Installing on Devolo Wifi Repeater AC (probably identical to Edimax EW-7476RPC)

Hello,

I somehow managed to flash 21.02 rc1/2 to a Devolo Wifi Repeater AC, probably identical to EW-7476RPC). But I cannot make it boot automatically.

U-Boot insists in loading a kernel from 0xbc050000, the cimage partition. After installation of OpenWrt, this partion is truncated to 0x20000, the firmware partion, which contains kernel and rootfs, starts at 0xbc070000. So, booting from 0xbc050000 fails as expected. Manually booting the installed kernel using

bootm 0xbc070014

works fine and boots up the system successfully. For some reason, alternatively to manually booting from the U-Boot shell, I can also enter "5" to interrupt the boot process (probably just some invalid selection) to have U-Boot execute the "bootcmd" I have set, which is ignored otherwise ...

Booting from 0xbc070000 fails as well, U-Boot will complain of an invalid magic, which corresponds to the ASCII values of "CSYS".

I am stuck.

Does this sound familar to anybody?

Kind regards,

Mali

Is the bootcmd not set/saved or is it reset?

It is saved ... this is the output of printenv at the U-Boot console:

MT7620 # printenv
baudrate=57600
ethaddr="B8:BE:F4:3D:D1:18"
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
u-boot=u-boot.bin
load=tftp 8A100000 $(u-boot)
u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
loadfs=tftp 8A100000 root.cramfs
u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
test_tftp=tftp 8A100000 root.cramfs;run test_tftp
ethact=Eth0 (10/100-M)
language_code=uk
hw_id=0116001f
domain=1
pincode=42519409
wlanaddr=00:aa:bb:cc:dd:10
kver=1.0.5
sn=5052800502
usboot=0
dom2=2
wanaddr=00:aa:bb:cc:dd:20
bootdelay=2
bver=4.0.1.6
op_mode=0
filesize=3dd000
fileaddr=80A00000
bootfile=uImage_DEVOLO-7476DRC-v005
ipaddr=192.168.9.165
bootcmd=bootm 0xbc070014
kernel_addr=BC070014
loadaddr=BC070014
autostart=no
serverip=192.168.9.137
stdin=serial
stdout=serial
stderr=serial

Environment size: 1081/4092 bytes
MT7620 #

As explained, it does not execute my "bootcmd" when I let is start without interruption, but tries to load from 0xbc050000 ... the beginning of the cimage partition, an address however, I do not find in the U-Boot environment ...

U-Boot 1.1.3 (Apr 24 2015 - 18:11:06)

Board: Ralink APSoC DRAM:  64 MB
gpiomode===>1a301c
after:gpiomode===>1a341c
Ralink UBoot ver: 4.0.1.0
ELX UBoot ver: 1.0.0 (Apr 24 2015 18:11:06)
Date:Apr 24 2015  Time:18:11:06
CPU: 580 MHz, MEM: 64 MB
Reset Phy by gpio 39

Please choose the operation: 1, 2, 3, 4, 9                                    0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1459090 Bytes =  1.4 MB
   Load Address: 80000000
   Entry Point:  802593c0
   Verifying Checksum ... Bad Data CRC
Enter edimax Recovery Mode

.......Start http..............

However, if I enter "5" ... the bootloader chooses to execute my bootcmd:

U-Boot 1.1.3 (Apr 24 2015 - 18:11:06)

Board: Ralink APSoC DRAM:  64 MB
gpiomode===>1a301c
after:gpiomode===>1a341c
Ralink UBoot ver: 4.0.1.0
ELX UBoot ver: 1.0.0 (Apr 24 2015 18:11:06)
Date:Apr 24 2015  Time:18:11:06
CPU: 580 MHz, MEM: 64 MB
Reset Phy by gpio 39

Please choose the operation: 1, 2, 3, 4, 9

You choosed 5
                                                                              0


System Boot Linux via Flash.
## Booting image at bc070014 ...
   Image Name:   MIPS OpenWrt Linux-5.4.111
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1978112 Bytes =  1.9 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 5.4.111 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16046-59980f7aaf)) #0 Sun Apr 18 10:06:57 2021
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620A ver:2 eco:6

Where does it get the address of 0xbc050000 from? Why would it ignore my "bootcmd" when left alone? Why would it execute it when I enter "5" (which is not a valid selection)? Why do I need to add that offset of 0x14 (length of CSYS header)?

