大破雑記帳

個人用メモな雑記ブログ　いろんなことをざっくりと。

WRC-2533GHBK2-T

Router/ELECOM

色々な用事で秋葉原に行った際、以前PCNETだった建物にいつの間にか入っていたハードオフの地下ジャンク階にて見付け確保。
既にサポート済みのWRC-2533GHBK-Iとほぼ共通であることは予想しているが、弄っていくのでメモ。

Switch

zone WAN LAN
port (WRC-2533GHBK2-T) INTERNET LAN4 LAN3 LAN2 LAN1
port (MT7530) port0 port1 port2 port3 port4

MAC

  • LAN: BC:5C:4C:xx:xx:FD (Config, ethaddr (text))
  • WAN: BC:5C:4C:xx:xx:FC (Config, wanaddr (text))
  • 2.4G: BC:5C:4C:xx:xx:FE (Factory, 0x4 (hex))
  • 5G: BC:5C:4C:xx:xx:FF (Factory, 0x8004 (hex))

U-Boot

  • help

      MT7621 # help
  ?       - alias for 'help'
  bootm   - boot application image from memory
  elx_check      - check ELX image
  go      - start application at address 'addr'
  help    - print online help
  md      - memory display
  mdio   - Ralink PHY register R/W command !!
  mm      - memory modify (auto-incrementing)
  mw      - memory write (fill)
  nm      - memory modify (constant address)
  printenv- print environment variables
  reset   - Perform RESET of the CPU
  rf      - read/write rf register
  saveenv - save environment variables to persistent storage
  setenv  - set environment variables
  tftpboot- boot image via network using TFTP protocol
  version - print monitor version

  • version

      MT7621 # version

  U-Boot 1.1.3 (Jan 19 2016 - 10:46:13)

  • printenv

      MT7621 # printenv
  bootcmd=tftp
  baudrate=57600
  ethaddr="BC:5C:4C:xx:xx:FD"
  ramargs=setenv bootargs root=/dev/ram rw
  addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
  addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
  flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
  kernel_addr=BFC40000
  u-boot=u-boot.bin
  load=tftp 8A100000 $(u-boot)
  u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
  loadfs=tftp 8A100000 root.cramfs
  u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
  test_tftp=tftp 8A100000 root.cramfs;run test_tftp
  ethact=Eth0 (10/100-M)
  language_code=jp
  hw_id=0107003b
  domain=1
  pincode=********
  wlanaddr=BC:5C:4C:xx:xx:FE
  kver=1.23.0
  sn=12345678901234567890123456789012
  usboot=0
  bver=4.0.1.5
  dom2=1
  wanaddr=BC:5C:4C:xx:xx:FC
  bootdelay=2
  filesize=52a000
  fileaddr=80A00000
  autostart=no
  op_mode=0
  ipaddr=192.168.2.101
  serverip=192.168.2.88
  bootfile=uImage_WRC-2533GHBK2-T
  stdin=serial
  stdout=serial
  stderr=serial

  Environment size: 1046/4092 bytes

  • tftpboot

      MT7621 # tftpboot

  netboot_common, argc= 1

  NetTxPacket = 0x87FE42C0

  KSEG1ADDR(NetTxPacket) = 0xA7FE42C0

  NetLoop,call eth_halt !

  NetLoop,call eth_init !
  Trying Eth0 (10/100-M)

  Waitting for RX_DMA_BUSY status Start... done

  ETH_STATE_ACTIVE!!
  Using Eth0 (10/100-M) device
  TFTP from server 192.168.2.88; our IP address is 192.168.2.101
  Filename 'uImage_WRC-2533GHBK2-T'.

  TIMEOUT_COUNT=10,Load address: 0x80100000
  Loading: *

  • help elx_check

      MT7621 # help elx_check
  elx_check usage:
  elx_check <addr>        - check image in <addr>

Kernel

パスワードが掛けられている

  • uname -a

      # uname -a
  Linux localhost.localdomain 3.2.9 #3 SMP Fri Jan 25 09:14:04 CST 2019 mips GNU/Linux

  • cat /proc/version

      # cat /proc/version
  Linux version 3.2.9 (root@edimax_cw) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Fri Jan 25 09:14:04 CST 2019

