Need build info for this device (Green Packet Berhad, Taiwan TDD-LTE BAND 41 OUTDOOR CPE OD235-GP)

Hardware Detail
IC = MX30LF1GE8AB-TI (128Mb)
SoC = AR9344
RAM = EM68B16CWQH-25H (2x32M SDRAM DDR2)
MAC = 1C:49:7B:EB:09:A5
FCC = https://fccid.io/W9V-OD235-GP
UBoot = U-Boot 1.1.4
Kernel = Linux Kernel Image 4.2.4
Original Firmware = https://mega.nz/#!bZRQkYbY!wJQJMYygfuUWrjRlBzQ0CAcJupR3riy-ufMigJZFTdc <- ipk for webflash

Extract file list on ipk file have 2 bin file (OpenWRX.bin and AP_Firmware.bin)

Binwalk result for 2 bin file

OpenWRX.bin
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1440844       0x15FC4C        ARM executable code, 16-bit (Thumb), big endian, at least 502 valid instructions

AP_Firmware.bin 
not detected

Internal Image

1 Like

does this device have a Serial Console

this?
image

ur need IC 8Mb for motherboard (Img 1) and you have to add POE (https://www.youtube.com/watch?v=Lk1UU79ZIws)

I have also tried flashing with the Outdoor firmware from OD235 / GreenPacket. my device Bolt! BL400 Outdoor .

https://phcorner.net/threads/686130/#post-11647308

I also hope this device can work / be supported from OpenWRT. as for the Indoor BL401 can already with OpenWRT.

ur need IC 8Mb for motherboard (Img 1) and you have to add POE (https://www.youtube.com/watch?v=Lk1UU79ZIws)

do you think this method will work?
if work, which firmware same like this device? i was read here, cpe210 almost same hardware spec. but i never try.
anw... i read on pinoy forum, reflashing nand can work, but too expensive tool for flashing nand

do you think this method will work?
my answer: yes, my PoE modification

I use the original FW from OD235 / greenpacket, but it doesn't work in Outdoor BL400 IC 8MB still go to Nand Flash boot (Boot with BOLT! **) not to IC Rom that I installed manually (Pinoy Forum / Philippines too). obstacle there, to switch boot to SPI ROM IC

** Booting image at 81000000 ...
   Image Name:   =01.01.02.147 ** FW Bolt!
   Created:      2018-12-07   7:14:23 UTC
   Image Type:   MIPS Linux Multi-File Image (lzma compressed)
   Data Size:    18345920 Bytes = 17.5 MB
   Load Address: 80002000
   Entry Point:  802c1180
   Contents:
   Image 0:  1441716 Bytes =  1.4 MB
   Image 1: 16904192 Bytes = 16.1 MB
   Verifying Checksum at 0x81000040 ...OK
   Uncompressing Multi-File Image ... OK

with putty
find_hif: bootstrap = 0xbf05ba
WASP BootROM Ver. 1.3
Nand Flash init
otp_get_nand_table: 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0
ONFI: Control Setting = 0xb44
hdr: [0xbd004000 : 0xbd004000 : 0x3000 : 0xbfb5a924]
nand_load_fw: read 6 pages
nand_load_fw: 0x10000 0x800 0xbd0047f0
nand_load_fw: 0x20000 0x800 0xbd004ff0
nand_load_fw: 0x30000 0x800 0xbd0057f0
nand_load_fw: 0x40000 0x800 0xbd005ff0
nand_load_fw: 0x50000 0x800 0xbd0067f0
f/w 0 read complete, jumping to 0xbd004000
initialize PLL & DDR

