タグ: MT7620A

WRC-1167GHBK2-I

ハードオフ東久留米店で、WR9500Nと一緒に確保したもの。以前よりMT7620を搭載していることを把握していたものの、少々懸念する点があり購入は見送っていたが、ジャンクで非常に安価に出ていたので衝動的に購入してしまった。
upstreamへマージできるかは不明なものの、弄っていくのでメモ。

Switch

zone WAN LAN
port
(WRC-1167GHBK-I)
INTERNET LAN4 LAN3 LAN2 LAN1
port
(MT7530)
port0 port1 port2 port3 port4

MAC

5G (MT7612E)のEEPROMにMACアドレスが埋め込まれていないため、openwrt/openwrtへのPRは行わない。

  • LAN: BC:5C:4C:xx:xx:51 (hwconfig, HW.LAN.MAC.Address (text))
  • WAN: BC:5C:4C:xx:xx:50 (hwconfig, HW.LAN.MAC.Address (text))
  • 2G: BC:5C:4C:xx:xx:52 (hwconfig, HW.LAN.2G.0.MAC.Address (text))
  • 5G: BC:5C:4C:xx:xx:53 (hwconfig, HW.LAN.5G.0.MAC.Address (text))

U-Boot

  • help
    MT7620 # help
    ?       - alias for 'help'
    bootm   - boot application image from memory
    cp      - memory copy
    erase   - erase SPI FLASH memory
    go      - start application at address 'addr'
    help    - print online help
    loadb   - load binary file over serial line (kermit mode)
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    nm      - memory modify (constant address)
    printenv- print environment variables
    reset   - Perform RESET of the CPU
    rf      - read/write rf register
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version
    MT7620 # version
    
    U-Boot 1.1.3 (Mar 27 2015 - 15:25:08)
    

  • printenv
    MT7620 # printenv
    bootcmd=tftp
    bootdelay=3
    baudrate=57600
    ethaddr="00:AA:BB:CC:DD:10"
    ipaddr=192.168.2.81
    serverip=192.168.2.89
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 151/4092 bytes
    

Kernel

パスワードが掛けられており、ログイン不可。

  • bootlog
    U-Boot 1.1.3 (Mar 27 2015 - 15:25:08)
    
    Board: Ralink APSoC DRAM:  64 MB
    relocate_code Pointer at: 83fb4000
    enable ephy clock...done. rf reg 29 = 5
    SSC disabled.
    ******************************
    Software System Reset Occurred
    ******************************
    spi_wait_nsec: 29 
    spi device id: c2 20 17 c2 20 (2017c220)
    find flash: MX25L6405D
    raspi_read: from:30000 len:1000 
    *** Warning - bad CRC, using default environment
    
    ============================================ 
    Ralink UBoot Version: 4.1.2.0
    -------------------------------------------- 
    ASIC 7620_MP (Port5GigaSW)
    DRAM component: 512 Mbits DDR, width 16
    DRAM bus: 16 bit
    Total memory: 64 MBytes
    Flash component: SPI Flash
    Date:Mar 27 2015  Time:15:25:08
    ============================================ 
    icache: sets:512, ways:4, linesz:32 ,total:65536
    dcache: sets:256, ways:4, linesz:32 ,total:32768 
    
     ##### The CPU freq = 580 MHZ #### 
     estimate memory size =64 Mbytes
    #Reset_MT7530
    
    Please choose the operation: 
       1: Load system code to SDRAM via TFTP. 
       2: Load system code then write to Flash via TFTP. 
       3: Boot system code via Flash (default).
       4: Entr boot command line interface.
       5: Load ucos code to SDRAM via TFTP Client. 
       7: Load Boot Loader code then write to Flash via Serial. 
       9: Load Boot Loader code then write to Flash via TFTP. 
                                                                                                                              0  
       
    3: System Boot system code via Flash.
    ## Booting image at bc070000 ...
    raspi_read: from:70000 len:40 
    Magic number at 0xBC070000 
    raspi_read: from:70014 len:40 
       Image Name:   Linux Kernel Image
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    4165548 Bytes =  4 MB
       Load Address: 80000000
       Entry Point:  8000c2f0
    raspi_read: from:70054 len:3f8fac 
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 8000c2f0) ...
    ## Giving linux memsize in MB, 64
    
    Starting kernel ...
    
    
    LINUX started...
    
     THIS IS ASIC
    Linux version 2.6.36 (root@localhost.localdomain) (gcc version 3.4.2) #119 Fri Mar 27 15:23:29 CST 2015
    
     The CPU feqenuce set to 580 MHz
     PCIE: bypass PCIe DLL.
     PCIE: Elastic buffer control: Addr:0x68 -> 0xB4
     disable all power about PCIe
    CPU revision is: 00019650 (MIPS 24Kc)
    Software DMA cache coherency
    Determined physical RAM map:
     memory: 04000000 @ 00000000 (usable)
    Zone PFN ranges:
      Normal   0x00000000 -> 0x00004000
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
        0: 0x00000000 -> 0x00004000
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
    Kernel command line: console=ttyS1,57600n8 root=1f05 console=ttyS0
    PID hash table entries: 256 (order: -2, 1024 bytes)
    Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
    Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
    Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    Writing ErrCtl register=0006ee20
    Readback ErrCtl register=0006ee20
    Memory: 61840k/65536k available (2266k kernel code, 3696k reserved, 397k data, 176k init, 0k highmem)
    Hierarchical RCU implementation.
            Verbose stalled-CPUs detection is disabled.
    NR_IRQS:128
    Console: colour dummy device 80x25
    console [ttyS1] enabled
    Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
    pid_max: default: 32768 minimum: 301
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    RALINK_GPIOMODE = 1a301d
    RALINK_GPIOMODE = 18301d
    PPLL_CFG1=0xe50000
    MT7620 PPLL lock
    PPLL_DRV =0x80080504
    start PCIe register access
    RALINK_RSTCTRL = 2400000
    RALINK_CLKCFG1 = 75afffc0
    
    *************** MT7620 PCIe RC mode *************
    PCIE0 enabled
    init_rt2880pci done
    bio: create slab  at 0
    vgaarb: loaded
    pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
    pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
    pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
    pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
    pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff]
    pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
    pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff 64bit] (PCI address [0x20000000-0x200fffff]
    pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
    pci 0000:00:00.0: PCI bridge to [bus 01-01]
    pci 0000:00:00.0:   bridge window [io  disabled]
    pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
    pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
    BAR0 at slot 0 = 0
    bus=0x0, slot = 0x0
    res[0]->start = 0
    res[0]->end = 0
    res[1]->start = 20200000
    res[1]->end = 2020ffff
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    bus=0x1, slot = 0x0
    res[0]->start = 20000000
    res[0]->end = 200fffff
    res[1]->start = 0
    res[1]->end = 0
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    Switching to clocksource MIPS
    NET: Registered protocol family 2
    IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    TCP established hash table entries: 2048 (order: 2, 16384 bytes)
    TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
    TCP: Hash tables configured (established 2048 bind 2048)
    TCP reno registered
    UDP hash table entries: 256 (order: 0, 4096 bytes)
    UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    NET: Registered protocol family 1
    Load Kernel WDG Timer Module
    Load Ralink Timer0 Module
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    msgmni has been set to 120
    io scheduler noop registered (default)
    Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
    serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
    serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
    brd: module loaded
    deice id : c2 20 17 c2 20 (2017c220)
    MX25L6405D(c2 2017c220) (8192 Kbytes)
    mtd .name = raspi, .size = 0x00800000 (0M) .erasesize = 0x00000008 (0K) .numeraseregions = 65536
    Creating 8 MTD partitions on "raspi":
    0x000000000000-0x000000030000 : "Bootloader"
    0x000000030000-0x000000040000 : "Config"
    0x000000040000-0x000000050000 : "Factory"
    0x000000050000-0x000000070000 : "nvram"
    0x000000070000-0x000000170000 : "Kernel"
    0x000000170000-0x0000007f0000 : "RootFS"
    0x0000007f0000-0x000000800000 : "hwconfig"
    0x000000070000-0x0000007f0000 : "Uimage"
    rdm_major = 254
    SMACCR1 -- : 0x0000000c
    SMACCR0 -- : 0x43762077
    Ralink APSoC Ethernet Driver Initilization. v3.0  256 rx/tx descriptors allocated, mtu = 1500!
    SMACCR1 -- : 0x0000000c
    SMACCR0 -- : 0x43762077
    PROC INIT OK!
    PPP generic driver version 2.4.2
    PPP BSD Compression module registered
    NET: Registered protocol family 24
    PPTP driver version 0.8.5
    i8042.c: i8042 controller self test timeout.
    Trying to free nonexistent resource 
    mice: PS/2 mouse device common for all mice
    Ralink APSoC Hardware Watchdog Timer
    u32 classifier
        Performance counters on
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (966 buckets, 3864 max)
    ctnetlink v0.93: registering with nfnetlink.
    matchsize=264
    xt_time: kernel timezone is -0000
    GRE over IPv4 demultiplexor driver
    gre: can't add protocol
    ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
    TCP cubic registered
    NET: Registered protocol family 17
    dnshijack
    802.1Q VLAN Support v1.8 Ben Greear 
    All bugs added by David S. Miller 
    VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
    Freeing unused kernel memory: 176k freed
    init started: BusyBox v1.12.1 (2015-01-27 11:57:03 CST)
    starting pid 23, tty '': '/etc/init.d/rcS sysinit'
    rc ver. 1.0.3
    Initializing...Success!
    Mounting file systems...Success!
    Creating devices...Success!
    Creating loopback device...Success!
    starting pid 30, tty '': '/etc/init.d/rcS start'
    rc ver. 1.0.3
    Initializing...Success!
    Loading dynamic libraries...Success!
    edx_gpio: module license 'unspecified' taints kernel.
    Disabling lock debugging due to kernel taint
    Initializing EDX GPIO...Done
    Acelink events notification ver. 1.6
    argv[0]=/sbin/ev_broker i=5 class=2 paction=NETDEV_REGISTER hold=
    NVRAM access daemon Ver. 1.0 Build 2argv[0]=/sbin/ev_broker i=5 class=2 paction=NETDEV_UP hold=
    0150127115621
    daemonize process
    Algorithmics/MIPS FPU Emulator v1.5
    argv[0]=/sbin/ev_broker i=5 class=2 paction=NETDEV_REGISTER hold=
    Starting L0000Config.so...binfile link OK!
    Done ! (ret=0)
    Starting L0100WLANInterface.so...Done ! (ret=0)
    Starting L0130EthInterface.so...Done ! (ret=0)
    Starting L0200LANConfig.so...Done ! (ret=0)
    1970-01-01 00:00:19: (server.c.915) can't have more connections than fds/2:  1024 824 
    start lld2d...
    udhcpd: max_leases=235 is too big, setting to 101
    start child_net...
    start Router mode accesscontrol...
    starting firewall...
    start house_keeper...
    Starting L0230LANServices.so...Done ! (ret=0)
    Starting L0300WANConfig.so...Done ! (ret=0)
    
