Add support for Beeline SmartBox Giga

For Developers
1

Beeline SmartBox GIGA is a wireless WiFi 5 router manufactured by Sercomm and widely distributed by Beeline ISP.

Device specification

SoC Type: MediaTek MT7621AT
RAM: 256 MiB, Nanya NT5CC128M16JR-EK
Flash: 128 MiB, Macronix MX30LF1G18AC
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7613BE): a/n/ac, 2x2
Ethernet: 3 ports - 2xGbE (WAN, LAN1), 1xFE (LAN2)
USB ports: 1xUSB3.0
Button: 1 button (reset)
Stock bootloader: U-Boot
PCB ID: DBE00B-1.6MM
Power: 12 VDC, 1.5 A
Connector type: barrel
Bootloader: U-Boot

Device commit

UART 
  VVV
+-----+
| GND |
+-----+
| TX  |
+-----+
|     | - Don't connect this
+-----+
| RX  |
+-----+

UART
UART800×600 120 KB

U-Boot environment

Environment default values:

U-Boot 1.1.3 (Aug 13 2019 - 15:27:14)
MT7621 # printenv
bootcmd=tftp
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
ipaddr=10.10.10.123
serverip=10.10.10.3
BootType=3
bootdelay=2
stdin=serial
stdout=serial
stderr=serial

Environment size: 160/4092 bytes

Boot type:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
default: 3

Example from U-Boot:

setenv BootType 1
saveenv
OEM Layout 
+-------+---------------------+--------------------------------+
| mtd0  | 0x0000000-0x0100000 | Boot Loader                    |
+-------+---------------------+--------------------------------+
| mtd1  | 0x0100000-0x0200000 | dynamic partition map          |
+-------+---------------------+--------------------------------+
| mtd2  | 0x0200000-0x0300000 | Factory                        |
+-------+---------------------+--------------------------------+
| mtd3  | 0x0300000-0x0400000 | Boot Flag                      |
+-------+---------------------+--------------------------------+
| mtd4  | 0x0400000-0x0a00000 | Kernel 1                       |
+-------+---------------------+--------------------------------+
| mtd5  | 0x0a00000-0x1000000 | Kernel 2                       |
+-------+---------------------+--------------------------------+
| mtd6  | 0x1000000-0x2800000 | File System 1                  |
+-------+---------------------+--------------------------------+
| mtd7  | 0x2800000-0x4000000 | File System 2                  |
+-------+---------------------+--------------------------------+
| mtd8  | 0x4000000-0x4800000 | Configuration/log              |
+-------+---------------------+--------------------------------+
| mtd9  | 0x4800000-0x5400000 | application tmp buffer (Ftool) |
+-------+---------------------+--------------------------------+
| mtd10 | 0x5400000-0x7c00000 | container                      |
+-------+---------------------+--------------------------------+
| mtd11 | 0x7c00000-0x7f80000 | bad block reserved             |
+-------+---------------------+--------------------------------+
Known issues

Sercomm NAND-specific:

MT7613BE-specific:

Credits

@MaxS0niX - Support, new ideas and working under Beeline SmartBox Turbo+ OpenWrt support
@kar200 - Sercomm header calculaton algorithm, S3 loader compilation settings
@guys from 4pda
@guys form Telegram OpenWrt chat, SmartBox Giga chat

1 Like
2

Stock FW

Stock FW

2.0.01
1.0.07

Decryption of Stock FW images

sercomm_fwutils

Flash Map Information

U-Boot uses this data at least to find the kernel. Can be edited manually (part_map 0x800, format: mtd_num - mtd_offset - mtd_size, all 4 bytes, reverse byte order).

U-Boot restores mtd1 aumomatically if you erase it.

******************************************
    Uboot StandAlone Entry
******************************************
********************************************
Flash Map Information
********************************************
Partition           Logic_Offs  Logic_size  Real_Offs   Real_Size
u-boot              0           100000      0           100000
part_map            100000      100000      100000      100000
factory-data        200000      100000      200000      120000
dual-flag           300000      100000      320000      100000
uImage1             400000      600000      420000      600000
uImage2             a00000      600000      a20000      600000
rootfs1             1000000     1800000     1020000     1800000
rootfs2             2800000     1800000     2820000     1800000
config/log          4000000     800000      4020000     800000
app-tmp             4800000     c00000      4820000     c00000
free-space          5400000     2800000     5420000     2800000
badblock-reserve    7c00000     400000      7c20000     360000
-----------------------------------------
Sercomm Private entries 
Sercomm Private:

Name                Real_Offs   Length
calibration1        200000      1000
calibration2        208000      1000
mac                 221000      6
CSN                 221010      c
language ID         221040      4
Domain ID           221050      4
PCBASN              221060      c
PIN                 221070      8
SSID                221080      20
Passphrase          2210a0      40
boot-version        6ffc3       2
boot-pid            6ffba       46
boot_flag           320000      8
upgrade-flag        320010      8
Boot log 
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.06.08 20:05:38 =~=~=~=~=~=~=~=~=~=~=~=
 

===================================================================

     		MT7621   stage1 code Mar 12 2015 14:42:52 (ASIC)

     		CPU=50000000 HZ BUS=16666666 HZ

==================================================================

Change MPLL source from XTAL to CR...

do MEMPLL setting..