sri
Wasp 1.3
Wasp (32bit) ddr2 init
setting for 40
fw1: Nand Init
leave FW1
f/w 0 execution complete
hdr: [0xa0100000 : 0xa0100000 : 0x2c800 : 0xf7343819]
nand_load_fw: read 89 pages
nand_load_fw: 0x70000 0x800 0xa01007f0
nand_load_fw: 0x80000 0x800 0xa0100ff0
nand_load_fw: 0x90000 0x800 0xa01017f0
nand_load_fw: 0xa0000 0x800 0xa0101ff0
nand_load_fw: 0xb0000 0x800 0xa01027f0
nand_load_fw: 0xc0000 0x800 0xa0102ff0
nand_load_fw: 0xd0000 0x800 0xa01037f0
nand_load_fw: 0xe0000 0x800 0xa0103ff0
nand_load_fw: 0xf0000 0x800 0xa01047f0
nand_load_fw: 0x100000 0x800 0xa0104ff0
nand_load_fw: 0x110000 0x800 0xa01057f0
nand_load_fw: 0x120000 0x800 0xa0105ff0
nand_load_fw: 0x130000 0x800 0xa01067f0
nand_load_fw: 0x140000 0x800 0xa0106ff0
nand_load_fw: 0x150000 0x800 0xa01077f0
nand_load_fw: 0x160000 0x800 0xa0107ff0
nand_load_fw: 0x170000 0x800 0xa01087f0
nand_load_fw: 0x180000 0x800 0xa0108ff0
nand_load_fw: 0x190000 0x800 0xa01097f0
nand_load_fw: 0x1a0000 0x800 0xa0109ff0
nand_load_fw: 0x1b0000 0x800 0xa010a7f0
nand_load_fw: 0x1c0000 0x800 0xa010aff0
nand_load_fw: 0x1d0000 0x800 0xa010b7f0
nand_load_fw: 0x1e0000 0x800 0xa010bff0
nand_load_fw: 0x1f0000 0x800 0xa010c7f0
nand_load_fw: 0x200000 0x800 0xa010cff0
nand_load_fw: 0x210000 0x800 0xa010d7f0
nand_load_fw: 0x220000 0x800 0xa010dff0
nand_load_fw: 0x230000 0x800 0xa010e7f0
nand_load_fw: 0x240000 0x800 0xa010eff0
nand_load_fw: 0x250000 0x800 0xa010f7f0
nand_load_fw: 0x260000 0x800 0xa010fff0
nand_load_fw: 0x270000 0x800 0xa01107f0
nand_load_fw: 0x280000 0x800 0xa0110ff0
nand_load_fw: 0x290000 0x800 0xa01117f0
nand_load_fw: 0x2a0000 0x800 0xa0111ff0
nand_load_fw: 0x2b0000 0x800 0xa01127f0
nand_load_fw: 0x2c0000 0x800 0xa0112ff0
nand_load_fw: 0x2d0000 0x800 0xa01137f0
nand_load_fw: 0x2e0000 0x800 0xa0113ff0
nand_load_fw: 0x2f0000 0x800 0xa01147f0
nand_load_fw: 0x300000 0x800 0xa0114ff0
nand_load_fw: 0x310000 0x800 0xa01157f0
nand_load_fw: 0x320000 0x800 0xa0115ff0
nand_load_fw: 0x330000 0x800 0xa01167f0
nand_load_fw: 0x340000 0x800 0xa0116ff0
nand_load_fw: 0x350000 0x800 0xa01177f0
nand_load_fw: 0x360000 0x800 0xa0117ff0
nand_load_fw: 0x370000 0x800 0xa01187f0
nand_load_fw: 0x380000 0x800 0xa0118ff0
nand_load_fw: 0x390000 0x800 0xa01197f0
nand_load_fw: 0x3a0000 0x800 0xa0119ff0
nand_load_fw: 0x3b0000 0x800 0xa011a7f0
nand_load_fw: 0x3c0000 0x800 0xa011aff0
nand_load_fw: 0x3d0000 0x800 0xa011b7f0
nand_load_fw: 0x3e0000 0x800 0xa011bff0
nand_load_fw: 0x3f0000 0x800 0xa011c7f0
nand_load_fw: 0x400000 0x800 0xa011cff0
nand_load_fw: 0x410000 0x800 0xa011d7f0
nand_load_fw: 0x420000 0x800 0xa011dff0
nand_load_fw: 0x430000 0x800 0xa011e7f0
nand_load_fw: 0x440000 0x800 0xa011eff0
nand_load_fw: 0x450000 0x800 0xa011f7f0
nand_load_fw: 0x460000 0x800 0xa011fff0
nand_load_fw: 0x470000 0x800 0xa01207f0
nand_load_fw: 0x480000 0x800 0xa0120ff0
nand_load_fw: 0x490000 0x800 0xa01217f0
nand_load_fw: 0x4a0000 0x800 0xa0121ff0
nand_load_fw: 0x4b0000 0x800 0xa01227f0
nand_load_fw: 0x4c0000 0x800 0xa0122ff0
nand_load_fw: 0x4d0000 0x800 0xa01237f0
nand_load_fw: 0x4e0000 0x800 0xa0123ff0
nand_load_fw: 0x4f0000 0x800 0xa01247f0
nand_load_fw: 0x500000 0x800 0xa0124ff0
nand_load_fw: 0x510000 0x800 0xa01257f0
nand_load_fw: 0x520000 0x800 0xa0125ff0
nand_load_fw: 0x530000 0x800 0xa01267f0
nand_load_fw: 0x540000 0x800 0xa0126ff0
nand_load_fw: 0x550000 0x800 0xa01277f0
nand_load_fw: 0x560000 0x800 0xa0127ff0
nand_load_fw: 0x570000 0x800 0xa01287f0
nand_load_fw: 0x580000 0x800 0xa0128ff0
nand_load_fw: 0x590000 0x800 0xa01297f0
nand_load_fw: 0x5a0000 0x800 0xa0129ff0
nand_load_fw: 0x5b0000 0x800 0xa012a7f0
nand_load_fw: 0x5c0000 0x800 0xa012aff0
nand_load_fw: 0x5d0000 0x800 0xa012b7f0
nand_load_fw: 0x5e0000 0x800 0xa012bff0
f/w 1 read complete, jumping to 0xa0100000