    Please press Enter to activate this console. starting wan_event...
    wan_event done !
    Notice: caching turned off
    Notice: caching turned off
    insmod: cannot insert '/sbin/hw_nat.ko': File exists
    starting wan_event...
    wan_event done !
    starting wan_event...
    udhcpc receive a leasefail for eth2.2
    wan_event done !
    

広告

WN-AC733GR3

WN-AC1167GRの作業にあたり、factoryファームの生成コードをある程度汎用化したく、おおよそヘッダが似通っているこの機種を確保。基板は9割方ELECOM WRC-733GHBKと同一だった。
弄るにあたってメモ。

Switch

zone WAN LAN
port
(WN-AC733GR3)
インターネット LAN4 LAN3 LAN2 LAN1
port
(RTL8367RB)
port0 port1 port2 port3 port4

MAC

Config (u-boot-env), eeprom内に有。

  • LAN: 34:76:C5:xx:xx:66 (Config, ethaddr (text))
  • WAN: 34:76:C5:xx:xx:65 (Config, wanaddr (text))
  • 2G: 34:76:C5:xx:xx:66 (Factory, 0x4 (hex))
  • 5G: 34:76:C5:xx:xx:67 (iNIC_rf, 0x4 (hex))

U-Boot

  • help
    MT7620 # help
    ?       - alias for 'help'
    bootm   - boot application image from memory
    elx_check      - check ELX image
    go      - start application at address 'addr'
    help    - print online help
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    mw      - memory write (fill)
    nm      - memory modify (constant address)
    printenv- print environment variables
    reset   - Perform RESET of the CPU
    rf      - read/write rf register
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version
    MT7620 # version
    
    U-Boot 1.1.3 (Jan 28 2013 - 19:01:11)
    

  • printenv
    MT7620 # printenv
    bootcmd=tftp
    baudrate=57600
    ethaddr="34:76:C5:**:**:66"
    ramargs=setenv bootargs root=/dev/ram rw
    addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
    addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
    flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
    kernel_addr=BFC40000
    u-boot=u-boot.bin
    load=tftp 8A100000 $(u-boot)
    u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
    loadfs=tftp 8A100000 root.cramfs
    u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
    test_tftp=tftp 8A100000 root.cramfs;run test_tftp
    ethact=Eth0 (10/100-M)
    language_code=jp
    hw_id=01040006
    domain=1
    pincode=01977608
    wlanaddr=00:aa:bb:cc:dd:10
    kver=2.00   
    sn=12345678901234567890123456789012
    usboot=0
    op_mode=1
    bver=4.0.1.5
    dom2=1
    wanaddr=34:76:C5:**:**:65
    bootdelay=2
    filesize=320000
    fileaddr=80A00000
    ipaddr=192.168.99.9
    serverip=192.168.99.8
    autostart=no
    bootfile=uImage_WN-AC733GR
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 1040/4092 bytes
    

Kernel

パスワードが掛けられている。

  • uname -a
    # uname -a
    Linux WN-AC733GR 3.2.9 #3 Mon Dec 2 17:57:37 CST 2013 mips GNU/Linux
    

  • cat /proc/version
    # cat /proc/version
    Linux version 3.2.9 (root@***-pc) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #3 Mon Dec 2 17:57:37 CST 2013
    

  • cat /proc/cpuinfo
    # cat /proc/cpuinfo
    system type             : Ralink MT7620   ver:2 eco:3
    machine                 : Ralink MT7620
    processor               : 0
    cpu model               : MIPS 24Kc V5.0
    BogoMIPS                : 385.02
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8]
    ASEs implemented        : mips16
    shadow register sets    : 1
    kscratch registers      : 0
    core                    : 0
    VCED exceptions         : not available
    VCEI exceptions         : not available
    

  • cat /proc/meminfo
    # cat /proc/meminfo
    MemTotal:          61928 kB
    MemFree:           36104 kB
    Buffers:            2112 kB
    Cached:             8716 kB
    SwapCached:            0 kB
    Active:             5028 kB
    Inactive:           8248 kB
    Active(anon):       2640 kB
    Inactive(anon):      732 kB
    Active(file):       2388 kB
    Inactive(file):     7516 kB
    Unevictable:           0 kB
    Mlocked:               0 kB
    SwapTotal:             0 kB
    SwapFree:              0 kB
    Dirty:                 0 kB
    Writeback:             0 kB
    AnonPages:          2464 kB
    Mapped:             1952 kB
    Shmem:               924 kB
    Slab:               6316 kB
    SReclaimable:        604 kB
    SUnreclaim:         5712 kB
    KernelStack:         672 kB
    PageTables:          452 kB
    NFS_Unstable:          0 kB
    Bounce:                0 kB
    WritebackTmp:          0 kB
    CommitLimit:       30964 kB
    Committed_AS:     349664 kB
    VmallocTotal:    1048372 kB
    VmallocUsed:        3448 kB
    VmallocChunk:    1034964 kB
    

  • cat /proc/mtd
    # cat /proc/mtd
    dev:    size   erasesize  name
    mtd0: 00800000 00001000 "ALL"
    mtd1: 00030000 00001000 "Bootloader"
    mtd2: 00010000 00001000 "Config"
    mtd3: 00008000 00001000 "Factory"
    mtd4: 00008000 00001000 "iNIC_rf"
    mtd5: 006d4000 00001000 "Kernel"
    mtd6: 00584000 00001000 "user"
    mtd7: 0008c000 00001000 "manufacture"
    mtd8: 00010000 00001000 "backup"
    mtd9: 00040000 00001000 "storage"
    

  • ls -al /sys/class/leds/
    # ls -al /sys/class/leds/
    lrwxrwxrwx    1         0 Jan  1  2012 2g_led -> ../../devices/platform/leds-gpio/leds/2g_led
    lrwxrwxrwx    1         0 Jan  1  2012 5g_led -> ../../devices/platform/leds-gpio/leds/5g_led
    lrwxrwxrwx    1         0 Jan  1  2012 status -> ../../devices/platform/leds-gpio/leds/status
    lrwxrwxrwx    1         0 Jan  1  2012 power_led -> ../../devices/platform/leds-gpio/leds/power_led
    drwxr-xr-x   18         0 Jan  1  2012 ..
    drwxr-xr-x    2         0 Jan  1  2012 .
    

  • bootlog (op_mode=1)
    U-Boot 1.1.3 (Jan 28 2013 - 19:01:11)
    
    Board: Ralink APSoC DRAM:  64 MB
    
     Realtek giga Mac init!
    Disable port 0
    Ralink UBoot ver: 4.0.1.0
    ELX UBoot ver: 4.0.1.5 (Jan 28 2013 19:01:11)
    Date:Jan 28 2013  Time:19:01:11
    CPU: 580 MHz, MEM: 64 MB
    
    Please choose the operation: 1, 2, 3, 4, 9
                                                                                                                              0  
       
    3: System Boot system code via Flash.
    ## Booting image at bc050000 ...
       Image Name:   Linux Kernel Image
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    1374857 Bytes =  1.3 MB
       Load Address: 80000000
       Entry Point:  80246300
       Verifying Checksum ... OK
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 80246300) ...
    ## Giving linux memsize in MB, 64
    
    Starting kernel ...
    
