OpenWrt for Z-Router ZR-2660 Chipset MT7621AT + MT7975 + MT7905

atErik · March 7, 2022, 11:16am

Hi OpenWRT developers & community,
Please help me (and other users) to create openwrt firmware for a WiFi6 AX1800 router with MTK MT7621AT chipset (with other chips MT7975 + MT7905).

Router name : WiFi6 Giga Dual-Band AX1800 Router.
Brand : Z-Router.
Model : ZR-2660.
HW revision : V1.0
SW ver: V1.0.1

Chipset detail info:

(1) MT7621AT , 2139-AMKH , CTPCY166 , DTPCW104.
(2) MT7975DN , 2145-AJCSL , DAP3G994.
(3) MT7905DEN , 2136-BXDAL , CCMCPG78.
(4) 7YK77 , D9PRR , VV6W , M.
Supplied router chips have heatsink attached/glued on them, so i cannot see exact chip numbers.
But when i requested a picture to MFR=manufacturer before HW modifications, then mfr shared PCB top-side picture (without heatsink attached), so i can see some of the chip numbers very clearly.
i can add a PCB bottom side picture later.
3 LAN ports (gigabit) , 1 WAN port (gigabit) , 1 USB 2.0 , 1 reset switch , 1 power-supply port.
Flash ROM in this router is suppose to be NAND based.

FIRMWARE info:

Currently the router has MTK SDK based deeply modified openwrt v15 firmware, loaded by MFR = manufacturer.
This firmware lacks many many standard/vanilla openwrt features & packages & options , No access to openwrt repo , user-interface (UI) is also very different & heavily customized by MTK, etc etc.
So current firmware is pretty much USELESS for any custom or advanced routing functionalities or network tools.

OPENWRT WEBSITE GUIDE/TOOLS:
in OpenWRT website TOH page(s) , i see that
Tenbay KuWfi T-MB5EU router has similar chipset & similar functionality as this "ZR-2660 WiFi6 AX1800" router.
This "ZR-2660 WiFi6 AX1800" router also has some similarity with MR70X router.

i do not have those other routers , so i do not know if PCB is same as this router, or not.
i added picture of this router , who has T-MB5EU or MR70X, is free to compare.
i do not think PCB is same . i think, these manufacturers obtain circuit diagram from similar developer or develops on their own , and as the chipset are same so they will have similar PCB design, but not-exact 100% same , i'm sure each MFR modifies the circuit design on their own to suit with their available component supply & target size, etc, so PCB layout will be different . Their firmware is different / customized , not-only because of slightly different HW component , because some MFR puts their brand name in firmware & UI , customizes it , selects + unselects various options , & there are also some MFR who wud not do huge modification(s) / customization(s) . Unfortunately this router's MFR decided to use the MTK-SDK-OpenWRT based deeply customized openwrt , which now they regret.

i have purchased this "ZR-2660 WiFi6 AX1800" router with a custom order:

i have changed their general router's hardware components : upgraded the RAM ( into 512MB ) and ROM (to 128MB), etc, and added USB 2.0 port & added an UART port.

MANUFACTURER=MFR HAS SHARED SOME TOOLS:

mfr shared tools (with some conditions) in order to help me, so that i'm able to compile and load and run the latest stable standard / vanilla openwrt in this router / PCB.
Per our deal+agreement, manufacturer=MFR would help (aka: provide tools) , to upgrade core mtk-openwrt v15 into standard / vanilla openwrt v21.x or v19.x , and i have to do the compile/load work.

MFR shared these tools:

(1) MTK SDK based MTK-OpenWRT : mtk-openwrt-lede-4.2.1.0-20200612-d2c8e460.tar.xz (991MB),
(2) MT7975 wifi drivers : mt7915_20201106-34067b.tar.xz (8.7MB).
(3a) Few PDF files : MT7621_MT7915D_Build_SOP_20200203.pdf,
(3b) MT7621_ProgrammingGuide_GSW_v01.pdf,
(3c) MT7921LEN_MT7921LUN_MT7921LSN_Datasheet.pdf,
(4) UART-to-USB adapter.
According to MFR , initial mtk-openwrt v15 firmware was developed/compiled in ubuntu.

JTAG:

i know exact contact points where EJTAG connections go in PCB,
but the points are very very micro,
beyond my ability to solder cables from an EJTAG port.

1ST ATTEMPT TO LOAD FIRMWARE:

i have downloaded the T-MB5EU router's firmware from openwrt site,
and tried to upgrade this router from firmware's upgrade UI :
- upgrade process shows checksum is ok,
- but upgrade did not work,
- firmware remained same.

SO WHAT ARE MY OPTIONS TO UPGRADE MFR'S CUSTOM FIRMWARE, INTO LAST STABLE OPENWRT ?

i'm currently using macOS catalina v10.15.7 on a (very) old macbook,
i would like to be able to compile/load from this macOS platform:

see more info on Build on macOS.
i can also run Ubuntu linux inside VirtualBox in this old macbook.

WHAT DEVELOPMENT TOOLS I WOULD NEED IN MACOS ?

i have older Xcode, and Command-Line-Tools in macOS.
more info for macOS is here : Build on macOS.
Package Manager : i do not want to use homebrew (as it steals/shares data for google) , i prefer MacPorts.

WHAT DEPENDENCIES I NEED TO LOAD IN MACOS ?

dependencies aka: prerequisites are mentioned here.

HOW CAN I BACKUP EXISTING FIRMWARE 1st, before loading another ?

WHAT ARE THE BUILD / COMPILE STEPS ?
To build/compile, should i do/apply these below steps ?
( these are specified inside MT7621_MT7915D_Build_SOP_20200203.pdf file )

cmd-01 : tar xvf mtk-openwrt-lede-4.2.0.0-20200203-28cb0822.tar.xz
cmd-02 : tar -xzvf "mt7915_20201106-34067b.tar.xz"
cmd-03 : cp -rf mt7915_20201106-34067b/* mtk-openwrt-lede-4.2.0.0
cmd-04 : cd mtk-openwrt-lede-4.2.0.0
cmd-05 : cp -f autobuild/mt7621-mt7915-AP-AX1800/.config .
cmd-06 : cp -f autobuild/mt7621-mt7915-AP-AX1800/config-4.4 target/linux/ramips/mt7621/config-4.4
cmd-07 : make defconfig
cmd-08 : make V=s

AT WHICH POINT I'M SUPPOSE TO ADD THE LAST STABLE OPENWRT SOURCE INTO ABOVE PROCESS BEFORE USING THE "make" ?
IN WHICH DIRECTORY CAN I PLACE THE LAST STABLE OPENWRT ?

( More info on standard / vanilla openwrt build/compile is here ).

After compile/build, the NAND compatible version suppose to be here:
bin/targets/ramips/mt7621/lede-ramips-mt7621-mt7621-rfb-ax-nand-squashfs-sysupgrade.bin

The MT7621_MT7915D_Build_SOP_20200203.pdf file is also showing this below instruction in it's most bottom side:

cmd : make kernel_menuconfig
but at which point i'm suppose to do that ?
before the cmd-07 or after it ?

HW DRIVERS:

DO I NEED TO EXTRACT ANY DRIVER FILES FROM EXISTING MTK-OPENWRT FIRMWARE SOURCE , TO ADD INTO LAST STABLE/VANILLA/STANDARD OPENWRT ?
if so, from which directory or after which step i can obtain that ?

HOW CAN I UPLOAD THE bin FIRMWARE FILE INTO FLASH MEMORY VIA UART-to-USB ADAPTER ?

more info on uploading firmware into router via UART-to-USB serial adapter : here.

REQUESTS TO DEVS:

Please kindly add/provide DETAIL & helpful answer / response,
so that other users with similar problem/issues,
can also update their such router (which has
MTK SDK based old or deeply modified OpenWRT),
to use last stable openwrt.

Q-and-A:

i have added (some) answer for my own Questions under some Qstn,
if you want to add more/better answer/guidance please do so kindly.
Obviously some questions i could not answer by myself or did not find an answer (with short time search),
so i created this topic,
please HELP & post answer for those unanswered Questions.

Thanks in advance.

atErik · March 7, 2022, 11:19am

for adding further info leter.

nicefile · March 9, 2022, 7:52pm

I have MR1800X (MR70X twin brother) and ported OpenWrt on it . Connect TTL and grab bootlog . Try to figure out reset button GPIO and NAND partition table /proc/mtd. Backup all You can from flash be sure to have factory and bootloader backed up.Consider flash breed bootloader for NAND devices (hiwifi-hc5962/r6220/xiaomi-r3g) It has great debug options and advanced settings like setting up MAC address or Overclocking . My story is here .I even matched existing supported hardware that boot on MR1800X (dir853-r) and require only small adjustments.

atErik · March 17, 2022, 12:23pm

Thank You @nicefile.
i will try to follow your very valuable pointers.
if possible, kindly please elaborate each step you mentioned earlier in your earlier post.

