Adding OpenWrt support for D-Link DIR-X1860 (MT7621 + MT7915 AX1800)

elesgrimidor · February 18, 2023, 10:23pm

What's the current status of the work on supporting this router? What work remains to be done? Depending upon the complexity of what's left, I might be able to help.

I see that @nbd commited some work in progress code recently. I've been running builds of his work over the past 6 months and haven't encountered any issues - everything seems fine from a stability and functionality perspective.

I'm pretty sure (it was a while ago so I'm not 100% certain) that I flashed over serial rather than with the recovery bootloader mentioned by @s_2. Not having to replicate the OEM firmware encryption definitely simplifies things.

s_2 · February 18, 2023, 11:05pm

// edit: Sorry, wrong Thread. So this time I confused DIR and DAP-X1860 myself

Factory image structure and encryption scheme is known, so we could actually implement factory encryption, the format is the same as e.g. for DIR-842.

For some devices (e.g. COVR-C1200 / P2500 / ...) it is sufficient to just encrypt the image for flashing via bootloader, since the signature itself would not be verified, but I had eventually closed my crypto PRs for several routers back then, for some models, including the DIR-842 and also the DIR-X1860, the PR was open for more than 1.5 years and I could not see any progress except for the constant need to rebase (maybe publishing vendor firmware keys is not quite appreciated by some project members), so those devices are not supported for now.

However with DIR-X1860, luckily the bootloader also seems to accept the unencrypted image, so we can flash that way (let's see for how long - Firefox is causing trouble already, but recent versions of Chromium still seem to work). For some older D-Link devices, I can no longer flash them via bootloader on Linux at all, not even using curl, some models (e.g. COVR-C1200) will only work on Windows with IE 10, and it takes several attempts

// edit: there is a draft PR for the factory image encryption here, waiting for comments:

github.com/openwrt/openwrt

[RFC] ath79: add encrypted Alpha Networks factory image for D-Link devices

openwrt:main ← raenye:dlink_alpha_image

opened 01:35PM - 10 Nov 23 UTC

raenye

+241 -7

Currently, OpenWrt generates factory images for several D-Link devices manufact…ured by Alpha Networks (in particular: DIR-842, DIR-859, DAP-1720, DIR-X1860) that must be flashed via the D-Link web recovery mode. This is cumbersome, as devices in recovery mode offer no DHCP, and not all web browsers upload the firmware as required by the recovery webserver ('application/octet-stream' binary form-data). To use the vendor upgrade firmware web UI for installation, the firmware needs to be encrypted using AES-256-CBC (with non-standard paddings and no salt). The AES key and IV are created by mangling the key and IV hard-coded in the GPL sources officially released by D-Link (see, e.g., `DIR842C3_GPL312EUb01DLink/tools/encimg/fw_sign_data.c`), and can also be extracted from the official firmware image via `strings /htdocs/cgibin`. The mangling process is described by the following code excerpt: ``` python -c 'import sys; s,k,i=sys.argv[1:]; X=lambda x: bytes( (j+1)^ord(a)^ord(b) for j,(a,b) in enumerate(zip(x,9*s)) ).hex(); print(X(k),X(i))' $(SEAMA_SIGNATURE) $(32B_KEY) $(16B_IV) ``` In fact, this is the firmware encryption method implemented by firmware-utils' nec-enc. * Rename current `factory.bin` images to `recovery.bin` * Add new `factory.bin` image (AES-encrypted `recovery.bin`) Installation: * Web UI: http://192.168.0.1, flash `factory.bin` * Recovery Web UI: Keep reset button pressed during power-on, flash `recovery.bin` via http://192.168.0.1 Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net> Signed-off-by: Rani Hod <rani.hod@gmail.com>

s_2 · February 13, 2026, 9:49pm

Meanwhile, support for revision B1 of this device was added to OpenWrt, using similar hardware, but manufactured by SGE rather than Alpha Networks, thus using the dlink-sge-image tool to encrypt firmware. On that note, I decided to dig this one back out, and implement factory image encryption based on the PR by @raenye mentioned above. This device is a bit more complicated though, using a dual image layout and at least requiring proprietary metadata appended to the factory image (before encryption).

The current state of my code is here (not yet polished, still needs work with wifi and MACs etc.) https://github.com/s-2/openwrt/tree/dir-x1860_2k26

Meanwhile, after adding alpha metadata containing the SEAMA_SIGNATURE, the image is accepted by OEM web updater (no more upgrade failed error), but still not flashing or not booting after flash, probably due to dual image. But the encryption is working fine (considering the metadata already made a difference, which means OEM web did successfully decrypt it).

As a side note, it seems just for DIR-842 C3 EU it needs to be considered that the recovery and factory image use a different signature, so maybe we have to pass it as a parameter rather than via DEVICE_VARS, unless someone finds another solution (I remember I had the same issue with seama-seal back then, in the old PR for DIR-842, and tried to solve it using a parameter instead https://github.com/openwrt/openwrt/pull/3109/changes/697a107c2db17f6efa3c99f7e426acd7a42a3f22 )

to be continued…

s_2 · February 19, 2026, 12:38am

update… eventually found that flashing factory image resulted in the device booting OEM, but running into kernel panic shortly after full bootup, but this is fixed by reflashing decrypted OEM via recovery. So something happened when uploading the image, but it was not yet booting OpenWrt.

sifting through the update process, fw_check.sh is called by a binary /usr/sbin/mtfwu, which constructs the HNAP response based on the result, and if successful, calls another script /etc/scripts/fw_upgrade.sh, which eventually calls sysupgrade.

#!/bin/sh
. /lib/functions/leds.sh
#Refer usr/lib/lua/luci/controller/admin/system.lua
killall -9 mydlink_watchdog.sh
killall -9 da_adaptor
tar -czf /etc/mydlinkCfg.tar.gz /mydlink/config
/etc/init.d/leds_config stop
led_off internet_ok 
led_timer internet_fail 500 500
sleep 2
killall dropbear uhttpd
sleep 1
/sbin/sysupgrade /tmp/firmware.seama

And that's when ancient OpenWrt comes in, making it all complicated... I guessed we somehow need the output of sysupgrade to see what’s going on, so I had tried to get the root password or something, hoping to be able to login to the device and call sysupgrade. Cameo used quite simple passwords back then (e.g. with DCH-G020), but I think Alpha Networks chose something better here, so trying to crunch hashcat -m 500 -O '$1$IZMtCXwQ$.Utpvyb1aQB0dHvGp.ONA1' -a 3 ?l?l?l?l?l?l?l?l was not any useful (assuming more complex passwords would take even longer).

