Adtran 854v6 restricted shell via serial, what next?

For Developers
1

Hi all,

I've got an Adtran 845v6 which is an interesting device as it has 10Gbe + 2.5Fbe wan and 4x gig Lan ports and wifi 6 And I think is x86. It runs a locked down openwrt image and I have managed to get serial console which I have to login with credentials setup from gui (ie admin account but not root) I have boot logs that seem to nicely show the Address mappings for flash which is nice.

However I have a locked down shell with something called TCLsh some kind of cisco like restriced shell. The bootloader has busybox disabled so I can't drop into a lower lever cmd line.

There are some strange commands in the TCLsh shell that suggest I can feed it an image via tftp but I couldnt get it to work last time I tried.

Without removing flaah storage, anyone have any ideas about getting root on this or erasing isp config portions of firmware?

I was thinking about brute forcing shell login over serial or fuzzing tcl, I think there maybe an easier way I have overlooked?

2

is there a boot sequence you can post ?

3

I sure can but not today, as I won't be home until late.

4 
[  446.543914] reboot: Restarting system


F0: 102B 0000

F6: 3800 00A0

F3: 0000 0000

V0: 0000 0000 [0001]

00: 0000 0000

BP: 0000 0041 [0000]

G0: 0190 0000

T0: 0000 0335 [000F]

Jump to BL


UNIVPLL_CON0 = 0xFE000000!!!

mt_pll_init: Set pll frequency for 25M crystal

RAM_CONSOLE preloader last status: 0x0 0x0 0x0 0x0 0x0 0x0 

[PMIC_WRAP]wrap_init pass,the return value=0.

[pmic_init] Preloader Start..................

[pmic_init] MT6380 CHIP Code, reg_val = 0, 1:E2  0:E3

[pmic_init] Done...................

Chip part number:7622A

MT7622 Version: 1.2.7, (iPA) 

SSC OFF

mt_pll_post_init: mt_get_cpu_freq = 1350000Khz

mt_pll_post_init: mt_get_mem_freq = 1600000Khz

mt_pll_post_init: mt_get_bus_freq = 1119920Khz

[PLFM] Init I2C: OK(0)



[BLDR] Build Time: 20180622-162441

==== Dump RGU Reg ========

RGU MODE:     14

RGU LENGTH:   FFE0

RGU STA:      40000000

RGU INTERVAL: FFF

RGU SWSYSRST: 8000

==== Dump RGU Reg End ====

RGU: g_rgu_satus:2

 mtk_wdt_mode_config  mode value=10, tmp:22000010

PL RGU RST: ??

SW reset with bypass power key flag

Find bypass powerkey flag

WDT NONRST=0x20000000

WDT IRQ_EN=0x340003

RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200F3)

[EMI] MDL number = 2

[EMI] DRAMC calibration start



[EMI] DRAMC calibration end



[EMI]rank0 size: 0x40000000

[MEM] complex R/W mem test pass

RAM_CONSOLE wdt status (0x2)=0x2

[mmc_init]: msdc0 start mmc_init_host() in PL...

[msdc_init]: msdc0 Host controller intialization start 

[SD0] Pins mode(1), none(0), down(1), up(2), keep(3)

[SD0] Pins mode(2), none(0), down(1), up(2), keep(3)

[info][msdc_set_startbit 1127] read data start bit at rising edge

[info][msdc_config_clksrc] input clock is 400000kHz

[SD0] Bus Width: 1

[info][msdc_config_clksrc] input clock is 400000kHz

[info][msdc_set_startbit 1127] read data start bit at rising edge

[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(385) DS(0) RS(0)

[msdc_init]: msdc0 Host controller intialization done

[mmc_init]: msdc0 start mmc_init_card() in PL...

[mmc_init_card]: start

[info][msdc_config_clksrc] input clock is 400000kHz

[info][msdc_set_startbit 1127] read data start bit at rising edge

[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(0) DDR(0) DIV(385) DS(0) RS(0)

[SD0] Bus Width: 8

[SD0] Switch to High-Speed mode!

[info][msdc_config_clksrc] input clock is 400000kHz

[info][msdc_set_startbit 1127] read data start bit at rising edge

[SD0] SET_CLK(260kHz): SCLK(259kHz) MODE(2) DDR(1) DIV(192) DS(0) RS(0)

[SD0] Bus Width: 8

[SD0] Size: 3776 MB, Max.Speed: 52000 kHz, blklen(512), nblks(7733248), ro(0)

[mmc_init_mem_card 3140][SD0] Initialized, eMMC50

before host->cur_bus_clk(259740)

[info][msdc_config_clksrc] input clock is 400000kHz

[info][msdc_set_startbit 1127] read data start bit at rising edge

[SD0] SET_CLK(52000kHz): SCLK(50000kHz) MODE(2) DDR(1) DIV(1) DS(0) RS(0)

host->cur_bus_clk(50000000)

[mmc_init_card]: finish successfully

[PLFM] Init Boot Device: OK(0)

[GPT_PL]Parsing Primary GPT now...

