Add support for Sercomm S3 on stock uboot

For Developers
1

Hi all,

This is the Sercomm S3. It is nearly identical to the beeline turbo+ which already has a pull request in the master tree here.

Device specifications are (taken from the pull resuqest and adjusted):

SoC Type: MediaTek MT7621AT
RAM: 256
Flash: 128 MiB Nand flash
Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2
Wireless 5 GHz (MT7615N): a/n/ac, 4x4
Ethernet: 5 ports - 5×GbE (WAN, LAN1-4)
USB ports: 1xUSB3.0
Button: 2 button (reset, wps)
LEDs: Red, Green, Blue.
Stock bootloader: U-Boot

The only difference I could see is the ram which is 256mb as opposed to 128m on the turbo+ and the partition sizes are slighlty different for some reason. Also the turbo+ has a zigbee chip where in mine it only has the spot for it.

The easiest method obvioulsy is to flash a custom breed bootloader as per the pull request.

The flash partitiosn are as follow:

~ # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "Boot Loader"
mtd1: 00100000 00020000 "dynamic partition map"
mtd2: 00100000 00020000 "Factory"
mtd3: 00100000 00020000 "Boot Flag"
mtd4: 00600000 00020000 "Kernel 1"
mtd5: 00600000 00020000 "Kernel 2"
mtd6: 02000000 00020000 "File System 1"
mtd7: 02000000 00020000 "File System 2"
mtd8: 01400000 00020000 "Configuration/log"
mtd9: 01b80000 00020000 "Debug (Ftool)"

I managed to create initramfs from the pull request. It works fine and I pasted the output on the bottom.

The kernel1 and kernel2 have an extra 256 byte paddding. After digging a bit I managed to get most of the info as below. I added hexdump of the official firmware.
One thing that took me a while t figure is that everything on this Sercomm header is written the in reverse.
so AB:CD:EF:12 is 12:EF:CD:AB.

Table I made which represent 4 hex number per field


+------------------------+-------------------------------------+------------------------+-------------------------------------------+
| Sercomm header         | unknown (appears to be some length) | Sercomm HDR chksum     | Unknown - Appears to be 02 followed by FF |
+------------------------+-------------------------------------+------------------------+-------------------------------------------+
| Kernel absolute offset | Kernel length                       | Kernel Checksum        | 00                                        |
+------------------------+-------------------------------------+------------------------+-------------------------------------------+
| FF FF FF FF            | FF FF FF FF                         | rootfs absolute offset | rootfs length                             |
+------------------------+-------------------------------------+------------------------+-------------------------------------------+
| rootfs checksum        | 00 00 00 00                         | FF FF FF FF            | FF FF FF FF                               |
+------------------------+-------------------------------------+------------------------+-------------------------------------------+

hexdump of the official firmware followed by the checksums reported by the bootloader

00000000  53 65 72 00 92 59 db 00  76 75 08 eb 02 ff ff ff  |Ser..Y..vu......|
00000010  00 01 40 00 91 58 3b 00  4e 51 e0 7e 00 00 00 00  |..@..X;.NQ.~....|
00000020  ff ff ff ff ff ff ff ff  00 00 00 01 00 00 d6 00  |................|
00000030  58 49 16 c9 00 00 00 00  ff ff ff ff ff ff ff ff  |XI..............|
00000040  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000100  27 05 19 56 6d 67 6a 16  5e 90 dc b6 00 3b 58 51  |'..Vmgj.^....;XQ|
00000110  81 00 10 00 81 71 d4 20  fc 1c 0c 69 05 05 02 03  |.....q. ...i....|
00000120  4c 69 6e 75 78 20 4b 65  72 6e 65 6c 20 49 6d 61  |Linux Kernel Ima|
00000130  67 65 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |ge..............|


*************************************
Boot Flag : Sercomm0�
*************************************
Fw header Magic check OK!
FW header checksum should: 0xeb087576, crc32 result: 0xeb087576, Fw header CRC check OK!
kernel : real offset: 0x00400100, data length: 0x003b5891,checksum :0x7ee0514e
kernel result: 0x7ee0514e, kernel check sum ok!
rootfs:  real offset: 0x01000000, data length: 0x00d60000, checksum :0xc9164958
rootfs result: 0xc9164958, rootfs check sum ok!
Kernel Addr : 0xbc400100
## Booting image at bc400100 ...
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    3889233 Bytes =  3.7 MB
   Load Address: 81001000
   Entry Point:  8171d420
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
kernel addr :0xBC400100 
No initrd
## Transferring control to Linux (at address 8171d420) ...
## Giving linux memsize in MB, 256

Starting kernel ...


LINUX started...

 THIS IS ASIC

SDK 5.0.S.0
Linux version 3.10.14 (scof@ubuntu) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 SMP Fri Apr 10 23:05:30 MSK 2020
1 Like
2

Stock boot

===================================================================
                MT7621   stage1 code 10:33:11 (ASIC)
                CPU=50000000 HZ BUS=16666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL2 FB_DL: 0xb, 1/0 = 564/460 2D000000
PLL3 FB_DL: 0x15, 1/0 = 547/477 55000000
PLL4 FB_DL: 0x17, 1/0 = 595/429 5D000000
do DDR setting..[00320381]
Apply DDR3 Setting...(use customer AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
      --------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000E:|    0    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1
000F:|    0    0    0    0    1    1    1    1    1    1    1    1    1    1    1    0
0010:|    1    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0
0011:|    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
rank 0 coarse = 15
rank 0 fine = 72
B:|    0    0    0    0    0    0    0    0    1    1    1    0    0    0    0    0
opt_dle value:9
DRAMC_R0DELDLY[018]=00001D1E
==================================================================
                RX      DQS perbit delay software calibration 
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    9 6 10 7 9 4 8 1 2 6 
10 |    3 10 5 7 3 7 
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center 
y=0-7bit DQ of every group
input delay:DQS0 =30 DQS1 = 29
==================================================================
bit     DQS0     bit      DQS1
0  (1~56)28  8  (1~55)28
1  (1~55)28  9  (1~55)28
2  (1~59)30  10  (0~57)28
3  (1~56)28  11  (1~54)27
4  (1~56)28  12  (0~55)27
5  (1~58)29  13  (0~54)27
6  (0~58)29  14  (1~58)29
7  (1~58)29  15  (0~56)28
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    11 8 10 9 11 5 9 2 3 7 
10 |    4 12 7 9 3 8 
==================================================================
==================================================================
     TX  perbyte calibration 
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000 
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 
DQ loop=15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1 
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2 
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
20,data:88
[EMI] DRAMC calibration passed

===================================================================
                MT7621   stage1 code done 
                CPU=50000000 HZ BUS=16666666 HZ
===================================================================


U-Boot 1.1.3 (Mar  4 2020 - 17:12:16)

Board: Ralink APSoC DRAM:  256 MB
rt2880 uboot v0.00e04 05/25/2006
SERIAL_CLOCK_DIVISOR =16 
kaiker,,CONFIG_BAUDRATE =57600 
SDRAM SIZE:10000000
Top of RAM usable for U-Boot at: 90000000
Reserving 425k for U-Boot at: 8ff94000
Reserving 1028k for malloc() at: 8fe93000
Reserving 44 Bytes for Board Info at: 8fe92fd4
Reserving 36 Bytes for Global Data at: 8fe92fb0
Reserving 128k for boot params() at: 8fe72fb0
Stack Pointer at: 8fe72f98
relocate_code Pointer at: 8ff94000