When i rebooted router, after connecting the router with a USB-to-UART serial adapter, then i have received below data as output from this zr-2660 router:
Full log file is here: bootlog_zr-2660-wifi6-ax1800_ash_02.txt
Some portion of data is shown in below from above webpage:

===================================================================
     		MT7621   stage1 code Dec 16 2019 17:45:55 (ASIC)
     		CPU=500000000 HZ BUS=166666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11000000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL2 FB_DL: 0xe, 1/0 = 769/255 39000000
PLL3 FB_DL: 0x12, 1/0 = 625/399 49000000
PLL4 FB_DL: 0x14, 1/0 = 696/328 51000000
DDR patch working
do DDR setting..[01F40000]
Apply DDR3 Setting...(use default AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
      --------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    1    1    1
000E:|    0    0    0    0    0    0    0    0    1    1    1    1    1    1    1    1
000F:|    0    0    0    0    1    1    1    1    1    1    1    1    0    0    0    0
0010:|    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0    0
0011:|    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
DRAMC_DQSCTL1[0e0]=14000000
DRAMC_DQSGCTL[124]=80000000
rank 0 coarse = 16
rank 0 fine = 32
B:|    0    0    0    0    0    0    0    0    0    0    1    1    1    0    0    0
opt_dle value:11
DRAMC_DDR2CTL[07c]=C287223D
DRAMC_PADCTL4[0e4]=000022B3
DRAMC_DQIDLY1[210]=0F0D0C0B
DRAMC_DQIDLY2[214]=0C0D0D0D
DRAMC_DQIDLY3[218]=0E0D0C0B
DRAMC_DQIDLY4[21c]=0B0B0E0B
DRAMC_R0DELDLY[018]=00001C1D
==================================================================
		RX	DQS perbit delay software calibration 
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    10 11 11 15 11 12 11 12 10 10 
10 |    12 11 11 12 11 11 
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center 
y=0-7bit DQ of every group
input delay:DQS0 =29 DQS1 = 28
==================================================================
bit	DQS0	 bit      DQS1
0  (1~55)28  8  (1~54)27
1  (1~55)28  9  (1~52)26
2  (1~54)27  10  (1~54)27
3  (0~56)28  11  (1~50)25
4  (1~54)27  12  (2~54)28
5  (1~56)28  13  (1~52)26
6  (1~54)27  14  (1~56)28
7  (1~57)29  15  (2~54)28
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    11 12 13 15 13 13 13 12 11 12 
10 |    13 14 11 14 11 11 
==================================================================
==================================================================
     TX  perbyte calibration 
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000 
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 
DQ loop=15, cmp_err_1 = ffff019a
DQ loop=14, cmp_err_1 = ffff0180
DQ loop=13, cmp_err_1 = ffff0100
dqs_perbyte_dly.last_dqdly_pass[0]=13,  finish count=1 
DQ loop=12, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[1]=12,  finish count=2 
byte:0, (DQS,DQ)=(9,8)
byte:1, (DQS,DQ)=(9,8)
DRAMC_DQODLY1[200]=88888888
DRAMC_DQODLY2[204]=88888888
20,data:99
[EMI] DRAMC calibration passed

===================================================================
     		MT7621   stage1 code done 
     		CPU=500000000 HZ BUS=166666666 HZ
===================================================================

U-Boot SPL 2018.09 (Dec 14 2021 - 10:37:04 +0800)
Trying to boot from NAND

Initializing NMBM ...
Signature found at block 1023 [0x07fe0000]
First info table with writecount 2 found in block 960
Second info table with writecount 2 found in block 963
NMBM has been successfully attached


U-Boot 2018.09 (Feb 21 2022 - 22:51:43 +0800)

CPU:   MediaTek MT7621AT ver 1, eco 3
Clocks: CPU: 880MHz, DDR: 1200MHz, Bus: 220MHz, XTAL: 40MHz
Model: MediaTek MT7621 reference board (NAND)
DRAM:  448 MiB
NAND:  128 MiB

Initializing NMBM ...
Signature found at block 1023 [0x07fe0000]
First info table with writecount 2 found in block 960
Second info table with writecount 2 found in block 963
NMBM has been successfully attached

Loading Environment from NMBM... *** Warning - bad CRC, using default environment

In:    uartlite0@1e000c00
Out:   uartlite0@1e000c00
Err:   uartlite0@1e000c00
Net:   
Warning: eth@1e100000 (eth0) using random MAC address - HH:HH:HH:37:33:bc
eth0: eth@1e100000
Hit any key to stop autoboot:  0 


  *** U-Boot Boot Menu ***

     1. Startup system (Default)
     2. Upgrade firmware
     3. Upgrade bootloader
     4. Upgrade bootloader (advanced mode)
     5. Load image
     0. U-Boot console


