WNPR2600G

以前ファームウェアを調べた際にMT7621を搭載していることを把握しており、つい最近某フリマサイトで安価な出品を見かけて衝動的に購入してしまった。
弄っていくのでメモ。

Switch

zone	WAN	LAN
port (WNPR2600G)	インターネット	LAN4	LAN3	LAN2	LAN1
port (MT7530)	port0	port1	port2	port3	port4

MAC

Config (u-boot-env), eeprom内に有。

• LAN: 34:76:C5:xx:xx:1E (Config, ethaddr (text))
• WAN: 34:76:C5:xx:xx:1D (Config, wanaddr (text))
• 2G: 34:76:C5:xx:xx:1E (Factory, 0x4 (hex))
• 5G: 34:76:C5:xx:xx:1F (Factory, 0x8004 (hex))

U-Boot

• help

  U-Boot 1.1.3 (May 25 2016 - 17:17:58)
  MT7621 # help
  ?       - alias for 'help'
  bootm   - boot application image from memory
  cp      - memory copy
  elx_check      - check ELX image
  erase   - erase SPI FLASH memory
  go      - start application at address 'addr'
  help    - print online help
  md      - memory display
  mdio   - Ralink PHY register R/W command !!
  mm      - memory modify (auto-incrementing)
  mw      - memory write (fill)
  nm      - memory modify (constant address)
  printenv- print environment variables
  reset   - Perform RESET of the CPU
  rf      - read/write rf register
  saveenv - save environment variables to persistent storage
  setenv  - set environment variables
  spi     - spi command
  tftpboot- boot image via network using TFTP protocol
  version - print monitor version
  

• version

  MT7621 # version
  
  U-Boot 1.1.3 (May 25 2016 - 17:17:58)
  

• printenv
  ELECOM機関連の設定値が散見される

  MT7621 # printenv
  bootcmd=tftp
  baudrate=57600
  ethaddr="34:76:C5:**:**:1E"
  ramargs=setenv bootargs root=/dev/ram rw
  addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
  addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
  flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
  kernel_addr=BFC40000
  u-boot=u-boot.bin
  load=tftp 8A100000 $(u-boot)
  u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
  loadfs=tftp 8A100000 root.cramfs
  u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
  test_tftp=tftp 8A100000 root.cramfs;run test_tftp
  ethact=Eth0 (10/100-M)
  language_code=jp
  domain=1
  pincode=********
  wlanaddr=BC:5C:4C:**:**:**
  kver=1.04   
  sn=12345678901234567890123456789012
  usboot=0
  bver=4.0.1.5
  dom2=1
  wanaddr=34:76:C5:**:**:1D
  bootdelay=2
  filesize=52a000
  fileaddr=80A00000
  ipaddr=192.168.99.9
  serverip=192.168.99.8
  autostart=no
  bootfile=uImage_ELECOM-WRC-2533GHBK-I
  hw_id=0104003a
  op_mode=0
  stdin=serial
  stdout=serial
  stderr=serial
  
  Environment size: 1051/4092 bytes
  

Kernel

コンソールにパスワードが掛けられている

• uname -a

  # uname -a
  Linux WNPR2600G 3.2.9 #3 SMP Tue Oct 31 18:12:39 CST 2017 mips GNU/Linux
  

• cat /proc/version

  # cat /proc/version
  Linux version 3.2.9 (root@***-pc) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Tue Oct 31 18:12:39 CST 2017
  

• cat /proc/cpuinfo

  # cat /proc/version
  Linux version 3.2.9 (root@jim-pc) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Tue Oct 31 18:12:39 CST 2017
  # cat /proc/cpuinfo
  system type             : Mediatek MT7621 ver:1 eco:3
  machine                 : Ralink MT7621
  processor               : 0
  cpu model               : MIPS 1004Kc V2.15
  BogoMIPS                : 583.68
  wait instruction        : yes
  microsecond timers      : yes
  tlb_entries             : 32
  extra interrupt vector  : yes
  hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
  ASEs implemented        : mips16 dsp mt
  shadow register sets    : 1
  kscratch registers      : 0
  core                    : 0
  VCED exceptions         : not available
  VCEI exceptions         : not available
  
  processor               : 1
  cpu model               : MIPS 1004Kc V2.15
  BogoMIPS                : 583.68
  wait instruction        : yes
  microsecond timers      : yes
  tlb_entries             : 32
  extra interrupt vector  : yes
  hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
  ASEs implemented        : mips16 dsp mt
  shadow register sets    : 1
  kscratch registers      : 0
  core                    : 0
  VCED exceptions         : not available
  VCEI exceptions         : not available
  