Eventually looked at OEM metadata and added some more, especially the reference-board name in supported_devices did make it write to flash eventually.

However, after Recovery -> OEM, flashing OpenWrt would result in a kernel panic, since ubi would not contain a valid rootfs. However, flashing via Recovery -> OEM -> OEM (via regular web, not recovey this time) would make it work, so there seems to be an issue with switching partitions, and the user would not know which one is currently active. So there’s a 50% chance, otherwise it needs recovery.

Starting to look at wifi, meanwhile rebased to latest master, but currently something is broken there (libubox not building)… So I’ll wait for that to be fixed first.

s_2 · February 19, 2026, 11:03pm

build works after make dirclean, seems the switch to GCC 14 required the toolchain to be rebuilt.

No success getting wifi to work, it seems to be on &pcie2 according to

root@OpenWrt:~# lspci -k
00:00.0 Class 0604: 0e8d:0801
00:01.0 Class 0604: 0e8d:0801
02:00.0 Class 0002: 14c3:7915
01:00.0 Class 0002: 14c3:7916 mt7915e_hif

but no change, guess this means it was not detected at all? but lspci finds it

[   14.181070] pci 0000:00:00.0: enabling device (0000 -> 0003)
[   14.186814] mt7915e_hif 0000:01:00.0: enabling device (0000 -> 0002)
[   14.193805] pci 0000:00:01.0: enabling device (0000 -> 0003)
[   14.199565] mt7915e 0000:02:00.0: enabling device (0000 -> 0002)
[   14.371659] mt7915e 0000:02:00.0: Direct firmware load for mediatek/mt7915_rom_patch.bin failed with error -2
[   14.381653] mt7915e 0000:02:00.0: Falling back to sysfs fallback for: mediatek/mt7915_rom_patch.bin
[   14.482307] urngd: v1.0.2 started.
[   14.641716] mt7915e 0000:02:00.0: probe with driver mt7915e failed with error -12

// edit: nevermind, the package name for the mt7915 firmware was changed since this device was first added by nbd

after each write, even recovery seems to toggle bank_id=1 vs. bank_id=0 in uboot-env.

raenye · February 22, 2026, 12:30am

GMTA I stopped after length 8.
How about modifying /etc/shadow and creating a pre-rooted OF? it's not signed, after all.

s_2 · February 26, 2026, 1:20am

okay, so I’m confused about the MAC address layout, in OEM it looks like

lan :02 // label
wan :03
2.4 :04
5 :06

but I cannot find the MAC address anywhere, not even just the last three bytes (in case it were concatenated from OUI + address). The ancient repository from nbd seemed to read it from uboot-env, but there’s no variable like lanmac in there either. And no binary or ASCII matches is factory, devdata etc… Even tried on another device, previously untouched by OpenWrt (factory flashing from OEM worked right away, using regular OEM web, so in default state, with no broken firmware, it seems that partition is active. The cycle was set to 18, probably the amount of times the previous owner did boot it, and bank_id is 0.

Realized uboot-env-tools don’t really exist anymore, the kernel now supports extraction via nvmem drivers (not yet sure how to set variables though, e.g. if bank_id would eve require swapping. I remember @RolandoMagico did something similar for the M30 / M60 devices, though those were built by AMIT, not Alpha.

Guess we’d indeed have to look at the GPL code or something, maybe really try to build an image from it and see where MAC assignment comes from in the running, backdoored system…

Thought it would be easier with this one, after crypto is solved… but not so much I suppose

I hope I can find some more time by the start of next week.

// edit: pushed GPL release to github for indexing with Devin https://deepwiki.com/s-2/DIRX1860_A1_GPL102B06DLink

// edit #2: so there was lots of customizing to the AlphaWRT firmware with several ways of settings MAC addresses, but it seems they all assume it were located in the factory partition, but there’s just FFs at any of these offsets for the factory partitions of two of my devices https://deepwiki.com/search/when-the-device-boots-up-the-l_0bde1692-2929-4100-8e92-e047675672d3

// edit #3: guess I’d have to look closer at alpha/boards/wrgax10/base-files/files/sbin/mfc.lua

// edit #4: it seems the mac addresses are in uci, stored as a jffs2 in the devdatapartition. so it seems we need to mount that one, and retrieve it from there. Can we have two instances of uci on the same machine, pointing to different persistent storages?

s_2 · March 24, 2026, 9:19pm

It’s been a while, couldn’t really find much time…

But I can confirm that MAC addresses are definitely located in the mtd6 partition:

mount -t jffs2 -o noatime /dev/mtdblock6 /mnt/jffs
[ 6870.290371] jffs2: notice: (3001) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orp                                                                     han) and 0 of xref (0 dead, 0 orphan) found.

Inside the mounted folder there are two folders devdata and mydlinkcert, and within devdata there is a file called mfc:

root@OpenWrt:/mnt/jffs/devdata# cat mfc

config mfc 'default'
        option wanmac 'c4:e9:0a:1d:30:03'
        option lanmac 'c4:e9:0a:1d:30:02'
        option wlan24mac 'c4:e9:0a:1d:30:04'
        option wlan5mac 'c4:e9:0a:1d:30:06'
        option countrycode 'EU'
        option fota_did '9755b7963971b651bb7b60fa2ba497b2416d9f75a956ad9a9bc1f9536b50e963'
        option psk 'uuywa64994'
        option wifissid_5g 'dlink-3002-5GHz'
        option fota_clientid '5de5bd1da317c44f96397acc23e092fd'
        option pin '99922177'
        option hwver 'A1'
        option wifissid_2g 'dlink-3002'
        option mydlink_number '51786347'
        option mfcmode '0'

So I guess we have to use the userspace scripts 02_network and 10_fix_wifi_mac here, rather than having the kernel take care of this. I’m just wondering, are there generic scripts that use regexes to extract the actual ascii mac address from the line, after e.g. $(cat mfc | grep lanmac) or something?

