Adding OpenWrt support for Ancatus a6 wifi 6 ax1800 ax3

If i have a little time i post boot log

1 Like

Since the topic title is not clear about this: What is the intention of your posting? Why have you created it?

Original software is very poor by exemple:
-> i cannot bridge wan & lan ( i have a fiber box )
-> not support for ntfs


My intention is find a solution for build a Openwrt version for this

first problem with a serial console:

UBoot is login/password protected

second problem
OS is also with login & password unknow

7528DRAMC V1.6 (0)

Press 'x' or 'b' key in 1 secs to enter or skip bootloader upgrade.


EN7528 at Wed Apr 21 09:40:45 CST 2021 version 1.1 free bootbase

Set SPI Clock to 50 Mhz
spi_nand_probe: mfr_id=0xb, dev_id=0xe1
Using Flash ECC.
Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_XT26G01A, Flash Size=0x8000000
bmt pool size: 81 
BMT & BBT Init Success 

  GE Rext AnaCal Done! (1)(0x1f)  

Press any key in 8 secs to enter boot command mode.
.................................................................

KGD IC
Xtal:1
DDR3 init.
DRAMC init done. 
Calculate size.
DRAM size=256MB

7528DRAMC V1.6 (0)

Press 'x' or 'b' key in 1 secs to enter or skip bootloader upgrade.


EN7528 at Wed Apr 21 09:40:45 CST 2021 version 1.1 free bootbase

Set SPI Clock to 50 Mhz
spi_nand_probe: mfr_id=0xb, dev_id=0xe1
Using Flash ECC.
Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_XT26G01A, Flash Size=0x8000000
bmt pool size: 81 
BMT & BBT Init Success 

  GE Rext AnaCal Done! (1)(0x1f)  

Press any key in 8 secs to enter boot command mode.
................................................................................



==> boot flag = 0
Decompress to 80002000 free_mem_ptr=80E00000 free_mem_ptr_end=807B0000
from main
Uncompressing [LZMA] ...  done.
Linux version 3.18.21 (root@8952ff2bbc3b) (gcc version 4.6.3 (Buildroot 2015.08.1) ) #6 SMP Wed Apr 21 09:42:04 CST 2021
__l2cmem:0x807782a0, _l2cmem_end:0x807782a0, l2cmem_size:0 Bytes
memsize:256MB
EcoNet EN7528 SOC prom init
bootconsole [early0] enabled
CPU0 revision is: 0001992f (MIPS 1004Kc)
Determined physical RAM map:
 memory: 0fffe000 @ 00002000 (usable)
Wasting 64 bytes for tracking 2 unused pages
MIPS: machine is econet,en751221
Zone ranges:
  Normal   [mem 0x00002000-0x0fffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00002000-0x0fffffff]
Initmem setup node 0 [mem 0x00002000-0x0fffffff]
Detected 3 available secondary CPU(s)
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
PERCPU: Embedded 9 pages/cpu @81204000 s6080 r8192 d22592 u36864
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65022
Kernel command line: 
log_buf_len individual max cpu contribution: 4096 bytes
log_buf_len total cpu_extra contributions: 12288 bytes
log_buf_len min size: 16384 bytes
log_buf_len: 32768 bytes
early log buf free: 14328(87%)
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Writing ErrCtl register=0001de9d
Readback ErrCtl register=0001de9d
nmi base is 8126c200
Memory: 244560K/262136K available (7640K kernel code, 4018K rwdata, 1748K rodata, 208K init, 1358K bss, 17576K reserved)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:64


tc3162_time_init: Init bus timeout and watchdog

set rbus timeout as NMI then enable it
CPU frequency 900.00 MHz
plat_time_init: Entered, mips_timer_ack ptr is [800079dc]

 Using 200.000 MHz high precision timer.
r4k_clockevent_init: setup_irq OK, irq is [52]

console [ttyS0] enabled
console [ttyS0] enabled
bootconsole [early0] disabled
bootconsole [early0] disabled
Calibrating delay loop... 591.87 BogoMIPS (lpj=2959360)
pid_max: default: 32768 minimum: 301
Security Framework initialized
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
34K sync es set to 0.
Config7: 0x80090500
launch: starting cpu1
launch: cpu1 gone!
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
CPU1 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 1: done.
launch: starting cpu2
launch: cpu2 gone!
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
CPU2 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 2: done.
launch: starting cpu3
launch: cpu3 gone!
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
CPU3 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 3: done.
Brought up 4 CPUs
NET: Registered protocol family 16
PCIe 7528 PHY init  
PCIe driver version: 7528.1.20181122
EN7528 pcie_init
check pcie link up status: 
isRC0_LINKUP=1 
isRC1_LINKUP=1 
registering PCI controller with io_map_base unset
Initializing Ecnt Event Netlink Socket