U-Boot 1.1.4 (Dec  6 2014 - 05:53:15)

DB120
DRAM:  Tap value selected = 0xf [0x0 - 0x1f]
128 MB
Atheros on-chip NAND FLash Controller Driver, Version 0.1 (c) 2010 Atheros Commu                                                                                        nications, Ltd.
Ath Nand ID[87ff017c]: c2:f1:80:95:82
Macronix NAND 128MiB 3,3V 8-bit [128MB]
====== NAND Parameters ======
sc = 0x87ff0158 bbt = 0x86f60008 bbt_size = 0x100 nf_ctrl = 0x345
page = 0x800 block = 0x20000 oob = 0x40
size = 128MB


U-Boot 1.1.4 (Dec  8 2017 - 18:32:49)

DB120
DRAM:  Tap value selected = 0xf [0x0 - 0x1f]
128 MB
Atheros on-chip NAND FLash Controller Driver, Version 0.1 (c) 2010 Atheros Commu                                                                                        nications, Ltd.
Ath Nand ID[87fef17c]: c2:f1:80:95:82
Macronix NAND 128MiB 3,3V 8-bit [128MB]
====== NAND Parameters ======
sc = 0x87fef158 bbt = 0x86f60008 bbt_size = 0x100 nf_ctrl = 0x345
page = 0x800 block = 0x20000 oob = 0x40
size = 128MB
pci_init_board: PCIe PLL not set for 40MHz refclk
*** Warning *** : PCIe WLAN Module not found !!!
In:    serial
Out:   serial
Err:   serial
Net:   ag934x_enet_initialize...
 4096 bytes read: OK
No valid address in Flash. Using fixed address
 4096 bytes read: OK
Fetching MAC Address from 0x87fa3b18
 wasp  reset mask:c02200
WASP ----> S27 PHY
s27 reg init
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
WASP ----> S27 PHY
s27 reg init lan
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 1c:49:7b:e9:9b:8b
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
 131072 bytes read: OK
Setting 0xb8116290 to 0x20402d0f
Hit any key to stop autoboot:  0
Check image2 validation:
Image Header Magic Number --> OK
Image Header Checksum --> OK
Image Data Checksum --> Skipping bad block[0x2ea0000]
Skipping bad block[0x2ee0000]
Skipping bad block[0x3420000]
Skipping bad block[0x35e0000]
OK
## Booting image at 81000000 ...
   Image Name:   =01.01.02.147
   Created:      2018-12-07   7:14:23 UTC
   Image Type:   MIPS Linux Multi-File Image (lzma compressed)
   Data Size:    18345920 Bytes = 17.5 MB
   Load Address: 80002000
   Entry Point:  802c1180
   Contents:
   Image 0:  1441716 Bytes =  1.4 MB
   Image 1: 16904192 Bytes = 16.1 MB
   Verifying Checksum at 0x81000040 ...OK
   Uncompressing Multi-File Image ... OK

Starting kernel ...

