Add support for Sercomm S3 on stock uboot

And this Sercomm header will pass all the checks. The reason behind it is that I just used 4 bytes for kernel and rootfs checksum therfore they are always the same results

00000000  53 65 72 00 2b 57 66 00  f8 17 de af 02 ff ff ff  |Ser.+Wf.........|
00000010  00 01 40 00 04 00 00 00  a9 d7 62 03 00 00 00 00  |..@.......b.....|
00000020  ff ff ff ff ff ff ff ff  00 00 00 01 04 00 00 00  |................|
00000030  1c fc 55 2d 00 00 00 00  ff ff ff ff ff ff ff ff  |..U-............|
00000040  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000100

and again in a hex

536572002b576600f817deaf02ffffff0001400004000000a9d7620300000000ffffffffffffffff00000001040000001cfc552d00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
*************************************
Boot Flag : Sercomm0�
*************************************
Fw header Magic check OK!
FW header checksum should: 0xafde17f8, crc32 result: 0xafde17f8, Fw header CRC check OK!
kernel : real offset: 0x00400100, data length: 0x00000004,checksum :0x0362d7a9
kernel result: 0x0362d7a9, kernel check sum ok!
rootfs:  real offset: 0x01000000, data length: 0x00000004, checksum :0x2d55fc1c
rootfs result: 0x2d55fc1c, rootfs check sum ok!
Kernel Addr : 0xbc400100
## Booting image at bc400100 ...
   Image Name:   MIPS OpenWrt Linux-5.4.111
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2382013 Bytes =  2.3 MB
   Load Address: 81001000
   Entry Point:  81001000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
kernel addr :0xBC400100 
No initrd
## Transferring control to Linux (at address 81001000) ...
## Giving linux memsize in MB, 256

Starting kernel ...



OpenWrt kernel loader for MIPS based SoC
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80001000...

[    0.000000] Linux version 5.4.111 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16046-59980f7aaf)) #0 SMP Sun Apr 18 10:06:57 2021
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)

3 Likes

Hello @kar200 and thanks for continuing to work on the device. If you need to test something or information about Turbo+, then let me know. Can you post information and photo about S3 on the WikiDevi (https://wikidevi.wi-cat.ru/ or https://deviwiki.com/)? To compare better. I understand your device gives ISP Etisalat in the UAE?[1][2] Do our devices need to be combined under one vendor name? Or leave it as it is?

Hi @MaxS0niX,

If you are interested (and have console access) I can send you the openwrt 21.02.RC I have created. It actually works well.

At the moment I am trying to understand the structure of the update file.
For the Sercomm S3 there is a header with a string with the 1st line that represent probably the model number followed by a 16 byte sha256 that is just the calculation of the firmware in gzip format.

The Turbo+ looks similar exept that sha256sum (or what I think it is) does not match anything I tried. I am still trying to find out what it represent. This way we could have a firmware that can be updated through the web interface.

These are the files to be written to mtd4 and mtd6. !!!!!PLEASE USE THEM ONLY IF YOU HAVE ACCESS TO THE CONSOLE!!!! as since the header is done in a way to always work you won't get the uboot protection that swtiches to the second boot kernel anymore.

1 Like

Perhaps your guesses are correct.

Sorry, my English is bad :sweat_smile:. UART is connected. Bin files mtd4 and mtd6 are OpenWRT kernel and rootfs for the stock Uboot "Kernel 1" 0x000000400000-0x000000a00000 and "File System 1" 0x000001000000-0x000003000000?

Yes that is correct.

@inflabz is working on a better version at the moment. We realized that the bootloader is different as for the turbo+ there is a boot counter that needs to be reset in firmware which this does not have.

If the counter gets to 3 it automatically switch to the second kernel for boot.

You can still try with UART as it won't do anything bad beyond recovery.

1 Like

Hi. Thanks your work! If I understand correctly rootfs checksum must be recalculated after any write operation. How do you handle this?

1 Like

Hi @csharper2005,

Yes you are correct. But some of the firmware for the Turbo+ already use UBI for the rootfs and they still pass the checksum. I did not look into it but I guess there are no write operations on them.

With openwrt it is tricky. The "append-ubi" seem to create a ubi volume for rootfs that gets formated at the first boot so it changes the header already and the following boot it fails the checksum. I beleive this is done on purpose for openwrt to have a normal size rootfs but to then use the whole partition when it formats it the first time it boots (this is a very uneducated guess).

The easiest way to get around it is to actually set the rootfs size to 4 bytes only rather than the whole rootfs. This can also be done for the kernel. Since the first 4 bytes of the kernel and ubi are always the same in any image it will always pass the check (just a nice way to disabled the check in some way).