MEMPLL Config : 0x11100000

3PLL mode + External loopback

=== XTAL-40Mhz === DDR-1200Mhz ===

PLL3 FB_DL: 0x0, 1/0 = 599/425 01000000

PLL2 FB_DL: 0xc, 1/0 = 630/394 31000000

PLL4 FB_DL: 0x12, 1/0 = 704/320 49000000

do DDR setting..[00320381]

Apply DDR3 Setting...(use customer AC)

          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120

      --------------------------------------------------------------------------------

0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000E:|    0    0    0    0    0    0    0    0    0    0    0    0    1    1    1    1

000F:|    0    0    0    0    0    0    1    1    1    1    1    1    1    1    1    1

0010:|    1    1    1    1    1    1    1    1    1    1    1    0    0    0    0    0

0011:|    1    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0

0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

DRAMC_DQSCTL1[0e0]=14000000

DRAMC_DQSGCTL[124]=80000000

rank 0 coarse = 16

rank 0 fine = 40

B:|    0    0    0    0    0    0    0    0    1    1    1    0    0    0    0    0

opt_dle value:9

DRAMC_DDR2CTL[07c]=C287221D

DRAMC_PADCTL4[0e4]=000022B3

DRAMC_DQIDLY1[210]=0B0C0B0C

DRAMC_DQIDLY2[214]=060C090D

DRAMC_DQIDLY3[218]=0D060A05

DRAMC_DQIDLY4[21c]=0B050C07

DRAMC_R0DELDLY[018]=00002424

==================================================================

		RX	DQS perbit delay software calibration 

==================================================================

1.0-15 bit dq delay value

==================================================================

bit|     0  1  2  3  4  5  6  7  8  9

--------------------------------------

0 |    11 9 11 11 13 9 12 6 1 7 

10 |    5 11 7 9 5 8 

--------------------------------------



==================================================================

2.dqs window

x=pass dqs delay value (min~max)center 

y=0-7bit DQ of every group

input delay:DQS0 =36 DQS1 = 36

==================================================================

bit	DQS0	 bit      DQS1

0  (1~69)35  8  (1~64)32

1  (2~67)34  9  (1~65)33

2  (1~70)35  10  (2~68)35

3  (1~71)36  11  (2~67)34

4  (1~71)36  12  (2~70)36

5  (2~71)36  13  (0~66)33

6  (1~71)36  14  (2~70)36

7  (1~71)36  15  (1~66)33

==================================================================

3.dq delay value last

==================================================================

bit|    0  1  2  3  4  5  6  7  8   9

--------------------------------------

0 |    12 11 12 11 13 9 12 6 5 10 

10 |    6 13 7 12 5 11 

==================================================================

==================================================================

     TX  perbyte calibration 

==================================================================

DQS loop = 15, cmp_err_1 = ffff0000 

dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 

dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 

DQ loop=15, cmp_err_1 = ffff0000

dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1 

dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2 

byte:0, (DQS,DQ)=(8,8)

byte:1, (DQS,DQ)=(8,8)

DRAMC_DQODLY1[200]=88888888

DRAMC_DQODLY2[204]=88888888

20,data:88

[EMI] DRAMC calibration passed




===================================================================

     		MT7621   stage1 code done 

     		CPU=50000000 HZ BUS=16666666 HZ

===================================================================



U-Boot 1.1.3 (Aug 13 2019 - 15:27:14)