And how would I mount this, can we override fstab or something? Calling mount from the base-files-script seems a bit dirty (and we technically don’t know whether 02_network or 10_fix_wifi_mac would be called first, technically this might change any time. Is there maybe even a way to specify another jffs2 in the dts via the compatible string, so it would be mounted automagically on boot? But still the actual extraction would be from userspace, nothing to be supported natively within nvmem-cells I guess…

wersonit · April 27, 2026, 3:46pm

I got me a DIR-X1860 H/W version R1. I can help you If you need dts from it or whatever else. I also can’t find any mention of B1/A1 versions apart from Openwrt website. Openwrt for B1 version doesn’t work on R1. Web UI doesn’t accept it factory or sysupgrade. I didn’t try recovery though. Does it work through TFTP?

s_2 · April 27, 2026, 4:54pm

fascinating, I think for some other devices (DIR-842?! not sure) there was also a special russian version, with completely different bootloader etc., but people did manage to support it eventually. I pesonally don’t own any “R” revision of D-Link devices, could you maybe get a bootlog out of that thing?

//edit: ok it was with the DIR-878 and similar devices, i.e. Mediatek-based from Alpha Networks, so maybe the image format they used there could be similar here?

wersonit · August 2, 2026, 4:44pm

Finally found some time to do this. Here's the stock bootlog and partitions list.

Bootlog


===================================================================
                MT7621   stage1 code Dec 16 2019 17:45:55 (ASIC)
                CPU=500000000 HZ BUS=166666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11000000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL3 FB_DL: 0x10, 1/0 = 666/358 41000000
PLL2 FB_DL: 0x16, 1/0 = 639/385 59000000
PLL4 FB_DL: 0x16, 1/0 = 772/252 59000000
DDR patch working
do DDR setting..[01F40000]
Apply DDR3 Setting...(use default AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  11                                                                                                             2  120
      --------------------------------------------------------------------------                                                                                                             ------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 1    1
000E:|    0    0    0    0    0    0    0    0    1    1    1    1    1    1                                                                                                                 1    1
000F:|    0    0    0    0    1    1    1    1    1    1    1    1    1    0                                                                                                                 0    0
0010:|    1    1    1    1    1    1    1    1    0    0    0    0    0    0                                                                                                                 0    0
0011:|    1    1    1    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
DRAMC_DQSCTL1[0e0]=13000000
DRAMC_DQSGCTL[124]=80000033
rank 0 coarse = 15
rank 0 fine = 64
B:|    0    0    0    0    0    0    0    0    1    1    1    0    0    0    0                                                                                                                 0
opt_dle value:9
DRAMC_DDR2CTL[07c]=C287221D
DRAMC_PADCTL4[0e4]=000022B3
DRAMC_DQIDLY1[210]=0B0B0A0A
DRAMC_DQIDLY2[214]=070B080A
DRAMC_DQIDLY3[218]=0B090A08
DRAMC_DQIDLY4[21c]=0B090B09
DRAMC_R0DELDLY[018]=0000201F
==================================================================
                RX      DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    9 9 9 11 9 8 10 7 6 6
10 |    9 9 7 9 7 9
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =31 DQS1 = 32
==================================================================
bit     DQS0     bit      DQS1
0  (1~60)30  8  (1~60)30
1  (1~60)30  9  (0~57)28
2  (1~58)29  10  (2~62)32
3  (1~61)31  11  (1~59)30
4  (1~60)30  12  (1~60)30
5  (1~62)31  13  (1~59)30
6  (1~60)30  14  (1~60)30
7  (1~62)31  15  (1~59)30
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    10 10 11 11 10 8 11 7 8 10
10 |    9 11 9 11 9 11
==================================================================
==================================================================
     TX  perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2
DQ loop=15, cmp_err_1 = ffff0080
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=1
DQ loop=14, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=14,  finish count=2
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
DRAMC_DQODLY1[200]=88888888
DRAMC_DQODLY2[204]=88888888
20,data:88
[EMI] DRAMC calibration passed

===================================================================
                MT7621   stage1 code done
                CPU=500000000 HZ BUS=166666666 HZ
===================================================================

U-Boot SPL 2018.09-ge3d9f99-dirty (May 27 2022 - 14:34:52 +0300)
Trying to boot from NAND


U-Boot 2018.09-ge3d9f99-dirty (May 27 2022 - 14:34:52 +0300)

CPU:   MediaTek MT7621AT ver 1, eco 3
Clocks: CPU: 880MHz, DDR: 1200MHz, Bus: 220MHz, XTAL: 40MHz
Model: MediaTek MT7621 reference board (NAND)
DRAM:  256 MiB
NAND:  128 MiB
Loading Environment from NAND... *** Warning - bad CRC, using default environmen                                                                                                             t

In:    uartlite0@1e000c00
Out:   uartlite0@1e000c00
Err:   uartlite0@1e000c00
Net:
Warning: eth@1e100000 (eth0) using random MAC address - fa:26:d7:78:e2:6c
eth0: eth@1e100000
Hit any key to stop autoboot:  0
DRU DIR-X1860

  *** U-Boot Boot Menu ***

     1. Startup system (Default)
     2. Upgrade firmware
     3. Upgrade bootloader
     4. Upgrade bootloader (advanced mode)
     5. Load image
     6. Web UI
     0. U-Boot console


  Press UP/DOWN to move, ENTER to select

Loading from nand0, offset 0x140000
   Image Name:   DIR_X1860_MT7621
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1851765 Bytes = 1.8 MiB
   Load Address: 81001000
   Entry Point:  813ea230
Automatic boot of image at addr 0x80010000 ...
## Booting kernel from Legacy Image at 80010000 ...
   Image Name:   DIR_X1860_MT7621
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1851765 Bytes = 1.8 MiB
   Load Address: 81001000
   Entry Point:  813ea230
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

LINUX started...