  • cat /proc/cpuinfo

      # cat /proc/cpuinfo
  system type             : Mediatek MT7621 ver:1 eco:3
  machine                 : Ralink MT7621
  processor               : 0
  cpu model               : MIPS 1004Kc V2.15
  BogoMIPS                : 583.68
  wait instruction        : yes
  microsecond timers      : yes
  tlb_entries             : 32
  extra interrupt vector  : yes
  hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ff8, 0x0ff8, 0x0ff8, 0x0ff8]
  ASEs implemented        : mips16 dsp mt
  shadow register sets    : 1
  kscratch registers      : 0
  core                    : 0
  VCED exceptions         : not available
  VCEI exceptions         : not available

  processor               : 1
  cpu model               : MIPS 1004Kc V2.15
  BogoMIPS                : 583.68
  wait instruction        : yes
  microsecond timers      : yes
  tlb_entries             : 32
  extra interrupt vector  : yes
  hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
  ASEs implemented        : mips16 dsp mt
  shadow register sets    : 1
  kscratch registers      : 0
  core                    : 0
  VCED exceptions         : not available
  VCEI exceptions         : not available

  processor               : 2
  cpu model               : MIPS 1004Kc V2.15
  BogoMIPS                : 583.68
  wait instruction        : yes
  microsecond timers      : yes
  tlb_entries             : 32
  extra interrupt vector  : yes
  hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0000, 0x0000, 0x0000]
  ASEs implemented        : mips16 dsp mt
  shadow register sets    : 1
  kscratch registers      : 0
  core                    : 1
  VCED exceptions         : not available
  VCEI exceptions         : not available

  processor               : 3
  cpu model               : MIPS 1004Kc V2.15
  BogoMIPS                : 583.68
  wait instruction        : yes
  microsecond timers      : yes
  tlb_entries             : 32
  extra interrupt vector  : yes
  hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
  ASEs implemented        : mips16 dsp mt
  shadow register sets    : 1
  kscratch registers      : 0
  core                    : 1
  VCED exceptions         : not available
  VCEI exceptions         : not available

  • cat /proc/meminfo

      # cat /proc/meminfo
  MemTotal:         125860 kB
  MemFree:           77644 kB
  Buffers:            2928 kB
  Cached:            10728 kB
  SwapCached:            0 kB
  Active:             4096 kB
  Inactive:          11444 kB
  Active(anon):       1920 kB
  Inactive(anon):     1388 kB
  Active(file):       2176 kB
  Inactive(file):    10056 kB
  Unevictable:           0 kB
  Mlocked:               0 kB
  SwapTotal:             0 kB
  SwapFree:              0 kB
  Dirty:                 0 kB
  Writeback:             0 kB
  AnonPages:          1920 kB
  Mapped:             2072 kB
  Shmem:              1424 kB
  Slab:              16280 kB
  SReclaimable:        876 kB
  SUnreclaim:        15404 kB
  KernelStack:         816 kB
  PageTables:          412 kB
  NFS_Unstable:          0 kB
  Bounce:                0 kB
  WritebackTmp:          0 kB
  CommitLimit:       62928 kB
  Committed_AS:     350360 kB
  VmallocTotal:    1048372 kB
  VmallocUsed:       10124 kB
  VmallocChunk:    1023044 kB

  • cat /proc/mtd

      # cat /proc/mtd
  dev:    size   erasesize  name
  mtd0: 01000000 00010000 "ALL"
  mtd1: 00030000 00010000 "Bootloader"
  mtd2: 00010000 00010000 "Config"
  mtd3: 00010000 00010000 "Factory"
  mtd4: 007a0000 00010000 "Kernel"
  mtd5: 005d0000 00010000 "user"
  mtd6: 00200000 00010000 "TM_1"
  mtd7: 00400000 00010000 "TM_2"
  mtd8: 00190000 00010000 "manufacture"
  mtd9: 00080000 00010000 "storage"

  • ls -al /sys/class/leds/

      # ls -al /sys/class/leds/
  lrwxrwxrwx    1         0 Sep  1 00:22 PoE -> ../../devices/platform/leds-gpio/leds/PoE
  lrwxrwxrwx    1         0 Sep  1 00:00 2g_led -> ../../devices/platform/leds-gpio/leds/2g_led
  lrwxrwxrwx    1         0 Sep  1 00:00 5g_led -> ../../devices/platform/leds-gpio/leds/5g_led
  lrwxrwxrwx    1         0 Sep  1 00:00 wps_led -> ../../devices/platform/leds-gpio/leds/wps_led
  lrwxrwxrwx    1         0 Sep  1 00:00 power_led -> ../../devices/platform/leds-gpio/leds/power_led
  drwxr-xr-x   20         0 Sep  1 00:00 ..
  drwxr-xr-x    2         0 Sep  1 00:00 .