2 Likes

Just in case someone needs it
This hdr will pass the checksum calculation with any kernel and rootfs (for Sercomm0 bootflag)

Note: Rootfs needs to be UBI and not JFFS

❯ hexdump -C hdr.bin
00000000  53 65 72 00 2b 57 66 00  f8 17 de af 02 ff ff ff  |Ser.+Wf.........|
00000010  00 01 40 00 04 00 00 00  a9 d7 62 03 00 00 00 00  |..@.......b.....|
00000020  ff ff ff ff ff ff ff ff  00 00 00 01 04 00 00 00  |................|
00000030  1c fc 55 2d 00 00 00 00  ff ff ff ff ff ff ff ff  |..U-............|
00000040  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000100
2 Likes

Oh, magic hdr, thanks. I'm trying to adapt your method to Smartbox Giga / second slot (Sercomm1, kernel@0xa00000). I think the header for this case should look like this:

0000000000: 53 65 72 00 2B 57 66 00 │ F8 17 DE AF 02 FF FF FF  Ser +Wf ø↨Þ¯☻ÿÿÿ
0000000010: 00 01 A0 00 04 00 00 00 │ A9 D7 62 03 00 00 00 00   ☺  ♦   ©×b♥                        
0000000020: FF FF FF FF FF FF FF 00 │ 00 80 02 04 00 00 00 00  ÿÿÿÿÿÿÿ  €☻♦                         
0000000030: 1C FC 55 2D 00 00 00 00 │ FF FF FF FF FF FF FF FF  ∟üU-    ÿÿÿÿÿÿÿÿ                     
0000000040: FF FF FF FF FF FF FF FF │ FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
1 Like

I don't think that one is corect. The only thing that should change between the 2 is the location of the kernel and rootfs "400100 to A00100 for kernel" and " 1000000 to 3000000 for rootfs" and obviously the header checksum.

So:
Sercomm0 bootflag

0000:0000 | 53 65 72 00  2B 57 66 00  F8 17 DE AF  02 FF FF FF | Ser.+Wf.ø.Þ¯.ÿÿÿ
0000:0010 | 00 01 40 00  04 00 00 00  A9 D7 62 03  00 00 00 00 | ..@.....©×b.....
0000:0020 | FF FF FF FF  FF FF FF FF  00 00 00 01  04 00 00 00 | ÿÿÿÿÿÿÿÿ........
0000:0030 | 1C FC 55 2D  00 00 00 00  FF FF FF FF  FF FF FF FF | .üU-....ÿÿÿÿÿÿÿÿ
0000:0040 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:0050 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:0060 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:0070 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:0080 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:0090 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:00A0 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:00B0 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:00C0 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:00D0 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:00E0 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:00F0 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