Config XHCI 40M PLL 
******************************
Software System Reset Occurred
******************************
Now running in RAM - U-Boot at: 8ff94000

 monitor_flash_len =116812 
Command "mdio": 0xa0206984 => 0x8ff9a984
Command "nand": 0xa020c2bc => 0x8ffa02bc
Command "reset": 0xa0215cec => 0x8ffa9cec
Command "go": 0xa020dc68 => 0x8ffa1c68
Command "bootm": 0xa020e4c4 => 0x8ffa24c4
Command "loadb": 0xa020f184 => 0x8ffa3184
Command "tftpboot": 0xa020f7b4 => 0x8ffa37b4
Command "nm": 0xa020fe40 => 0x8ffa3e40
Command "mm": 0xa020fea4 => 0x8ffa3ea4
Command "md": 0xa020ff08 => 0x8ffa3f08
Command "saveenv": 0xa0210480 => 0x8ffa4480
Command "setenv": 0xa0210df0 => 0x8ffa4df0
Command "printenv": 0xa02104d0 => 0x8ffa44d0
Command "?": 0xa02110c4 => 0x8ffa50c4
Command "help": 0xa02110c4 => 0x8ffa50c4
Command "version": 0xa0210f84 => 0x8ffa4f84
Command "sc_boot": 0xa0213d30 => 0x8ffa7d30
Command "sc_nand": 0xa0213d68 => 0x8ffa7d68
Command "sc_eth_test": 0xa0213da4 => 0x8ffa7da4
Command "sc_phy": 0xa0213de0 => 0x8ffa7de0
Command "sc_time": 0xa0213e1c => 0x8ffa7e1c
Command "sc_btver": 0xa0213e54 => 0x8ffa7e54
Command "sc_fl_map": 0xa0213e90 => 0x8ffa7e90
Command "sc_endian": 0xa0213ecc => 0x8ffa7ecc
Command "sc_gpio": 0xa0213f08 => 0x8ffa7f08
Command "sc_led": 0xa0213f44 => 0x8ffa7f44
Command "sc_dl": 0xa0213f80 => 0x8ffa7f80
Allocate 16 byte aligned buffer: 8ffca410
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [C2 F1 80 95 02]
Device found in MTK table, ID: c2f1, EXT_ID: 809502
Support this Device in MTK table! c2f1 
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 880 MHZ #### 
 estimate memory size =256 Mbytes
#Reset_MT7530
set LAN/WAN WLLLL

Load Standalone from 40000
SC_DEBUG: Nand Partition Table Magic Found at 100000.

******************************************
    Uboot StandAlone Entry
******************************************
GPIO init
*********************************************************
      Press any key to enter Boot Command Interface      
*********************************************************
 0 
SC_DEBUG: Nand Partition Table Magic Found at 100000.

******************************************
    Uboot StandAlone Entry
******************************************

***************************************************
     Boot Version 0.2.1.0, at Mar  4 2020, 17:12:13

***************************************************
SC_DEBUG: Nand Partition Table Magic Found at 100000.
Entering Firmware : Everything is OK.

*************************************
Boot Flag : Sercomm0�
*************************************
Fw header Magic check error!
Fw header check fail !
Update boot flag to Sercomm1�
ranand_erase: start:300000, len:20000 
.
*************************************
Boot Flag : Sercomm1�
*************************************
Fw header Magic check OK!
FW header checksum should: 0xc16aee0e, crc32 result: 0xc16aee0e, Fw header CRC check OK!
kernel : real offset: 0x00a00100, data length: 0x003b5891,checksum :0x7ee0514e
kernel result: 0x7ee0514e, kernel check sum ok!
rootfs:  real offset: 0x03000000, data length: 0x00d60000, checksum :0xc9164958
rootfs result: 0xc9164958, rootfs check sum ok!
Kernel Addr : 0xbca00100
## Booting image at bca00100 ...
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    3889233 Bytes =  3.7 MB
   Load Address: 81001000
   Entry Point:  8171d420
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
kernel addr :0xBCA00100 
No initrd
## Transferring control to Linux (at address 8171d420) ...
## Giving linux memsize in MB, 256

Starting kernel ...


LINUX started...

 THIS IS ASIC

SDK 5.0.S.0
Linux version 3.10.14 (scof@ubuntu) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 SMP Fri Apr 10 23:05:30 MSK 2020

 The CPU feqenuce set to 880 MHz
GCMP present
CPU0 revision is: 0001992f (MIPS 1004Kc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 0fffc000 @ 00000000 (usable)
 memory: 00004000 @ 0fffc000 (reserved)
Zone ranges:
  DMA      [mem 0x00000000-0x00ffffff]
  Normal   [mem 0x01000000-0x0fffbfff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x0fffbfff]
Detected 3 available secondary CPU(s)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
PERCPU: Embedded 7 pages/cpu @81cb6000 s6720 r8192 d13760 u32768
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65020
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 rootfstype=squashfs
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Writing ErrCtl register=00002640
Readback ErrCtl register=00002640
Memory: 248792k/262128k available (7323k kernel code, 13336k reserved, 3130k data, 228k init, 0k highmem)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 577.53 BogoMIPS (lpj=1155072)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
launch: starting cpu1
launch: cpu1 gone!
CPU1 revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Synchronize counters for CPU 1: done.
launch: starting cpu2
launch: cpu2 gone!
CPU2 revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Synchronize counters for CPU 2: done.
launch: starting cpu3
launch: cpu3 gone!
CPU3 revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Synchronize counters for CPU 3: done.
Brought up 4 CPUs
devtmpfs: initialized
NET: Registered protocol family 16
release PCIe RST: RALINK_RSTCTRL = 7000000
PCIE PHY initialize
***** Xtal 40MHz *****
start MT7621 PCIe register access
RALINK_RSTCTRL = 7000000
RALINK_CLKCFG1 = 77ffeff8

*************** MT7621 PCIe RC mode *************
PCIE2 no card, disable it(RST&CLK)
pcie_link status = 0x3
RALINK_RSTCTRL= 3000000
*** Configure Device number setting of Virtual PCI-PCI bridge ***
RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2
PCIE0 enabled
PCIE1 enabled
interrupt enable status: 300000
Port 1 N_FTS = 1b105000
Port 0 N_FTS = 1b105000
config reg done
init_rt2880pci done
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff]
pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff]
pci 0000:00:01.0: BAR 1: assigned [mem 0x60210000-0x6021ffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
pci 0000:00:00.0: PCI bridge to [bus 01]
pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff]
pci 0000:00:01.0: PCI bridge to [bus 02]
pci 0000:00:01.0:   bridge window [mem 0x60100000-0x601fffff]
BAR0 at slot 0 = 0
bus=0x0, slot = 0x0
res[0]->start = 0
res[0]->end = 0
res[1]->start = 60200000
res[1]->end = 6020ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
BAR0 at slot 1 = 0
bus=0x0, slot = 0x1
res[0]->start = 0
res[0]->end = 0
res[1]->start = 60210000
res[1]->end = 6021ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0, irq=0x4
res[0]->start = 60000000
res[0]->end = 600fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x2, slot = 0x1, irq=0x18
res[0]->start = 60100000
res[0]->end = 601fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
Switching to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
4 CPUs re-calibrate udelay(lpj = 1167360)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NTFS driver 2.1.30 [Flags: R/W].
fuse init (API version 7.22)
msgmni has been set to 485
io scheduler noop registered (default)
reg_int_mask=0, INT_MASK= 0 
HSDMA_init

