Add support for Beeline SmartBox TURBO+

For Developers
1

Hello everyone!
This thread was created for discussions and posting information, on the way to official support router for OpenWRT and full functionality.

Description

The Beeline SmartBox Turbo+ router is supplied by the Beeline provider on the territory of the Russian Federation. OEM SerComm. Almost identical to SerComm S3. Perhaps they should be combined under one name. There are also similar devices from the provider.

General specification:

  • SoC Type: MediaTek MT7621AT (880 MHz, 2 cores)
  • Switch: MediaTek MT7530 (via SoC MT7621AT)
  • Ethernet: 5 ports - 5×GbE (WAN, LAN1-4)
  • Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
  • Wireless 5 GHz (MT7615N): a/n/ac, 4x4
  • Buttons: 2 button (RESET, WPS)
  • USB ports: 1xUSB3.0
  • BootLoader: U-Boot SerComm/Mediatek
  • Power: 12 VDC, 1.5 A

Beeline SmartBox TURBO+ specification:

  • RAM (Nanya NT5CC64M16GP): 128 MiB
  • NAND-Flash (Macronix MX30LF1G18AC): 128 MiB
  • ZigBee (EFR32 MG1B232GG): 3.0
  • LEDs: 1 RGB LED
  • CSN: SD18********
  • MAC LAN: 74:9D:79:**:**:**
  • Manufacturer's code: 0CQR0500QW1
  • PCB Sticker: 970CQR0QW00N128SMT Ver. 1.2
  • PCB: CQR00B-1.6

Beeline SmartBox TURBO specification:

  • RAM (Nanya M15T2G16128A): 256 MiB
  • NAND-Flash (ESMT F59L2G81XA): 256 MiB
  • LEDs: 1 RGB LED
  • CSN: SN2F********
  • MAC WAN: E0:0E:E4:**:**:**
  • Manufacturer's code: 0DF30500QW1
  • PCB Sticker: 970DF30QW00N256SMT Ver. 1.0
  • PCB: CQR20-1.6

Etisalat Sercomm S3 specification:

  • RAM (Nanya NT5CC128M16JR): 256 MiB
  • NAND-Flash (Macronix MX30LF1G18AC): 128 MiB
  • LEDs: 1 RGB LED, 2.4 & 5 GHz Wi-Fi LED Blue
  • CSN: ET2F*********
  • MAC WAN: 7C:8F:DE:**:**:**
  • PCB Sticker: 970DDK0PV01N128SMT Ver. 1.2
  • PCB: CQR20-1.6

Acknowledgments

Many thanks
People from the 4pda:
  • Harwest Git & Zigbee
  • VRamir
  • Sedy
  • butaford
  • ПолВторого
  • evzomsk

Community OpenWRT, Group OpenWRT RU and all who are involved.

Known Issues

Hide
Related Topics
Hide
Bibliography
Hide
2 Likes
2
Wiki OpenWRT for Sercomm S3 clones

https://openwrt.org/toh/beeline/smartbox_turbo_plus

https://openwrt.org/toh/beeline/smartbox_turbo

https://openwrt.org/toh/sercomm/S3

1 Like
3
1 Like
4

Bootloader

U-Boot 1.1.3 (Mar 6 2018 - 19:39:59)
rt2880 uboot v0.00e04 05/25/2006
Ralink UBoot Version: 5.0.0.0

BootLog.U-boot. 
===================================================================
                MT7621   stage1 code 10:33:11 (ASIC)
                CPU=50000000 HZ BUS=16666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL2 FB_DL: 0x16, 1/0 = 679/345 59000000
PLL4 FB_DL: 0x18, 1/0 = 767/257 61000000
PLL3 FB_DL: 0x1e, 1/0 = 644/380 79000000
do DDR setting..[00320381]
Apply DDR3 Setting...(use customer AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
      --------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    1
000E:|    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1    1
000F:|    0    0    0    0    1    1    1    1    1    1    1    1    1    1    0    0
0010:|    1    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0
0011:|    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
rank 0 coarse = 15
rank 0 fine = 72
B:|    0    0    0    0    0    0    0    0    1    1    1    0    0    0    0    0
opt_dle value:9
DRAMC_R0DELDLY[018]=00002121
==================================================================
                RX      DQS perbit delay software calibration 
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    14 9 13 11 13 8 14 6 4 12 
10 |    7 13 9 11 7 11 
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center 
y=0-7bit DQ of every group
input delay:DQS0 =33 DQS1 = 33
==================================================================
bit     DQS0     bit      DQS1
0  (1~65)33  8  (1~59)30
1  (1~64)32  9  (1~61)31
2  (1~64)32  10  (2~64)33
3  (1~63)32  11  (1~60)30
4  (1~60)30  12  (1~61)31
5  (1~62)31  13  (1~62)31
6  (1~64)32  14  (1~65)33
7  (1~66)33  15  (1~61)31
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    14 10 14 12 15 10 15 6 7 14 
10 |    7 15 11 13 7 13 
==================================================================
==================================================================
     TX  perbyte calibration 
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000 
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 
DQ loop=15, cmp_err_1 = ffff0080
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=1 
DQ loop=14, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=14,  finish count=2 
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
20,data:88
[EMI] DRAMC calibration passed

===================================================================
                MT7621   stage1 code done 
                CPU=50000000 HZ BUS=16666666 HZ
===================================================================


U-Boot 1.1.3 (Mar  6 2018 - 19:39:59)

Board: Ralink APSoC DRAM:  128 MB
rt2880 uboot v0.00e04 05/25/2006
SERIAL_CLOCK_DIVISOR =16 
kaiker,,CONFIG_BAUDRATE =57600 
SDRAM SIZE:08000000
Top of RAM usable for U-Boot at: 88000000
Reserving 426k for U-Boot at: 87f94000
Reserving 1028k for malloc() at: 87e93000
Reserving 44 Bytes for Board Info at: 87e92fd4
Reserving 36 Bytes for Global Data at: 87e92fb0
Reserving 128k for boot params() at: 87e72fb0
Stack Pointer at: 87e72f98
relocate_code Pointer at: 87f94000

Config XHCI 40M PLL 
Now running in RAM - U-Boot at: 87f94000

 monitor_flash_len =117844 
Command "mdio": 0xa0206b28 => 0x87f9ab28
Command "nand": 0xa020c460 => 0x87fa0460
Command "reset": 0xa0215ecc => 0x87fa9ecc
Command "go": 0xa020de0c => 0x87fa1e0c
Command "bootm": 0xa020e668 => 0x87fa2668
Command "loadb": 0xa020f328 => 0x87fa3328
Command "tftpboot": 0xa020f958 => 0x87fa3958
Command "nm": 0xa020ffe4 => 0x87fa3fe4
Command "mm": 0xa0210048 => 0x87fa4048
Command "md": 0xa02100ac => 0x87fa40ac
Command "saveenv": 0xa0210624 => 0x87fa4624
Command "setenv": 0xa0210f94 => 0x87fa4f94
Command "printenv": 0xa0210674 => 0x87fa4674
Command "?": 0xa0211268 => 0x87fa5268
Command "help": 0xa0211268 => 0x87fa5268
Command "version": 0xa0211128 => 0x87fa5128
Command "sc_boot": 0xa0213ed4 => 0x87fa7ed4
Command "sc_nand": 0xa0213f0c => 0x87fa7f0c
Command "sc_eth_test": 0xa0213f48 => 0x87fa7f48
Command "sc_phy": 0xa0213f84 => 0x87fa7f84
Command "sc_time": 0xa0213fc0 => 0x87fa7fc0
Command "sc_btver": 0xa0213ff8 => 0x87fa7ff8
Command "sc_fl_map": 0xa0214034 => 0x87fa8034
Command "sc_endian": 0xa0214070 => 0x87fa8070
Command "sc_ramtest": 0xa02140ac => 0x87fa80ac
Command "sc_gpio": 0xa02140e8 => 0x87fa80e8
Command "sc_led": 0xa0214124 => 0x87fa8124
Command "sc_dl": 0xa0214160 => 0x87fa8160
Allocate 16 byte aligned buffer: 87fca810
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [C2 F1 80 95 02]
Device found in MTK table, ID: c2f1, EXT_ID: 809502
Support this Device in MTK table! c2f1 
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
*** Warning - bad CRC, using default environment

============================================ 
Ralink UBoot Version: 5.0.0.0
-------------------------------------------- 
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection 
DRAM_TYPE: DDR3 
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Mar  6 2018  Time:19:39:59
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 880 MHZ #### 
 estimate memory size =128 Mbytes
#Reset_MT7530
set LAN/WAN WLLLL

Load Standalone from 40000
SC_DEBUG: Nand Partition Table Magic Found at 100000.

******************************************
    Uboot StandAlone Entry
******************************************
GPIO init
*********************************************************
      Press any key to enter Boot Command Interface      
*********************************************************
 0 
SC_DEBUG: Nand Partition Table Magic Found at 100000.

******************************************
    Uboot StandAlone Entry
******************************************

***************************************************
    Sercomm Boot Version 2.0.0.0, at Mar  6 2018, 19:39:56

***************************************************
SC_DEBUG: Nand Partition Table Magic Found at 100000.
Entering Firmware : Everything is OK.

*************************************
Boot Flag : Sercomm1�
*************************************

Kernel image header:
Image Addr:     00A00100
Image Len:      003A9C2F
Image CRC:      18227026
Start to calculate kernel_crc from 0x00a00100 ....
Kernel CRC verify OK!
Kernel Addr : 0xbca00100
## Booting image at bca00100 ...
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    3841007 Bytes =  3.7 MB
   Load Address: 81001000
   Entry Point:  8162c9e0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
boot_count2 is FF
write 1 to boot_count2
ranand_erase: start:320000, len:20000 
.kernel addr :0xBCA00100 
No initrd
## Transferring control to Linux (at address 8162c9e0) ...
## Giving linux memsize in MB, 128

Starting kernel ...