  Press UP/DOWN to move, ENTER to select


Loading FIT image at offset 0x180000 to memory 0x80010000, size 0x371ce0 ...
Automatic boot of image at addr 0x80010000 ...
## Loading kernel from FIT Image at 80010000 ...
   Using 'config@1' configuration
   Trying 'kernel@1' kernel subimage
     Description:  MIPS OpenWrt Linux-4.4.198
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x800100e4
     Data Size:    3599197 Bytes = 3.4 MiB
     Architecture: MIPS
     OS:           Linux
     Load Address: 0x81001000
     Entry Point:  0x81001000
     Hash algo:    crc32
     Hash value:   ef214bf9
     Hash algo:    sha1
     Hash value:   3622867a3961ae8e0edb8879a1a1105a9a5a5670
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 80010000 ...
   Using 'config@1' configuration
   Trying 'fdt@1' fdt subimage
     Description:  MIPS OpenWrt mt7621-rfb-ax-nand device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x8037ed88
     Data Size:    11312 Bytes = 11 KiB
     Architecture: MIPS
     Hash algo:    crc32
     Hash value:   9eca7c0d
     Hash algo:    sha1
     Hash value:   9c787b74f6ea45cbc6bcb4b4a3bd8e00511eb924
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x8037ed88
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 9be77000, end 9be7cc2f ... OK
[ 0.000000] Linux version 4.4.198 (root@devname) (gcc version 5.4.0 (LEDE GCC 5.4.0 r0-e88ba24) ) #0 SMP Thu Feb 24 05:17:04 UTC 2022
[ 0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[ 0.000000] MIPS: machine is MediaTek MT7621 RFB (802.11ax,NAND)
[ 0.000000] Determined physical RAM map:
[ 0.000000]  memory: 1c000000 @ 00000000 (usable)
[ 0.000000]  memory: 04000000 @ 20000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000]   DMA      [mem 0x0000000000000000-0x0000000000ffffff]
[ 0.000000]   Normal   [mem 0x0000000001000000-0x000000000fffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000]   node   0: [mem 0x0000000000000000-0x000000000fffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[ 0.000000] VPE topology {2,2} total 4
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[ 0.000000] PERCPU: Embedded 10 pages/cpu @81f5a000 s8544 r8192 d24224 u40960
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
[ 0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Writing ErrCtl register=0004064f
[ 0.000000] Readback ErrCtl register=0004064f
[ 0.000000] Memory: 246048K/262144K available (7394K kernel code, 4025K rwdata, 1744K rodata, 200K init, 223K bss, 16096K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] Hierarchical RCU implementation.
[ 0.000000] NR_IRQS:256
[ 0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns
.. : MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns
[ 0.000009] sched_clock: 32 bits at 440MHz, resolution 2ns, wraps every 4880645118ns
[ 0.007777] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[ 0.070403] pid_max: default: 32768 minimum: 301
[ 0.075122] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.081647] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
...
...
[ 0.365582] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.375382] futex hash table entries: 1024 (order: 3, 32768 bytes)
[ 0.381660] pinctrl core: initialized pinctrl subsystem
[ 0.388265] NET: Registered protocol family 16
[ 0.427196] mt7621_gpio 1e000600.gpio: registering 32 gpios
...
[ 0.444520] mt7621-pci 1e140000.pcie: Failed to get gpio for PCIe1
[ 0.450633] mt7621-pci 1e140000.pcie: Failed to get gpio for PCIe2
[ 0.657114] PCIe port 2 link down
[ 0.660346] PCI coherence region base: 0x60000000, mask/settings: 0xf0000002
[ 0.700178] PCI host bridge to bus 0000:00
[ 0.704211] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
, [io  0x1e160000-0x1e16ffff]
, [??? 0x00000000 flags 0x0]
[ 0.724687] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.733382] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 0.741346] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 0.750826] pci 0000:00:00.0: BAR 9: assigned [mem 0x60000000-0x601fffff pref]
[ 0.757998] pci 0000:00:01.0: BAR 9: assigned [mem 0x60200000-0x603fffff pref]
[ 0.765111] pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff]
[ 0.771877] pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff]
[ 0.778608] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit pref]
[ 0.786324] pci 0000:01:00.0: BAR 2: assigned [mem 0x60100000-0x60103fff 64bit pref]
[ 0.793995] pci 0000:01:00.0: BAR 4: assigned [mem 0x60104000-0x60104fff 64bit pref]
[ 0.801692] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 0.806588] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x601fffff pref]
[ 0.813782] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff 64bit pref]
[ 0.821470] pci 0000:02:00.0: BAR 2: assigned [mem 0x60300000-0x60303fff 64bit pref]
[ 0.829171] pci 0000:02:00.0: BAR 4: assigned [mem 0x60304000-0x60304fff 64bit pref]
[ 0.836838] pci 0000:00:01.0: PCI bridge to [bus 02]
[ 0.841769] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x603fffff pref]
[ 0.850698] clocksource: Switched to clocksource GIC
[ 0.857665] NET: Registered protocol family 2
[ 0.862655] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.869541] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.876007] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.882373] UDP hash table entries: 256 (order: 1, 8192 bytes)
[ 0.888121] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[ 0.894689] NET: Registered protocol family 1
[ 0.913238] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.918994] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.932340] io scheduler noop registered
[ 0.936184] io scheduler deadline registered (default)
[ 0.942984] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[ 0.950327] console [ttyS0] disabled
[ 0.953914] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 33, base_baud = 3125000) is a 16550A
[ 0.962896] console [ttyS0] enabled
[ 0.962896] console [ttyS0] enabled
[ 0.969786] bootconsole [early0] disabled
[ 0.969786] bootconsole [early0] disabled
[ 0.978246] 1e000d00.uartfull: ttyS1 at MMIO 0x1e000d00 (irq = 34, base_baud = 3125000) is a 16550A
[ 0.987749] 1e000e00.uartfull: ttyS2 at MMIO 0x1e000e00 (irq = 35, base_baud = 3125000) is a 16550A
[ 0.999432] libphy: Fixed MDIO Bus: probed
[ 1.060989] libphy: mdio: probed
[ 1.064775] mtk_soc_eth 1e100000.ethernet: generated random MAC address HH:HH:HH:ea:03:78
..ethernet: connected mac 0 to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
..ethernet eth0: mediatek frame engine at 0xbe100000, irq 10
..ethernet: generated random MAC address HH:HH:HH:5e:54:9d
..ethernet: connected mac 1 to PHY at fixed-0:01 [uid=00000000, driver=Generic PHY]
..ethernet eth1: mediatek frame engine at 0xbe100000, irq 10
[ 1.121633] register mt_drv
[ 1.124621] <--mt7916_hif_init()
[ 1.128356] Rx[0] Ring: total 24576 bytes allocated
[ 1.137569] Rx[1] Ring: total 16384 bytes allocated
[ 1.142590] <-- pci_alloc_tx_rx_ring_mem, Status=0
[ 1.180517] 
[ 1.180517] 
[ 1.180517] === pAd = c0301000, size = 13363360 ===
[ 1.180517] 
[ 1.191446] <-- RTMPAllocAdapterBlock, Status=0
[ 1.195996] PCI CSRBaseAddress =0xc0200000, csr_addr=0xc0200000!
[ 1.202034] RTMPInitPCIeDevice():device_id=0x7915
[ 1.206743] mt7915_init()-->
[ 1.209618] Use the default iPAiLNA bin image!
[ 1.214157] <--mt7915_init()
[ 1.217336] RtmpOSFileOpen(): Error 2 opening /etc/wireless/l1profile.dat
[ 1.225137] wdev_init(caller:RTMP_COM_IoctlHandle+0x39c/0x18a4), wdev(0)
[ 1.232788] Rx[0] Ring: total 24576 bytes allocated
[ 1.237830] Rx[1] Ring: total 24576 bytes allocated
[ 1.245050] Rx[2] Ring: total 8192 bytes allocated
[ 1.254158] Rx[3] Ring: total 16384 bytes allocated
[ 1.261414] Rx[4] Ring: total 8192 bytes allocated
[ 1.266263] <-- pci_alloc_tx_rx_ring_mem, Status=0
[ 1.272943] mt7621_wdt 1e000100.wdt: Initialized
[ 1.279168] NET: Registered protocol family 10
[ 1.285160] NET: Registered protocol family 17
[ 1.289695] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[ 1.302348] 8021q: 802.1Q VLAN Support v1.8
[ 1.308964] mtkmips-pinmux pinctrl: spi is already enabled
[ 1.314540] mtk-nand 1e003000.nand: Error applying setting, reverse things back
[ 1.322374] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xf1
.. : Macronix MX30LF1G18AC
.. : 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[ 1.340835] Scanning device for bad blocks
[ 2.783728] Bad eraseblock 878 at 0x000006dc0000
[ 3.025818] 7 ofpart partitions found on MTD device mtk-nand
[ 3.031499] Creating 7 MTD partitions on "mtk-nand":
[ 3.036469] 0x000000000000-0x000000080000 : "Bootloader"
[ 3.043287] 0x000000080000-0x000000100000 : "Config"
[ 3.049584] 0x000000100000-0x000000180000 : "Factory"
[ 3.055999] 0x000000180000-0x000005980000 : "firmware"
[ 3.642275] 2 fit-fw partitions found on MTD device firmware
[ 3.647955] 0x000000180000-0x000000500000 : "kernel"
[ 3.654394] 0x000000500000-0x000005980000 : "rootfs"
[ 3.661401] mtd: device 5 (rootfs) set to be root filesystem
[ 3.667254] 1 squashfs-split partitions found on MTD device rootfs
[ 3.673463] 0x000000fa0000-0x000005980000 : "rootfs_data"
[ 3.680829] 0x000005980000-0x000007980000 : "firmware_backup"
[ 3.688133] 0x000007b00000-0x000007c00000 : "zrsave"
[ 3.694445] 0x000007c00000-0x000007d00000 : "config2"
[ 3.740819] mt753x gsw: Switch is MediaTek MT7530 rev 1
[ 3.767541] libphy: mt753x_mdio: probed
[ 3.779884] hctosys: unable to open rtc device (rtc0)
[ 3.793975] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[ 3.801595] Freeing unused kernel memory: 200K
[ 3.806048] This architecture does not have kernel memory protection.
[ 4.574373] init: Console is alive
.. : - watchdog -
[ 6.017073] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 6.143704] usbcore: registered new interface driver usbfs
, interface driver hub
, device driver usb
[ 6.190855] SCSI subsystem initialized
[ 6.206165] 1e1c0000.usb supply vbus not found, using dummy regulator
[ 6.212782] 1e1c0000.usb supply vusb33 not found, using dummy regulator
[ 6.230709] xhci-mtk 1e1c0000.usb: xHCI Host Controller
..usb: new USB bus registered, assigned bus number 1
..usb: hcc params 0x01401198 hci version 0x96 quirks 0x00210010
[ 6.259322] xhci-mtk 1e1c0000.usb: irq 29, io mem 0x1e1c0000
[ 6.265947] hub 1-0:1.0: USB hub found
.. : 2 ports detected
[ 6.274260] xhci-mtk 1e1c0000.usb: xHCI Host Controller
[ 6.279500] xhci-mtk 1e1c0000.usb: new USB bus registered, assigned bus number 2
[ 6.287040] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[ 6.295987] hub 2-0:1.0: USB hub found
.. : 1 port detected
[ 6.317149] usbcore: registered new interface driver usb-storage
[ 6.325453] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 6.350973] init: - preinit -
[ 7.197862] random: jshn: uninitialized urandom read (4 bytes read, 29 bits of entropy available)
...
sendto(): Network unreachable
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[12.447733] mount_root: loading kmods from internal overlay
[12.495333] kmodloader: loading kernel modules from //etc/modules-boot.d/*
.. : done loading kernel modules from //etc/modules-boot.d/*
[12.766156] block: attempting to load /etc/config/fstab
