Add support for TP-Link Archer A10

gusbrac · February 27, 2022, 9:26pm

Hi everybody!

Looking to get help and help in getting this device supported.

Mandatory I'm 100% new and I have no idea what I'm doing disclaimer.
All the advances I made so far with this device has been thanks to the amazing posts of the community

The TL;DR of current status: booting fine through a generated initramfs image, LAN ports and Wifi seem to be working (thankfully it has very similar hardware to other devices). Currently finding ways to flash to NAND but it will probably require a U-boot rewrite as the stock U-boot seems to do some firmware checks. Details below.

Hardware:

CPU: MediaTek MT7621AT
NAND Flash: 128 MiB (ESMT F59L1G81MA-25T)
RAM: 256 MiB (Nanya NT5CC128M16IP-DI)
1x USB 3.0 port
Wireless: 5G MediaTek MT7615N, 2.4G MediaTek MT7615N
ETH1 chip: MediaTek MT7621AT
Network ports: 1-WAN, 4-1GbE-LAN

There seem to be 2 variants of the A10 which are A10 and A10 Pro. The only difference seems to be the USB 3.0 port on the Pro version.
The device on my hands was bought in Japan and on the inside it has a tag that says "Archer A2600 Pro(JP)Ver:1.0". I've seen this model ambiguously refered to as the A2600 and A10 (Pro and non Pro versions).
The TP-Link GPL source code for this model also includes sections for/from the Archer C2300 v2 and partially the Archer C6U (couldn't identify the version).

This device is also incredibly similar to the TP-Link EC330-G5u perhaps only with RAM variations, I'm linking to a 4pda forum post where they already took quite a deep dive on the EC330-G5u and that's from where I learned most of the info on how to work on my device:
https://4pda.to/forum/index.php?showtopic=1030035

In fact the A10 is mentioned in this thread and they note the A10 is super similar but has more RAM and no SkyWorks amplifiers. Hopefully by uniting efforts we can get OpenWRT support on several similar devices.
I recently revisited this thread and saw there was some work with the GPL sources but they are not really complete.

With some tweaks I managed to have it partially work but pretty much it only outputs U-boot images, no kernel images.
I saw some targets to make an image but the GPL sources definitely don't have everything needed to create one. In particular some tools which will be mentioned below.

The board has easily accesible UART pins which leads to a console with root access.

Information regarding the flash layout is as follows:

root@Akronite:/proc/sys# cat /proc/mtd
dev:    size   erasesize  name offset
mtd0: 00100000 00020000 "uboot" 00000000
mtd1: 00100000 00020000 "ubootenv" 00100000
mtd2: 03000000 00020000 "os0" 00200000
mtd3: 03000000 00020000 "os1" 03200000
mtd4: 00800000 00020000 "tp_data" 06200000
mtd5: 00400000 00020000 "radio" 06a00000
mtd6: 01180000 00020000 "data" 06e00000
mtd7: 07f80000 00020000 "wholeflash" 00000000
mtd8: 00100000 00020000 "nvram" 00100000
mtd9: 03000000 00020000 "rootfs" 00200000
mtd10: 03000000 00020000 "backup" 03200000

console boot log shows the following:

 Creating 11 MTD partitions on "MT7621-NAND":
[    2.412000] 0x000000000000-0x000000100000 : "uboot"
[    2.416000] 0x000000100000-0x000000200000 : "ubootenv"
[    2.424000] 0x000000200000-0x000003200000 : "os0"
[    2.440000] 0x000003200000-0x000006200000 : "os1"
[    2.460000] 0x000006200000-0x000006a00000 : "tp_data"
[    2.468000] 0x000006a00000-0x000006e00000 : "radio"
[    2.476000] 0x000006e00000-0x000007f80000 : "data"
[    2.488000] 0x000000000000-0x000007f80000 : "wholeflash"
[    2.528000] 0x000000100000-0x000000200000 : "nvram"
[    2.532000] 0x000000200000-0x000003200000 : "rootfs"
[    2.552000] 0x000003200000-0x000006200000 : "backup"

I have a backup of the wholeflash just in case.

From what I can gather, the rootfs, kernel, and final bootloader, all are inside a jffs2 filesystem. However the kernel and final bootloader are uncompressed within the fs with what I assume is a custom tool.

on the /bootfs/ dir there are three files: vmlinuz, tag_kernel and the confusingly named cferam.000
I can see CFE ram is related to the bootloader of Broadcom devices so I guess these devices are mostly running patched code from the C2300 v1.
However, when comparing the cferam.000 file of this device, it looks nothing like the cferam.000 of a broadcom device. It seems rather to be the final bootloader ("image bootloader"):

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x51F87DAE, created: 2020-04-21 01:57:26, image size: 146544 bytes, Data Address: 0xA01FB040, Entry Point: 0xA0200000, data CRC: 0xF6571FE5, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: "NAND Flash I"
121124        0x1D924         CRC32 polynomial table, little endian
122148        0x1DD24         U-Boot version string, "U-Boot 1.1.3 (Apr 21 2020 - 09:57:19)"

The sources suggest there are 3 bootloaders: the first U-boot, the main U-boot and the image u-boot (which is apparently the one that lives in cferam.000)
The image U-boot is not in the Uboot partition but in the jffs2 filsystem, uncompressed.

In the source the makefile shows the following section:


        echo "build firmware..."
        #@$(CONFIG_DIR)/buildFs $(IMAGE_DIR) $(CONFIG_DIR) $(SDK_ROOT_DIR)
        cp -f $(SDK_BIN_DIR)/linux.7z $(IMAGE_DIR)/vmlinuz
        cp -f $(CONFIG_DIR)/imageuboot.bin $(IMAGE_DIR)/uboot.bin

        @# prepare bootfs
        [ -d $(IMAGE_DIR)/bootfs ] || mkdir -p $(IMAGE_DIR)/bootfs
        @cp $(IMAGE_DIR)/uboot.bin $(IMAGE_DIR)/bootfs/cferam.000
        @cp $(IMAGE_DIR)/vmlinuz $(IMAGE_DIR)/bootfs/
        @dd if=/dev/zero of=$(IMAGE_DIR)/bootfs/tag_kernel bs=512 count=1
        @cp -pf $(IMAGE_DIR)/bootfs/* $(IMAGE_ROOTFS_DIR)/
        @echo "/cferam.000" > $(IMAGE_DIR)/nocomprlist
        @echo "/vmlinuz" >> $(IMAGE_DIR)/nocomprlist
        @echo "/tag_kernel" >> $(IMAGE_DIR)/nocomprlist
        @mkdir -p $(IMAGE_ROOTFS_DIR)/data
        @mkdir -p $(IMAGE_ROOTFS_DIR)/tp_data
        @mkdir -p $(IMAGE_ROOTFS_DIR)/radio
        @ln -sf /tag_kernel $(IMAGE_ROOTFS_DIR)/etc/tag_kernel
        @$(HOSTTOOLS_DIR)/fakeroot $(HOSTTOOLS_DIR)/mkfs.jffs2 -l -p -n -e 131072 -r $(IMAGE_ROOTFS_DIR)/ -o $(IMAGE_DIR)/rootfs.jffs2 -N $(IMAGE_DIR)/nocomprlist
        @$(HOSTTOOLS_DIR)/fakeroot $(HOSTTOOLS_DIR)/mktag_jffs2 -E 1 -s 48 -f $(IMAGE_DIR)/rootfs.jffs2 -o $(IMAGE_DIR)/rootfs.img
        @rm -rf $(IMAGE_DIR)/nocomprlist

I was unable to find a mkfs.jffs2 version that accepts the -N option to keep some files uncompressed and I didn't find the mktag_jffs2 binary anywhere.