  • elecom_header --help

      # elecom_header --help
  usage:    head    [-h?]      -h This help
  -s    Source filename
  -d    Destination filename
  -x    Remove ELECOM Header
  -c    Customer Name
  -p    Product Name
  -v    Version

  • header --help

      # header --help
  usage:    head    [-h?]      -h This help
  -s    Source filename
  -d    Destination filename
  -a    Auto set parameter
  -t    Types:
  bootloader (1)
  kernel (3)
  apps (5)
  factoryapps (11)
  userconfig (7)
  langpack (13)
  cust_logo (15)
  cust_apps (17)
  -v    Version
  -x    Recovery MD5 file [-u Magickey]
  -r    Vendor ID
  -p    Product ID
  -m    Magic Key(32 bits)
  -c    Code Version

  • elecom_header -x wrc-2533ghbk2-t_v1.23.bin

    header -x wrc-2533ghbk2-t_v1.23.bin

      # elecom_header -x wrc-2533ghbk2-t_v1.23.bin
  ### Remove Customer Header ####
  ------- Customer Header Info -------
  Customer Name : ELECOM
  Product  Name : WRC-2533GHBK2-T
  Product  Version : 1.23
  ------------------------------
  Header-Remove finished, got file [wrc-2533ghbk2-t_v1.23.bin] with size 7098496 bytes
  header: Return OK
  # header -x wrc-2533ghbk2-t_v1.23.bin
  ### Decoding  image ####
  Decode source file [wrc-2533ghbk2-t_v1.23.bin]
  ------- Header Info -------
  Vendor  id:  0x0107
  Product id:  0x003b
  Hardware id:  0x0107003b
  Version id:  3047
  Code Version:  1.23.0
  Type: 0x3 [kernel]
  comp_file_len:  7098368
  comp_file_sum:  0x0
  Header sum:  0x348
  Magic key:  0x30471688
  MD5 chksum:  446f893a8c79a9e2a149f239d49c2eb
  ------------------------------
  Decode finished, got file [wrc-2533ghbk2-t_v1.23.bin.bin] with size 7098368 bytes
  header: Return OK

  • bootlog

    
  ===================================================================
                  MT7621   stage1 code Mar 12 2015 14:43:30 (ASIC)
                  CPU=500000000 HZ BUS=125000000 HZ
  ==================================================================
  Change MPLL source from XTAL to CR...
  do MEMPLL setting..
  MEMPLL Config : 0x11000000
  3PLL mode + External loopback
  === XTAL-40Mhz === DDR-1200Mhz ===
  PLL2 FB_DL: 0xe, 1/0 = 685/339 39000000
  PLL4 FB_DL: 0xe, 1/0 = 687/337 39000000
  PLL3 FB_DL: 0x10, 1/0 = 521/503 41000000
  do DDR setting..[01F40000]
  Apply DDR3 Setting...(use default AC)
            0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
        --------------------------------------------------------------------------------
  0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    1
  000E:|    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1    1
  000F:|    0    0    0    0    1    1    1    1    1    1    1    1    1    1    0    0
  0010:|    1    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0
  0011:|    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0
  0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
  DRAMC_DQSCTL1[0e0]=13000000
  DRAMC_DQSGCTL[124]=80000033
  rank 0 coarse = 15
  rank 0 fine = 72
  B:|    0    0    0    0    0    0    0    0    0    0    1    1    1    0    0    0
  opt_dle value:11
  DRAMC_DDR2CTL[07c]=C287223D
  DRAMC_PADCTL4[0e4]=000022B3
  DRAMC_DQIDLY1[210]=0A09080B
  DRAMC_DQIDLY2[214]=06090909
  DRAMC_DQIDLY3[218]=0B080806
  DRAMC_DQIDLY4[21c]=09080B08
  DRAMC_R0DELDLY[018]=00001F1F
  ==================================================================
                  RX      DQS perbit delay software calibration 
  ==================================================================
  1.0-15 bit dq delay value
  ==================================================================
  bit|     0  1  2  3  4  5  6  7  8  9
  --------------------------------------
  0 |    8 5 6 7 6 6 6 6 2 7 
  10 |    6 8 6 10 7 9 
  --------------------------------------

  ==================================================================
  2.dqs window
  x=pass dqs delay value (min~max)center 
  y=0-7bit DQ of every group
  input delay:DQS0 =31 DQS1 = 31
  ==================================================================
  bit     DQS0     bit      DQS1
  0  (1~56)28  8  (1~54)27
  1  (1~56)28  9  (1~60)30
  2  (0~56)28  10  (1~58)29
  3  (1~56)28  11  (1~56)28
  4  (1~56)28  12  (0~58)29
  5  (1~56)28  13  (1~59)30
  6  (1~56)28  14  (1~59)30
  7  (2~61)31  15  (1~61)31
  ==================================================================
  3.dq delay value last
  ==================================================================
  bit|    0  1  2  3  4  5  6  7  8   9
  --------------------------------------
  0 |    11 8 9 10 9 9 9 6 6 8 
  10 |    8 11 8 11 8 9 
  ==================================================================
  ==================================================================
       TX  perbyte calibration 
  ==================================================================
  DQS loop = 15, cmp_err_1 = ffff0000 
  dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 
  dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 
  DQ loop=15, cmp_err_1 = ffff0080
  dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=1 
  DQ loop=14, cmp_err_1 = ffff0000
  dqs_perbyte_dly.last_dqdly_pass[0]=14,  finish count=2 
  byte:0, (DQS,DQ)=(8,8)
  byte:1, (DQS,DQ)=(8,8)
  DRAMC_DQODLY1[200]=88888888
  DRAMC_DQODLY2[204]=88888888
  20,data:88
  [EMI] DRAMC calibration passed