Sercomm1 bootflag

0000:0000 | 53 65 72 00  2B 57 66 00  80 8C BC 85  02 FF FF FF | Ser.+Wf...¼..ÿÿÿ
0000:0010 | 00 01 A0 00  04 00 00 00  A9 D7 62 03  00 00 00 00 | .. .....©×b.....
0000:0020 | FF FF FF FF  FF FF FF FF  00 00 00 03  04 00 00 00 | ÿÿÿÿÿÿÿÿ........
0000:0030 | 1C FC 55 2D  00 00 00 00  FF FF FF FF  FF FF FF FF | .üU-....ÿÿÿÿÿÿÿÿ
0000:0040 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:0050 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:0060 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:0070 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:0080 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:0090 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:00A0 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:00B0 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:00C0 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:00D0 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:00E0 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
0000:00F0 | FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF | ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
````
2 Likes

What utility do you use to generate the header? I've checked openwrt firmware-utils collection. There are many similar utils but none of them can be used unchanged for our case.

1 Like

At the moment just a hex editor so no utility.
I then use "cat" to add the header to the kernel.

This is still a work in progress. Actually more like a work without progress since I cannot even get an image that flashes from the web interface. The only image I have is one that was sent to the router by the ISP using TR69 which I copied to the usb while the automatic process was flashing the file. That imge does not work with the web interface.

1 Like

SmartBox Giga has a script. It looks that it scans usb for a firmware file S1010_SERCOMM*.img. It's possible that:

  • Your router has the similar script
  • Expected image format is identical to image that was received from your ISP
    In this case you can use this for the experiments with slots / upgrades / boot flags.

#!/bin/sh sleep 10 path=/usr/bin/find /mnt/shares/ -maxdepth 3 -name S1010_SERCOMM*.img 2> /dev/null if [ "$path" != "" ]; then #echo "no FW found!" #else for p in $path;do image=$p done #echo "Upgrade: FW image is ${image}" /bin/cp ${image} /tmp/S1010_SERCOMM_USB_UPGRADE.img /usr/sbin/dualImage_ctrl -du /tmp/S1010_SERCOMM_USB_UPGRADE.img -m USB -r -c #echo "FW Upgrade check done!" fi

1 Like

I saw that script. I was wondering at which stage it runs? Is that during boot?

Unfortubately the image I have only works without the -d switch (dualImgctrl -u firmware.img). I think I copied the file after it got decrypted and unfortunately it does not work anymore.

I restored all the partitions back to what they were when I got it and managed to upgrade it 2 or 3 times when I got the file but now it does not do it anymore.

1 Like

Works. :slight_smile:

Bootlog. Part №1
===================================================================
                MT7621   stage1 code 10:33:11 (ASIC)
                CPU=50000000 HZ BUS=16666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL3 FB_DL: 0x10, 1/0 = 602/422 41000000
PLL4 FB_DL: 0x16, 1/0 = 675/349 59000000
PLL2 FB_DL: 0x1c, 1/0 = 655/369 71000000
do DDR setting..[00320381]
Apply DDR3 Setting...(use customer AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
      --------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    1
000E:|    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1    1
000F:|    0    0    0    0    1    1    1    1    1    1    1    1    1    1    0    0
0010:|    1    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0
0011:|    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
rank 0 coarse = 15
rank 0 fine = 72
B:|    0    0    0    0    0    0    0    0    1    1    1    0    0    0    0    0
opt_dle value:9
DRAMC_R0DELDLY[018]=00001D1F
==================================================================
                RX      DQS perbit delay software calibration 
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    13 5 11 9 11 6 11 6 2 9 
10 |    5 13 7 9 4 9 
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center 
y=0-7bit DQ of every group
input delay:DQS0 =31 DQS1 = 29
==================================================================
bit     DQS0     bit      DQS1
0  (1~59)30  8  (1~54)27
1  (1~52)26  9  (1~57)29
2  (1~57)29  10  (1~57)29
3  (1~56)28  11  (1~54)27
4  (1~57)29  12  (1~57)29
5  (1~56)28  13  (1~55)28
6  (0~58)29  14  (1~57)29
7  (2~60)31  15  (1~56)28
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    14 10 13 12 13 9 13 6 4 9 
10 |    5 15 7 10 4 10 
==================================================================
==================================================================
     TX  perbyte calibration 
==================================================================
DQS loop = 15, cmp_err_1 = ffff2b01 
DQS loop = 14, cmp_err_1 = ffff0800 
dqs_perbyte_dly.last_dqsdly_pass[0]=14,  finish count=1 
DQS loop = 13, cmp_err_1 = ffff0000 
dqs_perbyte_dly.last_dqsdly_pass[1]=13,  finish count=2 
DQ loop=15, cmp_err_1 = ffff00a2
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=1 
DQ loop=14, cmp_err_1 = ffff0080
DQ loop=13, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=13,  finish count=2 
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,9)
20,data:88
[EMI] DRAMC calibration passed