.. : unable to load configuration (fstab: Entry not found)
.. : no usable configuration
[16.145196] jffs2: notice: (530) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[16.169994] mount_root: loading kmods from internal overlay
[16.217062] kmodloader: loading kernel modules from /tmp/overlay/upper/etc/modules-boot.d/*
.. : done loading kernel modules from /tmp/overlay/upper/etc/modules-boot.d/*
[16.490351] block: attempting to load /etc/config/fstab
.. : unable to load configuration (fstab: Entry not found)
.. : no usable configuration
[16.509049] mount_root: switching to jffs2 overlay
[16.527586] urandom-seed: Seed file not found (/etc/urandom.seed)
[16.749457] procd: - early -
.. : - watchdog -
.. : - watchdog -
.. : - ubus -
[17.529424] random: ubusd: uninitialized urandom read (4 bytes read, 74 bits of entropy available)
...
...
[17.684660] procd: - init -
Please press Enter to activate this console.
[18.306056] kmodloader: loading kernel modules from /etc/modules.d/*
[18.336552] l2tp_core: L2TP core driver, V2.0
[18.342200] l2tp_netlink: L2TP netlink interface
[18.352580] gre: GRE over IPv4 demultiplexor driver
[18.358997] ip_gre: GRE over IPv4 tunneling driver
[18.373019] ip6_tables: (C) 2000-2006 Netfilter Core Team
[18.387905] Netfilter messages via NETLINK v0.30.
[18.396686] ip_set: protocol 6
[18.442539] u32 classifier
[18.445267]     input device check on
[18.448928]     Actions configured
[18.454406] Mirror/redirect action on
[18.526530] nf_conntrack version 0.5.0 (3847 buckets, 15388 max)
[18.571741] fuse init (API version 7.23)
[18.596217] Bluetooth: Core ver 2.21
[18.599941] NET: Registered protocol family 31
[18.604444] Bluetooth: HCI device and connection manager initialized
.. : HCI socket layer initialized
.. : L2CAP socket layer initialized
.. : SCO socket layer initialized
[18.627519] Bridge firewalling registered
[18.633906] [btmtk_info] main_driver_init, BTMTK uart version: 7.0.20102101
.. : btmtk_cif_register
.. : uart_register
.. : uart_register done
.. : btmtk_cif_register: Done
.. : btmtk_fops_init: Start
.. : btmtk_fops_init: g_fwlog init
[18.668146] Bluetooth: btmtk_fops_init: BT_majorfwlog 252, devIDfwlog 264241152
[18.675519] [btmtk_info] main_driver_init: Done
[18.683086] mtk-eip93 1e004000.crypto: Assigning IRQ: 26
, ..crypto: Init succesfull
[18.715609] Ebtables v2.0 registered
[18.722070] ip_tables: (C) 2000-2006 Netfilter Core Team
[18.733266] Current mapfilter version v2.0.2
[18.738998] -->mtfwd_init(ver:1.0)<--
[18.892370] usbcore: registered new interface driver ums-alauda
, ums-cypress
, ums-datafab
, ums-freecom
, ums-isd200
, ums-jumpshot
, ums-karma
, ums-sddr09
, ums-sddr55
, ums-usbat
, usblp
[19.027807] xt_time: kernel timezone is -0000
[19.035102] usbcore: registered new interface driver asix
, ax88179_178a
[19.066471] PPP generic driver version 2.4.2
[19.072618] PPP MPPE Compression module registered
[19.078918] NET: Registered protocol family 24
[19.084948] PPTP driver version 0.8.5
[19.093524] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[19.101689] kmodloader: done loading kernel modules from /etc/modules.d/*
[19.592785] random: nonblocking pool is initialized
[22.104395] [mtfwd] update eth interface eth0
[23.932243] mediatek_soc_hnat 1e100000.hnat: wan = eth1
.. : lan = eth0
.. : ppd = eth0
.. : gmac num = 2
[23.953767] mediatek_soc_hnat 1e100000.hnat: ext devices = rax0
, ra0
, rax1
, ra1
, rax2
, ra2
, rax3
, ra3
, apclix0
, apcli0
[24.015525] mediatek_soc_hnat 1e100000.hnat: FOE entry number = 8192
..hnat: hwnat start
[27.648205] device eth0 entered promiscuous mode
[27.656174] br-lan: port 1(eth0) entered forwarding state
...
[29.117690] ra0: ===> main_virtual_if_open
[29.121901] RTMP_COM_IoctlHandle -> CMD_RTPRIV_IOCTL_VIRTUAL_INF_INIT
[29.129280] load l1profile succeed!
[29.132914] mt_service_open: wlan service opens successfully!
[29.144309] APWdsInitialize():WdsEntry[0~15]
[29.349491] [multi_profile_merge_5g_only] DBDC_MODE=1
[29.375555] WdsEnable is unknow(0;0;0;0)
...
[29.405088] multi-profile merge success, en:1,pf1_num:5,pf2_num:4,total:9
[29.412010] Open file "/etc/wireless/mediatek/DBDC_card0.dat" to store DBDC cfg! (23)
[29.452584] Write file "/etc/wireless/mediatek/DBDC_card0.dat" success (size=9153)!
[29.461226] BssidNum=9
[29.463606] Pf2MbssIdxMap:
[29.466370]  0  1  2  3  4  5  6  7  8 
[29.472734] MacAddress5 = 00:00:00:00:00:00
[29.479499] E2pAccessMode=2
[29.483174] SSID[0]=atErik-AEF3, EdcaIdx=0
[29.487146] SSID[1]=atErik-AEF3-2, EdcaIdx=0
[29.491456] SSID[2]=atErik-AEF3-3, EdcaIdx=0
[29.495760] SSID[3]=atErik-AEF3-4, EdcaIdx=0
[29.499970] SSID[4]=CMCC-ATERIK, EdcaIdx=0
[29.504606] SSID[5]=atErik-AEF3-5G, EdcaIdx=0
[29.509025] SSID[6]=atErik-AEF3-5G-2, EdcaIdx=0
[29.513564] SSID[7]=atErik-AEF3-5G-3, EdcaIdx=0
[29.518148] SSID[8]=atErik-AEF3-5G-4, EdcaIdx=0
[29.522989] RTMPSetProfileParameters(): DBDC Mode=1, eDBDC_mode = 1
[29.530320] cfg_mode=16
...
[29.537814] wmode_band_equal(): Band Equal!
...
[29.584816] auto_ch_select_set_cfg(): BandIdx0, AutoChannelAtBootup=1, AutoChannelAlg = 3
.. : BandIdx1, AutoChannelAtBootup=1, AutoChannelAlg = 3
[29.601969] Index0 Channel=0
[29.604882] Index1 Channel=0
[29.609971] BandSteering=0
[29.613139] BndStrgBssIdx=1;0;0;0;0;1;0;0;0
[29.617963] [TxPower] BAND0: 100, BAND1: 100
[29.632846] [SKUenable] BAND0: 0, BAND1: 0
[29.637318] [SkuTableIdx]: 0
[29.640716] [CCKTxStream] BAND0: 4, BAND1: 0
[29.645654] [PERCENTAGEenable] BAND0: 1, BAND1: 1
[29.651017] [BFBACKOFFenable] BAND0: 0, BAND1: 0
[29.656203] [Disable160RuMu] BAND0: 1, BAND1: 1
[29.660716] br-lan: port 1(eth0) entered forwarding state
[29.666830] [MaxRuOfdma] BAND0: 8, BAND1: 8
[29.671436] [MaxDLMuMimo] BAND0: 2, BAND1: 2
..] BAND0: 2, BAND1: 2
[29.682338] profile: FragThreshold[0]=2346
...
[29.715512] profile: FragThreshold[8]=2346
[29.720609] APEdca0
[29.723144] Valid=1
[29.725251] APAifsn[0]=3
.. [1]=7
.. [2]=1
.. [3]=1
[29.735545] APEdca1
[29.738173] Valid=1
[29.740296] APAifsn[0]=3
.. [1]=7
.. [2]=1
.. [3]=1
[29.750746] APEdca2
[29.753489] APEdca3
[29.774488] BSSAifsn[0]=3
.. [1]=7
.. [2]=2
.. [3]=2
...
[29.877493] UAPSDCapable[0]=1
...
[29.898541] UAPSDCapable[7]=1
[29.901547] default ApCliUAPSDCapable[0]=1
[29.905649] default ApCliUAPSDCapable[1]=1
[29.912303] DfsZeroWait Support=0/0
[29.918890] DfsZeroWaitCacTime=255/255
[29.924135] read_itxbf: ITxBfEn = 0
.. : BSSID[0]
.. : MBSS[0] ITxBfEn = 0
...
[30.013091] read_itxbf: ITxBfEn = 1
.. : BSSID[8]
.. : MBSS[8] ITxBfEn = 1
.. : Common.ITxBfEn = 1
[30.028957] read_etxbf: ETxBfEnCond = 1
.. : BSSID[0]
.. : MBSS[0] ETxBfEnCond = 1
...
[30.123991] read_etxbf: ETxBfEnCond = 1
.. : BSSID[8]
.. : MBSS[8] ETxBfEnCond = 1
[30.136547] HeraStbcPriority[0] = 0
[30.140097] HeraStbcPriority[1] = 0
[30.146641] MBSS[0] MuOfdmaDlEnable = 1
...
[30.177832] MBSS[8] MuOfdmaDlEnable = 1
[30.182185] MBSS[0] MuOfdmaUlEnable = 0
...
[30.213514] MBSS[8] MuOfdmaUlEnable = 1
[30.217987] MBSS[0] MuMimoDlEnable = 1
...
[30.248465] MBSS[8] MuMimoDlEnable = 1
[30.252889] MBSS[0] MuMimoUlEnable = 0
...
[30.283627] MBSS[8] MuMimoUlEnable = 1
[30.287879] [RTMPSetProfileParameters]Disable DFS/Zero wait=0/0
[30.352473] [PMF]Set_PMFMFPC_Proc:: apidx=0, Desired MFPC=0
...
[30.397532] [PMF]Set_PMFMFPC_Proc:: apidx=8, Desired MFPC=0
.. :: apidx=0, Desired MFPR=0
...
[30.448409] [PMF]Set_PMFMFPR_Proc:: apidx=8, Desired MFPR=0
[30.454363] [PMF]Set_PMFSHA256_Proc:: apidx=0, Desired PMFSHA256=0
...
[30.504105] [PMF]Set_PMFSHA256_Proc:: apidx=8, Desired PMFSHA256=0
[30.512078] ReadMboParameterFromFile::(bMboEnable[0]=1, MboCapIndication = 0x40)
...
[30.571776] ReadMboParameterFromFile::(bMboEnable[8]=1, MboCapIndication = 0x40)
.. ::(bMboEnable[0]=1)
.. ::(bMboEnable[1]=1)
[30.590593] MAP_MODE=0
[30.598120] ApCliEntry[0].Enable=0
[30.601587] ApCliEntry[1].Enable=0
[30.611044] APCLI[0] ApCliMuOfdmaDlEnable = 1
[30.615424] APCLI[1] ApCliMuOfdmaDlEnable = 1
[30.620179] APCLI[0] ApCliMuOfdmaUlEnable = 0
[30.624596] APCLI[1] ApCliMuOfdmaUlEnable = 0
[30.629403] APCLI[0] ApCliMuMimoDlEnable = 0
[30.633777] APCLI[1] ApCliMuMimoDlEnable = 0
[30.638523] APCLI[0] ApCliMuMimoUlEnable = 0
[30.642863] APCLI[1] ApCliMuMimoUlEnable = 0
[30.647618] rtmp_read_wds_from_file(): WDS Profile
[30.652937] WDS Number: band[0]=0, band[1]=0
[30.657683] WDS-Enable mode=0
[30.660714] WDS-Enable mode=0
[30.664607] If/wds0 - PeerPhyMode=0xb1
[30.668374] If/wds1 - PeerPhyMode=0xb1
[30.673359] AsicSetReptFuncEnable, caller:RTMPSetProfileParameters+0xbc5c/0x1144c
[30.680901] RepeaterCtrlExit, wrong state(0,0)
[30.685368] Band_0_RpEn(0),RpEnByAnyBnd(0),RpEn(0)
[30.690209] AndesSendCmdMsg: Could not send in band command due to diablefRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD
.. : Command type = ed, Extension command type = 48
[30.707086] MACRepeaterEn=0 Band=0
[30.710538] AsicSetReptFuncEnable, caller:RTMPSetProfileParameters+0xbc5c/0x1144c
[30.718108] RepeaterCtrlExit, wrong state(0,0)
[30.722630] Band_1_RpEn(0),RpEnByAnyBnd(0),RpEn(0)
[30.727462] AndesSendCmdMsg: Could not send in band command due to diablefRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD
.. : Command type = ed, Extension command type = 48
[30.744342] MACRepeaterEn=0 Band=1
[30.755376] HT_BAWinSize: wdev[0]: (TX=256, RX=256)
...
[30.794841] HT_BAWinSize: wdev[8]: (TX=256, RX=256)
[30.801070] HT: WDEV[0] Ext Channel = ABOVE
...
[30.834836] HT: WDEV[8] Ext Channel = ABOVE
[30.839665] HT: greenap_cap = 0
[30.843156] ChipI=7915, Value=0, pcie_aspm in profile=0
[30.848812] 0:ra0 TWTsupport = 0
[30.852128] 1:(null) TWTsupport = 0
...
[30.876792] 8:(null) TWTsupport = 0
[30.979600] ICapMode = 0
[30.994554] KernelRps --> 1
[31.002502] WtcSetMaxStaNum: MaxStaNum:229, BssidNum:9, WdsNum:16, MSTANum:1, MaxNumChipRept:32, MinMcastWcid:278
[31.012883] Top Init Done!
[31.015637] Use dev_alloc_skb
[31.018626] token_tx_two_queues_init(): ct sw token(0) number = 2048
, token que(0) inited done!id_head/tail=0/2048
, 8d249404,8d249404
, ct sw token(1) number = 6144
, token que(1) inited done!id_head/tail=0/6144
, 8d2494ac,8d2494ac
[31.064720] TxRing[0]: attr:0, total 2048 entry initialized
[31.074321] TxRing[1]: attr:0, total 2048 entry initialized
[31.084332] TxRing[2]: attr:0, total 2048 entry initialized
[31.090156] RX[0] DESC a0c28000 size = 24576
...
[31.122553] RX[6] DESC a0db6000 size = 8192
[31.127549] -->TX_RING_0[0xd9330]: Attr:0, Base=0xc20000, Cnt=2048!
[31.133880] -->TX_RING_1[0xd5420]: Attr:0, Base=0xdb8000, Cnt=2048!
[31.140155] -->TX_RING_2[0xd5430]: Attr:0, Base=0xdc0000, Cnt=2048!
[31.146463] -->TX_RING_3[0xd5400]: Attr:3, Base=0xda9000, Cnt=128!
[31.152719] -->TX_RING_4[0xd5410]: Attr:2, Base=0xdaa000, Cnt=256!
[31.158933] -->TX_RING_5[0xd5440]: Attr:1, Base=0xdab000, Cnt=256!
[31.165171] -->RX_RING_0[0xd8510]: Base=0xc28000, Cnt=1536
[31.170697] -->RX_RING_1[0xd9520]: Base=0xc1c000, Cnt=1024
[31.176224] -->RX_RING_2[0xd4500]: Base=0xdc8000, Cnt=1536
[31.181775] -->RX_RING_3[0xd4510]: Base=0xdd0000, Cnt=10
[31.187117] -->RX_RING_4[0xd5500]: Base=0xdb4000, Cnt=512
[31.192582] -->RX_RING_5[0xd5510]: Base=0xde8000, Cnt=1024
[31.198078] -->RX_RING_6[0xd5520]: Base=0xdb6000, Cnt=512
[31.203503] Hif Init Done!
...