Too many questions :wink:

Mali

how did you manage to install openwrt?

Hello Yurkila,

to be honest: I do not remember in detail ... I have access to the serial console and to the boot loader console. I can interrupt the boot of the stock firmware, get an image over tftp and boot it:

setenv ipaddr 192.168.9.165
setenv serverip 192.168.9.137
setenv netmask 255.255.255.0
tftpboot 0x800000 openwrt-21.02.0-rc1-ramips-mt7620-edimax_ew-7476rpc-initramfs-kernel.bin
bootm 0x800000

I assume I transferred the sysupgrade image to /tmp and performed an installation using sysupgrade.

I am wondering whether it is possibe to have either the stock firmware or the "Edimax Recovery Mode" install an OpenWrt sysupgrade.bin file. However, Devolo seems to use a different file format that uses some "obfuscation" ...

Kind regards,

Mali

I have managed to load it, but I see that it loads everything in tmp, if there was some way to make it permanent it would be very good, I am investigating to see what can be done, I have managed to install luci, but of course, at the first reboot everything is deleted and it has started again zero.

Have you managed to enter the edimax recovery? I can't get in and I can't go back to the original firmware either.

Hi.
I have successfully flashed openwrt-23.05.0-ramips-mt7620-netgear_ex3700-squashfs-sysupgrade.bin to my Devolo Repeater AC.
I set up a tftp server and used a serial to usb adapter, following the schematics on https://openwrt.org/toh/edimax/ew-7476rpc.
I used screen to connect to the serial port (screen /dev/ttyUSB0 57600) and interrupted u-boot using option 2. I then defined both the device and tftp server addresses, and the image to load and flash.
Device rebooted and i was able to access openwrt throught the serial console.
A this point i had no ethernet connectivity and wifi was disabled by default. I edited /etc/config/wireless and enabled both SSIDs.
Having defined a static ip address on my laptop wifi connection (192.168.1.2/24) i was able to connect to the devices SSIDs and accessed LUCI web interface.
For the moment i don't have link on the device ethernet port, although i see both eth0 and br-lan with ifconfig.
I'll try to see what's happening with this later on as i have other matters in my hands ATM but i believe this is good news so far.
Of course i'll be grateful if anyone is able to figure out the problem in the meantime.
Cheers!

DISCLAIMER: I'm not responsible for any damage caused by the following procedure!
!!! I do not know how to turn back to stock firmware. You have been warned !!!

I've put a clone of the openwrt repository with a custom branch named devolo-acr.

To build the image, follow procedure similar to https://openwrt.org/docs/guide-developer/toolchain/use-buildsystem

git clone --branch devolo-acr https://github.com/hmmmonteiro/openwrt.git

cd openwrt

./scripts/feeds update -a
./scripts/feeds install -a

make menuconfig

Choose:
Target System > (MediaTek Ralink MIPS)
Subtarget > (MT7620 based boards)
Target Profile > (DEVOLO ACR)
and save .config

make -j$(nproc) defconfig download clean world

go have a couple beers. it'll take a while.

