0] from cetral freq [2417]  offset [2200] 
[   27.596000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   27.604000] mt7615_apply_dpd() : reload Central CH [1] BW [0] from cetral freq [2422] i[44] offset [4b20] 
[   27.624000] MtCmdGetTXDPDCalResult:(ret = 0)
[   27.632000] MtCmdChannelSwitch: control_chl = 1,control_ch2=0, central_chl = 1 DBDCIdx= 0, Band= 0 
[   27.652000] BW = 0,TXStream = 2, RXStream = 2, scan(1)
[   27.908000] mt7615_apply_dcoc() : reload Central CH [2] BW [0] from cetral freq [2417]  offset [2200] 
[   27.924000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   27.932000] mt7615_apply_dpd() : reload Central CH [2] BW [0] from cetral freq [2422] i[44] offset [4b20] 
[   27.952000] MtCmdGetTXDPDCalResult:(ret = 0)
[   27.960000] MtCmdChannelSwitch: control_chl = 2,control_ch2=0, central_chl = 2 DBDCIdx= 0, Band= 0 
[   27.980000] BW = 0,TXStream = 2, RXStream = 2, scan(1)
[   28.216000] mt7615_apply_dcoc() : reload Central CH [3] BW [0] from cetral freq [2417]  offset [2200] 
[   28.232000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   28.240000] mt7615_apply_dpd() : reload Central CH [3] BW [0] from cetral freq [2422] i[44] offset [4b20] 
[   28.260000] MtCmdGetTXDPDCalResult:(ret = 0)
[   28.268000] MtCmdChannelSwitch: control_chl = 3,control_ch2=0, central_chl = 3 DBDCIdx= 0, Band= 0 
[   28.288000] BW = 0,TXStream = 2, RXStream = 2, scan(1)
[   28.524000] mt7615_apply_dcoc() : reload Central CH [4] BW [0] from cetral freq [2432]  offset [2300] 
[   28.540000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   28.548000] mt7615_apply_dpd() : reload Central CH [4] BW [0] from cetral freq [2422] i[44] offset [4b20] 
[   28.568000] MtCmdGetTXDPDCalResult:(ret = 0)
[   28.576000] MtCmdChannelSwitch: control_chl = 4,control_ch2=0, central_chl = 4 DBDCIdx= 0, Band= 0 
[   28.596000] BW = 0,TXStream = 2, RXStream = 2, scan(1)
[   28.844000] mt7615_apply_dcoc() : reload Central CH [5] BW [0] from cetral freq [2432]  offset [2300] 
[   28.860000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   28.868000] mt7615_apply_dpd() : reload Central CH [5] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
[   28.888000] MtCmdGetTXDPDCalResult:(ret = 0)
[   28.896000] MtCmdChannelSwitch: control_chl = 5,control_ch2=0, central_chl = 5 DBDCIdx= 0, Band= 0 
[   28.916000] BW = 0,TXStream = 2, RXStream = 2, scan(1)
[   29.152000] mt7615_apply_dcoc() : reload Central CH [6] BW [0] from cetral freq [2432]  offset [2300] 
[   29.168000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   29.176000] mt7615_apply_dpd() : reload Central CH [6] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
[   29.196000] MtCmdGetTXDPDCalResult:(ret = 0)
[   29.204000] MtCmdChannelSwitch: control_chl = 6,control_ch2=0, central_chl = 6 DBDCIdx= 0, Band= 0 
[   29.224000] BW = 0,TXStream = 2, RXStream = 2, scan(1)
[   29.460000] mt7615_apply_dcoc() : reload Central CH [7] BW [0] from cetral freq [2447]  offset [2400] 
[   29.476000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   29.484000] mt7615_apply_dpd() : reload Central CH [7] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
[   29.504000] MtCmdGetTXDPDCalResult:(ret = 0)
[   29.512000] MtCmdChannelSwitch: control_chl = 7,control_ch2=0, central_chl = 7 DBDCIdx= 0, Band= 0 
[   29.532000] BW = 0,TXStream = 2, RXStream = 2, scan(1)
[   29.768000] mt7615_apply_dcoc() : reload Central CH [8] BW [0] from cetral freq [2447]  offset [2400] 
[   29.784000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   29.792000] mt7615_apply_dpd() : reload Central CH [8] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
[   29.812000] MtCmdGetTXDPDCalResult:(ret = 0)
[   29.820000] MtCmdChannelSwitch: control_chl = 8,control_ch2=0, central_chl = 8 DBDCIdx= 0, Band= 0 
[   29.840000] BW = 0,TXStream = 2, RXStream = 2, scan(1)
[   30.116000] mt7615_apply_dcoc() : reload Central CH [9] BW [0] from cetral freq [2447]  offset [2400] 
[   30.132000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   30.140000] mt7615_apply_dpd() : reload Central CH [9] BW [0] from cetral freq [2442] i[45] offset [4bf8] 
[   30.160000] MtCmdGetTXDPDCalResult:(ret = 0)
[   30.168000] MtCmdChannelSwitch: control_chl = 9,control_ch2=0, central_chl = 9 DBDCIdx= 0, Band= 0 
[   30.188000] BW = 0,TXStream = 2, RXStream = 2, scan(1)
[   30.424000] mt7615_apply_dcoc() : reload Central CH [10] BW [0] from cetral freq [2467]  offset [2500] 
[   30.440000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   30.448000] mt7615_apply_dpd() : reload Central CH [10] BW [0] from cetral freq [2462] i[46] offset [4cd0] 
[   30.468000] MtCmdGetTXDPDCalResult:(ret = 0)
[   30.476000] MtCmdChannelSwitch: control_chl = 10,control_ch2=0, central_chl = 10 DBDCIdx= 0, Band= 0 
[   30.496000] BW = 0,TXStream = 2, RXStream = 2, scan(1)
[   30.732000] mt7615_apply_dcoc() : reload Central CH [11] BW [0] from cetral freq [2467]  offset [2500] 
[   30.748000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   30.756000] mt7615_apply_dpd() : reload Central CH [11] BW [0] from cetral freq [2462] i[46] offset [4cd0] 
[   30.776000] MtCmdGetTXDPDCalResult:(ret = 0)
[   30.784000] MtCmdChannelSwitch: control_chl = 11,control_ch2=0, central_chl = 11 DBDCIdx= 0, Band= 0 
[   30.804000] BW = 0,TXStream = 2, RXStream = 2, scan(1)
[   31.040000] ====================================================================
[   31.052000] Channel   1 : Busy Time =   2279, Skip Channel = FALSE, BwCap = TRUE
[   31.068000] Channel   2 : Busy Time =     14, Skip Channel = FALSE, BwCap = TRUE