The U-boot partition is looking like this. I am guessing it contains the first U-boot and 3 copies of the main U-boot, each with its own copy of the recovery webpage:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x84C4E28, created: 2020-04-21 01:57:07, image size: 109480 bytes, Data Address: 0xA0200000, Entry Point: 0xA0200000, data CRC: 0x98F1E723, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: "NAND Flash I"
86872         0x15358         U-Boot version string, "U-Boot 1.1.3 (Apr 21 2020 - 09:57:01)"
131072        0x20000         uImage header, header size: 64 bytes, header CRC: 0x12E54695, created: 2020-04-21 01:57:17, image size: 205892 bytes, Data Address: 0xA01FC040, Entry Point: 0xA0200000, data CRC: 0x2F0122FD, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: "NAND Flash I"
287068        0x4615C         CRC32 polynomial table, little endian
288092        0x4655C         U-Boot version string, "U-Boot 1.1.3 (Apr 21 2020 - 09:57:10)"
312819        0x4C5F3         HTML document header
332423        0x51287         HTML document footer
393216        0x60000         uImage header, header size: 64 bytes, header CRC: 0x12E54695, created: 2020-04-21 01:57:17, image size: 205892 bytes, Data Address: 0xA01FC040, Entry Point: 0xA0200000, data CRC: 0x2F0122FD, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: "NAND Flash I"
549212        0x8615C         CRC32 polynomial table, little endian
550236        0x8655C         U-Boot version string, "U-Boot 1.1.3 (Apr 21 2020 - 09:57:10)"
574963        0x8C5F3         HTML document header
594567        0x91287         HTML document footer
655360        0xA0000         uImage header, header size: 64 bytes, header CRC: 0x12E54695, created: 2020-04-21 01:57:17, image size: 205892 bytes, Data Address: 0xA01FC040, Entry Point: 0xA0200000, data CRC: 0x2F0122FD, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: "NAND Flash I"
811356        0xC615C         CRC32 polynomial table, little endian
812380        0xC655C         U-Boot version string, "U-Boot 1.1.3 (Apr 21 2020 - 09:57:10)"
837107        0xCC5F3         HTML document header
856711        0xD1287         HTML document footer

If I remember correctly (this was a while ago) I was able to modify the image U-boot in the "cferam.000" and modify the tag_kernel but the U-boot still checks the filesystem integrity as I got the following error:

CRC of rootfs is wrong(original 0xab426777 calculated 0x13938054)

I guess I'm going on the wrong path and it requires a U-boot partition rewrite but I was avoiding that route as to avoid bricking my device without knowing what I'm exactly doing although I'm very aware that's the risk.

The boot section of the console logs look like this (redacted a couple of parts):

U-Boot 1.1.3 (Apr 21 2020 - 09:57:10)

Board: Ralink APSoC DRAM:  256 MB
relocate_code Pointer at: 8ff84000

Config XHCI 40M PLL
Allocate 16 byte aligned buffer: 8ffca770
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [REDACTED]
Device found in MTK table, ID: c8d1, EXT_ID: 809540
Support this Device in MTK table! c8d1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
.
partable is:
uboot:0x100000@0x0
ubootenv:0x100000@0x100000
os0:0x3000000@0x200000
os1:0x3000000@0x3200000
tp_data:0x800000@0x6200000
radio:0x400000@0x6a00000
data:0x1180000@0x6e00000
.============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Apr 21 2020  Time:09:57:10
============================================
THIS IS Main Uboot: Including recovery webserver.
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =256 Mbytes
this uboot is loaded from 0xbc020000

Press '4' or 't' to break the booting process

Press 'x' to enter recovery web server                                                              0

3: System Boot system code via Flash.
boot rootfs from os0 image 0.
........found kernel tag, fslen = 33030144, bincrc = ab426777
........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................copy kernel len 3663359 fs_len 33030144
## Booting image at 89100000 ...
   Image Name:   NAND Flash I
   Image Type:   MIPS Linux Standalone Program (uncompressed)
   Data Size:    146544 Bytes = 143.1 kB
   Load Address: a01fb040
   Entry Point:  a0200000
   Verifying Checksum ... OK
data copied to 0xa01fb040
OK
jump to memory 0xa0200000


U-Boot 1.1.3 (Apr 21 2020 - 09:57:19)

Board: Ralink APSoC DRAM:  256 MB
relocate_code Pointer at: 8ff94000

Config XHCI 40M PLL
Allocate 16 byte aligned buffer: 8ffcaf70
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [REDACTED]
Device found in MTK table, ID: c8d1, EXT_ID: 809540
Support this Device in MTK table! c8d1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
.
partable is:
uboot:0x100000@0x0
ubootenv:0x100000@0x100000
os0:0x3000000@0x200000
os1:0x3000000@0x3200000
tp_data:0x800000@0x6200000
radio:0x400000@0x6a00000
data:0x1180000@0x6e00000
.============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Apr 21 2020  Time:09:57:19
============================================
THIS IS Image Uboot: Uboot included in upgrade image.
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =256 Mbytes
this uboot is loaded from 0x89100000

Press '2' or 't' to break the booting process


3: System Boot system code via Flash.
[get]mem environment not init yet.
[get]mem environment not init yet.
checking mem environment needn't save
try kernel boot addr 89200000 length 0x03000000
## Booting image at 89200000 ...
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    3663295 Bytes =  3.5 MB
   Load Address: 81001000
   Entry Point:  816a4980
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 816a4980) ...
## Giving linux memsize in MB, 256

Starting kernel ...

To get to build the initramfs to test, I used the following parameters (I referred to it as the A2600 Pro but it would likely be better to write A10 instead)

mt7621.mk file:

define Device/tplink_a2600pro-v1
  $(Device/dsa-migration)
  $(Device/tplink-safeloader)
  DEVICE_MODEL := A2600PRO
  DEVICE_VARIANT := v1
  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware \
	kmod-usb3 kmod-usb-ledtrig-usbport
  TPLINK_BOARD_ID := A2600PRO-V1
  KERNEL_INITRAMFS := $(KERNEL_DTB) | uImage lzma
  IMAGE_SIZE := 15744k

endef
TARGET_DEVICES += tplink_a2600pro-v1

mt7621_tplink_archer-a2600pro-v1.dts file:

#include "mt7621_tplink_archer-a2600pro-v1.dtsi"

/ {
	model = "TP-Link Archer A2600 Pro v1";
	compatible = "tplink,a2600pro-v1", "mediatek,mt7621-soc";
};

mt7621_tplink_archer-a2600pro-v1.dtsi file: (I tested the leds and buttons and most if not all are correct, they are also listed on the source. I have not yet been able to retrieve the MAC address from flash, details below.)

https://paste.c-net.org/MarryingStylist

01_leds file:

tplink,a2600pro-v1)
	ucidef_set_led_netdev "wifi2g" "Wifi 2.4G" "white:wifi2G" "wlan0"
	ucidef_set_led_netdev "wifi5g" "Wifi 5G" "white:wifi5G" "wlan1"
	ucidef_set_led_netdev "eth_link" "LAN link" "white:lan" "lan" "link"
	ucidef_set_led_netdev "wan" "WAN" "white:wan" "wan"
	ucidef_set_led_netdev "wan" "WAN" "orange:wan" "wan"
	;;

The tp_data partition contains the 2 eeprom files for the radios and a file named default-mac which has the MAC address of the system surprisingly instead of on the radio partition. MAC addresses are then used as follows:
eth0, the 2.4GHz radio and the switch ports get their MAC address straight form default-mac
The 5 GHz radio MAC address is the default-mac address minus one.

That's all I've got for now. Thank you very much in advance everyone!

gplv2 · March 2, 2022, 9:03pm

Kinda like the specs of this router, sure has enough flash ram. the mediatek platform seems like a plus since the drivers are well open sourced. My appreciated for TP-Link has risen a lot lately , Have a few C6U's I'm experimenting with. I was actually looking for a TP-Link device that also uses Mediatek but has more flash on board and this one kinda got my attention. Hope you get this one to work, the specs surely look like once you get this one to boot the proper image, things will work.

gusbrac · March 3, 2022, 10:30pm

Thanks for the encouraging words

Alright so I spent some time trying to figure out Uboot and learned enough to be able to experiment and not brick my router..... yet. I am just playing with the secondary bootloaders, not the very first one.