 hsdma_phy_tx_ring0 = 0x00c00000, hsdma_tx_ring0 = 0xa0c00000

 hsdma_phy_rx_ring0 = 0x00c04000, hsdma_rx_ring0 = 0xa0c04000
TX_CTX_IDX0 = 0
TX_DTX_IDX0 = 0
RX_CRX_IDX0 = 3ff
RX_DRX_IDX0 = 0
set_fe_HSDMA_glo_cfg
HSDMA_GLO_CFG = 465
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A
serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A
serial8250: ttyS2 at MMIO 0x1e000e00 (irq = 28) is a 16550A
brd: module loaded
MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
Allocate 16 byte aligned buffer: 81a87e00
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [C2 F1 80 95 02, 00809502]
Device found in MTK table, ID: c2f1, EXT_ID: 809502
alloctare : (mtd->writesize + mtd->oobsize) * page_per_block is 135168
Support this Device in MTK table! c2f1 
NAND device: Manufacturer ID: 0xc2, Chip ID: 0xf1 (Macronix NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Scanning device for bad blocks
Signature matched and data read!
load_fact_bbt success 1023
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
page: 200
Found dynamic partition map at 100000:
page: 201
        <0> offset: 00000000, length: 00100000
page: 201
        <1> offset: 00100000, length: 00100000
page: 201
        <2> offset: 00200000, length: 00100000
page: 201
        <3> offset: 00300000, length: 00100000
page: 201
        <4> offset: 00400000, length: 00600000
page: 201
        <5> offset: 00A00000, length: 00600000
page: 201
        <6> offset: 01000000, length: 02000000
page: 201
        <7> offset: 03000000, length: 02000000
page: 201
        <8> offset: 05000000, length: 01400000
page: 201
        <9> offset: 06400000, length: 01B80000
Creating 10 MTD partitions on "MT7621-NAND":
0x000000000000-0x000000100000 : "Boot Loader"
0x000000100000-0x000000200000 : "dynamic partition map"
0x000000200000-0x000000300000 : "Factory"
0x000000300000-0x000000400000 : "Boot Flag"
0x000000400000-0x000000a00000 : "Kernel 1"
0x000000a00000-0x000001000000 : "Kernel 2"
0x000001000000-0x000003000000 : "File System 1"
0x000003000000-0x000005000000 : "File System 2"
0x000005000000-0x000006400000 : "Configuration/log"
0x000006400000-0x000007f80000 : "Debug (Ftool)"
[mtk_nand] probe successfully!
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
register mt_drv

== pAd = c0181000, size = 5762112, Status=0 ==
pAd->PciHif.CSRBaseAddress =0xc0080000, csr_addr=0xc0080000!
RTMPInitPCIeDevice():device_id=0x7615
mt_pci_chip_cfg(): HWVer=0x8a10, FWVer=0x8a10, pAd->ChipID=0x7615
mt_pci_chip_cfg(): HIF_SYS_REV=0x76150001
AP Driver version-5.0.4.0
RtmpChipOpsHook(223): Not support for HIF_MT yet! MACVersion=0x0
mt7615_init()-->
Use 1st iPAiLNA default bin.
Use 0st /etc_ro/wlan/MT7615E_EEPROM1.bin default bin.
<--mt7615_init()
<-- RTMPAllocTxRxRingMemory, Status=0
rdm_major = 253
set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1
GMAC1_MAC_ADRH -- : 0x0000000c
GMAC1_MAC_ADRL -- : 0x43288071
Ralink APSoC Ethernet Driver Initilization. v3.1  4096 rx/tx descriptors allocated, mtu = 1500!
set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1
GMAC1_MAC_ADRH -- : 0x0000000c
GMAC1_MAC_ADRL -- : 0x43288091
<0>  !! create link_status PROC !!!!!
PROC INIT OK!
usbcore: registered new interface driver catc
usbcore: registered new interface driver kaweth
pegasus: v0.9.3 (2013/04/25), Pegasus/Pegasus II USB Ethernet driver
usbcore: registered new interface driver pegasus
usbcore: registered new interface driver rtl8150
usbcore: registered new interface driver r8152
usbcore: registered new interface driver asix
usbcore: registered new interface driver ax88179_178a
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver cdc_eem
usbcore: registered new interface driver dm9601
usbcore: registered new interface driver smsc75xx
usbcore: registered new interface driver smsc95xx
usbcore: registered new interface driver gl620a
usbcore: registered new interface driver net1080
usbcore: registered new interface driver plusb
usbcore: registered new interface driver rndis_host
usbcore: registered new interface driver cdc_subset
usbcore: registered new interface driver zaurus
usbcore: registered new interface driver MOSCHIP usb-ethernet driver
usbcore: registered new interface driver int51x1
usbcore: registered new interface driver kalmia
usbcore: registered new interface driver ipheth
usbcore: registered new interface driver sierra_net
usbcore: registered new interface driver cx82310_eth
usbcore: registered new interface driver cdc_ncm
usbcore: registered new interface driver lg-vl600
usbcore: registered new interface driver qmi_wwan
usbcore: registered new interface driver cdc_mbim
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci-pci: EHCI PCI platform driver
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
uhci_hcd: USB Universal Host Controller Interface driver
usbcore: registered new interface driver cdc_acm
cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver usblp
usbcore: registered new interface driver cdc_wdm
usbcore: registered new interface driver usb-storage
Ralink APSoC Hardware Watchdog Timer
Init Ingress Classify module ...
GACT probability on
Mirror/redirect action on
Failed to load ipt action
u32 classifier
    Performance counters on
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (3887 buckets, 15548 max)
ctnetlink v0.93: registering with nfnetlink.
NF_TPROXY: Transparent proxy support initialized, version 4.1.0
NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd.
gre: GRE over IPv4 demultiplexor driver
ip_tables: (C) 2000-2006 Netfilter Core Team
Type=Linux
arp_tables: (C) 2002 David S. Miller
TCP: cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
l2tp_core: L2TP core driver, V2.0
l2tp_ppp: PPPoL2TP kernel driver, V2.0
8021q: 802.1Q VLAN Support v1.8
Sercomm dual images: bootflag=Sercomm1, choose /dev/mtdblock7 as rootfs
VFS: Mounted root (squashfs filesystem) readonly on device 31:7.
devtmpfs: mounted
Freeing unused kernel memory: 228K (81a37000 - 81a70000)
init started: BusyBox v1.15.3 ()
starting pid 52, tty '': '/etc/rcS'
mount: mounting usbfs on /proc/bus/usb failed: No such file or directory
register rlt_drv


=== pAd = c0d81000, size = 2223688 ===

<-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
<-- RTMPAllocAdapterBlock, Status=0
pAd->CSRBaseAddress =0xc0c80000, csr_addr=0xc0c80000!
device_id =0x7603
RtmpChipOpsHook(474): Not support for HIF_MT yet!
mt7603_init()-->
mt_bcn_buf_init(224): Not support for HIF_MT yet!
<--mt7603_init()
load_dev_l1profile()-->
match_index_by_chipname() MT7603 found as INDEX0
l1set_profile_path() profile remain /etc/Wireless/RT2860/RT2860.dat
l1set_eeprom_offset() eeprom offset remain 0x0
l1set_eeprom_size() eeprom size remain 0x200
l1set_ifname() ifname rename from ra0 to ra
l1set_ifname() ifname remain ra
l1set_ifname() ifname remain ra
l1set_ifname() ifname remain apcli
hal_wd: module license 'sercomm' taints kernel.
Disabling lock debugging due to kernel taint
Init system monitor...
Sercomm HWIO Driver: loaded successfully
nUBI: attaching mtd8 to ubi8
UBI: scanning is finished
UBI: attached mtd8 (name "Configuration/log", size 20 MiB) to ubi8
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 160, bad PEBs: 0, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 4/1, WL threshold: 4096, image sequence number: 944567548
UBI: available PEBs: 0, total reserved PEBs: 160, PEBs reserved for bad PEB handling: 20
UBI: background thread "ubi_bgt8d" started, PID 99
UBI device number 8, total 160 LEBs (20316160 bytes, 19.4 MiB), UBIFS: background thread "ubifs_bgt8_0" started, PID 101
available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 8, volume 0, name "rootfs_data"
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 15872000 bytes (15 MiB, 125 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs)
UBIFS: reserved for root: 0 bytes (0 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID 7F2DC5A7-9B77-48A7-8575-13CC7A1BA981, small LPT model

