Hi guys,
I'm working on customizing the firmware of my MitraStar GPT-2742GX4X5V6 WiFi 6 router.
I successfully unpacked the firmware, made modifications to the SquashFS root, and repacked it using:
mksquashfs squashfs-root/ filesystem.sqsh -comp lzma -b 131072 -all-root -noappend
I also updated the FIT image and all checksums — everything passes and the device boots normally up to the point where the kernel finishes loading.
However, during boot, it gets stuck at this message:
Freeing unused kernel memory: 244K
busybox init and set aff
At this point, it seems like /sbin/init is being executed, but no script output appears after that. I believe the issue is related to the rcS script not executing properly or being redirected incorrectly.
I already checked:
initis a symlink tobusybox/etc/inittabpoints to/usr/etc/init.d/rcSrcSstarts with:
exec > /dev/console 2>&1
set -x
echo "[rcS] starting"
But the echo does not show in UART output.
Has anyone experienced this kind of issue before? Could the problem be with the redirection or the environment not being ready when rcS starts?
Any help or ideas would be greatly appreciated!
Thanks in advance.
my log uart:
EN7523DRAMC V0.4
dram_type = 5, speed = 1866
Final Impdance Cal Result: OCDP:0x1b, OCDN:0x1e, ODTP:0x6, ODTN:0x6
DDR1866 PLL setting init
[Dramc] PCDDR3 AC Timing update
Fire MRW command...
ModeReg.2, value.0x20 done
Fire MRW command...
ModeReg.3, value.0x0 done
Fire MRW command...
ModeReg.1, value.0x6 done
Fire MRW command...
ModeReg.0, value.0x1114 done
Fire MRW command...
ModeReg.1, value.0x86 done
Fire MRW command...
ModeReg.1, value.0x6 done
Calculate size.
DRAM size=512MB
[atf/uboot] calc_bmt_pool_size, goodPercent:0, total:2048, needValid:81, maxBmtC nt:128, poolSize:81
[atf] init_bmt, totalCnt:2048, sysCnt:1967, bmtCnt:81
[atf] start_init_bbt, sysBlock:1967, bmtBlock:81, load:1967
U-Boot 2014.04-rc1-svn23638 (Nov 14 2023 - 16:15:05)
DRAM: 496 MiB
GET_PACKAGE_ID=1
EN7529DT
Now running in RAM - U-Boot at: 9ee00000
spi_nand_probe: mfr_id=0xef, dev_id=0xaa
Using Flash ECC.
Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_W25N02KV, Flash Size=0x10000000
bmt pool size: 81
bmt found at block: 2047, mapped block: 0
BMT v1.
total 0 mapping
bbt found, bad block count: 0
BMT & BBT Init Success
In: serial
Out: serial
Err: serial
CPU0: found redistributor 0 region 0:9ee3d308
Net: ecnt_eth
Uip activated
Not found TC Phy
Not found TC Phy
Not found TC Phy
Not found TC Phy
Ignore RTL8221B init
read: src=0x50000, len=0x20000, dst=0x81800000
bootm flag=0, states=70f
## Booting kernel from Legacy Image at 81800000 ...
Image Name: zld-2.0 11/14/2023 16:15:00
Image Type: ARM U-Boot Standalone Program (lzma compressed)
Data Size: 16056 Bytes = 15.7 KiB
Load Address: 81700000
Entry Point: 81700000
Verifying Checksum ... OK
Uncompressing Standalone Program ... OK
ZYXEL zloader v1.4.8 (11/14/2023 - 16:15:00)
!!! Initialize nand !!!
tclinux_main->imageSequence= 1000001
tclinux_slave->imageSequence= 1000002
Multiboot clinent version: 4.0
Not support LED number 0 on this board!
Hit any key to stop autoboot: 0
Not support LED number 0 on this board!