You'll end up with and openwrt-ramips-mt7620-devolo_acr-squashfs-sysupgrade.bin, in openwrt/bin/targets/ramips/mt7620/ folder

Flashing:
Check the pinout schematics for the Edimax EW-7476RPC. They're the same. (Only RX, TX and GND. No VCC!)

ew-7476rpc-pcb, same as Devolo AC Repeater

Connect to the device through serial (Putty? 57600 baud)

Connect the device to your computer using an ethernet cable and assign your pc static address 192.168.1.2/24

Power your Devolo

Interrupt u-boot with option 2

Enter 192.168.1.1 IP for the device
Enter 192.168.1.2 for the PC
Enter the openwrt-ramips-mt7620-devolo_acr-squashfs-sysupgrade.bin filename

Wait 'till it flashes. It will reboot automatically into the new firmware. Give it time to install .. can take up to 3 or 4 mins.

You'll have access to shell either through serial or through ssh to 192.168.1.1 without password.

Configure network manually (/etc/config/network) and you'll be able to use opkg to install other software, like luci.

Although this is very recent, i've been using my Devolo for a few hours now and it seems to be handling things pretty well, including VLANs.

LEDs are not working (yet?).
Partitions could probably be better defined.

!!! I do not know how to turn back to stock firmware. You have been warned !!!

Hi. Little update.

LEDs are configured in the following way:
Bottom LED is for system status - booting, flashing and operation
Next 2 LEDs indicate 2.4GHz radio operation
Last 2 LEDs indicate 5GHz radio operation.

Also i have a new branch with a build environment for minimal OpenWrt with luci and default OWRT network configuration. No active wireless and static 192.168.1.1/24 on ethernet port.

Build recipe is

git clone --branch devolo-acr-configured https://github.com/hmmmonteiro/openwrt.git

cd openwrt

./scripts/feeds update -a
./scripts/feeds install -a

cp diffconfig .config

make -j$(nproc) defconfig download clean world

1st time, flash using serial as described above. Following updates can be done using luci interface.

If you find building boring i have a flash ready file here https://github.com/hmmmonteiro/openwrt/raw/devolo-acr-configured/bin/targets/ramips/mt7620/openwrt-ramips-mt7620-devolo_acr-squashfs-sysupgrade.bin

Btw .. Stupidly i did not save the boot log from the original firmware. I was wondering if anyone has it, or is able to produce it, and wouldn't mind sharing it.

Cheers!

For reference, stock boot is

U-Boot 1.1.3 (Apr 24 2015 - 18:11:06)

Board: Ralink APSoC DRAM:  64 MB
gpiomode===>1a301c
after:gpiomode===>1a341c
Ralink UBoot ver: 4.0.1.0
ELX UBoot ver: 1.0.0 (Apr 24 2015 18:11:06)
Date:Apr 24 2015  Time:18:11:06
CPU: 580 MHz, MEM: 64 MB
Reset Phy by gpio 39

Please choose the operation: 1, 2, 3, 4, 9
 0 
   
3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1459254 Bytes =  1.4 MB
   Load Address: 80000000
   Entry Point:  802593c0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 802593c0) ...
## Giving linux memsize in MB, 64

Starting kernel ...