  processor               : 2
  cpu model               : MIPS 1004Kc V2.15
  BogoMIPS                : 583.68
  wait instruction        : yes
  microsecond timers      : yes
  tlb_entries             : 32
  extra interrupt vector  : yes
  hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
  ASEs implemented        : mips16 dsp mt
  shadow register sets    : 1
  kscratch registers      : 0
  core                    : 1
  VCED exceptions         : not available
  VCEI exceptions         : not available
  
  processor               : 3
  cpu model               : MIPS 1004Kc V2.15
  BogoMIPS                : 583.68
  wait instruction        : yes
  microsecond timers      : yes
  tlb_entries             : 32
  extra interrupt vector  : yes
  hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
  ASEs implemented        : mips16 dsp mt
  shadow register sets    : 1
  kscratch registers      : 0
  core                    : 1
  VCED exceptions         : not available
  VCEI exceptions         : not available
  

• cat /proc/meminfo

  # cat /proc/meminfo
  MemTotal:         125776 kB
  MemFree:           78028 kB
  Buffers:            3396 kB
  Cached:            12056 kB
  SwapCached:            0 kB
  Active:             4536 kB
  Inactive:          13272 kB
  Active(anon):       2412 kB
  Inactive(anon):      852 kB
  Active(file):       2124 kB
  Inactive(file):    12420 kB
  Unevictable:           0 kB
  Mlocked:               0 kB
  SwapTotal:             0 kB
  SwapFree:              0 kB
  Dirty:                 0 kB
  Writeback:             0 kB
  AnonPages:          2400 kB
  Mapped:             1912 kB
  Shmem:               904 kB
  Slab:              15696 kB
  SReclaimable:        844 kB
  SUnreclaim:        14852 kB
  KernelStack:         808 kB
  PageTables:          428 kB
  NFS_Unstable:          0 kB
  Bounce:                0 kB
  WritebackTmp:          0 kB
  CommitLimit:       62888 kB
  Committed_AS:     349380 kB
  VmallocTotal:    1048372 kB
  VmallocUsed:        7548 kB
  VmallocChunk:    1024940 kB
  

• cat /proc/mtd

  # cat /proc/mtd
  dev:    size   erasesize  name
  mtd0: 01000000 00010000 "ALL"
  mtd1: 00030000 00010000 "Bootloader"
  mtd2: 00010000 00010000 "Config"
  mtd3: 00010000 00010000 "Factory"
  mtd4: 00da0000 00010000 "Kernel"
  mtd5: 00bd0000 00010000 "user"
  mtd6: 00190000 00010000 "manufacture"
  mtd7: 00080000 00010000 "storage"
  

• ls -al /sys/class/leds/

  # ls -al /sys/class/leds/
  lrwxrwxrwx    1         0 Sep  1 00:05 PoE -> ../../devices/platform/leds-gpio/leds/PoE
  lrwxrwxrwx    1         0 Sep  1 00:00 2g_led -> ../../devices/platform/leds-gpio/leds/2g_led
  lrwxrwxrwx    1         0 Sep  1 00:00 5g_led -> ../../devices/platform/leds-gpio/leds/5g_led
  lrwxrwxrwx    1         0 Sep  1 00:00 DIAG -> ../../devices/platform/leds-gpio/leds/DIAG
  lrwxrwxrwx    1         0 Sep  1 00:00 power_led -> ../../devices/platform/leds-gpio/leds/power_led
  drwxr-xr-x   20         0 Sep  1 00:00 ..
  drwxr-xr-x    2         0 Sep  1 00:00 .
  