TRX 1 : 0x174
TRX 2 : 0x174
tclinux_main->imageSequence= 1000001
tclinux_slave->imageSequence= 1000002
## Checking hash(es) for FIT Image at 81800274 ...
Hash(es) for Image 0 (fdt@1): sha1+
Hash(es) for Image 1 (kernel@1): sha1+
Hash(es) for Image 2 (filesystem@1): sha1+
bootflag==1 --> booting from second image
Reading kernel...
bootm flag=0, states=70f
## Loading kernel from FIT Image at 81800000 ...
Using 'conf@1' configuration
Trying 'kernel@1' kernel subimage
Description: ECONET Linux kernel
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x818020d4
Data Size: 4712453 Bytes = 4.5 MiB
Architecture: ARM
OS: Linux
Load Address: 0x80088000
Entry Point: 0x80088000
Hash algo: sha1
Hash value: 62c069d7c5fa7ec294c1d590edf14f5383b22cd0
Verifying Hash Integrity ... sha1+ OK
## Loading fdt from FIT Image at 81800000 ...
Using 'conf@1' configuration
Trying 'fdt@1' fdt subimage
Description: ECONET Flattened Device Tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x818000fc
Data Size: 7961 Bytes = 7.8 KiB
Architecture: ARM
Hash algo: sha1
Hash value: e853dfd851b028a69095fb22f8a9fccd57cbc163
Verifying Hash Integrity ... sha1+ OK
Booting using the fdt blob at 0x818000fc
Uncompressing Kernel Image ... OK
Loading Device Tree to 9cdf3000, end 9cdf7f18 ... OK
Starting kernel ...
Booting Linux on physical CPU 0x0
Initializing cgroup subsys cpuset
Initializing cgroup subsys cpu
Initializing cgroup subsys cpuacct
Linux version 4.4.115 (major@twpcmt01389-102) (gcc version 4.9.3 (Buildroot 2015 .08.1-gd814875) ) #1 SMP Wed Jun 21 17:20:09 CST 2023
CPU: ARMv7 Processor [410fd034] revision 4 (ARMv7), cr=10c5383d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine model: econet,en7523
bootconsole [uart0] enabled
Memory policy: Data cache writealloc
psci: probing for conduit method from DT.
psci: PSCIv1.1 detected in firmware.
psci: Using standard PSCI v0.2 function IDs
psci: MIGRATE_INFO_TYPE not supported.
[npu_wifi_offload_set_pkt_buf_addr]npu_pkt_buf_addr=9ddf1f40:9ddf1f40
npu_pkt_buffer memblock_alloc:9ddf1f40,buf_size=1600000
PERCPU: Embedded 11 pages/cpu @dddd9000 s14144 r8192 d22720 u45056
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 129728
Kernel command line: sdram_conf=0x00108893 product_name=GPT-2742GX4X5v6 ethaddr= 00:AA:BB:01:23:40 snmp_sysobjid=1.2.3.4.5 country_code=ff ether_gpio=0c power_gp io=1515 username=telecomadmin password=nE7jA%5m dsl_gpio=0b internet_gpio=02 mul ti_upgrade_gpio=0b020400000000000000000000000000 onu_type=2 qdma_init=33 root=/d ev/mtdblock6 ro console=ttyS0,115200n8 earlycon bootflag=1 serdes_sel=0 tclinux_ info=0x1f4188f,0x20d4,0x48110a,0x4832d8,0x1abe275,0x1c76fcb,0x20d4,0x47e805,0x48 09d4,0x17f62b7
PID hash table entries: 2048 (order: 1, 8192 bytes)
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 472164K/523008K available (8305K kernel code, 4011K rwdata, 2248K rodata , 244K init, 638K bss, 50844K reserved, 0K cma-reserved, 0K highmem)
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xffc00000 - 0xfff00000 (3072 kB)
vmalloc : 0xe0800000 - 0xff800000 ( 496 MB)
lowmem : 0xc0000000 - 0xe0000000 ( 512 MB)
pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)
modules : 0xbf000000 - 0xbfe00000 ( 14 MB)
.text : 0xc0088000 - 0xc0ad66e8 (10554 kB)
.init : 0xc0ad7000 - 0xc0b14000 ( 244 kB)
.data : 0xc0b14000 - 0xc0efedc0 (4012 kB)
.bss : 0xc0f01000 - 0xc0fa0a64 ( 639 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
Hierarchical RCU implementation.