[   31.084000] Channel   3 : Busy Time =   6174, Skip Channel = FALSE, BwCap = TRUE
[   31.096000] Channel   4 : Busy Time =   1496, Skip Channel = FALSE, BwCap = TRUE
[   31.112000] Channel   5 : Busy Time =   3980, Skip Channel = FALSE, BwCap = TRUE
[   31.128000] Channel   6 : Busy Time =   2663, Skip Channel = FALSE, BwCap = TRUE
[   31.140000] Channel   7 : Busy Time =   6730, Skip Channel = FALSE, BwCap = TRUE
[   31.156000] Channel   8 : Busy Time =   8393, Skip Channel = FALSE, BwCap = TRUE
[   31.172000] Channel   9 : Busy Time =   4785, Skip Channel = FALSE, BwCap = TRUE
[   31.184000] Channel  10 : Busy Time =   3404, Skip Channel = FALSE, BwCap = TRUE
[   31.200000] Channel  11 : Busy Time =   8515, Skip Channel = FALSE, BwCap = TRUE
[   31.216000] ====================================================================
[   31.232000] Rule 3 Channel Busy time value : Select Primary Channel 2 
[   31.244000] Rule 3 Channel Busy time value : Min Channel Busy = 14
[   31.256000] Rule 3 Channel Busy time value : BW = 20
[   31.264000]  AutoChSelUpdateChannel(): Update channel for wdev0 for this band PhyMode = 49,Channel = 36  
[   31.288000]  AutoChSelUpdateChannel(): Update channel for wdev1 for this band PhyMode = 49,Channel = 36  
[   31.308000]  AutoChSelUpdateChannel(): Update channel for wdev2 for this band PhyMode = 49,Channel = 36  
[   31.328000]  AutoChSelUpdateChannel(): Update channel for wdev3 for this band PhyMode = 49,Channel = 36  
[   31.348000]  AutoChSelUpdateChannel(): Update channel for wdev4 for this band PhyMode = 14,Channel = 2  
[   31.368000]  AutoChSelUpdateChannel(): Update channel for wdev5 for this band PhyMode = 14,Channel = 2  
[   31.388000]  AutoChSelUpdateChannel(): Update channel for wdev6 for this band PhyMode = 14,Channel = 2  
[   31.408000]  AutoChSelUpdateChannel(): Update channel for wdev7 for this band PhyMode = 14,Channel = 2  
[   31.428000] ApAutoChannelAtBootUp<-----------------
[   31.440000] WifiSysOpen(), wdev idx = 0
[   31.448000] wdev_attr_update(): wdevId0 = 34:76:c5:9b:a0:b1
[   31.456000] MtCmdSetDbdcCtrl:(ret = 0)
[   31.468000] Current Channel is 36. DfsZeroWaitSupport=0
[   31.476000] MtAsicSetChBusyStat(842): Not support for HIF_MT yet!
[   31.488000] MtAsicSetChBusyStat(842): Not support for HIF_MT yet!
[   31.500000] [PMF]APPMFInit:: apidx=0, MFPC=0, MFPR=0, SHA256=0
[   31.512000] [PMF]WPAMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
[   31.524000] HcUpdatePhyMode(): Update PhyMode for all wdev for this band PhyMode:49,Channel=36
[   31.544000] CountryCode(2.4G/5G)=1/1, RFIC=25, PHY mode(2.4G/5G)=14/49, support 32 channels
[   31.560000] wtc_acquire_groupkey_wcid: Found a non-occupied wtbl_idx:127 for WDEV_TYPE:1
[   31.560000]  LinkToOmacIdx = 0, LinkToWdevType = 1
[   31.588000] bssUpdateBmcMngRate (BSS_INFO_BROADCAST_INFO),                 CmdBssInfoBmcRate.u2BcTransmit= 8192,                 CmdBssInfoBmcRate.u2McTransmit = 8192
[   31.620000] MtCmdSetDbdcCtrl:(ret = 0)
[   31.720000] [RadarStateCheck]Set into RD_NORMAL_MODE
[   31.728000] MtCmdTxPowerSKUCtrl: fgTxPowerSKUEn: 1, BandIdx: 1
[   31.740000] MtCmdTxPowerPercentCtrl: fgTxPowerPercentEn: 1, BandIdx: 1
[   31.752000] MtCmdTxBfBackoffCtrl: fgTxBFBackoffEn: 0, BandIdx: 1
[   31.764000] mt7615_bbp_adjust():rf_bw=2, ext_ch=1, PrimCh=36, HT-CentCh=38, VHT-CentCh=42
[   31.784000] mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
[   31.800000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   31.808000] mt7615_apply_dpd() : reload Central CH [42] BW [2] from cetral freq [5220] i[9] offset [2d98] 
[   31.828000] MtCmdGetTXDPDCalResult:(ret = 0)
[   31.836000] MtCmdChannelSwitch: control_chl = 36,control_ch2=0, central_chl = 42 DBDCIdx= 1, Band= 0 
[   31.856000] BW = 2,TXStream = 2, RXStream = 2, scan(0)
[   31.916000] ap_phy_rrm_init_byRf(): AP Set CentralFreq at 42(Prim=36, HT-CentCh=38, VHT-CentCh=42, BBP_BW=2)
[   31.948000] [WrapDfsRadarDetectStart]: Band0Ch is 36[WrapDfsRadarDetectStart]: Band1Ch is 0LeadTimeForBcn, OmacIdx = 0, WDEV_WITH_BCN_ABILITY
[   31.972000] MtAsicSetRalinkBurstMode(2595): Not support for HIF_MT yet!
[   31.984000] MtAsicSetPiggyBack(779): Not support for HIF_MT yet!
[   31.996000] MtAsicSetTxPreamble(2574): Not support for HIF_MT yet!
[   32.008000] Main bssid = 34:76:c5:9b:a0:b1
[   32.028000] AsicRadioOnOffCtrl(): DbdcIdx=1 RadioOn
[   32.040000] MtCmdSetMacTxRx:(ret = 0)
[   32.048000] MtCmdSetMacTxRx:(ret = 0)
[   32.052000] fdb_enable()
[   32.356000] MCS Set = ff ff 00 00 01
[   32.364000] <==== mt_wifi_init, Status=0
[   32.372000] MtCmdEDCCACtrl: BandIdx: 0, EDCCACtrl: 1 
[   32.384000] MtCmdEDCCACtrl: BandIdx: 1, EDCCACtrl: 1 
[   32.412000] WtcSetMaxStaNum: MaxStaNum:84, BssidNum:8, WdsNum:0, ApcliNum:2, MaxNumChipRept:32, MinMcastWcid:118
[   32.480000] red_is_enabled: set CR4/N9 RED Enable to 1.
[   32.492000] cp_support_is_enabled: set CR4 CP_SUPPORT to Mode 2.
[   32.504000] Correct apidx from 7 to 0 for WscUUIDInit
[   32.512000] Generate UUID for apidx(0)
[   32.520000] first MBSSID is 34 76 c5 9b a0 b0
[   32.528000] UUID: c23b3558, len = 16
[   32.536000] 0x0000 : bc 32 9e 00 1d d8 11 b2 86 01 34 76 c5 9b a0 b0 
[   32.548000] 
[   32.936000] :MtCmdPktBudgetCtrl: bssid(255),wcid(65535),type(0)
[   33.016000] device rai0 entered promiscuous mode
[   33.028000] br-lan: port 3(rai0) entered forwarding state
[   33.036000] br-lan: port 3(rai0) entered forwarding state
[   33.572000] Device Instance
[   33.576000]  WDEV 00:
                Name:rai0
[   33.584000]          Wdev(list) Idx:0