Board: Ralink APSoC DRAM:  256 MB

rt2880 uboot v0.00e04 05/25/2006

SERIAL_CLOCK_DIVISOR =16 

kaiker,,CONFIG_BAUDRATE =57600 

SDRAM SIZE:10000000

Top of RAM usable for U-Boot at: 8fd00000

Reserving 425k for U-Boot at: 8fc94000

Reserving 1028k for malloc() at: 8fb93000

Reserving 44 Bytes for Board Info at: 8fb92fd4

Reserving 36 Bytes for Global Data at: 8fb92fb0

Reserving 128k for boot params() at: 8fb72fb0

Stack Pointer at: 8fb72f98

relocate_code Pointer at: 8fc94000


Config XHCI 40M PLL 

Now running in RAM - U-Boot at: 8fc94000


 monitor_flash_len =116956 

Command "mdio": 0xa02062f0 => 0x8fc9a2f0

Command "nand": 0xa020be4c => 0x8fc9fe4c

Command "reset": 0xa0215d6c => 0x8fca9d6c

Command "go": 0xa020d7f8 => 0x8fca17f8

Command "bootm": 0xa020e054 => 0x8fca2054

Command "loadb": 0xa020ed14 => 0x8fca2d14

Command "tftpboot": 0xa020f344 => 0x8fca3344

Command "nm": 0xa020fb48 => 0x8fca3b48

Command "mm": 0xa020fbac => 0x8fca3bac

Command "md": 0xa020fc10 => 0x8fca3c10

Command "mcmp": 0xa020f744 => 0x8fca3744

Command "saveenv": 0xa02102f4 => 0x8fca42f4

Command "setenv": 0xa0210c64 => 0x8fca4c64

Command "printenv": 0xa0210344 => 0x8fca4344

Command "?": 0xa0210f38 => 0x8fca4f38

Command "help": 0xa0210f38 => 0x8fca4f38

Command "version": 0xa0210df8 => 0x8fca4df8

Command "sc_upgrade_flag": 0xa0213d78 => 0x8fca7d78

Command "sc_boot": 0xa0213db0 => 0x8fca7db0

Command "sc_nand": 0xa0213de8 => 0x8fca7de8

Command "sc_eth_test": 0xa0213e24 => 0x8fca7e24

Command "sc_phy": 0xa0213e60 => 0x8fca7e60

Command "sc_time": 0xa0213e9c => 0x8fca7e9c

Command "sc_btver": 0xa0213ed4 => 0x8fca7ed4

Command "sc_fl_map": 0xa0213f10 => 0x8fca7f10

Command "sc_endian": 0xa0213f4c => 0x8fca7f4c

Command "sc_gpio": 0xa0213f88 => 0x8fca7f88

Command "sc_led": 0xa0213fc4 => 0x8fca7fc4

Command "sc_mem_usage_info": 0xa021390c => 0x8fca790c

Command "sc_dl": 0xa0214000 => 0x8fca8000

Allocate 16 byte aligned buffer: 8fcca3f0

Enable NFI Clock

# MTK NAND # : Use HW ECC

NAND ID [C2 F1 80 95 02]

Device found in MTK table, ID: c2f1, EXT_ID: 809502

Support this Device in MTK table! c2f1 

select_chip

[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16

Signature matched and data read!

load_fact_bbt success 1023

load fact bbt success

[mtk_nand] probe successfully!

mtd->writesize=2048 mtd->oobsize=64,	mtd->erasesize=131072  devinfo.iowidth=8

*** Warning - bad CRC, using default environment


icache: sets:256, ways:4, linesz:32 ,total:32768

dcache: sets:256, ways:4, linesz:32 ,total:32768 


 ##### The CPU freq = 880 MHZ #### 

 estimate memory size =256 Mbytes

#Reset_MT7530


Load Standalone from 40000

SC_DEBUG: Nand Partition Table Magic Found at 100000.


e[31m******************************************

    Uboot StandAlone Entry

******************************************e[0m

GPIO init

*********************************************************

      Press any key to enter Boot Command Interface      

*********************************************************

 0 

SC_DEBUG: Nand Partition Table Magic Found at 100000.


e[31m******************************************

    Uboot StandAlone Entry

******************************************e[0m



***************************************************


    S2 Boot Version 0100, at Aug 13 2019, 15:27:09




***************************************************


SC_DEBUG: Nand Partition Table Magic Found at 100000.

Ethernet is closed .

Entering Firmware : Everything is OK.



*************************************

Boot Flag : Sercomm1


*************************************

Fw header Magic check OK!

FW header checksum should: 0x47b7b0fe, crc32 result: 0x47b7b0fe, Fw header CRC check OK!

kernel : real offset: 0x00a20100, data length: 0x003dd3f8,checksum :0x67d1e2fd

kernel result: 0x67d1e2fd, kernel check sum ok!

rootfs:  real offset: 0x02820000, data length: 0x0093e000, checksum :0x81bdb3ef

rootfs result: 0x81bdb3ef, rootfs check sum ok!

Kernel Addr : 0xbca20100

## Booting image at bca20100 ...

   Image Name:   Linux Kernel Image

   Image Type:   MIPS Linux Kernel Image (lzma compressed)

   Data Size:    4051896 Bytes =  3.9 MB

   Load Address: 81001000

   Entry Point:  816eb7a0

   Verifying Checksum ... OK

   Uncompressing Kernel Image ... OK

kernel addr :0xBCA20100 

No initrd

## Transferring control to Linux (at address 816eb7a0) ...

## Giving linux memsize in MB, 256


Starting kernel ...