At least the GPL sources for the A10 do get to compile all 3 uboot images as used in the stock router. The configuration files for compilation (menuconfig) allow 4 options to select what to boot next: another Uboot, Image, Kernel or All.

Selecting Image will get it back to booting the stock way, it will get to their very custom code and find and verify the jffs2 filesystem with the weird cferam.000 file as stock.

Selecting Kernel and writing the address in flash where I wrote the sysupgrade image I compiled (partition os0) as the option for the load address seems to do the trick and at least I got the kernel to start booting and then panic due to not finding the rootfs. Probably it's not even recognizing the mtd partitions but I'm slowly moving forward and trying to figure it out.

U-Boot 1.1.3 (Apr 21 2020 - 09:57:01)

Board: Ralink APSoC DRAM:  256 MB
relocate_code Pointer at: 8ff9c000

Config XHCI 40M PLL
******************************
Software System Reset Occurred
******************************
Allocate 16 byte aligned buffer: 8ffcaeb0
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [REDACTED]
Device found in MTK table, ID: c8d1, EXT_ID: 809540
Support this Device in MTK table! c8d1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8

partable is:
part0:0x20000@0x0
part1:0x7f60000@0x20000
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Apr 21 2020  Time:09:57:01
============================================
THIS IS First Uboot: The first uboot located in NAND Flash to load next full-fea                            ture Uboot.
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =256 Mbytes
this uboot is loaded from 0xbc020000

Press '1' or 't' to break the booting process                                 0

3: System Boot system code via Flash.
## Booting image at bc020000 ...
   Image Name:   NAND Flash I
   Image Type:   MIPS Linux Standalone Program (uncompressed)
   Data Size:    142200 Bytes = 138.9 kB
   Load Address: a01fb040
   Entry Point:  a0200000
...   Verifying Checksum ... OK
data copied to 0xa01fb040
OK
jump to memory 0xa0200000


U-Boot 1.1.3 (Mar  3 2022 - 22:21:50)

Board: Ralink APSoC DRAM:  256 MB
relocate_code Pointer at: 8ff94000

Config XHCI 40M PLL
Allocate 16 byte aligned buffer: 8ffc9e70
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [REDACTED]
Device found in MTK table, ID: c8d1, EXT_ID: 809540
Support this Device in MTK table! c8d1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                             00 00 00 00 00
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8

partable is:
uboot:0x100000@0x0
ubootenv:0x100000@0x100000
os0:0x3000000@0x200000
os1:0x3000000@0x3200000
tp_data:0x400000@0x6200000
radio:0x400000@0x6600000
data:0x1580000@0x6a00000
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Mar  3 2022  Time:22:21:50
============================================
THIS IS the modified Uboot for OpenWRT.
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =256 Mbytes
this uboot is loaded from 0xbc020000

Press '2' or 't' to break the booting process                                 0

3: System Boot system code via Flash.
## Booting image at bc200000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.88
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2680346 Bytes =  2.6 MB
   Load Address: 80001000
   Entry Point:  80001000
.........................................   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80001000) ...
## Giving linux memsize in MB, 256

Starting kernel ...