[   33.588000]           Idx:8
[   33.592000]  WDEV 01:
                Name:rai1
[   33.600000]          Wdev(list) Idx:1
[   33.608000]           Idx:9
[   33.612000]  WDEV 02:
                Name:rai2
[   33.616000]          Wdev(list) Idx:2
[   33.624000]           Idx:10
[   33.628000]  WDEV 03:
                Name:rai3
[   33.636000]          Wdev(list) Idx:3
[   33.640000]           Idx:11
[   33.644000]  WDEV 04:
                Name:ra0
[   33.652000]          Wdev(list) Idx:4
[   33.660000]           Idx:12
[   33.664000]  WDEV 05:
                Name:ra1
[   33.668000]          Wdev(list) Idx:5
[   33.676000]           Idx:13
[   33.680000]  WDEV 06:
                Name:ra2
[   33.688000]          Wdev(list) Idx:6
[   33.692000]           Idx:14
[   33.696000]  WDEV 07:
                Name:ra3
[   33.704000]          Wdev(list) Idx:7
[   33.712000]           Idx:15
[   33.716000]  WDEV 08:
                Name:apclii0
[   33.724000]          Wdev(list) Idx:8
[   33.728000]           Idx:16
[   33.732000]  WDEV 09:
                Name:apcli0
[   33.740000]          Wdev(list) Idx:9
[   33.748000]           Idx:17
[   33.752000]  WDEV 10:
[   33.756000]  WDEV 11:
[   33.760000]  WDEV 12:
[   33.764000]  WDEV 13:
[   33.768000]  WDEV 14:
[   33.772000]  WDEV 15:
[   33.780000]  WDEV 16:
[   33.784000]  WDEV 17:
[   35.040000] br-lan: port 3(rai0) entered forwarding state
[   35.440000] WifiSysOpen(), wdev idx = 4
[   35.448000] wdev_attr_update(): wdevId4 = 34:76:c5:9b:a0:b0
[   35.460000] MtCmdSetDbdcCtrl:(ret = 0)
[   35.468000] [PMF]APPMFInit:: apidx=4, MFPC=0, MFPR=0, SHA256=0
[   35.480000] [PMF]WPAMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
[   35.492000] HcUpdatePhyMode(): Update PhyMode for all wdev for this band PhyMode:14,Channel=2
[   35.512000] CountryCode(2.4G/5G)=1/1, RFIC=25, PHY mode(2.4G/5G)=14/49, support 32 channels
[   35.528000] wtc_acquire_groupkey_wcid: Found a non-occupied wtbl_idx:126 for WDEV_TYPE:1
[   35.528000]  LinkToOmacIdx = 14, LinkToWdevType = 1
[   35.556000] bssUpdateBmcMngRate (BSS_INFO_BROADCAST_INFO),                 CmdBssInfoBmcRate.u2BcTransmit= 0,                 CmdBssInfoBmcRate.u2McTransmit = 0
[   35.588000] MtCmdSetDbdcCtrl:(ret = 0)
[   35.704000] [RadarStateCheck]Set into RD_NORMAL_MODE
[   35.712000] MtCmdTxPowerSKUCtrl: fgTxPowerSKUEn: 1, BandIdx: 0
[   35.724000] MtCmdTxPowerPercentCtrl: fgTxPowerPercentEn: 1, BandIdx: 0
[   35.736000] MtCmdTxBfBackoffCtrl: fgTxBFBackoffEn: 0, BandIdx: 0
[   35.748000] mt7615_bbp_adjust():rf_bw=1, ext_ch=1, PrimCh=2, HT-CentCh=4, VHT-CentCh=42
[   35.764000] mt7615_apply_dcoc() : reload Central CH [4] BW [1] from cetral freq [2432]  offset [2300] 
[   35.784000] MtCmdGetRXDCOCCalResult:(ret = 0)
[   35.792000] mt7615_apply_dpd() : reload Central CH [4] BW [1] from cetral freq [2422] i[44] offset [4b20] 
[   35.812000] MtCmdGetTXDPDCalResult:(ret = 0)
[   35.820000] MtCmdChannelSwitch: control_chl = 2,control_ch2=0, central_chl = 4 DBDCIdx= 0, Band= 0 
[   35.840000] BW = 1,TXStream = 2, RXStream = 2, scan(0)
[   35.896000] ap_phy_rrm_init_byRf(): AP Set CentralFreq at 4(Prim=2, HT-CentCh=4, VHT-CentCh=42, BBP_BW=1)
[   35.928000] LeadTimeForBcn, OmacIdx = 14, WDEV_WITH_BCN_ABILITY
[   35.940000] Generate UUID for apidx(4)
[   35.948000] first MBSSID is 34 76 c5 9b a0 b0
[   35.960000] UUID: c23c11d8, len = 16
[   35.964000] 0x0000 : bc 32 9e 00 1d d8 11 b2 86 01 34 76 c5 9b a0 b0 
[   35.980000] 
start daemon 
[   36.296000] device ra0 entered promiscuous mode
[   36.304000] br-lan: port 4(ra0) entered forwarding state
[   36.316000] br-lan: port 4(ra0) entered forwarding state
[   36.464000] led=8, on=0, off=4000, blinks,=0, reset=0, time=1 low_trigger=1
[   36.560000] led=8, on=0, off=4000, blinks,=0, reset=0, time=1 low_trigger=0
[   36.648000] led=8, on=0, off=4000, blinks,=0, reset=0, time=1 low_trigger=1
[   36.696000] Device Instance
[   36.700000]  WDEV 00:
                Name:rai0
[   36.708000]          Wdev(list) Idx:0
[   36.716000]           Idx:8
[   36.720000]  WDEV 01:
                Name:rai1
[   36.728000]          Wdev(list) Idx:1
[   36.732000]           Idx:9
[   36.736000]  WDEV 02:
                Name:rai2
[   36.744000]          Wdev(list) Idx:2
[   36.748000]           Idx:10
[   36.756000]  WDEV 03:
                Name:rai3
[   36.760000]          Wdev(list) Idx:3
[   36.768000]           Idx:11
[   36.772000]  WDEV 04:
                Name:ra0
[   36.780000]          Wdev(list) Idx:4
[   36.784000]           Idx:12
[   36.788000]  WDEV 05:
                Name:ra1
[   36.796000]          Wdev(list) Idx:5
[   36.800000]           Idx:13
[   36.808000]  WDEV 06:
                Name:ra2
[   36.812000]          Wdev(list) Idx:6
[   36.820000]           Idx:14
[   36.824000]  WDEV 07:
                Name:ra3
[   36.832000]          Wdev(list) Idx:7
[   36.836000]           Idx:15
[   36.840000]  WDEV 08:
                Name:apclii0
[   36.848000]          Wdev(list) Idx:8
[   36.856000]           Idx:16
[   36.860000]  WDEV 09:
                Name:apcli0
[   36.868000]          Wdev(list) Idx:9
[   36.872000]           Idx:17
[   36.876000]  WDEV 10:
[   36.880000]  WDEV 11:
[   36.888000]  WDEV 12:
[   36.892000]  WDEV 13:
[   36.896000]  WDEV 14:
[   36.900000]  WDEV 15:
[   36.904000]  WDEV 16:
[   36.908000]  WDEV 17:
procd: - init complete -
[   38.320000] br-lan: port 4(ra0) entered forwarding state
switch_val: 1
ifce_automode: 
wan_link_stat: 0
[   48.176000] led=9, on=4000, off=0, blinks,=0, reset=0, time=1 low_trigger=0

