以前ファームウェアを調べた際にMT7621を搭載していることを把握しており、つい最近某フリマサイトで安価な出品を見かけて衝動的に購入してしまった。
弄っていくのでメモ。
Switch
zone | WAN | LAN | |||
---|---|---|---|---|---|
port (WNPR2600G) |
インターネット | LAN4 | LAN3 | LAN2 | LAN1 |
port (MT7530) |
port0 | port1 | port2 | port3 | port4 |
MAC
Config
(u-boot-env), eeprom内に有。
- LAN:
34:76:C5:xx:xx:1E
(Config,ethaddr
(text)) - WAN:
34:76:C5:xx:xx:1D
(Config,wanaddr
(text)) - 2G:
34:76:C5:xx:xx:1E
(Factory,0x4
(hex)) - 5G:
34:76:C5:xx:xx:1F
(Factory,0x8004
(hex))
U-Boot
- help
U-Boot 1.1.3 (May 25 2016 - 17:17:58) MT7621 # help ? - alias for 'help' bootm - boot application image from memory cp - memory copy elx_check - check ELX image erase - erase SPI FLASH memory go - start application at address 'addr' help - print online help md - memory display mdio - Ralink PHY register R/W command !! mm - memory modify (auto-incrementing) mw - memory write (fill) nm - memory modify (constant address) printenv- print environment variables reset - Perform RESET of the CPU rf - read/write rf register saveenv - save environment variables to persistent storage setenv - set environment variables spi - spi command tftpboot- boot image via network using TFTP protocol version - print monitor version
- version
MT7621 # version U-Boot 1.1.3 (May 25 2016 - 17:17:58)
- printenv
ELECOM機関連の設定値が散見されるMT7621 # printenv bootcmd=tftp baudrate=57600 ethaddr="34:76:C5:**:**:1E" ramargs=setenv bootargs root=/dev/ram rw addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1 flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr) kernel_addr=BFC40000 u-boot=u-boot.bin load=tftp 8A100000 $(u-boot) u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize) loadfs=tftp 8A100000 root.cramfs u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize) test_tftp=tftp 8A100000 root.cramfs;run test_tftp ethact=Eth0 (10/100-M) language_code=jp domain=1 pincode=******** wlanaddr=BC:5C:4C:**:**:** kver=1.04 sn=12345678901234567890123456789012 usboot=0 bver=4.0.1.5 dom2=1 wanaddr=34:76:C5:**:**:1D bootdelay=2 filesize=52a000 fileaddr=80A00000 ipaddr=192.168.99.9 serverip=192.168.99.8 autostart=no bootfile=uImage_ELECOM-WRC-2533GHBK-I hw_id=0104003a op_mode=0 stdin=serial stdout=serial stderr=serial Environment size: 1051/4092 bytes
Kernel
コンソールにパスワードが掛けられている
- uname -a
# uname -a Linux WNPR2600G 3.2.9 #3 SMP Tue Oct 31 18:12:39 CST 2017 mips GNU/Linux
- cat /proc/version
# cat /proc/version Linux version 3.2.9 (root@***-pc) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Tue Oct 31 18:12:39 CST 2017
- cat /proc/cpuinfo