LINUX started...

 THIS IS ASIC

SDK 5.0.S.0
Linux version 3.10.14 (sercomm@pavel) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 SMP Tue Mar 10 20:27:48 MSK 2020

 The CPU feqenuce set to 880 MHz
GCMP present
CPU0 revision is: 0001992f (MIPS 1004Kc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 0fffc000 @ 00000000 (usable)
 memory: 00004000 @ 0fffc000 (reserved)
Zone ranges:
  DMA      [mem 0x00000000-0x00ffffff]
  Normal   [mem 0x01000000-0x0fffbfff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x0fffbfff]
Detected 3 available secondary CPU(s)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
PERCPU: Embedded 7 pages/cpu @81ca0000 s6720 r8192 d13760 u32768
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65020
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 rootfstype=squashfs
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Writing ErrCtl register=00030010
Readback ErrCtl register=00030010
Memory: 248880k/262128k available (7126k kernel code, 13248k reserved, 3223k data, 268k init, 0k highmem)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 577.53 BogoMIPS (lpj=1155072)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
launch: starting cpu1
launch: cpu1 gone!
CPU1 revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Synchronize counters for CPU 1: done.
launch: starting cpu2
launch: cpu2 gone!
CPU2 revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Synchronize counters for CPU 2: done.
launch: starting cpu3
launch: cpu3 gone!
CPU3 revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Synchronize counters for CPU 3: done.
Brought up 4 CPUs
devtmpfs: initialized
NET: Registered protocol family 16
release PCIe RST: RALINK_RSTCTRL = 7000000
PCIE PHY initialize
***** Xtal 40MHz *****
start MT7621 PCIe register access
RALINK_RSTCTRL = 7000000
RALINK_CLKCFG1 = 77ffeff8

*************** MT7621 PCIe RC mode *************
PCIE2 no card, disable it(RST&CLK)
pcie_link status = 0x3
RALINK_RSTCTRL= 3000000
*** Configure Device number setting of Virtual PCI-PCI bridge ***
RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2
PCIE0 enabled
PCIE1 enabled
interrupt enable status: 300000
Port 1 N_FTS = 1b105000
Port 0 N_FTS = 1b105000
config reg done
init_rt2880pci done
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:00.0: BAR 9: assigned [mem 0x60000000-0x601fffff pref]
pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff]
pci 0000:00:00.0: BAR 1: assigned [mem 0x60300000-0x6030ffff]
pci 0000:00:01.0: BAR 1: assigned [mem 0x60310000-0x6031ffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit pref]
pci 0000:01:00.0: BAR 2: assigned [mem 0x60100000-0x60103fff 64bit pref]
pci 0000:01:00.0: BAR 4: assigned [mem 0x60104000-0x60104fff 64bit pref]
pci 0000:00:00.0: PCI bridge to [bus 01]
pci 0000:00:00.0:   bridge window [mem 0x60000000-0x601fffff pref]
pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff]
pci 0000:00:01.0: PCI bridge to [bus 02]
pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
PCI: Enabling device 0000:00:00.0 (0004 -> 0006)
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
BAR0 at slot 0 = 0
bus=0x0, slot = 0x0
res[0]->start = 0
res[0]->end = 0
res[1]->start = 60300000
res[1]->end = 6030ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
BAR0 at slot 1 = 0
bus=0x0, slot = 0x1
res[0]->start = 0
res[0]->end = 0
res[1]->start = 60310000
res[1]->end = 6031ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0, irq=0x4
res[0]->start = 60000000
res[0]->end = 600fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 60100000
res[2]->end = 60103fff
res[3]->start = 0
res[3]->end = 0
res[4]->start = 60104000
res[4]->end = 60104fff
res[5]->start = 0
res[5]->end = 0
bus=0x2, slot = 0x1, irq=0x18
res[0]->start = 60200000
res[0]->end = 602fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
Switching to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
4 CPUs re-calibrate udelay(lpj = 1167360)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NTFS driver 2.1.30 [Flags: R/W].
fuse init (API version 7.22)
msgmni has been set to 486
io scheduler noop registered (default)
reg_int_mask=0, INT_MASK= 0 
HSDMA_init

 hsdma_phy_tx_ring0 = 0x00c00000, hsdma_tx_ring0 = 0xa0c00000

 hsdma_phy_rx_ring0 = 0x00c04000, hsdma_rx_ring0 = 0xa0c04000
TX_CTX_IDX0 = 0
TX_DTX_IDX0 = 0
RX_CRX_IDX0 = 3ff
RX_DRX_IDX0 = 0
set_fe_HSDMA_glo_cfg
HSDMA_GLO_CFG = 465
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A
serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A
serial8250: ttyS2 at MMIO 0x1e000e00 (irq = 28) is a 16550A
brd: module loaded
MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
Allocate 16 byte aligned buffer: 81a77dd0
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [C2 F1 80 95 02, 00809502]
Device found in MTK table, ID: c2f1, EXT_ID: 809502
alloctare : (mtd->writesize + mtd->oobsize) * page_per_block is 135168
Support this Device in MTK table! c2f1 