Booting Atheros AR934x
[Debug Code] start_kernel 642
[Debug Code] start_kernel 644
[Debug Code] start_kernel 648
[Debug Code] start_kernel 651
[    0.000000] Linux version 2.6.31 (snapshot@Hedy) (gcc version 4.3.5 (Buildroot 2012.08-svn17804-dirty) ) #1 Fri Dec 7 14:52:13 CST 2018
[    0.000000] flash_size passed from bootloader = 0
[    0.000000] arg 1: mem=128M
[    0.000000] CPU revision is: 0001974c (MIPS 74Kc)
[    0.000000] ath_sys_frequency: cpu srif ddr srif cpu 560 ddr 400 ahb 200
[    0.000000] step 0x54f scale 0x8
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initial ramdisk at: 0x81170000 (16904192 bytes)
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00008000
[    0.000000] Movable zone start PFN for each node
[    0.000000] early_node_map[1] active PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00008000
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,115200 init=/sbin/init mem=128M
[    0.000000] PID hash table entries: 512 (order: 9, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 95416k/131072k available (2830k kernel code, 35492k reserved, 791k data, 172k init, 0k highmem)
[    0.000000] NR_IRQS:128
[    0.000000] plat_time_init: plat time init done
[    0.008000] console [ttyS0] enabled
[Debug Code] start_kernel 659
[Debug Code] start_kernel 663
[Debug Code] start_kernel 673
[    0.020000] Calibrating delay loop... 279.55 BogoMIPS (lpj=559104)
[    0.116000] Mount-cache hash table entries: 512
[    0.120000] NET: Registered protocol family 16
[    0.124000] ath_pcibios_init: bus 0
[    0.124000] ***** Warning PCIe 0 H/W not found !!!
[    0.128000] registering PCI controller with io_map_base unset
[    0.132000] bio: create slab <bio-0> at 0
[    0.136000] SCSI subsystem initialized
[    0.140000] usbcore: registered new interface driver usbfs
[    0.144000] usbcore: registered new interface driver hub
[    0.148000] usbcore: registered new device driver usb
[    0.152000] NET: Registered protocol family 2
[    0.156000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.160000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.168000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.172000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.180000] TCP reno registered
[    0.184000] NET: Registered protocol family 1
[    0.188000] Trying to unpack rootfs image as initramfs...
[    0.192000] rootfs image is not initramfs (junk in compressed archive); looks like an initrd
[    0.476000] Freeing initrd memory: 16508k freed
[    0.480000] ATH GPIOC major 0
[    0.484000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.488000] msgmni has been set to 218
[    0.504000] alg: No test for stdrng (krng)
[    0.508000] io scheduler noop registered
[    0.508000] io scheduler deadline registered (default)
[    0.516000] HDLC line discipline maxframe=4096
[    0.520000] N_HDLC line discipline registered.
[    0.524000] Serial: Atheros High/Low-Speed UART
[    0.528000] uart clock: 115200
[    0.532000] ath_uart_request_port success to request memory region!!
[    0.536000] ttyS0 at I/O 0x18020000 (irq = 19) is a UART
[    0.544000] ath_uart_request_port success to request memory region!!
[    0.548000] ttyS1 at I/O 0x18500000 (irq = 22) is a HS_UART
[    0.556000] brd: module loaded
[    0.556000] cmdlinepart partition parsing not available
[    0.564000] RedBoot partition parsing not available
[    0.568000] No partitions found on flash bank 0
[    0.572000] Atheros on-chip NAND FLash Controller Driver, Version 0.1 (c) 2010 Atheros Communications, Ltd.
[    0.580000] Ath Nand ID[8785619c]: c2:f1:80:95:82
[    0.584000] Macronix NAND 128MiB 3,3V 8-bit [128MB]
[    0.860000] Creating 10 MTD partitions on "ath-nand":
[    0.864000] 0x000000000000-0x000000100000 : "Bootloader"
[    0.872000] 0x000000100000-0x000000200000 : "Bootloader2"
[    0.880000] 0x000000200000-0x000000300000 : "Config"
[    0.888000] 0x000000300000-0x000000580000 : "Env1"
[    0.904000] 0x000000580000-0x000000800000 : "Env2"
[    0.916000] 0x000000800000-0x000002800000 : "Kernel"
[    1.028000] 0x000002800000-0x000004800000 : "Kernel2"
[    1.144000] 0x000004800000-0x000006400000 : "Storage1"
[    1.244000] 0x000006400000-0x000008000000 : "Storage2"
[    1.344000] 0x000002960000-0x000004800000 : "rootfs"
[    1.452000] ====== NAND Parameters ======
[    1.452000] sc = 0x87856000 bbt = 0x8785d8a0 bbt_size = 0x100 nf_ctrl = 0x345
[    1.452000] page = 0x800 block = 0x20000 oob = 0x40
[    1.468000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    1.472000] usbcore: registered new interface driver cdc_acm
[    1.480000] cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters
[    1.488000] Initializing USB Mass Storage driver...
[    1.492000] usbcore: registered new interface driver usb-storage
[    1.496000] USB Mass Storage support registered.
[    1.500000] GACT probability on
[    1.504000] Mirror/redirect action on
[    1.508000] u32 classifier
[    1.512000]     Performance counters on
[    1.516000]     input device check on
[    1.516000]     Actions configured
[    1.520000] Netfilter messages via NETLINK v0.30.
[    1.524000] nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
[    1.532000] ctnetlink v0.93: registering with nfnetlink.
[    1.536000] xt_time: kernel timezone is -0000
[    1.540000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.548000] TCP cubic registered
[    1.548000] NET: Registered protocol family 10
[    1.556000] lo: Disabled Privacy Extensions
[    1.560000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    1.564000] NET: Registered protocol family 17
[    1.568000] NET: Registered protocol family 15
[    1.572000] Bridge firewalling registered
[    1.576000] Ebtables v2.0 registered
[    1.580000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[    1.584000] All bugs added by David S. Miller <davem@redhat.com>