[GPT_PL][0]name=tee1, part_id=8, start_sect=0x400, nr_sects=0x200

[GPT_PL][1]name=lk, part_id=8, start_sect=0x600, nr_sects=0x400

[GPT_PL][2]name=nvram, part_id=8, start_sect=0xA00, nr_sects=0x400

[GPT_PL][3]name=rf, part_id=8, start_sect=0xE00, nr_sects=0x800

[GPT_PL][4]name=boot, part_id=8, start_sect=0x1600, nr_sects=0x9A00

[GPT_PL][5]name=res1, part_id=8, start_sect=0xB000, nr_sects=0x26E00

[GPT_PL][6]name=mfginfo, part_id=8, start_sect=0x31E00, nr_sects=0x200

[GPT_PL][7]name=BOOT, part_id=8, start_sect=0x32000, nr_sects=0x100000

[GPT_PL][8]name=FLASH, part_id=8, start_sect=0x132000, nr_sects=0x62DFDF

[GPT_PL][9]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][10]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][11]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][12]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][13]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][14]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][15]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][16]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][17]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][18]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][19]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][20]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][21]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][22]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][23]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][24]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][25]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][26]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][27]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][28]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][29]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][30]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][31]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][32]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][33]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][34]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][35]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][36]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][37]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][38]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][39]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][40]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][41]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][42]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][43]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][44]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][45]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][46]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][47]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][48]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][49]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][50]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][51]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][52]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][53]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][54]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][55]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][56]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][57]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][58]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][59]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][60]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][61]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][62]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][63]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][64]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][65]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][66]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][67]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][68]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][69]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][70]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][71]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][72]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][73]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][74]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][75]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][76]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][77]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][78]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][79]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][80]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][81]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][82]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][83]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][84]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][85]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][86]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][87]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][88]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][89]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][90]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][91]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][92]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][93]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][94]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][95]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][96]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][97]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][98]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][99]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][100]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][101]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][102]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][103]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][104]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][105]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][106]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][107]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][108]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][109]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][110]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][111]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][112]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][113]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][114]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][115]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][116]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][117]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][118]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][119]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][120]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][121]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][122]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][123]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][124]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][125]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][126]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL][127]name=, part_id=8, start_sect=0x0, nr_sects=0x1

[GPT_PL]Success to find valid GPT.



[PART] blksz: 512B

[PART] [0x0000000000080000-0x00000000000BFFFF] "tee1" (512 blocks) 

[PART] [0x00000000000C0000-0x000000000013FFFF] "lk" (1024 blocks) 

[PART] [0x0000000000140000-0x00000000001BFFFF] "nvram" (1024 blocks) 

[PART] [0x00000000001C0000-0x00000000002BFFFF] "rf" (2048 blocks) 

[PART] [0x00000000002C0000-0x00000000015FFFFF] "boot" (39424 blocks) 

[PART] [0x0000000001600000-0x00000000063BFFFF] "res1" (159232 blocks) 

[PART] [0x00000000063C0000-0x00000000063FFFFF] "mfginfo" (512 blocks) 

[PART] [0x0000000006400000-0x00000000263FFFFF] "BOOT" (1048576 blocks) 

[PART] [0x0000000026400000-0x00000000EBFFBDFF] "FLASH" (6479839 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 

[PART] [0x0000000000000000-0x00000000000001FF] "" (1 blocks) 



Device APC domain init setup:



Domain Setup (0x0)

Domain Setup (0x0)

Device APC domain after setup:

Domain Setup (0x0)

Domain Setup (0x0)

[get_part] part->nr_sects=512, part->info->name=tee1

[get_part] part->nr_sects=1024, part->info->name=lk

[PART] Image with part header

[PART] name : U-Boot

[PART] addr : 41E00000h mode : -1

[PART] size : 316884

[PART] magic: 58881688h



[PART] load "lk" from 0x00000000000C0200 (dev) to 0x41E00000 (mem) [SUCCESS]

[PART] load speed: 11051KB/s, 316884 bytes, 28ms

load lk (ret=0)

[get_part] part->nr_sects=512, part->info->name=tee1

[PART] Image with part header

[PART] name : atf

[PART] addr : FFFFFFFFh mode : -1

[PART] size : 62032

[PART] magic: 58881688h



[PART] load "tee1" from 0x0000000000080200 (dev) to 0x43000DC0 (mem) [SUCCESS]

[PART] load speed: 6730KB/s, 62032 bytes, 9ms

load tee1 (ret=0)

[BLDR] bldr load tee part ret=0x0, addr=0x43001000

[get_part] part->nr_sects=512, part->info->name=tee1

[get_part] part->nr_sects=1024, part->info->name=lk

[get_part] part->nr_sects=1024, part->info->name=nvram

[get_part] part->nr_sects=2048, part->info->name=rf

[get_part] part->nr_sects=39424, part->info->name=boot

[BLDR] part_load_raw_part ret=0x0

[BLDR] part_load_images ret=0x0

[BLDR] Others, jump to ATF



[BLDR] jump to 0x41E00000

[BLDR] <0x41E00000>=0xEA00000F

[BLDR] <0x41E00004>=0xE59FF014



U-Boot 2014.04-rc1-g24cdfa2-dirty (Aug 03 2021 - 08:51:22)

auto detection g_total_rank_size = 0x3F000000
DRAM:  1008 MiB
dev_num = 0
***size=32768, offset=1310720, blk_start=2560, blk_cnt=64
In:    serial
Out:   serial
Err:   serial
dev_num = 0
***size=32768, offset=1310720, blk_start=2560, blk_cnt=64
Net:   mtk_eth
Uip activated
autoboot soon
ret2 = 1
ret2 = 1

Partition Map for MMC device 0  --   Partition Type: EFI

GPT: first_usable_lba incorrect: 22 > 0
print_part_efi: *** ERROR: Invalid GPT ***
mmc0 is available
ret2 = 1
ret2 = 1