firmware update log

### DO NOT set cfgapply ###
### Checksum is the same but commit does not change anything! Do nothing! ###
[  193.596000] led=9, on=1, off=1, blinks,=1, reset=0, time=4000 low_trigger=0
Unlocking firmware ...

Writing from /tmp/fw.bin to firmware ...     
Header checksum OK.
Data checksum OK
Unlocking persist ...
### Switch to bank 1 on next boot! ###
procd: - shutdown -
[  200.976000] eth1: ===> VirtualIF_close
[  201.912000] br-lan: port 3(ra0) entered disabled state
[  201.920000] br-lan: port 2(rai0) entered disabled state
[  201.932000] br-lan: port 1(eth0) entered disabled state
[  201.944000] device eth0 left promiscuous mode
[  201.952000] br-lan: port 1(eth0) entered disabled state
[  201.964000] ra2880stop()...Done
[  201.968000] eth1: ===> VirtualIF_close
[  201.980000] Free TX/RX Ring Memory!
[  201.988000] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[  202.000000] device ra0 left promiscuous mode
[  202.008000] br-lan: port 3(ra0) entered disabled state
[  202.016000] device rai0 left promiscuous mode
[  202.028000] br-lan: port 2(rai0) entered disabled state
[  203.560000] WifiSysClose(), wdev idx = 0
[  203.576000] WifiSysGetBssInfoState(): BssInfoIdx 0 not found!!!
[  203.588000] WifiSysUpdateBssInfoState(): BssInfoIdx 0 not found!!!
[  204.892000] Device Instance
[  204.900000]  WDEV 00:
                Name:rai0
[  204.904000]          Wdev(list) Idx:0
[  204.912000]           Idx:8
[  204.916000]  WDEV 01:
                Name:rai1
[  204.924000]          Wdev(list) Idx:1
[  204.928000]           Idx:9
[  204.932000]  WDEV 02:
                Name:rai2
[  204.940000]          Wdev(list) Idx:2
[  204.944000]           Idx:10
[  204.948000]  WDEV 03:
                Name:rai3
[  204.956000]          Wdev(list) Idx:3
[  204.964000]           Idx:11
[  204.968000]  WDEV 04:
                Name:ra0
[  204.972000]          Wdev(list) Idx:4
[  204.980000]           Idx:12
[  204.984000]  WDEV 05:
                Name:ra1
[  204.992000]          Wdev(list) Idx:5
[  204.996000]           Idx:13
[  205.000000]  WDEV 06:
                Name:ra2
[  205.008000]          Wdev(list) Idx:6
[  205.016000]           Idx:14
[  205.020000]  WDEV 07:
                Name:ra3
[  205.024000]          Wdev(list) Idx:7
[  205.032000]           Idx:15
[  205.036000]  WDEV 08:
                Name:apclii0
[  205.044000]          Wdev(list) Idx:8
[  205.048000]           Idx:16
[  205.052000]  WDEV 09:
                Name:apcli0
[  205.060000]          Wdev(list) Idx:9
[  205.068000]           Idx:17
[  205.072000]  WDEV 10:
[  205.076000]  WDEV 11:
[  205.080000]  WDEV 12:
[  205.084000]  WDEV 13:
[  205.088000]  WDEV 14:
[  205.096000]  WDEV 15:
[  205.100000]  WDEV 16:
[  205.104000]  WDEV 17:
[  205.112000] WifiSysClose(), wdev idx = 4
[  205.112000] WifiSysGetBssInfoState(): BssInfoIdx 1 not found!!!
[  205.112000] WifiSysUpdateBssInfoState(): BssInfoIdx 1 not found!!!
[  205.144000] MtAsicSetPiggyBack(779): Not support for HIF_MT yet!
[  205.156000] WifiSysClose(), wdev idx = 0
[  205.164000] WifiSysClose(), wdev idx = 1
[  205.172000] WifiSysClose(), wdev idx = 2
[  205.180000] WifiSysClose(), wdev idx = 3
[  205.212000] MtAsicSetPiggyBack(779): Not support for HIF_MT yet!
[  205.224000] WifiSysClose(), wdev idx = 4
[  205.232000] WifiSysClose(), wdev idx = 5
[  205.240000] WifiSysClose(), wdev idx = 6
[  205.248000] WifiSysClose(), wdev idx = 7
[  205.260000] kill LoopBackTxTask task failed!
[  205.272000] AndesRestartCheck: Current TOP_MISC2(0x7)
[  205.324000] CmdReStartDLRsp: Status Success!, Status(0)
[  205.336000] EventExtEventHandler: Unknown Ext Event(6f)
[  205.348000] AndesRestartCheck:  TOP_MISC2(1)
[  205.356000] RT28xxPciAsicRadioOff(): Not support for HIF_MT yet!
[  205.368000] RTMPDrvClose call RT28xxPciAsicRadioOff fail !!
[  205.380000] tx_kickout_fail_count = 0
[  205.384000] tx_timeout_fail_count = 0
[  205.392000] rx_receive_fail_count = 0
[  205.400000] alloc_cmd_msg = 1747
[  205.408000] free_cmd_msg = 1747
[  205.416000] cut_through_token_list_destroy(): 85854208,85854208
[  205.428000] cut_through_token_list_destroy(): 85854218,85854218
[  205.444000] FwOwn()::Set Fw Own
[  205.452000] RTMP_AllTimerListRelease: Size=0
[  205.464000] FwOwn()::Return since already in Fw Own...
[  205.472000] <---HwCtrlThread
procd: - reboot [  205.612000] Stopped WatchDog Timer.
-
[  205.620000] Restarting system.

WRC-733GHBK ブート時TFTP (RESETボタン)

WRC-733GHBKは、デバイスの電源投入時にRESETボタンを押しながら行うとTFTPサーバが開始される。
その時投入してみたログ。

U-Boot 1.1.3 (Jun  2 2015 - 17:05:47)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fac000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
spi_wait_nsec: 29 
spi device id: c2 20 17 c2 20 (2017c220)
find flash: MX25L6405D
raspi_read: from:30000 len:1000 
*** Warning - bad CRC, using default environment

============================================ 
Ralink UBoot Version: 4.1.2.0
-------------------------------------------- 
ASIC 7620_MP (Port5GigaSW)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Jun  2 2015  Time:17:05:47
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 580 MHZ #### 
 estimate memory size =64 Mbytes

 Realtek giga Mac init!

 Realtek giga Mac done!

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   5: Load ucos code to SDRAM via TFTP Client. 
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP. 

raspi_read: from:40028 len:6 

   
5: System Load Boot Loader | F/W  then write to Flash via TFTP Client. 
 Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
 Please Input new ones /or Ctrl-C to discard
        Input device IP (192.168.2.81)  Input server IP (192.168.2.89)  Input Linux Kernel filename () 
 netboot_common, argc= 3 

 NetTxPacket = 0x83FE3E80 

 KSEG1ADDR(NetTxPacket) = 0xA3FE3E80 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 Realtek giga Mac init!
regData1 = 0000 regData2 = 0000, RTL8367R
(rtk_switch_init 11983) init_rgmii done 

 Realtek giga Mac support done

 ETH_STATE_ACTIVE!! 
(NetLoop 408) bd->bi_enetaddr = 00:00:aa:bb:cc:dd
(NetLoop 409) NetOurEther = 00:00:aa:bb:cc:dd
Select server or client model: 1/2
server model start
SERVER IP address : 192.168.1.6 port:69
Load address: 0x80a00000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REQUEST, return our IP
Peer IP:192.168.1.89
Got ARP REPLY, set server/gtwy eth addr (3c:97:0e:60:44:30)
Got it
Peer IP:192.168.1.89
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######################
done
Bytes transferred = 5767953 (580311 hex)
NetBootFileXferSize= 00580311

****************Parse Head**************
signature=CSYS startAddr=0x01100000 burnAddr=0x00070000 nmodTag=RN62 len=0x0057ac72 

