Add OpenWrt support for YJ-Link "YJ-LW928AG"

For Developers
1

(I know that there's a similar topic, but I'm unsure if I should reply there as it's from almost 6 years ago)

I have a "YJ-LW928AG" router from YJ-Link.
It's based on the MediaTek MT7628AN evaluation board, with the 5GHz chip is MT7612EN.
The stock image is based on OpenWrt 14 (Forgot to get a copy of the stock firmware but I'm receiving an identical router in a few days since they were cheap).
The 5GHz chip worked in the stock firmware.

Upgraded it to "OpenWrt 22.03.3 r20028-43d71ad93e" (openwrt-22.03.3-ramips-mt76x8-mediatek_mt7628an-eval-board-squashfs-sysupgrade.bin)

The 5GHz chip doesn't appear as radio 1 - only getting the 2.4GHz on radio 0
I tried installing kmod-mt76 and a few other packages but still no radio 1

I looked though all the logs but I couldn't find any errors in the logs myself:

boot log:

[ 1117.736000] reboot: Restarting system
[04050C0C][04050C0C]
DDR Calibration DQS reg = 00008888


U-Boot 1.1.3 (Jun 15 2016 - 14:46:50)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb0000
******************************
Software System Reset Occurred
******************************
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
============================================
Ralink UBoot Version: 4.3.0.1
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Jun 15 2016  Time:14:46:50
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 575 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.                     0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.161
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2200167 Bytes =  2.1 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 5.10.161 (builder@buildhost) (mipsel-openwrt-linux-                                                                                                                                    musl-gcc (OpenWrt GCC 11.2.0 r20028-43d71ad93e) 11.2.0, GNU ld (GNU Binutils) 2.                                                                                                                                    37) #0 Tue Jan 3 00:24:21 2023
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is Mediatek MT7628AN evaluation board
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                                                                                                                                    es
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs                                                                                                                                    2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, lin                                                                                                                                    ear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, line                                                                                                                                    ar)
[    0.000000] Writing ErrCtl register=0006b4d0
[    0.000000] Readback ErrCtl register=0006b4d0
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 56420K/65536K available (5680K kernel code, 617K rwdata,                                                                                                                                     696K rodata, 1188K init, 210K bss, 9116K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] intc: using register map from devicetree
[    0.000000] CPU Clock: 575MHz
[    0.000000] timer_probe: no matching timers found
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_i                                                                                                                                    dle_ns: 6647862422 ns
[    0.000013] sched_clock: 32 bits at 287MHz, resolution 3ns, wraps every 74695                                                                                                                                    08094ns
[    0.015488] Calibrating delay loop... 380.92 BogoMIPS (lpj=1904640)
[    0.087635] pid_max: default: 32768 minimum: 301
[    0.096966] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linea                                                                                                                                    r)
[    0.111300] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes,                                                                                                                                     linear)
[    0.129144] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE                                                                                                                                     build
[    0.148312] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, ma                                                                                                                                    x_idle_ns: 19112604462750000 ns
[    0.167697] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.181199] pinctrl core: initialized pinctrl subsystem
[    0.196585] NET: Registered protocol family 16
[    0.206135] thermal_sys: Registered thermal governor 'step_wise'
[    0.269567] clocksource: Switched to clocksource MIPS
[    0.292804] NET: Registered protocol family 2
[    0.301686] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear                                                                                                                                    )
[    0.316894] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096                                                                                                                                     bytes, linear)
[    0.333432] TCP established hash table entries: 1024 (order: 0, 4096 bytes, l                                                                                                                                    inear)
[    0.348472] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.362391] TCP: Hash tables configured (established 1024 bind 1024)
[    0.375114] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.387972] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.402036] NET: Registered protocol family 1
[    0.410592] PCI: CLS 0 bytes, default 32
[    0.426233] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.444662] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.456120] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORIT                                                                                                                                    Y) (c) 2001-2006 Red Hat, Inc.
[    0.477708] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 2                                                                                                                                    52)
[    0.494937] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.506197] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.517444] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.528730] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.544176] printk: console [ttyS0] disabled
[    0.552661] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud                                                                                                                                     = 2500000) is a 16550A
[    0.570473] printk: console [ttyS0] enabled
[    0.570473] printk: console [ttyS0] enabled
[    0.586955] printk: bootconsole [early0] disabled
[    0.586955] printk: bootconsole [early0] disabled
[    0.607076] spi-mt7621 10000b00.spi: sys_freq: 191666666
[    0.637500] spi-nor spi0.0: s25fl064k (8192 Kbytes)
[    0.647297] 4 fixed-partitions partitions found on MTD device spi0.0
[    0.659965] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitio                                                                                                                                    ns
[    0.674479] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitio                                                                                                                                    ns
[    0.689283] Creating 4 MTD partitions on "spi0.0":
[    0.698824] 0x000000000000-0x000000030000 : "u-boot"
[    0.711674] 0x000000030000-0x000000040000 : "u-boot-env"
[    0.723587] 0x000000040000-0x000000050000 : "factory"
[    0.736829] 0x000000050000-0x000000800000 : "firmware"
[    0.748508] 2 uimage-fw partitions found on MTD device firmware
[    0.760333] Creating 2 MTD partitions on "firmware":
[    0.770187] 0x000000000000-0x0000002192a7 : "kernel"
[    0.780019] mtd: partition "kernel" doesn't end on an erase/write block -- fo                                                                                                                                    rce read-only
[    0.799544] 0x0000002192a7-0x0000007b0000 : "rootfs"
[    0.809459] mtd: partition "rootfs" doesn't start on an erase/write block bou                                                                                                                                    ndary -- force read-only
[    0.828914] mtd: setting mtd5 (rootfs) as root device
[    0.840223] 1 squashfs-split partitions found on MTD device rootfs
[    0.852564] 0x0000005b0000-0x0000007b0000 : "rootfs_data"
[    0.917731] rt3050-esw 10110000.esw: mediatek esw at 0xb0110000, irq 25 initi                                                                                                                                    alized
[    0.933055] mtk_soc_eth 10100000.ethernet: generated random MAC address d6:e5                                                                                                                                    :9a:aa:18:12
[    0.950100] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0                                                                                                                                    100000, irq 5
[    0.968392] NET: Registered protocol family 10
[    0.982913] Segment Routing with IPv6
[    0.990425] NET: Registered protocol family 17
[    0.999312] bridge: filtering via arp/ip/ip6tables is no longer available by                                                                                                                                     default. Update your scripts to load br_netfilter if you need this.
[    1.025007] 8021q: 802.1Q VLAN Support v1.8
[    1.048997] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    1.069792] Freeing unused kernel memory: 1188K
[    1.078755] This architecture does not have kernel memory protection.
[    1.091548] Run /sbin/init as init process
[    2.232198] init: Console is alive
[    2.239544] init: - watchdog -
[    3.992334] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.185542] usbcore: registered new interface driver usbfs
[    4.196596] usbcore: registered new interface driver hub
[    4.207238] usbcore: registered new device driver usb
[    4.225324] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    4.241470] ehci-fsl: Freescale EHCI Host controller driver
[    4.254600] ehci-platform: EHCI generic platform driver
[    4.275464] phy phy-10120000.usbphy.0: remote usb device wakeup disabled
[    4.288753] phy phy-10120000.usbphy.0: UTMI 16bit 30MHz
[    4.299114] ehci-platform 101c0000.ehci: EHCI Host Controller
[    4.310530] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1
[    4.326379] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000
[    4.359595] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00
[    4.373252] hub 1-0:1.0: USB hub found
[    4.381713] hub 1-0:1.0: 1 port detected
[    4.395955] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    4.412356] ohci-platform: OHCI generic platform driver
[    4.423243] ohci-platform 101c1000.ohci: Generic Platform OHCI controller
[    4.436770] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 2
[    4.452469] rt3050-esw 10110000.esw: port 3 link up
[    4.462297] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000
[    4.544682] hub 2-0:1.0: USB hub found
[    4.553206] hub 2-0:1.0: 1 port detected
[    4.565489] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.590494] init: - preinit -
[    6.511903] random: jshn: uninitialized urandom read (4 bytes read)
[    6.639090] random: jshn: uninitialized urandom read (4 bytes read)
[    6.827808] random: jshn: uninitialized urandom read (4 bytes read)
[    7.617652] rt3050-esw 10110000.esw: port 3 link down
Press the [f] key and hit [enter] to enter failsafe mode
Press [    7.941739] random: procd: uninitialized urandom read (4 bytes read)
the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   11.138012] rt3050-esw 10110000.esw: port 3 link up
[   11.147751] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   11.160782] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[   12.402153] jffs2: notice: (403) jffs2_build_xattr_subsystem: complete building xattr subsystem, 22 of xdatum (19 unchecked, 2 orphan) and 29 of xref (2 dead, 0 orphan) found.
[   12.437776] mount_root: switching to jffs2 overlay
[   12.454688] overlayfs: upper fs does not support tmpfile.
[   12.475500] urandom-seed: Seeding with /etc/urandom.seed
[   12.705534] procd: - early -
[   12.712675] procd: - watchdog -
[   13.679798] procd: - watchdog -
[   13.688166] procd: - ubus -
[   13.847093] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.863315] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.876750] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.907000] procd: - init -
Please press Enter to activate this console.
[   15.316688] random: jshn: uninitialized urandom read (4 bytes read)
[   15.370919] random: ubusd: uninitialized urandom read (4 bytes read)
[   15.410775] random: ubus: uninitialized urandom read (4 bytes read)
[   16.032288] kmodloader: loading kernel modules from /etc/modules.d/*
[   16.423980] urngd: v1.0.2 started.
[   16.717728] Loading modules backported from Linux version v5.15.81-0-ge4a7232c917c
[   16.732809] Backport generated by backports.git v5.15.81-1-0-ge1867d55
[   16.773792] random: crng init done
[   16.780615] random: 22 urandom warning(s) missed due to ratelimiting
[   16.886422] mt76_wmac 10300000.wmac: ASIC revision: 76280001
[   18.052332] mt76_wmac 10300000.wmac: Firmware Version: 20151201
[   18.064141] mt76_wmac 10300000.wmac: Build Time: 20151201183641
[   18.089572] mt76_wmac 10300000.wmac: firmware init done
[   18.611416] PPP generic driver version 2.4.2
[   18.759117] NET: Registered protocol family 24
[   18.784834] kmodloader: done loading kernel modules from /etc/modules.d/*
[   32.347749] rt3050-esw 10110000.esw: port 3 link down
[   35.933673] rt3050-esw 10110000.esw: port 3 link up
[   42.587902] br-lan: port 1(eth0.1) entered blocking state
[   42.598703] br-lan: port 1(eth0.1) entered disabled state
[   42.609990] device eth0.1 entered promiscuous mode
[   42.619482] device eth0 entered promiscuous mode
[   42.703094] br-lan: port 1(eth0.1) entered blocking state
[   42.713868] br-lan: port 1(eth0.1) entered forwarding state
[   43.590090] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