Build-time adjustment of leaf fanout to 32.
NR_IRQS:64 nr_irqs:64 64
CPU0: found redistributor 0 region 0:0x09080000
Architected cp15 timer(s) running at 25.00MHz (virt).
clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x5c40939b5, m ax_idle_ns: 440795202646 ns
sched_clock: 56 bits at 25MHz, resolution 40ns, wraps every 4398046511100ns
Switching to timer-based delay loop, resolution 40ns
console [ttyS0] enabled
console [ttyS0] enabled
bootconsole [uart0] disabled
bootconsole [uart0] disabled
Calibrating delay loop (skipped), value calculated using timer frequency.. 50.00 BogoMIPS (lpj=250000)
pid_max: default: 32768 minimum: 301
Security Framework initialized
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
Initializing cgroup subsys devices
Initializing cgroup subsys freezer
Initializing cgroup subsys debug
CPU: Testing write buffer coherency: ok
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x80088280 - 0x800882d8
CPU1: found redistributor 1 region 0:0x090a0000
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
Brought up 2 CPUs
SMP: Total of 2 processors activated (100.00 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911 2604462750000 ns
futex hash table entries: 512 (order: 3, 32768 bytes)
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
hw-breakpoint: maximum watchpoint size is 8 bytes.
l2c_sram_size:0x0
Initializing Ecnt Event Netlink Socket
Initializing Econet Event Netlink Socket nl_sk = dd4a7400
ecnt-hsdma 1fa01800.dma-controller: Econet HSDMA driver registered
NET: Registered protocol family 8
NET: Registered protocol family 20
clocksource: Switched to clocksource arch_sys_counter
NET: Registered protocol family 2
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
hw perfevents: enabled with armv7_cortex_a15 PMU driver, 7 counters available
sgmii probe init start
sgmii:int_name: sgmii_pcie0
sgmii:int_id: 0
sgmii:int_register: inin!
sgmii:sgmii->pcs1_base= e0878100
sgmii:sgmii->pcs2_base= e087aa00
sgmii:sgmii->an_base= e087c000
sgmii:sgmii->ra_base= e087e600
sgmii:sgmii->phya_base= e0944c00
sgmii:int_register: exit!
sgmii: int_init called
sgmii:cmd_wo:reg_t=e087aa20, val=0
sgmii: sync_int exit
sgmii probe init exit
sgmii probe init start
sgmii:int_name: sgmii_pcie1
sgmii:int_id: 1
sgmii:int_register: inin!
sgmii:sgmii->pcs1_base= e0946100
sgmii:sgmii->pcs2_base= e0948a00
sgmii:sgmii->an_base= e094a000
sgmii:sgmii->ra_base= e094c600
sgmii:sgmii->phya_base= e094ec00
sgmii:int_register: exit!
sgmii: int_init called
sgmii:cmd_wo:reg_t=e0948a20, val=0
sgmii: sync_int exit
sgmii probe init exit
sgmii probe init start
sgmii:int_name: sgmii_usb0
sgmii:int_id: 2
sgmii:int_register: inin!
sgmii:sgmii->pcs1_base= e0950100
sgmii:sgmii->pcs2_base= e0952a00
sgmii:sgmii->an_base= e0954000
sgmii:sgmii->ra_base= e0956600
sgmii:sgmii->phya_base= e0958c00
sgmii:int_register: exit!
sgmii: int_init called
sgmii:cmd_wo:reg_t=e0952a20, val=0
sgmii: sync_int exit
sgmii probe init exit
TC3162 hardware watchdog module loaded.
irq-0: 109 irq-1: 110 [i2c] ecnt_i2c_drv_probe
[crypto_k] res->name:/crypto_k@1fb70000
[crypto_k] res->start:0x1fb70000 ===
[crypto_k] res->end:0x1fb70803 ===
[crypto_k] ecnt_crypto_k->base:0xe09ce000
[trng] ecnt_trng_drv_probe
test_uc:e0826000 test_c:dd4c0000 cpu_top->base:e09dc800
[apb_timer] ecnt_timer_drv_probe
[timer] ecnt_timer->irq: 80
[timer] res->name:/apb_timer1@1fbf0100
i2c_slave init(ecnt_i2c_slave_drv_probe) done
[i2s] ecnt_i2s_drv_probe
7523 Thermal Sensor address probe done
iddq = 45
[thermal] thermal_phy->irq: 119
squashfs: version 4.0 (2009/01/31) Phillip Lougher
ntfs: driver 2.1.32 [Flags: R/W DEBUG].