****************CheckSume**************
CheckSum ok!
****************Start Upgrade Kernel**************
raspi_erase_write: offs:70000, count:57ac86
raspi_erase: offs:70000 len:570000
.......................................................................................
raspi_write: to:70000 len:570000 
.......................................................................................
raspi_read: from:70000 len:10000 
raspi_read: from:80000 len:10000 
raspi_read: from:90000 len:10000 
raspi_read: from:a0000 len:10000 
raspi_read: from:b0000 len:10000 
raspi_read: from:c0000 len:10000 
raspi_read: from:d0000 len:10000 
raspi_read: from:e0000 len:10000 
raspi_read: from:f0000 len:10000 
raspi_read: from:100000 len:10000 
raspi_read: from:110000 len:10000 
raspi_read: from:120000 len:10000 
raspi_read: from:130000 len:10000 
raspi_read: from:140000 len:10000 
raspi_read: from:150000 len:10000 
raspi_read: from:160000 len:10000 
raspi_read: from:170000 len:10000 
raspi_read: from:180000 len:10000 
raspi_read: from:190000 len:10000 
raspi_read: from:1a0000 len:10000 
raspi_read: from:1b0000 len:10000 
raspi_read: from:1c0000 len:10000 
raspi_read: from:1d0000 len:10000 
raspi_read: from:1e0000 len:10000 
raspi_read: from:1f0000 len:10000 
raspi_read: from:200000 len:10000 
raspi_read: from:210000 len:10000 
raspi_read: from:220000 len:10000 
raspi_read: from:230000 len:10000 
raspi_read: from:240000 len:10000 
raspi_read: from:250000 len:10000 
raspi_read: from:260000 len:10000 
raspi_read: from:270000 len:10000 
raspi_read: from:280000 len:10000 
raspi_read: from:290000 len:10000 
raspi_read: from:2a0000 len:10000 
raspi_read: from:2b0000 len:10000 
raspi_read: from:2c0000 len:10000 
raspi_read: from:2d0000 len:10000 
raspi_read: from:2e0000 len:10000 
raspi_read: from:2f0000 len:10000 
raspi_read: from:300000 len:10000 
raspi_read: from:310000 len:10000 
raspi_read: from:320000 len:10000 
raspi_read: from:330000 len:10000 
raspi_read: from:340000 len:10000 
raspi_read: from:350000 len:10000 
raspi_read: from:360000 len:10000 
raspi_read: from:370000 len:10000 
raspi_read: from:380000 len:10000 
raspi_read: from:390000 len:10000 
raspi_read: from:3a0000 len:10000 
raspi_read: from:3b0000 len:10000 
raspi_read: from:3c0000 len:10000 
raspi_read: from:3d0000 len:10000 
raspi_read: from:3e0000 len:10000 
raspi_read: from:3f0000 len:10000 
raspi_read: from:400000 len:10000 
raspi_read: from:410000 len:10000 
raspi_read: from:420000 len:10000 
raspi_read: from:430000 len:10000 
raspi_read: from:440000 len:10000 
raspi_read: from:450000 len:10000 
raspi_read: from:460000 len:10000 
raspi_read: from:470000 len:10000 
raspi_read: from:480000 len:10000 
raspi_read: from:490000 len:10000 
raspi_read: from:4a0000 len:10000 
raspi_read: from:4b0000 len:10000 
raspi_read: from:4c0000 len:10000 
raspi_read: from:4d0000 len:10000 
raspi_read: from:4e0000 len:10000 
raspi_read: from:4f0000 len:10000 
raspi_read: from:500000 len:10000 
raspi_read: from:510000 len:10000 
raspi_read: from:520000 len:10000 
raspi_read: from:530000 len:10000 
raspi_read: from:540000 len:10000 
raspi_read: from:550000 len:10000 
raspi_read: from:560000 len:10000 
raspi_read: from:570000 len:10000 
raspi_read: from:580000 len:10000 
raspi_read: from:590000 len:10000 
raspi_read: from:5a0000 len:10000 
raspi_read: from:5b0000 len:10000 
raspi_read: from:5c0000 len:10000 
raspi_read: from:5d0000 len:10000 
raspi_read: from:5e0000 len:10000 
raspi_erase: offs:5e0000 len:10000
.
raspi_write: to:5e0000 len:10000 
.
raspi_read: from:5e0000 len:10000 
Done!
## Booting image at bc070000 ...
raspi_read: from:70000 len:40 
Magic number at 0xBC070000 
   Image Name:   MIPS OpenWrt Linux-4.14.138
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1670238 Bytes =  1.6 MB
   Load Address: 80000000
   Entry Point:  80000000
raspi_read: from:70054 len:197c5e 
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 4.14.138 (musashino205@Taiha.Net) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r0+10854-852f048b82)) #0 Fri Aug 23 16:55:26 2019
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620A ver:2 eco:6
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is ELECOM WRC-733GHBK
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] random: get_random_bytes called from start_kernel+0x98/0x4a0 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=0007fabe
[    0.000000] Readback ErrCtl register=0007fabe
[    0.000000] Memory: 58360K/65536K available (3917K kernel code, 190K rwdata, 892K rodata, 1200K init, 213K bss, 7176K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000010] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015467] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087707] pid_max: default: 32768 minimum: 301
[    0.097160] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.110182] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.131221] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.150708] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.162924] pinctrl core: initialized pinctrl subsystem
[    0.173787] NET: Registered protocol family 16
[    0.665950] PCI host bridge /pcie@10140000 ranges:
[    0.675350]  MEM 0x0000000020000000..0x000000002fffffff
[    0.685722]   IO 0x0000000010160000..0x000000001016ffff
[    0.714206] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.725244] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.737497] GPIO line 0 (rtl8367rb-reset) hogged as output/high
[    0.750035] PCI host bridge to bus 0000:00
[    0.758035] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.771751] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    0.783477] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.796976] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.813215] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.830199] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.843254] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.857062] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[    0.870562] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.884071] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
[    0.897568] pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff]
[    0.911066] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.920917] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
[    0.938629] clocksource: Switched to clocksource systick
[    0.950480] NET: Registered protocol family 2
[    0.959938] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.973721] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.986303] TCP: Hash tables configured (established 1024 bind 1024)
[    0.999087] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.010614] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.023350] NET: Registered protocol family 1
[    1.035064] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    1.047873] Crashlog allocated RAM at address 0x3f00000
[    1.060080] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    1.080014] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.091518] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.124159] io scheduler noop registered
[    1.131868] io scheduler deadline registered (default)
[    1.142881] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.156522] console [ttyS0] disabled
[    1.163578] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[    1.183243] console [ttyS0] enabled
[    1.183243] console [ttyS0] enabled
[    1.197059] bootconsole [early0] disabled
[    1.197059] bootconsole [early0] disabled
[    1.213531] cacheinfo: Failed to find cpu0 device node
[    1.223811] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    1.241020] spi spi0.0: force spi mode3
[    1.249524] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    1.259355] 6 fixed-partitions partitions found on MTD device spi0.0
[    1.272021] Creating 6 MTD partitions on "spi0.0":
[    1.281598] 0x000000000000-0x000000030000 : "u-boot"
[    1.292477] 0x000000030000-0x000000040000 : "u-boot-env"
[    1.304022] 0x000000040000-0x000000050000 : "factory"
[    1.315022] 0x000000050000-0x000000070000 : "nvram"
[    1.325661] 0x000000070000-0x0000007f0000 : "firmware"
[    1.340588] 2 edimax-fw partitions found on MTD device firmware
[    1.352442] Creating 2 MTD partitions on "firmware":
[    1.362354] 0x000000000000-0x000000197cb2 : "kernel"
[    1.373202] 0x000000197cb2-0x000000780000 : "rootfs"
[    1.383991] mtd: device 6 (rootfs) set to be root filesystem
[    1.396927] 1 squashfs-split partitions found on MTD device rootfs
[    1.409321] 0x00000057b000-0x000000780000 : "rootfs_data"
[    1.421034] 0x0000007f0000-0x000000800000 : "hwconfig"
[    1.433043] libphy: Fixed MDIO Bus: probed
[    1.451060] gsw: setting port4 to ephy mode
[    1.459500] mtk_soc_eth 10100000.ethernet: generated random MAC address 62:be:ad:3f:f9:38
[    1.475838] mtk_soc_eth 10100000.ethernet: using fixed link parameters
[    1.488931] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[    1.501443] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    1.518465] rt2880_wdt 10000120.watchdog: Initialized
[    1.529931] NET: Registered protocol family 10
[    1.542959] Segment Routing with IPv6
[    1.550459] NET: Registered protocol family 17
[    1.559409] 8021q: 802.1Q VLAN Support v1.8
[    1.578909] VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
[    1.599546] Freeing unused kernel memory: 1200K
[    1.608595] This architecture does not have kernel memory protection.
[    2.623338] init: Console is alive
[    2.630457] init: - watchdog -
[    2.798590] random: fast init done
[    3.878900] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.104077] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.121329] init: - preinit -
[    5.573772] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex)
[    5.590196] 8021q: adding VLAN 0 to HW filter on device eth0
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3[    5.753384] random: procd: uninitialized urandom read (4 bytes read)
] or [4] key and hit [enter] to select the debug level
[    6.316998] mount_root: no usable overlay filesystem found, using tmpfs overlay
[    6.364486] urandom-seed: Seed file not found (/etc/urandom.seed)
[    6.461068] mtk_soc_eth 10100000.ethernet eth0: port 5 link down
[    6.485387] procd: - early -
[    6.491235] procd: - watchdog -
[    6.698076] procd: - watchdog -
[    6.704756] procd: - ubus -
[    6.862689] random: ubusd: uninitialized urandom read (4 bytes read)
[    6.981070] random: ubusd: uninitialized urandom read (4 bytes read)
[    6.994384] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.008207] procd: - init -
Please press Enter to activate this console.
[    7.922544] urandom_read: 5 callbacks suppressed
[    7.922555] random: jshn: uninitialized urandom read (4 bytes read)
[    8.361984] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.541834] urngd: jent-rng init failed, err: 2
[    8.652330] nat46: module (version 683fbd2b765506332a1af141545652bf58f03166) loaded.
[    8.675599] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    8.697423] rtl8367b rtl8367rb: cannot find mdio node phandle
[    8.708988] rtl8367b rtl8367rb: using GPIO pins 22 (SDA) and 23 (SCK)
[    8.722970] rtl8367b rtl8367rb: RTL8367RB chip found
[    9.966115] libphy: rtl8367rb: probed
[   10.083435] Loading modules backported from Linux version v5.3-rc4-0-gd45331b00ddb
[   10.098595] Backport generated by backports.git v5.3-rc4-1-0-g4ec72687
[   10.115153] ip_tables: (C) 2000-2006 Netfilter Core Team
[   10.136997] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[   10.230487] xt_time: kernel timezone is -0000
[   10.404182] PPP generic driver version 2.4.2
[   10.415835] NET: Registered protocol family 24
[   10.440335] mt76x0e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[   10.452952] mt76x0e 0000:01:00.0: ASIC revision: 76100002
[   10.466491] mt76x0e 0000:01:00.0: Firmware Version: 0.1.00
[   10.507031] mt76x0e 0000:01:00.0: EEPROM ver:01 fae:00
[   10.568137] ieee80211 phy1: rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'soc_wmac.eeprom'.
[   10.588143] rt2800_wmac 10180000.wmac: Direct firmware load for soc_wmac.eeprom failed with error -2
[   10.606373] rt2800_wmac 10180000.wmac: Falling back to user helper
[   11.536487] ieee80211 phy1: rt2x00_set_rt: Info - RT chipset 6352, rev 0500 detected
[   11.551999] ieee80211 phy1: rt2x00_set_rf: Info - RF chipset 7620 detected
[   11.602846] kmodloader: done loading kernel modules from /etc/modules.d/*
[   51.845474] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex)
[   51.861628] 8021q: adding VLAN 0 to HW filter on device eth0
[   51.946429] device eth0 entered promiscuous mode
[   51.997223] br-lan: port 1(eth0.1) entered blocking state
[   52.008062] br-lan: port 1(eth0.1) entered disabled state
[   52.019216] device eth0.1 entered promiscuous mode
[   52.094894] br-lan: port 1(eth0.1) entered blocking state
[   52.105723] br-lan: port 1(eth0.1) entered forwarding state
[   52.117038] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   52.873138] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   55.379325] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes
[   55.396188] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 517
[   63.886220] random: crng init done