    Ralink MT7620   ver:2 eco:3 running at 580.00 MHz
    console [ttyS1] enabled
    System Init version: 1.1 date: 1
    Setting up file systems ...
    Setting up /mnt/tmpfs directory with tmpfs/16384KB
    Setting up FLASH storage partition ...
    Setting up /apps directory ...apps is in FLASH ...
    Setting up loopback device ...
    FINISHED
    Start Normal Operation with Debug Messages ...
    cmd [start_all&]
    cmd [echo 0 > /sys/devices/platform/gpio-keys-polled/disable_intp]
    Application version:2.0.0.1              Date:2013/12/02
    
    ************************************************************************
    *                                ---ELX---                             *
    ************************************************************************
    
    KernelApp version: 2.0.0 build date: 2013/12/02 build time: 17:52:39
    cmd> cmd [sh /tmp/link_apps_to_root_dir.sh $1 $2 > /dev/null]
    ln: /sbin/./start_all: File exists
    cmd [rm -rf /tmp/link_apps_to_root_dir.sh]
    cmd [/sbin/dbox_init]
    ===  DBox Init start ==
    Dbox: used token len/max token len: 23/24, longest one is [wl1qos_priority_control]
    Dbox: used item len/max item len: 187/200
    Share memory created:  keyid 6888 shm_id 0 size 219(KB)
    Warning: dbox_destroy_share_memory p_dbox_cfg is NULL!
    cmd [/sbin/sd  &]
    CMD[mkdir -p /var/sd]
    __create_share_mem keyid 6888 shm_id 0
    CTRL_INTERFACE:[/var/sd_if]  CTRL_INTERFACE_IF:[if0]
    
    System Monitoring
    cmd [/sbin/sd_ctrl start_all]
    name [all]
    name [default]
    name [lo]
    name [imq0]
    name [imq1]
    name [eth2]
    name [eth2.1]
    name [eth2.2]
    name [br0]
    
    
    ********************
    Initialize Radio_(24G) setting ... rd[0]==1
    OK
    
    
    Configuring Ralink WiFi device ...Wlan is in AP Mode
    CMD[insmod /lib/rt2860v2_ap.ko]
    CMD[ifconfig ra0 0.0.0.0 up]
    CMD[iwpriv ra0 set RadioOn=0]
    CMD[ifconfig ra1 0.0.0.0 up]
    CMD[brctl addif br0 ra0]
    CMD[brctl addif br0 ra1]
    CMD[mkdir -p /etc/wsc_xml]
    CMD[ln -s /apps/etc/xml/* /etc/wsc_xml]
    CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
    CMD[wscd -i ra0 -m 1 -w /etc/wsc_xml -a 192.168.0.1&]
    CMD[iwpriv ra0 set IgmpSnEnable=0]
    CMD[iwpriv ra1 set IgmpSnEnable=0]
    CMD[iwpriv ra0 set RadioOn=1]
    CMD[iwpriv ra0 set WscConfMode=7]
    CMD[echo netdev > /sys/class/leds/2g_led/trigger]
    CMD[echo "ra0" > /sys/class/leds/2g_led/device_name]
    CMD[echo "link tx rx"> /sys/class/leds/2g_led/mode]
    CMD[iwpriv ra0 set WscMaxPinAttack=5]
    CMD[iwpriv ra0 set HtMIMOPS=3]
    
    
    ********************
    Initialize Radio_(5G) setting ... rd[1]==1
    OK
    Configuring 5G radio setting ... 
    
    Configuring Ralink WiFi device ...Wlan is in AP Mode
    CMD[insmod /lib/mt7610_ap.ko]
    wscd: SSDP UDP PORT = 1900
    CMD[ifconfig rai0 0.0.0.0 up]
    CMD[iwpriv rai0 set RadioOn=0]
    CMD[brctl addif br0 rai0]
    CMD[mkdir -p /etc/wsc_xml]
    CMD[ln -s /apps/etc/xml/* /etc/wsc_xml]
    ln: /etc/wsc_xml/WFAWLANConfigSCPD.xml: File exists
    CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
    route: SIOCADDRT: File exists
    CMD[wscd -i rai0 -m 1 -w /etc/wsc_xml -a 192.168.0.1&]
    CMD[iwpriv rai0 set IgmpSnEnable=0]
    wscd: SSDP UDP PORT = 1900
    CMD[iwpriv rai0 set RadioOn=1]
    CMD[iwpriv rai0 set WscConfMode=7]
    CMD[echo netdev > /sys/class/leds/5g_led/trigger]
    CMD[echo "rai0" > /sys/class/leds/5g_led/device_name]
    CMD[echo "link tx rx"> /sys/class/leds/5g_led/mode]
    CMD[iwpriv rai0 set WscMaxPinAttack=5]
    CMD[iwpriv rai0 set HtMIMOPS=3]
    --> default
    --> pppoeUnnumberMode 0
    --> DHCP_AR_MODE lan_dhcpd_enable
    WAN Speed = 1000 Mbps
    CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
    route: SIOCADDRT: File exists
    CMD[mkdir -p /etc/linuxigd]
    CMD[ln -sf /apps/etc/linuxigd/* /etc/linuxigd/.]
    CMD[upnpd -f  eth2.2 br0&]
    FAILED
    cmd [/sbin/taskmanager &]
    cmd [/sbin/xcontrol 2>/dev/null &]
    SEM_GETID got id -1
    Err: read_to_buf failed to open file /proc/454/status!
    Err: read_to_buf failed to open file /proc/455/status!
    XControl version: 1.0.0
    [XCONTROL DBG] if_dev_name:[eth2]
    We are using default MAC [00:AA:BB:CC:DD:10]
    server_socket 3
    socket timeout is 300
    WAN Speed = 1000 Mbps
    CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
    route: SIOCADDRT: File exists
    CMD[mkdir -p /etc/linuxigd]
    CMD[ln -sf /apps/etc/linuxigd/* /etc/linuxigd/.]
    send 15 to pid:1076
    CMD[upnpd -f  eth2.2 br0&]
    OK
    *** Task manager starts ***
    taskmanager update modules
    Err: read_to_buf failed to open file /proc/1153/status!
    taskmanager update modules
    failed to read /tmp/task_mgr.conf, use backup file!
    

WN-AC1167GRメモ headerチェック

WN-AC1167GR内の header でファームのヘッダが問題無くチェックをパスできるか確認。

# tftp -r openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin -g 192.168.0.100
# header -x openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin 
### Decoding  image ####
Decode source file [openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin]
------- Header Info -------
Vendor  id:  0x0104
Product id:  0x0016
Hardware id:  0x01040016
Version id:  
Code Version:  
Type: 0x3 [kernel]
comp_file_len:  5505028
comp_file_sum:  0x0
Header sum:  0x0
Magic key:  0x0
MD5 chksum:  90ba7450183602a7cbe542bc1a9b436
------------------------------
Decode finished, got file [openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-factory.bin.bin] with size 5505028 bytes
header: Return OK

header付加スクリプト

  • TOOLDIRは環境に合わせて書き換え
  • mkhashとxorimageはOpenWrtのfirmware-utilsを使用
  • ファイルサイズとmd5sumの埋め込みはxxd利用するともう少し簡略化できる(たぶん)
  • create_headerの hw_id を変更することで、WN-AC733GRxやWNPR2600G、ELECOMの同様のヘッダを持つ機種にも利用できるかもしれない
#!/bin/bash

TOOLDIR="/home/tofu/routers/firmware-utils"

create_header(){
	fw_bin="$1"
	hw_id="01040016"

	[ -d "$(pwd)/tmp" ] || mkdir $(pwd)/tmp
	( \
		echo -ne "\x00\x00\x00\x00\x00\x00\x00\x03" | \
			dd bs=42 count=1 conv=sync; \
		echo -ne "\x${hw_id:0:2}\x${hw_id:2:2}\x${hw_id:4:2}\x${hw_id:6:2}" | \
			dd bs=20 count=1 conv=sync; \
		echo -ne "$(printf '%08x' $(stat -c%s $fw_bin) | fold -s2 | xargs -I {} echo \\x{} | tr -d '\n')" | \
			dd bs=8 count=1 conv=sync; \
		echo -ne "$(${TOOLDIR}/mkhash md5 $fw_bin | fold -s2 | xargs -I {} echo \\x{} | tr -d '\n')" | \
			dd bs=58 count=1 conv=sync; \
	 ) > ./tmp/header.bin
}

xor_fw(){
	fw_bin="$1"
	xor_key="8844A2D168B45A2D"

	${TOOLDIR}/xorimage -i $fw_bin -o ./tmp/${fw_bin}.xor -p "$xor_key" -x
}

concat_header(){
	fw_bin="$1"
	cat ./tmp/header.bin ./tmp/${fw_bin}.xor > ./tmp/${fw_bin}.new
}

fw_bin=$1

[ -r "$fw_bin" ] && \
create_header $fw_bin && \
xor_fw $fw_bin && \
concat_header $fw_bin && \
cp ./tmp/${fw_bin}.new ./ || \
echo "ERROR"

実行例

./header.sh openwrt-ramips-mt7620-iodata_wn-ac1167gr-squashfs-plain.bin

WN-AC1167GR stock -> OpenWrt

それっぽい感じにヘッダを作り、投げ込めたのでメモ。
“wnac1167gr_v000.bin” というようなファイル名にリネームして放り込む必要がありそうな? → 特にリネームする必要は無かった。

br0: port 4(rai0) entering forwarding state
br0: port 3(ra1) entering forwarding state
br0: port 2(ra0) entering forwarding state
br0: port 1(eth2.1) entering forwarding state
device eth2.1 left promiscuous mode
br0: port 1(eth2.1) entering disabled state
sh: can't kill pid 719: No such process
route: SIOCDELRT: No such process
device ra0 left promiscuous mode
br0: port 2(ra0) entering disabled state
device ra1 left promiscuous mode
br0: port 3(ra1) entering disabled state
device wds0 is not a slave of br0
device wds1 is not a slave of br0
device wds2 is not a slave of br0
device wds3 is not a slave of br0
sh: can't kill pid 811: No such process
route: SIOCDELRT: No such process
device rai0 left promiscuous mode
br0: port 4(rai0) entering disabled state
interface wds4 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
interface wds5 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
interface wds6 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
interface wds7 does not exist!
ifconfig: SIOCGIFFLAGS: No such device
Interface doesn't accept private ioctl...
set (8BE2): Network is down
Interface doesn't accept private ioctl...
set (8BE2): Network is down
Sent SIGKILL to all processes
Requesting system reboot
Restarting system.
Hardware reset!!