LINUX started...
1 Like
5

Firmware

Stock FirmWare v1.0.12
SDK 5.0.S.0
Linux version 3.10.14+
BusyBox v1.12.1

BootLog.StockFW.Part.1 
Starting kernel ...


LINUX started...

 THIS IS ASIC

SDK 5.0.S.0
Linux version 3.10.14+ (phil@ubuntu) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 SMP Thu Aug 23 15:48:26 CST 2018

 The CPU feqenuce set to 880 MHz
GCMP present
CPU0 revision is: 0001992f (MIPS 1004Kc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 08000000 @ 00000000 (usable)
Zone ranges:
  DMA      [mem 0x00000000-0x00ffffff]
  Normal   [mem 0x01000000-0x07ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x07ffffff]
Detected 3 available secondary CPU(s)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
PERCPU: Embedded 7 pages/cpu @81b70000 s6656 r8192 d13824 u32768
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 root=ubi0:rootfs rootfstype=ubifs
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Writing ErrCtl register=00006006
Readback ErrCtl register=00006006
Memory: 119136k/131072k available (6359k kernel code, 11936k reserved, 3258k data, 232k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 577.53 BogoMIPS (lpj=1155072)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
launch: starting cpu1
launch: cpu1 gone!
CPU1 revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Synchronize counters for CPU 1: done.
launch: starting cpu2
launch: cpu2 gone!
CPU2 revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Synchronize counters for CPU 2: done.
launch: starting cpu3
launch: cpu3 gone!
CPU3 revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Synchronize counters for CPU 3: done.
Brought up 4 CPUs
devtmpfs: initialized
NET: Registered protocol family 16
release PCIe RST: RALINK_RSTCTRL = 7000000
PCIE PHY initialize
***** Xtal 40MHz *****
start MT7621 PCIe register access
RALINK_RSTCTRL = 7000000
RALINK_CLKCFG1 = 77ffeff8

*************** MT7621 PCIe RC mode *************
PCIE2 no card, disable it(RST&CLK)
pcie_link status = 0x3
RALINK_RSTCTRL= 3000000
*** Configure Device number setting of Virtual PCI-PCI bridge ***
RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2
PCIE0 enabled
PCIE1 enabled
interrupt enable status: 300000
Port 1 N_FTS = 1b105000
Port 0 N_FTS = 1b105000
config reg done
init_rt2880pci done
bio: create slab <bio-0> at 0
vgaarb: loaded
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff]
pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff]
pci 0000:00:01.0: BAR 1: assigned [mem 0x60210000-0x6021ffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
pci 0000:00:00.0: PCI bridge to [bus 01]
pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff]
pci 0000:00:01.0: PCI bridge to [bus 02]
pci 0000:00:01.0:   bridge window [mem 0x60100000-0x601fffff]
PCI: Enabling device 0000:00:00.0 (0004 -> 0006)
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
BAR0 at slot 0 = 0
bus=0x0, slot = 0x0
res[0]->start = 0
res[0]->end = 0
res[1]->start = 60200000
res[1]->end = 6020ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
BAR0 at slot 1 = 0
bus=0x0, slot = 0x1
res[0]->start = 0
res[0]->end = 0
res[1]->start = 60210000
res[1]->end = 6021ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0, irq=0x4
res[0]->start = 60000000
res[0]->end = 600fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x2, slot = 0x1, irq=0x18
res[0]->start = 60100000
res[0]->end = 601fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
Switching to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
4 CPUs re-calibrate udelay(lpj = 1167360)
fuse init (API version 7.22)
msgmni has been set to 232
io scheduler noop registered (default)
reg_int_mask=0, INT_MASK= 0 
HSDMA_init

 hsdma_phy_tx_ring0 = 0x00c00000, hsdma_tx_ring0 = 0xa0c00000

 hsdma_phy_rx_ring0 = 0x00c04000, hsdma_rx_ring0 = 0xa0c04000
TX_CTX_IDX0 = 0
TX_DTX_IDX0 = 0
RX_CRX_IDX0 = 3ff
RX_DRX_IDX0 = 0
set_fe_HSDMA_glo_cfg
HSDMA_GLO_CFG = 465
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A
serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A
serial8250: ttyS2 at MMIO 0x1e000e00 (irq = 28) is a 16550A
Ralink gpio driver initialized
brd: module loaded
MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
Allocate 16 byte aligned buffer: 819b2d60
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [C2 F1 80 95 02, 00809502]
Device found in MTK table, ID: c2f1, EXT_ID: 809502
alloctare : (mtd->writesize + mtd->oobsize) * page_per_block is 135168
[NAND] pagesz:2048 , oobsz: 288,eccbytes: 32
Support this Device in MTK table! c2f1 
NAND device: Manufacturer ID: 0xc2, Chip ID: 0xf1 (Macronix NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
SC_DEBUG: Go to read Magic at 100000
page: 200
SC_DEBUG: NAND Partition Table Magic Fount at 100000.
page: 201
SC_DEBUG: part 0,real_offset 00000000, real_length 00100000
page: 201
SC_DEBUG: part 1,real_offset 00100000, real_length 00100000
page: 201
SC_DEBUG: part 2,real_offset 00200000, real_length 00100000
page: 201
SC_DEBUG: part 3,real_offset 00300000, real_length 00100000
page: 201
SC_DEBUG: part 4,real_offset 00400000, real_length 00600000
page: 201
SC_DEBUG: part 5,real_offset 00a00000, real_length 00600000
page: 201
SC_DEBUG: part 6,real_offset 01000000, real_length 02000000
page: 201
SC_DEBUG: part 7,real_offset 03000000, real_length 02000000
page: 201
SC_DEBUG: part 8,real_offset 05000000, real_length 01400000
page: 201
SC_DEBUG: part 9,real_offset 06400000, real_length 01b80000
page: 201
SC_DEBUG: part 10,real_offset ffffffff, real_length ffffffff
Creating 11 MTD partitions on "MT7621-NAND":
0x000000000000-0x000000100000 : "Boot Loader"
0x000000100000-0x000000200000 : "dynamic partition map"
0x000000200000-0x000000300000 : "Factory"
0x000000300000-0x000000400000 : "Boot Flag"
0x000000400000-0x000000a00000 : "Kernel 1"
0x000000a00000-0x000001000000 : "Kernel 2"
0x000001000000-0x000003000000 : "File System 1"
0x000003000000-0x000005000000 : "File System 2"
0x000005000000-0x000006400000 : "Configuration/log"
0x000006400000-0x000007f80000 : "application tmp buffer (Ftool)"
0x000007f80000-0x000007f7ffff : "bad block reserved"
mtd: partition "bad block reserved" is out of reach -- disabled
[mtk_nand] probe successfully!
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
register mt_drv


=== pAd = c0181000, size = 3655800 ===

<-- RTMPAllocAdapterBlock, Status=0
get_wdev_by_idx: invalid idx(0)
pAd->PciHif.CSRBaseAddress =0xc0080000, csr_addr=0xc0080000!
get_wdev_by_idx: invalid idx(0)
RTMPInitPCIeDevice():device_id=0x7615
DriverOwn()::Try to Clear FW Own...
DriverOwn()::Success to clear FW Own
mt_pci_chip_cfg(): HWVer=0x8a10, FWVer=0x8a10, pAd->ChipID=0x7615
mt_pci_chip_cfg(): HIF_SYS_REV=0x76150001
RtmpChipOpsHook(493): Not support for HIF_MT yet! MACVersion=0x0
mt7615_init()-->
Use 1st iPAiLNA default bin.
Use 0st /etc_ro/wlan/MT7615E_EEPROM1.bin default bin.
<--mt7615_init()
ChipOpsMCUHook
cut_through_token_list_init(): TokenList inited done!id_head/tail=0/4096
cut_through_token_list_init(): 87645988,87645988
cut_through_token_list_init(): TokenList inited done!id_head/tail=0/4096
cut_through_token_list_init(): 87645998,87645998
<-- RTMPAllocTxRxRingMemory, Status=0
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
pci probe count=1
rdm_major = 253
GMAC1_MAC_ADRH -- : 0x0000000c
GMAC1_MAC_ADRL -- : 0x43288088
Ralink APSoC Ethernet Driver Initilization. v3.1  4096 rx/tx descriptors allocated, mtu = 1500!
GMAC1_MAC_ADRH -- : 0x0000000c
GMAC1_MAC_ADRL -- : 0x4328806c
<0>  !! create link_status PROC !!!!!
<0>  !! create port_link_change PROC !!!!!
PROC INIT OK!
usbcore: registered new interface driver usb-storage
Ralink APSoC Hardware Watchdog Timer
mt_msdc_init: !!!!! SDXC Module Initialize Fail !!!!!
GACT probability on
Mirror/redirect action on
Failed to load ipt action
u32 classifier
    Performance counters on
    Actions configured
nf_conntrack version 0.5.0 (1861 buckets, 7444 max)
gre: GRE over IPv4 demultiplexor driver
ip_tables: (C) 2000-2006 Netfilter Core Team
Type=Linux
TCP: cubic registered
NET: Registered protocol family 10
sit: IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Ebtables v2.0 registered
l2tp_core: L2TP core driver, V2.0
l2tp_ppp: PPPoL2TP kernel driver, V2.0
8021q: 802.1Q VLAN Support v1.8
boot image 2
UBI: attaching mtd7 to ubi0
UBI: scanning is finished
UBI: attached mtd7 (name "File System 2", size 32 MiB) to ubi0
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 0
UBI: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 20
UBI: background thread "ubi_bgt0d" started, PID 51
UBIFS: mounted UBI device 0, volume 0, name "rootfs", R/O mode
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 28061696 bytes (26 MiB, 221 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs)
UBIFS: reserved for root: 0 bytes (0 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID 307EE5B7-78FD-4B34-96A6-3E8FF936A24E, small LPT model
VFS: Mounted root (ubifs filesystem) readonly on device 0:10.
devtmpfs: mounted
Freeing unused kernel memory: 232K (81966000 - 819a0000)
init started: BusyBox v1.12.1 ()
starting pid 53, tty '': '/etc_ro/rcS'
Algorithmics/MIPS FPU Emulator v1.5
mount: mounting usbfs on /proc/bus/usb failed: No such file or directory
sc_drv: module license 'Sercomm' taints kernel.
Disabling lock debugging due to kernel taint
UBI: attaching mtd8 to ubi8
UBI: scanning is finished
UBI: attached mtd8 (name "Configuration/log", size 20 MiB) to ubi8
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 160, bad PEBs: 0, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 84/55, WL threshold: 4096, image sequence number: 588414212
UBI: available PEBs: 0, total reserved PEBs: 160, PEBs reserved for bad PEB handling: 20
UBI: background thread "ubi_bgt8d" started, PID 93
UBI device number 8, total 160 LEBs (20316160 bytes, 19.4 MiB), UBIFS: background thread "ubifs_bgt8_0" started, PID 95
available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 8, volume 0, name "sys_data"
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 15872000 bytes (15 MiB, 125 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs)
UBIFS: reserved for root: 0 bytes (0 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID EFB92F9F-3453-47AE-80AA-24C2B39EC1C1, small LPT model
starting pid 102, tty '/dev/ttyS1': '/bin/sh'


BusyBox v1.12.1 () built-in shell (ash)
Enter 'help' for a list of built-in commands.