===================================================================
                MT7621   stage1 code done 
                CPU=50000000 HZ BUS=16666666 HZ
===================================================================


U-Boot 1.1.3 (Mar  6 2018 - 19:39:59)

Board: Ralink APSoC DRAM:  128 MB
rt2880 uboot v0.00e04 05/25/2006
SERIAL_CLOCK_DIVISOR =16 
kaiker,,CONFIG_BAUDRATE =57600 
SDRAM SIZE:08000000
Top of RAM usable for U-Boot at: 88000000
Reserving 426k for U-Boot at: 87f94000
Reserving 1028k for malloc() at: 87e93000
Reserving 44 Bytes for Board Info at: 87e92fd4
Reserving 36 Bytes for Global Data at: 87e92fb0
Reserving 128k for boot params() at: 87e72fb0
Stack Pointer at: 87e72f98
relocate_code Pointer at: 87f94000

Config XHCI 40M PLL 
******************************
Software System Reset Occurred
******************************
Now running in RAM - U-Boot at: 87f94000

 monitor_flash_len =117844 
Command "mdio": 0xa0206b28 => 0x87f9ab28
Command "nand": 0xa020c460 => 0x87fa0460
Command "reset": 0xa0215ecc => 0x87fa9ecc
Command "go": 0xa020de0c => 0x87fa1e0c
Command "bootm": 0xa020e668 => 0x87fa2668
Command "loadb": 0xa020f328 => 0x87fa3328
Command "tftpboot": 0xa020f958 => 0x87fa3958
Command "nm": 0xa020ffe4 => 0x87fa3fe4
Command "mm": 0xa0210048 => 0x87fa4048
Command "md": 0xa02100ac => 0x87fa40ac
Command "saveenv": 0xa0210624 => 0x87fa4624
Command "setenv": 0xa0210f94 => 0x87fa4f94
Command "printenv": 0xa0210674 => 0x87fa4674
Command "?": 0xa0211268 => 0x87fa5268
Command "help": 0xa0211268 => 0x87fa5268
Command "version": 0xa0211128 => 0x87fa5128
Command "sc_boot": 0xa0213ed4 => 0x87fa7ed4
Command "sc_nand": 0xa0213f0c => 0x87fa7f0c
Command "sc_eth_test": 0xa0213f48 => 0x87fa7f48
Command "sc_phy": 0xa0213f84 => 0x87fa7f84
Command "sc_time": 0xa0213fc0 => 0x87fa7fc0
Command "sc_btver": 0xa0213ff8 => 0x87fa7ff8
Command "sc_fl_map": 0xa0214034 => 0x87fa8034
Command "sc_endian": 0xa0214070 => 0x87fa8070
Command "sc_ramtest": 0xa02140ac => 0x87fa80ac
Command "sc_gpio": 0xa02140e8 => 0x87fa80e8
Command "sc_led": 0xa0214124 => 0x87fa8124
Command "sc_dl": 0xa0214160 => 0x87fa8160
Allocate 16 byte aligned buffer: 87fca810
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [C2 F1 80 95 02]
Device found in MTK table, ID: c2f1, EXT_ID: 809502
Support this Device in MTK table! c2f1 
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
*** Warning - bad CRC, using default environment

============================================ 
Ralink UBoot Version: 5.0.0.0
-------------------------------------------- 
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection 
DRAM_TYPE: DDR3 
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Mar  6 2018  Time:19:39:59
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 880 MHZ #### 
 estimate memory size =128 Mbytes
#Reset_MT7530
set LAN/WAN WLLLL

Load Standalone from 40000
SC_DEBUG: Nand Partition Table Magic Found at 100000.

******************************************
    Uboot StandAlone Entry
******************************************
GPIO init
*********************************************************
      Press any key to enter Boot Command Interface      
*********************************************************
 0 
SC_DEBUG: Nand Partition Table Magic Found at 100000.

******************************************
    Uboot StandAlone Entry
******************************************

***************************************************
    Sercomm Boot Version 2.0.0.0, at Mar  6 2018, 19:39:56

***************************************************
SC_DEBUG: Nand Partition Table Magic Found at 100000.
Entering Firmware : Everything is OK.

*************************************
Boot Flag : Sercomm0�
*************************************

Kernel image header:
Image Addr:     00400100
Image Len:      00000004
Image CRC:      0362D7A9
Start to calculate kernel_crc from 0x00400100 ....
Kernel CRC verify OK!
Kernel Addr : 0xbc400100
## Booting image at bc400100 ...
   Image Name:   MIPS OpenWrt Linux-5.4.111
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2382013 Bytes =  2.3 MB
   Load Address: 81001000
   Entry Point:  81001000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
boot_count1 is 01
write 2 to boot_count1
ranand_erase: start:320000, len:20000 
.kernel addr :0xBC400100 
No initrd
## Transferring control to Linux (at address 81001000) ...
## Giving linux memsize in MB, 128

Starting kernel ...



OpenWrt kernel loader for MIPS based SoC
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80001000...

[    0.000000] Linux version 5.4.111 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16046-59980f7aaf)) #0 SMP Sun Apr 18 10:06:57 2021
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is Sercomm S3
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Bootlog. Part №2
[    0.000000] Linux version 5.4.111 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16046-59980f7aaf)) #0 SMP Sun Apr 18 10:06:57 2021
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is Sercomm S3
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] percpu: Embedded 14 pages/cpu s26768 r8192 d22384 u57344
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,57600n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00001150
[    0.000000] Readback ErrCtl register=00001150
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 121032K/131072K available (6047K kernel code, 207K rwdata, 744K rodata, 1244K init, 238K bss, 10040K reserved, 0K cma-reserved, 0K hi)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[    0.000000] NR_IRQS: 256