# cat /proc/version Linux version 3.2.9 (root@jim-pc) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Tue Oct 31 18:12:39 CST 2017 # cat /proc/cpuinfo system type : Mediatek MT7621 ver:1 eco:3 machine : Ralink MT7621 processor : 0 cpu model : MIPS 1004Kc V2.15 BogoMIPS : 583.68 wait instruction : yes microsecond timers : yes tlb_entries : 32 extra interrupt vector : yes hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000] ASEs implemented : mips16 dsp mt shadow register sets : 1 kscratch registers : 0 core : 0 VCED exceptions : not available VCEI exceptions : not available processor : 1 cpu model : MIPS 1004Kc V2.15 BogoMIPS : 583.68 wait instruction : yes microsecond timers : yes tlb_entries : 32 extra interrupt vector : yes hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000] ASEs implemented : mips16 dsp mt shadow register sets : 1 kscratch registers : 0 core : 0 VCED exceptions : not available VCEI exceptions : not available processor : 2 cpu model : MIPS 1004Kc V2.15 BogoMIPS : 583.68 wait instruction : yes microsecond timers : yes tlb_entries : 32 extra interrupt vector : yes hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000] ASEs implemented : mips16 dsp mt shadow register sets : 1 kscratch registers : 0 core : 1 VCED exceptions : not available VCEI exceptions : not available processor : 3 cpu model : MIPS 1004Kc V2.15 BogoMIPS : 583.68 wait instruction : yes microsecond timers : yes tlb_entries : 32 extra interrupt vector : yes hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000] ASEs implemented : mips16 dsp mt shadow register sets : 1 kscratch registers : 0 core : 1 VCED exceptions : not available VCEI exceptions : not available
- cat /proc/meminfo
# cat /proc/meminfo MemTotal: 125776 kB MemFree: 78028 kB Buffers: 3396 kB Cached: 12056 kB SwapCached: 0 kB Active: 4536 kB Inactive: 13272 kB Active(anon): 2412 kB Inactive(anon): 852 kB Active(file): 2124 kB Inactive(file): 12420 kB Unevictable: 0 kB Mlocked: 0 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 0 kB Writeback: 0 kB AnonPages: 2400 kB Mapped: 1912 kB Shmem: 904 kB Slab: 15696 kB SReclaimable: 844 kB SUnreclaim: 14852 kB KernelStack: 808 kB PageTables: 428 kB NFS_Unstable: 0 kB Bounce: 0 kB WritebackTmp: 0 kB CommitLimit: 62888 kB Committed_AS: 349380 kB VmallocTotal: 1048372 kB VmallocUsed: 7548 kB VmallocChunk: 1024940 kB
- cat /proc/mtd
# cat /proc/mtd dev: size erasesize name mtd0: 01000000 00010000 "ALL" mtd1: 00030000 00010000 "Bootloader" mtd2: 00010000 00010000 "Config" mtd3: 00010000 00010000 "Factory" mtd4: 00da0000 00010000 "Kernel" mtd5: 00bd0000 00010000 "user" mtd6: 00190000 00010000 "manufacture" mtd7: 00080000 00010000 "storage"
- ls -al /sys/class/leds/
# ls -al /sys/class/leds/ lrwxrwxrwx 1 0 Sep 1 00:05 PoE -> ../../devices/platform/leds-gpio/leds/PoE lrwxrwxrwx 1 0 Sep 1 00:00 2g_led -> ../../devices/platform/leds-gpio/leds/2g_led lrwxrwxrwx 1 0 Sep 1 00:00 5g_led -> ../../devices/platform/leds-gpio/leds/5g_led lrwxrwxrwx 1 0 Sep 1 00:00 DIAG -> ../../devices/platform/leds-gpio/leds/DIAG lrwxrwxrwx 1 0 Sep 1 00:00 power_led -> ../../devices/platform/leds-gpio/leds/power_led drwxr-xr-x 20 0 Sep 1 00:00 .. drwxr-xr-x 2 0 Sep 1 00:00 .