see next post.

in above webpage, the output from router, i have changed some hex-digits (a to f) into H, to mask actual MAC address:
?4:?5:?c:80:00:11 -> H4:H5:Hc:80:00:11
?2:?5:?c:80:00:11 -> H2:H5:Hc:80:00:11
?E:?5:?c:80:00:11 -> HE:H5:Hc:80:00:11
the ? or H is any 1 of these 16 hex-digits: 0 1 2 3 4 5 6 7 8 9 A B C D E F.

( i have already masked some sensitive data, but if submitted data in above, still has any private or sensitive data, then requesting to openwrt forum admin/mod: please mask them, thanks in advance )

atErik · March 17, 2022, 12:35pm

(see previous post, for earlier data)
...
[65.462671] Set_MapR2_Proc: MAP R2 is enabled
[65.470404] Set_MapTS_Proc: MAP TS is enabled
[65.485764] Set_MapR2_Proc MAP R2 is already enabled
[65.494229] Set_MapTS_Proc MAP TS is already enabled
[65.511796] Set_Map_Proc current MAP MODE is 0
[65.840860] ap_ftkd> FT_KDP_CryptKeySet: FT KDP is not init!



BusyBox v1.25.1 () built-in shell (ash)

     _________
    /        /\      _    ___ ___  ___
   /  LE    /  \    | |  | __|   \| __|
  /    DE  /    \   | |__| _|| |) | _|
 /________/  LE  \  |____|___|___/|___|                      lede-project.org
 \        \   DE /
  \    LE  \    /  -----------------------------------------------------------
   \  DE    \  /    Reboot (17.01-SNAPSHOT, r0-e88ba24)
    \________\/    -----------------------------------------------------------

telecomadmin@LEDE:/#

Here are few other commands & their output, from ASH shell:

telecomadmin@LEDE:/#  cat /proc/mtd
dev: 	size 		erasesize 	name
mtd0: 	00080000 	00020000 	"Bootloader"
mtd1: 	00080000 	00020000 	"Config"
mtd2: 	00080000 	00020000 	"Factory"
mtd3: 	05800000 	00020000 	"firmware"
mtd4: 	00380000 	00020000 	"kernel"
mtd5: 	05480000 	00020000 	"rootfs"
mtd6: 	049e0000 	00020000 	"rootfs_data"
mtd7: 	02000000 	00020000 	"firmware_backup"
mtd8: 	00100000 	00020000 	"zrsave"
mtd9: 	00100000 	00020000 	"config2"

i have kept all LAN & WAN ethernet cables disconnected from router's LAN / WAN ports during router reboot, then collected below data from ASH shell:

telecomadmin@LEDE:/#  ifconfig -a
apcli0    Link encap:Ethernet  HWaddr H2:H5:HC:80:00:11  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

apclix0   Link encap:Ethernet  HWaddr HE:H5:HC:80:00:11  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br-lan    Link encap:Ethernet  HWaddr H4:H5:HC:80:00:10  
          inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fe80::H6H5:Hcff:fe80:10/64 Scope:Link
          inet6 addr: fd18:9741:4531::1/60 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:17 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:2544 (2.4 KiB)

eth0      Link encap:Ethernet  HWaddr H4:H5:HC:80:00:10  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:17 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:2850 (2.7 KiB)
          Interrupt:10 

eth1      Link encap:Ethernet  HWaddr H4:H5:HC:80:00:01  
          inet6 addr: fe80::H6H5:Hcff:fe80:1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:823 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:283182 (276.5 KiB)
          Interrupt:10 

gre0      Link encap:UNSPEC  HWaddr 00-00-00-00-66-65-38-30-00-00-00-00-00-00-00-00  
          NOARP  MTU:1476  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

gretap0   Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1462  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ifb0      Link encap:Ethernet  HWaddr 4A:FH:FH:BH:60:5D  
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ifb1      Link encap:Ethernet  HWaddr AE:DH:0H:EH:32:5D  
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:4024 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4024 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:238248 (232.6 KiB)  TX bytes:238248 (232.6 KiB)

ra0       Link encap:Ethernet  HWaddr H4:H5:HC:80:00:11  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:31 

ra1       Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ra2       Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ra3       Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ra4       Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

rax0      Link encap:Ethernet  HWaddr H4:H5:HC:80:00:12  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

rax1      Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

rax2      Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

rax3      Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

teql0     Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

When i connected with router via serial cable/adapter, after the router completed reboot process, then i noticed a different/OTHER shell interface appeared inside the terminal emulation communication tool, see below:

=> 
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootmenu- ANSI terminal bootmenu
bootp   - boot image via network using BOOTP/TFTP protocol
chpart  - change active partition
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
echo    - echo args to console
editenv - edit environment variable
env     - environment handling commands
fdt     - flattened device tree utility commands
go      - start application at address 'addr'
gpio    - query and control gpio pins
help    - print command description/usage
iminfo  - print header information for application image
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loadx   - load binary file over serial line (xmodem mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mtkautoboot- Display MediaTek bootmenu
mtkboardboot- Boot MT7621 firmware
mtkload - MTK image loading utility
mtkupgrade- MTK firmware/bootloader upgrading utility
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
nmbm    - NMBM utility commands
printenv- print environment variables
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
setexpr - set environment variable as the result of eval expression
sleep   - delay execution for some time
source  - run script from memory
tftpboot- boot image via network using TFTP protocol
version - print monitor, compiler and linker version

user "nicefile" has pointed out later, that, above is the BOOTLOADER shell,
it displays a line with =>, that is the command prompt line.

i have tried few commands inside BOOTLOADER shell instance, & received slightly different output, see below:

=> bdinfo
boot_params = 0x9BE8B010
memstart    = 0x80000000
memsize     = 0x1C000000
flashstart  = 0x00000000
flashsize   = 0x00000000
flashoffset = 0x00000000
ethaddr     = (not set)
IP addr     = 192.168.1.1
baudrate    = 115200 bps
relocaddr   = 0x9BFA0000
reloc off   = 0x1BDA0000

Here is version command's output, ( from BOOTLOADER shell ):

=> version
U-Boot 2018.09 (Feb 21 2022 - 22:51:43 +0800)

mipsel-linux-gcc (Buildroot 2014.11) 4.9.2
GNU ld (GNU Binutils) 2.24

And here is info on partitions in memory, ( from BOOTLOADER shell ):

=> mtdparts

device nmbm0 <nmbm0>, # parts = 4
 #: name		size		offset		mask_flags
 0: u-boot              0x00080000	0x00000000	0
 1: u-boot-env          0x00080000	0x00080000	0
 2: factory             0x00080000	0x00100000	0
 3: firmware            0x07680000	0x00180000	0

active partition: nmbm0,0 - (u-boot) 0x00080000 @ 0x00000000

defaults:
mtdids  : nmbm0=nmbm0
mtdparts: mtdparts=nmbm0:512k(u-boot),512k(u-boot-env),512k(factory),-(firmware)

notice inside above output from bootloader shell , the mtd # 4 to # 9 are not-shown !!

console info, ( from BOOTLOADER shell ):

=> coninfo
List of available devices:
uartlite0@1e000c00 00000007 IO stdin stdout stderr 
serial   00000003 IO

shell environment info, ( from BOOTLOADER shell ):

=> printenv
baudrate=115200
bootcmd=mtkautoboot
bootdelay=0
fdtcontroladdr=9bff0ed0
ipaddr=192.168.1.1
mtddevname=u-boot
mtddevnum=0
mtdids=nmbm0=nmbm0
mtdparts=mtdparts=nmbm0:512k(u-boot),512k(u-boot-env),512k(factory),-(firmware)
netmask=255.255.255.0
partition=nmbm0,0
serverip=192.168.1.2
stderr=uartlite0@1e000c00
stdin=uartlite0@1e000c00
stdout=uartlite0@1e000c00

Environment size: 358/131068 bytes

is there a way to change router's deeply modified LEDE / GUI & other configs via busybox ash shell, so that the existing OpenWRT+MTK firmware v15 in this router, will allow the user to upgrade into the last stable/vanilla openwrt ?