[    0.000000] random: get_random_bytes called from 0x806d9998 with crng_init=0
[    0.000000] CPU Clock: 880MHz
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns
[    0.000008] sched_clock: 32 bits at 440MHz, resolution 2ns, wraps every 4880645118ns
[    0.015492] Calibrating delay loop... 583.68 BogoMIPS (lpj=1167360)
[    0.055835] pid_max: default: 32768 minimum: 301
[    0.065184] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.079592] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.097666] rcu: Hierarchical SRCU implementation.
[    0.107771] smp: Bringing up secondary CPUs ...
[    5.234384] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    5.234394] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    5.234406] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    5.234507] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.144947] Synchronize counters for CPU 1: done.
[    5.325410] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    5.325418] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    5.325425] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    5.325486] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.239385] Synchronize counters for CPU 2: done.
[    5.416547] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    5.416554] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    5.416561] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    5.416624] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.326983] Synchronize counters for CPU 3: done.
[    0.386589] smp: Brought up 1 node, 4 CPUs
[    0.399030] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.418322] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[    0.432148] pinctrl core: initialized pinctrl subsystem
[    0.444097] NET: Registered protocol family 16
[    0.475060] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[    0.495739] clocksource: Switched to clocksource GIC
[    0.507425] NET: Registered protocol family 2
[    0.516939] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.533552] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.548674] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.562664] TCP: Hash tables configured (established 1024 bind 1024)
[    0.575417] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.588311] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.602401] NET: Registered protocol family 1
[    0.610969] PCI: CLS 0 bytes, default 32
[    0.707711] 4 CPUs re-calibrate udelay(lpj = 1163264)
[    0.719236] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.732794] random: fast init done
[    0.750094] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.761608] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.782487] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.798821] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.810089] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.821320] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.832992] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.848778] printk: console [ttyS0] disabled
[    0.857233] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 19, base_baud = 3125000) is a 16550A
[    0.875162] printk: console [ttyS0] enabled
[    0.875162] printk: console [ttyS0] enabled
[    0.891733] printk: bootconsole [early0] disabled
[    0.891733] printk: bootconsole [early0] disabled
[    0.912910] mt7621-nand 1e003000.nand: Using programmed access timing: 31c07388
[    0.927782] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xf1
[    0.940439] nand: Macronix MX30LF1G18AC
[    0.948081] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    0.963163] mt7621-nand 1e003000.nand: ECC strength adjusted to 4 bits
[    0.976206] mt7621-nand 1e003000.nand: Using programmed access timing: 21005134
[    0.990771] mt7621-nand 1e003000.nand: Using programmed access timing: 21005134
[    1.005335] Scanning device for bad blocks
[    2.313003] 10 fixed-partitions partitions found on MTD device mt7621-nand
[    2.326706] Creating 10 MTD partitions on "mt7621-nand":
[    2.337301] 0x000000000000-0x000000100000 : "bootloader"
[    2.349306] 0x000000100000-0x000000200000 : "part_map"
[    2.360899] 0x000000200000-0x000000300000 : "factory-data"
[    2.373099] 0x000000300000-0x000000400000 : "bootflag"
[    2.384759] 0x000000400000-0x000000a00000 : "kernel0"
[    2.396243] 0x000000a00000-0x000001000000 : "kernel1"
[    2.407810] 0x000001000000-0x000003000000 : "ubi"
[    2.418666] 0x000003000000-0x000005000000 : "rootfs1"
[    2.430309] 0x000005000000-0x000006400000 : "config-log"
[    2.442337] 0x000006400000-0x000007f80000 : "reserved"
[    2.455581] libphy: Fixed MDIO Bus: probed
[    2.490179] libphy: mdio: probed
[    2.496879] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    2.513372] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 21
[    2.532140] mt7621-pci 1e140000.pcie: Parsing DT failed
[    2.545413] NET: Registered protocol family 10
[    2.555817] Segment Routing with IPv6
[    2.563240] NET: Registered protocol family 17
[    2.572199] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.598278] 8021q: 802.1Q VLAN Support v1.8
[    2.608648] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    2.631743] libphy: dsa slave smi: probed
[    2.640167] mt7530 mdio-bus:1f wan (uninitialized): PHY [dsa-0.0:00] driver [Generic PHY]