- bootlog
MT7615関連のログがあまりに多すぎるため、無線をオフにした状態のログ。=================================================================== MT7621 stage1 code Mar 12 2015 14:43:30 (ASIC) CPU=500000000 HZ BUS=125000000 HZ ================================================================== Change MPLL source from XTAL to CR... do MEMPLL setting.. MEMPLL Config : 0x11000000 3PLL mode + External loopback === XTAL-40Mhz === DDR-1200Mhz === PLL4 FB_DL: 0x3, 1/0 = 567/457 0D000000 PLL2 FB_DL: 0x11, 1/0 = 665/359 45000000 PLL3 FB_DL: 0x14, 1/0 = 691/333 51000000 do DDR setting..[01F40000] Apply DDR3 Setting...(use default AC) 0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120 -------------------------------------------------------------------------------- 0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000E:| 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 000F:| 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 1 0010:| 1 1 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0011:| 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 DRAMC_DQSCTL1[0e0]=14000000 DRAMC_DQSGCTL[124]=80000000 rank 0 coarse = 16 rank 0 fine = 40 B:| 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 opt_dle value:8 DRAMC_DDR2CTL[07c]=C287220D DRAMC_PADCTL4[0e4]=000022B3 DRAMC_DQIDLY1[210]=0B08070A DRAMC_DQIDLY2[214]=05070708 DRAMC_DQIDLY3[218]=0C070705 DRAMC_DQIDLY4[21c]=0A070B08 DRAMC_R0DELDLY[018]=00002222 ================================================================== RX DQS perbit delay software calibration ================================================================== 1.0-15 bit dq delay value ================================================================== bit| 0 1 2 3 4 5 6 7 8 9 -------------------------------------- 0 | 9 5 7 8 6 6 6 5 1 7 10 | 6 9 7 8 6 9 -------------------------------------- ================================================================== 2.dqs window x=pass dqs delay value (min~max)center y=0-7bit DQ of every group input delay:DQS0 =34 DQS1 = 34 ================================================================== bit DQS0 bit DQS1 0 (1~66)33 8 (1~60)30 1 (1~64)32 9 (1~68)34 2 (1~66)33 10 (1~66)33 3 (1~62)31 11 (1~62)31 4 (1~64)32 12 (1~66)33 5 (1~66)33 13 (0~63)31 6 (1~65)33 14 (1~66)33 7 (1~67)34 15 (1~66)33 ================================================================== 3.dq delay value last ================================================================== bit| 0 1 2 3 4 5 6 7 8 9 -------------------------------------- 0 | 10 7 8 11 8 7 7 5 5 7 10 | 7 12 8 11 7 10 ================================================================== ================================================================== TX perbyte calibration ================================================================== DQS loop = 15, cmp_err_1 = ffff0000 dqs_perbyte_dly.last_dqsdly_pass[0]=15, finish count=1 dqs_perbyte_dly.last_dqsdly_pass[1]=15, finish count=2 DQ loop=15, cmp_err_1 = ffff0000 dqs_perbyte_dly.last_dqdly_pass[0]=15, finish count=1 dqs_perbyte_dly.last_dqdly_pass[1]=15, finish count=2 byte:0, (DQS,DQ)=(8,8) byte:1, (DQS,DQ)=(8,8) DRAMC_DQODLY1[200]=88888888 DRAMC_DQODLY2[204]=88888888 20,data:88 [EMI] DRAMC calibration passed =================================================================== MT7621 stage1 code done CPU=500000000 HZ BUS=125000000 HZ =================================================================== U-Boot 1.1.3 (May 25 2016 - 17:17:58) Board: Ralink APSoC DRAM: 128 MB relocate_code Pointer at: 