• bootlog
  MT7615関連のログがあまりに多すぎるため、無線をオフにした状態のログ。

  
  ===================================================================
                  MT7621   stage1 code Mar 12 2015 14:43:30 (ASIC)
                  CPU=500000000 HZ BUS=125000000 HZ
  ==================================================================
  Change MPLL source from XTAL to CR...
  do MEMPLL setting..
  MEMPLL Config : 0x11000000
  3PLL mode + External loopback
  === XTAL-40Mhz === DDR-1200Mhz ===
  PLL4 FB_DL: 0x3, 1/0 = 567/457 0D000000
  PLL2 FB_DL: 0x11, 1/0 = 665/359 45000000
  PLL3 FB_DL: 0x14, 1/0 = 691/333 51000000
  do DDR setting..[01F40000]
  Apply DDR3 Setting...(use default AC)
            0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
        --------------------------------------------------------------------------------
  0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  000E:|    0    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1
  000F:|    0    0    0    0    0    1    1    1    1    1    1    1    1    1    1    1
  0010:|    1    1    1    1    1    1    1    1    1    1    1    0    0    0    0    0
  0011:|    1    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0
  0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  DRAMC_DQSCTL1[0e0]=14000000
  DRAMC_DQSGCTL[124]=80000000
  rank 0 coarse = 16
  rank 0 fine = 40
  B:|    0    0    0    0    0    0    0    1    1    1    0    0    0    0    0    0
  opt_dle value:8
  DRAMC_DDR2CTL[07c]=C287220D
  DRAMC_PADCTL4[0e4]=000022B3
  DRAMC_DQIDLY1[210]=0B08070A
  DRAMC_DQIDLY2[214]=05070708
  DRAMC_DQIDLY3[218]=0C070705
  DRAMC_DQIDLY4[21c]=0A070B08
  DRAMC_R0DELDLY[018]=00002222
  ==================================================================
                  RX      DQS perbit delay software calibration 
  ==================================================================
  1.0-15 bit dq delay value
  ==================================================================
  bit|     0  1  2  3  4  5  6  7  8  9
  --------------------------------------
  0 |    9 5 7 8 6 6 6 5 1 7 
  10 |    6 9 7 8 6 9 
  --------------------------------------
  
  ==================================================================
  2.dqs window
  x=pass dqs delay value (min~max)center 
  y=0-7bit DQ of every group
  input delay:DQS0 =34 DQS1 = 34
  ==================================================================
  bit     DQS0     bit      DQS1
  0  (1~66)33  8  (1~60)30
  1  (1~64)32  9  (1~68)34
  2  (1~66)33  10  (1~66)33
  3  (1~62)31  11  (1~62)31
  4  (1~64)32  12  (1~66)33
  5  (1~66)33  13  (0~63)31
  6  (1~65)33  14  (1~66)33
  7  (1~67)34  15  (1~66)33
  ==================================================================
  3.dq delay value last
  ==================================================================
  bit|    0  1  2  3  4  5  6  7  8   9
  --------------------------------------
  0 |    10 7 8 11 8 7 7 5 5 7 
  10 |    7 12 8 11 7 10 
  ==================================================================
  ==================================================================
       TX  perbyte calibration 
  ==================================================================
  DQS loop = 15, cmp_err_1 = ffff0000 
  dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 
  dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 
  DQ loop=15, cmp_err_1 = ffff0000
  dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1 
  dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2 
  byte:0, (DQS,DQ)=(8,8)
  byte:1, (DQS,DQ)=(8,8)
  DRAMC_DQODLY1[200]=88888888
  DRAMC_DQODLY2[204]=88888888
  20,data:88
  [EMI] DRAMC calibration passed
  
  ===================================================================
                  MT7621   stage1 code done 
                  CPU=500000000 HZ BUS=125000000 HZ
  ===================================================================
  
  
  U-Boot 1.1.3 (May 25 2016 - 17:17:58)
  
  Board: Ralink APSoC DRAM:  128 MB
  relocate_code Pointer at: 87fb4000
  
  Config XHCI 40M PLL 
  flash manufacture id: c2, device id 20 18
  find flash: MX25L12805D
  ============================================ 
  Ralink UBoot Version: 4.0.1.0
  ELX UBoot Version: 1.0.3
  -------------------------------------------- 
  ASIC 7621_MP (MAC to MT7530 Mode)
  DRAM_CONF_FROM: Auto-Detection 
  DRAM_TYPE: DDR3 
  DRAM bus: 16 bit
  Xtal Mode=3 OCP Ratio=1/4
  Flash component: SPI Flash
  Date:May 25 2016  Time:17:17:58
  ============================================ 
  icache: sets:256, ways:4, linesz:32 ,total:32768
  dcache: sets:256, ways:4, linesz:32 ,total:32768 
  
   ##### The CPU freq = 880 MHZ #### 
   estimate memory size =128 Mbytes
  #Reset_MT7530
  
  Please choose the operation: 
     1: Load system code to SDRAM via TFTP. 
     2: Load system code then write to Flash via TFTP. 
     3: Boot system code via Flash (default).
     4: Entr boot command line interface.
     9: Load Boot Loader code then write to Flash via TFTP. 
                                                                                                                            0  
     
  3: System Boot system code via Flash.
  ## Booting image at bfc50000 ...
     Image Name:   Linux Kernel Image
     Image Type:   MIPS Linux Kernel Image (lzma compressed)
     Data Size:    1879274 Bytes =  1.8 MB
     Load Address: 80001000
     Entry Point:  803123e0
     Verifying Checksum ... OK
     Uncompressing Kernel Image ... OK
  No initrd
  ## Transferring control to Linux (at address 803123e0) ...
  ## Giving linux memsize in MB, 128
  
  Starting kernel ...
  