net/nat/hw_nat/get_mem.c InitMod:40: Ralink HW NAT allocate DMA memory area
net/nat/hw_nat/get_mem.c InitMod:46: The DMA memory area has been allocated a0e00000 00e00000
Started WatchDog Timer.
switch register base addr to 0xb0100a00
write offset 0x80, value 0x5d805d80
write offset 0x84, value 0x1d801d80
SERIAL NUMBER: 
FFFFFFFF:FFFFFFFF:FFFFFFFF:FFFFFFFF:FFFFFFFF:FFFFFFFF
Raeth v3.1 (Tasklet)
phy_free_head is 0xc92000!!!
phy_free_tail_phy is 0xc93ff0!!!
txd_pool=a0c98000 phy_txd_pool=00C98000
ei_local->skb_free start address is 0x8ee026cc.
free_txd: 00c98010, ei_local->cpu_ptr: 00C98000
 POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
----------------+---------+--------
     0xa0c98000 0x00C98000 0x00C98000

phy_qrx_ring = 0x00c94000, qrx_ring = 0xa0c94000

phy_rx_ring0 = 0x00ca0000, rx_ring[0] = 0xa0ca0000
MT7530 Reset Completed!!
change HW-TRAP to 0x117c8f
set LAN/WAN WLLLL
GMAC1_MAC_ADRH -- : 0x00007c8f
GMAC1_MAC_ADRL -- : 0xdeacc120
GDMA2_MAC_ADRH -- : 0x0000000c
GDMA2_MAC_ADRL -- : 0x432880ca
eth3: ===> VirtualIF_open
MT7621 GE2 link rate to 1G
CDMA_CSG_CFG = 81000000
GDMA1_FWD_CFG = 20710000
GDMA2_FWD_CFG = 20710000
sc_lan_vlan_id = 1
sc_wan_vlan_id = 2
sc_special_vlan_id = 3
sc_host_queue = 3
rc_cmd=/usr/sbin/rc syslogd start 
rc_cmd=/usr/sbin/rc wan_switch start 
rc_cmd=/usr/sbin/rc lan_switch start 
rc_cmd=/usr/sbin/rc dnrd start 
rc_cmd=/usr/sbin/rc wlan start 
Interface doesn't accept private ioctl...
set (8BE2): Invalid argument
Interface doesn't accept private ioctl...
set (8BE2): Invalid argument
============guest<2> is disabled============
============guest<3> is disabled============
============guest<4> is disabled============
============guest<6> is disabled============
============guest<7> is disabled============
============guest<8> is disabled============
rc_cmd=/usr/sbin/rc lanip start init 
rc_cmd=/usr/sbin/rc firewall start 
ScDrvDev_ioctl: CMD: (20) is not supported
rc_cmd=rc radvd restart 
[Jan 01 00:00:36] radvd: no linklocal address configured for br0
[Jan 01 00:00:36] radvd: can't join ipv6-allrouters on br0
iptables: Bad rule (does a matching rule exist in that chain?).
rc_cmd=/usr/sbin/rc networkmap start init 
rc_cmd=/usr/sbin/rc qos start 
modprobe: module networkmap not found in modules.dep
rc_cmd=/usr/sbin/rc cpm start init 
Jan/01/1970 00:00:39: dhcp6_ctl_authinit: failed to open /tmp/dhcp6sctlkey: No such file or directory
Fri Apr 10 23:52:54 UTC 2020
rc_cmd=/usr/sbin/rc httpd start 
rc_cmd=/usr/sbin/rc coredump start 
rc_cmd=/usr/sbin/rc ieee_802_1x start 
rc_cmd=/usr/sbin/rc srt restart 
bind: Address already in use
bind: Address already in use
rc_cmd=/usr/sbin/rc rp start 
rc_cmd=/usr/sbin/rc udpecho start 
rc_cmd=/usr/sbin/rc ingress_qos start 
rc_cmd=/usr/sbin/rc ingress_classify start 
rc_cmd=/usr/sbin/rc qos_remark start 
rc_cmd=/usr/sbin/rc ipv6wd start 
rc_cmd=/usr/sbin/rc pppoe_relay start 
rc_cmd=/usr/sbin/rc telnetd start 
rc_cmd=/usr/sbin/rc sshd start 
rc_cmd=/usr/sbin/rc igd_upnp start 
rc_cmd=/usr/sbin/rc dnsr start 
rc_cmd=/usr/sbin/rc cron start 
Could not load host key: /etc/ssh/ssh_host_ed25519_key
rc_cmd=/usr/sbin/rc cups start 
rc_cmd=/usr/sbin/rc umtsd start 
rc_cmd=/usr/sbin/rc cwmp_stun start 
DualImage Sync: images are different, start sync
Erasing 128 Kibyte @ 20000 -- 100 % complete 
st
1 Like
3

Openwrt snapshot initramfs boot

MT7621 # tftpboot

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!! 
*** Warning: no boot file name; using 'test.bin'
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'test.bin'.

 TIMEOUT_COUNT=10,Load address: 0x88000000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
T Got ARP REPLY, set server/gtwy eth addr (24:4b:fe:78:c5:02)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########################################################
done
Bytes transferred = 7607617 (741541 hex)
LoadAddr=88000000 NetBootFileXferSize= 00741541
MT7621 # bootm
## Booting image at 88000000 ...
   Image Name:   MIPS OpenWrt Linux-5.4.115
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    7607553 Bytes =  7.3 MB
   Load Address: 80001000
   Entry Point:  80001000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
hdr->ih_os is 5
do_bootm:
cmdtp    : 8ffb0624
flag     : 0
argc     : 1
argv[0] : bootm
addr     : 88000000
len_ptr  : 88000040
verify   : 1
No initrd
## Transferring control to Linux (at address 80001000) ...
## Giving linux memsize in MB, 256

Starting kernel ...