BusyBox v1.35.0 (2023-01-03 00:24:21 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 22.03.3, r20028-43d71ad93e
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# cat /proc/cpuinfo
system type             : MediaTek MT7628AN ver:1 eco:2
machine                 : Mediatek MT7628AN evaluation board
processor               : 0
cpu model               : MIPS 24KEc V5.5
BogoMIPS                : 380.92
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp
Options implemented     : tlb 4kex 4k_cache prefetch mcheck ejtag llsc pindexed_dcache userlocal vint perf_cntr_intr_bit perf
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "factory"
mtd3: 007b0000 00010000 "firmware"
mtd4: 002192a7 00010000 "kernel"
mtd5: 00596d59 00010000 "rootfs"
mtd6: 00200000 00010000 "rootfs_data"
root@OpenWrt:/# lsmod
cfg80211              285840  6 mt76x0_common,mt76x2_common,mt76x02_lib,mt7603e,mt76,mac80211
cmac                    2464  0
compat                  1024  2 mac80211,cfg80211
crc_ccitt               1664  1 ppp_async
crc32c_generic          1376  1
drbg                   17536  0
ehci_fsl                3456  0
ehci_hcd               38064  2 ehci_platform,ehci_fsl
ehci_platform           4608  0
fsl_mph_dr_of           3632  0
gpio_button_hotplug     6592  0
hmac                    2496  0
jitterentropy_rng       7136  0
leds_gpio               3168  0
ledtrig_usbport         3024  0
libcrc32c                592  1 nf_tables
libsha256               8576  1 sha256_generic
mac80211              521824  6 mt76x0e,mt76x0_common,mt76x2e,mt76x02_lib,mt7603e,mt76
mt76                   44448  6 mt76x0e,mt76x0_common,mt76x2e,mt76x2_common,mt76x02_lib,mt7603e
mt7603e                38432  0
mt76x0_common          29504  1 mt76x0e
mt76x02_lib            40352  4 mt76x0e,mt76x0_common,mt76x2e,mt76x2_common
mt76x0e                 3680  0
mt76x2_common          11744  1 mt76x2e
mt76x2e                10048  0
nf_conntrack           69200  7 nft_redir,nft_nat,nft_masq,nft_flow_offload,nft_ct,nf_nat,nf_flow_table
nf_defrag_ipv4          1216  1 nf_conntrack
nf_defrag_ipv6          5584  1 nf_conntrack
nf_flow_table          22128  4 nf_flow_table_ipv6,nf_flow_table_ipv4,nf_flow_table_inet,nft_flow_offload
nf_flow_table_inet       576  0
nf_flow_table_ipv4       448  0
nf_flow_table_ipv6       448  0
nf_log_common           2976  2 nf_log_ipv6,nf_log_ipv4
nf_log_ipv4             3680  0
nf_log_ipv6             3968  0
nf_nat                 22384  4 nft_redir,nft_nat,nft_masq,nft_chain_nat
nf_reject_ipv4          2528  2 nft_reject_ipv4,nft_reject_inet
nf_reject_ipv6          2944  2 nft_reject_ipv6,nft_reject_inet
nf_tables             150992194 nft_fib_inet,nf_flow_table_ipv6,nf_flow_table_ipv4,nf_flow_table_inet,nft_reject_ipv6,nft_reject_ipv4,nft_reject_inet,nft_reject,nft_redir,nft_quota,nft_objref,nft_numgen,nft_nat,nft_masq,nft_log,nft_limit,nft_hash,nft_flow_offload,nft_fib_ipv6,nft_fib_ipv4,nft_fib,nft_ct,nft_counter,nft_chain_nat
nfnetlink               5184  1 nf_tables
nft_chain_nat            864  2
nft_counter             1792 16
nft_ct                  7680  3
nft_fib                 1408  3 nft_fib_inet,nft_fib_ipv6,nft_fib_ipv4
nft_fib_inet             672  0
nft_fib_ipv4            2080  1 nft_fib_inet
nft_fib_ipv6            2784  1 nft_fib_inet
nft_flow_offload        3488  0
nft_hash                2432  0
nft_limit               3584  5
nft_log                 1728  0
nft_masq                1824  1
nft_nat                 2592  0
nft_numgen              1504  0
nft_objref              1664  0
nft_quota               2016  0
nft_redir               1792  0
nft_reject              1152  3 nft_reject_ipv6,nft_reject_ipv4,nft_reject_inet
nft_reject_inet         1152  2
nft_reject_ipv4          672  0
nft_reject_ipv6          672  0
nls_base                4928  1 usbcore
ohci_hcd               25744  1 ohci_platform
ohci_platform           3424  0
ppp_async               7136  0
ppp_generic            24880  3 pppoe,ppp_async,pppox
pppoe                   9600  0
pppox                   1296  1 pppoe
seqiv                   1600  0
sha256_generic          2400  0
slhc                    5312  1 ppp_generic
usb_common              3184  3 ohci_hcd,ehci_platform,usbcore
usbcore               145760  6 ledtrig_usbport,ohci_platform,ohci_hcd,ehci_platform,ehci_fsl,ehci_hcd
root@OpenWrt:/# cat /etc/config/wireless