  Linux version 3.2.9 (root@***-pc) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Tue Oct 31 18:12:39 CST 2017
  GCMP present
  bootconsole [early0] enabled
  CPU revision is: 0001992f (MIPS 1004Kc)
  Mediatek MT7621 ver:1 eco:3 running at 880.00 MHz
  Software DMA cache coherency
  Determined physical RAM map:
   memory: 08000000 @ 00000000 (usable)
  Initrd not found or empty - disabling initrd
  Zone PFN ranges:
    Normal   0x00000000 -> 0x00008000
  Movable zone start PFN for each node
  early_node_map[1] active PFN ranges
      0: 0x00000000 -> 0x00008000
  Detected 3 available secondary CPU(s)
  PERCPU: Embedded 7 pages/cpu @81103000 s4800 r8192 d15680 u32768
  Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
  Kernel command line:  console=ttyS0,57600 root=/dev/ram0 rootfstype=squashfs,jffs2
  PID hash table entries: 512 (order: -1, 2048 bytes)
  Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
  Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
  Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
  Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
  MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
  Writing ErrCtl register=00048800
  Readback ErrCtl register=00048800
  Memory: 123988k/131072k available (3186k kernel code, 7084k reserved, 729k data, 1788k init, 0k highmem)
  SLUB: Genslabs=9, HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
  Hierarchical RCU implementation.
  NR_IRQS:128
  gic: revision 3.0
  CPU0: status register was 11000000
  CPU0: status register now 11001800
  CPU0: status register frc 1100dc00
  console [ttyS0] enabled, bootconsole disabled
  console [ttyS0] enabled, bootconsole disabled
  Calibrating delay loop... 574.46 BogoMIPS (lpj=1148928)
  pid_max: default: 32768 minimum: 301
  Mount-cache hash table entries: 512
  CPU revision is: 0001992f (MIPS 1004Kc)
  Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
  Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
  MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
  CPU revision is: 0001992f (MIPS 1004Kc)
  Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
  Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
  MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
  CPU revision is: 0001992f (MIPS 1004Kc)
  Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
  Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
  MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
  Brought up 4 CPUs
  Synchronize counters across 4 CPUs: done.
  NET: Registered protocol family 16
  MIPS: machine is Ralink MT7621
  before gpio setting:407ac
  after gpio setting:405ac
  release PCIe RST: RALINK_RSTCTRL = 3000000
  PCIE PHY initialize
  ***** Xtal 40MHz *****
  start MT7621 PCIe register access
  RALINK_RSTCTRL = 3000000
  RALINK_CLKCFG1 = 77ffeff8
  