 THIS IS ASIC

SDK 5.0.S.0
Linux version 3.10.108+ (jenkins@jrdslave2) (gcc version 5.5.0 (Buildroot 2018.08-git-00492-g751df64eb3-dirty) ) #1 SMP Fri Jun 10 11:52:44 MSK 2022

 The CPU feqenuce set to 880 MHz

 MIPS CPU sleep mode enabled.
GCMP present
CPU0 revision is: 0001992f (MIPS 1004Kc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 08000000 @ 00000000 (usable)
Zone ranges:
  DMA      [mem 0x00000000-0x00ffffff]
  Normal   [mem 0x01000000-0x07ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x07ffffff]
Detected 3 available secondary CPU(s)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
PERCPU: Embedded 7 pages/cpu @81664000 s5952 r8192 d14528 u32768
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 console=ttyS0
HZ = 100
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Writing ErrCtl register=00000004
Readback ErrCtl register=00000004
Memory: 124304k/131072k available (4075k kernel code, 6768k reserved, 974k data, 256k init, 0k highmem)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 577.53 BogoMIPS (lpj=2887680)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
launch: starting cpu1
launch: cpu1 gone!
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
CPU1 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 1: done.
launch: starting cpu2
launch: cpu2 gone!
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
CPU2 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 2: done.
launch: starting cpu3
launch: cpu3 gone!
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
CPU3 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 3: done.
Brought up 4 CPUs
NET: Registered protocol family 16
release PCIe RST: RALINK_RSTCTRL = 7000000
PCIE PHY initialize
***** Xtal 40MHz *****
start MT7621 PCIe register access
RALINK_RSTCTRL = 7000000
RALINK_CLKCFG1 = 77ffeff8

*************** MT7621 PCIe RC mode *************
PCIE2 no card, disable it(RST&CLK)
pcie_link status = 0x3
RALINK_RSTCTRL= 3000000
*** Configure Device number setting of Virtual PCI-PCI bridge ***
RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2
PCIE0 enabled
PCIE1 enabled
interrupt enable status: 300000
Port 1 N_FTS = 1b105000
Port 0 N_FTS = 1b105000
config reg done
init_rt2880pci done
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:00.0: BAR 9: assigned [mem 0x60000000-0x601fffff pref]
pci 0000:00:01.0: BAR 9: assigned [mem 0x60200000-0x603fffff pref]
pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff]
pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit pref]
pci 0000:01:00.0: BAR 2: assigned [mem 0x60100000-0x60103fff 64bit pref]
pci 0000:01:00.0: BAR 4: assigned [mem 0x60104000-0x60104fff 64bit pref]
pci 0000:00:00.0: PCI bridge to [bus 01]
pci 0000:00:00.0:   bridge window [mem 0x60000000-0x601fffff pref]
pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff 64bit pref]
pci 0000:02:00.0: BAR 2: assigned [mem 0x60300000-0x60303fff 64bit pref]
pci 0000:02:00.0: BAR 4: assigned [mem 0x60304000-0x60304fff 64bit pref]
pci 0000:00:01.0: PCI bridge to [bus 02]
pci 0000:00:01.0:   bridge window [mem 0x60200000-0x603fffff pref]
PCI: Enabling device 0000:00:00.0 (0004 -> 0006)
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
BAR0 at slot 0 = 0
bus=0x0, slot = 0x0
res[0]->start = 0
res[0]->end = 0
res[1]->start = 60400000
res[1]->end = 6040ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
BAR0 at slot 1 = 0
bus=0x0, slot = 0x1
res[0]->start = 0
res[0]->end = 0
res[1]->start = 60410000
res[1]->end = 6041ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0, irq=0x4
res[0]->start = 60000000
res[0]->end = 600fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 60100000
res[2]->end = 60103fff
res[3]->start = 0
res[3]->end = 0
res[4]->start = 60104000
res[4]->end = 60104fff
res[5]->start = 0
res[5]->end = 0
bus=0x2, slot = 0x1, irq=0x18
res[0]->start = 60200000
res[0]->end = 602fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 60300000
res[2]->end = 60303fff
res[3]->start = 0
res[3]->end = 0
res[4]->start = 60304000
res[4]->end = 60304fff
res[5]->start = 0
res[5]->end = 0
Switching to clocksource Ralink Systick timer
Registered /proc/sys/dru
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
multicast routing: unresolved cache size is 200, expires at 1.0 sec (HZ = 100)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 242
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered (default)
pcieport 0000:00:00.0: device [0e8d:0801] has invalid IRQ; check vendor BIOS
pcieport 0000:00:01.0: device [0e8d:0801] has invalid IRQ; check vendor BIOS
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A
serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A
Ralink gpio driver initialized
loop: module loaded
MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
Allocate 16 byte aligned buffer: 815407d0
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [01 F1 80 1D 01, 00801d01]
Device found in MTK table, ID: 1f1, EXT_ID: 801d01
Support this Device in MTK table! 1f1
NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD/Spansion NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Scanning device for bad blocks
Signature matched and data read!
load_fact_bbt success 1023
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
squashfsb.s_magic 0x81ffe5d8
squashfsb.s_magic 0x8a728050
squashfsb.s_magic 0xdeea60fb
squashfsb.s_magic 0x435fdfab
squashfsb.s_magic 0xec7734c
squashfsb.s_magic 0xe6520341
squashfsb.s_magic 0x254f560b
squashfsb.s_magic 0x73717368
squashfs filesystem found at block 0x320000
Creating 8 MTD partitions on "MT7621-NAND":
0x000000000000-0x000007f80000 : "ALL"
0x000000000000-0x000000080000 : "Bootloader"
0x000000080000-0x000000100000 : "Config"
0x000000100000-0x000000140000 : "Factory"
0x000000140000-0x000000320000 : "Kernel"
0x000000320000-0x000001000000 : "RootFS"
0x000000140000-0x000001000000 : "Linux"
0x000000000000-0x000001140000 : "Image"
[mtk_nand] probe successfully!
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
rdm_major = 253
GMAC1_MAC_ADRH -- : 0x0000bc22
GMAC1_MAC_ADRL -- : 0x289e0889
Ralink APSoC Ethernet Driver Initilization. v3.1  1024 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, Tx Ring = 1024, Rx Ring = 1024
GMAC1_MAC_ADRH -- : 0x0000bc22
GMAC1_MAC_ADRL -- : 0x289e0889
PROC INIT OK!
*****run project phy.
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 0(0x00000000)
xhci-hcd xhci-hcd: xHCI Host Controller
xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 1
xhci-hcd xhci-hcd: irq 22, io mem 0x1e1c0000
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: xHCI Host Controller
usb usb1: Manufacturer: Linux 3.10.108+ xhci-hcd
usb usb1: SerialNumber: xhci-hcd
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
xhci-hcd xhci-hcd: xHCI Host Controller
xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 2
usb usb2: New USB device found, idVendor=1d6b, idProduct=0003
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: xHCI Host Controller
usb usb2: Manufacturer: Linux 3.10.108+ xhci-hcd
usb usb2: SerialNumber: xhci-hcd
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver usb-storage
Ralink APSoC Hardware Watchdog Timer
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1942 buckets, 7768 max)
ctnetlink v0.93: registering with nfnetlink.
xt_time: kernel timezone is -0000
IPVS: Registered protocols ()
IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
IPVS: Creating netns size=768 id=0
IPVS: ipvs loaded.
ipip: IPv4 over IPv4 tunneling driver
gre: GRE over IPv4 demultiplexor driver
ip_gre: GRE over IPv4 tunneling driver
EoIP (IPv4) tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
Type=Linux
arp_tables: (C) 2002 David S. Miller
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
sit: IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Ebtables v2.0 registered
l2tp_core: L2TP core driver, V2.0
l2tp_ppp: PPPoL2TP kernel driver, V2.0
8021q: 802.1Q VLAN Support v1.8
nlmon: module starting ...
VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
Freeing unused kernel memory: 256K
Fri Jun 10 08:43:00 UTC 2022
Starting preinit...
Press Ctrl+C to enter developer menu.