( i have already masked some sensitive data, but if submitted data in above still has any private or sensitive data, then requesting to openwrt forum admin/mod: please mask them, thanks in advance )

Router's firmware itself should not connect with any external remote server (beside: time-server, dns-server, etc), So (based on above posted info), Do i need to create any specific firewall rule(s) via ash shell to block any network interface or external server, until the firmware is updated/upgraded into a stable/vanilla openwrt ?

Router's web GUI interface provides no option to setup/connect with the router via SSH.
Router's current / existing web GUI interface is heavily/deeply modified by router manufacturer (they used deeply modified MTK based OpenWRT),
it has NO ADVANCED configuration options.

nicefile · March 17, 2022, 2:00pm

I've looked into the your data and => is bootloader prompt (u-boot)
As it seems device is using some of LEDE build you should be able to backup entries in /dev/mtd (0-3 and 7-9) and scp them to safe location.
From the partition table flash partitions look similar to that in ipTIME AX2004M with the addition OEM data after 0x5980000 . Also both devices are using fit partition.
Gpio part should be tracked using methods from https://openwrt.org/docs/guide-developer/add.new.device .I would start from AX2004M dts and carve it into ZR2660 dts
I'll recommend to boot initramfs-kernel.bin files without flashing as NAND memory can be problematic to recover .

atErik · March 19, 2022, 4:06am

This ZR-2660 router's GUI web interface does not provide any real advanced configuration settings.
general simple config settings are put inside a tab called "Advanced" !!
No SSH option, whatsoever.

telecomadmin@LEDE:/#  cat /etc/os-release
NAME="LEDE"
VERSION="17.01-SNAPSHOT, Reboot"
ID="lede"
ID_LIKE="lede openwrt"
PRETTY_NAME="LEDE Reboot 17.01-SNAPSHOT"
VERSION_ID="17.01-snapshot"
HOME_URL="http://lede-project.org/"
BUG_URL="http://bugs.lede-project.org/"
SUPPORT_URL="http://forum.lede-project.org/"
BUILD_ID="r0-e88ba24"
LEDE_BOARD="ramips/mt7621"
LEDE_ARCH="mipsel_24kc"
LEDE_TAINTS="no-all"
LEDE_DEVICE_MANUFACTURER="LEDE"
LEDE_DEVICE_MANUFACTURER_URL="http://lede-project.org/"
LEDE_DEVICE_PRODUCT="Generic"
LEDE_DEVICE_REVISION="v0"
LEDE_RELEASE="LEDE Reboot 17.01-SNAPSHOT r0-e88ba24"

telecomadmin@LEDE:/#  ps  w
  PID USER       VSZ STAT COMMAND
    1 telecoma  1616 S    /sbin/procd
    2 telecoma     0 SW   [kthreadd]
    3 telecoma     0 SW   [ksoftirqd/0]
    5 telecoma     0 SW<  [kworker/0:0H]
    7 telecoma     0 SW   [rcu_sched]
    8 telecoma     0 SW   [rcu_bh]
    9 telecoma     0 SW   [migration/0]
   10 telecoma     0 SW   [migration/1]
   11 telecoma     0 SW   [ksoftirqd/1]
   13 telecoma     0 SW<  [kworker/1:0H]
   14 telecoma     0 SW   [migration/2]
   15 telecoma     0 SW   [ksoftirqd/2]
   16 telecoma     0 SW   [kworker/2:0]
   17 telecoma     0 SW<  [kworker/2:0H]
   18 telecoma     0 SW   [migration/3]
   19 telecoma     0 SW   [ksoftirqd/3]
   21 telecoma     0 SW<  [kworker/3:0H]
   22 telecoma     0 SW   [kworker/u8:1]
  125 telecoma     0 SW<  [writeback]
  127 telecoma     0 SW<  [crypto]
  128 telecoma     0 SW<  [bioset]
  130 telecoma     0 SW<  [kblockd]
  178 telecoma     0 SW   [kswapd0]
  179 telecoma     0 SW<  [vmstat]
  237 telecoma     0 SW   [fsnotify_mark]
  239 telecoma     0 SW<  [SquashFS read w]
  247 telecoma     0 SW<  [pencrypt]
  249 telecoma     0 SW<  [pdecrypt]
  322 telecoma     0 SW<  [ipv6_addrconf]
  328 telecoma     0 SW<  [deferwq]
  329 telecoma     0 SW   [kworker/2:1]
  333 telecoma     0 SW<  [bioset]
  338 telecoma     0 SW<  [bioset]
  343 telecoma     0 SW<  [bioset]
  348 telecoma     0 SW<  [bioset]
  353 telecoma     0 SW<  [bioset]
  358 telecoma     0 SW<  [bioset]
  363 telecoma     0 SW<  [bioset]
  368 telecoma     0 SW<  [bioset]
  373 telecoma     0 SW<  [bioset]
  378 telecoma     0 SW<  [bioset]
  384 telecoma     0 SW<  [kworker/1:1H]
  387 telecoma     0 SW<  [kworker/0:1H]
  390 telecoma     0 SW<  [kworker/2:1H]
  391 telecoma     0 SW<  [kworker/3:1H]
  642 telecoma  1184 S    /sbin/ubusd
  643 telecoma  1208 S    /bin/ash --login
  809 telecoma     0 SW   [irq/26-1e004000]
  810 telecoma     0 SW<  [wq_eip93]
 1006 telecoma  1344 S    {zr_check_map} /bin/sh /usr/bin/zr_check_map
 1645 telecoma  3528 S    nvram_daemon
 1761 telecoma  1268 S    /sbin/logd -S 64
 1770 telecoma  1448 S    /sbin/rpcd
 1942 telecoma  1492 S    /usr/sbin/odhcpd
 3398 telecoma  3472 S    /usr/sbin/uhttpd -f -h /www -r LEDE -x /cgi-bin -u /ubus -t 60 -T 30 -k 20 -A 1 -n 3 -N 100 -R -p 0.0.0.0
 3426 telecoma   976 S    xl2tpd -D -l -p /var/run/xl2tpd.pid
 4417 telecoma     0 SWN  [jffs2_gcd_mtd6]
 4438 telecoma  1620 S    /usr/sbin/funcactive
 9020 telecoma     0 SW   [kworker/u8:0]
14536 telecoma  1208 S    sleep 15
14546 telecoma  1208 R    ps w
16948 telecoma  1208 S    /usr/sbin/ntpd -n -N -S /usr/sbin/ntpd-hotplug -p time.nist.gov -p 1.lede.pool.ntp.org
17811 telecoma     0 SW   [kworker/1:0]
17843 telecoma     0 SW   [kworker/0:2]
18086 telecoma  1620 S    /sbin/netifd
18377 telecoma  1208 S    udhcpc -p /var/run/udhcpc-eth1.pid -s /lib/netifd/dhcp.script -f -t 0 -i eth1 -C -O 121
18796 dnsmasq   1312 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg02411c -k -x /var/run/dnsmasq/dnsmasq.cfg02411c.pid
18847 telecoma     0 SW   [kworker/3:0]
19569 telecoma   912 S    fwdd -p ra0 apcli0 -p rai0 apclii0 -p rax0 apclix0 -p wlan0 wlan-apcli0 -e eth0 5G
22327 telecoma     0 SW   [kworker/3:1]
22430 telecoma     0 SW   [kworker/0:0]
22617 telecoma     0 SW   [kworker/1:2]
23082 telecoma  1504 S    wapp -d1 -v2
23083 telecoma  1504 S    wapp -d1 -v2
telecomadmin@LEDE:/#

in my computer, the en0 is primary net interface (ip:192.168.5.130,dns:192.168.0.1),
cable goes into internet via my-router (192.168.5.1),
my-router is connected behind home-wifi-router (192.168.0.1).

in my computer, the en4 is 2nd net interface (ip:192.168.2.128,dns:192.168.2.1),
connected with this ZR-2660 router (192.168.2.1).

ErikComputer:~ erik$  /opt/local/bin/ssh  telecomadmin@192.168.2.1
ssh: connect to host 192.168.2.1 port 22: Connection refused
ErikComputer:~ erik$  /opt/local/bin/ssh  root@192.168.2.1
ssh: connect to host 192.168.2.1 port 22: Connection refused
ErikComputer:~ erik$  /opt/local/bin/ssh  -B en4  telecomadmin@192.168.2.1
ssh: connect to host 192.168.2.1 port 22: Connection refused
ErikComputer:~ erik$  /opt/local/bin/ssh  -B en4  root@192.168.2.1
ssh: connect to host 192.168.2.1 port 22: Connection refused
ErikComputer:~ erik$  /opt/local/bin/ssh  -B en4  telecomadmin@192.168.1.1
ssh: connect to host 192.168.1.1 port 22: Network is unreachable
ErikComputer:~ erik$  /opt/local/bin/ssh  -B en4  root@192.168.1.1
ssh: connect to host 192.168.1.1 port 22: Network is unreachable
ErikComputer:~ erik$  /opt/local/bin/ssh  -B en4  telecomadmin@192.168.1.2
ssh: connect to host 192.168.1.2 port 22: Network is unreachable
ErikComputer:~ erik$  /opt/local/bin/ssh  -B en4  root@192.168.1.2
ssh: connect to host 192.168.1.2 port 22: Network is unreachable
ErikComputer:~ erik$  /opt/local/bin/ssh  telecomadmin@192.168.2.1  -b 192.168.2.128
ssh: connect to host 192.168.2.1 port 22: Connection refused
ErikComputer:~ erik$  /opt/local/bin/ssh  root@192.168.2.1  -b 192.168.2.128
ssh: connect to host 192.168.2.1 port 22: Connection refused
ErikComputer:~ erik$  /opt/local/bin/ssh  telecomadmin@192.168.2.2  -B en4
ssh: connect to host 192.168.2.2 port 22: Operation timed out
ErikComputer:~ erik$  /opt/local/bin/ssh  root@192.168.2.1  -B en4
ssh: connect to host 192.168.2.2 port 22: Operation timed out