[    0.000000] Linux version 5.10.88 (builder@buildhost) (mipsel-openwrt-linux-m                            usl-gcc (OpenWrt GCC 11.2.0 r18437-92820cc5b9) 11.2.0, GNU ld (GNU Binutils) 2.3                            7) #0 SMP Mon Dec 27 20:20:10 2021
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is TP-Link Archer A2600 Pro v1
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                            es
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] percpu: Embedded 15 pages/cpu s30160 r8192 d23088 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64960
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,j                            ffs2
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, l                            inear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, lin                            ear)
[    0.000000] Writing ErrCtl register=00008350
[    0.000000] Readback ErrCtl register=00008350
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 249424K/262144K available (6949K kernel code, 624K rwdata                            , 820K rodata, 1256K init, 243K bss, 12720K reserved, 0K cma-reserved, 0K highme                            m)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jif                            fies.
[    0.000000] NR_IRQS: 256
[    0.000000] random: get_random_bytes called from 0x80836a80 with crng_init=0
[    0.000000] CPU Clock: 880MHz
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478ab                            b4, max_idle_ns: 440795247997 ns
[    0.000012] sched_clock: 64 bits at 880MHz, resolution 1ns, wraps every 43980                            46511103ns
[    0.007940] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_i                            dle_ns: 4343773742 ns
[    0.016920] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[    0.083070] pid_max: default: 32768 minimum: 301
[    0.087830] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linea                            r)
[    0.095033] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes,                             linear)
[    0.105292] rcu: Hierarchical SRCU implementation.
[    0.110268] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE                             build
[    0.118265] smp: Bringing up secondary CPUs ...
[    0.123386] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.123397] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                            es
[    0.123408] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.123481] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.178122] Synchronize counters for CPU 1: done.
[    0.209990] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.210000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                            es
[    0.210009] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.210056] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.269160] Synchronize counters for CPU 2: done.
[    0.299621] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.299630] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                            es
[    0.299639] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.299692] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.354339] Synchronize counters for CPU 3: done.
[    0.384201] smp: Brought up 1 node, 4 CPUs
[    0.392438] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, ma                            x_idle_ns: 19112604462750000 ns
[    0.402256] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[    0.409264] pinctrl core: initialized pinctrl subsystem
[    0.416493] NET: Registered protocol family 16
[    0.422159] thermal_sys: Registered thermal governor 'step_wise'
[    0.423082] cpuidle: using governor teo
[    0.450728] random: fast init done
[    0.471889] clocksource: Switched to clocksource GIC
[    0.478619] NET: Registered protocol family 2
[    0.483325] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear                            )
[    0.491628] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144                             bytes, linear)
[    0.500023] TCP established hash table entries: 2048 (order: 1, 8192 bytes, l                            inear)
[    0.507677] TCP bind hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.514780] TCP: Hash tables configured (established 2048 bind 2048)
[    0.521207] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.527704] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.534883] NET: Registered protocol family 1
[    0.539175] PCI: CLS 0 bytes, default 32
[    0.545662] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[    0.556244] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.562029] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORIT                            Y) (c) 2001-2006 Red Hat, Inc.
[    0.572532] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 2                            51)
[    0.581507] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.587434] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.593296] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.599770] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.610154] printk: console [ttyS0] disabled
[    0.614481] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 19, base_baud                             = 3125000) is a 16550A
[    0.623476] printk: console [ttyS0] enabled
[    0.623476] printk: console [ttyS0] enabled
[    0.631741] printk: bootconsole [early0] disabled
[    0.631741] printk: bootconsole [early0] disabled
[    0.644218] spi-mt7621 1e000b00.spi: sys_freq: 220000000
[    0.651061] spi-nor spi0.0: unrecognized JEDEC id bytes: ff ff ff ff ff ff
[    0.658036] spi-nor: probe of spi0.0 failed with error -2
[    0.665283] libphy: Fixed MDIO Bus: probed
[    0.703066] libphy: mdio: probed
[    0.706998] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    0.715360] mtk_soc_eth 1e100000.ethernet: generated random MAC address e6:aa                            :e5:92:ac:f6
[    0.724388] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe                            100000, irq 21
[    0.735834] mt7621-pci 1e140000.pcie: host bridge /pcie@1e140000 ranges:
[    0.742577] mt7621-pci 1e140000.pcie:   No bus range found for /pcie@1e140000                            , using [bus 00-ff]
[    0.751354] mt7621-pci 1e140000.pcie:      MEM 0x0060000000..0x006fffffff ->                             0x0000000000
[    0.759523] mt7621-pci 1e140000.pcie:       IO 0x001e160000..0x001e16ffff ->                             0x0000000000
[    0.767789] mt7621-pci 1e140000.pcie: Parsing DT failed
[    0.775365] NET: Registered protocol family 10
[    0.781368] Segment Routing with IPv6
[    0.785193] NET: Registered protocol family 17
[    0.789708] bridge: filtering via arp/ip/ip6tables is no longer available by                             default. Update your scripts to load br_netfilter if you need this.
[    0.802952] 8021q: 802.1Q VLAN Support v1.8
[    0.810276] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    0.831268] libphy: dsa slave smi: probed
[    0.835861] mt7530 mdio-bus:1f wan (uninitialized): PHY [dsa-0.0:00] driver [                            Generic PHY] (irq=POLL)
[    0.846636] mt7530 mdio-bus:1f lan1 (uninitialized): PHY [dsa-0.0:01] driver                             [Generic PHY] (irq=POLL)
[    0.857565] mt7530 mdio-bus:1f lan2 (uninitialized): PHY [dsa-0.0:02] driver                             [Generic PHY] (irq=POLL)
[    0.868446] mt7530 mdio-bus:1f lan3 (uninitialized): PHY [dsa-0.0:03] driver                             [Generic PHY] (irq=POLL)
[    0.879306] mt7530 mdio-bus:1f lan4 (uninitialized): PHY [dsa-0.0:04] driver                             [Generic PHY] (irq=POLL)
[    0.891077] mt7530 mdio-bus:1f: configuring for fixed/rgmii link mode
[    0.901703] DSA: tree 0 setup
[    0.904998] rt2880-pinmux pinctrl: pcie is already enabled
[    0.910547] mt7621-pci 1e140000.pcie: host bridge /pcie@1e140000 ranges:
[    0.917266] mt7621-pci 1e140000.pcie:   No bus range found for /pcie@1e140000                            , using [bus 00-ff]
[    0.926087] mt7621-pci 1e140000.pcie:      MEM 0x0060000000..0x006fffffff ->                             0x0000000000
[    0.934263] mt7621-pci 1e140000.pcie:       IO 0x001e160000..0x001e16ffff ->                             0x0000000000
[    0.942526] mt7621-pci-phy 1e149000.pcie-phy: PHY for 0xbe149000 (dual port =                             1)
[    0.950237] mt7621-pci-phy 1e14a000.pcie-phy: PHY for 0xbe14a000 (dual port =                             0)
[    0.957866] mt7621-pci 1e140000.pcie: failed to parse bus ranges property: -2                            2
[    1.065289] mt7621-pci-phy 1e149000.pcie-phy: Xtal is 40MHz
[    1.070855] mt7621-pci-phy 1e14a000.pcie-phy: Xtal is 40MHz
[    1.176591] mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK)
[    1.183545] mt7621-pci 1e140000.pcie: PCIE0 enabled
[    1.188400] mt7621-pci 1e140000.pcie: PCIE1 enabled
[    1.193280] mt7621-pci 1e140000.pcie: PCI coherence region base: 0x60000000,                             mask/settings: 0xf0000002
[    1.202732] mt7621-pci 1e140000.pcie: PCI host bridge to bus 0000:00
[    1.209078] pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
[    1.215962] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    1.222845] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.228312] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff] (b                            us address [0x00000000-0x0fffffff])
[    1.238509] pci 0000:00:00.0: [0e8d:0801] type 01 class 0x060400
[    1.244531] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    1.250774] pci 0000:00:00.0: reg 0x14: [mem 0x60400000-0x6040ffff]
[    1.257115] pci 0000:00:00.0: supports D1
[    1.261109] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    1.267491] pci 0000:00:01.0: [0e8d:0801] type 01 class 0x060400
[    1.273542] pci 0000:00:01.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    1.279785] pci 0000:00:01.0: reg 0x14: [mem 0x60410000-0x6041ffff]
[    1.286116] pci 0000:00:01.0: supports D1
[    1.290109] pci 0000:00:01.0: PME# supported from D0 D1 D3hot
[    1.297631] pci 0000:01:00.0: [14c3:7615] type 00 class 0x000280
[    1.303709] pci 0000:01:00.0: reg 0x10: initial BAR value 0x00000000 invalid
[    1.310732] pci 0000:01:00.0: reg 0x10: [mem size 0x00100000 64bit]
[    1.317165] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by                             2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe                             x1 link)
[    1.333589] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    1.338811] pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
[    1.344927] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    1.351711] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref                            ]
[    1.358908] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    1.365758] pci 0000:02:00.0: [14c3:7615] type 00 class 0x000280
[    1.371814] pci 0000:02:00.0: reg 0x10: initial BAR value 0x00000000 invalid
[    1.378836] pci 0000:02:00.0: reg 0x10: [mem size 0x00100000 64bit]
[    1.385266] pci 0000:02:00.0: 2.000 Gb/s available PCIe bandwidth, limited by                             2.5 GT/s PCIe x1 link at 0000:00:01.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe                             x1 link)
[    1.401775] pci 0000:00:01.0: PCI bridge to [bus 02-ff]
[    1.407001] pci 0000:00:01.0:   bridge window [io  0x0000-0x0fff]
[    1.413090] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
[    1.419850] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff pref                            ]
[    1.427068] pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 02
[    1.433726] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    1.440312] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    1.447268] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000]
[    1.453876] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000]
[    1.460811] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    1.467603] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref                            ]
[    1.474828] pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff]
[    1.481589] pci 0000:00:01.0: BAR 9: assigned [mem 0x60300000-0x603fffff pref                            ]
[    1.488803] pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff]
[    1.495594] pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff]
[    1.502382] pci 0000:00:00.0: BAR 7: assigned [io  0x1e160000-0x1e160fff]
[    1.509142] pci 0000:00:01.0: BAR 7: assigned [io  0x1e161000-0x1e161fff]
[    1.515932] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bi                            t]
[    1.523251] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.528196] pci 0000:00:00.0:   bridge window [io  0x1e160000-0x1e160fff]
[    1.534978] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    1.541761] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref                            ]
[    1.548960] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff 64bi                            t]
[    1.556268] pci 0000:00:01.0: PCI bridge to [bus 02]
[    1.561212] pci 0000:00:01.0:   bridge window [io  0x1e161000-0x1e161fff]
[    1.567993] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
[    1.574775] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff pref                            ]
[    1.584285] /dev/root: Can't open blockdev
[    1.588382] VFS: Cannot open root device "(null)" or unknown-block(0,0): erro                            r -6
[    1.595893] Please append a correct "root=" boot option; here are the availab                            le partitions:
[    1.604254] Kernel panic - not syncing: VFS: Unable to mount root fs on unkno                            wn-block(0,0)
[    1.612513] Rebooting in 1 seconds..

jdwl1o1 · March 3, 2022, 11:07pm

What are you passing to the kernel as the rootfs location? The bootlog is missing that info.

gusbrac · March 4, 2022, 12:32pm

Oops! The terminal output somehow broke in parts when copying, weird.

OEM bootargs are:

flashname=MT7621-NAND mtdparts=MT7621-NAND:0x00100000@0x00000000(uboot)ro,0x00100000@0x00100000(ubootenv),0x03000000@0x00200000(os0),0x03000000@0x03200000(os1),0x00400000@0x06200000(tp_data),0x00400000@0x06600000(radio),0x01580000@0x06A00000(data),128M@0(wholeflash),0x00100000@0x00100000(nvram),0x03000000@0x00200000(rootfs)ro,0x03000000@0x03200000(backup) console=ttyS1,115200 root=/dev/mtdblock9 rootfstype=jffs2 init=/etc/preinit printk.time=1 nand0=MT7621-NAND

What I was passing (removed the init and time part for no good reason and added squashfs to rootfstype):

flashname=MT7621-NAND mtdparts=MT7621-NAND:0x00100000@0x00000000(uboot)ro,0x00100000@0x00100000(ubootenv),0x03000000@0x00200000(os0),0x03000000@0x03200000(os1),0x00400000@0x06200000(tp_data),0x00400000@0x06600000(radio),0x01580000@0x06A00000(data),128M@0(wholeflash),0x00100000@0x00100000(nvram),0x03000000@0x00200000(rootfs)ro,0x03000000@0x03200000(backup) console=ttyS1,115200 root=/dev/mtdblock9 rootfstype=jffs2,squashfs nand0=MT7621-NAND