87fb4000 Config XHCI 40M PLL flash manufacture id: c2, device id 20 18 find flash: MX25L12805D ============================================ Ralink UBoot Version: 4.0.1.0 ELX UBoot Version: 1.0.3 -------------------------------------------- ASIC 7621_MP (MAC to MT7530 Mode) DRAM_CONF_FROM: Auto-Detection DRAM_TYPE: DDR3 DRAM bus: 16 bit Xtal Mode=3 OCP Ratio=1/4 Flash component: SPI Flash Date:May 25 2016 Time:17:17:58 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:256, ways:4, linesz:32 ,total:32768 ##### The CPU freq = 880 MHZ #### estimate memory size =128 Mbytes #Reset_MT7530 Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 9: Load Boot Loader code then write to Flash via TFTP. 0 3: System Boot system code via Flash. ## Booting image at bfc50000 ... Image Name: Linux Kernel Image Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1879274 Bytes = 1.8 MB Load Address: 80001000 Entry Point: 803123e0 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 803123e0) ... ## Giving linux memsize in MB, 128 Starting kernel ... Linux version 3.2.9 (root@***-pc) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Tue Oct 31 18:12:39 CST 2017 GCMP present bootconsole [early0] enabled CPU revision is: 0001992f (MIPS 1004Kc) Mediatek MT7621 ver:1 eco:3 running at 880.00 MHz Software DMA cache coherency Determined physical RAM map: memory: 08000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0x00000000 -> 0x00008000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00008000 Detected 3 available secondary CPU(s) PERCPU: Embedded 7 pages/cpu @81103000 s4800 r8192 d15680 u32768 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512 Kernel command line: console=ttyS0,57600 root=/dev/ram0 rootfstype=squashfs,jffs2 PID hash table entries: 512 (order: -1, 2048 bytes) Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes. Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes MIPS secondary cache 256kB, 8-way, linesize 32 bytes. Writing ErrCtl register=00048800 Readback ErrCtl register=00048800 Memory: 123988k/131072k available (3186k kernel code, 7084k reserved, 729k data, 1788k init, 0k highmem) SLUB: Genslabs=9, HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 Hierarchical RCU implementation. NR_IRQS:128 gic: revision 3.0 CPU0: status register was 11000000 CPU0: status register now 11001800 CPU0: status register frc 1100dc00 console [ttyS0] enabled, bootconsole disabled console [ttyS0] enabled, bootconsole disabled Calibrating delay loop... 574.46 BogoMIPS (lpj=1148928) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 CPU revision is: 0001992f (MIPS 1004Kc) Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes. Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes MIPS secondary cache 256kB, 8-way, linesize 32 bytes. CPU revision is: 0001992f (MIPS 1004Kc) Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes. Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes MIPS secondary cache 256kB, 8-way, linesize 32 bytes. CPU revision is: 0001992f (MIPS 1004Kc) Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes. Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes MIPS secondary cache 256kB, 8-way, linesize 32 bytes. Brought up 4 CPUs Synchronize counters across 4 CPUs: done. NET: Registered protocol family 16 MIPS: machine is Ralink MT7621 before gpio setting:407ac after gpio setting:405ac release PCIe RST: RALINK_RSTCTRL = 3000000 PCIE PHY initialize ***** Xtal 40MHz ***** start MT7621 PCIe register access RALINK_RSTCTRL = 3000000 RALINK_CLKCFG1 = 77ffeff8 *************** MT7621 PCIe RC mode ************* pcie_link status = 0x3 RALINK_RSTCTRL= 3000000 *** Configure Device number setting of Virtual PCI-PCI bridge *** RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2 PCIE0 enabled PCIE1 enabled interrupt enable status: 300000 Port 1 N_FTS = 1b105000 Port 0 N_FTS = 1b105000 config reg done init_rt2880pci done bio: create slab at 0 SCSI subsystem initialized pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000) pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000) pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff] pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff] pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff] pci 0000:00:00.0: BAR 1: set to [mem 0x60200000-0x6020ffff] (PCI address [0x60200000-0x6020ffff]) pci 0000:00:01.0: BAR 1: assigned [mem 0x60210000-0x6021ffff] pci 0000:00:01.0: BAR 1: set to [mem 0x60210000-0x6021ffff] (PCI address [0x60210000-0x6021ffff]) pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit] pci 0000:01:00.0: BAR 0: set to [mem 0x60000000-0x600fffff 64bit] (PCI address [0x60000000-0x600fffff]) pci 0000:00:00.0: PCI bridge to [bus 01-01] pci 0000:00:00.0: bridge window [mem 0x60000000-0x600fffff] pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff 64bit] pci 0000:02:00.0: BAR 0: set to [mem 0x60100000-0x601fffff 64bit] (PCI address [0x60100000-0x601fffff]) pci 0000:00:01.0: PCI bridge to [bus 02-02] pci 0000:00:01.0: bridge window [mem 0x60100000-0x601fffff] PCI: Enabling device 0000:00:00.0 (0004 -> 0006) PCI: Enabling device 0000:00:01.0 (0004 -> 0006) BAR0 at slot 0 = 0 bus=0x0, slot = 0x0 res[0]->start = 0 res[0]->end = 0 res[1]->start = 60200000 res[1]->end = 6020ffff res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 BAR0 at slot 1 = 0 bus=0x0, slot = 0x1 res[0]->start = 0 res[0]->end = 0 res[1]->start = 60210000 res[1]->end = 6021ffff res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 bus=0x1, slot = 0x0, irq=0x4 res[0]->start = 60000000 res[0]->end = 600fffff res[1]->start = 0 res[1]->end = 0 res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 bus=0x2, slot = 0x1, irq=0x18 res[0]->start = 60100000 res[0]->end = 601fffff res[1]->start = 0 res[1]->end = 0 res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 Switching to clocksource MIPS NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 3, 32768 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered UDP hash table entries: 128 (order: 0, 4096 bytes) UDP-Lite hash table entries: 128 (order: 0, 4096 bytes) NET: Registered protocol family 1 4 CPUs re-calibrate udelay(lpj = 1167360) Load Ralink Timer0 Module Load Ralink Timer1 Module Load Ralink Timer2 Module squashfs: version 4.0 (2009/01/31) Phillip Lougher JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. msgmni has been set to 242 io scheduler noop registered io scheduler deadline registered io scheduler cfq registered (default) Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x1e000c00 (irq = 26) is a 16550A serial8250: ttyS1 at MMIO 0x1e000e00 (irq = 28) is a 16550A loop: module loaded flash manufacture id: c2, device id 20 18 MX25L12805D(c2 2018c220) (16384 Kbytes) mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0 Creating 8 MTD partitions on "raspi": 0x000000000000-0x000001000000 : "ALL" 0x000000000000-0x000000030000 : "Bootloader" 0x000000030000-0x000000040000 : "Config" 