  ===================================================================
                  MT7621   stage1 code done 
                  CPU=500000000 HZ BUS=125000000 HZ
  ===================================================================


  U-Boot 1.1.3 (Jan 19 2016 - 10:46:13)

  Board: Ralink APSoC DRAM:  128 MB
  relocate_code Pointer at: 87fb8000

  Config XHCI 40M PLL 
  flash manufacture id: c2, device id 20 18
  find flash: MX25L12805D
  ============================================ 
  Ralink UBoot Version: 4.0.1.0
  ELX UBoot Version: 1.0.2
  -------------------------------------------- 
  ASIC 7621_MP (MAC to MT7530 Mode)
  DRAM_CONF_FROM: Auto-Detection 
  DRAM_TYPE: DDR3 
  DRAM bus: 16 bit
  Xtal Mode=3 OCP Ratio=1/4
  Flash component: SPI Flash
  Date:Jan 19 2016  Time:10:46:13
  ============================================ 
  icache: sets:256, ways:4, linesz:32 ,total:32768
  dcache: sets:256, ways:4, linesz:32 ,total:32768 

   ##### The CPU freq = 880 MHZ #### 
   estimate memory size =128 Mbytes
  #Reset_MT7530

  Please choose the operation: 
     1: Load system code to SDRAM via TFTP. 
     2: Load system code then write to Flash via TFTP. 
     3: Boot system code via Flash (default).
     4: Entr boot command line interface.
     9: Load Boot Loader code then write to Flash via TFTP.                                                                                      0 

  3: System Boot system code via Flash.
  ## Booting image at bfc50000 ...
     Image Name:   Linux Kernel Image
     Image Type:   MIPS Linux Kernel Image (lzma compressed)
     Data Size:    1861650 Bytes =  1.8 MB
     Load Address: 80001000
     Entry Point:  80305660
     Verifying Checksum ... OK
     Uncompressing Kernel Image ... OK
  No initrd
  ## Transferring control to Linux (at address 80305660) ...
  ## Giving linux memsize in MB, 128

  Starting kernel ...

  Linux version 3.2.9 (root@edimax_cw) (gcc version 4.6.4 (Buildroot 2013.05) ) #3 SMP Fri Jan 25 09:14:04 CST 2019
  GCMP present
  bootconsole [early0] enabled
  CPU revision is: 0001992f (MIPS 1004Kc)
  Mediatek MT7621 ver:1 eco:3 running at 880.00 MHz
  Software DMA cache coherency
  Determined physical RAM map:
   memory: 08000000 @ 00000000 (usable)
  Initrd not found or empty - disabling initrd
  Zone PFN ranges:
    Normal   0x00000000 -> 0x00008000
  Movable zone start PFN for each node
  early_node_map[1] active PFN ranges
      0: 0x00000000 -> 0x00008000
  Detected 3 available secondary CPU(s)
  PERCPU: Embedded 7 pages/cpu @81103000 s4800 r8192 d15680 u32768
  Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
  Kernel command line:  console=ttyS0,57600 root=/dev/ram0 rootfstype=squashfs,jffs2
  PID hash table entries: 512 (order: -1, 2048 bytes)
  Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
  Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
  Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
  Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
  MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
  Writing ErrCtl register=00012136
  Readback ErrCtl register=00012136
  Memory: 124056k/131072k available (3134k kernel code, 7016k reserved, 699k data, 1804k init, 0k highmem)
  SLUB: Genslabs=9, HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
  Hierarchical RCU implementation.
  NR_IRQS:128
  gic: revision 3.0
  CPU0: status register was 11000000
  CPU0: status register now 11001800
  CPU0: status register frc 1100dc00
  console [ttyS0] enabled, bootconsole disabled
  console [ttyS0] enabled, bootconsole disabled
  Calibrating delay loop... 577.53 BogoMIPS (lpj=1155072)
  pid_max: default: 32768 minimum: 301
  Mount-cache hash table entries: 512
  CPU revision is: 0001992f (MIPS 1004Kc)
  Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
  Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
  MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
  CPU revision is: 0001992f (MIPS 1004Kc)
  Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
  Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
  MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
  CPU revision is: 0001992f (MIPS 1004Kc)
  Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
  Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
  MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
  Brought up 4 CPUs
  Synchronize counters across 4 CPUs: done.
  NET: Registered protocol family 16
  MIPS: machine is Ralink MT7621
  before gpio setting:407ac
  after gpio setting:405ac
  release PCIe RST: RALINK_RSTCTRL = 3000000
  PCIE PHY initialize
  ***** Xtal 40MHz *****
  start MT7621 PCIe register access
  RALINK_RSTCTRL = 3000000
  RALINK_CLKCFG1 = 77ffeff8