Linux version 3.2.9 (root@localhost.localdomain) (gcc version 4.6.4 (Buildroot 2013.05) ) #10 Fri Jun 8 16:29:42 CST 2018
 PCIE: bypass PCIe DLL.
 disable all power about PCIe
CPU revision is: 00019650 (MIPS 24Kc)
Ralink MT7620   ver:2 eco:6 running at 580.00 MHz
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line:  console=ttyS1,57600 root=/dev/ram0 rootfstype=squashfs,jffs2
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=0002409c
Readback ErrCtl register=0002409c
Memory: 60572k/65536k available (2441k kernel code, 4964k reserved, 631k data, 1176k init, 0k highmem)
SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 385.02 BogoMIPS (lpj=770048)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
MIPS: machine is Ralink MT7620
PPLL_CFG1=0xe64000
MT7620 PPLL lock
PPLL_DRV =0x80080504
start PCIe register access
mt7620_pci_rr(MT7620_PCI_REG_PCICFG_ADDR):1000f0
i=0,1
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
vgaarb: loaded
SCSI subsystem initialized
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff])
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff 64bit] (PCI address [0x20000000-0x200fffff])
pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 118
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000500 (irq = 13) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
loop: module loaded
deice id : c2 20 17 c2 20 (2017c220)
MX25L6405D(c2 2017c220) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00001000 (4K) .numeraseregions = 0
Creating 10 MTD partitions on "raspi":
0x000000000000-0x000000800000 : "ALL"
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config"
0x000000040000-0x000000048000 : "Factory"
0x000000048000-0x000000050000 : "iNIC_rf"
0x000000050000-0x000000724000 : "Kernel"
0x0000001b5000-0x000000724000 : "user"
0x000000724000-0x0000007b0000 : "manufacture"
0x0000007b0000-0x0000007c0000 : "backup"
0x0000007c0000-0x000000800000 : "storage"
rdm_major = 253
IMQ driver loaded successfully. (numdevs = 2, numqueues = 1)
	Hooking IMQ after NAT on PREROUTING.
	Hooking IMQ before NAT on POSTROUTING.
SMACCR1 -- : 0x000000aa
SMACCR0 -- : 0xbbccdd10
Ralink APSoC Ethernet Driver Initilization. v3.0  256 rx/tx descriptors allocated, mtu = 1500!
SMACCR1 -- : 0x000000aa
SMACCR0 -- : 0xbbccdd10
PROC INIT OK!
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
Registered button device:multi-fun-button, gpio:60,code:265,index:9
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
ctnetlink v0.93: registering with nfnetlink.
xt_time: kernel timezone is -0000
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP westwood registered
NET: Registered protocol family 17
L2TP core driver, V2.0
8021q: 802.1Q VLAN Support v1.8
Freeing unused kernel memory: 1176k freed
System Init version: 1.1 date: 1
Setting up file systems ...
Setting up /mnt/tmpfs directory with tmpfs/16384KB
Setting up FLASH storage partition ...
JFFS2 notice: (316) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
Setting up /apps directory ...apps is in FLASH ...
Setting up loopback device ...
FINISHED
cat: can't open '/sys/devices/platform/gpio-keys-polled/reset': No such file or directory
Start Normal Operation Mode ...
************************************************************************
*                                ---ELX---                             *
************************************************************************

KernelApp version: 9.0.4 build date: 2018/06/08 build time: 16:27:58
cmd> ln: /sbin/./arp: File exists
ln: /sbin/./insmod: File exists
ln: /sbin/./lsmod: File exists
ln: /sbin/./rmmod: File exists
ln: /sbin/./route: File exists
ln: /sbin/./start_all: File exists
ln: /sbin/./sysctl: File exists
ln: /sbin/./syslogd: File exists
ln: /sbin/./vconfig: File exists
ln: /bin/./busybox: File exists
ln: /bin/./date: File exists
ln: /bin/./df: File exists
ln: /bin/./echo: File exists
ln: /bin/./grep: File exists
ln: /bin/./kill: File exists
ln: /bin/./mkdir: File exists
ln: /bin/./mknod: File exists
ln: /bin/./mv: File exists
ln: /bin/./netstat: File exists
ln: /bin/./ping: File exists
ln: /bin/./ps: File exists
ln: /bin/./pwd: File exists
ln: /bin/./rm: File exists
ln: /bin/./sleep: File exists
ln: /bin/./sync: File exists
ln: /bin/./touch: File exists
ln: /bin/./true: File exists
ln: /bin/./uname: File exists
ln: /usr/bin/./[: File exists
ln: /usr/bin/./[[: File exists
ln: /usr/bin/./basename: File exists
ln: /usr/bin/./cmp: File exists
ln: /usr/bin/./groups: File exists
ln: /usr/bin/./hd: File exists
ln: /usr/bin/./hexdump: File exists
ln: /usr/bin/./id: File exists
ln: /usr/bin/./ipcs: File exists
ln: /usr/bin/./killall: File exists
ln: /usr/bin/./logger: File exists
ln: /usr/bin/./lspci: File exists
ln: /usr/bin/./md5sum: File exists
ln: /usr/bin/./tac: File exists
ln: /usr/bin/./tail: File exists
ln: /usr/bin/./test: File exists
ln: /usr/bin/./tftp: File exists
ln: /usr/bin/./time: File exists
ln: /usr/bin/./uptime: File exists
Share memory created:  keyid 6888 shm_id 0 size 159(KB)
Warning: dbox_destroy_share_memory p_dbox_cfg is NULL!
CMD[mkdir -p /var/sd]
__create_share_mem keyid 6888 shm_id 0