# Build Time : 2018-08-23, 16:02:19
[util_brd.c][read_protected_data_to_ram][200]: key=R3APGuNQ
Erasing 128 Kibyte @ 20000 -- 100 % complete 
ap_name=syslogd, action=start
[main]read config /etc/default.xml success
[CM_XML2RAM]xml file</tmp/sys_data/xmlx> to RAM ret=0
ap_name=coredump, action=start
sh: cannot create /proc/sys/kernel/core_pattern: nonexistent directory
Started WatchDog Timer.
FFFFFFFF:FFFFFFFF:FFFFFFFF:FFFFFFFF:FFFFFFFF:FFFFFFFF
Raeth v3.1 (Tasklet)
set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1
phy_free_head is 0xc18000!!!
phy_free_tail_phy is 0xc19ff0!!!
txd_pool=a0ca0000 phy_txd_pool=00CA0000
ei_local->skb_free start address is 0x870026cc.
free_txd: 00ca0010, ei_local->cpu_ptr: 00CA0000
 POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
----------------+---------+--------
     0xa0ca0000 0x00CA0000 0x00CA0000

phy_qrx_ring = 0x00c0b000, qrx_ring = 0xa0c0b000

phy_rx_ring0 = 0x00cb0000, rx_ring[0] = 0xa0cb0000
MT7530 Reset Completed!!
change HW-TRAP to 0x17c8f
set LAN/WAN LLLLW
GMAC1_MAC_ADRH -- : 0x0000749d
GMAC1_MAC_ADRL -- : 0x792ee62b
GDMA2_MAC_ADRH -- : 0x0000000c
GDMA2_MAC_ADRL -- : 0x43288018
eth3: ===> VirtualIF_open
MT7621 GE2 link rate to 1G
CDMA_CSG_CFG = 81000000
GDMA1_FWD_CFG = 20710000
GDMA2_FWD_CFG = 20710000
Chain 'FORWARD_WIFI' doesn't exist.
*****run project phy.
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
xhci-hcd xhci-hcd: xHCI Host Controller
xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 1
xhci-hcd xhci-hcd: irq 22, io mem 0x1e1c0000
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
xhci-hcd xhci-hcd: xHCI Host Controller
xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
led=10, on=1, off=3600, blinks=1, reset=1, time=1
restore_ft_tool get ftool header  sucess
get ftool magic check failed
ap_name=dnrd, action=start
get_wdev_by_idx: invalid idx(0)
ap_name=phy, action=start
switch reg write offset=2004, value=ff0003
switch reg write offset=2104, value=ff0003
switch reg write offset=2204, value=ff0003
switch reg write offset=2304, value=ff0003
switch reg write offset=2404, value=ff0003
switch reg write offset=2504, value=ff0003
switch reg write offset=2604, value=ff0003
switch reg write offset=2010, value=810000c0
switch reg write offset=2110, value=810000c0
switch reg write offset=2210, value=810000c0
switch reg write offset=2310, value=810000c0
switch reg write offset=2410, value=810000c0
switch reg write offset=2510, value=810000c0
switch reg write offset=2610, value=81000000
switch reg write offset=2710, value=81000000
switch reg write offset=2704, value=20ff0003
switch reg write offset=2610, value=81000000
ap_name=iptv_bridge, action=start
IPTV Port Mask 0000
old_vlan 1111
switch reg write offset=2014, value=10002
switch reg write offset=2114, value=10001
switch reg write offset=2214, value=10001
switch reg write offset=2314, value=10001
switch reg write offset=2414, value=10001
switch reg write offset=2514, value=10002
switch reg write offset=2614, value=10001
REG_ESW_WT_MAC_ATC is 0x7ff0002
done.
device eth2 entered promiscuous mode
Set: phy[31].reg[24] = 6ffff
Set: phy[31].reg[12512] = 2125
ap_name=lanip, action=start
br0: port 1(eth2) entered forwarding state
br0: port 1(eth2) entered forwarding state
Set: phy[1].reg[0] = 3300
info, udhcp server (v0.9.7) started
Open file "/tmp/sys_data/dhcp_lease_info" failed, errno:2(No such file or directory).
Read data from flash failed, errno:2(No such file or directory).
Load dhcp lease info from flash failed.
Set: phy[2].reg[0] = 3300
Set: phy[3].reg[0] = 3300
Set: phy[4].reg[0] = 3300
ap_name=telnetd, action=start
ap_name=sshd, action=start
ap_name=httpd, action=start
ap_name=redirect, action=start
bind: Address already in use
ap_name=dnrd, action=start redirect
ap_name=bftpd, action=start
ap_name=firewall, action=start
br0: port 1(eth2) entered forwarding state
x_tables: ip_tables: LOG.0 target: invalid size 32 (kernel) != (user) 264
x_tables: ip_tables: LOG.0 target: invalid size 32 (kernel) != (user) 264
x_tables: ip_tables: LOG.0 target: invalid size 32 (kernel) != (user) 264
x_tables: ip_tables: LOG.0 target: invalid size 32 (kernel) != (user) 264
x_tables: ip_tables: LOG.0 target: invalid size 32 (kernel) != (user) 264
x_tables: ip_tables: LOG.0 target: invalid size 32 (kernel) != (user) 264
x_tables: ip_tables: LOG.0 target: invalid size 32 (kernel) != (user) 264
x_tables: ip_tables: LOG.0 target: invalid size 32 (kernel) != (user) 264
x_tables: ip_tables: LOG.0 target: invalid size 32 (kernel) != (user) 264
x_tables: ip_tables: LOG.0 target: invalid size 32 (kernel) != (user) 264
x_tables: ip_tables: LOG.0 target: invalid size 32 (kernel) != (user) 264
get inteface eth3 mtu failed
ap_name=srt, action=restart
ap_name=rp, action=start
ap_name=mediaserver, action=restart
killall: minidlna: no process killed
ap_name=udpecho, action=restart
ap_name=ntp, action=start
ap_name=hwim, action=start
ap_name=cpm, action=start
get_wdev_by_idx: invalid idx(0)
ap_name=wanip, action=stop 1
ap_name=dnrd, action=stop wid 1
ap_name=fw_wan, action=restart 1 mss_wan
get inteface ppp1 mtu failed
ap_name=wanip, action=stop 2
ap_name=dnrd, action=stop wid 2
ap_name=hw_nat, action=stop
ap_name=fw_wan, action=restart 2 mss_wan
get inteface eth3.12 mtu failed
ap_name=wanip, action=stop 3
ap_name=igmp_proxy, action=stop 3
ap_name=dnrd, action=stop wid 3
ap_name=hw_nat, action=stop
ap_name=fw_wan, action=restart 3 mss_wan
get inteface eth3.11 mtu failed
ap_name=web_notifier, action=start
start_web_notifier: web notifier disable
ap_name=igd_upnp, action=start
register rlt_drv


=== pAd = c2e81000, size = 1417936 ===
1 Like
6
BootLog.StockFW.Part.2 

<-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
<-- RTMPAllocAdapterBlock, Status=0
pAd->CSRBaseAddress =0xc2d80000, csr_addr=0xc2d80000!
device_id =0x7603
RtmpChipOpsHook(507): Not support for HIF_MT yet!
mt7603_init()-->
mt_bcn_buf_init(224): Not support for HIF_MT yet!
<--mt7603_init()
ap_name=wlan, action=start
interface ra1 does not exist!
ifconfig: ioctl 0x8913 failed: No such device
device ra0 is not a slave of br0
device rai0 is not a slave of br0
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
DriverOwn()::Return since already in Driver Own...
===============================
Current DevInfo Num: 0
===============================
===============================
Current BssInfo Num: 0
===============================
===============================
Current StaRec Num: 0
===============================
APWdsInitialize():WdsEntry[0]
APWdsInitialize():WdsEntry[1]
APWdsInitialize():WdsEntry[2]
APWdsInitialize():WdsEntry[3]
[wifi_fwd_set_cb_num] band_cb_offset=33, recv_from_cb_offset=34
RtmpOSFileOpen(): Error 2 opening /etc/Wireless/iNIC/iNIC_ap_5G.dat
Open file "/etc/Wireless/iNIC/iNIC_ap_5G.dat" failed!
E2pAccessMode=2
SSID[0]=Beeline_5G_F13791, EdcaIdx=0
RTMPSetProfileParameters(): DBDC Mode=0
cfg_mode=14
cfg_mode=14
wmode_band_equal(): Band Equal!
[TxPower] BAND0: 100 
[PERCENTAGEenable] BAND0: 1 
APEdca0
APEdca1
APEdca2
APEdca3
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
default ApCliAPSDCapable[0]=0
default ApCliAPSDCapable[1]=0
rtmp_read_wds_from_file(): WDS Profile
APWdsInitialize():WdsEntry[0]
APWdsInitialize():WdsEntry[1]
APWdsInitialize():WdsEntry[2]
APWdsInitialize():WdsEntry[3]
WDS-Enable mode=0
HT: Ext Channel = BELOW
HT: greenap_cap = 0
WtcSetMaxStaNum: MaxStaNum:87, BssidNum:1, WdsNum:4, ApcliNum:2, MaxNumChipRept:32, MinMcastWcid:125
Top Init Done!
Use alloc_skb
RX[0] DESC a0c14000 size = 8192
RX[1] DESC a0c16000 size = 8192
Hif Init Done!
ctl->txq = c04f9400
ctl->rxq = c04f940c
ctl->ackq = c04f9418
ctl->kickq = c04f9424
ctl->tx_doneq = c04f9430
ctl->rx_doneq = c04f943c
mt7615_fw_prepare():FW(8a10), HW(8a10), CHIPID(7615))
mt7615_fw_prepare(2752): MT7615_E3, USE E3 patch and ram code binary image
AndesMTLoadRomMethodFwDlRing(1036), cap->rom_patch_len(11150)
AndesRestartCheck: Current TOP_MISC2(0x1)
AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
20170304031443a

platform = 
ALPS
hw/sw version = 
8a108a10
patch version = 
00000010
Patch SEM Status=2
MtCmdPatchSemGet:(ret = 0)