0x000000040000-0x000000050000 : "Factory" 0x000000050000-0x000000df0000 : "Kernel" 0x000000220000-0x000000df0000 : "user" 0x000000df0000-0x000000f80000 : "manufacture" 0x000000f80000-0x000001000000 : "storage" rdm_major = 253 IMQ driver loaded successfully. (numdevs = 2, numqueues = 1) Hooking IMQ after NAT on PREROUTING. Hooking IMQ before NAT on POSTROUTING. GMAC1_MAC_ADRH -- : 0x0000000c GMAC1_MAC_ADRL -- : 0x43288002 Ralink APSoC Ethernet Driver Initilization. v3.1 512 rx/tx descriptors allocated, mtu = 1500! GMAC1_MAC_ADRH -- : 0x0000000c GMAC1_MAC_ADRL -- : 0x432880c9 PROC INIT OK! PPP generic driver version 2.4.2 PPP BSD Compression module registered PPP Deflate Compression module registered PPP MPPE Compression module registered NET: Registered protocol family 24 Registered button device:reset, gpio:16,code:408,index:10 Registered button device:wps, gpio:18,code:529,index:11 Registered button device:op_mode_1, gpio:13,code:263,index:7 GACT probability on Mirror/redirect action on Simple TC action Loaded netem: version 1.3 u32 classifier Performance counters on input device check on Actions configured Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (2500 buckets, 17500 max, 2500 max0, 20000 reserved) xt_time: kernel timezone is -0000 ip_tables: (C) 2000-2006 Netfilter Core Team TCP westwood registered NET: Registered protocol family 10 ip6_tables: (C) 2000-2006 Netfilter Core Team IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 NET: Registered protocol family 2 L2TP core driver, V2.0 8021q: 802.1Q VLAN Support v1.8 Freeing unused kernel memory: 1788k freed System Init version: 1.1 date: 1 Setting up file systems ... Setting up /mnt/tmpfs directory with tmpfs/16384KB Setting up FLASH storage partition ... JFFS2 notice: (345) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. Setting up /apps directory ...apps is in FLASH ... Setting up loopback device ... FINISHED Start Normal Operation Mode ... ************************************************************************ * ---ELX--- * ************************************************************************ KernelApp version: 1.4.0 build date: 2017/10/31 build time: 18:06:42 cmd> ln: /sbin/./start_all: File exists Share memory created: keyid 6888 shm_id 0 size 208(KB) Warning: dbox_destroy_share_memory p_dbox_cfg is NULL! nat_session_manager: module license 'unspecified' taints kernel. Disabling lock debugging due to kernel taint Start nat_session_reservation_init_driver __create_share_mem keyid 6888 shm_id 0 0:1F: 0: 0: 0: 0 Raeth v3.1 (Tasklet) phy_free_head is 0x6c00000!!! phy_free_tail_phy is 0x6c01ff0!!! txd_pool=a6c1a000 phy_txd_pool=06C1A000 ei_local->skb_free start address is 0x8703d45c. free_txd: 06c1a010, ei_local->cpu_ptr: 06C1A000 POOL HEAD_PTR | DMA_PTR | CPU_PTR ----------------+---------+-------- 0xa6c1a000 0x06C1A000 0x06C1A000 phy_qrx_ring = 0x06c02000, qrx_ring = 0xa6c02000 phy_rx_ring0 = 0x073ea000, rx_ring0 = 0xa73ea000 GMAC1_MAC_ADRH -- : 0x0000001f GMAC1_MAC_ADRL -- : 0x00000000 GDMA2_MAC_ADRH -- : 0x000000aa GDMA2_MAC_ADRL -- : 0xbbccdd20 eth3: ===> VirtualIF_open CDMA_CSG_CFG = 81000000 GDMA1_FWD_CFG = 20710000 GDMA2_FWD_CFG = 20710000 ra2880stop()...Done eth3: ===> VirtualIF_close Free TX/RX Ring Memory! 