System Monitoring
__create_share_mem keyid 6888 shm_id 0
Raeth v3.0 (Tasklet)

phy_tx_ring = 0x03272000, tx_ring = 0xa3272000

phy_rx_ring0 = 0x03273000, rx_ring0 = 0xa3273000
Reset Switch!!
SMACCR1 -- : 0x000000aa
SMACCR0 -- : 0xbbccdd10
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = 20710000
ra2880stop()...Done
Free TX/RX Ring Memory!
Raeth v3.0 (Tasklet)

phy_tx_ring = 0x03205000, tx_ring = 0xa3205000

phy_rx_ring0 = 0x031f5000, rx_ring0 = 0xa31f5000
Reset Switch!!
SMACCR1 -- : 0x0000b8be
SMACCR0 -- : 0xf43f08e2
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = 20710000
switch register base addr to 0xb0100000
write offset 0x4, value 0x20000000
device br_t.1 entered promiscuous mode
device br_t entered promiscuous mode
br0: port 1(br_t.1) entering forwarding state
br0: port 1(br_t.1) entering forwarding state
br0: port 1(br_t.1) entering forwarding state
device eth2 entered promiscuous mode
br0: port 2(eth2) entering forwarding state
br0: port 2(eth2) entering forwarding state
br0: port 1(br_t.1) entering forwarding state
br0: port 1(br_t.1) entering forwarding state


********************
Initialize Radio_(24G) setting ... 
rd[0]==1
OK


Configuring Ralink WiFi device ...Wlan is in
 Universal Repeater Mode
CMD[insmod /lib/rt2860v2_ap.ko]
rt2860v2_ap: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
CMD[cp /lib/24G_SingleSKU_CE.dat /etc/Wireless/RT2860/SingleSKU.dat]
[2.5G]Copy single SKU file for ETSI(CE)...
 [24G] CE EDCCA enable!
CMD[ifconfig ra0 0.0.0.0 up]
start ch = 10, ch->num = 4
18 18 18 18 
16 16 16 16 16 16 16 16 
18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 
rt635x_tssi0_dc is 0x00000002
rt635x_tssi1_dc is 0xfffffffe
rt635x_tssi0_dc is 0x00000002
rt635x_tssi1_dc is 0xfffffffe
rt635x_tssi0_dc is 0x00000002
rt635x_tssi1_dc is 0xfffffffe
0x1300 = 00064300
CMD[iwpriv ra0 set RadioOn=0]
CMD[brctl addif br0 ra0]
device ra0 entered promiscuous mode
br0: port 3(ra0) entering forwarding state
br0: port 3(ra0) entering forwarding state
CMD[brctl addif br0 apcli0]
device apcli0 entered promiscuous mode
CMD[iwpriv ra0 set RadioOn=1]
rt635x_tssi0_dc is 0x00000002
rt635x_tssi1_dc is 0xfffffffe
rt635x_tssi0_dc is 0x00000002
rt635x_tssi1_dc is 0xfffffffe
CMD[iwpriv ra0 set WscMaxPinAttack=5]
CMD[iwpriv ra0 set HtMIMOPS=3]
CMD[iwpriv ra0 set DyncVgaEnable=0]