Patch is not ready && get semaphore success, SemStatus(2)
EventGenericEventHandler: CMD Success
MtCmdAddressLenReq:(ret = 0)
MtCmdPatchFinishReq
EventGenericEventHandler: CMD Success
Send checksum req..
Patch SEM Status=3
MtCmdPatchSemGet:(ret = 0)

Release patch semaphore, SemStatus(3)
AndesMTEraseRomPatch
WfMcuHwInit: Before NICLoadFirmware, check IcapMode=0
AndesMTLoadFwMethodFwDlRing(810), cap->fw_len(459960)
Build Date:_201705121437
Build Date:_201705121437
AndesRestartCheck: Current TOP_MISC2(0x1)
AndesRestartCheck: (TOP_MISC2 = 1), ready to continue...RET(0)
EventGenericEventHandler: CMD Success
MtCmdAddressLenReq:(ret = 0)
EventGenericEventHandler: CMD Success
MtCmdAddressLenReq:(ret = 0)
MtCmdFwStartReq: override = 1, address = 540672
EventGenericEventHandler: CMD Success
Build Date:_201703141726
EventGenericEventHandler: CMD Success
MtCmdAddressLenReq:(ret = 0)
MtCmdFwStartReq: override = 4, address = 0
EventGenericEventHandler: CMD Success
WfMcuHwInit: NICLoadFirmware OK, Check IcapMode=0
MCU Init Done!
efuse_probe: efuse = 10000212
RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5
RtmpEepromGetDefault::e2p_dafault=1
RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1
NVM is FLASH mode. dev_idx [1] FLASH OFFSET [0x8000]
NICReadEEPROMParameters():Calling eeinit
NICReadEEPROMParameters: EEPROM 0x52 b302
NICReadEEPROMParameters: EEPROM 0x52 b302
Country Region from e2p = 101
mt7615_antenna_default_reset(): TxPath = 4, RxPath = 4
mt7615_antenna_default_reset(): DBDC 2G TxPath = 2, 2G RxPath = 2
mt7615_antenna_default_reset(): DBDC 5G TxPath = 2, 2G RxPath = 2
rtmp_read_txpwr_from_eeprom(243): Don't Support this now!
RTMPReadTxPwrPerRate(1382): Don't Support this now!
RcRadioInit(): DbdcMode=0, ConcurrentBand=1
RcRadioInit(): pRadioCtrl=87646464,Band=0,rfcap=3,channel=1,PhyMode=2
MtCmdSetDbdcCtrl:(ret = 0)
Band Rf: 1, Phy Mode: 2
AntCfgInit(2787): Not support for HIF_MT yet!
MtSingleSkuLoadParam: RF_LOCKDOWN Feature ON !!!
MtSingleSkuLoadParam: SKU Table index = 0 
MtBfBackOffLoadTable: RF_LOCKDOWN Feature ON !!!
MtBfBackOffLoadTable: BFBackoff Table index = 0 
EEPROM Init Done!
mt_mac_init()-->
mt_mac_pse_init(2787): Don't Support this now!
mt7615_init_mac_cr()-->
mt7615_init_mac_cr(): TMAC_TRCR0=0x82783c8c
mt7615_init_mac_cr(): TMAC_TRCR1=0x82783c8c
MtAsicSetMacMaxLen(1313): Not finish Yet!
<--mt_mac_init()
CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0
CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0
CmdRxHdrTransBLUpdateRsp::EventExtCmdResult.u4Status = 0x0
MAC Init Done!
MT7615BBPInit():BBP Initialization.....
        Band 0: valid=1, isDBDC=0, Band=2, CBW=1, CentCh/PrimCh=1/1, prim_ch_idx=0, txStream=2
        Band 1: valid=0, isDBDC=0, Band=0, CBW=0, CentCh/PrimCh=0/0, prim_ch_idx=0, txStream=0
MT7615BBPInit() todo 
PHY Init Done!
tx_pwr_comp_init():NotSupportYet!
MtCmdSetMacTxRx:(ret = 0)
CountryCode(2.4G/5G)=1/13, RFIC=25, PHY mode(2.4G/5G)=49/49, support 25 channels
WifiSysOpen(), wdev idx = 0
wdev_attr_update(): wdevId0 = 74:9d:79:xx:xx:2d
MtCmdSetDbdcCtrl:(ret = 0)
ApAutoChannelAtBootUp----------------->
ApAutoChannelAtBootUp: AutoChannelBootup = 1, AutoChannelFlag = 1
MtCmdSetMacTxRx:(ret = 0)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 36,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 40,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 44,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 48,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
:MtCmdPktBudgetCtrl: bssid(255),wcid(65535),type(0)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [58] BW [2] from cetral freq [5290]  offset [1a00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 52,control_ch2=0, central_chl = 58 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [58] BW [2] from cetral freq [5290]  offset [1a00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 56,control_ch2=0, central_chl = 58 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [58] BW [2] from cetral freq [5290]  offset [1a00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 60,control_ch2=0, central_chl = 58 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [58] BW [2] from cetral freq [5290]  offset [1a00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 64,control_ch2=0, central_chl = 58 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [106] BW [2] from cetral freq [5530]  offset [1d00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 100,control_ch2=0, central_chl = 106 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [106] BW [2] from cetral freq [5530]  offset [1d00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 104,control_ch2=0, central_chl = 106 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [106] BW [2] from cetral freq [5530]  offset [1d00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 108,control_ch2=0, central_chl = 106 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [106] BW [2] from cetral freq [5530]  offset [1d00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 112,control_ch2=0, central_chl = 106 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [122] BW [2] from cetral freq [5610]  offset [1e00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 116,control_ch2=0, central_chl = 122 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [122] BW [2] from cetral freq [5610]  offset [1e00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 120,control_ch2=0, central_chl = 122 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [122] BW [2] from cetral freq [5610]  offset [1e00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 124,control_ch2=0, central_chl = 122 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [122] BW [2] from cetral freq [5610]  offset [1e00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 128,control_ch2=0, central_chl = 122 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [138] BW [2] from cetral freq [5690]  offset [1f00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 132,control_ch2=0, central_chl = 138 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [138] BW [2] from cetral freq [5690]  offset [1f00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 136,control_ch2=0, central_chl = 138 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [138] BW [2] from cetral freq [5690]  offset [1f00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 140,control_ch2=0, central_chl = 138 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [138] BW [2] from cetral freq [5690]  offset [1f00] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 144,control_ch2=0, central_chl = 138 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [155] BW [2] from cetral freq [5775]  offset [2000] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 149,control_ch2=0, central_chl = 155 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [155] BW [2] from cetral freq [5775]  offset [2000] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 153,control_ch2=0, central_chl = 155 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [155] BW [2] from cetral freq [5775]  offset [2000] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 157,control_ch2=0, central_chl = 155 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
[DfsSwitchCheck]: DFS ByPass TX calibration.
mt7615_apply_dcoc() : reload Central CH [155] BW [2] from cetral freq [5775]  offset [2000] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 161,control_ch2=0, central_chl = 155 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(1)
====================================================================
Channel  36 : Busy Time =    247, Skip Channel = FALSE, BwCap = TRUE
Channel  40 : Busy Time =  10571, Skip Channel = FALSE, BwCap = TRUE
Channel  44 : Busy Time =    230, Skip Channel = FALSE, BwCap = TRUE
Channel  48 : Busy Time =    214, Skip Channel = FALSE, BwCap = TRUE
====================================================================
Rule 3 Channel Busy time value : Select Primary Channel 48 
Rule 3 Channel Busy time value : Min Channel Busy = 10571
Rule 3 Channel Busy time value : BW = 80
 AutoChSelUpdateChannel(): Update channel for wdev0 for this band PhyMode = 49,Channel = 48  
ApAutoChannelAtBootUp<-----------------
Current Channel is 48. DfsZeroWaitSupport=0
MtAsicSetChBusyStat(865): Not support for HIF_MT yet!
[PMF]APPMFInit:: apidx=0, MFPC=0, MFPR=0, SHA256=0
[PMF]WPAMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
HcUpdatePhyMode(): Update PhyMode for all wdev for this band PhyMode:49,Channel=48
CountryCode(2.4G/5G)=1/13, RFIC=25, PHY mode(2.4G/5G)=49/49, support 25 channels
Enable 20/40 BSSCoex Channel Scan(BssCoex=1)
wtc_acquire_groupkey_wcid: Found a non-occupied wtbl_idx:127 for WDEV_TYPE:1
 LinkToOmacIdx = 0, LinkToWdevType = 1
bssUpdateBmcMngRate (BSS_INFO_BROADCAST_INFO),                 CmdBssInfoBmcRate.u2BcTransmit= 8192,                 CmdBssInfoBmcRate.u2McTransmit = 8196
[RadarStateCheck]Set into RD_NORMAL_MODE
MtCmdTxPowerSKUCtrl: fgTxPowerSKUEn: 0, BandIdx: 0
MtCmdTxPowerPercentCtrl: fgTxPowerPercentEn: 1, BandIdx: 0
MtCmdTxBfBackoffCtrl: fgTxBFBackoffEn: 0, BandIdx: 0
mt7615_bbp_adjust():rf_bw=2, ext_ch=3, PrimCh=48, HT-CentCh=46, VHT-CentCh=42
mt7615_apply_dcoc() : reload Central CH [42] BW [2] from cetral freq [5210]  offset [1900] 
MtCmdGetRXDCOCCalResult:(ret = 0)
mt7615_apply_cal_data() : eeprom 0x52 bit 0 is 0, do runtime cal , skip TX reload
MtCmdChannelSwitch: control_chl = 48,control_ch2=0, central_chl = 42 DBDCIdx= 0, Band= 0 
BW = 2,TXStream = 4, RXStream = 4, scan(0)
ap_phy_rrm_init_byRf(): AP Set CentralFreq at 42(Prim=48, HT-CentCh=46, VHT-CentCh=42, BBP_BW=2)
[WrapDfsRadarDetectStart]: Band0Ch is 48[WrapDfsRadarDetectStart]: Band1Ch is 0LeadTimeForBcn, OmacIdx = 0, WDEV_WITH_BCN_ABILITY
MtAsicSetRalinkBurstMode(2618): Not support for HIF_MT yet!
MtAsicSetPiggyBack(802): Not support for HIF_MT yet!
MtAsicSetTxPreamble(2597): Not support for HIF_MT yet!
WifiFwdSet::disabled=0
Main bssid = 74:9d:79:xx:xx:2d
AsicRadioOnOffCtrl(): DbdcIdx=0 RadioOn
MtCmdSetMacTxRx:(ret = 0)
fdb_enable()
MCS Set = ff ff ff ff 01
<==== mt_wifi_init, Status=0
MtCmdEDCCACtrl: BandIdx: 0, EDCCACtrl: 1 
MtCmdEDCCACtrl: BandIdx: 1, EDCCACtrl: 1 
WDS_Init():
The new WDS interface MAC = FF:FF:FF:FF:FF:FF
  MacTabMatchWCID = 0
The new WDS interface MAC = FF:FF:FF:FF:FF:FF
  MacTabMatchWCID = 0
The new WDS interface MAC = FF:FF:FF:FF:FF:FF
  MacTabMatchWCID = 0
The new WDS interface MAC = FF:FF:FF:FF:FF:FF
  MacTabMatchWCID = 0
Total allocated 4 WDS interfaces!
WtcSetMaxStaNum: MaxStaNum:87, BssidNum:1, WdsNum:4, ApcliNum:2, MaxNumChipRept:32, MinMcastWcid:125
red_is_enabled: set CR4/N9 RED Enable to 1.
cp_support_is_enabled: set CR4 CP_SUPPORT to Mode 2.
Correct apidx from 0 to 0 for WscUUIDInit
Generate UUID for apidx(0)
UUID: c01b35a0, len = 16
0x0000 : bc 32 9e 00 1d d8 11 b2 86 01 74 9d 79 xx xx 2d 