Initializing Econet Event Netlink Socket nl_sk = 8fd1ac00

usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
pci_bus 0000:00: root bus resource [io  0x1f600000-0x1f61ffff]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
pci 0000:00:01.0: BAR 8: assigned [mem 0x20200000-0x203fffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
pci 0000:00:00.0: PCI bridge to [bus 01]
pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
pci 0000:02:00.0: BAR 0: assigned [mem 0x20200000-0x202fffff 64bit pref]
pci 0000:02:00.0: BAR 2: assigned [mem 0x20300000-0x20303fff 64bit pref]
pci 0000:02:00.0: BAR 4: assigned [mem 0x20304000-0x20304fff 64bit pref]
pci 0000:00:01.0: PCI bridge to [bus 02]
pci 0000:00:01.0:   bridge window [mem 0x20200000-0x203fffff]
Switched to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1

 mt7512_pcie_fixup: 0x1438 = 20000015 
 mt7512_pcie_rc0_retrain: 80 = 0145dc12 80 = 01608c12
RC0 Link Traing Result: 10110008
 mt7512_pcie_fixup: 0x3438 = 20200015 
 mt7512_pcie_rc1_retrain: 80 = 0145dc12 80 = 01608c12
RC1 Link Traing Result: 10120008
TC3162 hardware watchdog module loaded.
futex hash table entries: 1024 (order: 4, 65536 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
ntfs: driver 2.1.31 [Flags: R/W DEBUG].
jffs2: version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
fuse init (API version 7.23)
msgmni has been set to 477
io scheduler noop registered (default)
ttyS0 at I/O 0xbfbf0003 (irq = 5, base_baud = 7200) is a TC3162
ECNT ring buffer init success
brd: module loaded

SPI Flash Init Start
Found no SPI flash device
IS_SPIFLASH=0x0, IS_NANDFLASH=0x1, (0xBFA10114)=0x6)
Set SPI Clock to 50 Mhz
spi_nand_probe: mfr_id=0xb, dev_id=0xe1
Using Flash ECC.
Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_XT26G01A, Flash Size=0x8000000
spi nand flash
tc3162: flash device 0x01000000 at 0x1c000000
EN7512 mtd init: spi nand probe enter
[spi_nand_setup] : Enter 
nand: device found, Manufacturer ID: 0x0b, Chip ID: 0xe1
nand: Unknown _SPI_NAND_DEVICE_ID_XT26G01A
nand: 128MiB, SLC, page size: 2048, OOB size: 64
nand_scan_ident ok
[spi_nand_setup]: chip size =  0x8000000, erase_shift=0x11
bmt pool size: 81 
BMT & BBT Init Success 

parsing <0[bootloader],0[romfile],25m[tclinux],25m[tclinux_slave]>
partition 7: name <tclinux_slave>, offset ffffffff, size 1900000, mask flags 0
partition 4: name <tclinux>, offset ffffffff, size 1900000, mask flags 0
partition 1: name <romfile>, offset ffffffff, size fffffffe, mask flags 0
partition 0: name <bootloader>, offset ffffffff, size fffffffe, mask flags 0
Creating 9 MTD partitions on "EN7512-SPI_NAND":
0x000000000000-0x000000040000 : "bootloader"
0x000000040000-0x000000080000 : "romfile"
0x000000080000-0x00000041529d : "kernel"
mtd: partition "kernel" doesn't end on an erase block -- force read-only
0x00000041529d-0x00000130529d : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x000000080000-0x000001980000 : "tclinux"
0x000001980000-0x000001d1529d : "kernel_slave"
mtd: partition "kernel_slave" doesn't end on an erase block -- force read-only
0x000001d1529d-0x000002c0529d : "rootfs_slave"
mtd: partition "rootfs_slave" doesn't start on an erase block boundary -- force read-only
0x000001980000-0x000003280000 : "tclinux_slave"
0x000006dc0000-0x000007000000 : "reservearea"


rootfs
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
NET: Registered protocol family 24
register rtpci
PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
<--mt7916_hif_init()
Rx[0] Ring: total 24576 bytes allocated
Rx[1] Ring: total 16384 bytes allocated
<-- pci_alloc_tx_rx_ring_mem, Status=0
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
PCI: Enabling device 0000:02:00.0 (0000 -> 0002)