NAND device: Manufacturer ID: 0xc2, Chip ID: 0xf1 (Macronix NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Scanning device for bad blocks
Bad eraseblock 22 at 0x0000002c0000
Signature matched and data read!
load_fact_bbt success 1023
00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
SC_DEBUG: Go to read Magic at 100000
page: 200
SC_DEBUG: NAND Partition Table Magic was found at 100000.
page: 201
SC_DEBUG: part 0,real_offset 00000000, real_length 00100000
page: 201
SC_DEBUG: part 1,real_offset 00100000, real_length 00100000
page: 201
SC_DEBUG: part 2,real_offset 00200000, real_length 00120000
page: 201
SC_DEBUG: part 3,real_offset 00320000, real_length 00100000
page: 201
SC_DEBUG: part 4,real_offset 00420000, real_length 00600000
page: 201
SC_DEBUG: part 5,real_offset 00a20000, real_length 00600000
page: 201
SC_DEBUG: part 6,real_offset 01020000, real_length 01800000
page: 201
SC_DEBUG: part 7,real_offset 02820000, real_length 01800000
page: 201
SC_DEBUG: part 8,real_offset 04020000, real_length 00800000
page: 201
SC_DEBUG: part 9,real_offset 04820000, real_length 00c00000
page: 201
SC_DEBUG: part 10,real_offset 05420000, real_length 02800000
page: 201
SC_DEBUG: part 11,real_offset 07c20000, real_length 00360000
Creating 12 MTD partitions on "MT7621-NAND":
0x000000000000-0x000000100000 : "Boot Loader"
0x000000100000-0x000000200000 : "dynamic partition map"
0x000000200000-0x000000320000 : "Factory"
0x000000320000-0x000000420000 : "Boot Flag"
0x000000420000-0x000000a20000 : "Kernel 1"
0x000000a20000-0x000001020000 : "Kernel 2"
0x000001020000-0x000002820000 : "File System 1"
0x000002820000-0x000004020000 : "File System 2"
0x000004020000-0x000004820000 : "Configuration/log"
0x000004820000-0x000005420000 : "application tmp buffer (Ftool)"
0x000005420000-0x000007c20000 : "container"
0x000007c20000-0x000007f80000 : "bad block reserved"
[mtk_nand] probe successfully!
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
register mt_drv


=== pAd = c0181000, size = 8000960 ===

<-- RTMPAllocAdapterBlock, Status=0
pAd->PciHif.CSRBaseAddress =0xc0080000, csr_addr=0xc0080000!
RTMPInitPCIeDevice():device_id=0x7663
mt_pci_chip_cfg(): HWVer=0x8a10, FWVer=0x8a01, pAd->ChipID=0x7663
mt7663_init()-->
<--mt7663_init()
<-- RTMPAllocTxRxRingMemory, Status=0
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
add_oom_notifier()
rdm_major = 253
set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1
GMAC1_MAC_ADRH -- : 0x0000000c
GMAC1_MAC_ADRL -- : 0x43288071
Ralink APSoC Ethernet Driver Initilization. v3.1  4096 rx/tx descriptors allocated, mtu = 1500!
set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1
GMAC1_MAC_ADRH -- : 0x0000000c
GMAC1_MAC_ADRL -- : 0x43288011
<0>  !! create link_status PROC !!!!!
PROC INIT OK!
usbcore: registered new interface driver usb-storage
Ralink APSoC Hardware Watchdog Timer
GACT probability on
Mirror/redirect action on
Failed to load ipt action
u32 classifier
    Performance counters on
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (3888 buckets, 15552 max)
ctnetlink v0.93: registering with nfnetlink.
NF_TPROXY: Transparent proxy support initialized, version 4.1.0
NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd.
IPVS: Registered protocols ()
IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
IPVS: Creating netns size=776 id=0
IPVS: ipvs loaded.
gre: GRE over IPv4 demultiplexor driver
ip_tables: (C) 2000-2006 Netfilter Core Team
Type=Linux
arp_tables: (C) 2002 David S. Miller
TCP: cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
Ebtables v2.0 registered
l2tp_core: L2TP core driver, V2.0
l2tp_ppp: PPPoL2TP kernel driver, V2.0
8021q: 802.1Q VLAN Support v1.8
Sercomm dual images: bootflag=Sercomm1, choose /dev/mtdblock7 as rootfs
VFS: Mounted root (squashfs filesystem) readonly on device 31:7.
devtmpfs: mounted
Freeing unused kernel memory: 268K (81a1d000 - 81a60000)

init started: BusyBox v1.15.3 ()

starting pid 51, tty '': '/etc/rcS'
mount: mounting usbfs on /proc/bus/usb failed: No such file or directory
register rlt_drv