gpiom: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
gpiom: module starting ...
gpiom: using profile DIR_X1860_MT7621.
gpiom: button support enabled.
gpiom: led support enabled.
gpiom: ctrl support disabled.
update_boot_worker: bootloader is up-to-date, done
Preinit completed


BusyBox v1.31.1 (2022-06-10 12:06:34 MSK) built-in shell (ash)

/ # Jun 10 11:43:02 [ALRT] kernel: PROC INIT OK!
FFFFFFFF:FFFFFFFF:FFFFFFFF:FFFFFFFF:FFFFFFFF:FFFFFFFF
Raeth v3.1 (NAPI
,SkbRecycle)
set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1

phy_tx_ring = 0x00c08000, tx_ring = 0xa0c08000

phy_rx_ring0 = 0x00c0c000, rx_ring[0] = 0xa0c0c000

phy_rx_ring0 = 0x00c0c000, rx_ring[0] = 0xa0c0c000
MT7530 Reset Completed!!
change HW-TRAP to 0x17c8f
set LAN/WAN LLLLW
GMAC1_MAC_ADRH -- : 0x0000bc22
GMAC1_MAC_ADRL -- : 0x289e0889
GDMA2_MAC_ADRH -- : 0x0000bc22
GDMA2_MAC_ADRL -- : 0x289e0888
eth3: ===> VirtualIF_open
MT7621 GE2 link rate to 1G
CDMA_CSG_CFG = 81000000
GDMA1_FWD_CFG = 20710000
GDMA2_FWD_CFG = 20710000
eth3: ===> VirtualIF_open
IPv6: ADDRCONF(NETDEV_UP): eth3: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): eth3: link becomes ready
<--mt7916_hif_init()
Rx[0] Ring: total 24576 bytes allocated
Rx[1] Ring: total 16384 bytes allocated
<-- pci_alloc_tx_rx_ring_mem, Status=0


=== pAd = c1801000, size = 13616000 ===

<-- RTMPAllocAdapterBlock, Status=0
RTMPInitPCIeDevice():device_id=0x7915
mt7915_init()-->
Use the default iPAiLNA bin image!
<--mt7915_init()
wdev_init(caller:RTMP_COM_IoctlHandle+0xad4/0x1b54 [mt_wifi]), wdev(0)
Rx[0] Ring: total 24576 bytes allocated
Rx[1] Ring: total 24576 bytes allocated
Rx[2] Ring: total 8192 bytes allocated
Rx[3] Ring: total 16384 bytes allocated
Rx[4] Ring: total 8192 bytes allocated
<-- pci_alloc_tx_rx_ring_mem, Status=0
Set_Debug_Proc(): (DebugLevel = 0)
efuse_probe: efuse = 10000012
d-link channel[1+2+3+4+5] = 5000
d-link channel[2+3+4+5+6] = 5210
d-link channel[3+4+5+6+7] = 5410
d-link channel[4+5+6+7+8] = 5630
d-link channel[5+6+7+8+9] = 5780
d-link channel[6+7+8+9+10] = 5650
d-link channel[7+8+9+10+11] = 5360
d-link channel[8+9+10+11+12] = 4740
d-link channel[9+10+11+12+13] = 3520
d-link select channel = 13 + 9
Set_Debug_Proc(): (DebugLevel = 0)
efuse_probe: efuse = 10000012
d-link channel[1+2+3+4+5] = 3890
d-link channel[2+3+4+5+6] = 3790
d-link channel[3+4+5+6+7] = 3800
d-link channel[4+5+6+7+8] = 3890
d-link channel[5+6+7+8+9] = 3970
d-link channel[6+7+8+9+10] = 3950
d-link channel[7+8+9+10+11] = 3980
d-link channel[8+9+10+11+12] = 3700
d-link channel[9+10+11+12+13] = 2840
d-link select channel = 13 + 9
d-link channel[36+40+44+48] = 1400
d-link channel[52+56+60+64] = 550
d-link channel[149+153+157+161] = 80
d-link select channel = 149 + 161
d-link channel[149] = 50
d-link channel[153] = 30
d-link channel[157] = 0
d-link channel[161] = 0
d-link select main channel = 157
nf_conntrack_rtsp v0.7 loading
nf_nat_rtsp v0.7 loading
Boot time (phase 1): 5.33 sec (kernel), 28.48 (user)
Boot time (phase 2): 5.33 sec (kernel), 28.68 (user)
eth3: ===> VirtualIF_close
GDMA2_MAC_ADRH -- : 0x0000bc22
GDMA2_MAC_ADRL -- : 0x289e0888
eth3: ===> VirtualIF_open
device deth1 entered promiscuous mode
device eth2 entered promiscuous mode
device ra0 entered promiscuous mode
device rax0 entered promiscuous mode
br1: port 3(rax0) entered forwarding state
br1: port 3(rax0) entered forwarding state
br1: port 2(ra0) entered forwarding state
br1: port 2(ra0) entered forwarding state
br1: port 1(deth1) entered forwarding state
br1: port 1(deth1) entered forwarding state
enum_acl_netdev: got 2 ifaces (1 LAN, 1 WAN)
enum_acl_netdev: need 4 patterns instead of 6
init PpeFoeBase = a0e00000
eth2 ifindex =2
eth3 ifindex =8
WanInf name is eth3!
PpeDevRegHandler : ineterface ra0 register (10)
PpeDevRegHandler : ineterface rax0 register (12)