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/10300000.wmac'
        option channel '1'
        option band '2g'
        option htmode 'HT20'
        option disabled '1'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'OpenWrt'
        option encryption 'none'
2

For embedded devices like these, "based on" is not sufficient to just force flash another device's firmware image. Most vendors start out from the reference designs, but they almost always do change (important) aspects of it, so your device would need to be ported individually and get its own, bespoke DTS and image - something not helped by you having force-flashed a wrong image (as it might have already destroyed irrecoverable calibration data, stomped over the OEM partitioning and makes it impossible to check what the OEM might have done differently).

Furthermore your topic doesn't seem to be correct, at least my web searching suggests this to be a 'standard' plastic wireless router, not an evaluation board at all - there are quite major differences between the two in terms of debugging access, features/ specs and documentation.

Now you have two options, try to get back to the OEM firmware and hope (chances are that you already bricked it for good) that to fix things, so you can start with porting your device over to OpenWrt the 'proper' (and hard) way - if you can't get hold of that, you'd be up for an even harder way of finding out what is going wrong blindly, without being able to cross-reference the settings of the OEM firmware.
…unless you take the third route, of accepting your losses and consider it bricked.

3

Ah ok
Didn't know it was that complex for an already supported CPU
I already put in a request for the stock firmware so I guess I'll see where it goes (and I have the 2nd router arriving in a few days time)

It just doesn't feel bricked though? (Edit: I also have access to UBoot and can upload images to the router from there if anything happens - that's how I got OpenWrt on it in the first place, using TFTP recovery with a raspberry pi, as I originally tried the mt7620 firmware instead of the mt76x8 firmware)

The board looks very similar to an Archer C50 v1

Everything works apart from the 5GHz Wi-Fi (led status lights work, ethernet and wifi 2.4GHz networking works)

Though I do understand your concerns - so I'll just change the topic to reflect this then

4

Exact CPU text (what's printed on the CPU):
MEDIATEK MT7628AN 1509-AJCSL EAP0A928

Exact 5GHz chip text:
MEDIATEK MT7612EN 1526-BMAL ETP38B36

System reports: 64MB of Ram, 8MB of Flash

Once I get the 2nd router I'll upload the stock firmware bootlogs, and if I can, the full stock image

Board pictures:

20230414_080445
20230414_0804451920×3413 430 KB

20230414_080056
20230414_0800561920×1080 162 KB

20230414_075942
20230414_0759421920×1080 193 KB

CPU close up:

20230412_141453
20230412_1414531920×3413 640 KB

5

mt7621 is easier than many other targets, as the platform is rather uniform, but the details still matter - and there are many things that basically every vendor customizes (flash partitioning, GPIO- and LED assignments, ...).