Partition Map for MMC device 0  --   Partition Type: EFI

Part	Start LBA	End LBA		Name
	Attributes
	Type UUID
	Partition UUID
  1	0x00000400	0x000005ff	"tee1"
	attrs:	0x0000000000000000
	type:	0fc63daf-8483-4772-8e79-3d69d8477de4
	uuid:	54caf666-b451-48ff-bfe5-3010378d8a8c
  2	0x00000600	0x000009ff	"lk"
	attrs:	0x0000000000000000
	type:	0fc63daf-8483-4772-8e79-3d69d8477de4
	uuid:	42677055-cdfa-44b5-a3b3-60a1e2d17d37
  3	0x00000a00	0x00000dff	"nvram"
	attrs:	0x0000000000000000
	type:	0fc63daf-8483-4772-8e79-3d69d8477de4
	uuid:	f72448af-1a00-4c89-9f58-90501cb9a17f
  4	0x00000e00	0x000015ff	"rf"
	attrs:	0x0000000000000000
	type:	0fc63daf-8483-4772-8e79-3d69d8477de4
	uuid:	be5e87a6-f109-4c95-b4f7-a0c728c0a463
  5	0x00001600	0x0000afff	"boot"
	attrs:	0x0000000000000000
	type:	0fc63daf-8483-4772-8e79-3d69d8477de4
	uuid:	aa5eba22-8510-41fa-bb7e-18d4f5ce68ab
  6	0x0000b000	0x00031dff	"res1"
	attrs:	0x0000000000000000
	type:	0fc63daf-8483-4772-8e79-3d69d8477de4
	uuid:	a9849703-e2ec-4d4a-b30d-cf86177e2ae5
  7	0x00031e00	0x00031fff	"mfginfo"
	attrs:	0x0000000000000000
	type:	0fc63daf-8483-4772-8e79-3d69d8477de4
	uuid:	24e66e55-8ff5-4973-8e2d-dc7b1296535a
  8	0x00032000	0x00131fff	"BOOT"
	attrs:	0x0000000000000000
	type:	0fc63daf-8483-4772-8e79-3d69d8477de4
	uuid:	f025cd06-3a15-4935-a7c2-350def1bbe31
  9	0x00132000	0x0075ffde	"FLASH"
	attrs:	0x0000000000000000
	type:	0fc63daf-8483-4772-8e79-3d69d8477de4
	uuid:	ba46b350-3786-426b-a5ab-d9f669f24deb
mmc0 is available
reading uEnv.txt
25 bytes read in 1 ms (24.4 KiB/s)
mmc0 operation
dev_num = 0

MMC read: dev # 0, block # 204288, count 512 ... 512 blocks read: OK

USING imageid : 2, imageid_adj 0
reading /images/2/bin/uboot-init.txt.405
176 bytes read in 4 ms (43 KiB/s)
Running uboot_init for engnum 405

 mdio.w addr[0x0000000D]  value[0x0000001E]

 mdio.w addr[0x0000000E]  value[0x00000008]

 mdio.w addr[0x0000000D]  value[0x0000401E]

 mdio.w addr[0x0000000E]  value[0x000024E2]
reading /images/2/fit-multi.itb
11771240 bytes read in 768 ms (14.6 MiB/s)
bootm flag=0, states=70f
## Loading kernel from FIT Image at 40080000 ...
   Using 'config@405' configuration
   Trying 'kernel@k1' kernel subimage
     Description:  Linux Kernel k1
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x400800d4
     Data Size:    4717459 Bytes = 4.5 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   291c9a93
     Hash algo:    sha1
     Hash value:   4a3293b8525bbdc259910ab1738faba4e53fd561
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 40080000 ...
   Using 'config@405' configuration
   Trying 'ramdisk@rdisk' ramdisk subimage
     Description:  ramdisk rdisk
     Type:         RAMDisk Image
     Compression:  uncompressed
     Data Start:   0x40544574
     Data Size:    6770519 Bytes = 6.5 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   ea66d940
     Hash algo:    sha1
     Hash value:   1ca1c9b9bc649311a0c82e3dff85a14bb7ed8bbd
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 40080000 ...
   Using 'config@405' configuration
   Trying 'fdt@854-v6-iPA' fdt subimage
     Description:  Flattened Device Tree blob 854-v6-iPA
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4051e178
     Data Size:    31633 Bytes = 30.9 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   0170240f
     Hash algo:    sha1
     Hash value:   691e1d76e06377ade0716639bf4355742dab7259
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x4051e178
   Uncompressing Kernel Image ... OK
   Loading Ramdisk to 7c8b2000, end 7cf26f57 ... OK
   Loading Device Tree to 6bff5000, end 6bfffb90 ... OK

Starting kernel ...
5 
Starting kernel ...