Partitions

dev:    size   erasesize  name
mtd0: 07f80000 00020000 "ALL"
mtd1: 00080000 00020000 "Bootloader"
mtd2: 00080000 00020000 "Config"
mtd3: 00040000 00020000 "Factory"
mtd4: 001e0000 00020000 "Kernel"
mtd5: 00ce0000 00020000 "RootFS"
mtd6: 00ec0000 00020000 "Linux"
mtd7: 01140000 00020000 "Image"

I also tried to scp mtd0 to my PC. It didn't work because "/tmp is out of space". For some reason router thinks that it has only 128 megabytes of ram, but the chip is NT5CC128M16JR-EK, so it's clearly 2 gigabits or 256 megabytes.

wersonit · August 2, 2026, 5:34pm

Upgrading the firmware from 4.0.2 to 4.0.7 did the trick. Ram size is correct now. But this firmware also has a different mtd layout.

Newer bootlog


===================================================================
                MT7621   stage1 code 10:33:11 (ASIC)
                CPU=50000000 HZ BUS=16666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL3 FB_DL: 0xf, 1/0 = 603/421 3D000000
PLL4 FB_DL: 0x14, 1/0 = 596/428 51000000
PLL2 FB_DL: 0x16, 1/0 = 742/282 59000000
do DDR setting..[00320381]
Apply DDR3 Setting...(use customer AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  11                                                                                                             2  120
      --------------------------------------------------------------------------                                                                                                             ------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    1
000E:|    0    0    0    0    0    0    0    0    0    1    1    1    1    1                                                                                                                 1    1
000F:|    0    0    0    0    1    1    1    1    1    1    1    1    1    0                                                                                                                 0    0
0010:|    1    1    1    1    1    1    1    1    0    0    0    0    0    0                                                                                                                 0    0
0011:|    1    1    1    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0                                                                                                                 0    0
rank 0 coarse = 15
rank 0 fine = 64
B:|    0    0    0    0    0    0    0    0    1    1    1    0    0    0    0                                                                                                                 0
opt_dle value:9
DRAMC_R0DELDLY[018]=00001E1F
==================================================================
                RX      DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    9 9 9 11 9 8 10 7 6 6
10 |    9 9 7 9 7 9
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =31 DQS1 = 30
==================================================================
bit     DQS0     bit      DQS1
0  (1~60)30  8  (1~60)30
1  (1~60)30  9  (1~57)29
2  (1~56)28  10  (1~60)30
3  (2~60)31  11  (1~58)29
4  (1~60)30  12  (1~60)30
5  (0~62)31  13  (1~58)29
6  (1~59)30  14  (1~60)30
7  (1~62)31  15  (1~60)30
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    10 10 12 11 10 8 11 7 6 7
10 |    9 10 7 10 7 9
==================================================================
==================================================================
     TX  perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2
DQ loop=15, cmp_err_1 = ffff0082
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=1
DQ loop=14, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=14,  finish count=2
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
20,data:88
[EMI] DRAMC calibration passed

===================================================================
                MT7621   stage1 code done
                CPU=50000000 HZ BUS=16666666 HZ
===================================================================


U-Boot 1.1.3 (Nov 11 2025 - 12:33:28)

Board: Ralink APSoC DRAM:  256 MB
relocate_code Pointer at: 8ff90000

Config XHCI 40M PLL
Allocate 16 byte aligned buffer: 8ffcb650
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [01 F1 80 1D 01]
Device found in MTK table, ID: 1f1, EXT_ID: 801d01
Support this Device in MTK table! 1f1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                                                              00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                                                              00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                                                              00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                                                              00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                                                              00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                                                              00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                                                              00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                                                                                                              00 00 00 00 00
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
..============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Nov 11 2025  Time:12:33:28
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =256 Mbytes
#Reset_MT7530
set LAN/WAN LLLLW
DRU DIR-X1860

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
default: 3                                                                   0

3: System Boot system code via Flash.
## Booting image at bc140000 ...
   Image Name:   DIR_X1860_MT7621
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    4043202 Bytes =  3.9 MB
   Load Address: 81001000
   Entry Point:  81005ec0
..............................................................   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 81005ec0) ...
## Giving linux memsize in MB, 256

Starting kernel ...