6

Ok, so once I get the 2nd router, how do I get this info out of it?
For extra context it looks like the UART console gives you root access by default in their custom OpenWrt 14 (as the user was just root)
And it doesn't look like UBoot is protected either

7

You need to create a dts that accurately describes the hardware in your dev board.

You can get a lot of info from the boot log, but v14 is so old it’s not going to be a huge help.

Really the vendor should be providing the required details as this is a development unit. Stuff like memory ranges, flash specs, gpio and device registers.

8

Oh it's not a dev unit - i misidentified it, the OpenWrt dev board image worked on the router but it's just a consumer router (but it is similar).
The manufacturer doesn't feature it on their website and they haven't replied to my email yet, might need to send it again but translated to chinese as they are a chinese company.
But I should be able to extract all the info from the 2nd router

9

So I got the second router:
Bootlog:

Restarting system.
[04030C0C][04030D07]
DDR Calibration DQS reg = 00008987


U-Boot 1.1.3 (Jun 15 2016 - 14:46:50)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb0000
******************************
Software System Reset Occurred
******************************
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 4.3.0.1
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Jun 15 2016  Time:14:46:50
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 575 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.                                                                                                                                                         0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   OpenWrt Linux-3.10.14
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1012713 Bytes = 989 kB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...


LINUX started...

 THIS IS ASIC

SDK 5.0.S.0
Linux version 3.10.14 (lgh@server) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #15 Tue Sep 6 02:10:53 EDT 2016

 The CPU feqenuce set to 575 MHz
CPU0 revision is: 00019655 (MIPS 24KEc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone ranges:
  Normal   [mem 0x00000000-0x03ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x03ffffff]
Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 rootfstype=squashfs,jffs2
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Writing ErrCtl register=000794c0
Readback ErrCtl register=000794c0
Memory: 61732k/65536k available (2337k kernel code, 3760k reserved, 434k data, 172k init, 0k highmem)
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 382.46 BogoMIPS (lpj=764928)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
RALINK_GPIOMODE = 54050404
RALINK_GPIOMODE = 54040404
***** Xtal 25MHz *****
start PCIe register access
RALINK_RSTCTRL = 2400000
RALINK_CLKCFG1 = fdbfffc0

*************** MT7628 PCIe RC mode *************
PCIE0 enabled
Port 0 N_FTS = 1b105000
init_rt2880pci done
bio: create slab <bio-0> at 0
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
pci_bus 0000:00: root bus resource [io  0x10160000-0x1016ffff]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
pci 0000:00:00.0: PCI bridge to [bus 01]
pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
BAR0 at slot 0 = 0
bus=0x0, slot = 0x0
res[0]->start = 0
res[0]->end = 0
res[1]->start = 20200000
res[1]->end = 2020ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0
res[0]->start = 20000000
res[0]->end = 200fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
Switching to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) (SUMMARY)  (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 120
io scheduler noop registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
Ralink gpio driver initialized
flash manufacture id: ef, device id 40 17
W25Q64BV(ef 40170000) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 5 MTD partitions on "raspi":
0x000000000000-0x000000800000 : "ALL"
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config"
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x000000800000 : "firmware"
0x000000147429-0x000000800000 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs_data" created automatically, ofs=0x430000, len=0x3d0000
0x000000430000-0x000000800000 : "rootfs_data"
rdm_major = 253
GMAC1_MAC_ADRH -- : 0x0000f884
GMAC1_MAC_ADRL -- : 0x7900b502
Ralink APSoC Ethernet Driver Initilization. v3.1  512 rx/tx descriptors allocated, mtu = 1500!
GMAC1_MAC_ADRH -- : 0x0000f884
GMAC1_MAC_ADRL -- : 0x7900b502
PROC INIT OK!
gre: GRE over IPv4 demultiplexor driver
TCP: cubic registered
NET: Registered protocol family 17
8021q: 802.1Q VLAN Support v1.8
registered taskstats version 1
VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
Freeing unused kernel memory: 172K (802b5000 - 802e0000)
procd: Console is alive
procd: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
jffs2 is ready
No jffs2 marker was found
jffs2: notice: (197) jffs2_build_xattr_subsystem: complete building xattr subsystem, 19 of xdatum (1 unchecked, 18 orphan) and 37 of xref (0 dead, 30 orphan) found.
switching to overlay
procd: - early -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
ip_gre: GRE over IPv4 tunneling driver
u32 classifier
    input device check on
    Actions configured
Mirror/redirect action on
Failed to load ipt action
fuse init (API version 7.22)
ip_tables: (C) 2000-2006 Netfilter Core Team
Type=Linux
nf_conntrack version 0.5.0 (967 buckets, 3868 max)
Ralink APSoC Hardware Watchdog Timer
xt_time: kernel timezone is -0000
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
hostinfo.ko installed
FFFFFFF8:FFFFFF84:79: 0:FFFFFFB5: 2
Raeth v3.1 (Tasklet,SkbRecycle)

phy_tx_ring = 0x02c30000, tx_ring = 0xa2c30000

phy_rx_ring0 = 0x02c32000, rx_ring0 = 0xa2c32000
GMAC1_MAC_ADRH -- : 0x0000f884
GMAC1_MAC_ADRL -- : 0x7900b502
RT305x_ESW: Link Status Changed
device eth0.1 entered promiscuous mode
device eth0 entered promiscuous mode
br-lan: port 1(eth0.1) entered forwarding state
br-lan: port 1(eth0.1) entered forwarding state
register rt2860


=== pAd = c0881000, size = 2022784 ===

<-- RTMPAllocTxRxRingMemory, Status=0
<-- RTMPAllocAdapterBlock, Status=0
pAd->CSRBaseAddress =0xc0780000, csr_addr=0xc0780000!
device_id =0x7662
==>rlt_wlan_chip_onoff(): OnOff:1, Reset= 1, pAd->WlanFunCtrl:0x0, Reg-WlanFunCtrl=0x20a
E2pAccessMode=2
cfg_mode=14
cfg_mode=14
wmode_band_equal(): Band Not Equal!
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
default ApCliAPSDCapable[0]=0
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5
NVM is FLASH mode (pAd->flash_offset = 0x48000)
get_dev_name_prefix(): dev_idx = 1, dev_name_prefix=rai
build time =
20141115060606a
rom patch for E3 IC