[ATF][     8.145228]save kernel info
[ATF][     8.148164]Kernel_EL2
[ATF][     8.150834]Kernel is 64Bit
[ATF][     8.153922]pc=0x44000000, r0=0x6bff5000, r1=0x0
INFO:    BL3-1: Preparing for EL3 exit to normal world, Kernel
INFO:    BL3-1: Next image address = 0x44000000
INFO:    BL3-1: Next image spsr = 0x3c9
[ATF][     8.171620]el3_exit
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.10.110 (cmonroe@bfg9000.smartrg.sba) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 8.4.0 r16529-c284603acd) 8.4.0, GNU ld (GNU Binutils) 2.34) #0 SMP PREEMPT Tue Apr 12 16:00:22 2022
[    0.000000] Machine model: Adtran 854-v6
[    0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[    0.000000] printk: bootconsole [uart8250] enabled
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x0000000044ffffff]
[    0.000000]   node   0: [mem 0x0000000045000000-0x0000000045140fff]
[    0.000000]   node   0: [mem 0x0000000045141000-0x000000007fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000007fffffff]
[    0.000000] On node 0 totalpages: 262144
[    0.000000]   DMA zone: 4096 pages used for memmap
[    0.000000]   DMA zone: 0 pages reserved
[    0.000000]   DMA zone: 262144 pages, LIFO batch:63
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv0.2 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: Trusted OS migration not required
[    0.000000] percpu: Embedded 30 pages/cpu s83672 r8192 d31016 u122880
[    0.000000] pcpu-alloc: s83672 r8192 d31016 u122880 alloc=30*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: ARM erratum 845719
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] CPU features: detected: ARM erratum 843419
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 258048
[    0.000000] Kernel command line: earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n1 swiotlb=512 imageid=2 flashdev=/dev/mmcblk0 rootfstype=squashfs engnum=405 block2mtd.block2mtd=/dev/mmcblk0,65536,eMMC,5 mtdparts=eMMC:1m@0x1c0000(factory)
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 1004408K/1048576K available (9790K kernel code, 1766K rwdata, 2988K rodata, 768K init, 319K bss, 44168K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] ftrace: allocating 34081 entries in 134 pages
[    0.000000] ftrace: allocated 134 pages with 3 groups
[    0.000000] rcu: Preemptible hierarchical RCU implementation.
[    0.000000] 	Trampoline variant of Tasks RCU enabled.
[    0.000000] 	Rude variant of Tasks RCU enabled.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GIC: GICv2 detected, but range too small and irqchip.gicv2_force_probe not set
[    0.000000] random: get_random_bytes called from start_kernel+0x3ac/0x4f8 with crng_init=0
[    0.000000] arch_timer: cp15 timer(s) running at 12.50MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2e2049cda, max_idle_ns: 440795202628 ns
[    0.000003] sched_clock: 56 bits at 12MHz, resolution 80ns, wraps every 4398046511080ns
[    0.008279] Calibrating delay loop (skipped), value calculated using timer frequency.. 25.00 BogoMIPS (lpj=125000)
[    0.018677] pid_max: default: 32768 minimum: 301
[    0.023406] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.030840] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.039857] rcu: Hierarchical SRCU implementation.
[    0.045551] smp: Bringing up secondary CPUs ...
[    0.050451] Detected VIPT I-cache on CPU1
[    0.050499] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.050571] smp: Brought up 1 node, 2 CPUs
[    0.065267] SMP: Total of 2 processors activated.
[    0.069984] CPU features: detected: 32-bit EL0 Support
[    0.075147] CPU features: detected: CRC32 instructions
[    0.080439] CPU: All CPU(s) started at EL2
[    0.084552] alternatives: patching kernel code
[    0.089428] devtmpfs: initialized
[    0.096670] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.106586] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.113504] pinctrl core: initialized pinctrl subsystem
[    0.119603] NET: Registered protocol family 16
[    0.124413] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.131544] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.139334] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.148115] thermal_sys: Registered thermal governor 'fair_share'
[    0.148119] thermal_sys: Registered thermal governor 'bang_bang'
[    0.154233] thermal_sys: Registered thermal governor 'step_wise'
[    0.160286] thermal_sys: Registered thermal governor 'user_space'
[    0.166675] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[    0.179655] ASID allocator initialised with 65536 entries
[    0.219375] cryptd: max_cpu_qlen set to 1000
[    0.226887] SCSI subsystem initialized
[    0.230840] libata version 3.00 loaded.
[    0.234880] usbcore: registered new interface driver usbfs
[    0.241385] usbcore: registered new interface driver hub
[    0.246779] usbcore: registered new device driver usb
[    0.252875] Advanced Linux Sound Architecture Driver Initialized.
[    0.259597] Bluetooth: Core ver 2.22
[    0.263301] NET: Registered protocol family 31
[    0.267757] Bluetooth: HCI device and connection manager initialized
[    0.274216] Bluetooth: HCI socket layer initialized
[    0.279110] Bluetooth: L2CAP socket layer initialized
[    0.284195] Bluetooth: SCO socket layer initialized
[    0.289376] clocksource: Switched to clocksource arch_sys_counter
[    0.366187] NET: Registered protocol family 2
[    0.370702] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.378739] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes, linear)
[    0.387153] TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.394983] TCP bind hash table entries: 8192 (order: 5, 131072 bytes, linear)
[    0.402351] TCP: Hash tables configured (established 8192 bind 8192)
[    0.408818] UDP hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.415483] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes, linear)
[    0.422658] NET: Registered protocol family 1
[    0.427044] PCI: CLS 0 bytes, default 64
[    0.431099] Unpacking initramfs...
[    0.673276] Freeing initrd memory: 6608K
[    0.677733] hw perfevents: enabled with armv8_cortex_a53 PMU driver, 7 counters available
[    0.689429] workingset: timestamp_bits=46 max_order=18 bucket_order=0
[    0.699933] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.705877] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.749260] mtk-tphy 1a0c4000.usb-phy: failed to get ref_clk(id-1)
[    0.760751] mt-pmic-pwrap 10001000.pwrap: unexpected interrupt int=0x1
[    0.782814] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    0.790683] printk: console [ttyS0] disabled
[    0.815156] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 22, base_baud = 1562500) is a ST16650V2
[    0.824394] printk: console [ttyS0] enabled
[    0.824394] printk: console [ttyS0] enabled
[    0.832768] printk: bootconsole [uart8250] disabled