Linux version 4.4.198 (jenkins@jrdslave1) (gcc version 8.3.0 (Buildroot 2019.11-git-00227-g43d3ccfdce) ) #1 SMP Tue Nov 11 20:53:57 MSK 2025
SoC Type: MediaTek MT7621 ver:1 eco:3
bootconsole [early0] enabled
CPU0 revision is: 0001992f (MIPS 1004Kc)
MIPS: machine is MediaTek MT7621 RFB (802.11ax,NAND)
Determined physical RAM map:
 memory: 10000000 @ 00000000 (usable)
Zone ranges:
  DMA      [mem 0x0000000000000000-0x0000000000ffffff]
  Normal   [mem 0x0000000001000000-0x000000000fffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x0000000000000000-0x000000000fffffff]
Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
VPE topology {2,2} total 4
PERCPU: Embedded 10 pages/cpu @82003000 s9168 r8192 d23600 u40960
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
Kernel command line: console=ttyS0,57600
log_buf_len individual max cpu contribution: 4096 bytes
log_buf_len total cpu_extra contributions: 12288 bytes
log_buf_len min size: 16384 bytes
log_buf_len: 32768 bytes
early log buf free: 14200(86%)
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Writing ErrCtl register=000002c9
Readback ErrCtl register=000002c9
Memory: 245340K/262144K available (8032K kernel code, 4107K rwdata, 1744K rodata, 248K init, 133K bss, 16804K reserved, 0K cma-reserved)
SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
        Build-time adjustment of leaf fanout to 32.
NR_IRQS:256
clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns
clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns
sched_clock: 32 bits at 440MHz, resolution 2ns, wraps every 4880645118ns
Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU1 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 1: done.
CPU2 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 2: done.
CPU3 revision is: 0001992f (MIPS 1004Kc)
Synchronize counters for CPU 3: done.
Brought up 4 CPUs
CPU3: update max cpu_capacity 589
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
CPU3: update max cpu_capacity 589
futex hash table entries: 1024 (order: 3, 32768 bytes)
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
Power management is using heavyweight sync 0
mt7621_gpio 1e000600.gpio: registering 32 gpios
mt7621_gpio 1e000600.gpio: registering 32 gpios
mt7621_gpio 1e000600.gpio: registering 32 gpios
gpiom irq 19 created
mt7621-pci 1e140000.pcie: Failed to get gpio for PCIe1
mt7621-pci 1e140000.pcie: Failed to get gpio for PCIe2
PCIe port 2 link down
PCI coherence region base: 0x60000000, mask/settings: 0xf0000002
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:00.0: BAR 9: assigned [mem 0x60000000-0x601fffff pref]
pci 0000:00:01.0: BAR 9: assigned [mem 0x60200000-0x603fffff pref]
pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff]
pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit pref]
pci 0000:01:00.0: BAR 2: assigned [mem 0x60100000-0x60103fff 64bit pref]
pci 0000:01:00.0: BAR 4: assigned [mem 0x60104000-0x60104fff 64bit pref]
pci 0000:00:00.0: PCI bridge to [bus 01]
pci 0000:00:00.0:   bridge window [mem 0x60000000-0x601fffff pref]
pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff 64bit pref]
pci 0000:02:00.0: BAR 2: assigned [mem 0x60300000-0x60303fff 64bit pref]
pci 0000:02:00.0: BAR 4: assigned [mem 0x60304000-0x60304fff 64bit pref]
pci 0000:00:01.0: PCI bridge to [bus 02]
pci 0000:00:01.0:   bridge window [mem 0x60200000-0x603fffff pref]
clocksource: Switched to clocksource GIC
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jitterentropy: Initialization failed with host not compliant with requirements: 2
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered (default)
Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
console [ttyS0] disabled
console [ttyS0] enabled0 at MMIO 0x1e000c00 (irq = 33, base_baud = 3125000) is a 16550A
console [ttyS0] enabled
bootconsole [early0] disabled
bootconsole [early0] disabled
1e000d00.uartfull: ttyS1 at MMIO 0x1e000d00 (irq = 34, base_baud = 3125000) is a 16550A
1e000e00.uartfull: ttyS2 at MMIO 0x1e000e00 (irq = 35, base_baud = 3125000) is a 16550A
loop: module loaded
physmap platform flash device: 01000000 at 1fc00000
physmap-flash physmap-flash.0: map_probe failed
libphy: Fixed MDIO Bus: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
libphy: mdio: probed
mtk_soc_eth 1e100000.ethernet: generated random MAC address da:84:e3:2d:d7:13
mtk_soc_eth 1e100000.ethernet: connected mac 0 to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 10
mtk_soc_eth 1e100000.ethernet: generated random MAC address 96:f2:ff:80:8b:ba
mtk_soc_eth 1e100000.ethernet: connected mac 1 to PHY at fixed-0:01 [uid=00000000, driver=Generic PHY]
mtk_soc_eth 1e100000.ethernet eth1: mediatek frame engine at 0xbe100000, irq 10
mediatek_soc_hnat 1e100000.hnat: wan = eth1
mediatek_soc_hnat 1e100000.hnat: lan = eth0
mediatek_soc_hnat 1e100000.hnat: ppd = eth0
mediatek_soc_hnat 1e100000.hnat: gmac num = 2
mediatek_soc_hnat 1e100000.hnat: ext devices = rax0
mediatek_soc_hnat 1e100000.hnat: ext devices = ra0
mediatek_soc_hnat 1e100000.hnat: ext devices = rax1
mediatek_soc_hnat 1e100000.hnat: ext devices = ra1
mediatek_soc_hnat 1e100000.hnat: ext devices = rax2
mediatek_soc_hnat 1e100000.hnat: ext devices = ra2
mediatek_soc_hnat 1e100000.hnat: ext devices = rax3
mediatek_soc_hnat 1e100000.hnat: ext devices = ra3
mediatek_soc_hnat 1e100000.hnat: ext devices = apclix0
mediatek_soc_hnat 1e100000.hnat: ext devices = apcli0
mediatek_soc_hnat 1e100000.hnat: FOE entry number = 16384
mediatek_soc_hnat 1e100000.hnat: hwnat start
hnat roaming work enable
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
usbcore: registered new interface driver usb-storage
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
Registered /proc/sys/dru
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (3833 buckets, 15332 max)
ctnetlink v0.93: registering with nfnetlink.
xt_time: kernel timezone is -0000
IPVS: Registered protocols ()
IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
IPVS: Creating netns size=912 id=0
IPVS: ipvs loaded.
ipip: IPv4 over IPv4 tunneling driver
gre: GRE over IPv4 demultiplexor driver
ip_gre: GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
arp_tables: (C) 2002 David S. Miller
Initializing XFRM netlink socket
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
sit: IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
Bridge firewalling registered
Ebtables v2.0 registered
l2tp_core: L2TP core driver, V2.0
l2tp_ppp: PPPoL2TP kernel driver, V2.0
8021q: 802.1Q VLAN Support v1.8
nlmon: module starting ...
mtkmips-pinmux pinctrl: spi is already enabled
mtk-nand 1e003000.nand: Error applying setting, reverse things back
nand: device found, Manufacturer ID: 0x01, Chip ID: 0xf1
nand: AMD/Spansion S34ML01G2
nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
Scanning device for bad blocks
5 ofpart partitions found on MTD device mtk-nand
Creating 5 MTD partitions on "mtk-nand":
0x000000000000-0x000000080000 : "Bootloader"
0x000000080000-0x000000100000 : "Config"
0x000000100000-0x000000140000 : "Factory"
0x000000140000-0x000002000000 : "Linux"
2 uimage-fw partitions found on MTD device Linux
0x000000140000-0x000000520000 : "kernel"
0x000000520000-0x000002000000 : "rootfs"
mtd: device 5 (rootfs) set to be root filesystem
0x000002000000-0x000008000000 : "reserve"
mt753x gsw: Switch is MediaTek MT7530 rev 1
libphy: mt753x_mdio: probed
VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
Freeing unused kernel memory: 248K
This architecture does not have kernel memory protection.
random: init: uninitialized urandom read (4 bytes read, 36 bits of entropy available)
random: date: uninitialized urandom read (4 bytes read, 37 bits of entropy available)
Tue Nov 11 17:41:00 UTC 2025
Starting preinit...
Press Ctrl+C to enter developer menu.