platform =
ALPS
hw/sw version =
▒▒
patch version =

FW Version:0.0.00 Build:1
Build Time:201410061140____
fw for E3 IC
RX[0] DESC a2e09000 size = 4096
RX[1] DESC a2e0a000 size = 4096
E2pAccessMode=2
cfg_mode=14
cfg_mode=14
wmode_band_equal(): Band Not Equal!
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
default ApCliAPSDCapable[0]=0
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 49
get_chl_grp:illegal channel (167)
get_chl_grp:illegal channel (167)
get_chl_grp:illegal channel (169)
get_chl_grp:illegal channel (169)
get_chl_grp:illegal channel (171)
get_chl_grp:illegal channel (171)
get_chl_grp:illegal channel (173)
get_chl_grp:illegal channel (173)
Country Region from e2p = ffff
mt76x2_read_temp_info_from_eeprom:: is_temp_tx_alc=0, temp_tx_alc_enable=0
mt76x2_read_tx_alc_info_from_eeprom:: is_ePA_mode=1, ePA_type=0
mt76x2_read_tx_alc_info_from_eeprom:: [5G band] high_temp_slope=15, low_temp_slope=9
mt76x2_read_tx_alc_info_from_eeprom:: [2G band] high_temp_slope=13, low_temp_slope=16
mt76x2_read_tx_alc_info_from_eeprom:: [5G band] tc_lower_bound=-7, tc_upper_bound=4
mt76x2_read_tx_alc_info_from_eeprom:: [2G band] tc_lower_bound=-7, tc_upper_bound=5
br-lan: port 1(eth0.1) entered forwarding state
mt76x2_get_external_lna_gain::LNA type=0x0, BLNAGain=0xffffff8c, ALNAGain0=0xffffff89, ALNAGain1=0xffffff8a, ALNAGain2=0xffffff8a
2. Phy Mode = 49
3. Phy Mode = 49
andes_pci_fw_init
0x1300 = 00073200
AntCfgInit: primary/secondary ant 0/1
andes_load_cr:cr_type(2)
ChipStructAssign(): MT76x2 hook !
RTMPSetPhyMode: channel is out of range, use first channel=0
MCS Set = ff ff 00 00 01
get_chl_grp:illegal channel (169)
get_chl_grp:illegal channel (169)
get_low_mid_hi_index:illegal channel(169)
get_chl_grp:illegal channel (169)
get_chl_grp:illegal channel (169)
get_low_mid_hi_index:illegal channel(169)
get_chl_grp:illegal channel (173)
get_chl_grp:illegal channel (173)
get_low_mid_hi_index:illegal channel(173)
get_chl_grp:illegal channel (173)
get_chl_grp:illegal channel (173)
get_low_mid_hi_index:illegal channel(173)
mt76x2_bbp_adjust():rf_bw=2, ext_ch=1, PrimCh=52, HT-CentCh=54, VHT-CentCh=58
APStartUp(): AP Set CentralFreq at 58(Prim=52, HT-CentCh=54, VHT-CentCh=58, BBP_BW=2)
mt76x2_calibration(channel = 58)
Main bssid = f8:84:79:00:b5:16
mt76x2_reinit_agc_gain:original agc_vga0 = 0x4e, agc_vga1 = 0x4e
mt76x2_reinit_agc_gain:updated agc_vga0 = 0x4e, agc_vga1 = 0x4e
mt76x2_reinit_hi_lna_gain:original hi_lna0 = 0x30, hi_lna1 = 0x30
mt76x2_reinit_hi_lna_gain:updated hi_lna0 = 0x30, hi_lna1 = 0x30
original vga value(chain0) = 4e
original vga value(chain1) = 4e
<==== rt28xx_init, Status=0
get_dev_name_prefix(): dev_idx = 1, dev_name_prefix=apclii
RTMPDrvOpen(1):Check if PDMA is idle!
RTMPDrvOpen(2):Check if PDMA is idle!
procd: - init complete -
device rai0 entered promiscuous mode
br-lan: port 2(rai0) entered forwarding state
br-lan: port 2(rai0) entered forwarding state


=== pAd = c0db9000, size = 1235064 ===

<-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
<-- RTMPAllocAdapterBlock, Status=0
RtmpChipOpsHook(492): Not support for HIF_MT yet!
mt7628_init()-->
mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
e2.bin mt7628_init(1135)::(2), pChipCap->fw_len(63888)
mt_bcn_buf_init(218): Not support for HIF_MT yet!
<--mt7628_init()
TX_BCN DESC a292f000 size = 320
RX[0] DESC a2932000 size = 1024
RX[1] DESC a2933000 size = 1024
E2pAccessMode=0
cfg_mode=9
cfg_mode=9
wmode_band_equal(): Band Equal!
AndesSendCmdMsg: Could not send in band command due to diable fRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
default ApCliAPSDCapable[0]=0
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
RTMPSetDefaultChannel() : default channel to 1
load fw image from fw_header_image
AndesMTLoadFwMethod1(2182)::pChipCap->fw_len(63888)
FW Version:20151201
FW Build Date:20151201183641
CmdAddressLenReq:(ret = 0)
CmdFwStartReq: override = 1, address = 1048576
CmdStartDLRsp: WiFI FW Download Success
MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
efuse_probe: efuse = 10000002
RtmpChipOpsEepromHook::e2p_type=0, inf_Type=4
RtmpEepromGetDefault::e2p_dafault=2
RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
NVM is FLASH mode
1. Phy Mode = 14
Country Region from e2p = ffff
tssi_1_target_pwr_g_band = 34
2. Phy Mode = 14
3. Phy Mode = 14
NICInitPwrPinCfg(11): Not support for HIF_MT yet!
NICInitializeAsic(651): Not support rtmp_mac_sys_reset () for HIF_MT yet!
mt_mac_init()-->
MtAsicInitMac()-->
mt7628_init_mac_cr()-->
MtAsicSetMacMaxLen(1276): Set the Max RxPktLen=1024!
<--mt_mac_init()
        WTBL Segment 1 info:
br-lan: port 2(rai0) entered forwarding state
                MemBaseAddr/FID:0x28000/0
                EntrySize/Cnt:32/128
        WTBL Segment 2 info:
                MemBaseAddr/FID:0x40000/0
                EntrySize/Cnt:64/128
        WTBL Segment 3 info:
                MemBaseAddr/FID:0x42000/64
                EntrySize/Cnt:64/128
        WTBL Segment 4 info:
                MemBaseAddr/FID:0x44000/128
                EntrySize/Cnt:32/128
AntCfgInit(2947): Not support for HIF_MT yet!
MCS Set = ff ff 00 00 01
MtAsicSetChBusyStat(861): Not support for HIF_MT yet!
CmdSlotTimeSet:(ret = 0)
[PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0
MtAsicSetRalinkBurstMode(3047): Not support for HIF_MT yet!
MtAsicSetPiggyBack(796): Not support for HIF_MT yet!
reload DPD from flash , 0x9F = [c600] doReload bit7[0]
CmdLoadDPDDataFromFlash: Channel = 13, DoReload = 0
MtAsicSetTxPreamble(3026): Not support for HIF_MT yet!
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
Main bssid = f8:84:79:00:b5:02
<==== rt28xx_init, Status=0
@@@ ed_monitor_exit : ===>
@@@ ed_monitor_exit : <===
mt7628_set_ed_cca: TURN OFF EDCCA  mac 0x10618 = 0xd7083f0f, EDCCA_Status=0
WiFi Startup Cost (ra0): 3.972s
device ra0 entered promiscuous mode
br-lan: port 3(ra0) entered forwarding state
br-lan: port 3(ra0) entered forwarding state
br-lan: port 3(ra0) entered forwarding state