  *************** MT7621 PCIe RC mode *************
  pcie_link status = 0x3
  RALINK_RSTCTRL= 3000000
  *** Configure Device number setting of Virtual PCI-PCI bridge ***
  RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2
  PCIE0 enabled
  PCIE1 enabled
  interrupt enable status: 300000
  Port 1 N_FTS = 1b105000
  Port 0 N_FTS = 1b105000
  config reg done
  init_rt2880pci done
  bio: create slab  at 0
  SCSI subsystem initialized
  pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
  pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000)
  pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
  pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff]
  pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff]
  pci 0000:00:00.0: BAR 1: set to [mem 0x60200000-0x6020ffff] (PCI address [0x60200000-0x6020ffff])
  pci 0000:00:01.0: BAR 1: assigned [mem 0x60210000-0x6021ffff]
  pci 0000:00:01.0: BAR 1: set to [mem 0x60210000-0x6021ffff] (PCI address [0x60210000-0x6021ffff])
  pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
  pci 0000:01:00.0: BAR 0: set to [mem 0x60000000-0x600fffff 64bit] (PCI address [0x60000000-0x600fffff])
  pci 0000:00:00.0: PCI bridge to [bus 01-01]
  pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
  pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff 64bit]
  pci 0000:02:00.0: BAR 0: set to [mem 0x60100000-0x601fffff 64bit] (PCI address [0x60100000-0x601fffff])
  pci 0000:00:01.0: PCI bridge to [bus 02-02]
  pci 0000:00:01.0:   bridge window [mem 0x60100000-0x601fffff]
  PCI: Enabling device 0000:00:00.0 (0004 -> 0006)
  PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
  BAR0 at slot 0 = 0
  bus=0x0, slot = 0x0
  res[0]->start = 0
  res[0]->end = 0
  res[1]->start = 60200000
  res[1]->end = 6020ffff
  res[2]->start = 0
  res[2]->end = 0
  res[3]->start = 0
  res[3]->end = 0
  res[4]->start = 0
  res[4]->end = 0
  res[5]->start = 0
  res[5]->end = 0
  BAR0 at slot 1 = 0
  bus=0x0, slot = 0x1
  res[0]->start = 0
  res[0]->end = 0
  res[1]->start = 60210000
  res[1]->end = 6021ffff
  res[2]->start = 0
  res[2]->end = 0
  res[3]->start = 0
  res[3]->end = 0
  res[4]->start = 0
  res[4]->end = 0
  res[5]->start = 0
  res[5]->end = 0
  bus=0x1, slot = 0x0, irq=0x4
  res[0]->start = 60000000
  res[0]->end = 600fffff
  res[1]->start = 0
  res[1]->end = 0
  res[2]->start = 0
  res[2]->end = 0
  res[3]->start = 0
  res[3]->end = 0
  res[4]->start = 0
  res[4]->end = 0
  res[5]->start = 0
  res[5]->end = 0
  bus=0x2, slot = 0x1, irq=0x18
  res[0]->start = 60100000
  res[0]->end = 601fffff
  res[1]->start = 0
  res[1]->end = 0
  res[2]->start = 0
  res[2]->end = 0
  res[3]->start = 0
  res[3]->end = 0
  res[4]->start = 0
  res[4]->end = 0
  res[5]->start = 0
  res[5]->end = 0
  Switching to clocksource MIPS
  NET: Registered protocol family 2
  IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
  TCP established hash table entries: 4096 (order: 3, 32768 bytes)
  TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
  TCP: Hash tables configured (established 4096 bind 4096)
  TCP reno registered
  UDP hash table entries: 128 (order: 0, 4096 bytes)
  UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
  NET: Registered protocol family 1
  4 CPUs re-calibrate udelay(lpj = 1167360)
  Load Ralink Timer0 Module
  Load Ralink Timer1 Module
  Load Ralink Timer2 Module
  squashfs: version 4.0 (2009/01/31) Phillip Lougher
  JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
  msgmni has been set to 242
  io scheduler noop registered
  io scheduler deadline registered
  io scheduler cfq registered (default)
  Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
  serial8250: ttyS0 at MMIO 0x1e000c00 (irq = 26) is a 16550A
  serial8250: ttyS1 at MMIO 0x1e000e00 (irq = 28) is a 16550A
  loop: module loaded
  flash manufacture id: c2, device id 20 18
  MX25L12805D(c2 2018c220) (16384 Kbytes)
  mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
  Creating 8 MTD partitions on "raspi":
  0x000000000000-0x000001000000 : "ALL"
  0x000000000000-0x000000030000 : "Bootloader"
  0x000000030000-0x000000040000 : "Config"
  0x000000040000-0x000000050000 : "Factory"
  0x000000050000-0x000000df0000 : "Kernel"
  0x000000220000-0x000000df0000 : "user"
  0x000000df0000-0x000000f80000 : "manufacture"
  0x000000f80000-0x000001000000 : "storage"
  rdm_major = 253
  IMQ driver loaded successfully. (numdevs = 2, numqueues = 1)
          Hooking IMQ after NAT on PREROUTING.
          Hooking IMQ before NAT on POSTROUTING.
  GMAC1_MAC_ADRH -- : 0x0000000c
  GMAC1_MAC_ADRL -- : 0x43288002
  Ralink APSoC Ethernet Driver Initilization. v3.1  512 rx/tx descriptors allocated, mtu = 1500!
  GMAC1_MAC_ADRH -- : 0x0000000c
  GMAC1_MAC_ADRL -- : 0x432880c9
  PROC INIT OK!
  PPP generic driver version 2.4.2
  PPP BSD Compression module registered
  PPP Deflate Compression module registered
  PPP MPPE Compression module registered
  NET: Registered protocol family 24
  Registered button device:reset, gpio:16,code:408,index:10
  Registered button device:wps, gpio:18,code:529,index:11
  Registered button device:op_mode_1, gpio:13,code:263,index:7
  GACT probability on
  Mirror/redirect action on
  Simple TC action Loaded
  netem: version 1.3
  u32 classifier
      Performance counters on
      input device check on
      Actions configured
  Netfilter messages via NETLINK v0.30.
  nf_conntrack version 0.5.0 (2500 buckets, 17500 max, 2500 max0, 20000 reserved)
  xt_time: kernel timezone is -0000
  ip_tables: (C) 2000-2006 Netfilter Core Team
  TCP westwood registered
  NET: Registered protocol family 10
  ip6_tables: (C) 2000-2006 Netfilter Core Team
  IPv6 over IPv4 tunneling driver
  NET: Registered protocol family 17
  NET: Registered protocol family 2
  L2TP core driver, V2.0
  8021q: 802.1Q VLAN Support v1.8
  Freeing unused kernel memory: 1788k freed
  System Init version: 1.1 date: 1
  Setting up file systems ...
  Setting up /mnt/tmpfs directory with tmpfs/16384KB
  Setting up FLASH storage partition ...
  JFFS2 notice: (345) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
  Setting up /apps directory ...apps is in FLASH ...
  Setting up loopback device ...
  FINISHED
  Start Normal Operation Mode ...
  ************************************************************************
  *                                ---ELX---                             *
  ************************************************************************
  