BusyBox v1.31.0 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r0+10852-a5aab6f68e
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# 

なんだかJFFS2周りがおかしいが、とりあえずこれで投入することが可能なことを確認。
JFFS2のエラーによりユーザー領域 (rootfs_data) が構築されない問題が発生するが、 firstboot 実施の上再起動することで正常に機能するようになった。

OpenWrtサポート作業状況+予定

WRC-733GHBK
factory投入テスト、最終的なコードチェックで投げ込み
 → 投げ込んだ
WRC-1167GHBK2-I
WRC-1167GHBK2, WRC-1167GHBK2-Cとの互換性をファームからのみ再調査、投げ込みはWRC-733GHBKの様子を見て判断
ただし、投げ込むとしてもWRC-1167GHBK2(-C)実機が手元で確認できない限り、WRC-1167GHBK2(-C)のサポートは含めない
WN-DX1167R
某フリマアプリにて購入済みのWN-AX1167GR2が届き次第、それのサポート作業と同時にDXとのDeviceTreeやsysupgrade周辺コード擦り合わせ実施
WNPR2600G
PRへのOpenWrtチームからの反応があまり無い
NetBSDなNEC機 (WR8750N, WR9500N, WG600HP)
通常のLinux機優先しているため投げ込みは保留中、自repo (musashino-build/openwrt) でのメンテナンスは継続
WR8175N, WG300HPはFlashが4MBのみのため、NetBSD機を投げ込むかどうかに関わらず独自のサポートに留める予定
WSR-2533DHPL
サポート作業は大体完了、あとはOpenWrt化のテストなどいくらか
WSR-2533DHP2
openwrt-devel MLに来ていたRTL8367Sドライバをウォッチ中、それの動向次第

作業予定

WCR-1166DS(入手予定)
MACアドレス構成コード周りの簡略化(mtd_get_mac_ascii へ置換), factoryのbrick問題検証
WSR-1166DHP(2)
MACアドレス構成コード周りの簡略化(mtd_get_mac_asciiへ置換)
git-bashから起動したVSCodeでもWindowsのssh.exeを使うメモ

git-bashから起動したVSCodeでもWindowsのssh.exeを使うメモ

2019/07/04 12:14 追記

Remote拡張で新たなウィンドウが起動された場合、そのウィンドウ内ではsettings.jsonの ${env: <var>} が展開されず、この文字列のままPATHに設定されてしまうことが判明。この結果、ウィンドウ内でSSHが使用できず接続に失敗する。
どうにもできないので、この記事のやり方は非推奨。2019/07/04現在、VSCode Insiders (バージョン: 1.36.0-insider) ではRemote拡張の設定でSSHコマンドへのパス指定が実装されているため、これを利用してしまうのが手っ取り早そう。リリース版 (バージョン: 1.35.1) にはこの設定は無し。
追記: リリース版 (バージョン: 1.36.0) からssh.exeへのパス指定が追加されていることを確認。

Windows 10にて、普段git-bashからVisual Studio Codeを起動して作業しているが、その際VSCodeへgit-bashからPATHが渡され、VSCode側の認識するssh.exeがgit-bash側のものとWindows側のもの2種類が存在してしまっていた。

PS C:\Users\tofu\git\musashino205\openwrt> cmd
Microsoft Windows [Version 10.0.18362.175]
(c) 2019 Microsoft Corporation. All rights reserved.

C:\Users\tofu\git\musashino205\openwrt>path
PATH=C:\Users\tofu\bin;C:\Program Files\Git\mingw64\bin;C:\Program Files\Git\usr\local\bin;C:\Program Files\Git\usr\bin;C:\Program Files\Git\usr\bin;C:\Program Files\Git\mingw64\bin;C:\Program Files\Git\usr\bin;C:\Users\tofu\bin;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Windows\System32\OpenSSH;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files\NVIDIA Corporation\NVIDIA NvDLISR;C:\Program Files\dotnet;C:\Program Files\Microsoft SQL Server\130\Tools\Binn;C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\170\Tools\Binn;C:\Program Files\Microsoft VS Code\bin;C:\Program Files (x86)\Poedit;D:\Compiler\go\bin;D:\Compiler\GOPATH\bin;C:\Users\tofu\AppData\Local\Microsoft\WindowsApps;C:\Program Files\Git\usr\bin\vendor_perl;C:\Program Files\Git\usr\bin\core_perl

C:\Users\tofu\git\musashino205\openwrt>where ssh.exe
C:\Program Files\Git\usr\bin\ssh.exe
C:\Windows\System32\OpenSSH\ssh.exe

C:\Users\tofu\git\musashino205\openwrt>

この結果、Remoting (SSH)などでgit-bash側のssh.exeが使用され、Windows側のssh-agentに登録した認証情報を使用して自動的にログインできず、毎回パスワードを聞かれて非常に面倒だった。

大体対処できたのでメモ。

Windowsの環境変数を追加登録
Windowsの環境変数を登録。ユーザー環境変数で問題ない。
名前は VSCPATH などとし、値は %PATH%
settings.jsonを編集
VSCodeのsettings.jsonを開き、以下を追加して保存(環境変数名は適宜合わせること)

    "terminal.integrated.env.windows": {
        "PATH": "${env:VSCPATH}"
    }

${env:<variable>} は環境変数を読み取って代入するもの。

以上。

PS C:\Users\tofu\git\musashino205\openwrt> cmd
Microsoft Windows [Version 10.0.18362.175]
(c) 2019 Microsoft Corporation. All rights reserved.