0:1F: 0: 0: 0: 0 Raeth v3.1 (Tasklet) phy_free_head is 0x6c24000!!! phy_free_tail_phy is 0x6c25ff0!!! txd_pool=a733c000 phy_txd_pool=0733C000 ei_local->skb_free start address is 0x8703d45c. free_txd: 0733c010, ei_local->cpu_ptr: 0733C000 POOL HEAD_PTR | DMA_PTR | CPU_PTR ----------------+---------+-------- 0xa733c000 0x0733C000 0x0733C000 phy_qrx_ring = 0x07359000, qrx_ring = 0xa7359000 phy_rx_ring0 = 0x073f2000, rx_ring0 = 0xa73f2000 GMAC1_MAC_ADRH -- : 0x0000001f GMAC1_MAC_ADRL -- : 0x00000000 eth3: ===> VirtualIF_open CDMA_CSG_CFG = 81000000 GDMA1_FWD_CFG = 20710000 GDMA2_FWD_CFG = 20710000 GDMA2_MAC_ADRH -- : 0x00003476 GDMA2_MAC_ADRL -- : 0xc583ba1d eth3: ===> VirtualIF_open ADDRCONF(NETDEV_UP): br0: link is not ready device eth2 entered promiscuous mode br0: port 1(eth2) entering forwarding state br0: port 1(eth2) entering forwarding state ******************** Initialize Radio_(24G) setting ... rd[0]==1 OK Configuring Ralink WiFi device ...Wlan is in AP Mode CMD[insmod /lib/rlt_wifi.ko] register mt_drv === pAd = c0601000, size = 2378520 === PciHif.CSRBaseAddress =0xc0500000, csr_addr=0xc0500000! RTMPInitPCIeDevice():device_id=0x7615 DriverOwn()::Try to Clear FW Own... DriverOwn()::Success to clear FW Own mt_pci_chip_cfg(): HWVer=0x8a10, FWVer=0x8a10, pAd->ChipID=0x7615 mt_pci_chip_cfg(): HIF_SYS_REV=0x76150001 RtmpChipOpsHook(492): Not support for HIF_MT yet! MACVersion=0x0 mt7615_init()--> Use 1st ePAeLNA default bin. Use 2nd ePAeLNA default bin. rxq = c0843d84 ctl->ackq = c0843d90 ctl->kickq = c0843d9c ctl->tx_doneq = c0843da8 ctl->rx_doneq = c0843db4 mt7615_fw_prepare():FW(8a10), HW(8a10), CHIPID(7615)) mt7615_fw_prepare(2356): MT7615_E3, USE E3 patch and ram code binary image AndesMTLoadRomMethodFwDlRing(1035), cap->rom_patch_len(3150) AndesRestartCheck: Current TOP_MISC2(0x1) AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0) 20160419154809a platform = ALPS hw/sw version = 8a108a10 patch version = 00000010 Patch SEM Status=2 MtCmdPatchSemGet:(ret = 0) Patch is not ready && get semaphore success, SemStatus(2) EventGenericEventHandler: CMD Success MtCmdAddressLenReq:(ret = 0) MtCmdPatchFinishReq EventGenericEventHandler: CMD Success Send checksum req.. Patch SEM Status=3 MtCmdPatchSemGet:(ret = 0) Release patch semaphore, SemStatus(3) AndesMTEraseRomPatch AndesMTLoadFwMethodFwDlRing(809), cap->fw_len(452248) Build Date:_201609021732 Build Date:_201609021732 AndesRestartCheck: Current TOP_MISC2(0x1) AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0) EventGenericEventHandler: CMD Success MtCmdAddressLenReq:(ret = 0) EventGenericEventHandler: CMD Success MtCmdAddressLenReq:(ret = 0) MtCmdFwStartReq: override = 1, address = 540672 EventGenericEventHandler: CMD Success Build Date:_201607011611 EventGenericEventHandler: CMD Success MtCmdAddressLenReq:(ret = 0) MtCmdFwStartReq: override = 4, address = 0 EventGenericEventHandler: CMD Success MCU Init Done! efuse_probe: efuse = 10000212 RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5 RtmpEepromGetDefault::e2p_dafault=1 RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1 NVM is FLASH mode. dev_idx [0] FLASH OFFSET [0x40000] NICReadEEPROMParameters: EEPROM 0x52 b307 MtCmdSetTxLpfCal:(ret = 0) MtCmdSetTxIqCal:(ret = 0) MtCmdSetTxDcCal:(ret = 0) MtCmdSetRxFiCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) Country Region from e2p = 1 mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4 rtmp_read_txpwr_from_eeprom(224): Don't Support this now! RTMPReadTxPwrPerRate(1381): Don't Support this now! RcRadioInit(): DbdcMode=0, ConcurrentBand=1 RcRadioInit(): pRadioCtrl=878e9438,Band=0,rfcap=3,channel=1,PhyMode=2 MtCmdSetDbdcCtrl:(ret = 0) Band Rf: 1, Phy