U-Boot 1.1.3 (Jul 30 2014 - 21:26:23)

Board: Ralink APSoC DRAM:  64 MB
Ralink UBoot ver: 4.0.1.0
ELX UBoot ver: 4.0.1.6 (Jul 30 2014 21:26:23)
Date:Jul 30 2014  Time:21:26:23
CPU: 580 MHz, MEM: 64 MB
#Reset_MT7530
MT7620N disable wan port phy 0

Please choose the operation: 1, 2, 3, 4, 9
                                                                                                                          0  
   
3: System Boot system code via Flash.
## Booting image at bc070000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.89
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1572544 Bytes =  1.5 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 4.14.89 (musashino205@Taiha.Net) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r0+8844-8b0f1087cc)) #0 Wed Dec 19 14:20:51 2018
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620A ver:2 eco:6
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is I-O DATA WN-AC1167GR
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] random: get_random_bytes called from start_kernel+0x8c/0x474 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=0001af06
[    0.000000] Readback ErrCtl register=0001af06
[    0.000000] Memory: 59792K/65536K available (3650K kernel code, 169K rwdata, 852K rodata, 184K init, 207K bss, 5744K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000011] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015469] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087708] pid_max: default: 32768 minimum: 301
[    0.097110] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.110134] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.130733] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.150215] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.162391] pinctrl core: initialized pinctrl subsystem
[    0.173240] NET: Registered protocol family 16
[    0.664925] PCI host bridge /pcie@10140000 ranges:
[    0.674322]  MEM 0x0000000020000000..0x000000002fffffff
[    0.684696]   IO 0x0000000010160000..0x000000001016ffff
[    0.711848] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.722885] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.735975] PCI host bridge to bus 0000:00
[    0.743971] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.757691] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    0.769418] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.782919] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.799126] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.815680] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.828738] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.842549] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    0.856050] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[    0.870415] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.883925] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[    0.898470] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[    0.912817] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.922669] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
[    0.936186] pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
[    0.954220] clocksource: Switched to clocksource systick
[    0.965893] NET: Registered protocol family 2
[    0.975340] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.989118] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    1.001710] TCP: Hash tables configured (established 1024 bind 1024)
[    1.014493] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.026011] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.038685] NET: Registered protocol family 1
[    1.049988] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    1.062734] Crashlog allocated RAM at address 0x3f00000
[    1.074984] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    1.093443] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.104948] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.134261] io scheduler noop registered
[    1.141907] io scheduler deadline registered (default)
[    1.152969] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.166616] console [ttyS0] disabled
[    1.173609] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[    1.193384] console [ttyS0] enabled
[    1.193384] console [ttyS0] enabled
[    1.207155] bootconsole [early0] disabled
[    1.207155] bootconsole [early0] disabled
[    1.223589] cacheinfo: Failed to find cpu0 device node
[    1.233860] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    1.250494] spi spi0.0: force spi mode3
[    1.258992] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    1.268831] 9 fixed-partitions partitions found on MTD device spi0.0
[    1.281492] Creating 9 MTD partitions on "spi0.0":
[    1.291053] 0x000000000000-0x000000030000 : "u-boot"
[    1.301893] 0x000000030000-0x000000040000 : "u-boot-env"
[    1.313411] 0x000000040000-0x000000048000 : "Factory"
[    1.324481] 0x000000048000-0x000000050000 : "iNIC_rf"
[    1.335451] 0x000000050000-0x000000070000 : "NoUsed"
[    1.346240] 0x000000070000-0x000000724000 : "firmware"
[    1.361495] 2 uimage-fw partitions found on MTD device firmware
[    1.373360] Creating 2 MTD partitions on "firmware":
[    1.383268] 0x000000000000-0x00000017ff00 : "kernel"
[    1.394103] 0x00000017ff00-0x0000006b4000 : "rootfs"
[    1.404891] mtd: device 7 (rootfs) set to be root filesystem
[    1.417780] 1 squashfs-split partitions found on MTD device rootfs
[    1.430170] 0x00000051c000-0x0000006b4000 : "rootfs_data"
[    1.441868] 0x000000724000-0x0000007b0000 : "manufacture"
[    1.453527] 0x0000007b0000-0x0000007c0000 : "backup"
[    1.464422] 0x0000007c0000-0x000000800000 : "storage"
[    1.476152] libphy: Fixed MDIO Bus: probed
[    1.494665] libphy: mdio: probed
[    1.505816] mtk_soc_eth 10100000.ethernet: using fixed link parameters
[    1.520905] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[    1.543657] mtk_soc_eth 10100000.ethernet: loaded mt7530 driver
[    1.556146] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    1.573158] rt2880_wdt 10000120.watchdog: Initialized
[    1.584634] NET: Registered protocol family 10
[    1.598207] Segment Routing with IPv6
[    1.605689] NET: Registered protocol family 17
[    1.614607] 8021q: 802.1Q VLAN Support v1.8
[    1.640878] VFS: Mounted root (squashfs filesystem) readonly on device 31:7.
[    1.655983] Freeing unused kernel memory: 184K
[    1.664861] This architecture does not have kernel memory protection.
[    2.884162] random: fast init done
[    3.376096] init: Console is alive
[    3.383103] init: - watchdog -
[    5.216454] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    5.602456] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.618831] init: - preinit -
[    7.679126] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex)
[    7.695385] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    7.707063] 8021q: adding VLAN 0 to HW filter on device eth0
[    7.718617] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3[    7.881440] random: procd: uninitialized urandom read (4 bytes read)
] or [4] key and hit [enter] to select the debug level
[    8.333303] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    8.382482] urandom-seed: Seed file not found (/etc/urandom.seed)
[    8.477085] mtk_soc_eth 10100000.ethernet eth0: port 5 link down
[    8.500674] procd: - early -
[    8.506519] procd: - watchdog -
[    8.720075] procd: - watchdog -
[    8.726625] procd: - ubus -
[    8.995261] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.119153] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.132436] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.146130] procd: - init -
Please press Enter to activate this console.
[    9.687288] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.912282] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    9.936696] Loading modules backported from Linux version v4.19.7-0-g61c68f2a2af0
[    9.951681] Backport generated by backports.git v4.19.7-1-0-g148b072d
[    9.969253] ip_tables: (C) 2000-2006 Netfilter Core Team
[    9.991331] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[   10.240395] xt_time: kernel timezone is -0000
[   10.405310] mt76x2e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[   10.417917] mt76x2e 0000:01:00.0: ASIC revision: 76120044
[   10.616088] mt76x2e 0000:01:00.0: ROM patch build: 20141115060606a
[   10.634389] mt76x2e 0000:01:00.0: Firmware Version: 0.0.00
[   10.645359] mt76x2e 0000:01:00.0: Build: 1
[   10.653512] mt76x2e 0000:01:00.0: Build Time: 201507311614____
[   10.670106] mt76x2e 0000:01:00.0: Firmware running!
[   10.706126] PPP generic driver version 2.4.2
[   10.723773] NET: Registered protocol family 24
[   10.833645] rt2800_wmac 10180000.wmac: loaded eeprom from mtd device "Factory"
[   10.848119] ieee80211 phy1: rt2x00_set_rt: Info - RT chipset 6352, rev 0500 detected
[   10.863584] ieee80211 phy1: rt2x00_set_rf: Info - RF chipset 7620 detected
[   10.976473] kmodloader: done loading kernel modules from /etc/modules.d/*
[   12.379026] urandom_read: 5 callbacks suppressed
[   12.379035] random: jshn: uninitialized urandom read (4 bytes read)
[   29.231715] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   29.285994] jffs2_build_filesystem(): unlocking the mtd device... 
[   29.286009] done.
[   29.302226] jffs2_build_filesystem(): erasing all blocks after the end marker... 
[   29.579476] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (1000Mbps/Full duplex)
[   29.610524] 8021q: adding VLAN 0 to HW filter on device eth0
[   29.805068] br-lan: port 1(eth0.1) entered blocking state
[   29.815907] br-lan: port 1(eth0.1) entered disabled state
[   29.827089] device eth0.1 entered promiscuous mode
[   29.836692] device eth0 entered promiscuous mode
[   30.020666] br-lan: port 1(eth0.1) entered blocking state
[   30.031498] br-lan: port 1(eth0.1) entered forwarding state
[   30.042845] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   30.611535] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   53.338536] done.
[   53.342445] jffs2: notice: (1277) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   54.227888] overlayfs: upper fs does not support tmpfile.
[   66.595958] random: crng init done



BusyBox v1.29.3 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r0+8851-5827264d5b
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# ubus call system board
{
        "kernel": "4.14.89",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7620A ver:2 eco:6",
        "model": "I-O DATA WN-AC1167GR",
        "board_name": "iodata,wn-ac1167gr",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r0+8851-5827264d5b",
                "target": "ramips\/mt7620",
                "description": "OpenWrt SNAPSHOT r0+8851-5827264d5b"
        }
}

WN-AC1167GR

MT7620機というのをしばらく前に把握し、そのうちやりたいなーと思っていた機種。某所で偶然900円で出品されているのを見つけてしまい、衝動的に購入してしまった。
弄るのでメモ。

Switch

zone WAN LAN
port
(WN-AC1167GR)
インターネット LAN4 LAN3 LAN2 LAN1
port
(MT7530)
port0 port1 port2 port3 port4