  KernelApp version: 1.4.0 build date: 2017/10/31 build time: 18:06:42
  cmd> ln: /sbin/./start_all: File exists
  Share memory created:  keyid 6888 shm_id 0 size 208(KB)
  Warning: dbox_destroy_share_memory p_dbox_cfg is NULL!
  nat_session_manager: module license 'unspecified' taints kernel.
  Disabling lock debugging due to kernel taint
  Start nat_session_reservation_init_driver
  __create_share_mem keyid 6888 shm_id 0
   0:1F: 0: 0: 0: 0
  Raeth v3.1 (Tasklet)
  phy_free_head is 0x6c00000!!!
  phy_free_tail_phy is 0x6c01ff0!!!
  txd_pool=a6c1a000 phy_txd_pool=06C1A000
  ei_local->skb_free start address is 0x8703d45c.
  free_txd: 06c1a010, ei_local->cpu_ptr: 06C1A000
   POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
  ----------------+---------+--------
       0xa6c1a000 0x06C1A000 0x06C1A000
  
  phy_qrx_ring = 0x06c02000, qrx_ring = 0xa6c02000
  
  phy_rx_ring0 = 0x073ea000, rx_ring0 = 0xa73ea000
  GMAC1_MAC_ADRH -- : 0x0000001f
  GMAC1_MAC_ADRL -- : 0x00000000
  GDMA2_MAC_ADRH -- : 0x000000aa
  GDMA2_MAC_ADRL -- : 0xbbccdd20
  eth3: ===> VirtualIF_open
  CDMA_CSG_CFG = 81000000
  GDMA1_FWD_CFG = 20710000
  GDMA2_FWD_CFG = 20710000
  ra2880stop()...Done
  eth3: ===> VirtualIF_close
  Free TX/RX Ring Memory!
   0:1F: 0: 0: 0: 0
  Raeth v3.1 (Tasklet)
  phy_free_head is 0x6c24000!!!
  phy_free_tail_phy is 0x6c25ff0!!!
  txd_pool=a733c000 phy_txd_pool=0733C000
  ei_local->skb_free start address is 0x8703d45c.
  free_txd: 0733c010, ei_local->cpu_ptr: 0733C000
   POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
  ----------------+---------+--------
       0xa733c000 0x0733C000 0x0733C000
  
  phy_qrx_ring = 0x07359000, qrx_ring = 0xa7359000
  
  phy_rx_ring0 = 0x073f2000, rx_ring0 = 0xa73f2000
  GMAC1_MAC_ADRH -- : 0x0000001f
  GMAC1_MAC_ADRL -- : 0x00000000
  eth3: ===> VirtualIF_open
  CDMA_CSG_CFG = 81000000
  GDMA1_FWD_CFG = 20710000
  GDMA2_FWD_CFG = 20710000
  GDMA2_MAC_ADRH -- : 0x00003476
  GDMA2_MAC_ADRL -- : 0xc583ba1d
  eth3: ===> VirtualIF_open
  ADDRCONF(NETDEV_UP): br0: link is not ready
  device eth2 entered promiscuous mode
  br0: port 1(eth2) entering forwarding state
  br0: port 1(eth2) entering forwarding state
  