Data from router:

telecomadmin@LEDE:/#  service sshd restart
service "sshd" not found, the following services are available:
boot                mtkhnat             uhttpd
bootcount           network             umount
cron                odhcpd              urandom_seed
ddns                omcproxy            xl2tpd
dnsmasq             pptpd               zrMac_filter
done                rpcd                zrParental_control
enablemodem         smp                 zr_mapbsscfg
firewall            start_jcgqos        zrdomain
firmware.sh         start_wifitimer     zrfuncactive
fstab               sysctl              zrhostName
fwdd                sysfixtime          zrset_default
gpio_switch         sysntpd             zrsetup
led                 system              zrwactive
log                 telnet

telecomadmin@LEDE:/#  ls /bin
air_monitor                     mpstat
ash                             multithread_malloc_testcode
board_detect                    multithread_malloc_testcode_t0
busybox                         multithread_malloc_testcode_t1
cat                             multithread_malloc_testcode_t2
chgrp                           mv
chmod                           netmsg
chown                           netstat
config_generate                 nice
cp                              opkg
date                            pidof
dd                              ping
df                              ping6
dmesg                           ps
echo                            pwd
egrep                           rm
false                           rmdir
fgrep                           sed
fsync                           sh
grep                            sleep
gunzip                          sync
gzip                            tar
ipcalc.sh                       touch
kill                            true
ln                              ubus
lock                            uclient-fetch
login                           umount
ls                              uname
mkdir                           vi
mknod                           wget
mktemp                          zcat
mount

telecomadmin@LEDE:/#  ls /sbin
arp_neigh_loop     ifup               pivot_root         udevtrigger
askfirst           init               poweroff           udhcpc
block              ip                 procd              updatepid.sh
devstatus          jffs2mark          reboot             upgraded
firstboot          jffs2reset         reload_config      urandom_seed
fixup-mac-address  kmodloader         route              validate_data
fw3                l1dat              rpcd               vconfig
getipconfig.sh     led.sh             sigma              wfa_ca
getpid.sh          logd               smp.sh             wfa_dut
getpstats.sh       logread            start-stop-daemon  wfa_test_cli.sh
gpstats.sh         luci-reload        stoping.sh         wfaping.sh
halt               mkswap             swconfig           wfaping6.sh
hotplug-call       mount_root         switch_root        wifi
hwclock            mtd                sysctl             wifi.legacy
ifconfig           mtk_factory_rw.sh  sysupgrade
ifdown             mtkhnat            ubusd
ifstatus           netifd             uci

telecomadmin@LEDE:/#  ls /usr/bin
1905ctrl              kvcedit               signify
8021xd                ldd                   sort
EasyMesh_openwrt.sh   led                   speedlimit
[                     less                  strings
[[                    logger                switch
ated                  lspci                 tail
awk                   lua                   tee
basename              luci-bwc              telnet
bndstrg2              map_cert_script.sh    test
bs20                  map_config_agent.lua  tftp
bunzip2               mapd                  time
bzcat                 mapd_cli              top
chpasswd              mapd_user_iface       tp_ts_switch.sh
chpasswd.sh           mbo_nr.sh             tr
clear                 md5sum                traceroute
cmp                   mii_mgr               traceroute6
config2               mii_mgr_cl45          uart_launcher
config_agent.lua      miniupnpd             uniq
crontab               mkfifo                uptime
curl                  mtdc_test             usign
cut                   nc                    wapp
datconf               nohup                 wapp_openwrt.sh
dirname               nslookup              wappctrl
du                    nsupdate              wc
env                   nvram_daemon          which
expr                  nvram_get             wifi_config_save
find                  nvram_set             wificonf
free                  openssl               xargs
fwdd                  p1905_managerd        yes
fwtool                passwd                zrMac_filter
gdbserver             pgrep                 zr_check_bridge
getrandom             printf                zr_check_map
head                  qdma                  zr_check_wan_port.sh
hexdump               readlink              zr_config_lost
id                    regs                  zr_get_sta
iperf                 reset                 zr_hwnat
iperf3                resolveip             zr_init_easyMesh
iwinfo                sd_rw_test.sh         zr_port_domain
jshn                  seq                   zrapp
jsonfilter            set_login_user        zrget_vendor
killall               sha256sum             zrwactive

telecomadmin@LEDE:/#  ls /usr/sbin
TimerTask            iwconfig             ubicrc32
bcrelay              iwlist               ubidetach
brctl                iwpriv               ubiformat
bridge               lmdd                 ubimkvol
chroot               lsmod                ubinfo
crond                memtester            ubinize
cwmpd                modinfo              ubirename
dnsmasq              modprobe             ubirmvol
ebtables             ntpd                 ubirsvol
ebtables-restore     ntpd-hotplug         ubiupdatevol
ebtables-save        odhcp6c              uhttpd
ethtool              odhcpd               vpn
funcactive           odhcpd-update        vpn_service
generaterule.sh      omcproxy             wifi_enable.sh
hostapd              opkg-key             wpa_supplicant
hwnat-disable.sh     pppd                 wpad
hwnat-enable.sh      pptpctrl             xl2tpd
insmod               pptpd                xl2tpd-control
ip                   px5g                 xtables-multi
ip6tables            rmmod                zrParental_control
ip6tables-restore    swapoff              zr_encrypt
ip6tables-save       swapon               zr_mapucidefault.sh
ipset                tc                   zr_mesh_exec
iptables             tcpdump              zr_report
iptables-restore     telnetd              zrdefault
iptables-save        ubiattach            zrhostName
ipv6                 ubiblock             zrinternet_ctl

telecomadmin@LEDE:/#

so there is no SSH inside the ZR-2660 router !!
MFR "Z-ROUTER" has removed ssh packages from ZR-2660 !!

According to MFR, telnet can be enabled temporarily : after visiting a specific webpage in router via web-browser, telnet support is temporarily enabled.
After visiting that page, then below telnet command worked:

ErikComputer:~ erik$  telnet 192.168.2.1
Trying 192.168.2.1...
Connected to 192.168.2.1.
Escape character is '^]'.

LEDE login: adminuser
Password: 


BusyBox v1.25.1 () built-in shell (ash)

     _________
    /        /\      _    ___ ___  ___
   /  LE    /  \    | |  | __|   \| __|
  /    DE  /    \   | |__| _|| |) | _|
 /________/  LE  \  |____|___|___/|___|                      lede-project.org
 \        \   DE /
  \    LE  \    /  -----------------------------------------------------------
   \  DE    \  /    Reboot (17.01-SNAPSHOT, r0-e88ba24)
    \________\/    -----------------------------------------------------------

telecomadmin@LEDE:/#  ssh
-sh: ssh: not found

telecomadmin@LEDE:/#  sshd
-sh: sshd: not found

telecomadmin@LEDE:/#  uci
Usage: uci [<options>] <command> [<arguments>]

Commands:
        batch
        export     [<config>]
        import     [<config>]
        changes    [<config>]
        commit     [<config>]
        add        <config> <section-type>
        add_list   <config>.<section>.<option>=<string>
        del_list   <config>.<section>.<option>=<string>
        show       [<config>[.<section>[.<option>]]]
        get        <config>.<section>[.<option>]
        set        <config>.<section>[.<option>]=<value>
        delete     <config>[.<section>[[.<option>][=<id>]]]
        rename     <config>.<section>[.<option>]=<name>
        revert     <config>[.<section>[.<option>]]
        reorder    <config>.<section>=<position>

Options:
        -c <path>  set the search path for config files (default: /etc/config)
        -d <str>   set the delimiter for list values in uci show
        -f <file>  use <file> as input instead of stdin
        -m         when importing, merge data into an existing package
        -n         name unnamed sections on export (default)
        -N         don't name unnamed sections
        -p <path>  add a search path for config change files
        -P <path>  add a search path for config change files and use as default
        -q         quiet mode (don't print error messages)
        -s         force strict mode (stop on parser errors, default)
        -S         disable strict mode
        -X         do not use extended syntax on 'show'

telecomadmin@LEDE:/#  uci show dropbear
uci: Entry not found

telecomadmin@LEDE:/#  set
HOME='/'
HOSTNAME='LEDE'
IFS='   
'
LOGNAME='adminuser'
OPTIND='1'
PATH='/usr/sbin:/usr/bin:/sbin:/bin'
PPID='30365'
PS1='\u@\h:\w\$ '
PS2='> '
PS4='+ '
PWD='/'
SHELL='/bin/sh'
SHLVL='1'
USER='adminuser'
_='dropbear'

telecomadmin@LEDE:/#  tftp
BusyBox v1.25.1 () multi-call binary.

Usage: tftp [OPTIONS] HOST [PORT]

Transfer a file from/to tftp server

        -l FILE Local FILE
        -r FILE Remote FILE
        -g      Get file
        -p      Put file

telecomadmin@LEDE:/#  nanddump
-sh: nanddump: not found

( i have adjusted/masked few data in above )

so there is no dropbear ssh daemon or client, no nanddump inside this ZR-2660 router !!

What are my options to backup firmware paritions ?
it appears mtd tool (inside router) can backup partition,
& tftp tool (inside router) can send file into a TFP-daemon.
if i run a TFTP-daemon in my-computer, then i can receive those mtd files.