MAC

  • Factory, 0x4 (2.4G)
  • iNIC_rf, 0x4 (5G)
  • LAN: 34:76:C5:xx:xx:9A
  • WAN: 34:76:C5:xx:xx:99
  • 2.4G: 34:76:C5:xx:xx:9A
  • 5G: 34:76:C5:xx:xx:9B

U-Boot

  • help
    MT7620 # help
    ?       - alias for 'help'
    bootm   - boot application image from memory
    elx_check      - check ELX image
    go      - start application at address 'addr'
    help    - print online help
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    mw      - memory write (fill)
    nm      - memory modify (constant address)
    printenv- print environment variables
    reset   - Perform RESET of the CPU
    rf      - read/write rf register
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version
    MT7620 # version
    
    U-Boot 1.1.3 (Jul 30 2014 - 21:26:23)
    

  • printenv
    MT7620 # printenv
    bootcmd=tftp
    baudrate=57600
    ethaddr="34:76:C5:**:**:9A"
    ramargs=setenv bootargs root=/dev/ram rw
    addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
    addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
    flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
    kernel_addr=BFC40000
    u-boot=u-boot.bin
    load=tftp 8A100000 $(u-boot)
    u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
    loadfs=tftp 8A100000 root.cramfs
    u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
    test_tftp=tftp 8A100000 root.cramfs;run test_tftp
    ethact=Eth0 (10/100-M)
    language_code=jp
    hw_id=01040016
    domain=1
    pincode=01977608
    wlanaddr=34:76:C5:**:**:9B
    kver=1.02   
    sn=12345678901234567890123456789012
    usboot=0
    dom2=1
    wanaddr=34:76:C5:**:**:99
    bootdelay=2
    filesize=320000
    fileaddr=80A00000
    ipaddr=192.168.99.9
    serverip=192.168.99.8
    autostart=no
    bootfile=uImage_WN-AC1167GR
    op_mode=0
    bver=4.0.1.6
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 1041/4092 bytes
    

Kernel

  • bootlog
    U-Boot 1.1.3 (Jul 30 2014 - 21:26:23)
    
    Board: Ralink APSoC DRAM:  64 MB
    Ralink UBoot ver: 4.0.1.0
    ELX UBoot ver: 4.0.1.6 (Jul 30 2014 21:26:23)
    Date:Jul 30 2014  Time:21:26:23
    CPU: 580 MHz, MEM: 64 MB
    #Reset_MT7530
    MT7620N disable wan port phy 0
    
    Please choose the operation: 1, 2, 3, 4, 9
                                                                                                                                   0  
       
    3: System Boot system code via Flash.
    ## Booting image at bc070000 ...
       Image Name:   Linux Kernel Image
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    1429145 Bytes =  1.4 MB
       Load Address: 80000000
       Entry Point:  80256840
       Verifying Checksum ... OK
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 80256840) ...
    ## Giving linux memsize in MB, 64
    
    Starting kernel ...
    
    Linux version 3.2.9 (root@jim-pc) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #3 Thu Oct 23 09:38:46 CST 2014
     PCIE: bypass PCIe DLL.
     disable all power about PCIe
    CPU revision is: 00019650 (MIPS 24Kc)
    Ralink MT7620   ver:2 eco:6 running at 580.00 MHz
    Determined physical RAM map:
     memory: 04000000 @ 00000000 (usable)
    Initrd not found or empty - disabling initrd
    Zone PFN ranges:
      Normal   0x00000000 -> 0x00004000
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
        0: 0x00000000 -> 0x00004000
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
    Kernel command line:  console=ttyS1,57600 root=/dev/ram0 rootfstype=squashfs,jffs2
    PID hash table entries: 256 (order: -2, 1024 bytes)
    Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
    Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
    Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    Writing ErrCtl register=0001ad00
    Readback ErrCtl register=0001ad00
    Memory: 60672k/65536k available (2428k kernel code, 4864k reserved, 616k data, 1104k init, 0k highmem)
    SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
    NR_IRQS:128
    console [ttyS1] enabled
    Calibrating delay loop... 385.02 BogoMIPS (lpj=770048)
    pid_max: default: 32768 minimum: 301
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    MIPS: machine is Ralink MT7620
    PPLL_CFG1=0xeb4000
    MT7620 PPLL lock
    PPLL_DRV =0x80080504
    start PCIe register access
    mt7620_pci_rr(MT7620_PCI_REG_PCICFG_ADDR):1000f0
    i=0,1
    registering PCI controller with io_map_base unset
    bio: create slab  at 0
    SCSI subsystem initialized
    pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
    pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
    pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
    pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff])
    pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
    pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff 64bit] (PCI address [0x20000000-0x200fffff])
    pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
    pci 0000:00:00.0: PCI bridge to [bus 01-01]
    pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
    pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
    Switching to clocksource MIPS
    NET: Registered protocol family 2
    IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    TCP established hash table entries: 2048 (order: 2, 16384 bytes)
    TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
    TCP: Hash tables configured (established 2048 bind 2048)
    TCP reno registered
    UDP hash table entries: 256 (order: 0, 4096 bytes)
    UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    NET: Registered protocol family 1
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
    msgmni has been set to 118
    io scheduler noop registered
    io scheduler deadline registered
    io scheduler cfq registered (default)
    Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
    serial8250: ttyS0 at MMIO 0x10000500 (irq = 13) is a 16550A
    serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
    loop: module loaded
    deice id : c2 20 17 c2 20 (2017c220)
    MX25L6405D(c2 2017c220) (8192 Kbytes)
    mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00001000 (4K) .numeraseregions = 0
    Creating 11 MTD partitions on "raspi":
    0x000000000000-0x000000800000 : "ALL"
    0x000000000000-0x000000030000 : "Bootloader"
    0x000000030000-0x000000040000 : "Config"
    0x000000040000-0x000000048000 : "Factory"
    0x000000048000-0x000000050000 : "iNIC_rf"
    0x000000050000-0x000000070000 : "NoUsed"
    0x000000070000-0x000000744000 : "Kernel"
    0x0000001cd000-0x000000744000 : "user"
    0x000000724000-0x0000007b0000 : "manufacture"
    0x0000007b0000-0x0000007c0000 : "backup"
    0x0000007c0000-0x000000800000 : "storage"
    IMQ driver loaded successfully. (numdevs = 2, numqueues = 1)
            Hooking IMQ after NAT on PREROUTING.
            Hooking IMQ before NAT on POSTROUTING.
    SMACCR1 -- : 0x000000aa
    SMACCR0 -- : 0xbbccdd10
    Ralink APSoC Ethernet Driver Initilization. v3.1  512 rx/tx descriptors allocated, mtu = 1500!
    SMACCR1 -- : 0x000000aa
    SMACCR0 -- : 0xbbccdd10
    PROC INIT OK!
    PPP generic driver version 2.4.2
    PPP BSD Compression module registered
    PPP Deflate Compression module registered
    PPP MPPE Compression module registered
    NET: Registered protocol family 24
    Registered button device:reset, gpio:2,code:408,index:10
    Registered button device:wps, gpio:1,code:529,index:11
    Registered button device:opmode_1, gpio:12,code:263,index:7
    Registered button device:, gpio:0,code:264,index:8
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (2500 buckets, 19800 max, 200 max0, 20000 reserved)
    xt_time: kernel timezone is -0000
    ip_tables: (C) 2000-2006 Netfilter Core Team
    TCP westwood registered
    NET: Registered protocol family 17
    L2TP core driver, V2.0
    8021q: 802.1Q VLAN Support v1.8
    Freeing unused kernel memory: 1104k freed
    System Init version: 1.1 date: 1
    Setting up file systems ...
    Setting up /mnt/tmpfs directory with tmpfs/16384KB
    Setting up FLASH storage partition ...
    JFFS2 notice: (320) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    Setting up /apps directory ...apps is in FLASH ...
    Setting up loopback device ...
    FINISHED
    Start Normal Operation Mode ...
    ************************************************************************
    *                                ---ELX---                             *
    ************************************************************************
    
    KernelApp version: 1.2.1 build date: 2014/10/23 build time: 09:36:45
    cmd> ln: /sbin/./start_all: File exists
    nat_session_manager: module license 'unspecified' taints kernel.
    Disabling lock debugging due to kernel taint
    Start nat_session_reservation_init_driver
    Raeth v3.1 (Tasklet)
    
    phy_tx_ring = 0x032c6000, tx_ring = 0xa32c6000
    
    phy_rx_ring0 = 0x032dc000, rx_ring0 = 0xa32dc000
    SMACCR1 -- : 0x000000aa
    SMACCR0 -- : 0xbbccdd10
    ESW: Link Status Changed - Port5 Link UP
    CDMA_CSG_CFG = 81000000
    GDMA1_FWD_CFG = 20710000
    device eth2 entered promiscuous mode
    device eth2.1 entered promiscuous mode
    br0: port 1(eth2.1) entering forwarding state
    br0: port 1(eth2.1) entering forwarding state
    device eth2.2 entered promiscuous mode
    br0: port 2(eth2.2) entering forwarding state
    br0: port 2(eth2.2) entering forwarding state
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    0x1300 = 00064380
    device ra0 entered promiscuous mode
    br0: port 3(ra0) entering forwarding state
    br0: port 3(ra0) entering forwarding state
    device ra1 entered promiscuous mode
    br0: port 4(ra1) entering forwarding state
    br0: port 4(ra1) entering forwarding state
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
    create [wsc_5g] proc!
    device rai0 entered promiscuous mode
    br0: port 5(rai0) entering forwarding state
    br0: port 5(rai0) entering forwarding state
    ln: /etc/wsc_xml/WFAWLANConfigSCPD.xml: File exists
    route: SIOCADDRT: File exists
    
    
    
    
    