For reference this is the stock partition table.

dev:    size   erasesize  name offset
mtd0: 00100000 00020000 "uboot" 00000000
mtd1: 00100000 00020000 "ubootenv" 00100000
mtd2: 03000000 00020000 "os0" 00200000
mtd3: 03000000 00020000 "os1" 03200000
mtd4: 00800000 00020000 "tp_data" 06200000
mtd5: 00400000 00020000 "radio" 06a00000
mtd6: 01180000 00020000 "data" 06e00000
mtd7: 07f80000 00020000 "wholeflash" 00000000
mtd8: 00100000 00020000 "nvram" 00100000
mtd9: 03000000 00020000 "rootfs" 00200000
mtd10: 03000000 00020000 "backup" 03200000

On flash I just copied the squashfs-sysupgrade image to mtd2/os0 (which is the same as mtd9/rootfs from what I understand) so pretty much they look like this:

binwalk openwrt-snapshot-r18437-92820cc5b9-ramips-mt7621-tplink_a2600pro-v1-squashfs-sysupgrade.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x540C760B, created: 2021-12-27 20:20:10, image size: 2680346 bytes, Data Address: 0x80001000, Entry Point: 0x80001000, data CRC: 0xA6B6C944, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt Linux-5.10.88"
64            0x40            LZMA compressed data, properties: 0x6D, dictionary size: 2097152 bytes, uncompressed size: 8835452 bytes
2680410       0x28E65A        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3823978 bytes, 1288 inodes, blocksize: 262144 bytes, created: 2021-12-27 20:20:10

I am guessing I should have the filesystem on a separate partition instead. (Edit: Likely I guessed wrong and I just created the dts/dtsi files the wrong way, currently experimenting with that)

Thanks for the help!

jdwl1o1 · March 5, 2022, 9:48am

That’s a pretty unique mtd description. I suggest setting the command line in uboot to have the rootfs at mtd2 and see if it boots.

gusbrac · March 11, 2022, 12:33am

Indeed, I spent so much time figuring the mtd layout because it differed from most TP-Link usual layouts even with almost the exact same hardware like the RE650.

Taking all your suggestions I did another dive and try to understand flash types. I changed some values in the .dtsi file and then the kernel booted up!

Part of the .dtsi looked like this:

&spi0 {
	status = "okay";

	flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <40000000>;

But it was wrong, it's not spi for the A10. So I checked the files for other routers that use NAND storage (not quite sure yet the difference between NAND and SPI mind you) then I made some changes. Now that section before the partition definitions looks like this instead:

&nand {
        status = "okay";

This got the kernel booting successfully and I was quite excited, it seemed to initialize the rootfs on the first boot BUT it was failing after first restart and it would use a tmpfs instead, no changes were saved. Sad but there was progress.

I noticed these lines on the bootlog which caught my attention:

[    3.720418] UBI: auto-attach mtd6
[    3.723756] ubi0: attaching mtd6

Then I learned about UBI and that a script attaches automatically partitions called data or ubi and finds the UBI# magic value, which it did because the stock firmware also uses a ubi partition.

Since I got the information on how to build the DTS file for NAND storage from a Xiaomi router I further saw the other configuration files for that router and noticed it uses separate kernel and rootfs images so I modified the section on the m7621.mk file for the A10 like this:

define Device/tplink_a2600pro-v1
  $(Device/dsa-migration)
  $(Device/uimage-lzma-loader)
  DEVICE_MODEL := A2600PRO
  DEVICE_VARIANT := v1
  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware \
        kmod-usb3 kmod-usb-ledtrig-usbport uboot-envtools
  TPLINK_BOARD_ID := A2600PRO-V1
  IMAGE_SIZE := 30000k
  BLOCKSIZE := 128k
  PAGESIZE := 2048
  KERNEL_SIZE := 4096k
  UBINIZE_OPTS := -E 5
  IMAGES += kernel1.bin rootfs0.bin
  IMAGE/kernel1.bin := append-kernel
  IMAGE/rootfs0.bin := append-ubi | check-size
endef
TARGET_DEVICES += tplink_a2600pro-v1

So I flashed the kernel on mtd2 as usual and the rootfs image on mtd6 (and modified the DTS file accordingly), also tried to put it on mtd3 for extra space but the kernel could never find it and would panic.

I spent an embarrassing amount of time troubleshooting why it was not finding the ubi partition (I was flashing everything from the first bootloader) when i decided to read directly the NAND on the main bootloader to check what it was seeing and noticed the main bootloader has a slightly different map of the memory than the first bootloader AND the GPL sources also have a tiny bit different memory map that was different than the stock one of my router.

Fixed all that, modified the partitions section of the .dtsi file like this:

&nand {
        status = "okay";

                partitions {
                        compatible = "fixed-partitions";
                        #address-cells = <1>;
                        #size-cells = <1>;

                        partition@0 {
                                label = "u-boot";
                                reg = <0x0 0x100000>;
                                read-only;
                        };

                        partition@100000 {
                                label = "u-boot-env";
                                reg = <0x100000 0x100000>;
                                read-only;
                        };

                        partition@200000 {
                                label = "os0";
                                reg = <0x200000 0x3000000>;
                        };

                        partition@3200000 {
                                label = "ubi";
                                reg = <0x3200000 0x3000000>;
                        };

                        tp_data: partition@6200000 {
                                label = "tp_data";
                                reg = <0x6200000 0x800000>;
                                read-only;
                        };

                        radio: partition@6a00000 {
                                label = "radio";
                                reg = <0x6a00000 0x400000>;
                                read-only;
                        };

                        partition@6e00000 {
                                label = "stock_data";
                                reg = <0x6e00000 0x1180000>;
                                read-only;
                        };
                };
};

And I finally got a complete boot! Changes survive reboots!

I wanted to paste the first good boot log but I hit the character limit so, just a couple of commands:

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r18437-92820cc5b9
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 3.8M      3.8M         0 100% /rom
tmpfs                   122.4M     72.0K    122.3M   0% /tmp
/dev/ubi0_1              35.1M     44.0K     33.2M   0% /overlay
overlayfs:/overlay       35.1M     44.0K     33.2M   0% /
tmpfs                   512.0K         0    512.0K   0% /dev
root@OpenWrt:/# mount
/dev/root on /rom type squashfs (ro,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,noatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,noatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
/dev/ubi0_1 on /overlay type ubifs (rw,noatime,assert=read-only,ubi=0,vol=1)
overlayfs:/overlay on / type overlay (rw,noatime,lowerdir=/,upperdir=/overlay/upper,workdir=/overlay/work)
tmpfs on /dev type tmpfs (rw,nosuid,relatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,mode=600,ptmxmode=000)
debugfs on /sys/kernel/debug type debugfs (rw,noatime)
none on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,noatime,mode=700)

Yay!! So....... Lot's of testing to do and issues to find (For starters I don't know why the leds were working in the initramfs version but not on the one on flash ). Also some cleanup and I'll see what's the best way to provide the image files that worked with instructions to flash it on this particular model, maybe we can get it to work on similar models.

Btw, also pretty sure we can play with the partitions to have more room for storage.

TheOncomingStorm · April 15, 2022, 3:18pm

All this is very encouraging. Have you made enough progress to release it yet?

FanOfOpenWRT · June 7, 2022, 10:40pm

I'm also very interested in this! Just checking in.

walmartshopper · September 30, 2022, 8:02pm

My wife just found one of these at the thrift store so I'm also interested.

TheOncomingStorm · January 3, 2023, 9:59pm

Any progress to get this released? I'd love to get this router off of stock firmware ASAP.

castillofrancodamian · January 5, 2023, 3:54am

Very impossible for that to happen.