device rai0 entered promiscuous mode
br0: port 2(rai0) entered forwarding state
br0: port 2(rai0) entered forwarding state
TX_BCN DESC a0cc4000 size = 320
RX[0] DESC a0cc8000 size = 2048
RX[1] DESC a0cc9000 size = 2048
E2pAccessMode=2
cfg_mode=9
cfg_mode=9
wmode_band_equal(): Band Equal!
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
default ApCliAPSDCapable[0]=0
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
FW Version:ap_pcie
FW Build Date:20160107100755
CmdAddressLenReq:(ret = 0)
CmdFwStartReq: override = 1, address = 1048576
CmdStartDLRsp: WiFI FW Download Success
AsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
efuse_probe: efuse = 10000002
RtmpChipOpsEepromHook::e2p_type=2, inf_Type=5
RtmpEepromGetDefault::e2p_dafault=1
RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 1
NVM is FLASH mode, flash_offset = 0x0
1. Phy Mode = 14
@@@  NICReadEEPROMParameters : pAd->FWLoad=0 
Country Region from e2p = ffff
tssi_1_target_pwr_g_band = 36
2. Phy Mode = 14
3. Phy Mode = 14
NICInitPwrPinCfg(14): Not support for HIF_MT yet!
NICInitializeAsic(584): Not support rtmp_mac_sys_reset () for HIF_MT yet!
mt_mac_init()-->
mt7603_init_mac_cr()-->
AsicSetMacMaxLen(1826): Set the Max RxPktLen=1024!
<--mt_mac_init()
        WTBL Segment 1 info:
                MemBaseAddr/FID:0x28000/0
                EntrySize/Cnt:32/128
        WTBL Segment 2 info:
                MemBaseAddr/FID:0x40000/0
                EntrySize/Cnt:64/128
        WTBL Segment 3 info:
                MemBaseAddr/FID:0x42000/64
                EntrySize/Cnt:64/128
        WTBL Segment 4 info:
                MemBaseAddr/FID:0x44000/128
                EntrySize/Cnt:32/128
MtAsicACQueue: Write CR:21510, Value=10421
MtAsicACQueue: Write CR:21500, Value=10421
AntCfgInit(2567): Not support for HIF_MT yet!
RTMPSetPhyMode(): channel out of range, use first ch=0
MCS Set = ff ff 00 00 01
br0: port 2(rai0) entered forwarding state
[PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0
[PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
[PMF]ap_pmf_init:: apidx=1, MFPC=0, MFPR=0, SHA256=0
AsicSetRalinkBurstMode(4148): Not support for HIF_MT yet!
RTMPSetPiggyBack(876): Not support for HIF_MT yet!
AsicSetTxPreamble(4135): Not support for HIF_MT yet!
AsicAddSharedKeyEntry(1992): Not support for HIF_MT yet!
The 4-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 4
AsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xa0
Main bssid = 74:9d:79:xx:xx:2b
<==== rt28xx_init, Status=0
@@@ ed_monitor_init : ===>
@@@ ed_monitor_init : <===
mt7603_set_ed_cca: TURN ON EDCCA mac 0x10618 = 0xd7c87d0f, EDCCA_Status=1
WiFi Startup Cost (ra0): 3.532s
device ra0 entered promiscuous mode
br0: port 3(ra0) entered forwarding state
br0: port 3(ra0) entered forwarding state
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
ap_name=wlan_guest_portal, action=start
ap_name=qtbl, action=start
Insert quick routing module ...
<0> ######DUMP QUICK TABLE FUNC ADDR#######
<0> skb_dev_in_qtl:c308bf7c
<0> CheckSumModify:c308b000
<0> update_conntrack_time:c308c368
<0> matchFromLan:c308c7d4
<0> matchFromWan:c308c414
<0> doMatch:c308cb8c
<0> MyCheckSum:c308b104
<0> CheckSumDlt:c308b14c
<0> checkEntry:c308bdcc
<0> delEntry:c308b6f4
<0> addEntry:c308bc14
<0> checkValidQTEntry:c308b2f8
<0> updateQtlWhenPktXmit:c308c000
<0> qtbl_read_proc:c308b904
<0> qtbl_write_proc:c308b6a4
<0> ######DUMP QUICK TABLE FUNC ADDR END#######
ap_name=hw_nat, action=start
Ralink HW NAT Module Enabled
eth2 ifindex =5
eth3 ifindex =8
<0> file:net/nat/hw_nat/hwnat_ioctl.c, line:259, result:0.
Device Instance
        WDEV 00:
                Name:rai0
                Wdev(list) Idx:0
                 Idx:4
***********dev->ifindex = 4
        WDEV 01:
                Name:wdsi0
                Wdev(list) Idx:1
                 Idx:10
***********dev->ifindex = a
        WDEV 02:
                Name:wdsi1
                Wdev(list) Idx:2
                 Idx:11
***********dev->ifindex = b
        WDEV 03:
                Name:wdsi2
                Wdev(list) Idx:3
                 Idx:12
***********dev->ifindex = c
        WDEV 04:
                Name:wdsi3
                Wdev(list) Idx:4
                 Idx:13
***********dev->ifindex = d
        WDEV 05:
                Name:apclii0
                Wdev(list) Idx:5
                 Idx:14
***********dev->ifindex = e
        WDEV 06:
        WDEV 07:
        WDEV 08:
        WDEV 09:
        WDEV 10:
        WDEV 11:
        WDEV 12:
        WDEV 13:
        WDEV 14:
        WDEV 15:
        WDEV 16:
        WDEV 17:
        WDEV 18:
        WDEV 19:
        WDEV 20:
        WDEV 21:
Set HwnatEn = 1
ap_name=cron, action=start
ap_name=networkmap, action=start
sh: cannot create /proc/sys/kernel/disable_kswapd: nonexistent directory
nmap_main.c[main][82][46]:main pid 1669 ppid 1
nmap_active_detect.c[nmap_other_subnet_detect_func][592][46]:other subnet detect  pid 1691 ppid 1690
nmap_main.c[nmap_wait_and_process_thread_func][449][46]:packet handle process pid 1695 ppid 1690
nmap_main.c[nmap_wait_and_process_thread_func][449][46]:packet handle process pid 1696 ppid 1690
nmap_main.c[nmap_wait_and_process_thread_func][449][46]:packet handle process pid 1698 ppid 1690
nmap_main.c[nmap_wait_and_process_thbr0: port 3(ra0) entered forwarding state
read_func][449][46]:packet handle process pid 1697 ppid 1690
nmap_main.c[nmap_wait_and_process_thread_func][449][46]:packet handle process pid 1699 ppid 1690
nmap_main.c[nmap_detect_thread_func][391][46]:active detect process pid 1700 ppid 1690
nmap_main.c[nmap_refresh_thread_func][403][46]:refresh process pid 1701 ppid 1690
nmap_main.c[nmap_server_thread_func][468][46]:server process pid 1702 ppid 1690
nmap_main.c[nmap_monitor_thread_func][458][46]:monitor process pid 1703 ppid 1690
nmap_main.c[nmap_detect_thread_func][391][46]:active detect process pid 1704 ppid 1690
ap_name=switch, action=start
ap_name=qos_service, action=start
ACL start
return num of index list == 7
ruleNum == 7
patternNum == 8
switch reg write offset=44, value=161117
switch reg write offset=2004, value=1ff0403
switch reg write offset=2104, value=2ff0403
switch reg write offset=2204, value=2ff0403
switch reg write offset=2304, value=2ff0403
switch reg write offset=2404, value=2ff0403
switch reg write offset=1600, value=80000000
switch reg write offset=1608, value=80000000
switch reg write offset=1610, value=80000000
switch reg write offset=1618, value=80000000
switch reg write offset=1620, value=80000000
switch reg write offset=1628, value=80000000
switch reg write offset=1630, value=80000000
switch reg write offset=1638, value=80000000
switch reg write offset=1500, value=80000000
switch reg write offset=1508, value=80000000
switch reg write offset=1510, value=80000000
switch reg write offset=1518, value=80000000
switch reg write offset=1520, value=80000000
switch reg write offset=1528, value=80000000
switch reg write offset=1530, value=80000000
switch reg write offset=1538, value=80000000
switch reg write offset=48, value=9080000
switch reg write offset=4c, value=1b581250
switch reg write offset=50, value=2da824a0
switch reg write offset=54, value=3ff836f0
Set: phy[0].reg[4] = 01e1
Set: phy[1].reg[4] = 01e1
Set: phy[2].reg[4] = 01e1
Set: phy[3].reg[4] = 01e1
Set: phy[4].reg[4] = 01e1
switch reg read offset=3608, value=3b
switch reg read offset=3508, value=3b
switch reg write offset=94, value=f000000
switch reg write offset=98, value=a1f00
switch reg write offset=90, value=8000503c
switch reg write offset=94, value=0
switch reg write offset=98, value=10000000
switch reg write offset=90, value=8000901e
switch reg write offset=94, value=1a000007
switch reg write offset=98, value=0
switch reg write offset=90, value=8000b01e
switch reg write offsetInit Ingress Classify module ...
=94, value=ffff749d
switch reg write offset=98,Change WAN TR069 match  from <0> to <1>