    
    
    
    
    
    
    Ebtables v2.0 registered
    Start wps_led driver
    br0: port 1(eth2.1) entering forwarding state
    br0: port 2(eth2.2) entering forwarding state
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    br0: port 3(ra0) entering forwarding state
    br0: port 4(ra1) entering forwarding state
    br0: port 5(rai0) entering forwarding state
    cat: can't open '/var/run/upnpd.pid': No such file or directory
    route: SIOCDELRT: No such process
    device ra0 left promiscuous mode
    br0: port 3(ra0) entering forwarding state
    device ra1 left promiscuous mode
    br0: port 4(ra1) entering forwarding state
    device wds0 is not a slave of br0
    device wds1 is not a slave of br0
    device wds2 is not a slave of br0
    device wds3 is not a slave of br0
    RtmpOSNetDevDetach(): RtmpOSNetDeviceDetach(), dev->name=ra0!
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    0x1300 = 00064380
    device ra0 entered promiscuous mode
    br0: port 3(ra0) entering forwarding state
    br0: port 3(ra0) entering forwarding state
    device ra1 entered promiscuous mode
    br0: port 4(ra1) entering forwarding state
    br0: port 4(ra1) entering forwarding state
    ln: /etc/wsc_xml/WFAWLANConfigSCPD.xml: File exists
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    device rai0 left promiscuous mode
    br0: port 5(rai0) entering forwarding state
    interface wds4 does not exist!
    ifconfig: SIOCGIFFLAGS: No such device
    interface wds5 does not exist!
    ifconfig: SIOCGIFFLAGS: No such device
    interface wds6 does not exist!
    ifconfig: SIOCGIFFLAGS: No such device
    interface wds7 does not exist!
    ifconfig: SIOCGIFFLAGS: No such device
    RtmpOSNetDevDetach(): RtmpOSNetDeviceDetach(), dev->name=rai0!
    Unregister PCI device driver
    create [wsc_5g] proc!
    device rai0 entered promiscuous mode
    br0: port 5(rai0) entering forwarding state
    br0: port 5(rai0) entering forwarding state
    ln: /etc/wsc_xml/WFAWLANConfigSCPD.xml: File exists
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    rt635x_tssi0_dc is 0xffffffff
    rt635x_tssi1_dc is 0x00000000
    br0: port 3(ra0) entering forwarding state
    br0: port 4(ra1) entering forwarding state
    br0: port 5(rai0) entering forwarding state
    

WRC-733GHBK

10/05にフラッと行ったハードオフ越谷花田店で、偶然見つけたもの。以前調べてMT7620ということを把握しており、GbEということもあってそのうちやっておこうかなーと思っていたため、衝動的に購入してしまった。税込540円、ACアダプタ付。
弄っていくのでメモ。

Switch

zone WAN LAN
port
(WRC-733GHBK)
INTERNET LAN4 LAN3 LAN2 LAN1
port
(RTL8367RB)
port0 port1 port2 port3 port4

MAC

hwconfigパーティション内に格納されている

  • LAN: HW.LAN.MAC.Address
  • WAN: HW.WAN.MAC.Address
  • 2G: HW.LAN.2G.0.MAC.Address
  • 5G: HW.LAN.5G.0.MAC.Address
  • LAN: xx:xx:xx:xx:xx:E5
  • WAN: xx:xx:xx:xx:xx:E4
  • 2G: xx:xx:xx:xx:xx:E6
  • 5G: xx:xx:xx:xx:xx:E7

U-Boot

  • help
    MT7620 # help
    ?       - alias for 'help'
    bootm   - boot application image from memory
    cp      - memory copy
    erase   - erase SPI FLASH memory
    go      - start application at address 'addr'
    help    - print online help
    loadb   - load binary file over serial line (kermit mode)
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    nm      - memory modify (constant address)
    printenv- print environment variables
    reset   - Perform RESET of the CPU
    rf      - read/write rf register
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version
    MT7620 # version
    
    U-Boot 1.1.3 (Jul 10 2014 - 16:50:54)
    

  • printenv
    MT7620 # printenv
    bootcmd=tftp
    bootdelay=3
    baudrate=57600
    ethaddr="00:AA:BB:CC:DD:10"
    ipaddr=192.168.2.81
    serverip=192.168.2.89
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 151/4092 bytes
    

Kernel

パスワードが掛けられており、コンソールにログインできない

  • bootlog
    U-Boot 1.1.3 (Jul 10 2014 - 16:50:54)
    
    Board: Ralink APSoC DRAM:  64 MB
    relocate_code Pointer at: 83fac000
    enable ephy clock...done. rf reg 29 = 5
    SSC disabled.
    ******************************
    Software System Reset Occurred
    ******************************
    spi_wait_nsec: 29 
    spi device id: c2 20 17 c2 20 (2017c220)
    find flash: MX25L6405D
    raspi_read: from:30000 len:1000 
    *** Warning - bad CRC, using default environment
    
    ============================================ 
    Ralink UBoot Version: 4.1.2.0
    -------------------------------------------- 
    ASIC 7620_MP (Port5GigaSW)
    DRAM component: 512 Mbits DDR, width 16
    DRAM bus: 16 bit
    Total memory: 64 MBytes
    Flash component: SPI Flash
    Date:Jul 10 2014  Time:16:50:54
    ============================================ 
    icache: sets:512, ways:4, linesz:32 ,total:65536
    dcache: sets:256, ways:4, linesz:32 ,total:32768 
    
     ##### The CPU freq = 580 MHZ #### 
     estimate memory size =64 Mbytes
    
     Realtek giga Mac init!
    
     Realtek giga Mac done!
    
    Please choose the operation: 
       1: Load system code to SDRAM via TFTP. 
       2: Load system code then write to Flash via TFTP. 
       3: Boot system code via Flash (default).
       4: Entr boot command line interface.
       5: Load ucos code to SDRAM via TFTP Client. 
       7: Load Boot Loader code then write to Flash via Serial. 
       9: Load Boot Loader code then write to Flash via TFTP. 
                                                                                                                              0  
       
    3: System Boot system code via Flash.
    ## Booting image at bc070000 ...
    raspi_read: from:70000 len:40 
    Magic number at 0xBC070000 
    raspi_read: from:70014 len:40 
       Image Name:   Linux Kernel Image
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    4313004 Bytes =  4.1 MB
       Load Address: 80000000
       Entry Point:  8000c3b0
    raspi_read: from:70054 len:41cfac 
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 8000c3b0) ...
    ## Giving linux memsize in MB, 64
    
    Starting kernel ...
    
    
    LINUX started...
    
     THIS IS ASIC
    Linux version 2.6.36 (root@localhost.localdomain) (gcc version 3.4.2) #425 Fri Sep 19 17:53:19 CST 2014
    
     The CPU feqenuce set to 580 MHz
    
     MIPS CPU sleep mode enabled.
     PCIE: bypass PCIe DLL.
     PCIE: Elastic buffer control: Addr:0x68 -> 0xB4
     disable all power about PCIe
    CPU revision is: 00019650 (MIPS 24Kc)
    Software DMA cache coherency
    Determined physical RAM map:
     memory: 04000000 @ 00000000 (usable)
    Zone PFN ranges:
      Normal   0x00000000 -> 0x00004000
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
        0: 0x00000000 -> 0x00004000
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
    Kernel command line: console=ttyS1,57600n8 root=1f05 console=ttyS0
    PID hash table entries: 256 (order: -2, 1024 bytes)
    Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
    Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
    Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    Writing ErrCtl register=00078974
    Readback ErrCtl register=00078974
    Memory: 61456k/65536k available (2385k kernel code, 4080k reserved, 646k data, 180k init, 0k highmem)
    NR_IRQS:128
    Console: colour dummy device 80x25
    console [ttyS1] enabled
    Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
    pid_max: default: 32768 minimum: 301
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    RALINK_GPIOMODE = 1a311d
    RALINK_GPIOMODE = 18311d
    PPLL_CFG1=0xf14000
    MT7620 PPLL lock
    PPLL_DRV =0x80080504
    start PCIe register access
    RALINK_RSTCTRL = 2400000
    RALINK_CLKCFG1 = 75afffc0
    