[    0.832768] printk: bootconsole [uart8250] disabled
[    0.863743] 11005000.serial: ttyS1 at MMIO 0x11005000 (irq = 23, base_baud = 1562500) is a ST16650V2
[    0.874272] mtk_rng 1020f000.rng: registered RNG driver
[    0.874403] random: fast init done
[    0.879878] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.883077] random: crng init done
[    0.895139] loop: module loaded
[    0.898285] the cryptoloop driver has been deprecated and will be removed in in Linux 5.16
[    0.914468] rtc_mt7622 10212800.rtc: registered as rtc0
[    0.919754] rtc_mt7622 10212800.rtc: setting system clock to 2000-01-01T00:00:00 UTC (946684800)
[    0.928846] i2c /dev entries driver
[    0.935050] mtk-wdt 10212000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=1)
[    0.943245] Bluetooth: HCI UART driver ver 2.3
[    0.947686] Bluetooth: HCI UART protocol H4 registered
[    0.952828] Bluetooth: HCI UART protocol BCSP registered
[    0.958286] Bluetooth: HCI UART protocol Broadcom registered
[    0.964022] Bluetooth: HCI UART protocol QCA registered
[    1.079831] srg-sysled 0-0030: srg_led_probe done
[    1.080656] mtk-msdc 11230000.mmc: phase: [map:f0ffffff] [maxlen:24] [final:8]
[    1.092805] mmc0: new HS200 MMC card at address 0001
[    1.099235] mmcblk0: mmc0:0001 004GA0 3.69 GiB 
[    1.100385] debugfs: Directory '11220000.clock-controller:audio-controller' with parent 'mt2701-wm8960' already present!
[    1.104923] mmcblk0boot0: mmc0:0001 004GA0 partition 1 2.00 MiB
[    1.120643] wm8960 0-001a: ASoC: error at soc_component_write_no_lock on wm8960.0-001a: -6
[    1.121511] mmcblk0boot1: mmc0:0001 004GA0 partition 2 2.00 MiB
[    1.135059] wm8960 0-001a: ASoC: error at soc_component_write_no_lock on wm8960.0-001a: -6
[    1.143497] mmcblk0rpmb: mmc0:0001 004GA0 partition 3 512 KiB, chardev (248:0)
[    1.150789] wm8960 0-001a: ASoC: error at snd_soc_component_update_bits on wm8960.0-001a: -6
[    1.161862]  mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9
[    1.269610] wm8960 0-001a: ASoC: error at snd_soc_component_update_bits on wm8960.0-001a: -6
[    1.278246] wm8960 0-001a: ASoC: error at soc_component_write_no_lock on wm8960.0-001a: -6
[    1.286708] wm8960 0-001a: ASoC: error at snd_soc_component_update_bits on wm8960.0-001a: -6
[    1.296194] NET: Registered protocol family 10
[    1.301332] Segment Routing with IPv6
[    1.305036] NET: Registered protocol family 17
[    1.309530] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.322493] 8021q: 802.1Q VLAN Support v1.8
[    1.339526] mtk-pcie 1a143000.pcie: host bridge /pcie@1a143000 ranges:
[    1.346069] mtk-pcie 1a143000.pcie: Parsing ranges property...
[    1.351925] mtk-pcie 1a143000.pcie:      MEM 0x0020000000..0x0027ffffff -> 0x0020000000
[    1.386558] mtk-pcie 1a143000.pcie: PCI host bridge to bus 0000:00
[    1.392761] pci_bus 0000:00: root bus resource [bus 00-ff]
[    1.398241] pci_bus 0000:00: root bus resource [mem 0x20000000-0x27ffffff]
[    1.405123] pci_bus 0000:00: scanning bus
[    1.409171] pci 0000:00:00.0: [14c3:3258] type 01 class 0x060400
[    1.415216] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x1ffffffff 64bit pref]
[    1.424135] pci_bus 0000:00: fixups for bus
[    1.428317] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 0
[    1.435034] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.443050] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 1
[    1.449851] pci_bus 0000:01: scanning bus
[    1.454067] pci 0000:01:00.0: [14c3:7915] type 00 class 0x000280
[    1.460255] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
[    1.467575] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
[    1.474901] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
[    1.482863] pci 0000:01:00.0: supports D1 D2
[    1.487125] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    1.493766] pci 0000:01:00.0: PME# disabled
[    1.498248] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    1.540766] pci_bus 0000:01: fixups for bus
[    1.544944] pci_bus 0000:01: bus scan returning with max=01
[    1.550520] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    1.557130] pci_bus 0000:00: bus scan returning with max=01
[    1.562715] pci 0000:00:00.0: BAR 0: no space for [mem size 0x200000000 64bit pref]
[    1.570369] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x200000000 64bit pref]
[    1.578365] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[    1.585154] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
[    1.592979] pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
[    1.600807] pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
[    1.608624] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.613591] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
[    1.620459] pcieport 0000:00:00.0: of_irq_parse_pci: failed with rc=-22
[    1.627065] pcieport 0000:00:00.0: assign IRQ: got 0
[    1.632039] pcieport 0000:00:00.0: enabling device (0000 -> 0002)
[    1.638144] pcieport 0000:00:00.0: enabling bus mastering
[    1.644070] mtk-pcie 1a145000.pcie: host bridge /pcie@1a145000 ranges:
[    1.650610] mtk-pcie 1a145000.pcie: Parsing ranges property...
[    1.656441] mtk-pcie 1a145000.pcie:      MEM 0x0028000000..0x002fffffff -> 0x0028000000
[    1.690922] mtk-pcie 1a145000.pcie: PCI host bridge to bus 0001:00
[    1.697099] pci_bus 0001:00: root bus resource [bus 00-ff]
[    1.702594] pci_bus 0001:00: root bus resource [mem 0x28000000-0x2fffffff]
[    1.709466] pci_bus 0001:00: scanning bus
[    1.713635] pci 0001:00:01.0: [14c3:3258] type 01 class 0x060400
[    1.719670] pci 0001:00:01.0: reg 0x10: [mem 0x00000000-0x1ffffffff 64bit pref]
[    1.728476] pci_bus 0001:00: fixups for bus
[    1.732669] pci 0001:00:01.0: scanning [bus 00-00] behind bridge, pass 0
[    1.739363] pci 0001:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.747374] pci 0001:00:01.0: scanning [bus 00-00] behind bridge, pass 1
[    1.754182] pci_bus 0001:01: scanning bus
[    1.758396] pci 0001:01:00.0: [14c3:7915] type 00 class 0x000280
[    1.764581] pci 0001:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
[    1.771905] pci 0001:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
[    1.779226] pci 0001:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
[    1.787184] pci 0001:01:00.0: supports D1 D2
[    1.791452] pci 0001:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    1.798083] pci 0001:01:00.0: PME# disabled
[    1.802569] pci 0001:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0001:00:01.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    1.840769] pci_bus 0001:01: fixups for bus
[    1.844948] pci_bus 0001:01: bus scan returning with max=01
[    1.850528] pci_bus 0001:01: busn_res: [bus 01-ff] end is updated to 01
[    1.857138] pci_bus 0001:00: bus scan returning with max=01
[    1.862726] pci 0001:00:01.0: BAR 0: no space for [mem size 0x200000000 64bit pref]