=== pAd = c0301000, size = 11482176 ===

<-- RTMPAllocAdapterBlock, Status=0
PCI CSRBaseAddress =0xc0200000, csr_addr=0xc0200000!
RTMPInitPCIeDevice():device_id=0x7915
mt7915_init()-->
Use the default iPAiLNA bin image!
<--mt7915_init()
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
Rx[0] Ring: total 24576 bytes allocated
Rx[1] Ring: total 24576 bytes allocated
Rx[2] Ring: total 8192 bytes allocated
Rx[3] Ring: total 16384 bytes allocated
Rx[4] Ring: total 8192 bytes allocated
<-- pci_alloc_tx_rx_ring_mem, Status=0
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
get_wdev_by_idx: invalid idx(0)
USB driver version: 7528.2.20181130
7528 USB PHY config, enable port0 port1
port 0 u2_slew_rate_cal_7528
FM_OUT value = 133(0x00000085)
SR calibration value = 4
port 1 u2_slew_rate_cal_7528
FM_OUT value = 133(0x00000085)
SR calibration value = 4
xhci-hcd xhci-hcd.0: xHCI Host Controller
xhci-hcd xhci-hcd.0: new USB bus registered, assigned bus number 1
xhci-hcd xhci-hcd.0: irq 10, io mem 0x1fb90000
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
xhci-hcd xhci-hcd.0: xHCI Host Controller
xhci-hcd xhci-hcd.0: new USB bus registered, assigned bus number 2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected


....


2 Likes

I have updated the topic title accordingly.

1 Like

The SoC I never heard of, but the switch and wireless (at least one wireless chip) seem to be MediaTek (both supported by OpenWrt already I think).

The 'Econet' doesn't ring a bell but it seems there has been some work on some of their SoCs being upstreamed, see here, by @blogic.

1 Like

SoC boots on linus HEAD, basic drivers have been rewritten but we are still missing the whole networking part

2 Likes

Looks like this SoC

CPU: MIPS 1004Kc (Dual-core) • Clock rate: @900MHz
1 Like

found SNANDER Windows Utility for flash SPI with CH341A programmer

  1. XTX XT26G02B
    059. XTX XT26G01A
  2. XTX XT26G02A

with original firmware

no exFat, NTFS
no dlna , relayd / repeater , vlan possibility ., bridge wan with lan's , ..

for the moment not usable , do not buy this product

I soldered some wires on the flash memory after read the flash memory

link for SPI FLASH CONTENT ( use https )
hxxps://mega.nz/file/zSg2SJLA#VDXYqKMkh5t7nQ3oFou5bQMAwtajMebOuEYkJWnYSwA

i have found infos in the bootloader

Bootloader
login: telecomadmin
password: nE7jA%5m

firmware is HDR2 : 80000 to 41529D ( extraction ? ) not found solution for SSH


  GE Rext AnaCal Done! (1)(0x1f)
Press any key in 8 secs to enter boot command mode.
...
UserName: telecomadmin
Password: ********