cat /proc/mtd

[root@OpenWrt /]# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00800000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 007b0000 00010000 "firmware"
mtd5: 006b8bd7 00010000 "rootfs"
mtd6: 003d0000 00010000 "rootfs_data"

I have been looking at either finding a dts file on the router or creating one, but I don't know how to do either.

I found this program, but the problem is loading it onto the router as opkg looks for a packages.gz in a location on the openwrt website that doesn't exist anymore, so i can't run "opkg update && opkg install git git-http" and then download the program using git.

10

Just wget it ?

11

I've never used wget before but I'm pretty sure I'm using it correctly, though it's not working?

[root@OpenWrt /]# ping raw.githubusercontent.com
PING raw.githubusercontent.com (185.199.111.133): 56 data bytes
64 bytes from 185.199.111.133: seq=0 ttl=60 time=5.270 ms
64 bytes from 185.199.111.133: seq=1 ttl=60 time=4.819 ms
^C
--- raw.githubusercontent.com ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 4.819/5.044/5.270 ms
[root@OpenWrt /]# wget -OL -O split-appended-dtb.file raw.githubusercontent.com/MoetaYuko/split-appended-dtb/master/split-appended-dtb
Connecting to raw.githubusercontent.com (185.199.110.133:80)
wget: not an http or ftp url: https://raw.githubusercontent.com/MoetaYuko/split-appended-dtb/master/split-appended-dtb
[root@OpenWrt /]# wget -OL raw.githubusercontent.com/MoetaYuko/split-appended-dtb/master/split-appended-dtb >> split-appended-dtb.file
Connecting to raw.githubusercontent.com (185.199.109.133:80)
wget: not an http or ftp url: https://raw.githubusercontent.com/MoetaYuko/split-appended-dtb/master/split-appended-dtb
[root@OpenWrt /]# wget -OL https://codeload.github.com/MoetaYuko/split-appended-dtb/zip/refs/heads/master >> master.zip
wget: not an http or ftp url: https://codeload.github.com/MoetaYuko/split-appended-dtb/zip/refs/heads/master
12

Just use the whole URL for the raw file, c&p it from the browser.

13

Yeah I'm not going to use that program anymore, loaded it onto the router using ftp, but then gcc isn't installed
As mt7628 14.07 barrier breaker doesn't exist anymore, I can't install and use gcc
Tried to use one of the other versions (mt7620n, mt7630a) in the 14.07 barrier breaker archive but that didn't work.

Going to look for the proper way to make a dts file

Edit:
I found this spec pdf and I must admit that I'm way over my head - that is a long pdf file, I am inexperienced and don't have much free time to spend on this.
Is there any way to copy the contents of the entire flash chip and upload it here?

14

You should start with something as close as possible to your device. Primarily start with another device with a similar SoC (the main CPU chipset).
So you want to look into MediaTek MT7628_MP boards/devices.

And then you want to confirm various addresses from the DT to your boot log.
i.e. the RAM amount and location (64MB @ 0x0000), and the serial ports 16550 @ 0x10000d00 (irq 21), and another 16550 @ 0x10000c00 (irq 20).

And then your flash memory and partitions: W25Q64BV of 8192KBytes size.. and you can populate the factory partitions layout.
That should get you something bootable.
Then you'd need to deal with any additional peripherals on the PCI bus..

15

Here's a reference board commit

You should drop out the LEDs / Buttons unless you're confident of them first up.
Ideally you get to a linux console without something panicking. Then you can do some gpio checks to see which inputs are buttons (and add them into DT). Then tracing for LEDs (or if you feel lucky just turn on an output and drive it high / low.. see if LED turns on)

16

Hi, I know it's been over a year (I put off working on this as it seemed daunting) but I found a bit of time to work on this over the weekend and I've made some progress - won't be able to work on this again for over a month.

I'm probably doing something wrong as whenever I try and run the new image on the router I get the error "Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover"
However I don't know what's wrong

serial out:

[04050C0D][04050C0C]
DDR Calibration DQS reg = 00008889


U-Boot 1.1.3 (Jun 15 2016 - 14:46:50)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb0000
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
============================================ 
Ralink UBoot Version: 4.3.0.1
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Jun 15 2016  Time:14:46:50
============================================ 
icache ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 575 MHZ #### 
 estimate memory size =628 PHY!!!!!!
Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via F  4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFT 4 
You choosed 4

 0 

   
4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Jun 15 2016 - 14:46:50)
MT7628 # tftpboot

 netboot_common, argc= 1 

 NetTxPacket = 0x83FE4A40 

 KSEG1ADDR(NetTxPacket) = 0xA3FE4A40 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!! 
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'test.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: checksum bad
Got ARP REPLY, set server/gtwy eth addr (d0:c0:bf:42:28:01)
Got it
#checksum bad
################################################################
	 #################################################################
	 #################################################################
	 ##############################Got ARP REQUEST, return our IP
###################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ######################
done
Bytes transferred = 5435871 (52f1df hex)
NetBootFileXferSize= 0052f1df
MT7628 # bootm
## Booting image at 80100000 ...
   Image Name:   MIPS OpenWrt Linux-5.15.150
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    5435807 Bytes =  5.2 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover

Files:
mt7628an_yj_lw928ag.dts

// SPDX-License-Identifier: GPL-2.0-or-later

#include "mt7628an.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>

/ {
	compatible = "yj-link,LW928AG", "mediatek,mt7628an-soc";
	model = "YJ-LW928AG";

	chosen {
		bootargs = "console=ttyS0,115200";
	};
};

&spi0 {
	status = "okay";

	flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <40000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "Bootloader";
				reg = <0x0 0x30000>;
				read-only;
			};

			partition@30000 {
				label = "Config";
				reg = <0x30000 0x10000>;
				read-only;
			};

			partition@40000 {
				label = "Factory";
				reg = <0x40000 0x10000>;
				read-only;
			};

			partition@50000 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x50000 0x7b0000>;
			};

			bdinfo: partition@800000 {
				label = "rootfs";
				reg = <0x800000 0x6b8bd7>;
				read-only;
			};

			partition@738BD7 {
				label = "rootfs_data";
				reg = <0xff0000 0x3d0000>;
				read-only;
			};
		};
	};
};

&state_default {
	gpio {
		groups = "jtag", "wdt";
		function = "gpio";
	};
};

&ethernet {
	nvmem-cells = <&macaddr_bdinfo_9>;
	nvmem-cell-names = "mac-address";
};

&wmac {
	status = "okay";
};

&bdinfo {
	compatible = "nvmem-cells";
	#address-cells = <1>;
	#size-cells = <1>;

	macaddr_bdinfo_9: macaddr@9 {
		reg = <0x9 0x6>;
	};
};

01_leds

yj-link,LW928AG|\

02_networks

yj-link,LW928AG|\

mt76x8.mk

define Device/yj_lw928ag
  IMAGE_SIZE := 15360k
  DEVICE_VENDOR := YJ_Link
  DEVICE_MODEL := LW928SG
  DEVICE_PACKAGES:= kmod-usb2 kmod-usb-ohci
endef
TARGET_DEVICES += yj_lw928ag
17

Issue fixed (LZMA error 1 fix)

The only change in the files is that the baudrate of the serial console in mt7628an_yj_lw928ag.dts is now 57600.
The partitions probably need changing as they don't seem right.
I don't know how to figure out the led and button config and change the Ethernet order (they appear reversed in luci, the furthest from the wan port is the wan in software, and the wan is port 4 of the switch ethernet).

Bootlog:

[04020C0E][04020D07]
DDR Calibration DQS reg = 00008888


U-Boot 1.1.3 (Jun 15 2016 - 14:46:50)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb0000
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
*** Warning - bad CRC, using default environment

============================================ 
Ralink UBoot Version: 4.3.0.1
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Jun 15 2016  Time:14:46:50
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 575 MHZ #### 
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP. 
 4 
You choosed 1

 0 

   
1: System Load Linux to SDRAM via TFTP. 
 Please Input new ones /or Ctrl-C to discard
        Input device IP (10.10.10.123) ==:10.10.10.123
        Input server IP (10.10.10.3) ==:10.10.10.3
        Input Linux Kernel filename () ==:test.bin

 netboot_common, argc= 3 

 NetTxPacket = 0x83FE4A40 

 KSEG1ADDR(NetTxPacket) = 0xA3FE4A40 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!! 
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'test.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (d0:c0:bf:42:28:01)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################Got ARP REQUEST, return our IP