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
io scheduler noop registered (default)
PCIe driver version: 7523.0.20210201
PCIe ref clk init.
===EN7523 PCIe init
mtk-pcie 1fa91000.pcie: pcie rc 0 linkup success
mtk-pcie 1fa91000.pcie: pcie rc 1 linkup success
===============PCIe check===tmp_reg=========81014c3===========
mtk-pcie 1fa91000.pcie: PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
pci_bus 0000:00: root bus resource [bus 00-ff]
PCI: bus0: Fast back to back transfers disabled
pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
PCI: bus1: Fast back to back transfers disabled
PCI: bus2: Fast back to back transfers disabled
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
pci 0000:00:01.0: BAR 8: assigned [mem 0x20200000-0x203fffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
pci 0000:00:00.0: PCI bridge to [bus 01]
pci 0000:00:00.0: bridge window [mem 0x20000000-0x201fffff]
pci 0000:02:00.0: BAR 0: assigned [mem 0x20200000-0x202fffff 64bit pref]
pci 0000:02:00.0: BAR 2: assigned [mem 0x20300000-0x20303fff 64bit pref]
pci 0000:02:00.0: BAR 4: assigned [mem 0x20304000-0x20304fff 64bit pref]
pci 0000:00:01.0: PCI bridge to [bus 02]
pci 0000:00:01.0: bridge window [mem 0x20200000-0x203fffff]
mt7512_pcie_fixup: 0x1438 = 20000015
mt7512_pcie_rc0_retrain: 80 = 0145dc12 80 = 01608c12
RC0 Link Traing Result: 10120008
===========RC0 set conf space INTx=============
mt7512_pcie_fixup: 0x2438 = 20200015
mt7512_pcie_rc1_retrain: 80 = 0145dc12 80 = 01608c12
RC1 Link Traing Result: 10120008
===========RC1 set conf space INTx=============
ttyS0 at I/O 0xbfbf0000 (irq = 95, base_baud = 7200) is a TC3162
ECNT ring buffer init success
brd: module loaded
SPI Flash Init Start
Found no SPI flash device
IS_SPIFLASH=0x0, IS_NANDFLASH=0x1, (0xBFA10114)=0x6)
Set SPI Clock to 50 Mhz
spi_nand_probe: mfr_id=0xef, dev_id=0xaa
Using Flash ECC.
Detected SPI NAND Flash : _SPI_NAND_DEVICE_ID_W25N02KV, Flash Size=0x10000000
spi nand flash
tc3162: flash device 0x02000000 at 0x00000000
EN7512 mtd init: spi nand probe enter
[spi_nand_setup] : Enter
nand: device found, Manufacturer ID: 0xef, Chip ID: 0xaa
nand: Unknown _SPI_NAND_DEVICE_ID_W25N02KV
nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
nand_scan_ident ok
[spi_nand_setup]: chip size = 0x10000000, erase_shift=0x11
bmt pool size: 81
BMT & BBT Init Success
parsing <0[bootloader],256k[romfile],92160k[tclinux],92160k[tclinux_slave],256k[ second_romfile],13312k[data],42496k[app],2304k[reservearea_backup]>
partition 11: name <reservearea_backup>, offset ffffffff, size 240000, mask flag s 0
partition 10: name <app>, offset ffffffff, size 2980000, mask flags 0
partition 9: name <data>, offset ffffffff, size d00000, mask flags 0
partition 8: name <second_romfile>, offset ffffffff, size 40000, mask flags 0
partition 7: name <tclinux_slave>, offset ffffffff, size 5a00000, mask flags 0
partition 4: name <tclinux>, offset ffffffff, size 5a00000, mask flags 0
partition 1: name <romfile>, offset ffffffff, size 40000, mask flags 0
partition 0: name <bootloader>, offset ffffffff, size fffffffe, mask flags 0
Creating 13 MTD partitions on "EN7512-SPI_NAND":
0x000000000000-0x000000080000 : "bootloader"