TheOncomingStorm · January 5, 2023, 1:18pm

Yet according to this thread, it is indeed possible if gusbrac is to be believed.

csharper2005 · January 6, 2023, 11:02pm

I hope this will be helpful...
Similar device TP-Link EC330-G5u Ver:1.0 router (also known as TP-Link Archer C9ERT):

github.com/openwrt/openwrt

ramips: add basic support for TP-Link EC330-G5u v1

openwrt:master ← csharper2005:tplink_ec330-g5u-v1

opened 11:00PM - 06 Jan 23 UTC

csharper2005

+352 -0

This adds basic support for TP-Link EC330-G5u Ver:1.0 router (also known as TP-L…ink Archer C9ERT). Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 128 MiB, Nanya NT5CC64M16GP-DI Flash: 128 MiB NAND, ESMT F59L1G81MA-25T Wireless 2.4 GHz (MediaTek MT7615N): b/g/n, 4x4 Wireless 5 GHz (MediaTek MT7615N): a/n/ac, 4x4 Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1xUSB3.0 Button: 4 (Led, WiFi On/Off, Reset, WPS) LEDs: 7 blue LEDs, 1 orange(amber) LED, 1 white(non-gpio) LED Power: 12 VDC, 2 A Connector type: Barrel Bootloader: First U-Boot (1.1.3), Main U-Boot (1.1.3). Additionally, original TP-Link firmware contains Image U-Boot (1.1.3). Serial console (UART) --------------------- ``` V +-------+-------+-------+-------+ | +3.3V | GND | TX | RX | +---+---+-------+-------+-------+ | J2 | +--- Don't connect ``` Installation ------------ 1. Rename OpenWrt initramfs image to test.bin and place it on tftp server with IP 192.168.0.5 2. Attach UART, switch on the router and interrupt the boot process by pressing 't' 3. Load and run OpenWrt initramfs image: ``` tftpboot bootm ``` 5. Once inside OpenWrt, switch to the first boot image: ``` fw_setenv BootImage 0 ``` 7. Run 'sysupgrade -n' with the sysupgrade OpenWrt image Back to Stock ------------- Run in the OpenWrt shell: ``` fw_setenv BootImage 1 reboot ``` Recovery -------- 1. Press Reset button and power on the router 3. Navigate to U-Boot recovery web server (http://192.168.0.1/) and upload the OEM firmware MAC addresses ------------- ``` +---------+-------------------+-------------------+-------------+ | | MAC example 1 | MAC example 2 | Algorithm | +---------+-------------------+-------------------+-------------+ | label | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | LAN | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WAN | 72:ff:7b:xx:xx:f5 | 54:d4:f7:xx:xx:db | label+1 [1] | | WLAN 2g | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WLAN 5g | 68:ff:7b:xx:xx:f6 | 50:d4:f7:xx:xx:dc | label+2 | +---------+-------------------+-------------------+-------------+ ``` label MAC address was found in factory at 0x165 (text format xx:xx:xx:xx:xx:xx). Notes ----- [1] WAN MAC address: a. First octet of WAN MAC is differ than others and OUI is not related to TP-Link company. This probably should be fixed. b. Flipping bits in first octet and hex delta are different for the different MAC examples: ``` +-----------------+----------------+----------------+ | | Example 1 | Example 2 | +-----------------+----------------+----------------+ | LAN | 68 = 0110 1000 | 50 = 0101 0000 | | MAC (1st octet) | ^ ^ ^ | | +-----------------+----------------+----------------+ | WAN | 72 = 0111 0010 | 54 = 0101 0100 | | MAC (1st octet) | ^ ^ ^ | ^ | +-----------------+----------------+----------------+ | HEX delta | 0xa | 0x4 | +-----------------+----------------+----------------+ | DEC delta | 4 | 4 | +-----------------+----------------+----------------+ ``` c. DEC delta is a constant (4). This looks like a mistake in OEM firmware and probably should be fixed. Based on the above, I decided to keep correct OUI and make WAN MAC = label + 1. [2] Bootloaders The device contains 3 bootloaders: - First U-Boot: U-Boot 1.1.3 (Mar 18 2019 - 12:50:24). The First U-Boot located on NAND Flash to load next full-feature Uboot. - Main U-Boot + its backup: U-Boot 1.1.3 (Mar 18 2019 - 12:50:29). This bootloader includes recovery webserver. Requires special uImages to continue the boot process: ``` - 0x00 (os0, os1) - firmware uImage - 0x40 (os0, os1) - standalone uImage (OpenWrt kernel is here) ``` - Additionally, both slots of the original TP-Link firmware contains Image U-Boot: U-Boot 1.1.3 (Oct 16 2019 - 08:14:45). It checks image magics and CRCs. We don't use this U-Boot with OpenWrt.

FanOfOpenWRT · May 18, 2023, 4:23pm

Any further progress being made?

What are the current roadblocks for the Archer A10? It was looking hopeful earlier in this thread.

csharper2005 · May 18, 2023, 4:55pm

Have you already tried the firmware from this device - https://openwrt.org/toh/tp-link/ec330-g5u_v1? There is a chance that it will work.

FanOfOpenWRT · May 18, 2023, 5:59pm

I'll be darned if that doesn't look (physically) identical to the Archer A10. I upgraded to a Belkin RT3200 and gave my Archer A10 to mom so it'll be a while before I can try and confirm if the firmware you suggested could work.

Will report back when I eventually do, unless someone else tries first.

cmykel · June 13, 2023, 2:30pm

Wow i have the same router, i!m very interisting

walmartshopper · June 20, 2023, 10:58pm

I was unable to try the ec330-g5u build because the flashing instructions for that device don't work on the A10. When I downloaded the stock config and put it into the TP Link Config Editor, it said the file was invalid. Therefore I could not telnet into the router to flash with tftp. Does anyone know of any other way to get the A10 into tftp recovery mode? There was a web-based recovery mode but it was only accepting stock firmware.

youngt2 · April 8, 2024, 5:54pm

I tried the serial flashing instruction from the EC330-G5U page. It seems to have worked at first glance. Big problem I see so far is that the maximum transmit power for the wireless is limited to 6dbm. So, while the wireless does seem to work, you have to basically stand next to it to be in range.

Anyone have any ideas how to increase? Will keep doing research.

Below is the serial out from OpenWrt boot.

U-Boot 1.1.3 (Nov 13 2018 - 17:12:53)

Board: Ralink APSoC DRAM:  128 MB
relocate_code Pointer at: 87f9c000

Config XHCI 40M PLL
******************************
Software System Reset Occurred
******************************
Allocate 16 byte aligned buffer: 87fcacf0
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [C8 D1 80 95 40]
Device found in MTK table, ID: c8d1, EXT_ID: 809540
Support this Device in MTK table! c8d1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8

partable is:
part0:0x20000@0x0
part1:0x7f60000@0x20000
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Nov 13 2018  Time:17:12:53
============================================
THIS IS First Uboot: The first uboot located in NAND Flash to load next full-fea                                                                      ture Uboot.
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =128 Mbytes

Press '1' or 't' to break the booting process                                 0

3: System Boot system code via Flash.
## Booting image at bc020000 ...
   Image Name:   NAND Flash I
   Image Type:   MIPS Linux Standalone Program (uncompressed)
   Data Size:    183320 Bytes = 179 kB
   Load Address: a01fc040
   Entry Point:  a0200000
...   Verifying Checksum ... OK
data copied to 0xa01fc040
OK
jump to memory 0xa0200000


U-Boot 1.1.3 (Nov 13 2018 - 17:13:43)

Board: Ralink APSoC DRAM:  128 MB
relocate_code Pointer at: 87f88000

Config XHCI 40M PLL
Allocate 16 byte aligned buffer: 87fc8f10
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [C8 D1 80 95 40]
Device found in MTK table, ID: c8d1, EXT_ID: 809540
Support this Device in MTK table! c8d1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                       00 00 00 00 00
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
.
partable is:
part0:0x400000@0x0
part1:0x7000000@0x400000
part2:0xb80000@0x7400000
.============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Nov 13 2018  Time:17:13:43
============================================
THIS IS Main Uboot: Including recovery webserver.
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =128 Mbytes
this uboot is loaded from 0xbc020000

Press '4' or 't' to break the booting process

Press 'x' to enter recovery web server                                        0

3: System Boot system code via Flash.
do_bootm
## Booting image at bc400000 ...
   Image Name:   OS IMAGE (OpenWrt)
   Image Type:   MIPS Linux Firmware (uncompressed)
   Data Size:    2804668 Bytes =  2.7 MB
   Load Address: 80001000
   Entry Point:  80001000
ret is -3
try next header
## Booting image at bc400040 ...
   Image Name:   MIPS OpenWrt Linux-5.15.150
   Image Type:   MIPS Linux Standalone Program (uncompressed)
   Data Size:    2804604 Bytes =  2.7 MB
   Load Address: 80001000
   Entry Point:  80001000
...........................................   Verifying Checksum ... OK
data copied to 0x80001000
OK
jump to memory 0x80001000


OpenWrt kernel loader for MIPS based SoC
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80001000...