[    1.592000] athwdt_init: Registering WDT success
[    1.596000] athwdt_timer_init:447: here jiffies:2151218116
[    1.600000] ath_otp_init: Registering OTP success
[    1.604000] ath_clksw_init: Registering Clock Switch Interface success
[    1.724000] VFS: Mounted root (squashfs filesystem) readonly on device 31:9.
[    1.732000] Freeing unused kernel memory: 172k freed
[    2.728000] Algorithmics/MIPS FPU Emulator v1.5
fips mode: disabled
init started: BusyBox v1.17.4 (2018-12-07 14:42:36 CST)
Fri Dec  7 00:00:00 UTC 2018
kernel.panic = 3
net.ipv4.conf.default.arp_ignore = 1
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.ip_forward = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 120
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_rmem = 4096 87380 6291456
net.ipv4.tcp_wmem = 4096 16384 4194304
net.core.netdev_budget = 16
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.log_martians = 1
net.bridge.bridge-nf-filter-vlan-tagged = 1
net.ipv6.conf.all.autoconf = 0
net.ipv6.conf.all.accept_ra_pinfo = 0
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.all.forwarding = 1
vm.swappiness = 0
vm.min_free_kbytes = 8192
vm.dirty_writeback_centisecs = 0
vm.dirty_background_ratio = 0
vm.overcommit_ratio = 100
vm.overcommit_memory = 2
STORAGE_MTD=8
[    3.792000] UBI: attaching mtd8 to ubi8
[    3.796000] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    3.800000] UBI: logical eraseblock size:    126976 bytes
[    3.804000] UBI: smallest flash I/O unit:    2048
[    3.812000] UBI: VID header offset:          2048 (aligned 2048)
[    3.816000] UBI: data offset:                4096
[    4.124000] UBI: attached mtd8 to ubi8
[    4.128000] UBI: MTD device name:            "Storage2"
[    4.132000] UBI: MTD device size:            28 MiB
[    4.140000] UBI: number of good PEBs:        224
[    4.144000] UBI: number of bad PEBs:         0
[    4.148000] UBI: max. allowed volumes:       128
[    4.152000] UBI: wear-leveling threshold:    4096
[    4.156000] UBI: number of internal volumes: 1
[    4.160000] UBI: number of user volumes:     1
[    4.164000] UBI: available PEBs:             0
[    4.168000] UBI: total number of reserved PEBs: 224
[    4.172000] UBI: number of PEBs reserved for bad PEB handling: 20
[    4.180000] UBI: max/mean erase counter: 1363/1303
[    4.184000] UBI: image sequence number: 1159870063
[    4.188000] UBI: background thread "ubi_bgt8d" started, PID 69
UBI device number 8, total 224 LEBs (28442624 bytes, 27.1 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
Volume ID:   0 (on ubi8)
[    4.416000] UBIFS: recovery needed
[    4.556000] UBIFS: recovery completed
[    4.560000] UBIFS: mounted UBI device 8, volume 0, name "mtd8"
[    4.564000] UBIFS: file system size:   24252416 bytes (23684 KiB, 23 MiB, 191 LEBs)
[    4.572000] UBIFS: journal size:       1269760 bytes (1240 KiB, 1 MiB, 10 LEBs)
[    4.580000] UBIFS: media format:       w4/r0 (latest is w4/r0)
[    4.584000] UBIFS: default compressor: lzo
[    4.588000] UBIFS: reserved for root:  1145500 bytes (1118 KiB)
Starting portmap: done
Checking Account Information...done
Create /etc/user_list for vsftpd.
Initializing random number generator... done.
Start gather entropy daemon...addentropy: reading data from stdin. make sure it has 1 entropy bit per real bit!generating random bytes @ 1000000+c us/bit
Starting network time protocol daemon: ntpd.
Starting network management services:.
Generating cron table...
net.ipv4.tcp_synack_retries = 3
[: bad number
[    7.920000] ATHR_GMAC: Length per segment 1536
[    7.924000] ATHR_GMAC: fifo cfg 3 01f00140
[    7.928000] mac:0 Registering S27....
[    7.932000] ATHR_GMAC: RX TASKLET - Pkts per Intr:16
[    7.936000] Reading Flash for Calibraton data from 0x0 and partition name is Config
[    7.944000] ATHR_GMAC: Mac address for unit 0:879c1880
[    7.952000] ATHR_GMAC: ff:ff:ff:ff:ff:ff
[    8.504000] ATHR_GMAC: Max segments per packet :   1
[    8.508000] ATHR_GMAC: Max tx descriptor count :   128
[    8.516000] ATHR_GMAC: Max rx descriptor count :   128
[    8.520000] ATHR_GMAC: Mac capability flags    :   2580
[    8.524000] mac:1 Registering S27....
[    8.528000] ATHR_GMAC: RX TASKLET - Pkts per Intr:16
[    8.532000] Reading Flash for Calibraton data from 0x6 and partition name is Config
[    8.540000] ATHR_GMAC: Mac address for unit 1:879c16c0
[    8.544000] ATHR_GMAC: 1c:49:7b:e9:9b:8b
[    9.100000] ATHR_GMAC: Max segments per packet :   1
[    9.104000] ATHR_GMAC: Max tx descriptor count :   128
[    9.108000] ATHR_GMAC: Max rx descriptor count :   128
[    9.112000] ATHR_GMAC: Mac capability flags    :   2D80
[    9.220000] usbcore: registered new interface driver cdc_ether
[    9.396000] Power on WiMAX card...
Waiting for device eth2...
Waiting for device eth2...
Waiting for device eth2...
ifconfig: SIOCGIFFLAGS: No such device
[   13.084000] athr_gmac_ring_alloc Allocated 2048 at 0x8798b800
[   13.088000] athr_gmac_ring_alloc Allocated 2048 at 0x8798b000
[   13.396000] WASP ----> S27 PHY MDIO
[   13.400000] ATHRS27: resetting s27
[   13.504000] ATHRS27: s27 reset done
[   13.516000] Setting Drop CRC Errors, Pause Frames and Length Error frames
[   13.524000] Setting PHY...
[   14.548000] ADDRCONF(NETDEV_UP): eth1: link is not ready
[   14.780000] Ethernet interface (eth2) not found
insmod: can't insert '/lib/modules/2.6.31/kernel/drivers/net/kthp/kthp.ko': Operation not permitted
## Error: "clientkey" not defined
## Error: "clientcert" not defined
## Error: "private_key_header" not defined
[         AES_Key_Gen]     203   MAC=[1C:49:7B:E9:9B:8C]
[         AES_Key_Gen]     204   Customer=[Bolt]
[         AES_Key_Gen]     209   key=[1C:49:7B:E9:9B:8CBolt] len[21]
### USER mode ###
net.netfilter.nf_conntrack_checksum = 0
net.ipv4.icmp_errors_use_inbound_ifaddr = 1
my_kill: no process to kill[cms]