=== pAd = c0e81000, size = 1295256 ===

<-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
<-- RTMPAllocAdapterBlock, Status=0
pAd->CSRBaseAddress =0xc0d80000, csr_addr=0xc0d80000!
device_id =0x7603
RtmpChipOpsHook(474): Not support for HIF_MT yet!
mt7603_init()-->
mt_bcn_buf_init(224): Not support for HIF_MT yet!
<--mt7603_init()
hal_wd: module license 'sercomm' taints kernel.
Disabling lock debugging due to kernel taint
Init system monitor...
Sercomm HWIO Driver: loaded successfully
nUBI: attaching mtd8 to ubi8
UBI: scanning is finished
UBI: attached mtd8 (name "Configuration/log", size 8 MiB) to ubi8
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 64, bad PEBs: 0, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 67/49, WL threshold: 4096, image sequence number: 679372223
UBI: available PEBs: 0, total reserved PEBs: 64, PEBs reserved for bad PEB handling: 20

UBI: background thread "ubi_bgt8d" started, PID 93
UBI device number 8, total 64 LEBs (8126464 byteUBIFS: background thread "ubifs_bgt8_0" started, PID 95
s, 7.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 8, volume 0, name "0"
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 3809280 bytes (3 MiB, 30 LEBs), journal size 3428352 bytes (3 MiB, 27 LEBs)
UBIFS: reserved for root: 0 bytes (0 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID D569DB63-F2CC-4411-9F53-3FA4254DC41A, small LPT model
Started WatchDog Timer.
SERIAL NUMBER: SQ1731F7F722
FFFFFFFF:FFFFFFFF:FFFFFFFF:FFFFFFFF:FFFFFFFF:FFFFFFFF
Raeth v3.1 (Tasklet)
phy_free_head is 0xc9c000!!!
phy_free_tail_phy is 0xc9dff0!!!
txd_pool=a0ca8000 phy_txd_pool=00CA8000
ei_local->skb_free start address is 0x8e9026cc.
free_txd: 00ca8010, ei_local->cpu_ptr: 00CA8000
 POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
----------------+---------+--------
     0xa0ca8000 0x00CA8000 0x00CA8000