    *************** MT7620 PCIe RC mode *************
    PCIE0 enabled
    init_rt2880pci done
    bio: create slab  at 0
    vgaarb: loaded
    pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
    pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
    pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
    pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff]
    pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
    pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff] (PCI address [0x20000000-0x200fffff]
    pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff]
    pci 0000:01:00.1: BAR 0: set to [mem 0x20100000-0x201fffff] (PCI address [0x20100000-0x201fffff]
    pci 0000:00:00.0: PCI bridge to [bus 01-01]
    pci 0000:00:00.0:   bridge window [io  disabled]
    pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
    pci 0000:00:00.0:   bridge window [mem pref disabled]
    BAR0 at slot 0 = 0
    bus=0x0, slot = 0x0
    res[0]->start = 0
    res[0]->end = 0
    res[1]->start = 20200000
    res[1]->end = 2020ffff
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    bus=0x1, slot = 0x0
    res[0]->start = 20000000
    res[0]->end = 200fffff
    res[1]->start = 0
    res[1]->end = 0
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    bus=0x1, slot = 0x0
    res[0]->start = 20100000
    res[0]->end = 201fffff
    res[1]->start = 0
    res[1]->end = 0
    res[2]->start = 0
    res[2]->end = 0
    res[3]->start = 0
    res[3]->end = 0
    res[4]->start = 0
    res[4]->end = 0
    res[5]->start = 0
    res[5]->end = 0
    Switching to clocksource Ralink Systick timer
    NET: Registered protocol family 2
    IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    TCP established hash table entries: 2048 (order: 2, 16384 bytes)
    TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
    TCP: Hash tables configured (established 2048 bind 2048)
    TCP reno registered
    UDP hash table entries: 256 (order: 0, 4096 bytes)
    UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    NET: Registered protocol family 1
    Load Kernel WDG Timer Module
    Load Ralink Timer0 Module
    VFS: Disk quotas dquot_6.5.2
    Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    msgmni has been set to 120
    alg: No test for stdrng (krng)
    io scheduler noop registered (default)
    Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
    serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
    serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
    brd: module loaded
    deice id : c2 20 17 c2 20 (2017c220)
    MX25L6405D(c2 2017c220) (8192 Kbytes)
    mtd .name = raspi, .size = 0x00800000 (0M) .erasesize = 0x00000008 (0K) .numeraseregions = 65536
    Creating 8 MTD partitions on "raspi":
    0x000000000000-0x000000030000 : "Bootloader"
    0x000000030000-0x000000040000 : "Config"
    0x000000040000-0x000000050000 : "Factory"
    0x000000050000-0x000000070000 : "nvram"
    0x000000070000-0x000000180000 : "Kernel"
    0x000000180000-0x0000007f0000 : "RootFS"
    0x0000007f0000-0x000000800000 : "hwconfig"
    0x000000070000-0x0000007f0000 : "Uimage"
    rdm_major = 254
    SMACCR1 -- : 0x0000000c
    SMACCR0 -- : 0x43762077
    Ralink APSoC Ethernet Driver Initilization. v3.0  256 rx/tx descriptors allocated, mtu = 1500!
    SMACCR1 -- : 0x0000000c
    SMACCR0 -- : 0x43762077
    PROC INIT OK!
    PPP generic driver version 2.4.2
    PPP BSD Compression module registered
    NET: Registered protocol family 24
    PPTP driver version 0.8.5
    i8042.c: i8042 controller self test timeout.
    Trying to free nonexistent resource 
    mice: PS/2 mouse device common for all mice
    Ralink APSoC Hardware Watchdog Timer
    u32 classifier
        Performance counters on
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (960 buckets, 3840 max)
    ctnetlink v0.93: registering with nfnetlink.
    matchsize=264
    xt_time: kernel timezone is -0000
    GRE over IPv4 demultiplexor driver
    gre: can't add protocol
    ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
    TCP cubic registered
    NET: Registered protocol family 17
    dnshijack
    802.1Q VLAN Support v1.8 Ben Greear 
    All bugs added by David S. Miller 
    VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
    Freeing unused kernel memory: 180k freed
    init started: BusyBox v1.12.1 (2014-04-28 14:42:24 CST)
    starting pid 27, tty '': '/etc/init.d/rcS sysinit'
    rc ver. 1.0.3
    Initializing...Success!
    Mounting file systems...Success!
    Creating devices...Success!
    Creating loopback device...Success!
    starting pid 34, tty '': '/etc/init.d/rcS start'
    rc ver. 1.0.3
    Initializing...Success!
    Loading dynamic libraries...Success!
    edx_gpio: module license 'unspecified' taints kernel.
    Disabling lock debugging due to kernel taint
    Initializing EDX GPIO...Done
    Acelink events notification ver. 1.6
    argv[0]=/sbin/ev_broker i=5 class=2 paction=NETDEV_REGISTER hold=
    NVRAM access daemon Ver. 1.0 Build 20140919151150
    daemonizAlgorithmics/MIPS FPU Emulator v1.5
    e process
    argv[0]=/sbin/ev_broker i=5 class=2 paction=NETDEV_UP hold=
    argv[0]=/sbin/ev_broker i=5 class=2 paction=NETDEV_REGISTER hold=
    Starting L0000Config.so...Done ! (ret=0)
    Starting L0100WLANInterface.so...Done ! (ret=0)
    Starting L0130EthInterface.so...Done ! (ret=0)
    Starting L0200LANConfig.so...Done ! (ret=0)
    1970-01-01 00:00:25: (server.c.915) can't have more connections than fds/2:  1024 824 
    start lld2d...
    udhcpd: max_leases=235 is too big, setting to 101
    start child_net...
    start house_keeper...
    Starting L0230LANServices.so...Done ! (ret=0)
    Starting L0300WANConfig.so...Done ! (ret=0)
    
    Please press Enter to activate this console. starting wan_event...
    wan_event done !
    Notice: caching turned off
    Notice: caching turned off
    starting wan_event...
    wan_event done !
    starting wan_event...
    udhcpc receive a leasefail for eth2.2
    wan_event done !
    

WHR-300HP2

偶然某氏から頂くことができたため、早速筐体を開けた。以下今後必要になる可能性もあるのでデータを書き残し

雑感

筐体が非常に開けづらい。ツメがリア側を除き一辺あたり3か所ほどあり引っ掛かりが固いほか、今まで開けたことがあるWSR, WZR系列と筐体の構造が異なり、はめ込みの境目を見誤るなどした。

  • uname -a
    # uname -a
    Linux (none) 2.6.36 #17 Fri Jun 20 20:33:39 CST 2014 mips unknown
    

  • cat /proc/version
    # cat /proc/version
    Linux version 2.6.36 (root@SWD1-CVS3) (gcc version 3.4.2) #17 Fri Jun 20 20:33:39 CST 2014
    

  • cat /proc/cpuinfo
    # cat /proc/cpuinfo
    system type             : Ralink SoC
    processor               : 0
    cpu model               : MIPS 24Kc V5.0
    BogoMIPS                : 386.04
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ff8, 0x0ff8, 0x0eeb, 0x0ff8]
    ASEs implemented        : mips16 dsp
    shadow register sets    : 1
    core                    : 0
    VCED exceptions         : not available
    VCEI exceptions         : not available
    

  • cat /proc/mtd
    # cat /proc/mtd    
    dev:    size   erasesize  name
    mtd0: 00030000 00010000 "Bootloader"
    mtd1: 00010000 00010000 "Config"
    mtd2: 00010000 00010000 "Factory"
    mtd3: 005b0000 00010000 "Kernel"
    mtd4: 00100000 00010000 "User_CFG"
    

  • ls -al /dev/mtd*
    # ls -al /dev/mtd*  
    brw-rw----    1 0        0         31,   7 /dev/mtdblock7
    brw-rw----    1 0        0         31,   6 /dev/mtdblock6
    brw-rw----    1 0        0         31,   5 /dev/mtdblock5
    brw-rw----    1 0        0         31,   4 /dev/mtdblock4
    brw-rw----    1 0        0         31,   3 /dev/mtdblock3
    brw-rw----    1 0        0         31,   2 /dev/mtdblock2
    brw-rw----    1 0        0         31,   1 /dev/mtdblock1
    brw-rw----    1 0        0         31,   0 /dev/mtdblock0
    crw-rw----    1 0        0         90,  15 /dev/mtd7ro
    crw-rw----    1 0        0         90,  14 /dev/mtd7
    crw-rw----    1 0        0         90,  13 /dev/mtd6ro
    crw-rw----    1 0        0         90,  12 /dev/mtd6
    crw-rw----    1 0        0         90,  11 /dev/mtd5ro
    crw-rw----    1 0        0         90,  10 /dev/mtd5
    crw-rw----    1 0        0         90,   9 /dev/mtd4ro
    crw-rw----    1 0        0         90,   8 /dev/mtd4
    crw-rw----    1 0        0         90,   7 /dev/mtd3ro
    crw-rw----    1 0        0         90,   6 /dev/mtd3
    crw-rw----    1 0        0         90,   5 /dev/mtd2ro
    crw-rw----    1 0        0         90,   4 /dev/mtd2
    crw-rw----    1 0        0         90,   3 /dev/mtd1ro
    crw-rw----    1 0        0         90,   2 /dev/mtd1
    crw-rw----    1 0        0         90,   1 /dev/mtd0ro
    crw-rw----    1 0        0         90,   0 /dev/mtd0
    

  • bootlog
    U-Boot 1.1.3 (Apr  3 2013 - 20:22:35)
    
    Board: Ralink APSoC DRAM:  64 MB
    relocate_code Pointer at: 83fb4000
    enable ephy clock...done. rf reg 29 = 5
    SSC disabled.
    ******************************
    Software System Reset Occurred
    ******************************
    spi_wait_nsec: 29 
    spi device id: 1 2 16 4d 0 (2164d00)
    find flash: S25FL064P
    raspi_read: from:30000 len:1000 
    raspi_read: from:30000 len:1000 
    *** Check if data is correct or not...
    *** Data is correct.
    ============================================ 
    Ralink UBoot Version: 4.1.1.0
    Buffalo UBoot Version: 3.00
    -------------------------------------------- 
    ASIC 7620_MP (Port5<->None)
    DRAM component: 512 Mbits DDR, width 16
    DRAM bus: 16 bit
    Total memory: 64 MBytes
    Flash component: SPI Flash
    Date:Apr  3 2013  Time:20:22:35
    ============================================ 
    icache: sets:512, ways:4, linesz:32 ,total:65536
    dcache: sets:256, ways:4, linesz:32 ,total:32768 
    
     ##### The CPU freq = 580 MHZ #### 
     estimate memory size =64 Mbytes
    
    Please choose the operation: 
       1: Load system code to SDRAM via TFTP. 
       2: Load system code then write to Flash via TFTP. 
       3: Boot system code via Flash (default).
       4: Entr boot command line interface.
       7: Load Boot Loader code then write to Flash via Serial. 
       9: Load Boot Loader code then write to Flash via TFTP. 
                                                                                                                                  0 
    aossgpio=[8192]
       
    3: System Boot system code via Flash.
    raspi_read: from:30000 len:10000 
    Erasing SPI Flash...
    raspi_erase: offs:30000 len:10000
    .
    Writing to SPI Flash...
    raspi_write: to:30000 len:10000 
    .
    done
    ## Booting image at bc050000 ...
    raspi_read: from:50000 len:40 
       Image Name:   Linux Kernel Image
       Image Type:   MIPS Linux Kernel Image (lzma compressed)
       Data Size:    5470848 Bytes =  5.2 MB
       Load Address: 80000000
       Entry Point:  8000c310
    raspi_read: from:50040 len:537a80 
       Verifying Checksum ... OK
       Uncompressing Kernel Image ... OK
    No initrd
    ## Transferring control to Linux (at address 8000c310) ...
    ## Giving linux memsize in MB, 64
    
    Starting kernel ...
    