C:\Users\tofu\git\musashino205\openwrt>path
PATH=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files\NVIDIA Corporation\NVIDIA NvDLISR;C:\Program Files\dotnet\;C:\Program Files\Microsoft SQL Server\130\Tools\Binn\;C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\170\Tools\Binn\;C:\Program Files\Microsoft VS Code\bin;C:\Program Files (x86)\Poedit;D:\Compiler\go\bin;D:\Compiler\GOPATH\bin;C:\Users\tofu\AppData\Local\Microsoft\WindowsApps;

C:\Users\tofu\git\musashino205\openwrt>where ssh.exe
C:\Windows\System32\OpenSSH\ssh.exe

C:\Users\tofu\git\musashino205\openwrt>

WN-G300DGR

作業した時期が非常に古く、メモを取っていなかったので今更ながら書き出し。なお、既に散々弄った状態であるためオリジナルとは異なっていたり、破損個所が存在する可能性に注意すること。

MAC

  • LAN: 00:A0:B0:xx:xx:AC (u-boot-env, ethaddr (text))
  • WAN: 00:A0:B0:xx:xx:AB (u-boot-env, wanaddr (tex))
  • 2.4G: 00:A0:B0:xx:xx:AC (Factory, 0x4 (hex))

※Flash: Parallel-NOR (CFI) 4MiB (MX29LV320E)

U-Boot

  • help
    RT3052 # help
    rf      - read/write rf register
    ?       - alias for 'help'
    bootm   - boot application image from memory
    cp      - memory copy
    erase   - erase FLASH memory
    go      - start application at address 'addr'
    help    - print online help
    loadb   - load binary file over serial line (kermit mode)
    loopback   - Ralink eth loopback test !!
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    mw      - memory write (fill)
    nm      - memory modify (constant address)
    printenv- print environment variables
    protect - enable or disable FLASH write protection
    reset   - Perform RESET of the CPU
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    spicmd  - read/write data from/to eeprom or vtss
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version

    RT3052 # version
    
    U-Boot 1.1.3 (Jun  1 2011 - 15:30:20)
    

  • printenv

    RT3052 # printenv
    bootcmd=tftp
    bootdelay=5
    baudrate=57600
    ethaddr="00:A0:B0:**:**:**"
    sn=00024936I
    hw_ver=1.0.0
    pro_id=000
    country=000
    domain=1
    wanaddr=00:A0:B0:**:**:**
    wlanaddr=00:AA:BB:CC:DD:12
    fwaddr=00:AA:BB:CC:DD:13
    eth_en=0
    snextra=00000000000000000000
    preboot=echo;echo
    ramargs=setenv bootargs root=/dev/ram rw
    addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
    addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
    flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
    kernel_addr=BFC40000
    u-boot=u-boot.bin
    load=tftp 8A100000 $(u-boot)
    u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
    loadfs=tftp 8A100000 root.cramfs
    u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
    test_tftp=tftp 8A100000 root.cramfs;run test_tftp
    hw_id=030A003E
    ethact=Eth0 
    filesize=26c36d
    fileaddr=80800000
    ipaddr=192.168.99.9
    serverip=192.168.99.8
    autostart=no
    bootfile=uImageWN-G300DGR
    uboot_ver=1.0.6.20
    op_mode=1
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 1066/4092 bytes
    

Kernel

  • uname -a

    # uname -a
    Linux WN-G300DGR 2.6.21 #3 Tue Mar 17 09:25:56 CST 2015 mips unknown
    

  • cat /proc/version

    # cat /proc/version
    Linux version 2.6.21 (root@******-******-******-******) (gcc version 3.4.6) #3 Tue Mar 17 09:25:56 CST 2015
    

  • cat /proc/cpuinfo

    # cat /proc/cpuinfo
    system type             : Ralink SoC
    processor               : 0
    cpu model               : MIPS 24K V4.12
    BogoMIPS                : 255.48
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes
    ASEs implemented        : mips16 dsp
    VCED exceptions         : not available
    VCEI exceptions         : not available
    

  • cat /proc/meminfo

    # cat /proc/meminfo
    MemTotal:        29696 kB
    MemFree:         15092 kB
    Buffers:          1096 kB
    Cached:           5616 kB
    SwapCached:          0 kB
    Active:           3860 kB
    Inactive:         4216 kB
    SwapTotal:           0 kB
    SwapFree:            0 kB
    Dirty:               0 kB
    Writeback:           0 kB
    AnonPages:        1372 kB
    Mapped:           1920 kB
    Slab:             3684 kB
    SReclaimable:      464 kB
    SUnreclaim:       3220 kB
    PageTables:        412 kB
    NFS_Unstable:        0 kB
    Bounce:              0 kB
    CommitLimit:     14848 kB
    Committed_AS:     3692 kB
    VmallocTotal:  1048404 kB
    VmallocUsed:     18468 kB
    VmallocChunk:  1029828 kB
    

  • cat /proc/mtd

    # cat /proc/mtd
    dev:    size   erasesize  name
    mtd0: 00020000 00010000 "Bootloader"
    mtd1: 00010000 00010000 "backup"
    mtd2: 00010000 00010000 "Config "
    mtd3: 00010000 00010000 "Factory"
    mtd4: 000b0000 00010000 "Kernel"
    mtd5: 002b0000 00010000 "app"
    mtd6: 001a0000 00010000 "cb-app"
    mtd7: 00040000 00010000 "manufacture"
    mtd8: 00010000 00002000 "storage"
    

  • bootlog

    U-boot Ver:1.0.6.20 2011/06/01
    
    
    Board: Ralink APSoC DRAM:  32 MB  2*16 MB
    ============================================ 
    ASIC 3052_MP2 (Port5GigaSW)
    Product Name: WN-G300DGR
    SDRAM CAS = 3(d1835272) 
    ============================================ 
    
    Please choose the operation: 
       1: Load system code to SDRAM via TFTP. 
    
    LINUX started...
    
     THIS IS ASIC
    init started: BusyBox v1.7.5 (2015-03-17 09:22:54 CST)
    starting pid 151, tty '/dev/console': '/sbin/config_init'
    mknod: /dev/ttyS0: File exists
    mknod: /dev/ttyS1: File exists
    Config Init version: 1.15.000.113 date: 2015/03/17
    Thu Jan  1 00:00:00 UTC 2015
    mount: can't find /sys in /etc/fstab or /etc/mtab
    ln: /lib/./modules: File exists
    switch reg write offset=94, value=7f00
    Could not find Watchdog driver (/apps/lib/modules/2.6.21/kernel/arch/mips/rt2880/rt_timer.ko)
    Application Ver:1.15.000.113             Date:2015/03/17
    
    starting pid 211, tty '/dev/ttyS1': '/sbin/config_term'
    ************************************************************************
    *                               WN-G300DGR                             *
    ************************************************************************
    
    KernelApp/Ramdisk Ver:1.15.000.113                       Date:2015/03/17
    cat: can't open '/apps/lib/modules/2.6.21/modulesApp.dep': No such file or directory
    ln: /sbin/apps_init: File exists
    ln: /sbin/opmode.sh: File exists
    password: createShareMem keyid 7001 shmId 0
    Set Int value 0 but not in rage 1000 to 50000
    checkpApCfg i=746 [wan2_dl_bw]
    Set Int value 0 but not in rage 1000 to 50000
    checkpApCfg i=762 [wan2_ul_bw]
    checkpApCfg error!!
    CTRL_INTERFACE:[/var/sysconfd_if]  CTRL_INTERFACE_IF:[if0]
    