random: modprobe: uninitialized urandom read (4 bytes read, 44 bits of entropy available)
gpiom: loading out-of-tree module taints kernel.
gpiom: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
gpiom: module starting ...
gpiom: using profile DIR_X1860_MT7621.
gpiom: button support enabled.
gpiom: led support enabled.
gpiom: ctrl support disabled.
random: init: uninitialized urandom read (4 bytes read, 44 bits of entropy available)
update_boot_worker: bootloader is up-to-date, done
random: loggingd: uninitialized urandom read (4 bytes read, 44 bits of entropy available)
random: loggingd: uninitialized urandom read (4 bytes read, 44 bits of entropy available)
Preinit completed
random: d_init: uninitialized urandom read (4 bytes read, 44 bits of entropy available)
random: sh: uninitialized urandom read (4 bytes read, 44 bits of entropy available)


BusyBox v1.35.0 () built-in shelrandom: deuteron: uninitialized urandom read (4 bytes read, 44 bits of entropy available)
l (ash)

/ # random: deuteron: uninitialized urandom read (4 bytes read, 44 bits of entropy available)
Nov 11 17:41:02 [ ERR] kernel: physmap-flash physmap-flash.0: map_probe failed
Nov 11 17:41:02 [ ERR] kernel: mtk_soc_eth 1e100000.ethernet: generated random MAC address da:84:e3:2d:d7:13
Nov 11 17:41:02 [ ERR] kernel: mtk_soc_eth 1e100000.ethernet: generated random MAC address 96:f2:ff:80:8b:ba
Nov 11 17:41:02 [ ERR] kernel: mtk-nand 1e003000.nand: Error applying setting, reverse things back
hnat_priv ppd = eth0
device eth0 entered promiscuous mode
IPv6: ADDRCONF(NETDEV_UP): br0: link is not ready
device eth0.1 entered promiscuous mode
br0: port 1(eth0.1) entered forwarding state
br0: port 1(eth0.1) entered forwarding state
IPv6: ADDRCONF(NETDEV_CHANGE): br0: link becomes ready
hnat_priv ppd = eth0.1
Nov 11 20:41:05 [ ERR] default_wifi_get_channel[1035]: d_wifi_ioctl(): No such device (19)
hnat_priv ppd = eth0
random: nonblocking pool is initialized
extif_set_dev(ra0)
extif_put_dev(ra0)
br0: port 1(eth0.1) entered forwarding state
extif_set_dev(ra0)
extif_set_dev(rax0)
hnat_priv ppd = eth0.1
Boot time (phase 1): 5.38 sec (kernel), 26.81 (user)
device ra0 entered promiscuous mode
br0: port 2(ra0) entered forwarding state
br0: port 2(ra0) entered forwarding state
device ra0 left promiscuous mode
br0: port 2(ra0) entered disabled state
device ra0 entered promiscuous mode
br0: port 2(ra0) entered forwarding state
br0: port 2(ra0) entered forwarding state
device rax0 entered promiscuous mode
br0: port 3(rax0) entered forwarding state
br0: port 3(rax0) entered forwarding state
Boot time (phase 2): 5.38 sec (kernel), 33.91 (user)

Newer layout

dev:    size   erasesize  name
mtd0: 00080000 00020000 "Bootloader"
mtd1: 00080000 00020000 "Config"
mtd2: 00040000 00020000 "Factory"
mtd3: 01ec0000 00020000 "Linux"
mtd4: 003e0000 00020000 "kernel"
mtd5: 01ae0000 00020000 "rootfs"
mtd6: 06000000 00020000 "reserve"

wersonit · August 4, 2026, 8:05pm

So, how do we (or I) make openwrt for that thing?

Can you tell if it is similar to DIR-878? Then I could probably make use of its dts, but with offset adjustments. I'm not familiar with firmware signatures yet, but I will figure it out.

s_2 · August 5, 2026, 9:28am

I'm not quite sure which ODM builds these for D-Link, the DIR-X1860 A1 is made by Alpha Networks (formerly D-Link's own hardware design department), the DIR-878 are made by SGE/T&W. But this mostly affects the factory image generation etc., first thing to do is building an initramfs image including the particular mtd layout

You can have a look at the .dtsi for basically any other mt7621 device with NAND, and create a very minimal .dts with the header (model name etc.) and the mtd partition layout. insert an entry for the device in image/mt7621.mk and start a build.

Can you actually interrupt the u-boot by pressing 1 during

wersonit:

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
default: 3                                                                   0

3: System Boot system code via Flash.

or is the selection 3 hardcoded into uboot, i.e. there is no countdown timer before 3 was selected? D-Link did that to some previous devices.

If you can press 1 here, see what happens after sending your initramfs via tftp if that boots, next step is finding GPIO for buttons / LEDs, getting wifi to work etc.