[    0.000000] Linux version 5.4.115 (karim@arch-dekstop) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16577-b832ebb886)) #0 SMP Sat May 1 21:55:1
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is Sercomm S3
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] percpu: Embedded 14 pages/cpu s26480 r8192 d22672 u57344
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64960
[    0.000000] Kernel command line: console=ttyS0,57600n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Writing ErrCtl register=00002640
[    0.000000] Readback ErrCtl register=00002640
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 245424K/262144K available (6024K kernel code, 200K rwdata, 1268K rodata, 6192K init, 230K bss, 16720K reserved, 0K c)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 256
[    0.000000] random: get_random_bytes called from start_kernel+0x36c/0x584 with crng_init=0
[    0.000000] CPU Clock: 880MHz
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns
[    0.000008] sched_clock: 32 bits at 440MHz, resolution 2ns, wraps every 4880645118ns
[    0.015480] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[    0.087813] pid_max: default: 32768 minimum: 301
[    0.097145] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.111550] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.129672] rcu: Hierarchical SRCU implementation.
[    0.139789] smp: Bringing up secondary CPUs ...
[    0.171448] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.171458] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.171471] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.171574] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.209422] Synchronize counters for CPU 1: done.
[    0.294995] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.295003] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.295012] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.295077] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.329953] Synchronize counters for CPU 2: done.
[    0.412192] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.412200] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.412208] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.412274] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.449539] Synchronize counters for CPU 3: done.
[    0.509153] smp: Brought up 1 node, 4 CPUs
[    0.521588] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.541067] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[    0.554893] pinctrl core: initialized pinctrl subsystem
[    0.566690] NET: Registered protocol family 16
[    0.603133] random: fast init done
[    0.603417] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[    0.630830] clocksource: Switched to clocksource GIC
[    0.642413] NET: Registered protocol family 2
[    0.651675] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.668192] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear)
[    0.683392] TCP bind hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.697560] TCP: Hash tables configured (established 2048 bind 2048)
[    0.710300] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.723191] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.737271] NET: Registered protocol family 1
[    0.745839] PCI: CLS 0 bytes, default 32
[    6.890763] 4 CPUs re-calibrate udelay(lpj = 2924544)
[    6.902407] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[    6.926908] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    6.938389] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    6.961598] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    6.972888] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    6.984209] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    6.996049] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    7.009957] printk: console [ttyS0] disabled
[    7.018396] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 19, base_baud = 3125000) is a 16550A
[    7.036330] printk: console [ttyS0] enabled
[    7.036330] printk: console [ttyS0] enabled
[    7.052875] printk: bootconsole [early0] disabled
[    7.052875] printk: bootconsole [early0] disabled
[    7.073823] mt7621-nand 1e003000.nand: Using programmed access timing: 31c07388
[    7.088678] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xf1
[    7.101333] nand: Macronix MX30LF1G18AC
[    7.108951] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    7.124031] mt7621-nand 1e003000.nand: ECC strength adjusted to 4 bits
[    7.137057] mt7621-nand 1e003000.nand: Using programmed access timing: 21005134
[    7.151624] mt7621-nand 1e003000.nand: Using programmed access timing: 21005134
[    7.166176] Scanning device for bad blocks
[    8.466847] 10 fixed-partitions partitions found on MTD device mt7621-nand
[    8.480535] Creating 10 MTD partitions on "mt7621-nand":
[    8.491124] 0x000000000000-0x000000100000 : "bootloader"
[    8.503026] 0x000000100000-0x000000200000 : "part_map "
[    8.514698] 0x000000200000-0x000000300000 : "factory-data"
[    8.526915] 0x000000300000-0x000000400000 : "dual-flag"
[    8.538581] 0x000000400000-0x000000a00000 : "kernel1"
[    8.549950] 0x000000a00000-0x000001000000 : "kernel2"
[    8.561439] 0x000001000000-0x000003000000 : "rootfs1"
[    8.572985] 0x000003000000-0x000005000000 : "rootfs2"
[    8.584512] 0x000005000000-0x000006400000 : "config/-log"
[    8.596636] 0x000006400000-0x000007f80000 : "ubi"
[    8.608872] libphy: Fixed MDIO Bus: probed
[    8.651232] libphy: mdio: probed
[    8.657900] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    8.674094] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 21
[    8.692786] mt7621-pci 1e140000.pcie: Parsing DT failed
[    8.705654] NET: Registered protocol family 10
[    8.715947] Segment Routing with IPv6
[    8.723392] NET: Registered protocol family 17
[    8.732582] 8021q: 802.1Q VLAN Support v1.8
[    8.744428] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    8.887099] libphy: dsa slave smi: probed
[    8.895545] mt7530 mdio-bus:1f wan (uninitialized): PHY [dsa-0.0:00] driver [Generic PHY]
[    8.913338] mt7530 mdio-bus:1f lan1 (uninitialized): PHY [dsa-0.0:01] driver [Generic PHY]
[    8.931319] mt7530 mdio-bus:1f lan2 (uninitialized): PHY [dsa-0.0:02] driver [Generic PHY]
[    8.949257] mt7530 mdio-bus:1f lan3 (uninitialized): PHY [dsa-0.0:03] driver [Generic PHY]
[    8.967198] mt7530 mdio-bus:1f lan4 (uninitialized): PHY [dsa-0.0:04] driver [Generic PHY]
[    8.985205] mt7530 mdio-bus:1f: configuring for fixed/rgmii link mode
[    9.002827] DSA: tree 0 setup
[    9.009089] rt2880-pinmux pinctrl: pcie is already enabled
[    9.020078] mt7621-pci 1e140000.pcie: Error applying setting, reverse things back
[    9.035143] mt7621-pci-phy 1e149000.pcie-phy: PHY for 0xbe149000 (dual port = 1)
[    9.050074] mt7621-pci-phy 1e14a000.pcie-phy: PHY for 0xbe14a000 (dual port = 0)
[    9.164842] mt7621-pci-phy 1e149000.pcie-phy: Xtal is 40MHz
[    9.175955] mt7621-pci-phy 1e14a000.pcie-phy: Xtal is 40MHz
[    9.286992] mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK)
[    9.300862] mt7621-pci 1e140000.pcie: PCIE0 enabled
[    9.310553] mt7621-pci 1e140000.pcie: PCIE1 enabled
[    9.320272] mt7621-pci 1e140000.pcie: PCI coherence region base: 0x60000000, mask/settings: 0xf0000002
[    9.338985] mt7621-pci 1e140000.pcie: PCI host bridge to bus 0000:00
[    9.351669] pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
[    9.365362] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    9.379057] pci_bus 0000:00: root bus resource [bus 00-ff]
[    9.390021] pci 0000:00:00.0: [0e8d:0801] type 01 class 0x060400
[    9.402027] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    9.414513] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[    9.427064] pci 0000:00:00.0: supports D1
[    9.435051] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    9.446903] pci 0000:00:01.0: [0e8d:0801] type 01 class 0x060400
[    9.458912] pci 0000:00:01.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    9.471401] pci 0000:00:01.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[    9.483945] pci 0000:00:01.0: supports D1
[    9.491933] pci 0000:00:01.0: PME# supported from D0 D1 D3hot
[    9.504750] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    9.520709] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    9.536878] pci 0000:01:00.0: [14c3:7615] type 00 class 0x000280
[    9.548901] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit]
[    9.562591] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s x1 link at 0000:00:00.0 (capable of 4.000 Gb/s wi)
[    9.591539] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    9.601958] pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
[    9.614096] pci 0000:00:00.0:   bridge window [mem 0x00000000-0x000fffff]