 value=80f00
switch reg write offset=90, value=8000503d
switchChange l2tp control match  from <0> to <1>

 reg write offset=94, value=ffff792e
switch regChange iptv packet classify from <0> to <1>

 write offset=98, value=80f02
switch reg write Change non ip packet classify from <0> to <0>

offset=90, value=8000503e
switch reg write offsChange dscp match  from <0> to <1>

et=94, value=ffffe62b
switch reg write offset=98, value=80f04
Add dscp match  from range idx=0,start_dscp=34,end_dscp=34
switch reg write offset=90, value=8000503f
switch reg write offset=94, value=ffff1d7b
switch reg write offset=98, value=c0100
switch reg write offset=90, value=80005008
swiChange RxRingThrehold  from <512> to <1024>

tch reg write offset=94, value=fc0088
switch reg write offset=98, value=a1e00
switch reg write offset=90, value=80005007
switch reg write offset=94, value=1000100
switch reg write offset=98, value=81f00
switch reg write offset=90, value=80005006
switch reg write offset=94, value=ffff0035
switch reg write offset=98, value=cff00
switch reg write offset=90, value=80005005
switch reg write offset=94, value=ffffc021
switch reg write offset=98, value=d010a
switch reg write offset=90, value=80005004
switch reg write offset=94, value=ffffff03
switch reg write offset=98, value=d0108
switch reg write offset=90, value=80005003
switch reg write offset=94, value=80008000
switch reg write offset=98, value=d0100
switch reg write offset=90, value=80005002
switch reg write offset=94, value=ffff06a5
switch reg write offset=98, value=c0100
switch reg write offset=90, value=80005001
switch reg write offset=94, value=0
switch reg write offset=98, value=e0000000
switch reg write offset=90, value=8000901f
switch reg write offset=94, value=8000000
switch reg write offset=98, value=0
switch reg write offset=90, value=8000b01f
switch reg write offset=94, value=80
switch reg write offset=98, value=0
switch reg write offset=90, value=80009006
switch reg write offset=94, value=c000040
switch reg write offset=98, value=0
switch reg write offset=90, value=8000b006
switch reg write offset=94, value=40
switch reg write offset=98, value=0
switch reg write offset=90, value=80009005
switch reg write offset=94, value=e000060
switch reg write offset=98, value=0
switch reg write offset=90, value=8000b005
switch reg write offset=94, value=120
switch reg write offset=98, value=0
switch reg write offset=90, value=80009004
switch reg write offset=94, value=d000050
switch reg write offset=98, value=0
switch reg write offset=90, value=8000b004
switch reg write offset=94, value=2
switch reg write offset=98, value=0
switch reg write offset=90, value=80009003
switch reg write offset=94, value=b000030
switch reg write offset=98, value=0
switch reg write offset=90, value=8000b003
switch reg write offset=94, value=1a
switch reg write offset=98, value=0
switch reg write offset=90, value=80009002
switch reg write offset=94, value=f000070
switch reg write offset=98, value=0
switch reg write offset=90, value=8000b002
switch reg write offset=94, value=6
switch reg write offset=98, value=0
switch reg write offset=90, value=80009001
switch reg write offset=94, value=f000070
switch reg write offset=98, value=0
switch reg write offset=90, value=8000b001
check iptablesbles and proc success
ESW: Link Status Changed - Port2 Link UP
ESW: Link Status Changed - Port2 Link Down
1 Like
7

@MaxS0niX Could you share details on how the breed bootloader and breed update file was created for this device ?

https://github.com/MaxS0niX/smartbox-turbo-tools/blob/main/breed/sbtp.bin

https://github.com/MaxS0niX/smartbox-turbo-tools/blob/main/openwrt-19.07.7-ramips-mt7621-beeline_smartbox-turbo-plus-squashfs-breed.bin

8

Bootloader Breed was taken from Inflabz, which in turn was edited by Hackpascal for the Xiaomi 3Gv1. It is no longer required at the moment, but can be used at will as you can use U-boot over UART. U-boot requires resetting the boot counter on successful boot. The partitions will change. PR will be updated shortly. The work is still ongoing.

2 Likes
9

UART - Serial Console

[J4] on PCB

  1. GND
  2. TX
  3. 3.3V (VCC) - Don't connect
  4. RX
  • Solder bridges R53 and R54. If you do not connect, the line TX and RX will be broken.
  • Baud rate 57600 8n1
Photo before

Снимок экрана_2021-06-22_00-26-48
Снимок экрана_2021-06-22_00-26-48793×460 522 KB

Photo after

IMG_20210622_003739
IMG_20210622_0037392643×1518 994 KB

1 Like
10

@markbirss, for which device do you need the breed bootloader?

1 Like
11

ideally no device, as requiring Breed bootloader (or installing any closed source blob that is not from original vendor, for example an old firmware version is ok, a bootloader from third parties is not) is a disqualifier for merging in OpenWrt afaik
Or is breed opensource now?

12

Breed still isn't open source. But sometimes it has no good alternative because of the bug / feature. Afaik the PR is being adapting now for the stock U-boot.

1 Like
13

actually i do not have a specific device that i need breed for, but it has some nice features built in e.g overclocking that u-boot does not provide

i have for example 1 device which has breed but does not yet offer mainline openwrt

ZBT RP102
https://fccid.io/2AC47-RP102/Internal-Photos/Internal-Photos-4115688

14

Not all breeds allow overclock. Breed for subj based on Xiaomi mir3g and has no overclock function. The main purpose - debricking without UART and soldering, high-precision work with mtd, handle this bug-feature.

1 Like
15

Log Shell U-Boot

? - alias for 'help' 
MT7621 # ?
?       - alias for 'help'
bootm   - boot application image from memory
go      - start application at address 'addr'
help    - print online help
loadb   - load binary file over serial line (kermit mode)
md      - memory display
mdio    - Ralink PHY register R/W command !!
mm      - memory modify (auto-incrementing)
nand    - nand command
nm      - memory modify (constant address)
printenv- print environment variables
reset   - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
sc_boot - Sercomm boot kernel command
sc_btver- Sercomm display bootloader version command
sc_dl   - Sercomm upgrade command
sc_endian       - Sercomm debug command to test current system endian
sc_eth_test     - Sercomm: ethernet test command
sc_fl_map       - Sercomm dump flash map command
sc_gpio - Sercomm gpio command
sc_led  - Sercomm led command
sc_nand - Sercomm nand command
sc_phy  - Sercomm R/W PHY register
sc_ramtest      - Sercomm DRAM test command
sc_time - Sercomm timer command
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
bootm - boot application image from memory 
MT7621 # ? bootm
bootm [addr [arg ...]]
    - boot application image stored in memory
        passing arguments 'arg ...'; when booting a Linux kernel,
        'arg' can be the address of an initrd image
go - start application at address 'addr' 
MT7621 # ? go
go addr [arg ...]
    - start application at address 'addr'
      passing 'arg' as arguments
help - print online help 
MT7621 # ? help
help [command ...]
    - show help information (for 'command')
'help' prints online help for the monitor commands.

Without arguments, it prints a short usage message for all commands.