[    2.657951] mt7530 mdio-bus:1f lan1 (uninitialized): PHY [dsa-0.0:01] driver [Generic PHY]
[    2.675928] mt7530 mdio-bus:1f lan2 (uninitialized): PHY [dsa-0.0:02] driver [Generic PHY]
[    2.693850] mt7530 mdio-bus:1f lan3 (uninitialized): PHY [dsa-0.0:03] driver [Generic PHY]
[    2.711821] mt7530 mdio-bus:1f lan4 (uninitialized): PHY [dsa-0.0:04] driver [Generic PHY]
[    2.729806] mt7530 mdio-bus:1f: configuring for fixed/rgmii link mode
[    2.747430] DSA: tree 0 setup
[    2.753726] rt2880-pinmux pinctrl: pcie is already enabled
[    2.764681] mt7621-pci 1e140000.pcie: Error applying setting, reverse things back
[    2.779778] mt7621-pci-phy 1e149000.pcie-phy: PHY for 0xbe149000 (dual port = 1)
[    2.794714] mt7621-pci-phy 1e14a000.pcie-phy: PHY for 0xbe14a000 (dual port = 0)
[    2.909298] mt7621-pci-phy 1e149000.pcie-phy: Xtal is 40MHz
[    2.920419] mt7621-pci-phy 1e14a000.pcie-phy: Xtal is 40MHz
[    3.031292] mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK)
[    3.045169] mt7621-pci 1e140000.pcie: PCIE0 enabled
[    3.054886] mt7621-pci 1e140000.pcie: PCIE1 enabled
[    3.064615] mt7621-pci 1e140000.pcie: PCI coherence region base: 0x60000000, mask/settings: 0xf0000002
[    3.083340] mt7621-pci 1e140000.pcie: PCI host bridge to bus 0000:00
[    3.096029] pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
[    3.109731] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    3.123439] pci_bus 0000:00: root bus resource [bus 00-ff]
[    3.134412] pci 0000:00:00.0: [0e8d:0801] type 01 class 0x060400
[    3.146415] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    3.158910] pci 0000:00:00.0: reg 0x14: [mem 0x60400000-0x6040ffff]
[    3.171469] pci 0000:00:00.0: supports D1
[    3.179461] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    3.191310] pci 0000:00:01.0: [0e8d:0801] type 01 class 0x060400
[    3.203323] pci 0000:00:01.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    3.215823] pci 0000:00:01.0: reg 0x14: [mem 0x60410000-0x6041ffff]
[    3.228375] pci 0000:00:01.0: supports D1
[    3.236370] pci 0000:00:01.0: PME# supported from D0 D1 D3hot
[    3.249420] pci 0000:01:00.0: [14c3:7615] type 00 class 0x000280
[    3.261463] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit]
[    3.275158] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5 GT/s x1 link)
[    3.304144] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    3.314567] pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
[    3.326713] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    3.340245] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref]
[    3.354642] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    3.368061] pci 0000:02:00.0: [14c3:7603] type 00 class 0x028000
[    3.380091] pci 0000:02:00.0: reg 0x10: [mem 0x00000000-0x000fffff]
[    3.392718] pci 0000:02:00.0: PME# supported from D0 D3hot D3cold
[    3.406290] pci 0000:00:01.0: PCI bridge to [bus 02-ff]
[    3.416725] pci 0000:00:01.0:   bridge window [io  0x0000-0x0fff]
[    3.428870] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
[    3.442398] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff pref]
[    3.456796] pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 02
[    3.470024] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    3.483205] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    3.497088] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000]
[    3.510274] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000]
[    3.524153] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    3.537683] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref]
[    3.552081] pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff]
[    3.565611] pci 0000:00:01.0: BAR 9: assigned [mem 0x60300000-0x603fffff pref]
[    3.580009] pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff]
[    3.593543] pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff]
[    3.607075] pci 0000:00:00.0: BAR 7: assigned [io  0x1e160000-0x1e160fff]
[    3.620608] pci 0000:00:01.0: BAR 7: assigned [io  0x1e161000-0x1e161fff]
[    3.634144] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
[    3.648729] pci 0000:00:00.0: PCI bridge to [bus 01]
[    3.658623] pci 0000:00:00.0:   bridge window [io  0x1e160000-0x1e160fff]
[    3.672155] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    3.685684] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref]
[    3.700086] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff]
[    3.713616] pci 0000:00:01.0: PCI bridge to [bus 02]
[    3.723509] pci 0000:00:01.0:   bridge window [io  0x1e161000-0x1e161fff]
[    3.737041] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
[    3.750569] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff pref]
[    3.765496] mt7530 mdio-bus:1f: Link is Up - 1Gbps/Full - flow control off
[    3.769018] UBI: auto-attach mtd6
[    3.785902] ubi0: attaching mtd6
[    3.834708] UBI: EOF marker found, PEBs from 33 will be erased
[    3.846575] ubi0: scanning is finished
[    3.894040] ubi0: volume 1 ("rootfs_data") re-sized from 9 to 201 LEBs
[    3.907945] ubi0: attached mtd6 (name "ubi", size 32 MiB)
[    3.918723] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    3.932419] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    3.945935] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    3.959806] ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
[    3.971770] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    3.986152] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1618740417