  *************** MT7621 PCIe RC mode *************
  pcie_link status = 0x3
  RALINK_RSTCTRL= 3000000
  *** Configure Device number setting of Virtual PCI-PCI bridge ***
  RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2
  PCIE0 enabled
  PCIE1 enabled
  interrupt enable status: 300000
  Port 1 N_FTS = 1b105000
  Port 0 N_FTS = 1b105000
  config reg done
  init_rt2880pci done
  bio: create slab  at 0
  SCSI subsystem initialized
  pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
  pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000)
  pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
  pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff]
  pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff]
  pci 0000:00:00.0: BAR 1: set to [mem 0x60200000-0x6020ffff] (PCI address [0x60200000-0x6020ffff])
  pci 0000:00:01.0: BAR 1: assigned [mem 0x60210000-0x6021ffff]
  pci 0000:00:01.0: BAR 1: set to [mem 0x60210000-0x6021ffff] (PCI address [0x60210000-0x6021ffff])
  pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
  pci 0000:01:00.0: BAR 0: set to [mem 0x60000000-0x600fffff 64bit] (PCI address [0x60000000-0x600fffff])
  pci 0000:00:00.0: PCI bridge to [bus 01-01]
  pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
  pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff 64bit]
  pci 0000:02:00.0: BAR 0: set to [mem 0x60100000-0x601fffff 64bit] (PCI address [0x60100000-0x601fffff])
  pci 0000:00:01.0: PCI bridge to [bus 02-02]
  pci 0000:00:01.0:   bridge window [mem 0x60100000-0x601fffff]
  PCI: Enabling device 0000:00:00.0 (0004 -> 0006)
  PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
  BAR0 at slot 0 = 0
  bus=0x0, slot = 0x0
  res[0]->start = 0
  res[0]->end = 0
  res[1]->start = 60200000
  res[1]->end = 6020ffff
  res[2]->start = 0
  res[2]->end = 0
  res[3]->start = 0
  res[3]->end = 0
  res[4]->start = 0
  res[4]->end = 0
  res[5]->start = 0
  res[5]->end = 0
  BAR0 at slot 1 = 0
  bus=0x0, slot = 0x1
  res[0]->start = 0
  res[0]->end = 0
  res[1]->start = 60210000
  res[1]->end = 6021ffff
  res[2]->start = 0
  res[2]->end = 0
  res[3]->start = 0
  res[3]->end = 0
  res[4]->start = 0
  res[4]->end = 0
  res[5]->start = 0
  res[5]->end = 0
  bus=0x1, slot = 0x0, irq=0x4
  res[0]->start = 60000000
  res[0]->end = 600fffff
  res[1]->start = 0
  res[1]->end = 0
  res[2]->start = 0
  res[2]->end = 0
  res[3]->start = 0
  res[3]->end = 0
  res[4]->start = 0
  res[4]->end = 0
  res[5]->start = 0
  res[5]->end = 0
  bus=0x2, slot = 0x1, irq=0x18
  res[0]->start = 60100000
  res[0]->end = 601fffff
  res[1]->start = 0
  res[1]->end = 0
  res[2]->start = 0
  res[2]->end = 0
  res[3]->start = 0
  res[3]->end = 0
  res[4]->start = 0
  res[4]->end = 0
  res[5]->start = 0
  res[5]->end = 0
  Switching to clocksource MIPS
  NET: Registered protocol family 2
  IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
  TCP established hash table entries: 4096 (order: 3, 32768 bytes)
  TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
  TCP: Hash tables configured (established 4096 bind 4096)
  TCP reno registered
  UDP hash table entries: 128 (order: 0, 4096 bytes)
  UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
  NET: Registered protocol family 1
  4 CPUs re-calibrate udelay(lpj = 1167360)
  Load Ralink Timer0 Module
  Load Ralink Timer1 Module
  Load Ralink Timer2 Module
  squashfs: version 4.0 (2009/01/31) Phillip Lougher
  JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
  msgmni has been set to 242
  io scheduler noop registered
  io scheduler deadline registered
  io scheduler cfq registered (default)
  Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
  serial8250: ttyS0 at MMIO 0x1e000c00 (irq = 26) is a 16550A
  serial8250: ttyS1 at MMIO 0x1e000e00 (irq = 28) is a 16550A
  loop: module loaded
  flash manufacture id: c2, device id 20 18
  MX25L12805D(c2 2018c220) (16384 Kbytes)
  mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
  Creating 10 MTD partitions on "raspi":
  0x000000000000-0x000001000000 : "ALL"
  0x000000000000-0x000000030000 : "Bootloader"
  0x000000030000-0x000000040000 : "Config"
  0x000000040000-0x000000050000 : "Factory"
  0x000000050000-0x0000007f0000 : "Kernel"
  0x000000220000-0x0000007f0000 : "user"
  0x0000007f0000-0x0000009f0000 : "TM_1"
  0x0000009f0000-0x000000df0000 : "TM_2"
  0x000000df0000-0x000000f80000 : "manufacture"
  0x000000f80000-0x000001000000 : "storage"
  rdm_major = 253
  IMQ driver loaded successfully. (numdevs = 2, numqueues = 1)
          Hooking IMQ after NAT on PREROUTING.
          Hooking IMQ before NAT on POSTROUTING.
  GMAC1_MAC_ADRH -- : 0x0000000c
  GMAC1_MAC_ADRL -- : 0x4328806b
  Ralink APSoC Ethernet Driver Initilization. v3.1  512 rx/tx descriptors allocated, mtu = 1500!
  GMAC1_MAC_ADRH -- : 0x0000000c
  GMAC1_MAC_ADRL -- : 0x432880e9
  PROC INIT OK!
  PPP generic driver version 2.4.2
  PPP BSD Compression module registered
  PPP Deflate Compression module registered
  PPP MPPE Compression module registered
  NET: Registered protocol family 24
  Registered button device:reset, gpio:16,code:408,index:10
  Registered button device:wps, gpio:18,code:529,index:12
  Registered button device:op_mode_1, gpio:13,code:263,index:7
  GACT probability on
  Mirror/redirect action on
  Simple TC action Loaded
  netem: version 1.3
  u32 classifier
      Performance counters on
      input device check on
      Actions configured
  Netfilter messages via NETLINK v0.30.
  nf_conntrack version 0.5.0 (3750 buckets, 26250 max, 3750 max0, 30000 reserved)
  xt_time: kernel timezone is -0000
  ip_tables: (C) 2000-2006 Netfilter Core Team
  TCP westwood registered
  NET: Registered protocol family 10
  ip6_tables: (C) 2000-2006 Netfilter Core Team
  IPv6 over IPv4 tunneling driver
  NET: Registered protocol family 17
  NET: Registered protocol family 2
  L2TP core driver, V2.0
  8021q: 802.1Q VLAN Support v1.8
  Freeing unused kernel memory: 1804k freed
  System Init version: 1.1 date: 1
  Setting up file systems ...
  Setting up /mnt/tmpfs directory with tmpfs/16384KB
  Setting up FLASH storage partition ...
  JFFS2 notice: (337) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
  Setting up /apps directory ...apps is in FLASH ...
  Setting FLASH up TM_1 partition ...
  JFFS2 notice: (375) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
  Setting FLASH up TM_2 partition ...
  JFFS2 notice: (380) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
  Setting up loopback device ...
  FINISHED
  Start Normal Operation Mode ...
  ************************************************************************
  *                                ---ELX---                             *
  ************************************************************************