[    1.870380] pci 0001:00:01.0: BAR 0: failed to assign [mem size 0x200000000 64bit pref]
[    1.878377] pci 0001:00:01.0: BAR 8: assigned [mem 0x28000000-0x281fffff]
[    1.885166] pci 0001:01:00.0: BAR 0: assigned [mem 0x28000000-0x280fffff 64bit pref]
[    1.892990] pci 0001:01:00.0: BAR 2: assigned [mem 0x28100000-0x28103fff 64bit pref]
[    1.900817] pci 0001:01:00.0: BAR 4: assigned [mem 0x28104000-0x28104fff 64bit pref]
[    1.908635] pci 0001:00:01.0: PCI bridge to [bus 01]
[    1.913603] pci 0001:00:01.0:   bridge window [mem 0x28000000-0x281fffff]
[    1.920468] pcieport 0001:00:01.0: of_irq_parse_pci: failed with rc=-22
[    1.927075] pcieport 0001:00:01.0: assign IRQ: got 0
[    1.932049] pcieport 0001:00:01.0: enabling device (0000 -> 0002)
[    1.938153] pcieport 0001:00:01.0: enabling bus mastering
[    1.944041] mtk_hsdma 1b007000.dma-controller: Using 3 as missing dma-requests property
[    1.952279] mtk_hsdma 1b007000.dma-controller: MediaTek HSDMA driver registered
[    1.960522] xhci-mtk 1a0c0000.usb: xHCI Host Controller
[    1.965757] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 1
[    1.974823] xhci-mtk 1a0c0000.usb: hcc params 0x01403198 hci version 0x96 quirks 0x0000000000210010
[    1.983915] xhci-mtk 1a0c0000.usb: irq 28, io mem 0x1a0c0000
[    1.990110] hub 1-0:1.0: USB hub found
[    1.993872] hub 1-0:1.0: 2 ports detected
[    1.998102] xhci-mtk 1a0c0000.usb: xHCI Host Controller
[    2.003339] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 2
[    2.010754] xhci-mtk 1a0c0000.usb: Host supports USB 3.0 SuperSpeed
[    2.017047] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    2.025468] hub 2-0:1.0: USB hub found
[    2.029226] hub 2-0:1.0: 1 port detected
[    2.034014] of_cfs_init
[    2.036526] of_cfs_init: OK
[    2.039990] ALSA device list:
[    2.042952]   #0: mt2701-wm8960
[    2.047745] Freeing unused kernel memory: 768K
[    2.079445] Run /init as init process
[    2.083102]   with arguments:
[    2.086060]     /init
[    2.088324]   with environment:
[    2.091467]     HOME=/
[    2.093818]     TERM=linux
[    2.096515]     imageid=2
[    2.099127]     flashdev=/dev/mmcblk0
[    2.102795]     engnum=405
Booting engnum 405
CP437: No error information
fsck.fat 4.1 (2017-01-24)
/dev/mmcblk0p8: 29 files, 5760/130812 clusters
e2fsck 1.45.6 (20-Mar-2020)
/dev/mmcblk0p9: clean, 235/202800 files, 54137/809979 blocks
[    2.248767] EXT4-fs (mmcblk0p9): mounted filesystem with ordered data mode. Opts: (null)
[    2.562480] init: Console is alive
[    2.565964] init: - watchdog -
[    3.229210] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.263042] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.274902] init: - preinit -
Cannot find device "eth0"
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
rm: can't remove '/tmp/tmp.kImapn': No such file or directory
[    5.629278] Starting lvm2 during preinit
File descriptor 3 (/dev/watchdog) leaked on lvm invocation. Parent PID 880: /bin/sh
[    6.040975] device-mapper: ioctl: 4.43.0-ioctl (2020-10-01) initialised: dm-devel@redhat.com
File descriptor 3 (/dev/watchdog) leaked on lvm invocation. Parent PID 880: /bin/sh
[    6.320677] overlayfs: "xino" feature enabled using 2 upper inode bits.
mount: can't fin[    6.355817] urandom-seed: Seed file not found (/etc/urandom.seed)
d /dev/pts in /etc/fstab
Found flashdev : flashdev=/dev/mmcblk0
Moving boot and FLASH mounts
[    6.530576] ============ Installing CDT overlay ===============
[    6.536537] /FLASH/overlay-cdt
[    6.539714] ===================================================
[    6.580730] ===================================================
[    6.602920] procd: - early -
[    6.605835] procd: - watchdog -
Failed to connect to ubus
sh: 1bbb: unknown operand
[    7.169352] procd: - watchdog -
[    7.193086] procd: - ubus -
[    7.250258] procd: - init -
Please press Enter to activate this console.
[    7.596823] urngd: v1.0.2 started.
[    7.963905] getmfginfo : check_partition() found /dev/mmcblk0p7
[    8.181076] mfginfo matches backup
[    8.184742] mfginfo read, engnum=405
[    8.371346] pstore: Using crash dump compression: deflate
[    8.377653] printk: console [ramoops-1] enabled
[    8.382971] pstore: Registered ramoops as persistent store backend
[    8.389157] ramoops: using 0x140000@0x45001000, ecc: 0
[    8.400074] bootdata: memory (0x1000@0x45000000), pubd 0xffffffc010fcd000
[    8.706680] SFP WAN dtb-overlay-fixup.sh SCRIPT_VERSION 1.1 : PDB_DTB_OVERLAYS [WAN_GPHY211_CU_SFP]
[    8.716322] dtb-overlay-fixup.sh : Applying overlay WAN_GPHY211_CU_SFP
[    8.778648] dtb-overlay-fixup.sh : SFP is unknown
[    8.783627] dtb-overlay-fixup.sh : WAN CU mode
[    8.811835] OF: overlay: WARNING: memory leak will occur if overlay removed, property: /sfp-wan/status
[    8.821253] OF: overlay: WARNING: memory leak will occur if overlay removed, property: /ethernet@1b100000/mdio-bus/switch@0/ports/port@5/phy-mode
[    8.834314] OF: overlay: WARNING: memory leak will occur if overlay removed, property: /ethernet@1b100000/mdio-bus/switch@0/ports/port@5/compatible
[    9.047005] polecat2-cal-fixup.sh: starting on 405
[    9.113589] pkginstall: found an extra ipk in /FLASH/cdt
[   10.185269] pkginstall: opkg install /FLASH/cdt/cdt-be-fibre_1.0.1-1_aarch64_cortex-a53.ipk succeeded
[   10.308045] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.346475] mtk_soc_eth 1b100000.ethernet: generated random MAC address 8a:ea:87:00:3a:ae
[   10.355207] mtk_soc_eth 1b100000.ethernet eth0: mediatek frame engine at 0xffffffc0113e0000, irq 34
[   10.365156] debugfs: Directory 'mtkreg' with parent '/' already present!
[   10.379243] NET: Registered protocol family 38
[   10.390886] NET: Registered protocol family 8
[   10.395256] NET: Registered protocol family 20
[   10.515301] RPC: Registered named UNIX socket transport module.
[   10.521302] RPC: Registered udp transport module.
[   10.526012] RPC: Registered tcp transport module.
[   10.535704] Maxlinear Ethernet GPY211B mt7530-0:05: Firmware Version: 0x8747 (release)
[   10.539421] RPC: Registered tcp NFSv4.1 backchannel transport module.
[   10.557809] mt7530 mdio-bus:00 lan4 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=142)
[   10.573355] tun: Universal TUN/TAP device driver, 1.6
[   10.579478] mt7530 mdio-bus:00 lan3 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=143)
[   10.595318] ipip: IPv4 and MPLS over IPv4 tunneling driver
[   10.600529] mt7530 mdio-bus:00 lan2 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=144)
[   10.615919] l2tp_core: L2TP core driver, V2.0
[   10.621706] l2tp_netlink: L2TP netlink interface
[   10.628274] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[   10.634484] mt7530 mdio-bus:00 lan1 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=145)
[   10.646237] gre: GRE over IPv4 demultiplexor driver