[    9.627617] pci 0000:00:00.0:   bridge window [mem 0x00000000-0x000fffff pref]
[    9.642008] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    9.655407] pci 0000:02:00.0: [14c3:7603] type 00 class 0x028000
[    9.667436] pci 0000:02:00.0: reg 0x10: [mem 0x00000000-0x000fffff]
[    9.680056] pci 0000:02:00.0: PME# supported from D0 D3hot D3cold
[    9.693606] pci 0000:00:01.0: PCI bridge to [bus 02-ff]
[    9.704035] pci 0000:00:01.0:   bridge window [io  0x0000-0x0fff]
[    9.716174] pci 0000:00:01.0:   bridge window [mem 0x00000000-0x000fffff]
[    9.729694] pci 0000:00:01.0:   bridge window [mem 0x00000000-0x000fffff pref]
[    9.744084] pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 02
[    9.757314] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    9.770487] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    9.784358] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000]
[    9.797538] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000]
[    9.811410] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    9.824933] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref]
[    9.839318] pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff]
[    9.852845] pci 0000:00:01.0: BAR 9: assigned [mem 0x60300000-0x603fffff pref]
[    9.867231] pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff]
[    9.880780] pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff]
[    9.894315] pci 0000:00:00.0: BAR 7: assigned [io  0x1e160000-0x1e160fff]
[    9.907836] pci 0000:00:01.0: BAR 7: assigned [io  0x1e161000-0x1e161fff]
[    9.921379] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
[    9.935949] pci 0000:00:00.0: PCI bridge to [bus 01]
[    9.945840] pci 0000:00:00.0:   bridge window [io  0x1e160000-0x1e160fff]
[    9.959360] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    9.972883] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref]
[    9.987275] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff]
[   10.000801] pci 0000:00:01.0: PCI bridge to [bus 02]
[   10.010668] pci 0000:00:01.0:   bridge window [io  0x1e161000-0x1e161fff]
[   10.024190] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
[   10.037709] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff pref]
[   10.053476] UBI error: no valid UBI magic found inside mtd9
[   10.064666] hctosys: unable to open rtc device (rtc0)
[   10.075370] mt7530 mdio-bus:1f: Link is Up - 1Gbps/Full - flow control off
[   10.112187] Freeing unused kernel memory: 6192K
[   10.121228] This architecture does not have kernel memory protection.
[   10.134043] Run /init as init process
[   10.768556] init: Console is alive
[   10.775599] init: - watchdog -
[   10.802345] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[   10.827265] usbcore: registered new interface driver usbfs
[   10.838334] usbcore: registered new interface driver hub
[   10.849049] usbcore: registered new device driver usb
[   10.892026] SCSI subsystem initialized
[   10.909371] xhci-mtk 1e1c0000.xhci: 1e1c0000.xhci supply vbus not found, using dummy regulator
[   10.926704] xhci-mtk 1e1c0000.xhci: 1e1c0000.xhci supply vusb33 not found, using dummy regulator
[   10.944408] xhci-mtk 1e1c0000.xhci: xHCI Host Controller
[   10.955024] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus number 1
[   10.980977] xhci-mtk 1e1c0000.xhci: hcc params 0x01401198 hci version 0x96 quirks 0x0000000000290010
[   10.999243] xhci-mtk 1e1c0000.xhci: irq 20, io mem 0x1e1c0000
[   11.012052] hub 1-0:1.0: USB hub found
[   11.019599] hub 1-0:1.0: 2 ports detected
[   11.028197] xhci-mtk 1e1c0000.xhci: xHCI Host Controller
[   11.038814] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus number 2
[   11.053741] xhci-mtk 1e1c0000.xhci: Host supports USB 3.0 SuperSpeed
[   11.066672] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[   11.083666] hub 2-0:1.0: USB hub found
[   11.091240] hub 2-0:1.0: 1 port detected
[   11.107224] usbcore: registered new interface driver usb-storage
[   11.119542] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[   11.141133] init: - preinit -
[   11.281094] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode
[   11.297149] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
[   11.314033] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   11.383577] random: jshn: uninitialized urandom read (4 bytes read)
[   11.454571] random: jshn: uninitialized urandom read (4 bytes read)
[   11.494872] random: jshn: uninitialized urandom read (4 bytes read)
[   11.708290] mt7530 mdio-bus:1f lan1: configuring for phy/gmii link mode
[   11.721934] 8021q: adding VLAN 0 to HW filter on device lan1
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   15.878133] procd: - early -
[   15.884027] procd: - watchdog -
[   16.441006] procd: - watchdog -
[   16.447673] procd: - ubus -
[   16.514515] procd: - init -
Please press Enter to activate this console.
[   16.846899] kmodloader: loading kernel modules from /etc/modules.d/*
[   16.913626] Loading modules backported from Linux version v5.10.34-0-g0aa66717f684
[   16.928810] Backport generated by backports.git v5.10.34-1-0-g7b5533e1
[   16.968367] xt_time: kernel timezone is -0000
[   16.995830] urngd: v1.0.2 started.
[   17.035326] mt7621-pci 1e140000.pcie: bus=2 slot=1 irq=24
[   17.046174] pci 0000:00:01.0: enabling device (0004 -> 0007)
[   17.057461] mt7603e 0000:02:00.0: enabling device (0000 -> 0002)
[   17.069622] mt7603e 0000:02:00.0: ASIC revision: 76030010
[   17.141111] random: crng init done
[   17.147882] random: 7 urandom warning(s) missed due to ratelimiting
[   18.111742] mt7603e 0000:02:00.0: Firmware Version: ap_pcie
[   18.122936] mt7603e 0000:02:00.0: Build Time: 20160107100755
[   18.170817] mt7603e 0000:02:00.0: firmware init done
[   18.356331] mt7621-pci 1e140000.pcie: bus=1 slot=0 irq=23
[   18.367213] pci 0000:00:00.0: enabling device (0004 -> 0007)
[   18.378519] mt7615e 0000:01:00.0: enabling device (0000 -> 0002)
[   18.421475] mt7615e 0000:01:00.0: HW/SW Version: 0x8a108a10, Build Time: 20180518100604a
[   18.421475] 
[   18.422303] PPP generic driver version 2.4.2
[   18.450923] NET: Registered protocol family 24
[   18.457637] mt7615e 0000:01:00.0: N9 Firmware Version: _reserved_, Build Time: 20200814163649
[   18.465624] wireguard: WireGuard 1.0.0 loaded. See www.wireguard.com for information.
[   18.485854] mt7615e 0000:01:00.0: CR4 Firmware Version: _reserved_, Build Time: 20190121161307
[   18.492466] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
[   18.506964] kmodloader: done loading kernel modules from /etc/modules.d/*
[   35.878442] mtk_soc_eth 1e100000.ethernet eth0: Link is Down
[   35.903569] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode
[   35.919722] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
[   35.924919] mt7530 mdio-bus:1f lan1: configuring for phy/gmii link mode
[   35.952684] 8021q: adding VLAN 0 to HW filter on device lan1
[   35.967715] br-lan: port 1(lan1) entered blocking state
[   35.978271] br-lan: port 1(lan1) entered disabled state
[   35.990444] device lan1 entered promiscuous mode
[   35.999758] device eth0 entered promiscuous mode
[   36.014733] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   36.042901] mt7530 mdio-bus:1f lan2: configuring for phy/gmii link mode
[   36.057234] 8021q: adding VLAN 0 to HW filter on device lan2
[   36.072180] br-lan: port 2(lan2) entered blocking state
[   36.082730] br-lan: port 2(lan2) entered disabled state
[   36.094953] device lan2 entered promiscuous mode
[   36.115356] mt7530 mdio-bus:1f lan3: configuring for phy/gmii link mode
[   36.129268] 8021q: adding VLAN 0 to HW filter on device lan3
[   36.144020] br-lan: port 3(lan3) entered blocking state
[   36.154555] br-lan: port 3(lan3) entered disabled state
[   36.166442] device lan3 entered promiscuous mode
[   36.186673] mt7530 mdio-bus:1f lan4: configuring for phy/gmii link mode
[   36.200594] 8021q: adding VLAN 0 to HW filter on device lan4
[   36.215388] br-lan: port 4(lan4) entered blocking state
[   36.225956] br-lan: port 4(lan4) entered disabled state
[   36.238103] device lan4 entered promiscuous mode
[   36.268345] mt7530 mdio-bus:1f wan: configuring for phy/gmii link mode
[   36.282008] 8021q: adding VLAN 0 to HW filter on device wan
[   39.231298] mt7530 mdio-bus:1f lan3: Link is Up - 1Gbps/Full - flow control rx/tx
[   39.246265] br-lan: port 3(lan3) entered blocking state
[   39.256686] br-lan: port 3(lan3) entered forwarding state
[   39.268369] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   40.271211] mt7530 mdio-bus:1f lan3: Link is Down
[   40.281128] br-lan: port 3(lan3) entered disabled state
[   46.511215] mt7530 mdio-bus:1f lan3: Link is Up - 1Gbps/Full - flow control rx/tx
[   46.526181] br-lan: port 3(lan3) entered blocking state
[   46.536604] br-lan: port 3(lan3) entered forwarding state