  KernelApp version: 1.23.0 build date: 2019/01/25 build time: 09:08:40
  cmd> ln: /sbin/./start_all: File exists
  Share memory created:  keyid 6888 shm_id 0 size 335(KB)
  Warning: dbox_destroy_share_memory p_dbox_cfg is NULL!
  __create_share_mem keyid 6888 shm_id 0
  3F: 1: 1: 0: 0: 0
  Raeth v3.1 (Tasklet)
  phy_free_head is 0x6c7e000!!!
  phy_free_tail_phy is 0x6c7fff0!!!
  txd_pool=a6c1a000 phy_txd_pool=06C1A000
  ei_local->skb_free start address is 0x8702945c.
  free_txd: 06c1a010, ei_local->cpu_ptr: 06C1A000
   POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
  ----------------+---------+--------
       0xa6c1a000 0x06C1A000 0x06C1A000

  phy_qrx_ring = 0x06c79000, qrx_ring = 0xa6c79000

  phy_rx_ring0 = 0x07366000, rx_ring0 = 0xa7366000
  GMAC1_MAC_ADRH -- : 0x0000000c
  GMAC1_MAC_ADRL -- : 0x432880e9
  GDMA2_MAC_ADRH -- : 0x000000aa
  GDMA2_MAC_ADRL -- : 0xbbccdd20
  eth3: ===> VirtualIF_open
  CDMA_CSG_CFG = 81000000
  GDMA1_FWD_CFG = 20710000
  GDMA2_FWD_CFG = 20710000
  ra2880stop()...Done
  eth3: ===> VirtualIF_close
  Free TX/RX Ring Memory!
  3F: 1: 1: 0: 0: 0
  Raeth v3.1 (Tasklet)
  phy_free_head is 0x6c86000!!!
  phy_free_tail_phy is 0x6c87ff0!!!
  txd_pool=a6da6000 phy_txd_pool=06DA6000
  ei_local->skb_free start address is 0x8702945c.
  free_txd: 06da6010, ei_local->cpu_ptr: 06DA6000
   POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
  ----------------+---------+--------
       0xa6da6000 0x06DA6000 0x06DA6000