phy_qrx_ring = 0x00c9e000, qrx_ring = 0xa0c9e000

phy_rx_ring0 = 0x00cb0000, rx_ring[0] = 0xa0cb0000
MT7530 Reset Completed!!
change HW-TRAP to 0x117c8f
set LAN/WAN WLLLL
GMAC1_MAC_ADRH -- : 0x000060ce
GMAC1_MAC_ADRL -- : 0x866eb816
GDMA2_MAC_ADRH -- : 0x0000000c
GDMA2_MAC_ADRL -- : 0x432880ba
eth3: ===> VirtualIF_open
MT7621 GE2 link rate to 1G
CDMA_CSG_CFG = 81000000
GDMA1_FWD_CFG = 20710000
GDMA2_FWD_CFG = 20710000
sc_lan_vlan_id = 1
sc_wan_vlan_id = 2
sc_special_vlan_id = 3
sc_host_queue = 3
rc_cmd=/usr/sbin/rc syslogd start 
Chain 'FORWARD_WIFI' doesn't exist.
Chain 'INPUT_WIFI' doesn't exist.
rc_cmd=/usr/sbin/rc wan_switch start 
rc_cmd=/usr/sbin/rc lan_switch start 
rc_cmd=/usr/sbin/rc dnrd start 
rc_cmd=/usr/sbin/rc wlan start 
============guest<2> is disabled============
============guest<3> is disabled============
============guest<4> is disabled============
============guest<6> is disabled============
============guest<7> is disabled============
============guest<8> is disabled============
Chain 'FORWARD_WIFI' doesn't exist.
Chain 'INPUT_WIFI' doesn't exist.
rc_cmd=/usr/sbin/rc lanip start init 
rc_cmd=/usr/sbin/rc firewall start 
ScDrvDev_ioctl: CMD: (20) is not supported
rc_cmd=rc radvd restart 
[Jan 01 00:00:31] radvd: no linklocal address configured for br0
[Jan 01 00:00:31] radvd: can't join ipv6-allrouters on br0
iptables: Bad rule (does a matching rule exist in that chain?).
rc_cmd=/usr/sbin/rc networkmap start init 
rc_cmd=/usr/sbin/rc qtbl start 
rc_cmd=/usr/sbin/rc qos start 
rc_cmd=/usr/sbin/rc cpm start init 
rc_cmd=/usr/sbin/rc wanip stop 1 
rc_cmd=/usr/sbin/rc dnrd stop wid 1 
rc_cmd=/usr/sbin/rc hw_nat stop 1 
rc_cmd=/usr/sbin/rc qtbl stop 1 
rc_cmd=/usr/sbin/rc wanip stop 0 
rc_cmd=/usr/sbin/rc dnrd stop wid 0 
rc_cmd=/usr/sbin/rc hw_nat stop 0 
rc_cmd=/usr/sbin/rc dnrd stop wid 1 
rc_cmd=/usr/sbin/rc hw_nat stop 1 
rc_cmd=/usr/sbin/rc qtbl stop 0 
rc_cmd=/usr/sbin/rc dnrd stop wid 0 
Tue Mar 10 21:04:28 UTC 2020
rc_cmd=/usr/sbin/rc qtbl stop 1 
rc_cmd=/usr/sbin/rc ntp restart 0 
rc_cmd=/usr/sbin/rc httpd start 
rc_cmd=/usr/sbin/rc hw_nat stop 0 
rc_cmd=/usr/sbin/rc qtbl stop 0 
rc_cmd=/usr/sbin/rc coredump start 
rc_cmd=/usr/sbin/rc redirect start 
sh: /usr/sbin/uevent: not found
rc_cmd=/usr/sbin/rc dnrd start redirect 
rc_cmd=/usr/sbin/rc ieee_802_1x start 
bind: Address already in use
bind: Address already in use
rc_cmd=/usr/sbin/rc srt restart 
rc_cmd=/usr/sbin/rc rp start 
Mar/10/2020 21:04:28: dhcp6_ctl_authinit: failed to open /tmp/dhcp6sctlkey: No such file or directory
rc_cmd=/usr/sbin/rc udpecho start 
rc_cmd=/usr/sbin/rc ingress_qos start 
ScDrvDev_ioctl: CMD: (19) is not supported
/usr/sbin/iq: failed to enable Ingress QoS
rc_cmd=/usr/sbin/rc ingress_classify start 
rc_cmd=/usr/sbin/rc qos_remark start 
rc_cmd=/usr/sbin/rc ipv6wd start 
rc_cmd=/usr/sbin/rc pppoe_relay start 
rc_cmd=/usr/sbin/rc telnetd start 
rc_cmd=/usr/sbin/rc sshd start 
rc_cmd=/usr/sbin/rc igd_upnp start 
rc_cmd=/usr/sbin/rc dnsr start 
rc_cmd=/usr/sbin/rc cron start 
Could not load host key: /etc/ssh/ssh_host_ed25519_key

rc_cmd=/usr/sbin/rc cwmp_stun start 

Erasing 128 Kibyte @ 20000 --  0 % complete 
Erasing 128 Kibyte

Smart Box GIGA login:
1 Like
3
Alternative Bootloaders
  • Breed - no longer necessary
1 Like
4

Download OpenWrt (community builds) / Stock firmware / Recoveries

Device pages (and all necessary instructions) on OpenWrt wiki:

3 Likes
5

Capacitor mod USB +5V

Problem - Hanging on of Fibocom L860-GL USB modem under high upload.
Solution - Solder the C1840 capacitor in the 5V USB power circuit. The place for it is already exists. Keep the polarity of the capacitor!
Rating 100-330 uF x 16V.

Photo, before and after

before
before659×800 133 KB

after
after777×800 193 KB

1 Like
6

Emergency recovery

Symptoms - router doesn't boot, blinking green and red
You can also enter the router into Recovery mode by holding Reset and then connecting the power.

Recovery steps:

  1. Compile sercomm-recovery under the Linux:
git clone https://github.com/danitool/sercomm-recovery.git
make
  1. Connect the router with a cable and run sercomm-recovery:

  • For Turbo + with 128 MB NAND:
    sudo ./sercomm-recovery enp0s3 recovery_turboplus_stock.bin
    this file is for Turbo+ only, it isn't suitable for Turbo without plus, with 256 MB NAND

  • For GIGA:
    sudo ./sercomm-recovery enp0s3 recovery_giga_stock.bin
    where the enp0s3 network interface connected the router.
    ifconfig - list on available network interfaces

  1. Wait until the router is flashed and rebooted.

Download ready recovery images for Turbo+ and GIGA

How to make own recovery images:

  1. Contcat all mtd backup into one file:
    cat mtd0 ... mtd10 > full.bin
  2. Add OOB data:
    bbe -b ":512" -e "A 0000000000000000" full.bin -o full-oob.bin

Thanks to @Kar200 for the idea and initial testing on Sercomm S3 (almost twin of Turbo+).