BusyBox v1.33.0 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r16640-b607e7df34
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
-------------------------------------------------
1 Like
4

I have a couple of issues. One is that I could not figure out how the checksum header is calculated. I tried the same wat like uboot (replacing the value by 00 and recalculating the crc32 but it is not the same result).

I used the noob approach that I am and just created a hdr with everything else and since the bootloader reports the value it expects when there is an error I just replaced it and it got accepted.

But it still did not boot. the boot process hangs at the follwoing and then nothing. I tried to play with the different recipes in the makefile to no joy.

If anyone could think of something else. I have a feeling it's either to do with something in the sercomm header maybe or in the kernel itself (since it has that extra 256 byte padding).

******************************************
    Uboot StandAlone Entry
******************************************

***************************************************
     Boot Version 0.2.1.0, at Mar  4 2020, 17:12:13

***************************************************
SC_DEBUG: Nand Partition Table Magic Found at 100000.
Entering Firmware : Everything is OK.

*************************************
Boot Flag : Sercomm0�
*************************************
Fw header Magic check OK!
FW header checksum should: 0x0825951f, crc32 result: 0x0825951f, Fw header CRC check OK!
kernel : real offset: 0x00400100, data length: 0x0026c5b8,checksum :0x9bf0cca0
kernel result: 0x9bf0cca0, kernel check sum ok!
rootfs:  real offset: 0x01000000, data length: 0x00620000, checksum :0x7a1d686b
rootfs result: 0x7a1d686b, rootfs check sum ok!
Kernel Addr : 0xbc400100
## Booting image at bc400100 ...
   Image Name:   MIPS OpenWrt Linux-5.4.115
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2540920 Bytes =  2.4 MB
   Load Address: 80001000
   Entry Point:  80001000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... O
1 Like
5

Hi. Send me the original bootloader and dump of your router labz56@gmail.com

6

Thanks @inflabz . I have sent them to you.

1 Like
7

I hacked up a small tool a few days ago when I was facing the same problem. Mostly code stolen from other places. It might help: https://www.mork.no/~bjorn/crc32range.c

The UI was made for one-time usage by myself, so it obviously sucks. But the idea is to quickly be able to recalculate checksums over a selectable range of an image file, comparing then with an exiting value. For example for this image which as a 0x17c bytes long header with a checksum in offset 0x174:

 bjorn@canardo:/usr/local/src/openwrt$ /tmp/crc32range bin/r16596+3-6f77ce77248d/targets/ramips/mt7621/openwrt-snapshot-ramips-mt7621-zyxel_lte5398-initramfs-recovery.bin 0 0x17c 0x174
 old checksum at offset 372: f55bb8f4
 0aa4470b        0b47a40a        f55bb8f4        f4b85bf5

So you see that the 3rd value matches. Which means that this is a bit inverted crc32 sum.

This tool was very useful when I didn't even now which range the sum should be calculated over, since I easily could change the range without changing the tool or image

1 Like
8

Thanks for the tool @bmork . At the moment the main issue is why the router accepts the initramfs image from tftp but refuses to boot from flash. What I do is just flash the kernel, boot the image and I get a nice message like this "it gives me the checksum if it is incorrect and I just replace it.

FW header checksum should: 0xeb087576, crc32 result: 0xeb087576, Fw header CRC check OK!

I also use okteta from KDE. It is so usefull for people like me (very limited coding knowledge to not say none). I can just highlight the data or even select a range and just click on any checksum that is availble (quite a few there) and get instat result.

1 Like
9

@inflabz I just realised I am uisng your modified breed bootloader. Thanks for doing that.

I just compiled an image from snapshot and everything is working. I guess I will just use that instead of trying to make an image that boots from the stock bootloader.

1 Like
10

Can someone please point me to the right direction? I have been able to get the whole header sorted out (thanks to @Lucky1),

After days of trying to change the receipe to have a similar kernel as the stock one I overlooked for some reason the "Load address". In fact I did not overlook it I just decided it was the same for some reason.

I beleive the bootloader checks that address and it has to be 0x81001000. If I use the default one from openwrt "0x80001000" it loads the kernel and just hangs there. But the initramfs image in tftp does boot and work fine (I guess no checks are made there)

I tried to change that to the 0x81001000 in the "ramips/mage/Makefile" and although now it goes further till starting kernel "which it did not get to before" it does not work "not even the initramfs".

Can someone point me to the right direction please? I did a few search on the openwrt tree and I cannot seem to find a device that changes that. What is the correct way to change it?

"*************************************
Boot Flag : Sercomm0�
*************************************
Fw header Magic check OK!
FW header checksum should: 0x5bf8b2ce, crc32 result: 0x5bf8b2ce, Fw header CRC check OK!
kernel : real offset: 0x00400100, data length: 0x00264715,checksum :0x0a72d890
kernel result: 0x0a72d890, kernel check sum ok!
rootfs:  real offset: 0x01000000, data length: 0x003483fe, checksum :0x59f6e2aa
rootfs result: 0x59f6e2aa, rootfs check sum ok!
Kernel Addr : 0xbc400100
## Booting image at bc400100 ...
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2508501 Bytes =  2.4 MB
   Load Address: 81001000
   Entry Point:  81001000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
kernel addr :0xBC400100 
No initrd
## Transferring control to Linux (at address 81001000) ...
## Giving linux memsize in MB, 256

Starting kernel ...
1 Like
11

If it can help anyone this is the Sercomm header for both S3 and beeline turbo+
All values are written reverse

+------------------------------+-------------------------------------+------------------------------+---------------+
| Sercom HDR "53657200"        | Absoulte lenght for Sercomm footer  | HDR Checksum                 | 02 FF FF FF   |
| FFFFFFFF for hdr crc32 calc  | (normally kernel length + 0x400100) | FFFFFFFF for hdr crc32 calc  |               |
+------------------------------+-------------------------------------+------------------------------+---------------+
| kernel flash offset          | uImage kernel length                | uimage kernel crc32          | 00 00 00 00   |
| 00 01 40 00 (if bootlfag set |                                     |                              |               |
| to Sercomm0)                 |                                     |                              |               |
+------------------------------+-------------------------------------+------------------------------+---------------+
| FF FF FF FF                  | FF FF FF FF                         | rootfs flash offset          | rootfs length |
|                              |                                     | 00 00 00 01 (if bootflag set |               |
|                              |                                     | to Sercomm0)                 |               |
+------------------------------+-------------------------------------+------------------------------+---------------+
| Rootfs checksum              | 00 00 00 00                         | 00 00 00 00                  | 00 00 00 00   |
+------------------------------+-------------------------------------+------------------------------+---------------+````
1 Like
12

Just adding how I managed to get this to boot. maybe it will help someone else.

image/Makefile

define Build/loader-common-s3
	rm -rf $@.src
	$(MAKE) -C lzma-loader \
		PKG_BUILD_DIR="$@.src" \
		TARGET_DIR="$(dir $@)" LOADER_NAME="$(notdir $@)" \
		BOARD="$(BOARDNAME)" PLATFORM="$(LOADER_PLATFORM)" \
		LZMA_TEXT_START=0x82800000 LOADADDR=0x80001000 \
		$(1) compile loader.$(LOADER_TYPE)
	mv "$@.$(LOADER_TYPE)" "$@"
	rm -rf $@.src
endef

define Build/loader-kernel-s3
	$(call Build/loader-common-s3,LOADER_DATA="$@")
endef

define Device/uimage-lzma-loader-s3
  KERNEL_LOADADDR = 0x81001000
  LOADER_TYPE := bin
  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel-s3 | lzma | uImage lzma
endef

And this in the mt7621.mk

define Device/sercomm_s3
$(Device/uimage-lzma-loader-s3)
  BLOCKSIZE := 128k
  PAGESIZE := 2048
  KERNEL_SIZE := 4096k
  UBINIZE_OPTS := -E 5
  IMAGES += kernel0.bin rootfs0.bin
  IMAGE/kernel0.bin := append-kernel
  IMAGE/rootfs0.bin := append-ubi
  DEVICE_VENDOR := Sercomm
  DEVICE_MODEL := S3
  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7615-firmware kmod-usb3 \
  kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += sercomm_s3

dts

// SPDX-License-Identifier: GPL-2.0-or-later OR MIT

#include "mt7621.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>

/ {
	compatible = "sercomm,s3", "mediatek,mt7621-soc";
	model = "Sercomm S3";

	aliases {
		led-boot = &led_status_blue;
		led-failsafe = &led_status_red;
		led-running = &led_status_green;
		led-upgrade = &led_status_red;
		label-mac-device = &gmac0;
	};

	chosen {
		bootargs = "console=ttyS0,57600n8";
	};

	leds {
		compatible = "gpio-leds";

		led_status_blue: status_blue {
			label = "blue:status";
			gpios = <&gpio 13 GPIO_ACTIVE_HIGH>;
		};

		led_status_green: status_green {
			label = "green:status";
			gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
		};

		led_status_red: status_red {
			label = "red:status";
			gpios = <&gpio 16 GPIO_ACTIVE_HIGH>;
		};
	};

	keys {
		compatible = "gpio-keys";

		wps {
			label = "wps";
			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_WPS_BUTTON>;
		};

		reset {
			label = "reset";
			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_RESTART>;
		};
	};
};