[    0.000000] Linux version 5.15.150 (builder@buildhost) (mipsel-openwrt-linux-                                                                      musl-gcc (OpenWrt GCC 12.3.0 r23809-234f1a2efa) 12.3.0, GNU ld (GNU Binutils) 2.                                                                      40.0) #0 SMP Fri Mar 22 22:09:42 2024
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is TP-Link EC330-G5u v1
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                                                                      es
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] percpu: Embedded 12 pages/cpu s17808 r8192 d23152 u49152
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jff                                                                      s2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, li                                                                      near)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, line                                                                      ar)
[    0.000000] Writing ErrCtl register=00010990
[    0.000000] Readback ErrCtl register=00010990
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 119272K/131072K available (7303K kernel code, 629K rwdata                                                                      , 880K rodata, 1224K init, 225K bss, 11800K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jif                                                                      fies.
[    0.000000] NR_IRQS: 256
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478ab                                                                      b4, max_idle_ns: 440795247997 ns
[    0.000004] sched_clock: 64 bits at 880MHz, resolution 1ns, wraps every 43980                                                                      46511103ns
[    0.008061] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[    0.066216] pid_max: default: 32768 minimum: 301
[    0.071630] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linea                                                                      r)
[    0.078844] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes,                                                                       linear)
[    0.090432] rcu: Hierarchical SRCU implementation.
[    0.095901] smp: Bringing up secondary CPUs ...
[    0.101297] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.101325] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                                                                      es
[    0.101340] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.101383] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.160677] Synchronize counters for CPU 1: done.
[    0.193223] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.193246] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                                                                      es
[    0.193257] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.193284] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.252186] Synchronize counters for CPU 2: done.
[    0.282838] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.282860] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt                                                                      es
[    0.282871] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.282902] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.337376] Synchronize counters for CPU 3: done.
[    0.367237] smp: Brought up 1 node, 4 CPUs
[    0.377058] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, ma                                                                      x_idle_ns: 19112604462750000 ns
[    0.386875] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[    0.393958] pinctrl core: initialized pinctrl subsystem
[    0.400808] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.407433] thermal_sys: Registered thermal governor 'step_wise'
[    0.432712] clocksource: Switched to clocksource GIC
[    0.439091] NET: Registered PF_INET protocol family
[    0.444226] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear                                                                      )
[    0.452255] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096                                                                       bytes, linear)
[    0.460569] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes,                                                                       linear)
[    0.468256] TCP established hash table entries: 1024 (order: 0, 4096 bytes, l                                                                      inear)
[    0.475883] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.482899] TCP: Hash tables configured (established 1024 bind 1024)
[    0.489341] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.495857] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.503195] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.508810] PCI: CLS 0 bytes, default 32
[    0.515525] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.527344] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.533220] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORIT                                                                      Y) (c) 2001-2006 Red Hat, Inc.
[    0.544481] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 2                                                                      51)
[    0.556076] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.561934] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.567937] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.574048] mt7621-pci 1e140000.pcie: host bridge /pcie@1e140000 ranges:
[    0.580723] mt7621-pci 1e140000.pcie:   No bus range found for /pcie@1e140000                                                                      , using [bus 00-ff]
[    0.589489] mt7621-pci 1e140000.pcie:      MEM 0x0060000000..0x006fffffff ->                                                                       0x0060000000
[    0.597605] mt7621-pci 1e140000.pcie:       IO 0x001e160000..0x001e16ffff ->                                                                       0x0000000000
[    0.962715] mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK)
[    0.969611] mt7621-pci 1e140000.pcie: PCIE0 enabled
[    0.974490] mt7621-pci 1e140000.pcie: PCIE1 enabled
[    0.979306] PCI coherence region base: 0x60000000, mask/settings: 0xf0000002
[    0.986526] mt7621-pci 1e140000.pcie: PCI host bridge to bus 0000:00
[    0.992830] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.998244] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    1.005101] pci_bus 0000:00: root bus resource [io  0x0000-0xffff]
[    1.011253] pci 0000:00:00.0: [0e8d:0801] type 01 class 0x060400
[    1.017204] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    1.023427] pci 0000:00:00.0: reg 0x14: [mem 0x60400000-0x6040ffff]
[    1.029674] pci 0000:00:00.0: supports D1
[    1.033608] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    1.040214] pci 0000:00:01.0: [0e8d:0801] type 01 class 0x060400
[    1.046239] pci 0000:00:01.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    1.052415] pci 0000:00:01.0: reg 0x14: [mem 0x60410000-0x6041ffff]
[    1.058729] pci 0000:00:01.0: supports D1
[    1.062647] pci 0000:00:01.0: PME# supported from D0 D1 D3hot
[    1.070727] pci 0000:01:00.0: [14c3:7615] type 00 class 0x000280
[    1.076749] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit]
[    1.083649] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by                                                                       2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe                                                                       x1 link)
[    1.100038] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    1.105243] pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
[    1.111242] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    1.118010] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref                                                                      ]
[    1.125179] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    1.132041] pci 0000:02:00.0: [14c3:7615] type 00 class 0x000280
[    1.138036] pci 0000:02:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit]
[    1.144934] pci 0000:02:00.0: 2.000 Gb/s available PCIe bandwidth, limited by                                                                       2.5 GT/s PCIe x1 link at 0000:00:01.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe                                                                       x1 link)
[    1.161322] pci 0000:00:01.0: PCI bridge to [bus 02-ff]
[    1.166541] pci 0000:00:01.0:   bridge window [io  0x0000-0x0fff]
[    1.172541] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
[    1.179312] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff pref                                                                      ]
[    1.186482] pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 02
[    1.193105] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    1.199620] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    1.206575] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000]
[    1.213126] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000]
[    1.220014] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    1.226790] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref                                                                      ]
[    1.233952] pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff]
[    1.240662] pci 0000:00:01.0: BAR 9: assigned [mem 0x60300000-0x603fffff pref                                                                      ]
[    1.247866] pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff]
[    1.254607] pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff]
[    1.261313] pci 0000:00:00.0: BAR 7: assigned [io  0x0000-0x0fff]
[    1.267401] pci 0000:00:01.0: BAR 7: assigned [io  0x1000-0x1fff]
[    1.273443] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bi                                                                      t]
[    1.280676] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.285622] pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