  
  ********************
  Initialize Radio_(24G) setting ... 
  rd[0]==1
  OK
  
  
  Configuring Ralink WiFi device ...Wlan is in
   AP Mode
  CMD[insmod /lib/rlt_wifi.ko]
  register mt_drv
  
  
  === pAd = c0601000, size = 2378520 ===
  
  PciHif.CSRBaseAddress =0xc0500000, csr_addr=0xc0500000!
  RTMPInitPCIeDevice():device_id=0x7615
  DriverOwn()::Try to Clear FW Own...
  DriverOwn()::Success to clear FW Own
  mt_pci_chip_cfg(): HWVer=0x8a10, FWVer=0x8a10, pAd->ChipID=0x7615
  mt_pci_chip_cfg(): HIF_SYS_REV=0x76150001
  RtmpChipOpsHook(492): Not support for HIF_MT yet! MACVersion=0x0
  mt7615_init()-->
  Use 1st ePAeLNA default bin.
  
  Use 2nd ePAeLNA default bin.
  rxq = c0843d84
  ctl->ackq = c0843d90
  ctl->kickq = c0843d9c
  ctl->tx_doneq = c0843da8
  ctl->rx_doneq = c0843db4
  mt7615_fw_prepare():FW(8a10), HW(8a10), CHIPID(7615))
  mt7615_fw_prepare(2356): MT7615_E3, USE E3 patch and ram code binary image
  AndesMTLoadRomMethodFwDlRing(1035), cap->rom_patch_len(3150)
  AndesRestartCheck: Current TOP_MISC2(0x1)
  AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
  20160419154809a
  
  platform = 
  ALPS
  hw/sw version = 
  8a108a10
  patch version = 
  00000010
  Patch SEM Status=2
  MtCmdPatchSemGet:(ret = 0)
  
  Patch is not ready && get semaphore success, SemStatus(2)
  EventGenericEventHandler: CMD Success
  MtCmdAddressLenReq:(ret = 0)
  MtCmdPatchFinishReq
  EventGenericEventHandler: CMD Success
  Send checksum req..
  Patch SEM Status=3
  MtCmdPatchSemGet:(ret = 0)
  
  Release patch semaphore, SemStatus(3)
  AndesMTEraseRomPatch
  AndesMTLoadFwMethodFwDlRing(809), cap->fw_len(452248)
  Build Date:_201609021732
  Build Date:_201609021732
  AndesRestartCheck: Current TOP_MISC2(0x1)
  AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
  EventGenericEventHandler: CMD Success
  MtCmdAddressLenReq:(ret = 0)
  EventGenericEventHandler: CMD Success
  MtCmdAddressLenReq:(ret = 0)
  MtCmdFwStartReq: override = 1, address = 540672
  EventGenericEventHandler: CMD Success
  Build Date:_201607011611
  EventGenericEventHandler: CMD Success
  MtCmdAddressLenReq:(ret = 0)
  MtCmdFwStartReq: override = 4, address = 0
  EventGenericEventHandler: CMD Success
  MCU Init Done!
  efuse_probe: efuse = 10000212
  RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5
  RtmpEepromGetDefault::e2p_dafault=1
  RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1
  NVM is FLASH mode. dev_idx [0] FLASH OFFSET [0x40000]
  NICReadEEPROMParameters: EEPROM 0x52 b307
  MtCmdSetTxLpfCal:(ret = 0)
  MtCmdSetTxIqCal:(ret = 0)
  MtCmdSetTxDcCal:(ret = 0)
  MtCmdSetRxFiCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  Country Region from e2p = 1
  mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4
  rtmp_read_txpwr_from_eeprom(224): Don't Support this now!
  RTMPReadTxPwrPerRate(1381): Don't Support this now!
  RcRadioInit(): DbdcMode=0, ConcurrentBand=1
  RcRadioInit(): pRadioCtrl=878e9438,Band=0,rfcap=3,channel=1,PhyMode=2
  MtCmdSetDbdcCtrl:(ret = 0)
  Band Rf: 1, Phy Mode: 2
  AntCfgInit(2618): Not support for HIF_MT yet!
  MtSingleSkuLoadParam: RF_LOCKDOWN Feature OFF !!!
  MtBfBackOffLoadTable: RF_LOCKDOWN Feature OFF !!!
  EEPROM Init Done!
  mt_mac_init()-->
  mt_mac_pse_init(2715): Don't Support this now!
  mt7615_init_mac_cr()-->
  mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c
  mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c
  MtAsicSetMacMaxLen(1288): Not finish Yet!
  