buildroot login: /etc/conf/user/mark.conf cannot be opened!
/mnt/jffs2/conf/user/mark.conf cannot be opened!
/etc/conf/user/mark_l2.conf cannot be opened!
/mnt/jffs2/conf/user/mark_l2.conf cannot be opened!
/etc/conf/user/l2_traffic.conf cannot be opened!
/mnt/jffs2/conf/user/l2_traffic.conf cannot be opened!
/etc/conf/user/clatd.conf cannot be opened!
/mnt/jffs2/conf/user/clatd.conf cannot be opened!
/etc/conf/user/wifi_11ac.conf cannot be opened!
/mnt/jffs2/conf/user/wifi_11ac.conf cannot be opened!
/etc/conf/user/other.conf cannot be opened!
/mnt/jffs2/conf/user/other.conf cannot be opened!
[User]Set param sys_ext_if value eth2
Enable firewall ...
Accept SIP well-known port, 5060 ...
===== NAT Mode, Outer IP:Dynamic, MTU:1500 =====
[   24.496000] device eth1 entered promiscuous mode
ifconfig: SIOCGIFFLAGS: No such device
_lv_EXTIF=eth2, _lv_BRIF=br0, _lv_WAN_IP=
conntrack v1.4.2 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.2 (conntrack-tools): 5 flow entries have been deleted.
sh: you need to specify whom to kill
Generating sequansd xml file now
[User]Set param sys_ext_if value eth2
Enable firewall ...
Accept SIP well-known port, 5060 ...
===== NAT Mode, Outer IP:Dynamic, MTU:1500 =====
ifconfig: SIOCGIFFLAGS: No such device
killall: sequansd: no process killed
killall: you need to specify whom to kill
_lv_EXTIF=eth2, _lv_BRIF=br0, _lv_WAN_IP=
conntrack v1.4.2 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.2 (conntrack-tools): 1 flow entries have been deleted.
 7:00 35.498 >| HPS/SPY       audit >| new AsyncContext name='DCC' maxcmds=100
 7:00 35.896 >| DCC/SPY        info >| Register Client index=6 name='internal' services=7
 7:00 35.896 >| DCC/SPY        info >| Register Client index=8 name='upg' services=5
 7:00 35.896 >| DCC/SPY        info >| Register Client index=7 name='deviceInfo' services=23
 7:00 35.896 >| DCC/SPY        info >| Register Client index=1 name='dbg' services=9
 7:00 35.896 >| DCC/SPY        info >| Register Client index=2 name='evt' services=9
 7:00 35.896 >| DCC/SPY        info >| Register Client index=3 name='cnx' services=7
 7:00 35.896 >| DCC/SPY        info >| Register Client index=4 name='dcm' services=4
 7:00 35.898 >| DCC/SPY        info >| Register Client index=10 name='rftb' services=6
 7:00 36.022 >| DCC/SPY        info >| Register Client index=5 name='ue' services=168
 7:00 36.022 >| DCC/SPY        info >| Register Client index=11 name='plaInfo' services=5
 7:00 36.022 >| DCC/SPY        info >| Register Client index=13 name='usimInfo' services=2
 7:00 36.022 >| DCC/SPY        info >| Register Client index=14 name='has' services=5
 7:00 36.022 >| DCC/SPY        info >| Register Client index=15 name='mts' services=40
 7:00 36.022 >| DCC/SPY        info >| Register Client index=16 name='arc' services=4
 7:00 36.022 >| DCC/SPY        info >| Register Client index=17 name='pla' services=3
 7:00 36.024 >| DCC/SPY        info >| Register Client index=12 name='plaDbg' services=5
 7:00 36.024 >| DCC/SPY        info >| Register Client index=18 name='wrat' services=39
 7:00 36.024 >| DCC/SPY        info >| Register Client index=19 name='sorb' services=4
 7:00 36.024 >| DCC/SPY        info >| Register Client index=20 name='mpdn' services=11
 7:00 36.024 >| DCC/SPY        info >| Register Client index=22 name='ims' services=14
 7:00 36.024 >| DCC/SPY        info >| Register Client index=23 name='imsService' services=2
 7:00 36.024 >| DCC/SPY        info >| Register Client index=21 name='atf' services=6
 7:00 36.024 >| DCC/SPY        info >| Register Client index=24 name='sms' services=10
 7:00 36.024 >| DCC/SPY        info >| Register Client index=25 name='stk' services=17
 7:00 36.024 >| DCC/SPY        info >| Register Client index=26 name='embms' services=16
 7:00 36.024 >| DCC/SPY        info >| Register Client index=27 name='dat' services=5
 7:00 36.026 >| DCC/SPY        info >| Register Client index=28 name='prov' services=8
 7:00 36.026 >| DCC/SPY        info >| Register Client index=29 name='smsDual' services=15
 7:00 36.026 >| DCC/SPY        info >| Register Client index=32 name='drf' services=3
 7:00 36.026 >| DCC/SPY        info >| Register Client index=31 name='dualRx' services=3
 7:00 36.026 >| DCC/SPY        info >| Register Client index=32 name='imsd' services=11
 7:00 36.026 >| DCC/SPY        info >| [0]Started...
sh: atheros_app: not found
sh: atheros_app: not found
sh: atheros_app: not found
sh: atheros_app: not found
DATA ROUTING stop
my_kill: no process to kill[miniupnpd]
miniupnpd_helper.sh: removing rules of miniupnpd...