  phy_qrx_ring = 0x06c27000, qrx_ring = 0xa6c27000

  phy_rx_ring0 = 0x06d9c000, rx_ring0 = 0xa6d9c000
  GMAC1_MAC_ADRH -- : 0x0000bc5c
  GMAC1_MAC_ADRL -- : 0x4cxxxxfd
  eth3: ===> VirtualIF_open
  CDMA_CSG_CFG = 81000000
  GDMA1_FWD_CFG = 20710000
  GDMA2_FWD_CFG = 20710000
  GDMA2_MAC_ADRH -- : 0x0000bc5c
  GDMA2_MAC_ADRL -- : 0x4cxxxxfc
  eth3: ===> VirtualIF_open
  eth3: ===> VirtualIF_close
  GDMA2_MAC_ADRH -- : 0x0000bc5c
  GDMA2_MAC_ADRL -- : 0x4cxxxxfc
  eth3: ===> VirtualIF_open
  ADDRCONF(NETDEV_UP): br0: link is not ready
  device br_t.1 entered promiscuous mode
  device br_t entered promiscuous mode
  br0: port 1(br_t.1) entering forwarding state
  br0: port 1(br_t.1) entering forwarding state
  ADDRCONF(NETDEV_CHANGE): br0: link becomes ready
  br0: port 1(br_t.1) entering forwarding state
  device eth2 entered promiscuous mode
  br0: port 2(eth2) entering forwarding state
  br0: port 2(eth2) entering forwarding state
  br0: port 1(br_t.1) entering forwarding state
  br0: port 1(br_t.1) entering forwarding state


  ********************
  Initialize Radio_(24G) setting ... 
  rd[0]==1
  OK


  Configuring Ralink WiFi device ...Wlan is in
   AP Mode
  CMD[insmod /lib/rlt_wifi.ko]
  ChipOpsMCUHook
  create [wsc_24g] proc!
  ChipOpsMCUHook
  create [wsc_5g] proc!
  CMD[cp /lib/7615_SingleSKU.dat /etc/Wireless/RT2860/7615_SingleSKU.dat]
  Copy single SKU file for 7615...
  CMD[cp /lib/7615_SingleSKU_BF.dat /etc/Wireless/RT2860/7615_SingleSKU_BF.dat]
  Copy single SKU BF file for 7615...
  CMD[ifconfig ra0 0.0.0.0 up]
  efuse_probe: efuse = 10000212
  MT7615BBPInit():BBP Initialization.....
          Band 0: valid=1, isDBDC=0, Band=2, CBW=1, CentCh/PrimCh=1/1, prim_ch_idx=0, txStream=2
          Band 1: valid=0, isDBDC=0, Band=0, CBW=0, CentCh/PrimCh=0/0, prim_ch_idx=0, txStream=0
  RTMPSetLEDStatus: before AndesLedEnhanceOP , status=1, LED_CMD=2!
  AndesLedEnhanceOP: Success!
  CMD[ifconfig ra1 0.0.0.0 up]
  CMD[brctl addif br0 ra0]
  device ra0 entered promiscuous mode
  br0: port 3(ra0) entering forwarding state
  br0: port 3(ra0) entering forwarding state
  CMD[brctl addif br0 ra1]
  device ra1 entered promiscuous mode
  br0: port 4(ra1) entering forwarding state
  br0: port 4(ra1) entering forwarding state
  CMD[mkdir -p /etc/wsc_xml]
  CMD[ln -s /apps/etc/xml/* /etc/wsc_xml]
  CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
  CMD[wscd -i ra0 -m 1 -w /etc/wsc_xml -a 192.168.2.1&amp;]
  CMD[iwpriv ra0 set IgmpSnEnable=0]
  CMD[iwpriv ra1 set IgmpSnEnable=0]
  CMD[iwpriv ra0 set WscConfMode=7]
  CMD[iwpriv ra0 set WscSetupLock=0]
  CMD[iwpriv ra0 set WscMaxPinAttack=5]
  CMD[iwpriv ra0 set HtMIMOPS=3]
  CMD[iwpriv ra0 set TxPowerFeatureCtrl=1:0:15]
  Interface doesn't accept private ioctl...
  set (8BE2): Invalid argument
  CMD[iwpriv ra0 set Channel=11]
  RTMPSetLEDStatus: before AndesLedEnhanceOP , status=0, LED_CMD=0!
  AndesLedEnhanceOP: Success!
  RTMPSetLEDStatus: before AndesLedEnhanceOP , status=1, LED_CMD=2!
  AndesLedEnhanceOP: Success!
  Reload iwevent...
  send 15 to pid:692
  CMD[iwevent &amp;]
  Waiting for Wireless Events from interfaces...
  CMD[echo 1 1 > /proc/wsc_preled]