[    1.291638] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    1.298405] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref                                                                      ]
[    1.305586] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff 64bi                                                                      t]
[    1.312848] pci 0000:00:01.0: PCI bridge to [bus 02]
[    1.317730] pci 0000:00:01.0:   bridge window [io  0x1000-0x1fff]
[    1.323819] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
[    1.330517] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff pref                                                                      ]
[    1.340327] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    1.351449] printk: console [ttyS0] disabled
[    1.355811] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 19, base_baud                                                                       = 3125000) is a 16550A
[    1.364829] printk: console [ttyS0] enabled
[    1.364829] printk: console [ttyS0] enabled
[    1.373096] printk: bootconsole [early0] disabled
[    1.373096] printk: bootconsole [early0] disabled
[    1.385945] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0xd1
[    1.392344] nand: ESMT NAND 128MiB 3,3V 8-bit
[    1.396739] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB siz                                                                      e: 64
[    1.404313] mt7621-nand 1e003000.nand: ECC strength adjusted to 4 bits
[    1.410922] 7 fixed-partitions partitions found on MTD device mt7621-nand
[    1.419180] Creating 7 MTD partitions on "mt7621-nand":
[    1.424494] 0x000000000000-0x000000400000 : "u-boot"
[    1.492164] 3 fixed-partitions partitions found on MTD device u-boot
[    1.498559] Creating 3 MTD partitions on "u-boot":
[    1.503357] 0x000000000000-0x000000020000 : "u-boot-first"
[    1.511774] 0x000000020000-0x000000060000 : "u-boot-main"
[    1.522087] 0x000000060000-0x0000000a0000 : "u-boot-main-reserve"
[    1.533227] 0x000000400000-0x000003400000 : "os0"
[    2.275808] 2 fixed-partitions partitions found on MTD device os0
[    2.281916] Creating 2 MTD partitions on "os0":
[    2.286485] 0x000000000000-0x000000400000 : "kernel"
[    2.354333] 0x000000400000-0x000003000000 : "ubi-os0"
[    3.035373] 0x000003400000-0x000006400000 : "os1"
[    3.777768] 0x000006400000-0x000007400000 : "userfs"
[    4.029272] 0x000007400000-0x000007800000 : "u-boot-env"
[    4.097260] 0x000007800000-0x000007c00000 : "factory"
[    4.164928] 0x000000000000-0x000007f80000 : "wholeflash"
[    6.135185] Concatenating MTD devices:
[    6.138989] (0): "ubi-os0"
[    6.141699] (1): "userfs"
[    6.144343] into device "ubi-concat"
[    6.148013] 1 fixed-partitions partitions found on MTD device ubi-concat
[    6.154711] Creating 1 MTD partitions on "ubi-concat":
[    6.159840] 0x000000000000-0x000003c00000 : "ubi"
[    7.214763] mtk_soc_eth 1e100000.ethernet: generated random MAC address aa:ac                                                                      :9c:90:88:a2
[    7.223171] mtk_soc_eth 1e100000.ethernet: generated random MAC address 8a:61                                                                      :9e:30:66:09
[    7.232734] mt7530-mdio mdio-bus:1f: MT7530 adapts as multi-chip module
[    7.246514] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe                                                                      100000, irq 21
[    7.258572] mtk_soc_eth 1e100000.ethernet wan: mediatek frame engine at 0xbe1                                                                      00000, irq 21
[    7.268854] i2c_dev: i2c /dev entries driver
[    7.276423] NET: Registered PF_INET6 protocol family
[    7.284120] Segment Routing with IPv6
[    7.287861] In-situ OAM (IOAM) with IPv6
[    7.291860] NET: Registered PF_PACKET protocol family
[    7.297030] bridge: filtering via arp/ip/ip6tables is no longer available by                                                                       default. Update your scripts to load br_netfilter if you need this.
[    7.310620] 8021q: 802.1Q VLAN Support v1.8
[    7.321270] gpio-export gpio-export: 1 gpio(s) exported
[    7.327056] mt7530-mdio mdio-bus:1f: MT7530 adapts as multi-chip module
[    7.352643] mt7530-mdio mdio-bus:1f: configuring for fixed/rgmii link mode
[    7.360508] mt7530-mdio mdio-bus:1f: Link is Up - 1Gbps/Full - flow control r                                                                      x/tx
[    7.364043] mt7530-mdio mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:01] d                                                                      river [MediaTek MT7530 PHY] (irq=24)
[    7.381092] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:02] d                                                                      river [MediaTek MT7530 PHY] (irq=25)
[    7.393975] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:03] d                                                                      river [MediaTek MT7530 PHY] (irq=26)
[    7.406897] mt7530-mdio mdio-bus:1f lan4 (uninitialized): PHY [mt7530-0:04] d                                                                      river [MediaTek MT7530 PHY] (irq=27)
[    7.419153] DSA: tree 0 setup
[    7.426149] UBI: auto-attach mtd12
[    7.429586] ubi0: attaching mtd12
[    8.969670] ubi0: scanning is finished
[    8.990449] ubi0: attached mtd12 (name "ubi", size 60 MiB)
[    8.996028] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    9.002913] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    9.009676] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    9.016645] ubi0: good PEBs: 480, bad PEBs: 0, corrupted PEBs: 0
[    9.022640] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 12                                                                      8
[    9.029865] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequ                                                                      ence number: 268961471
[    9.038904] ubi0: available PEBs: 0, total reserved PEBs: 480, PEBs reserved                                                                       for bad PEB handling: 10
[    9.048149] ubi0: background thread "ubi_bgt0d" started, PID 354
[    9.050883] block ubiblock0_0: created from ubi0:0(rootfs)
[    9.059747] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem
[    9.075748] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    9.086928] Freeing unused kernel image (initmem) memory: 1224K
[    9.092918] This architecture does not have kernel memory protection.
[    9.099348] Run /sbin/init as init process
[    9.554834] init: Console is alive
[    9.558644] init: - watchdog -
[   10.367436] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[   10.426950] usbcore: registered new interface driver usbfs
[   10.432599] usbcore: registered new interface driver hub
[   10.438208] usbcore: registered new device driver usb
[   10.454674] xhci-mtk 1e1c0000.xhci: supply vbus not found, using dummy regula                                                                      tor
[   10.462371] xhci-mtk 1e1c0000.xhci: supply vusb33 not found, using dummy regu                                                                      lator
[   10.470275] xhci-mtk 1e1c0000.xhci: xHCI Host Controller
[   10.475663] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus numb                                                                      er 1
[   10.488170] xhci-mtk 1e1c0000.xhci: hcc params 0x01401198 hci version 0x96 qu                                                                      irks 0x0000000000290010
[   10.497440] xhci-mtk 1e1c0000.xhci: irq 20, io mem 0x1e1c0000
[   10.503455] xhci-mtk 1e1c0000.xhci: xHCI Host Controller
[   10.508773] xhci-mtk 1e1c0000.xhci: new USB bus registered, assigned bus numb                                                                      er 2
[   10.516284] xhci-mtk 1e1c0000.xhci: Host supports USB 3.0 SuperSpeed
[   10.523737] hub 1-0:1.0: USB hub found
[   10.527660] hub 1-0:1.0: 2 ports detected
[   10.532744] usb usb2: We don't know the algorithms for LPM for this host, dis                                                                      abling LPM.
[   10.541907] hub 2-0:1.0: USB hub found
[   10.545883] hub 2-0:1.0: 1 port detected
[   10.558772] kmodloader: done loading kernel modules from /etc/modules-boot.d/                                                                      *
[   10.571816] init: - preinit -
[   11.411440] random: jshn: uninitialized urandom read (4 bytes read)
[   11.531683] random: jshn: uninitialized urandom read (4 bytes read)
[   11.584297] random: jshn: uninitialized urandom read (4 bytes read)
[   11.934947] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii l                                                                      ink mode
[   11.947494] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flo                                                                      w control rx/tx
[   11.953221] mt7530-mdio mdio-bus:1f lan1: configuring for phy/gmii link mode
[   11.963515] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   14.136952] UBIFS (ubi0:1): Mounting in unauthenticated mode
[   14.143041] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 506
[   14.226031] UBIFS (ubi0:1): recovery needed
[   14.348096] UBIFS (ubi0:1): recovery completed
[   14.352812] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "root                                                                      fs_data"
[   14.360622] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O u                                                                      nit sizes: 2048 bytes/2048 bytes
[   14.370517] UBIFS (ubi0:1): FS size: 53583872 bytes (51 MiB, 422 LEBs), max 4                                                                      32 LEBs, journal size 2666496 bytes (2 MiB, 21 LEBs)
[   14.382154] UBIFS (ubi0:1): reserved for root: 2530898 bytes (2471 KiB)
[   14.388761] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID F6FEE                                                                      C9F-28DD-419F-8F8E-F71B71BA23C6, small LPT model
...