    
    LINUX started...
    
     THIS IS ASIC
    Linux version 2.6.36 (root@SWD1-CVS3) (gcc version 3.4.2) #17 Fri Jun 20 20:33:39 CST 2014
    
     The CPU feqenuce set to 580 MHz
     PCIE: bypass PCIe DLL.
     PCIE: Elastic buffer control: Addr:0x68 -> 0xB4
     disable all power about PCIe
    CPU revision is: 00019650 (MIPS 24Kc)
    Determined physical RAM map:
     memory: 04000000 @ 00000000 (usable)
    Initrd not found or empty - disabling initrd
    Zone PFN ranges:
      Normal   0x00000000 -> 0x00004000
    Movable zone start PFN for each node
    early_node_map[1] active PFN ranges
        0: 0x00000000 -> 0x00004000
    Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
    Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 console=ttyS0
    PID hash table entries: 256 (order: -2, 1024 bytes)
    Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
    Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
    Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
    Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
    Writing ErrCtl register=0003ff78
    Readback ErrCtl register=0003ff78
    Memory: 55768k/65536k available (4324k kernel code, 9768k reserved, 808k data, 3848k init, 0k highmem)
    NR_IRQS:128
    console [ttyS1] enabled
    Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
    pid_max: default: 32768 minimum: 301
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    RALINK_GPIOMODE = 1a311c
    RALINK_GPIOMODE = 18311c
    PPLL_CFG1=0xe68000
    MT7620 PPLL lock
    PPLL_DRV =0x80080504
    start PCIe register access
    RALINK_PCI_PCICFG_ADDR = 1000f0
    
    *************** MT7620 PCIe RC mode *************
    PCIE0 no card, disable it(RST&CLK)
    bio: create slab <bio-0> at 0
    vgaarb: loaded
    SCSI subsystem initialized
    Switching to clocksource MIPS
    NET: Registered protocol family 2
    IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    TCP established hash table entries: 2048 (order: 2, 16384 bytes)
    TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
    TCP: Hash tables configured (established 2048 bind 2048)
    TCP reno registered
    UDP hash table entries: 256 (order: 0, 4096 bytes)
    UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    NET: Registered protocol family 1
    squashfs: version 4.0 (2009/01/31) Phillip Lougher
    JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
    fuse init (API version 7.15)
    msgmni has been set to 108
    Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
    io scheduler noop registered (default)
    HDLC line discipline maxframe=4096
    N_HDLC line discipline registered.
    #####GPIOMODE = 18111c#####
    Ralink gpio driver initialized
    Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
    serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
    serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
    brd: module loaded
    flash0: started
    deice id : 1 2 16 4d 0 (2164d00)
    S25FL064P(01 2164d00) (8192 Kbytes)
    mtd .name = raspi, .size = 0x00800000 (0M) .erasesize = 0x00000008 (0K) .numeraseregions = 65536
    Creating 5 MTD partitions on "raspi":
    0x000000000000-0x000000030000 : "Bootloader"
    0x000000030000-0x000000040000 : "Config"
    0x000000040000-0x000000050000 : "Factory"
    0x000000050000-0x000000600000 : "Kernel"
    0x000000600000-0x000000700000 : "User_CFG"
    rdm_major = 253
    SMACCR1 -- : 0x0000000c
    SMACCR0 -- : 0x43762077
    Ralink APSoC Ethernet Driver Initilization. v3.0  256 rx/tx descriptors allocated, mtu = 1500!
    SMACCR1 -- : 0x0000000c
    SMACCR0 -- : 0x43762077
    PROC INIT OK!
    PPP generic driver version 2.4.2
    PPP BSD Compression module registered
    PPP MPPE Compression module registered
    NET: Registered protocol family 24
    
    
    === pAd = c0156000, size = 808880 ===
    
    <-- RTMPAllocTxRxRingMemory, Status=0
    <-- RTMPAllocAdapterBlock, Status=0
    AP Driver version-2.7.1.5
    Ralink APSoC Hardware Watchdog Timer
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (871 buckets, 3484 max)
    ctnetlink v0.93: registering with nfnetlink.
    IPVS: Registered protocols ()
    IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
    IPVS: ipvs loaded.
    ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
    TCP cubic registered
    NET: Registered protocol family 17
    L2TP core driver, V2.0
    PPPoL2TP kernel driver, V2.0
    802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
    All bugs added by David S. Miller <davem@redhat.com>
    Freeing unused kernel memory: 3848k freed
    init started: BusyBox v1.12.1 (2014-Algorithmics/MIPS FPU Emulator v1.5
    06-20 20:22:30 CST)
    starting pid 28, tty '': '/etc_ro/rcS'
    led=9, on=1, off=1, blinks,=4000, reset=1, time=4000
    devpts: called with bogus options
    mount: mounting none on /proc/bus/usb failed: No such file or directory
    Welcome to
        _______  _______  ___     __  ____   _  _   ___
        |  ___  \|   __  ||   |   |__||    \ | || | /  /
        | |___| ||  |__| ||   |__  __ |     \| || |/  /
        |   _   /|   _   ||      ||  || |\     ||     \
        |__| \__\|__| |__||______||__||_| \____||_|\___\
    
                         =System Architecture Department=
    
    [check_jffs]80 : JFFS_OK
    Set: phy[0].reg[0] = 3100
    Set: phy[1].reg[0] = 3100
    Set: phy[2].reg[0] = 3100
    Set: phy[3].reg[0] = 3100
    Set: phy[4].reg[0] = 3100
    nvram_init: INFO=>nvram MAC initialized successfully!
    ==>shm_init()!!
    check_shm_hash: Check shm hash value
    hashNum are the same with WIFITxRate1, -1718058408!!!
    nvram_init: INFO=>nvram conf initialized successfully!
    nvram_init: INFO=> RAM CONF successful created!
    nvram_init: INFO=> RC.CONF successful created!
    ---------------- Get WLAN MAC cc:e1:d5:74:09:f4---------------
    Tue Jan  1 00:00:00 UTC 2013
    switch reg write offset=2004, value=ff0003
    switch reg write offset=2104, value=ff0003
    switch reg write offset=2204, value=ff0003
    switch reg write offset=2304, value=ff0003
    switch reg write offset=2404, value=ff0003
    switch reg write offset=2504, value=ff0003
    switch reg write offset=2010, value=810000c0
    switch reg write offset=2110, value=810000c0
    switch reg write offset=2210, value=810000c0
    switch reg write offset=2310, value=810000c0
    switch reg write offset=2410, value=810000c0
    switch reg write offset=2510, value=810000c0
    switch reg write offset=2610, value=81000000
    switch reg write offset=2710, value=81000000
    switch reg write offset=2604, value=20ff0003
    switch reg write offset=2704, value=20ff0003
    Special Tag Disabled
    switch reg write offset=2610, value=81000000
    switch reg write offset=2014, value=10001
    switch reg write offset=2114, value=10001
    switch reg write offset=2214, value=10001
    switch reg write offset=2314, value=10001
    switch reg write offset=2414, value=10002
    switch reg write offset=2514, value=10001
    REG_ESW_WT_MAC_ATC is 0x7ff0002
    done.
    input_access=[3]
    echo 3 > /proc/lan_wlan_access_controller
    route: ioctl 0x890c failed: No such process
    /usr/shell/udhcpc.sh stop ok
    killall: httpd: no process killed
    route: resolving dev
    Interface doesn't accept private ioctl...
    set (8BE2): Network is down
    killall: wscd: no process killed
    Interface doesn't accept private ioctl...
    set (8BE2): Network is down
    Interface doesn't accept private ioctl...
    set (8BE2): Network is down
    bridge_restart: restart Static Route ...
    set_br_iso_mac: reset MAC done
    set_br_iso_mac: bridge mode, static IP mode
    START add route..............
    getbootloaderenv : bootloader_ver =3.00
    psntpdate: Name or service not known
    
    ***** g_wl_interface = ra0 ******
    
    MAX_NUM_SESSIONS : 5; NUM_SEES: 64 
    [Enter Test] in wlan_led_ctrl.c main()
    .CAN'T FIND G_band_led
    brctl setwlanforward br0 15
    route: ioctl 0x890b failed: File exists
    libupnp: using UDP SSDP_PORT = 1900
    CAN'T FIND WDS_AOSS_Running
    CAN'T FIND pptp_dhcp_lock
    set_br_iso_mac: reset MAC done
    set_br_iso_mac: bridge mode, static IP mode
    starting pid 394, tty '/dev/ttyS1': '/bin/sh'
    
    
    BusyBox v1.12.1 (2014-06-20 20:22:30 CST) built-in shell (ash)
    Enter 'help' for a list of built-in commands.
    
    # killall: psntpdate: no process killed