0x000000080000-0x0000000c0000 : "romfile"
0x0000000c0000-0x000000543452 : "kernel"
mtd: partition "kernel" doesn't end on an erase block -- force read-only
0x00000054354c-0x00000200354c : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-o nly
0x0000000c0000-0x000005ac0000 : "tclinux"
0x000005ac0000-0x000005f40b4d : "kernel_slave"
mtd: partition "kernel_slave" doesn't end on an erase block -- force read-only
0x000005f40c48-0x000007740c48 : "rootfs_slave"
mtd: partition "rootfs_slave" doesn't start on an erase block boundary -- force read-only
0x000005ac0000-0x00000b4c0000 : "tclinux_slave"
0x00000b4c0000-0x00000b500000 : "second_romfile"
0x00000b500000-0x00000c200000 : "data"
0x00000c200000-0x00000eb80000 : "app"
0x00000eb80000-0x00000edc0000 : "reservearea_backup"
0x00000edc0000-0x00000f000000 : "reservearea"
rootfs_slave
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
NET: Registered protocol family 24
register rtpci
mt7915_ap.ko zyWlan_evt_init: create socket successfully
pci 0000:00:00.0: enabling device (0140 -> 0142)
rtpci 0000:01:00.0: enabling device (0140 -> 0142)
pdev=dd61a000,phy_add= 20000000
=== pAd = e3201000, size = 13604224 ===
<-- RTMPAllocAdapterBlock, Status=0
PCI CSRBaseAddress =0xe3100000, csr_addr=0xe3100000!
RTMPInitPCIeDevice():device_id=0x7915
mt7915_init()-->
Use 1st iPAiLNA default bin.
<--mt7915_init()
mt7915_ap.ko zyWlan_evt_init: create socket successfully
wdev_init(caller:RTMP_COM_IoctlHandle+0x1134/0x1a60), wdev(0)
!!HIF_RX_EVENT Only
!!HIF_RX_EVENT Only
!!HIF_RX_EVENT Only
!!HIF_RX_EVENT Only
<-- pci_alloc_tx_rx_ring_mem, Status=0
===> wf_reset_init()
pci 0000:00:01.0: enabling device (0140 -> 0142)
rtpci 0000:02:00.0: enabling device (0140 -> 0142)
pdev=dd61a800,phy_add= 20200000
=== pAd = e4001000, size = 13604224 ===
<-- RTMPAllocAdapterBlock, Status=0
PCI CSRBaseAddress =0xe3f00000, csr_addr=0xe3f00000!
RTMPInitPCIeDevice():device_id=0x7915
mt7915_init()-->
Use 2nd iPAiLNA default bin.
<--mt7915_init()
mt7915_ap.ko zyWlan_evt_init: create socket successfully
wdev_init(caller:RTMP_COM_IoctlHandle+0x1134/0x1a60), wdev(0)
!!HIF_RX_EVENT Only
!!HIF_RX_EVENT Only
!!HIF_RX_EVENT Only
!!HIF_RX_EVENT Only
<-- pci_alloc_tx_rx_ring_mem, Status=0
===> wf_reset_init()
hidraw: raw HID events driver (C) Jiri Kosina
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (7377 buckets, 29508 max)
ctnetlink v0.93: registering with nfnetlink.
nf_conntrack_rtsp v0.7 loading
nf_conntrack_rtcp v0.7 loading
port #0: 8027
nf_nat_rtsp v0.7 loading
nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>
nf_tables_compat: (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
xt_time: kernel timezone is -0000
IPv4 over IPsec tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully
Initializing XFRM netlink socket
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
sit: IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update you r scripts to load br_netfilter if you need this.
Ebtables v2.0 registered
8021q: 802.1Q VLAN Support v1.8
lib80211: common routines for IEEE802.11 drivers
Registering SWP/SWPB emulation handler
tc3162ser_startup
VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
Freeing unused kernel memory: 244K
busybox init and set aff