[    4.004345] ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB handling: 20
[    4.022733] ubi0: background thread "ubi_bgt0d" started, PID 498
[    4.024528] block ubiblock0_0: created from ubi0:0(rootfs)
[    4.045645] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem
[    4.059520] hctosys: unable to open rtc device (rtc0)
[    4.086554] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    4.106128] Freeing unused kernel memory: 1244K
[    4.115183] This architecture does not have kernel memory protection.
[    4.128060] Run /sbin/init as init process
[    4.688789] init: Console is alive
[    4.695872] init: - watchdog -
[    5.476608] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    5.578297] usbcore: registered new interface driver usbfs
[    5.589390] usbcore: registered new interface driver hub
[    5.600107] usbcore: registered new device driver usb
[    5.619838] xhci-mtk 1e1c0000.xhci: 1e1c0000.xhci supply vbus not found, using dummy regulator
[    5.637142] xhci-mtk 1e1c0000.xhci: 1e1c0000.xhci supply vusb33 not found, using dummy regulator
[    5.654853] xhci-mtk 1e1c0000.xhci: xHCI Host Controller
[    5.665473] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus number 1
[    5.687905] xhci-mtk 1e1c0000.xhci: hcc params 0x01401198 hci version 0x96 quirks 0x0000000000290010
[    5.706194] xhci-mtk 1e1c0000.xhci: irq 20, io mem 0x1e1c0000
[    5.718953] hub 1-0:1.0: USB hub found
[    5.726539] hub 1-0:1.0: 2 ports detected
[    5.735224] xhci-mtk 1e1c0000.xhci: xHCI Host Controller
[    5.745855] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus number 2
[    5.760778] xhci-mtk 1e1c0000.xhci: Host supports USB 3.0 SuperSpeed
[    5.773646] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    5.790669] hub 2-0:1.0: USB hub found
[    5.798243] hub 2-0:1.0: 1 port detected
[    5.811482] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    5.832060] init: - preinit -
[    6.493461] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode
[    6.509554] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
[    6.526409] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    6.674524] random: jshn: uninitialized urandom read (4 bytes read)
[    6.744852] random: jshn: uninitialized urandom read (4 bytes read)
[    6.785281] random: jshn: uninitialized urandom read (4 bytes read)
[    6.995467] mt7530 mdio-bus:1f lan1: configuring for phy/gmii link mode
[    7.009136] 8021q: adding VLAN 0 to HW filter on device lan1
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   11.212454] UBIFS (ubi0:1): default file-system created
[   11.224250] UBIFS (ubi0:1): Mounting in unauthenticated mode
[   11.235800] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 637
[   11.359960] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[   11.375595] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   11.395344] UBIFS (ubi0:1): FS size: 24252416 bytes (23 MiB, 191 LEBs), journal size 1269760 bytes (1 MiB, 10 LEBs)
[   11.416127] UBIFS (ubi0:1): reserved for root: 1145500 bytes (1118 KiB)
[   11.429303] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 4163FF7D-EDAC-4CA9-BC78-C822FF4651A4, small LPT model
[   11.454895] mount_root: overlay filesystem has not been fully initialized yet
[   11.469618] mount_root: switching to ubifs overlay
[   11.485849] urandom-seed: Seed file not found (/etc/urandom.seed)
[   11.573047] procd: - early -
[   11.578929] procd: - watchdog -
[   12.179925] procd: - watchdog -
[   12.186829] procd: - ubus -
[   12.294422] procd: - init -
Please press Enter to activate this console.
[   12.891258] kmodloader: loading kernel modules from /etc/modules.d/*
[   12.916711] Loading modules backported from Linux version v5.10.16-0-gde53befa79cf
[   12.931812] Backport generated by backports.git v5.10.16-1-0-g21d2a1d2
[   12.960392] xt_time: kernel timezone is -0000
[   13.015478] mt7621-pci 1e140000.pcie: bus=2 slot=1 irq=24
[   13.026289] pci 0000:00:01.0: enabling device (0006 -> 0007)
[   13.037588] mt7603e 0000:02:00.0: enabling device (0000 -> 0002)
[   13.049758] mt7603e 0000:02:00.0: ASIC revision: 76030010
[   13.076385] urngd: v1.0.2 started.
[   13.217463] random: crng init done
[   13.224260] random: 7 urandom warning(s) missed due to ratelimiting
[   13.681016] mt7603e 0000:02:00.0: Firmware Version: ap_pcie
[   13.692150] mt7603e 0000:02:00.0: Build Time: 20160107100755
[   13.727729] mt7603e 0000:02:00.0: firmware init done
[   13.921759] mt7621-pci 1e140000.pcie: bus=1 slot=0 irq=23
[   13.932619] pci 0000:00:00.0: enabling device (0006 -> 0007)
[   13.943936] mt7615e 0000:01:00.0: enabling device (0000 -> 0002)
[   13.998120] PPP generic driver version 2.4.2
[   14.008715] NET: Registered protocol family 24
[   14.032733] kmodloader: done loading kernel modules from /etc/modules.d/*
[   14.093866] mt7615e 0000:01:00.0: HW/SW Version: 0x8a108a10, Build Time: 20180518100604a
[   14.093866] 
[   14.453960] mt7615e 0000:01:00.0: N9 Firmware Version: _reserved_, Build Time: 20200814163649
[   14.505666] mt7615e 0000:01:00.0: CR4 Firmware Version: _reserved_, Build Time: 20190121161307
[   51.017078] mtk_soc_eth 1e100000.ethernet eth0: Link is Down
[   51.041797] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode
[   51.057871] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
[   51.061890] mt7530 mdio-bus:1f lan1: configuring for phy/gmii link mode