[   10.653285] ip_gre: GRE over IPv4 tunneling driver
[   10.655080] mt7530 mdio-bus:00 wan (uninitialized): PHY [mt7530-0:05] driver [Maxlinear Ethernet GPY211B] (irq=POLL)
[   10.668957] ip6_gre: GRE over IPv6 tunneling driver
[   10.671175] mt7530 mdio-bus:00: configuring for fixed/2500base-x link mode
[   10.681010] DSA: tree 0 setup
[   10.681150] mt7530 mdio-bus:00: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   10.759428] PPP generic driver version 2.4.2
[   10.813541] hid: raw HID events driver (C) Jiri Kosina
[   10.820294] GACT probability on
[   10.824656] Mirror/redirect action on
[   10.838203] u32 classifier
[   10.841232]     input device check on
[   10.844900]     Actions configured
[   10.871308] Simple TC action Loaded
[   10.892598] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[   10.897921] Bluetooth: BNEP filters: protocol multicast
[   10.903384] Bluetooth: BNEP socket layer initialized
[   10.909580] Bridge firewalling registered
[   10.916792] [btmtk_warn] main_driver_init, BTMTK uart version: 7.0.20120401
[   10.923818] [btmtk_warn] uart_register Done
[   10.931673] usbcore: registered new interface driver btusb
[   10.938572] usbcore: registered new interface driver cdc_wdm
[   10.946999] Loading modules backported from Linux version v5.15.33-0-g06f50ca83ace
[   10.954630] Backport generated by backports.git v5.15.33-1-0-g183c4ab2
[   10.985731] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[   10.991726] Bluetooth: HIDP socket layer initialized
[   10.998029] hso: drivers/net/usb/hso.c: Option Wireless
[   11.003640] usbcore: registered new interface driver hso
[   11.014587] usbcore: registered new interface driver ipheth
[   11.024912] usbcore: registered new interface driver kaweth
[   11.067538] pegasus: v0.9.3 (2013/04/25), Pegasus/Pegasus II USB Ethernet driver
[   11.075330] usbcore: registered new interface driver pegasus
[   11.083935] PPP MPPE Compression module registered
[   11.090517] NET: Registered protocol family 24
[   11.096956] PPTP driver version 0.8.5
[   11.104396] usbcore: registered new interface driver r8152
[   11.112682] Bluetooth: RFCOMM TTY layer initialized
[   11.117606] Bluetooth: RFCOMM socket layer initialized
[   11.122812] Bluetooth: RFCOMM ver 1.11
[   11.128542] usbcore: registered new interface driver rtl8150
[   11.146568] usbcore: registered new interface driver usbserial_generic
[   11.153283] usbserial: USB Serial support registered for generic
[   11.198188] xt_time: kernel timezone is -0000
[   11.204257] usbcore: registered new interface driver aqc111
[   11.212739] usbcore: registered new interface driver asix
[   11.220567] usbcore: registered new interface driver ax88179_178a
[   11.228266] usbcore: registered new interface driver cdc_eem
[   11.236327] usbcore: registered new interface driver cdc_ether
[   11.245269] usbcore: registered new interface driver cdc_ncm
[   11.252339] usbcore: registered new interface driver cdc_subset
[   11.338980] usbcore: registered new interface driver dm9601
[   11.348201] usbcore: registered new interface driver huawei_cdc_ncm
[   11.357411] usbcore: registered new interface driver kalmia
[   11.365269] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[   11.432168] usbcore: registered new interface driver MOSCHIP usb-ethernet driver
[   11.482256] mt7915e 0000:01:00.0: assign IRQ: got 146
[   11.487448] pci 0000:00:00.0: enabling bus mastering
[   11.492506] mt7915e 0000:01:00.0: enabling device (0000 -> 0002)
[   11.498682] mt7915e 0000:01:00.0: enabling bus mastering
[   11.504205] mt7915e 0000:01:00.0: ASIC revision: 79150094
[   11.629778] mt7915e 0000:01:00.0: mt7915_init_hardware: rdd_antenna = 0
[   11.678068] mt7915e 0000:01:00.0: HW/SW Version: 0x8a108a10, Build Time: 20211222184017a
[   11.678068] 
[   11.784102] mt7915e 0000:01:00.0: WM Firmware Version: ____000000, Build Time: 20211222184052
[   11.832722] mt7915e 0000:01:00.0: WA Firmware Version: DEV_000000, Build Time: 20211222184111
[   11.988442] mt7915e 0000:01:00.0: read efuse data size=3584, caching to OTP
[   11.999528] mt7915e 0001:01:00.0: assign IRQ: got 148
[   12.004646] pci 0001:00:01.0: enabling bus mastering
[   12.009651] mt7915e 0001:01:00.0: enabling device (0000 -> 0002)
[   12.015731] mt7915e 0001:01:00.0: enabling bus mastering
[   12.021143] mt7915e 0001:01:00.0: ASIC revision: 79150094
[   12.139775] mt7915e 0001:01:00.0: mt7915_init_hardware: rdd_antenna = 0
[   12.159864] mt7915e 0001:01:00.0: HW/SW Version: 0x8a108a10, Build Time: 20211222184017a
[   12.159864] 
[   12.178523] mt7915e 0001:01:00.0: WM Firmware Version: ____000000, Build Time: 20211222184052
[   12.201496] mt7915e 0001:01:00.0: WA Firmware Version: DEV_000000, Build Time: 20211222184111
[   12.353830] mt7915e 0001:01:00.0: read efuse data size=3584, caching to OTP
[   12.366648] usbcore: registered new interface driver plusb
[   12.375688] usbcore: registered new interface driver qmi_wwan
[   12.383794] usbcore: registered new interface driver rndis_host
[   12.391283] usbcore: registered new interface driver sierra
[   12.397012] usbserial: USB Serial support registered for Sierra USB modem
[   12.405630] usbcore: registered new interface driver sierra_net
[   12.414472] usbcore: registered new interface driver smsc95xx
[   12.424225] usbcore: registered new interface driver sr9700
[   12.434414] usbcore: registered new interface driver cdc_mbim
[   12.441988] usbcore: registered new interface driver option
[   12.447722] usbserial: USB Serial support registered for GSM modem (1-port)
[   12.455268] kmodloader: done loading kernel modules from /etc/modules.d/*
[   14.772917] zzz-custom-config custom_defaults exist
[   15.545560] smartrg.net.create.devices starting
[   15.584918] mtk_soc_eth 1b100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   15.593333] mtk_soc_eth 1b100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   15.608845] smartrg.net.create.defaults done
[   19.159576] mtk_soc_eth 1b100000.ethernet eth0: Link is Down
[   19.169936] mtk_soc_eth 1b100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   19.178271] mtk_soc_eth 1b100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   19.187954] device eth0 entered promiscuous mode
[   19.193884] mt7530 mdio-bus:00 lan1: configuring for phy/gmii link mode
[   19.203786] 8021q: adding VLAN 0 to HW filter on device lan1
[   19.214095] mt7530 mdio-bus:00 lan2: configuring for phy/gmii link mode
[   19.221405] 8021q: adding VLAN 0 to HW filter on device lan2
[   19.234101] mt7530 mdio-bus:00 lan3: configuring for phy/gmii link mode
[   19.243829] 8021q: adding VLAN 0 to HW filter on device lan3
[   19.254077] mt7530 mdio-bus:00 lan4: configuring for phy/gmii link mode
[   19.263723] 8021q: adding VLAN 0 to HW filter on device lan4
[   20.212059] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready

OpenWrt login:
6

It's not ...

7

Any inspiration on how to get root or recovery mode? I will post logs of the restricted terminal in time.

8

I couldn't find anything about this device, but there is a 854v6 - is there a typo?

Try to get the GPL drop from the manufacturer. There might be additional clues on how to achieve that.

9

It is a typo, thanks I have corrected it.

I don't think I'll bother emailing manufacturer for their gpl portions because I've done it in the past and it's been fruitless, you just end up with a broken or vanilla linux kernel with all the proprietry firmware blobs removed.

I think I will extract the firmware from the 16pin chip by removal, the gizmos to do that are very cheap now, I need to check it is comparible tonight before I order the tool.

I will see about adding photos and the boot logs to the hardware wiki when I get chance.

1 Like
10

start with the photos, if it's the "wrong" SoC, it wouldn't be supported.

11

SoC is MT7622AV
Ram is SKhynix H5TC4G83EFR
eMMc Kioxia THGBMNG5D1LBAIL 4Gb

Switch chip Is MT7531AE
Voltage / power regulator MT6380N

MXL SLWHC C950Y4

On the reverse side there is a Floating point, ADC chip Sharp 21479AE

I have tried the command line tools to feed it an openwrt image via TFTP but it has a signature verification that fails, I am going to try my hand at removing the eMMC (BGA 153) and reading it from an adaptor. I will post back with updates if succesfull. Probably won't be untill next weekend now.

12

I have a root shell now, I've had a good look around. I'm just struggling with dumping the firmware as no usb devices show in /dev or under lsblk

But usb drive does show under lsusb, something to do with udev and CONFIG_DEVTMPFS=y ?

Idk I've ran out of time this weekend but I came accross a post refencing /dev/bus/usb or /sys/bus/usb I'll have a look later in the week. https://stackoverflow.com/questions/35270200/dev-bus-usb-not-created-found

It is fun getting into these things but very time consuming and does not have great "wife approval factor"