route: SIOCDELRT: No such process
SCRIPT
  CLI : "sendat command="AT+CEMODE=0""
  CLI : "setUsimMode useFakeUsim=0"
  CLI : "poweron"
  CLI : "poweroff"
  CLI : "setCaps srvBandOnly=0 mfbi=0 tm8=0"
rm: can't remove '/dev/at0': No such file or directory
ln: /dev/at0: Read-only file system
sh: atheros_app: not found
sh: atheros_app: not found
sh: atheros_app: not found
 7:00 41.606 >| DCC/SPY        info >| [0]Connected...
 7:00 41.608 >| DCC/SPY        info >| [0x10D10001] [0] Received service push _cHandle=(nil) size=2245 msQty=0
sh: atheros_app: not found
2018-12-07 07:00:36: (log.c.164) server started
ifconfig: SIOCSIFMTU: No such device
pid:362
Open fifo /tmp/cwmpc_IpcFifo failed
cwmpc_IpcCmdSend:4 failed
DATA ROUTING stop
my_kill: no process to kill[miniupnpd]
miniupnpd_helper.sh: removing rules of miniupnpd...

route: SIOCDELRT: No such process
killall: snmpd: no process killed
    <downloadCommandKey></downloadCommandKey>
[User]Set param wifi_REG_AP value 0
[initSrvSock] Initial REG Server...
[TR069_A4] Daemonizing process
[TR069_A4] dns_lookup ####################################################################################################
DATA ROUTING stop