  ********************
  Initialize Radio_(5G) setting ... 
  rd[1]==1
  OK
  Configuring 5G radio setting ... 


  Configuring Ralink WiFi device ...Wlan is in
   AP Mode
  CMD[cp /lib/7615_SingleSKU.dat /etc/Wireless/RT2860/7615_SingleSKU.dat]
  Copy single SKU file for 7615...
  CMD[cp /lib/7615_SingleSKU_BF.dat /etc/Wireless/RT2860/7615_SingleSKU_BF.dat]
  Copy single SKU BF file for 7615...
  CMD[ifconfig rai0 0.0.0.0 up]
  efuse_probe: efuse = 10000212
  br0: port 2(eth2) entering forwarding state
  br0: port 1(br_t.1) entering forwarding state
  MT7615BBPInit():BBP Initialization.....
          Band 0: valid=1, isDBDC=0, Band=2, CBW=1, CentCh/PrimCh=1/1, prim_ch_idx=0, txStream=2
          Band 1: valid=0, isDBDC=0, Band=0, CBW=0, CentCh/PrimCh=0/0, prim_ch_idx=0, txStream=0
  RTMPSetLEDStatus: before AndesLedEnhanceOP , status=1, LED_CMD=2!
  AndesLedEnhanceOP: Success!
  CMD[brctl addif br0 rai0]
  device rai0 entered promiscuous mode
  br0: port 5(rai0) entering forwarding state
  br0: port 5(rai0) entering forwarding state
  CMD[mkdir -p /etc/wsc_xml]
  CMD[ln -s /apps/etc/xml/* /etc/wsc_xml]
  ln: /etc/wsc_xml/WFAWLANConfigSCPD.xml: File exists
  CMD[route add -net 239.0.0.0 netmask 255.0.0.0 br0]
  route: SIOCADDRT: File exists
  CMD[wscd -i rai0 -m 1 -w /etc/wsc_xml -a 192.168.2.1&amp;]
  CMD[iwpriv rai0 set IgmpSnEnable=0]
  CMD[iwpriv rai0 set WscConfMode=7]
  CMD[iwpriv rai0 set WscSetupLock=0]
  CMD[iwpriv rai0 set WscMaxPinAttack=5]
  CMD[iwpriv rai0 set HtMIMOPS=3]
  CMD[iwpriv rai0 set TxPowerFeatureCtrl=1:0:15]
  Interface doesn't accept private ioctl...
  set (8BE2): Invalid argument
  CMD[iwpriv rai0 set Channel=36]
  Reload iwevent...
  send 15 to pid:983
  CMD[iwevent &amp;]
  Waiting for Wireless Events from interfaces...
  CMD[echo 2 1 > /proc/wsc_preled]
  dsc: module license 'unspecified' taints kernel.
  Disabling lock debugging due to kernel taint








  eth3: ===> VirtualIF_close
  GDMA2_MAC_ADRH -- : 0x0000bc5c
  GDMA2_MAC_ADRL -- : 0x4cxxxxfc
  eth3: ===> VirtualIF_open
  RTMPSetLEDStatus: before AndesLedEnhanceOP , status=0, LED_CMD=0!
  AndesLedEnhanceOP: Success!
  RTMPSetLEDStatus: before AndesLedEnhanceOP , status=1, LED_CMD=2!
  AndesLedEnhanceOP: Success!
  Start wps_led driver
  Ebtables v2.0 registered
  sh: can't create /sys/devices/virtual/net/br0/bridge/multicast_snooping: nonexistent directory
  __create_share_mem keyid 6888 shm_id 0
  __create_share_mem keyid 6888 shm_id 0
  eth2 ifindex =4
  eth3 ifindex =8
  ***********dev->ifindex = c
  ***********dev->ifindex = e
  ***********dev->ifindex = f
  ***********dev->ifindex = 10
  ***********dev->ifindex = 11
  ***********dev->ifindex = d
  ***********dev->ifindex = 12
  ***********dev->ifindex = 13
  ***********dev->ifindex = 14
  ***********dev->ifindex = 15
  Err: read_to_buf failed to open file /proc/657/status!
  eth3: ===> VirtualIF_close
  eth3: ===> VirtualIF_open
  eth3: ===> VirtualIF_close
  eth3: ===> VirtualIF_open
  echo: write error: Invalid argument
  br0: port 3(ra0) entering forwarding state
  br0: port 4(ra1) entering forwarding state
  RTMPSetLEDStatus: before AndesLedEnhanceOP , status=0, LED_CMD=0!
  AndesLedEnhanceOP: Success!
  RTMPSetLEDStatus: before AndesLedEnhanceOP , status=1, LED_CMD=2!
  AndesLedEnhanceOP: Success!
  br0: port 5(rai0) entering forwarding state
  RTMPSetLEDStatus: before AndesLedEnhanceOP , status=0, LED_CMD=0!
  AndesLedEnhanceOP: Success!
  RTMPSetLEDStatus: before AndesLedEnhanceOP , status=1, LED_CMD=2!
  AndesLedEnhanceOP: Success!