bldr> help

?                                   Print out help messages.
help                                Print out help messages.
go                                  Booting the linux kernel.
decomp                              Decompress kernel image to ram.
memrl <addr>                        Read a word from addr.
memwl <addr> <value>                Write a word to addr.
dump <addr> <len>                   Dump memory content.
jump <addr>                         Jump to addr.
flash <dst> <src> <len> <oob>       Write to flash from src to dst(oob: write nand oob if 1).
imginfo                             Show images info.
spinand_rwtest                      Flash Test
bdstore <flash dst> <bin src>       Do backdoor config store
bdshow                              Show backdoor config
bdswitch[1|0]                       Enable or disable backdoor function
ddrcalswitch[1|0]                   Enable or disable ddr calibration funciton
drambistswitch[0|1|2]               disable or enable, and quick or normal test
xmdm <addr> <len>                   Xmodem receive to addr.
miir <phyaddr> <reg>                Read ethernet phy reg.
miiw <phyaddr> <reg> <value>        Write ethernet phy reg.
cpufreq <freq num> / <m> <n>        Set CPU Freq <156~450>(freq has to be multiple of 6)
ipaddr <ip addr>                    Change modem's IP.
httpd                               Start Web Server
mtd
bldr> bdshow
back door config is not support NAND Flash
bldr> miir
Usage: miir <phyaddr> <reg>
bldr> http
PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
bldr> http start
PBUF_POOL_BUFSIZE = 256
tcp_bind()
Local Port = 0
tcp_bind: bind to port 80
bldr> ipaddr 192.168.1.152
Change IP address to 192.168.1.152
bldr> mtd
0x00000000-0x00040000 : "bootloader"
0x00040000-0x00080000 : "romfile"
0x00080000-0x0041529d : "kernel"
0x0041529d-0x0130529d : "rootfs"
0x00080000-0x01980000 : "tclinux"
0x01980000-0x01d1529d : "kernel_slave"
0x01d1529d-0x02c0529d : "rootfs_slave"
0x01980000-0x03280000 : "tclinux_slave"
0x06dc0000-0x07000000 : "reservearea"
bldr>

1 Like

first its not antacus)) i know real provider for this router

second i already see hash for login_pass ,but need your help, can you read full flash via asprogrammer ?

Full Flash with SNANDer

hxxps://mega.nz/file/zSg2SJLA#VDXYqKMkh5t7nQ3oFou5bQMAwtajMebOuEYkJWnYSwA

replace xx by tt

passwd

admin:$1$$iC.dUsGpxNNJGeOm1dFio/:0:0:root:/:/bin/sh ???

I think admin:1234 but ssh forbidden???

hidden:
http://192.168.10.1/cgi-bin/telnet.asp

login - admin
pass - Um_rbr1234

real provider CM = china mobile

model UNR030N

You have in your router customized firmware.

Your firmware broken,maybe SNANDer not can read full firmware if you compare images you see this , can you read full firmware via asprogrammer ? here link asprogramer

The firmware read with SNander is correct
I read again several times and compared the data with HexEdit
Moreover I manage to read the files after extraction with 7Z
I used SNAnder because the Detected SPI NAND memory
XTX XT26G01A is not in the ASProgrammer database
If you tell me how can i connect with WIN SCP ( SSH ? )or transfet files to PC Computer, telnet
I will be able to read the partitions with cat /dev/mtd0 > mtd0.bin
cat /dev/mtd1 > mtd1.bin .... and rebuild full firmware with cat /dev/mtd0 > backup_fullflash.bin
cat /dev/mtd1 >> backup_fullflash.bin ....

I have tested with WIndows tftp server and ftpput 192.168.1.10 mtd0.bin mtd0.bin -u ADMIN -p ADMIN -P 5555
but i have ftpput: CWD error: Permission Denied.

No problem, give me id in asprogrammer i add your flash to database )

Datashhet for XTX XT26G01A

ReadId Table:
Byte 0: 0BH
Byte 1: E1H

But sure Snander read correctly the data

I do not see why it would be necessary to use ASProgrammer which would force me to solder again the 8 wires on the memory whereas I am certain that the content which was read with SNander will be exactly the same I had checked several times If you have been able to look in the files put at mega.nz you will see that the contents of the partitions extracted with 7 zip contain the same files that I have when looking in the OS with the console connected to the serial port
I had also used the -v command with SNander which makes it possible to verify that the content is correct

Now if you find the firmware is not correct it may be that the manufacturer's firmware is not good if you have another one i can try flashing it to see if it works better

it would be much easier if I could recover the contents of mtdxxx to my computer

Found solution with a USB key

cd /tmp/mnt/usb1_1

All mtd0,1,2, ...
cat /dev/mtdx > mtdx.bin

All MTD for 2 * BOX_ANCATUS

hxxps://mega.nz/file/6PIykLLD#RCPZvgKq4fKusqiP7UipuZMZMiJmdliNNz7Aq_F1m34

any update on this for openwrt support