1 Like
7

Current status (22.06.2022)

@adschm (initial reviewer) last seen on GitHub many months ago so we need help one of the member to merge the rest part of the code.

Outdated

Device PR coundn't be merged because a reviewer from OpenWrt hasn't been found for the commit add Sercomm partition map parser. @adschm recomended try upstream the patch to Linux. On the other hand, the it looks like the patch is OpenWrt-related only.

The parser is necessary to prevent the Sercomm-based devices from bootlops and other artefacts during the OpenWrt installation. Affected devices, at least:

  • NetGear R6260
  • NetGear R6350
  • NetGear R6850
  • NetGear WAC124 (CHJ)
  • NetGear R6800
  • NetGear R6700-v2
  • NetGear R7200
  • NetGear Nighthawk AC2400 (BZV)
  • Beeline SmartBox Turbo+
  • Beeline SmartBox Turbo
  • Beeline SmartBox GIGA
  • Sercomm S3

For this reason, for already merged devices, replacing the U-Boot bootloader with a Breed is a common practice.

Previous attempts to merge parser:
https://patchwork.ozlabs.org/project/openwrt/patch/20200628232747.1367531-1-jan@3e8.eu/
https://github.com/openwrt/openwrt/pull/1318

1 Like
8

Problem

Broken link autodetection. Link speed is 1 Gbps even if the cable or remote device supports only 100 Mbps.
https://bugs.openwrt.org/index.php?do=details&task_id=3839

Workaround

Add this to rc.local:
ethtool -s wan speed 100 duplex full autoneg off

1 Like
9

Restore U-Boot and mtd1-3 from a backup

flash erase 0x100000 0x300000
wget http://192.168.1.2/mtd1
flash write 0x100000 0x80001000 1048576
wget http://192.168.1.2/mtd2
flash write 0x200000 0x80001000 1048576
wget http://192.168.1.2/mtd3
flash write 0x300000 0x80001000 1048576
wget http://192.168.1.2/mtd0
flash erase 0x0 0x100000
flash write 0x0 0x80001000 1048576
1 Like
10

Image's OEM Stock FirmWare for Beeline SmartBox GIGA

Referance
2 Likes
11

Please add command wget http://192.168.1.2/mtd1 before all others. In that case user will not erase flash when web server cannot handle such request.

So, maybe, proper post will look like this:

For professionals / developers only. You can easily brick the router.

Use Breed telnet console to download dump for the first partition:

wget http://192.168.1.2/mtd1

If you have an error, do not proceed! There is a probably error with your web server. Also check size, reported by wget command. If size differs, you will brick your device.

Then you can copy and paste commands below, line by line, execute and watch for errors:

flash erase 0x100000 0x300000
…
12

Mtd parser got backported to kernel 5.10, basically everything is ready for merging giga https://github.com/openwrt/openwrt/pull/4195

13

And to 5.15 kernel too. I've updated the current status. Briefly - we need someone else's help due to @adschm's absence.

1 Like
14

Device page Beeline SmartBox GIGA has been created

3 Likes
15

a hdd box with separate power supply is connected to my router. Sometimes, very rarely, the usb is reset, and the following messages are displayed in the logs. I tried using different usb cables usb2.0 and usb3.0, it doesn't help. This may be due to the fact that there is no capacitor on the usb?

[622672.299961] sd 0:0:0:0: [sda] tag#19 CDB: opcode=0x2a 2a 00 1e 04 08 d0 00 00 10 00
[622702.355588] sd 0:0:0:0: [sda] tag#19 uas_eh_abort_handler 0 uas-tag 1 inflight: CMD
[622702.371191] sd 0:0:0:0: [sda] tag#19 CDB: opcode=0x2a 2a 00 1e 04 08 d0 00 00 10 00
[622702.399561] scsi host0: uas_eh_device_reset_handler start
[622702.535888] usb 1-1: reset high-speed USB device number 2 using xhci-mtk
[622702.697523] scsi host0: uas_eh_device_reset_handler success
16

I think that it's possible. Nothing bad if you solder a capacitor.

17

Looks like there is RC2 already released. Is wiki outdated?

18

I would like to know how much free space is left to install packages, after installing 23.05 on the TP-Link EC330-G5u.

Thank you so much.