         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ####################
done
Bytes transferred = 5757925 (57dbe5 hex)
NetBootFileXferSize= 0057dbe5
Erasing SPI Flash...
.
Writing to SPI Flash...
.
done
Automatic boot of image at addr 0x80A00000 ...
## Booting image at 80a00000 ...
   Image Name:   MIPS OpenWrt Linux-5.15.150
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    5757861 Bytes =  5.5 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 5.15.150 (osboxes@osboxes) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23809-234f1a2efa) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Fri Mar 22 22:09:42 2024
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is YJ-LW928AG
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=0007edee
[    0.000000] Readback ErrCtl register=0007edee
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 52704K/65536K available (5553K kernel code, 600K rwdata, 1196K rodata, 4544K init, 207K bss, 12832K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] intc: using register map from devicetree
[    0.000000] CPU Clock: 575MHz
[    0.000000] timer_probe: no matching timers found
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6647862422 ns
[    0.000002] sched_clock: 32 bits at 287MHz, resolution 3ns, wraps every 7469508094ns
[    0.015460] Calibrating delay loop... 380.92 BogoMIPS (lpj=1904640)
[    0.087614] pid_max: default: 32768 minimum: 301
[    0.097912] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.112269] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.136573] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.155978] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.169612] pinctrl core: initialized pinctrl subsystem
[    0.181923] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.198084] rt2880-pinmux pinctrl: invalid group "jtag" for function "gpio"
[    0.229863] clocksource: Switched to clocksource MIPS
[    0.241600] NET: Registered PF_INET protocol family
[    0.251494] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.266656] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.283335] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.298569] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.313717] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.327645] TCP: Hash tables configured (established 1024 bind 1024)
[    0.340384] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.353257] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.367433] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.378625] PCI: CLS 0 bytes, default 32
[    1.149077] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    1.168930] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.180423] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.203631] mt7621_gpio 10000600.gpio: registering 32 gpios
[    1.215005] mt7621_gpio 10000600.gpio: registering 32 gpios
[    1.226424] mt7621_gpio 10000600.gpio: registering 32 gpios
[    1.238033] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    1.251971] printk: console [ttyS0] disabled
[    1.260458] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
[    1.278279] printk: console [ttyS0] enabled
[    1.278279] printk: console [ttyS0] enabled
[    1.294753] printk: bootconsole [early0] disabled
[    1.294753] printk: bootconsole [early0] disabled
[    1.315109] spi-mt7621 10000b00.spi: sys_freq: 191666666
[    1.334260] spi-nor spi0.0: s25fl064k (8192 Kbytes)
[    1.344137] 6 fixed-partitions partitions found on MTD device spi0.0
[    1.356787] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    1.371329] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    1.386211] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    1.400774] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    1.415792] Creating 6 MTD partitions on "spi0.0":
[    1.425354] 0x000000000000-0x000000030000 : "Bootloader"
[    1.437913] 0x000000030000-0x000000040000 : "Config"
[    1.449343] 0x000000040000-0x000000050000 : "Factory"
[    1.461155] 0x000000050000-0x000000800000 : "firmware"
[    1.472927] 2 uimage-fw partitions found on MTD device firmware
[    1.484763] Creating 2 MTD partitions on "firmware":
[    1.494614] 0x000000000000-0x0000000f7429 : "kernel"
[    1.504452] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
[    1.522525] 0x0000000f7429-0x0000007b0000 : "rootfs"
[    1.532456] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[    1.552040] mtd: setting mtd5 (rootfs) as root device
[    1.562357] 1 squashfs-split partitions found on MTD device rootfs
[    1.574657] 0x0000003e0000-0x0000007b0000 : "rootfs_data"
[    1.586803] 0x000000800000-0x000000eb8bd7 : "rootfs"
[    1.596745] mtd: partition "rootfs" is out of reach -- disabled
[    1.610225] 0x000000ff0000-0x0000013c0000 : "rootfs_data"
[    1.620996] mtd: partition "rootfs_data" is out of reach -- disabled
[    1.659002] rt3050-esw 10110000.esw: mediatek esw at 0xb0110000, irq 25 initialized
[    1.674416] mtk_soc_eth 10100000.ethernet: generated random MAC address 56:8c:9f:3e:05:94
[    1.691456] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    1.710637] NET: Registered PF_INET6 protocol family
[    2.359015] Segment Routing with IPv6
[    2.366517] In-situ OAM (IOAM) with IPv6
[    2.374532] NET: Registered PF_PACKET protocol family
[    2.384730] 8021q: 802.1Q VLAN Support v1.8
[    5.048254] rt3050-esw 10110000.esw: port 3 link up
[    8.171840] Freeing unused kernel image (initmem) memory: 4544K
[    8.183623] This architecture does not have kernel memory protection.
[    8.196397] Run /init as init process
[    8.967757] init: Console is alive
[    8.975313] init: - watchdog -
[    9.011675] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    9.043601] usbcore: registered new interface driver usbfs
[    9.054664] usbcore: registered new interface driver hub
[    9.065382] usbcore: registered new device driver usb
[    9.083528] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    9.099719] fsl-ehci: Freescale EHCI Host controller driver
[    9.112993] ehci-platform: EHCI generic platform driver
[    9.133940] phy phy-10120000.usbphy.0: remote usb device wakeup disabled
[    9.147250] phy phy-10120000.usbphy.0: UTMI 16bit 30MHz
[    9.157604] ehci-platform 101c0000.ehci: EHCI Host Controller
[    9.169073] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1
[    9.184934] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000
[    9.219887] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00
[    9.233646] hub 1-0:1.0: USB hub found
[    9.242129] hub 1-0:1.0: 1 port detected
[    9.258802] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    9.272955] ohci-platform: OHCI generic platform driver
[    9.283897] ohci-platform 101c1000.ohci: Generic Platform OHCI controller
[    9.297445] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 2
[    9.313328] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000
[    9.395098] hub 2-0:1.0: USB hub found
[    9.403672] hub 2-0:1.0: 1 port detected
[    9.418460] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    9.443536] init: - preinit -
[    9.802410] random: jshn: uninitialized urandom read (4 bytes read)
[    9.933582] random: jshn: uninitialized urandom read (4 bytes read)
[   10.136134] random: jshn: uninitialized urandom read (4 bytes read)
[   10.457469] rt3050-esw 10110000.esw: port 3 link down
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   12.803705] procd: - early -
[   12.809834] procd: - watchdog -
[   13.502789] procd: - watchdog -
[   13.509495] procd: - ubus -
[   13.526593] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.565780] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.579143] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.596527] procd: - init -
Please press Enter to activate this console.
[   13.799694] rt3050-esw 10110000.esw: port 3 link up
[   14.465828] kmodloader: loading kernel modules from /etc/modules.d/*
[   15.073320] Loading modules backported from Linux version v6.1.24-0-g0102425ac76b
[   15.088243] Backport generated by backports.git v5.15.92-1-44-gd6ea70fafd36
[   15.284206] mt76_wmac 10300000.wmac: ASIC revision: 76280001
[   15.296587] mt76_wmac 10300000.wmac: Invalid MAC address, using random address 0a:04:a9:14:ca:ec
[   16.361371] mt76_wmac 10300000.wmac: Firmware Version: 20151201
[   16.373185] mt76_wmac 10300000.wmac: Build Time: 20151201183641
[   16.449875] mt76_wmac 10300000.wmac: firmware init done
[   16.913210] PPP generic driver version 2.4.2
[   16.961097] NET: Registered PF_PPPOX protocol family
[   17.050348] kmodloader: done loading kernel modules from /etc/modules.d/*
[   17.455315] urngd: v1.0.2 started.
[   17.668999] random: jshn: uninitialized urandom read (4 bytes read)
[   18.208237] random: jshn: uninitialized urandom read (4 bytes read)
[   18.997948] random: jshn: uninitialized urandom read (4 bytes read)
[   19.247632] random: jshn: uninitialized urandom read (4 bytes read)
[   21.266201] random: crng init done
[   21.273063] random: 27 urandom warning(s) missed due to ratelimiting
[   35.144776] rt3050-esw 10110000.esw: port 3 link down
[   38.487245] rt3050-esw 10110000.esw: port 3 link up
[   44.248466] br-lan: port 1(eth0.2) entered blocking state
[   44.259286] br-lan: port 1(eth0.2) entered disabled state
[   44.270419] device eth0.2 entered promiscuous mode
[   44.279968] device eth0 entered promiscuous mode
[   44.356050] br-lan: port 1(eth0.2) entered blocking state
[   44.366846] br-lan: port 1(eth0.2) entered forwarding state
[   45.270588] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready



BusyBox v1.36.1 (2024-03-22 22:09:42 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 23.05.3, r23809-234f1a2efa
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
18

Last update for the month, I think I'm close to fixing the partitions.
I used this guide to find the gpio values for all the buttons, although it didn't work for the leds.
Tried to add the pci of the 5GHz chip to the dts, it compiled and booted but didn't find the chip.

To do:
Fully fix partitions
Find gpio values of leds
Layout ethernet ports correctly
Find where the MAC address and other calibration data are stored on the flash
Get the pci 5GHz chip recognised

And other things that I'm probably forgetting right now or don't know about yet.