********************
Initialize Radio_(5G) setting ... 
rd[1]==2
OK
Configuring 5G radio setting ... 


Configuring Ralink WiFi device ...Wlan is in
 Universal Repeater Mode
CMD[insmod /lib/rlt_wifi.ko]
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
create [wsc_5g] proc!
CMD[cp /lib/5G_SingleSKU_CE.dat /etc/Wireless/RT2860/5g_SingleSKU.dat]
[5G]Copy single SKU file for CE...
[5G] CE EDCCA enable! 
CMD[ifconfig rai0 0.0.0.0 up]
CMD[iwpriv rai0 set RadioOn=0]
CMD[brctl addif br0 rai0]
device rai0 entered promiscuous mode
br0: port 5(rai0) entering forwarding state
br0: port 5(rai0) entering forwarding state
CMD[brctl addif br2 apclii0]
device apclii0 entered promiscuous mode
CMD[iwpriv rai0 set RadioOn=1]
CMD[iwpriv rai0 set WscMaxPinAttack=5]
CMD[iwpriv rai0 set HtMIMOPS=3]
CMD[iwpriv ra0 set DyncVgaEnable=0]














Ebtables v2.0 registered
__create_share_mem keyid 6888 shm_id 0
__create_share_mem keyid 6888 shm_id 0
Start wps_led driver
br0: port 2(eth2) entering forwarding state
br0: port 1(br_t.1) entering forwarding state
br0: port 3(ra0) entering forwarding state
br0: port 5(rai0) entering forwarding state

and env vars have these default values

U-Boot 1.1.3 (Apr 24 2015 - 18:11:06)

Board: Ralink APSoC DRAM:  64 MB
gpiomode===>1a301c
after:gpiomode===>1a341c
Ralink UBoot ver: 4.0.1.0
ELX UBoot ver: 1.0.0 (Apr 24 2015 18:11:06)
Date:Apr 24 2015  Time:18:11:06
CPU: 580 MHz, MEM: 64 MB
Reset Phy by gpio 39

Please choose the operation: 1, 2, 3, 4, 9

You choosed 4

 0 

   
4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Apr 24 2015 - 18:11:06)
MT7620 # ?
?       - alias for 'help'
bootm   - boot application image from memory
cp      - memory copy
elx_check      - check ELX image
erase   - erase SPI FLASH memory
go      - start application at address 'addr'
help    - print online help
md      - memory display
mdio   - Ralink PHY register R/W command !!
mm      - memory modify (auto-incrementing)
mw      - memory write (fill)
nm      - memory modify (constant address)
printenv- print environment variables
reset   - Perform RESET of the CPU
rf      - read/write rf register
saveenv - save environment variables to persistent storage
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
MT7620 # printenv 
bootcmd=tftp
baudrate=57600
ethaddr="B8:BE:F4:3F:08:E2"
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
kernel_addr=BFC40000
u-boot=u-boot.bin
load=tftp 8A100000 $(u-boot)
u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
loadfs=tftp 8A100000 root.cramfs
u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
test_tftp=tftp 8A100000 root.cramfs;run test_tftp
ethact=Eth0 (10/100-M)
language_code=uk
hw_id=0116001f
domain=1
pincode=42519409
wlanaddr=00:aa:bb:cc:dd:10
kver=9.0.4  
sn=5052800502                      
usboot=0
dom2=2
wanaddr=00:aa:bb:cc:dd:20
bootdelay=2
bver=4.0.1.6
op_mode=0
filesize=3dd000
fileaddr=80A00000
ipaddr=192.168.99.9
serverip=192.168.99.8
autostart=no
bootfile=uImage_DEVOLO-7476DRC-v005
stdin=serial
stdout=serial
stderr=serial

Environment size: 1049/4092 bytes
MT7620 #