Mode: 2 AntCfgInit(2618): Not support for HIF_MT yet! MtSingleSkuLoadParam: RF_LOCKDOWN Feature OFF !!! MtBfBackOffLoadTable: RF_LOCKDOWN Feature OFF !!! EEPROM Init Done! mt_mac_init()--> mt_mac_pse_init(2715): Don't Support this now! mt7615_init_mac_cr()--> mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c MtAsicSetMacMaxLen(1288): Not finish Yet! ApAutoChannelAtBootUprxq = c0bc3d84 ctl->ackq = c0bc3d90 ctl->kickq = c0bc3d9c ctl->tx_doneq = c0bc3da8 ctl->rx_doneq = c0bc3db4 mt7615_fw_prepare():FW(8a10), HW(8a10), CHIPID(7615)) mt7615_fw_prepare(2356): MT7615_E3, USE E3 patch and ram code binary image AndesMTLoadRomMethodFwDlRing(1035), cap->rom_patch_len(3150) AndesRestartCheck: Current TOP_MISC2(0x1) AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0) 20160419154809a platform = ALPS hw/sw version = 8a108a10 patch version = 00000010 Patch SEM Status=2 MtCmdPatchSemGet:(ret = 0) Patch is not ready && get semaphore success, SemStatus(2) EventGenericEventHandler: CMD Success MtCmdAddressLenReq:(ret = 0) MtCmdPatchFinishReq EventGenericEventHandler: CMD Success Send checksum req.. Patch SEM Status=3 MtCmdPatchSemGet:(ret = 0) Release patch semaphore, SemStatus(3) AndesMTEraseRomPatch AndesMTLoadFwMethodFwDlRing(809), cap->fw_len(452248) Build Date:_201609021732 Build Date:_201609021732 AndesRestartCheck: Current TOP_MISC2(0x1) AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0) EventGenericEventHandler: CMD Success MtCmdAddressLenReq:(ret = 0) EventGenericEventHandler: CMD Success MtCmdAddressLenReq:(ret = 0) MtCmdFwStartReq: override = 1, address = 540672 EventGenericEventHandler: CMD Success Build Date:_201607011611 EventGenericEventHandler: CMD Success MtCmdAddressLenReq:(ret = 0) MtCmdFwStartReq: override = 4, address = 0 EventGenericEventHandler: CMD Success MCU Init Done! efuse_probe: efuse = 10000212 RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5 RtmpEepromGetDefault::e2p_dafault=1 RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1 NVM is FLASH mode. dev_idx [1] FLASH OFFSET [0x48000] NICReadEEPROMParameters: EEPROM 0x52 b307 MtCmdSetTxLpfCal:(ret = 0) MtCmdSetTxIqCal:(ret = 0) MtCmdSetTxDcCal:(ret = 0) MtCmdSetRxFiCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) MtCmdSetRxFdCal:(ret = 0) Country Region from e2p = 1 mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4 rtmp_read_txpwr_from_eeprom(224): Don't Support this now! RTMPReadTxPwrPerRate(1381): Don't Support this now! RcRadioInit(): DbdcMode=0, ConcurrentBand=1 RcRadioInit(): pRadioCtrl=878eb438,Band=0,rfcap=3,channel=1,PhyMode=2 MtCmdSetDbdcCtrl:(ret = 0) Band Rf: 1, Phy Mode: 2 AntCfgInit(2618): Not support for HIF_MT yet! MtSingleSkuLoadParam: RF_LOCKDOWN Feature OFF !!! MtBfBackOffLoadTable: RF_LOCKDOWN Feature OFF !!! EEPROM Init Done! mt_mac_init()--> mt_mac_pse_init(2715): Don't Support this now! mt7615_init_mac_cr()--> mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c MtAsicSetMacMaxLen(1288): Not finish Yet! ApAutoChannelAtBootUp VirtualIF_open Ebtables v2.0 registered __create_share_mem keyid 6888 shm_id 0 __create_share_mem keyid 6888 shm_id 0 __create_share_mem keyid 6888 shm_id 0 Start wps_led driver Err: read_to_buf failed to open file /proc/523/status! br0: port 1(eth2) entering forwarding state eth3: ===> VirtualIF_close eth3: ===> VirtualIF_open eth3: ===> VirtualIF_close eth3: ===> VirtualIF_open br0: port 2(ra0) entering forwarding state br0: port 3(rai0) entering forwarding state
広告