  ApAutoChannelAtBootUprxq = c0bc3d84
  ctl->ackq = c0bc3d90
  ctl->kickq = c0bc3d9c
  ctl->tx_doneq = c0bc3da8
  ctl->rx_doneq = c0bc3db4
  mt7615_fw_prepare():FW(8a10), HW(8a10), CHIPID(7615))
  mt7615_fw_prepare(2356): MT7615_E3, USE E3 patch and ram code binary image
  AndesMTLoadRomMethodFwDlRing(1035), cap->rom_patch_len(3150)
  AndesRestartCheck: Current TOP_MISC2(0x1)
  AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
  20160419154809a
  
  platform = 
  ALPS
  hw/sw version = 
  8a108a10
  patch version = 
  00000010
  Patch SEM Status=2
  MtCmdPatchSemGet:(ret = 0)
  
  Patch is not ready && get semaphore success, SemStatus(2)
  EventGenericEventHandler: CMD Success
  MtCmdAddressLenReq:(ret = 0)
  MtCmdPatchFinishReq
  EventGenericEventHandler: CMD Success
  Send checksum req..
  Patch SEM Status=3
  MtCmdPatchSemGet:(ret = 0)
  
  Release patch semaphore, SemStatus(3)
  AndesMTEraseRomPatch
  AndesMTLoadFwMethodFwDlRing(809), cap->fw_len(452248)
  Build Date:_201609021732
  Build Date:_201609021732
  AndesRestartCheck: Current TOP_MISC2(0x1)
  AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
  EventGenericEventHandler: CMD Success
  MtCmdAddressLenReq:(ret = 0)
  EventGenericEventHandler: CMD Success
  MtCmdAddressLenReq:(ret = 0)
  MtCmdFwStartReq: override = 1, address = 540672
  EventGenericEventHandler: CMD Success
  Build Date:_201607011611
  EventGenericEventHandler: CMD Success
  MtCmdAddressLenReq:(ret = 0)
  MtCmdFwStartReq: override = 4, address = 0
  EventGenericEventHandler: CMD Success
  MCU Init Done!
  efuse_probe: efuse = 10000212
  RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5
  RtmpEepromGetDefault::e2p_dafault=1
  RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1
  NVM is FLASH mode. dev_idx [1] FLASH OFFSET [0x48000]
  NICReadEEPROMParameters: EEPROM 0x52 b307
  MtCmdSetTxLpfCal:(ret = 0)
  MtCmdSetTxIqCal:(ret = 0)
  MtCmdSetTxDcCal:(ret = 0)
  MtCmdSetRxFiCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  MtCmdSetRxFdCal:(ret = 0)
  Country Region from e2p = 1
  mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4
  rtmp_read_txpwr_from_eeprom(224): Don't Support this now!
  RTMPReadTxPwrPerRate(1381): Don't Support this now!
  RcRadioInit(): DbdcMode=0, ConcurrentBand=1
  RcRadioInit(): pRadioCtrl=878eb438,Band=0,rfcap=3,channel=1,PhyMode=2
  MtCmdSetDbdcCtrl:(ret = 0)
  Band Rf: 1, Phy Mode: 2
  AntCfgInit(2618): Not support for HIF_MT yet!
  MtSingleSkuLoadParam: RF_LOCKDOWN Feature OFF !!!
  MtBfBackOffLoadTable: RF_LOCKDOWN Feature OFF !!!
  EEPROM Init Done!
  mt_mac_init()-->
  mt_mac_pse_init(2715): Don't Support this now!
  mt7615_init_mac_cr()-->
  mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c
  mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c
  MtAsicSetMacMaxLen(1288): Not finish Yet!
  
  ApAutoChannelAtBootUp VirtualIF_open
  Ebtables v2.0 registered
  __create_share_mem keyid 6888 shm_id 0
  __create_share_mem keyid 6888 shm_id 0
  __create_share_mem keyid 6888 shm_id 0
  Start wps_led driver
  Err: read_to_buf failed to open file /proc/523/status!
  br0: port 1(eth2) entering forwarding state
  eth3: ===> VirtualIF_close
  eth3: ===> VirtualIF_open
  eth3: ===> VirtualIF_close
  eth3: ===> VirtualIF_open
  br0: port 2(ra0) entering forwarding state
  br0: port 3(rai0) entering forwarding state