&nand {
	status = "okay";

	partitions {
		compatible = "fixed-partitions";
		#address-cells = <1>;
		#size-cells = <1>;

		partition@0 {
			label = "bootloader";
			reg = <0x0 0x100000>;
		};

		partition@100000{
			label = "part_map ";
			reg = <0x100000 0x100000 >;
		};

		factory:partition@200000 {
			label = "factory-data";
			reg = <0x200000 0x100000>;
		};

		partition@300000 {
			label = "bootflag";
			reg = <0x300000 0x100000>;
		};

		partition@400000 {
			label = "kernel0";
			reg = <0x400000 0x600000>;
		};

		partition@a00000 {
			label = "kernel1";
			reg = <0xa00000 0x600000>;
		};

		partition@1000000 {
			label = "ubi";
			reg = <0x1000000 0x2000000>;
		};

		partition@3000000 {
			label = "rootfs1";
			reg = <0x3000000 0x2000000>;
		};

		partition@5000000{
			label = "config-log";
			reg = <0x5000000 0x1400000>;
		};

		partition@6400000 {
			label = "reserved";
			reg = <0x6400000 0x1b80000>;
		};
	};
};

&pcie {
	status = "okay";
};

&pcie0 {
	wifi@0,0 {
		compatible = "pci14c3,7615";
		reg = <0x0000 0 0 0 0>;
		mediatek,mtd-eeprom = <&factory 0x8000>;
		ieee80211-freq-limit = <5000000 6000000>;
		mtd-mac-address = <&factory 0x21000>;
		mtd-mac-address-increment = <2>;
	};
};

&pcie1 {
	wifi@0,0 {
		compatible = "pci14c3,7603";
		reg = <0x0000 0 0 0 0>;
		mediatek,mtd-eeprom = <&factory 0x0000>;
		ieee80211-freq-limit = <2400000 2500000>;
		mtd-mac-address = <&factory 0x21000>;
		mtd-mac-address-increment = <3>;
	};
};

&gmac0 {
	mtd-mac-address = <&factory 0x21000>;
};

&switch0 {
	ports {
		port@0 {
			status = "okay";
			label = "wan";
			mtd-mac-address = <&factory 0x21000>;
			mtd-mac-address-increment = <1>;
		};

		port@1 {
			status = "okay";
			label = "lan1";
		};

		port@2 {
			status = "okay";
			label = "lan2";
		};

		port@3 {
			status = "okay";
			label = "lan3";
		};

		port@4 {
			status = "okay";
			label = "lan4";
		};
	};
};

&state_default {
	gpio {
		groups = "uart2", "jtag";
		function = "gpio";
	};
};
2 Likes
13

And this Sercomm header will pass all the checks. The reason behind it is that I just used 4 bytes for kernel and rootfs checksum therfore they are always the same results

00000000  53 65 72 00 2b 57 66 00  f8 17 de af 02 ff ff ff  |Ser.+Wf.........|
00000010  00 01 40 00 04 00 00 00  a9 d7 62 03 00 00 00 00  |..@.......b.....|
00000020  ff ff ff ff ff ff ff ff  00 00 00 01 04 00 00 00  |................|
00000030  1c fc 55 2d 00 00 00 00  ff ff ff ff ff ff ff ff  |..U-............|
00000040  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000100

and again in a hex

536572002b576600f817deaf02ffffff0001400004000000a9d7620300000000ffffffffffffffff00000001040000001cfc552d00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

*************************************
Boot Flag : Sercomm0�
*************************************
Fw header Magic check OK!
FW header checksum should: 0xafde17f8, crc32 result: 0xafde17f8, Fw header CRC check OK!
kernel : real offset: 0x00400100, data length: 0x00000004,checksum :0x0362d7a9
kernel result: 0x0362d7a9, kernel check sum ok!
rootfs:  real offset: 0x01000000, data length: 0x00000004, checksum :0x2d55fc1c
rootfs result: 0x2d55fc1c, rootfs check sum ok!
Kernel Addr : 0xbc400100
## Booting image at bc400100 ...
   Image Name:   MIPS OpenWrt Linux-5.4.111
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2382013 Bytes =  2.3 MB
   Load Address: 81001000
   Entry Point:  81001000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
kernel addr :0xBC400100 
No initrd
## Transferring control to Linux (at address 81001000) ...
## Giving linux memsize in MB, 256

Starting kernel ...



OpenWrt kernel loader for MIPS based SoC
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80001000...

[    0.000000] Linux version 5.4.111 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16046-59980f7aaf)) #0 SMP Sun Apr 18 10:06:57 2021
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
3 Likes
14

Hello @kar200 and thanks for continuing to work on the device. If you need to test something or information about Turbo+, then let me know. Can you post information and photo about S3 on the WikiDevi (https://wikidevi.wi-cat.ru/ or https://deviwiki.com/)? To compare better. I understand your device gives ISP Etisalat in the UAE?[1][2] Do our devices need to be combined under one vendor name? Or leave it as it is?

15

Hi @MaxS0niX,

If you are interested (and have console access) I can send you the openwrt 21.02.RC I have created. It actually works well.

At the moment I am trying to understand the structure of the update file.
For the Sercomm S3 there is a header with a string with the 1st line that represent probably the model number followed by a 16 byte sha256 that is just the calculation of the firmware in gzip format.

The Turbo+ looks similar exept that sha256sum (or what I think it is) does not match anything I tried. I am still trying to find out what it represent. This way we could have a firmware that can be updated through the web interface.

These are the files to be written to mtd4 and mtd6. !!!!!PLEASE USE THEM ONLY IF YOU HAVE ACCESS TO THE CONSOLE!!!! as since the header is done in a way to always work you won't get the uboot protection that swtiches to the second boot kernel anymore.

1 Like
16

Perhaps your guesses are correct.

17

Sorry, my English is bad :sweat_smile:. UART is connected. Bin files mtd4 and mtd6 are OpenWRT kernel and rootfs for the stock Uboot "Kernel 1" 0x000000400000-0x000000a00000 and "File System 1" 0x000001000000-0x000003000000?

18

Yes that is correct.

@inflabz is working on a better version at the moment. We realized that the bootloader is different as for the turbo+ there is a boot counter that needs to be reset in firmware which this does not have.

If the counter gets to 3 it automatically switch to the second kernel for boot.

You can still try with UART as it won't do anything bad beyond recovery.

1 Like
19

Hi. Thanks your work! If I understand correctly rootfs checksum must be recalculated after any write operation. How do you handle this?

1 Like
20

Hi @csharper2005,

Yes you are correct. But some of the firmware for the Turbo+ already use UBI for the rootfs and they still pass the checksum. I did not look into it but I guess there are no write operations on them.

With openwrt it is tricky. The "append-ubi" seem to create a ubi volume for rootfs that gets formated at the first boot so it changes the header already and the following boot it fails the checksum. I beleive this is done on purpose for openwrt to have a normal size rootfs but to then use the whole partition when it formats it the first time it boots (this is a very uneducated guess).

The easiest way to get around it is to actually set the rootfs size to 4 bytes only rather than the whole rootfs. This can also be done for the kernel. Since the first 4 bytes of the kernel and ubi are always the same in any image it will always pass the check (just a nice way to disabled the check in some way).

2 Likes