    System Monitoring
    *********************************************************************
    Initializing system environment
    Setting up /tmp directory ...
    Setting up loopback device ...
    ***************************************************
    System is in    AP Router Mode [0]
    ***************************************************
    SEM_GETID got id -1
    Mac: 0, rtcTime:1420070401
    Starting system logging daemon ...OK
    Setting up Ethernet devices ...
    OK
    Configuring Bridge device ...          OK
    Setting the host&domain name ...Finished.
    Configuring net ...          OK
    Configuring LAN device ...          OK
    getRegularDomain,0
    Configuring RT28XX device ...Wlan is in AP Mode
    Using fixWDSLowTP function.
    sh: cannot create /proc/netpktconfig/config_interface: nonexistent directory
    Wan Manager...
    Configuring WAN device[WAN0] ...
    Obtaining IP address from DHCP ... 
    wan is Ready
    Set Domain Routing for FLET'S Square Connection...            
    Starting DNS Proxy ...            FAILED
    Starting DHCP(udhcpd) server ...            OK
    Starting ntpclient ...            
    Setup tc for QoS ... Disabled
    
    SCHEDULE, ServiceWlanLowRateInit ...service_index[0].
    
    SCHEDULE, ServiceWlsRadioOffInit ...service_index[1].
    
    SCHEDULE, ServiceLedOffInit ...service_index[2].
    
    SCHEDULE, ServiceLanOffInit ...service_index[3].
    
    SCHEDULE, ServiceWanOffInit ...service_index[4].
    
    SCHEDULE, ServiceLanLowRateInit ...service_index[5].
    
    SCHEDULE, ServicePowerLedInit ...service_index[6].
    
    
    Schedule starting  [scheduleOpen], ...wait result..
    Schedule result :[Disable (No rules)]. 
    Configuring network routing and filtering ...Iptable restart VPN ACL ...VPN ACL ...
    OK
    Starting SiteBlock server ...            
    Netpacket Filter Open ....              sysGetKernelInfo: netv :1.0
    Kernel netpkt ver netv: 1.0
    OK
    Starting DDNS  ...  Disabled
    Starting UPNPD  ...  WAN Speed = 10 Mbps
    FAILED
    Starting HTTPD server ...           OK
    Staring ALG...           OK
    Starting LLTD ...           OK
    Starting netbios daemon ...  OK
    Initialization has completed
    *We used 6.210000 seconds to initialize all modules*
    pSEM_GETID got id 32769
    [RMGMT DBG] RMGMT_VERSION: 3.42.32
    NewWAN0:[192.168.1.25]  LastWAN0:[0.0.0.0]
    wan0Configuring ...
    Wan IP was changed, Reload related module**
    *** PROCESS MANAGER Starts ***
    Processmanager update modules
    Restarting Iptables ....Clean iptable...OK
    Configuring network routing and filtering ...Iptable restart VPN ACL ...VPN ACL ...
    OK
    OK
    QoS, Stopping
    Setup tc for QoS ... Disabled
    Reloading dnsProxy ...            Stopping DNS Proxy ...            OK
    Set Domain Routing for FLET'S Square Connection...            
    Starting DNS Proxy ...            wan0Configuring ...
    OK
    Stopping igmpProxy ...            OK
    Starting IGMP Proxy ...  OK
    Starting UPNPD  ...  WAN Speed = 1000 Mbps
    OK
    RMMOD ALG H323 [ip_nat_h323]
    RMMOD ALG MMS [ip_nat_mms]
    RMMOD 2nd ALG TFTP [ip_nat_tftp]
    RMMOD ALG TFTP [ip_conntrack_tftp]
    RMMOD ALG Egg [ip_conntrack_egg]
    RMMOD ALG IRC [ip_nat_irc]
    RMMOD ALG Quake3 [ip_nat_quake3]
    RMMOD ALG Talk [ip_nat_talk]
    RMMOD ALG PPTP [ip_nat_pptp]
    RMMOD ALG SNMP [ip_nat_snmp_basic]
    RMMOD ALG FTP [ip_nat_ftp]
    RMMOD 2nd ALG SIP [ip_nat_sip]
    RMMOD ALG SIP [ip_conntrack_sip]
    RMMOD 2nd ALG RTSP [ip_nat_rtsp]
    RMMOD ALG RTSP [ip_conntrack_rtsp]
    Staring ALG...           OK
    Processmanager update modules
    VPN, WAN_IP_CHANGED event received ...Closing ntpclient ...            Starting ntpclient ...            
    Stopping DDNS ...            OK
    Starting DDNS  ...  Disabled
    
    SCHEDULE, ServiceWlanLowRateInit ...service_index[0].
    
    SCHEDULE, ServiceWlsRadioOffInit ...service_index[1].
    
    SCHEDULE, ServiceLedOffInit ...service_index[2].
    
    SCHEDULE, ServiceLanOffInit ...service_index[3].
    
    SCHEDULE, ServiceWanOffInit ...service_index[4].
    
    SCHEDULE, ServiceLanLowRateInit ...service_index[5].
    
    SCHEDULE, ServicePowerLedInit ...service_index[6].
    
    
    Schedule starting  [scheduleOpen], ...wait result..
    Schedule result :[Disable (No rules)]. 
    ==>error
    

検索ワード色々

適当にWordPressのダッシュボードやGoogle Webmasterの解析を眺め、拾い上げたワードについて色々。
雑記だけでなくメインのブログでの検索ワードについてもまとめる。

Q: 何故OpenWrt関係だけ?
A: BVEとかVostro 260sその他も色々あったけど、最近の記事の傾向的にOpenWrtが扱いやすいから。
wn-ac1167r openwrt
WN-AC1167″R” はRealtek SoC搭載と推測される。OpenWrtでは現在Realtek SoCのサポートが無く、搭載するルータもサポートできないためこの機種は未サポート。今後の作業予定も無し。
elecom wrc-1167ghbk2-s dd-wrt
WRC-1167GHBK2-S用のDD-WRTファームウェアは存在せず。DD-WRTはそもそもが過去のOpenWrtをベースとし海外機を中心とした国外のプロジェクトであり、日本のみで販売されている機種をプロジェクトが人的その他のリソースを割いてサポートしても現地方面にとってはメリットが皆無であるため、サポートされる可能性は限りなく低い。OpenWrtでは既にサポート済み。
なお、BUFFALOやPlanexの一部機種(古いものが中心)はDD-WRTでもサポートされている。
openwrt コマンド仕様書
基本的に openwrt.org の Technical Reference を参照。OpenWrtはLinuxをKernelに採用しており、Linuxで一般的なコマンドについてはそれぞれの開発元のドキュメントを参照。
openwrt nec
2019年6月現在、OpenWrtでサポートされているNEC製ルータは以下の通り。

model SoC target/subtarget Release
WG800HP QCA9563 ath79/generic snapshot
WG1200CR QCA9563 ath79/generic snapshot
WG2600HP/HP2 IPQ8064 ipq806x/generic OpenWrt 18.06

※WG2600HPxはHPのみサポート済みとなっているが、WG2600HP2にもHP用OpenWrtファームウェアを使用可。WG2600HP3は未サポート。
※他にサポートが可能と思われる機種はいくつかあるが、実機を確保できていないため、まだ。

openwrt 対応機種
wsr-1166dhp3 openwrt
WSR-1166DHP3はRealtek SoCを搭載する。このため、上で挙げたWN-AC1167Rと同様にOpenWrtでサポートされていないSoCであるため現在この機種もサポートされておらず、今後作業予定も無し。