To get detailed help information for specific commands you can type
'help' with one or more command names as arguments.
loadb - load binary file over serial line (kermit mode) 
MT7621 # ? loadb
loadb [ off ] [ baud ]
    - load binary file over serial line with offset 'off' and baudrate 'baud'
md - memory display 
MT7621 # ? md
md [.b, .w, .l] address [# of objects]
    - memory display

MT7621 # md.l bbffff80
bbffff80: ffffffff ffffffff ffffffff ffffffff    ................
bbffff90: ffffffff ffffffff ffffffff ffffffff    ................
bbffffa0: ffffffff ffffffff ffffffff ffffffff    ................
bbffffb0: ffffffff ffffffff ffffffff ffffffff    ................
bbffffc0: ffffffff ffffffff ffffffff ffffffff    ................
bbffffd0: ffffffff ffffffff ffffffff ffffffff    ................
bbffffe0: ffffffff ffffffff ffffffff ffffffff    ................
bbfffff0: ffffffff ffffffff ffffffff ffffffff    ................
bc000000: baddbadd baddbadd baddbadd baddbadd    ................
bc000010: baddbadd baddbadd baddbadd baddbadd    ................
bc000020: baddbadd baddbadd baddbadd baddbadd    ................
bc000030: baddbadd baddbadd baddbadd baddbadd    ................
bc000040: baddbadd baddbadd baddbadd baddbadd    ................
bc000050: baddbadd baddbadd baddbadd baddbadd    ................
bc000060: baddbadd baddbadd baddbadd baddbadd    ................
bc000070: baddbadd baddbadd baddbadd baddbadd    ................
mdio - Ralink PHY register R/W command !! 
MT7621 # ? mdio
mdio mdio.r [phy_addr(dec)] [reg_addr(dec)] 
mdio.w [phy_addr(dec)] [reg_addr(dec)] [data(HEX)] 
mdio.anoff GMAC1 Force link status enable !!  
mdio.anon GMAC1 Force link status disable !!  
mdio.wb [phy register(dec)] [bit offset(Dec)] [Value(0/1)]  
mdio.d - dump all Phy registers 
mdio.d [phy register(dec)] - dump Phy registers
mm - memory modify (auto-incrementing) 
MT7621 # ? mm
mm [.b, .w, .l] address
    - memory modify, auto increment address
nand - nand command 
MT7621 # ? nand
nand nand usage:
  nand id
  nand read <addr> <len>
  nand write <addr> <data...>
  nand page <number>
  nand erase <addr> <len>
  nand oob <number>
  nand dump
  nand init
nm - memory modify (constant address) 
MT7621 # ? nm
nm [.b, .w, .l] address
    - memory modify, read and keep address
printenv- print environment variables 
MT7621 # ? printenv
printenv 
    - print values of all environment variables
printenv name ...
    - print value of environment variable 'name'

MT7621 # printenv
bootcmd=tftp
bootdelay=1
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
BootType=3
filesize=525194
fileaddr=84000000
ipaddr=10.10.10.123
serverip=10.10.10.3
autostart=no
bootfile=test.bin
stdin=serial
stdout=serial
stderr=serial
reset - Perform RESET of the CPU 
MT7621 # ? reset
reset - No help available.
saveenv - save environment variables to persistent storage 
MT7621 # saveenv
Saving Environment to NAND Flash...
Erasing NAND Flash...
ranand_erase: start:80000, len:20000 
.Writing to NAND Flash...
done
sc_boot - Sercomm boot kernel command 
MT7621 # ? sc_boot
sc_boot sc_boot usage:
        sc_boot
sc_btver- Sercomm display bootloader version command 
MT7621 # sc_btver
SC_DEBUG: Nand Partition Table Magic Found at 100000.

******************************************
    Uboot StandAlone Entry
******************************************

******************************************************
    Sercomm Boot Version 2.0.0.0    at Mar  6 2018  19:39:55

******************************************************
sc_dl - Sercomm upgrade command 
MT7621 # ? sc_dl
sc_dl sc_dl usage:
        sc_dl [debug_level] 
         debug_level = [0,3] 
        0 - all
        1 - warn
        2 - info
        3 - error
        default is 2

MT7621 # sc_dl 0
SC_DEBUG: Nand Partition Table Magic Found at 100000.

******************************************
    Uboot StandAlone Entry
******************************************
DEBUG_INF:===================================================
DEBUG_INF:Sercomm Upgrade(Module Ver 2.16.01.31) Start!
DEBUG_INF:===================================================
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!! 
ECC bytes for page : 28
DEBUG_INF:ecc bytes 28 
DEBUG_DBG:<boot-version        > has been read before erased!
DEBUG_DBG:<boot-pid            > has been read before erased!
DEBUG_DBG:<calibration1        > has been read before erased!
DEBUG_DBG:<calibration2        > has been read before erased!
DEBUG_DBG:<mac                 > has been read before erased!
DEBUG_DBG:<CSN                 > has been read before erased!
DEBUG_DBG:<language ID         > has been read before erased!
DEBUG_DBG:<Domain ID           > has been read before erased!
DEBUG_DBG:<PCBASN              > has been read before erased!
DEBUG_DBG:<PIN                 > has been read before erased!
DEBUG_DBG:<SSID                > has been read before erased!
DEBUG_DBG:<Passphrase          > has been read before erased!
DEBUG_DBG:<boot_flag           > has been read before erased!
DEBUG_DBG:<boot_count1         > has been read before erased!
DEBUG_DBG:<boot_count2         > has been read before erased!
DEBUG_DBG:<header_mian_kernel  > has been read before erased!
DEBUG_DBG:<header_bk_kernel    > has been read before erased!
DEBUG_DBG:=============================================
DEBUG_DBG:All parameters information listed:
DEBUG_DBG:=============================================
DEBUG_DBG:Partition Index 0, Name <u-boot>:
DEBUG_DBG:-----------------------------------
DEBUG_DBG:Param Name          good_blk_idx   offs_in_blk    length         Actionl
DEBUG_DBG:boot-version        4              ffb0           4              UPDATED
DEBUG_DBG:boot-pid            4              ffba           46             UPDATED
DEBUG_DBG:
DEBUG_DBG:Partition Index 2, Name <factory-data>:
DEBUG_DBG:-----------------------------------
DEBUG_DBG:Param Name          good_blk_idx   offs_in_blk    length         Actionl
DEBUG_DBG:calibration1        0              0              1000            KEPT
DEBUG_DBG:calibration2        0              8000           1000            KEPT
DEBUG_DBG:mac                 1              1000           6               KEPT
DEBUG_DBG:CSN                 1              1010           c               KEPT
DEBUG_DBG:language ID         1              1040           4               KEPT
DEBUG_DBG:Domain ID           1              1050           4               KEPT
DEBUG_DBG:PCBASN              1              1060           c               KEPT
DEBUG_DBG:PIN                 1              1070           8               KEPT
DEBUG_DBG:SSID                1              1080           20              KEPT
DEBUG_DBG:Passphrase          1              10a0           40              KEPT
DEBUG_DBG:
DEBUG_DBG:Partition Index 3, Name <dual-flag>:
DEBUG_DBG:-----------------------------------
DEBUG_DBG:Param Name          good_blk_idx   offs_in_blk    length         Actionl
DEBUG_DBG:boot_flag           0              0              8              UPDATED
DEBUG_DBG:boot_count1         1              1              1              UPDATED
DEBUG_DBG:boot_count2         1              2              1              UPDATED
DEBUG_DBG:
DEBUG_DBG:Partition Index 4, Name <uImage1>:
DEBUG_DBG:-----------------------------------
DEBUG_DBG:Param Name          good_blk_idx   offs_in_blk    length         Actionl
DEBUG_DBG:header_mian_kernel  0              0              100            UPDATED
DEBUG_DBG:
DEBUG_DBG:Partition Index 5, Name <uImage2>:
DEBUG_DBG:-----------------------------------
DEBUG_DBG:Param Name          good_blk_idx   offs_in_blk    length         Actionl
DEBUG_DBG:header_bk_kernel    0              0              100            UPDATED
DEBUG_DBG:
DEBUG_DBG:=============================================
DEBUG_DBG:init state, listening
sc_endian - Sercomm debug command to test current system endian 
MT7621 # ? sc_endian
sc_endian
sc_eth_test - Sercomm: ethernet test command 
MT7621 # ? sc_eth_test
sc_eth_test 
sc_eth_test  <PORT> <SPEED> <MODE>
sc_fl_map - Sercomm dump flash map command 
MT7621 # ? sc_fl_map
sc_fl_map sc_fl_map usage:
         sc_fl_map

MT7621 # sc_fl_map
SC_DEBUG: Nand Partition Table Magic Found at 100000.

******************************************
    Uboot StandAlone Entry
******************************************
********************************************
Flash Map Information
********************************************
Partition           Offset      Length      
u-boot              0           100000      
part_map            100000      100000      
factory-data        200000      100000      
dual-flag           300000      100000      
uImage1             400000      600000      
uImage2             a00000      600000      
rootfs1             1000000     2000000     
rootfs2             3000000     2000000     
config/log          5000000     1400000     
app-tmp             6400000     1b80000     

-----------------------------------------
Persist Partition:

part_map
factory-data
app-tmp

----------------------------------------
Sercomm Private:

Name                Offset      Length      
calibration1        200000      1000        
calibration2        208000      1000        
mac                 221000      6           
CSN                 221010      c           
language ID         221040      4           
Domain ID           221050      4           
PCBASN              221060      c           
PIN                 221070      8           
SSID                221080      20          
Passphrase          2210a0      40          
boot-version        8ffb0       4           
boot-pid            8ffba       46          
boot_flag           300000      8           
boot_count1         320001      1           
boot_count2         320002      1           
header_mian_kernel  400000      100         
header_bk_kernel    a00000      100
sc_gpio - Sercomm gpio command 
MT7621 # ? sc_gpio
sc_gpio usage:
        sc_gpio d : display gpio register values
        sc_gpio i <gpio_num> : set certain gpio as input
        sc_gpio o <gpio_num> : set certain gpio as output
        sc_gpio w <gpio_num> <1|0> : set gpio high or low
        sc_gpio r <gpio_num> : get gpio input
        sc_gpio m : do gpio init

MT7621 # sc_gpio d
SC_DEBUG: Nand Partition Table Magic Found at 100000.