[   51.088881] 8021q: adding VLAN 0 to HW filter on device lan1
[   51.103669] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   51.117412] br-lan: port 1(lan1) entered blocking state
[   51.128215] br-lan: port 1(lan1) entered disabled state
[   51.140010] device lan1 entered promiscuous mode
[   51.149306] device eth0 entered promiscuous mode
[   51.186286] mt7530 mdio-bus:1f lan2: configuring for phy/gmii link mode
[   51.201298] 8021q: adding VLAN 0 to HW filter on device lan2
[   51.215925] br-lan: port 2(lan2) entered blocking state
[   51.226513] br-lan: port 2(lan2) entered disabled state
[   51.238555] device lan2 entered promiscuous mode
[   51.258847] mt7530 mdio-bus:1f lan3: configuring for phy/gmii link mode
[   51.272831] 8021q: adding VLAN 0 to HW filter on device lan3
[   51.290581] br-lan: port 3(lan3) entered blocking state
[   51.301092] br-lan: port 3(lan3) entered disabled state
[   51.313052] device lan3 entered promiscuous mode
[   51.333973] mt7530 mdio-bus:1f lan4: configuring for phy/gmii link mode
[   51.347990] 8021q: adding VLAN 0 to HW filter on device lan4
[   51.364511] br-lan: port 4(lan4) entered blocking state
[   51.375034] br-lan: port 4(lan4) entered disabled state
[   51.387051] device lan4 entered promiscuous mode
[   51.416875] mt7530 mdio-bus:1f wan: configuring for phy/gmii link mode
[   51.430699] 8021q: adding VLAN 0 to HW filter on device wan
[   54.280231] mt7530 mdio-bus:1f lan2: Link is Up - 1Gbps/Full - flow control rx/tx
[   54.295207] br-lan: port 2(lan2) entered blocking state
[   54.305674] br-lan: port 2(lan2) entered forwarding state
[   54.317369] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   55.528237] mt7530 mdio-bus:1f wan: Link is Up - 1Gbps/Full - flow control rx/tx
[   55.543019] IPv6: ADDRCONF(NETDEV_CHANGE): wan: link becomes ready



BusyBox v1.33.0 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 21.02.0-rc1, r16046-59980f7aaf
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# ubus call system board
{
        "kernel": "5.4.111",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7621 ver:1 eco:3",
        "model": "Sercomm S3",
        "board_name": "sercomm,s3",
        "release": {
                "distribution": "OpenWrt",
                "version": "21.02.0-rc1",
                "revision": "r16046-59980f7aaf",
                "target": "ramips/mt7621",
                "description": "OpenWrt 21.02.0-rc1 r16046-59980f7aaf"
        }
}
root@OpenWrt:/# 

Снимок экрана_2021-06-13_23-22-30

I've written a script to generate hdr automatically during the compilation of Openwrt. Perhaps it will be useful to someone.

#!/usr/bin/env bash
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
#
###
### serkernhdr - calculates and appends a special kernel header.###
#
# (0x00) Sercomm HDR "53657200"
SERHDR_00=53657200
# (0x02) Unknown
SERHDR_02=02ffffff
# (0x02) For SmartBox GIGA - RootFS offset + RootFS size
#SERHDR_04=04008002
# (0x10) Kernel offset
SERHDR_10=00a00100
# (0x28) RootFS offset
SERHDR_28=02800000
# (0x34, 0x1c) Just 0
SERHDR_ZZ=00000000
#
# Kernel image
IMAGE_KERNEL=$1
# RootFS image
IMAGE_ROOTFS=$2
# Temp file
SERHDR_TMP=$3

add_zeros () {
        awk '{ printf "%8s\n", $0 }' | sed 's/ /0/g'
}

# Endianness swap
swap_bytes () {
	add_zeros | awk '{for (i=7;i>=1;i=i-2) printf "%s%s", \
		substr($1,i,2), (i>1?"":"\n")}'
}

# Returns filesize (hex, reversed)
get_fsize () {
	printf "%x\n" `stat -c "%s" $1` | swap_bytes
}

# Returns crc32 (hex, reversed)
get_fcrc () {
	dd if=$1 2>/dev/null | gzip -c | tail -c 8 | od -An -tx4 -N4 \
		--endian=big | tr -d ' \n' | add_zeros
}

# Writes 4 bytes in the header by offset
write_hdr () {
	echo -ne "$(echo $1 | sed 's/../\\x&/g')" | dd of=$2 bs=1 \
		seek=$(($3)) count=4 conv=notrunc status=none 2>/dev/null
}

# Filling 256 bytes with 0xFF
dd if=/dev/zero ibs=1 count=256 status=none | tr "\000" "\377" > \
	$SERHDR_TMP 2>/dev/null

write_hdr $SERHDR_ZZ $SERHDR_TMP $((0x1c))
write_hdr $SERHDR_ZZ $SERHDR_TMP $((0x34))
write_hdr $SERHDR_02 $SERHDR_TMP $((0x0c))
write_hdr $(printf "%x\n" $((16#$SERHDR_28 + 16#$(get_fsize \
	$IMAGE_ROOTFS | swap_bytes ))) | swap_bytes) $SERHDR_TMP $((0x04))
write_hdr $(echo $SERHDR_10 | swap_bytes) $SERHDR_TMP $((0x10))
write_hdr $(echo $SERHDR_28 | swap_bytes) $SERHDR_TMP $((0x28))
write_hdr $(get_fsize $IMAGE_KERNEL) $SERHDR_TMP $((0x14))
write_hdr $(get_fcrc  $IMAGE_KERNEL) $SERHDR_TMP $((0x18))
write_hdr $(get_fsize $IMAGE_ROOTFS) $SERHDR_TMP $((0x2c))
write_hdr $(get_fcrc  $IMAGE_ROOTFS) $SERHDR_TMP $((0x30))
write_hdr $(get_fcrc  $SERHDR_TMP)   $SERHDR_TMP $((0x08))
write_hdr $SERHDR_00 $SERHDR_TMP $((0x00))

dd if=$SERHDR_TMP     > $IMAGE_KERNEL.temporary
dd if=$IMAGE_KERNEL  >> $IMAGE_KERNEL.temporary
mv $IMAGE_KERNEL.temporary $IMAGE_KERNEL
rm $SERHDR_TMP

3 Likes
  1. Place serkernhdr in $(TOPDIR)/scripts and and adjust to your device / layout.
  2. Add this to ramips/image/Makefile
define Build/sercomm-kernel
        $(TOPDIR)/scripts/serkernhdr $@ $(IMAGE_ROOTFS) $@.hdr
endef
  1. Add this to your device definition in mt7621.mk
  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | uImage none \
        | sercomm-kernel
  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | \
        uImage none
  IMAGES += kernel1.bin rootfs1.bin
  IMAGE/kernel1.bin := append-kernel
  IMAGE/rootfs1.bin := append-ubi | check-size
2 Likes

Good work @csharper2005. Did you manage to find a way to reset the boot count? or does it change boot flag after restarting?

1 Like