i think best way is direct reflashing nand flashing.
do u have try flash use TTL? because i want try but idk where tx/rx/gnd. maybe this method can work

yes, but nand flash is expensive LOL. I was able to use USBTTL, but I didn't understand the flash script with TTL; for jumpers with TTL maybe you can try as shown

agree! nand flash tool too expensive.
what's the meaning D+? same like tx?
update, cant read. i must plug power when reading?

Yes, but the best solution by NAND Flash seems. even though the IC file has been loaded, the modem is still reading from Nand Memory.
yes D + = TX
yes, it must be at 5V (maybe with POE)
or you plug the power from Vcc + Gound in the Serial Console (for me it works)

because boot still detect nand as primary boot and it means u ic isnt funcion
i was try read with or without power (with poe), but still havn't read eprom
do u has try this method?

what commands should be typed to delete or insert files with TTL, because I'm confused hehehe
20191119_205456

what do you mean like this? I connected only to TTL without LAN
20191119_205528
*** Warning *** : PCIe WLAN Module not found !!!
In: serial
Out: serial
Err: serial
Net: ag934x_enet_initialize...
4096 bytes read: OK
No valid address in Flash. Using fixed address
4096 bytes read: OK
Fetching MAC Address from 0x87fa3b18
wasp reset mask:c02200
WASP ----> S27 PHY
s27 reg init
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
WASP ----> S27 PHY
s27 reg init lan
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 1c:49:7b:e9:9b:8b
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
131072 bytes read: OK
Setting 0xb8116290 to 0x20402d0f
Hit any key to stop autoboot: 0
ar7240> pl
pll cpu-pll dither ddr-pll dither - Set to change CPU & DDR speed
pll erase
pll get

u need tftpd software for transfering data with LAN cable, read previous link i share. its tutorial for debricking, but i think can be applied for this case.
anw... i still cant reading device with ttl. i was use 3 device (ft232rl, arduino as usb ttl, and ch341a) and 2 OS (windows 10 and debian linux) with or without power (poe or vcc 5v pin)

whats worng? bcs im not inserting ic rom?

I haven't tried it that way, because I'm still confused. whether the srciptnya (standard) command is the same and similar to run on this router (BL400)

I only use USBTLL Prolific PL2303 / DKU 5; CA42 has been modified to run as TTL. windows 7

The stock u-boot should have a way to write to NAND, or at least tftp an image into RAM. u-boot should have a help command that shows what commands are compiled in. Typically you'd start by tftpbooting an initramd image of Openwrt. NAND support has just been added to ath79 target. For example the WNDR4300v1 is AR9344 and NAND.

It'd be a good idea to see if the stock firmware lets you dump the flash partitions and load them out of the device, so you have a backup.

To boot from NOR flash you'd need to set up a resistor strap to tell the ROM in the AR9344 to load from the SPI / NOR chip interface instead of NAND. I don't know exactly how. It seems a little pointless to convert to NOR when you have a large NAND already on board.


i cant give you solution, because i still cant read my device. maybe you can read reference here and here
or you can try @mk24 trick

its mean not yet support with mtk?

how, are there results? :slightly_smiling_face:

still nothing