******************************************
    Uboot StandAlone Entry
******************************************

*********************************************************
GPIO_MUX        [0xbe000060]:    0x000a85ac
GPIO31_0_DIR    [0xbe000600]:    0x0001b518
GPIO31_0_DATA   [0xbe000620]:    0xffd5d59f
GPIO63_32_DIR   [0xbe000604]:    0x00000000
GPIO63_32_DATA  [0xbe000624]:    0x100007ff
GPIO95_64_DIR   [0xbe000608]:    0x00000000
GPIO95_64_DATA  [0xbe000628]:    0x00000000
*********************************************************
sc_led - Sercomm led command 
MT7621 # ? sc_led
sc_led sc_led usage:
         sc_led on  all
         sc_led off all
         sc_led on      <led_num>
         sc_led off <led_num>
         sc_led info

MT7621 # sc_led info
SC_DEBUG: Nand Partition Table Magic Found at 100000.

******************************************
    Uboot StandAlone Entry
******************************************
--------------------------------------------
Name                ID     GPIO_PIN
--------------------------------------------
LED_LAN1            1      4      
LED_LAN2            2      3      
LED_LAN3            3      12     
LED_LAN4            4      10     
LED_WAN             5      8      
LED_ETH_G           6      13     
LED_USB             7      15     
LED_WIFI            8      16     
RESET_BUTTON        10     14     
WPS_BUTTON          11     11
sc_nand - Sercomm nand command 
MT7621 # ? sc_nand
sc_nand sc_nand usage:
        sc_nand r <offsets> : dump page data and oob by given offset(inhex)
        sc_nand w <offsets> <data>: write one byte data on flash
        sc_nand e <block_num> : erase block(in HEX)
        sc_nand markbad <offsets> : mark one block as bad block
        sc_nand clearbad <offsets> : clear one block which is marked bad
        sc_nand b : scan all bad block
        sc_nand b <block_num> : print the block is good block or bad block(in HEX)
        sc_nand oob : dump oob of first page for whole flash

MT7621 # sc_nand r 0x300000
SC_DEBUG: Nand Partition Table Magic Found at 100000.

******************************************
    Uboot StandAlone Entry
******************************************
Nand Flash: Block Size 0x20000, Page Size 0x800, OOB Size 0x40 Total Size 0x7f80000.
Nand Read Page at offs 0x300000, round(0x300000)

0x0000: 53  65  72  63  6f  6d  6d  31  00  ff  ff  ff  ff  ff  ff  ff  
0x0010: ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  
0x0020: ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff
[...]
0x07d0: ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  
0x07e0: ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  
0x07f0: ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  
OOB:

0x0000: ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  
0x0010: ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  ff  
0x0020: d7  96  bf  8e  3f  c6  fb  ff  26  20  98  1b  87  6e  fc  ff  
0x0030: 26  20  98  1b  87  6e  fc  ff  26  20  98  1b  87  6e  fc  ff
sc_phy - Sercomm R/W PHY register 
MT7621 # ? sc_phy
sc_phy sc_phy usage:
    sc_phy <w|r> <PHY_ADDR> <REG_ADDR> [DATA]
sc_ramtest - Sercomm DRAM test command 
MT7621 # ? sc_ramtest
sc_ramtest sc_ramtest usage:
    sc_ramtest <start_offset> <end_offset> [times]
sc_time - Sercomm timer command 
MT7621 # ? sc_time
sc_time sc_time usage:
sc_time [time_in_second]
setenv - set environment variables 
MT7621 # ? setenv
setenv name value ...
    - set environment variable 'name' to 'value ...'
setenv name
    - delete environment variable 'name'

MT7621 # setenv BootType 1
tftpboot- boot image via network using TFTP protocol 
MT7621 # ? tftpboot
tftpboot [loadAddress] [bootfilename]
version - print monitor version 
MT7621 # version

U-Boot 1.1.3 (Mar  6 2018 - 19:39:59)
2 Likes
16

Layout U-boot

0x0     - 0x21D00 = Uboot
0x21D00 - 0x40000 = FF FF
0x40000 - 0x50000 = Commands?
0x50000 - 0x80000 = FF FF
0x80000 - 0x81000 = Environment
0x81000 - 0xFFFFF = FF FF
0x1B800 - 0x1BAE0 = NAND FLASH Chip's 
❯ xxd -s $((0x1B800)) -l $((0x1BAE0-0x1B800)) mtd0.bin
0001b800: 987d feff 0000 0000 0000 0000 ffff ffff  .}..............
0001b810: ffff 0000 6d74 6b6e 616e 6400 f101 0000  ....mtknand.....
0001b820: 011d 8000 0408 8000 8000 0008 4000 0000  ............@...
0001b830: ff7f c730 5333 344d 4c30 3147 3130 3054  ...0S34ML01G100T
0001b840: 4600 0000 0000 0000 f192 0000 ff95 8000  F...............
0001b850: 0408 8000 8000 0008 4000 0000 ff7f c730  ........@......0
0001b860: 4635 394c 3147 3831 4100 0000 0000 0000  F59L1G81A.......
0001b870: 0000 0000 dac8 0000 4495 9000 0508 0001  ........D.......
0001b880: 8000 0008 4000 0000 ff7f c730 4635 394c  ....@......0F59L
0001b890: 3247 3831 4100 0000 0000 0000 0000 0000  2G81A...........
0001b8a0: dcc8 0000 5495 9000 0508 0002 8000 0008  ....T...........
0001b8b0: 4000 0000 ff7f c730 4635 394c 3447 3831  @......0F59L4G81
0001b8c0: 4100 0000 0000 0000 0000 0000 f1ef 0000  A...............
0001b8d0: 0095 0000 0408 8000 8000 0008 4000 0000  ............@...
0001b8e0: ff7f c730 5732 394e 3031 4856 0000 0000  ...0W29N01HV....
0001b8f0: 0000 0000 0000 0000 daef 0000 0495 9000  ................
0001b900: 0508 0001 8000 0008 4000 0000 ff7f c730  ........@......0
0001b910: 5732 394e 3032 4756 0000 0000 0000 0000  W29N02GV........
0001b920: 0000 0000 dcef 0000 5495 9000 0508 0002  ........T.......
0001b930: 8000 0008 4000 0000 ff7f c730 5732 394e  ....@......0W29N
0001b940: 3034 4756 0000 0000 0000 0000 0000 0000  04GV............
0001b950: d3ec 0000 5895 5100 0508 0004 8000 0008  ....X.Q.........
0001b960: 4000 0000 3343 0400 4b39 4b38 4738 3030  @...3C..K9K8G800
0001b970: 3000 0000 0000 0000 0000 0000 f1c2 0000  0...............
0001b980: c21d 8000 0408 8000 8000 0008 4000 0000  ............@...
0001b990: ff7f c730 4d58 3330 4c46 3147 3038 4141  ...0MX30LF1G08AA
0001b9a0: 0000 0000 0000 0000 f1c2 0000 0295 8000  ................
0001b9b0: 0408 8000 8000 0008 4000 0000 ff7f c730  ........@......0
0001b9c0: 4d58 3330 4c46 3147 3138 4143 0000 0000  MX30LF1G18AC....
0001b9d0: 0000 0000 dac2 0000 0695 9000 0508 0001  ................
0001b9e0: 8000 0008 4000 0000 ff7f c730 4d58 3330  ....@......0MX30
0001b9f0: 4c46 3247 3138 4143 0000 0000 0000 0000  LF2G18AC........
0001ba00: dcc2 0000 5695 9000 0508 0002 8000 0008  ....V...........
0001ba10: 4000 0000 ff7f c730 4d58 3330 4c46 3447  @......0MX30LF4G
0001ba20: 3138 4143 0000 0000 0000 0000 482c 0000  18AC........H,..
0001ba30: a926 0000 0508 0008 0002 0010 e000 0000  .&..............
0001ba40: ff7f c730 4d54 3239 4631 3647 3038 4142  ...0MT29F16G08AB
0001ba50: 4142 0000 0000 0000 d398 0000 7626 9000  AB..........v&..
0001ba60: 0508 0004 0001 0010 e000 0000 ff7f c730  ...............0
0001ba70: 5443 3538 4e56 4733 5330 4600 0000 0000  TC58NVG3S0F.....
0001ba80: 0000 0000 da01 0000 4695 9000 0508 0001  ........F.......
0001ba90: 8000 0008 7000 0000 ff7f c730 5333 344d  ....p......0S34M
0001baa0: 4c30 3247 3230 3054 4600 0000 0000 0000  L02G200TF.......
0001bab0: dc01 0000 5695 9000 0508 0002 8000 0008  ....V...........
0001bac0: 7000 0000 ff7f c730 5333 344d 4c30 3447  p......0S34ML04G
0001bad0: 3230 3054 4600 0000 0000 0000 0000 0000  200TF...........

Suitable chips NAND FLASH

  • S34ML01G100TF [SkyHigh Memory]
  • F59L1G81A [Elite Semiconductor Memory Technology (ESMT)]
  • F59L2G81A
  • F59L4G81A
  • W29N01HV [WINBOND Electronics]
  • W29N02GV
  • W29N04GV
  • K9K8G8000
  • MX30LF1G08AA [Macronix International]
  • MX30LF1G18AC
  • MX30LF2G18AC
  • MX30LF4G18AC
  • MT29F16G08ABAB [Micron]
  • TC58NVG3S0F [Toshiba Semiconductor]
  • S34ML02G200TF
  • S34ML04G200TF
1 Like
17

Does the " Suitable chips NAND FLASH" support also vary per device ?

1 Like
18

Hi! I didn't quite understand the question. :grin: This information is found in the U-boot binary file. The previous message indicates which addresses. In my understanding, in case of failure of the NAND Flash, for this device can be replaced from this list.

2 Likes
19

If the "saveenv" command U-boot has never been used, then the address 0x80000 will be "FF FF" size 0x1000.

1 Like
20

Ah, ok, understood