After contacting MFR, i was able to obtain the mt7621a.dtsi file,
partial info shown below:

/*
 * Device Tree Source for MT7621
 *
 * Copyright (C) 2018 OpenWrt
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <dt-bindings/interrupt-controller/mips-gic.h>
#include <dt-bindings/clock/leopard-clk.h>
#include <dt-bindings/phy/phy.h>

/ {
	#address-cells = <1>;
	#size-cells = <1>;
	compatible = "mediatek,mt7621-soc";

	cpus {
		cpu@0 {
			compatible = "mips,mips1004Kc";
		};

		cpu@1 {
			compatible = "mips,mips1004Kc";
		};
	};

	cpuintc: cpuintc@0 {
		#address-cells = <0>;
		#interrupt-cells = <1>;
		interrupt-controller;
		compatible = "mti,cpu-interrupt-controller";
	};

	aliases {
		serial0 = &uartlite;
	};

	cpuclock: cpuclock@0 {
		#clock-cells = <0>;
		compatible = "mtk,mt7621-cpu-clock";
	};

	sysbusclock: sysbusclock@0 {
		#clock-cells = <0>;
		compatible = "mtk,mt7621-sys-bus-clock";
	};

	apll: apll@0 {
		#clock-cells = <0>;
		compatible = "fixed-clock";

		clock-frequency = <270000000>;
	};

	sysclock50M: sysclock50M@0 {
		#clock-cells = <0>;
		compatible = "fixed-clock";

		clock-frequency = <50000000>;
	};

	sysclock125M: sysclock125M@0 {
		#clock-cells = <0>;
		compatible = "fixed-clock";

		clock-frequency = <125000000>;
	};

	palmbus: palmbus@1e000000 {
		compatible = "palmbus";
		reg = <0x1e000000 0x100000>;
		ranges = <0x0 0x1e000000 0x0fffff>;

		#address-cells = <1>;
		#size-cells = <1>;

		sysc: sysc@0 {
			compatible = "mtk,mt7621-sysc";
			reg = <0x0 0x100>;
		};

		wdt: wdt@100 {
			compatible = "mtk,mt7621-wdt";
			reg = <0x100 0x100>;
		};

		gpio@600 {
			#address-cells = <1>;
			#size-cells = <0>;

			compatible = "mtk,mt7621-gpio";
			reg = <0x600 0x100>;

			interrupt-parent = <&gic>;
			interrupts = <GIC_SHARED 12 IRQ_TYPE_LEVEL_HIGH>;

			gpio0: bank@0 {
				reg = <0>;
				compatible = "mtk,mt7621-gpio-bank";
				gpio-controller;
				#gpio-cells = <2>;
			};

			gpio1: bank@1 {
				reg = <1>;
				compatible = "mtk,mt7621-gpio-bank";
				gpio-controller;
				#gpio-cells = <2>;
			};

			gpio2: bank@2 {
				reg = <2>;
				compatible = "mtk,mt7621-gpio-bank";
				gpio-controller;
				#gpio-cells = <2>;
			};
		};

		i2c@0 {
			compatible = "i2c-gpio";
			gpios = <&gpio0 3 1>, <&gpio0 4 1>;
			i2c-gpio,delay-us = <3>;
			#address-cells = <1>;
			#size-cells = <0>;
			status = "okay";
			pinctrl-names = "default";
			pinctrl-0 = <&i2c_pins>;
		};

		i2s: i2s@a00 {
			compatible = "mediatek,mt7621-i2s";
			reg = <0xa00 0x100>;

			clocks = <&apll>;

			resets = <&rstctrl 17>;
			reset-names = "i2s";

			interrupt-parent = <&gic>;
			interrupts = <GIC_SHARED 16 IRQ_TYPE_LEVEL_HIGH>;

			txdma-req = <2>;
			rxdma-req = <3>;

			dmas = <&gdma 4>,
				<&gdma 6>;
			dma-names = "tx", "rx";

			status = "disabled";
		};

		spi0: spi@b00 {
			status = "disabled";

			compatible = "mediatek,mt7621-spi";
			reg = <0xb00 0x100>;

			clocks = <&sysbusclock>;

			resets = <&rstctrl 18>;
			reset-names = "spi";

			#address-cells = <1>;
			#size-cells = <0>;

			pinctrl-names = "default";
			pinctrl-0 = <&spi_pins>;
		};

		uartlite: uartlite@c00 {
			compatible = "mediatek,mt6577-uart", "ns16550a";
			reg = <0xc00 0x100>;

			clocks = <&sysclock50M>;
			clock-frequency = <50000000>;

			interrupt-parent = <&gic>;
			interrupts = <GIC_SHARED 26 IRQ_TYPE_LEVEL_HIGH>;

			reg-shift = <2>;
			reg-io-width = <4>;
			no-loopback-test;
		};

		uartfull1: uartfull@d00 {
			compatible = "mediatek,mt6577-uart", "ns16550a";
			reg = <0xd00 0x100>;

			clocks = <&sysclock50M>;
			clock-frequency = <50000000>;

			interrupt-parent = <&gic>;
			interrupts = <GIC_SHARED 27 IRQ_TYPE_LEVEL_HIGH>;

			reg-shift = <2>;
			reg-io-width = <4>;
			no-loopback-test;

			status = "disabled";
		};

		uartfull2: uartfull@e00 {
			compatible = "mediatek,mt6577-uart", "ns16550a";
			reg = <0xe00 0x100>;

			clocks = <&sysclock50M>;
			clock-frequency = <50000000>;

			interrupt-parent = <&gic>;
			interrupts = <GIC_SHARED 28 IRQ_TYPE_LEVEL_HIGH>;

			reg-shift = <2>;
			reg-io-width = <4>;
			no-loopback-test;

			status = "disabled";
		};

		gdma: gdma@2800 {
			compatible = "mtk,rt3883-gdma";
			reg = <0x2800 0x800>;

			resets = <&rstctrl 14>;
			reset-names = "dma";

			interrupt-parent = <&gic>;
			interrupts = <0 13 4>;

			#dma-cells = <1>;
			#dma-channels = <16>;
			#dma-requests = <16>;

			status = "disabled";
		};

		bch: ecc@3800 {
			compatible = "mediatek,mt7621-ecc";
			reg = <0x3800 0x800>;

			status = "disabled";
		};

		nand: nand@3000 {
			compatible = "mediatek,mt7621-nfc";
			reg = <0x3000 0x800>;

			ecc-engine = <&bch>;
			#address-cells = <1>;
			#size-cells = <1>;

			pinctrl-names = "default";
			pinctrl-0 = <&nand_pins>;

			status = "disabled";
		};

		memc: memc@5000 {
			compatible = "mtk,mt7621-memc";
			reg = <0x5000 0x1000>;
		};

		hsdma: hsdma@7000 {
			compatible = "mediatek,mt7621-hsdma";
			reg = <0x7000 0x1000>;

			resets = <&rstctrl 5>;
			reset-names = "hsdma";

			interrupt-parent = <&gic>;
			interrupts = <0 11 4>;

			#dma-cells = <1>;
			#dma-channels = <1>;
			#dma-requests = <1>;

			status = "disabled";
		};
	};

	rstctrl: rstctrl {
		compatible = "ralink,rt2880-reset";
		#reset-cells = <1>;
	};

	clkctrl: clkctrl {
		compatible = "ralink,rt2880-clock";
		#clock-cells = <1>;
	};

	ethsys: ethsys@1e000000 {
		compatible = "mediatek,mt7621-ethsys", "syscon";
		reg = <0x1e000000 0x8000>;
	};

	raeth: raeth@1e100000 {
		compatible = "mediatek,mt7621-eth";
		reg = <0x1e100000 0xE000>;

		interrupt-parent = <&gic>;
		interrupts = <GIC_SHARED 3 IRQ_TYPE_LEVEL_HIGH>;

		mediatek,ethsys = <&ethsys>;

		status = "disabled";
	};

	eth: ethernet@1e100000 {
		compatible = "mediatek,mt7621-eth", "syscon";
		reg = <0x1e100000 0xE000>;

		#address-cells = <1>;
		#size-cells = <0>;

		interrupt-parent = <&gic>;
		interrupts = <GIC_SHARED 3 IRQ_TYPE_LEVEL_HIGH>;

		mediatek,ethsys = <&ethsys>;

		status = "disabled";
	};

	gsw: gsw {
		compatible = "mediatek,mt753x";
		mt7530,direct-phy-access;
		interrupt-parent = <&gic>;
		interrupts = <GIC_SHARED 23 IRQ_TYPE_LEVEL_HIGH>;

		#address-cells = <1>;
		#size-cells = <0>;
	};

	hnat: hnat@1e100000 {
		compatible = "mediatek,mtk-hnat_v1";
		reg = <0x1e100000 0x3000>;

		resets = <&ethsys 0>;
		reset-names = "mtketh";

		status = "disabled";
	};

	sdhci: sdhci@1e130000 {
		status = "disabled";

		compatible = "mediatek,mt7621-sdhci";
		reg = <0x1e130000 0x4000>;

		interrupt-parent = <&gic>;
		interrupts = <GIC_SHARED 20 IRQ_TYPE_LEVEL_HIGH>;
	};

	pcie: pcie@1e140000 {
		compatible = "mediatek,mt7621-pci";
		reg = <0x1e140000 0x40000>;

		#address-cells = <3>;
		#size-cells = <2>;

		pinctrl-names = "default";
		pinctrl-0 = <&pcie_pins>;

		device_type = "pci";

		bus-range = <0 255>;
		ranges = <
			0x02000000 0 0x00000000 0x60000000 0 0x10000000 /* pci memory */
			0x01000000 0 0x00000000 0x1e160000 0 0x00010000 /* io space */
		>;

		interrupt-parent = <&gic>;
		interrupts = <GIC_SHARED 4 IRQ_TYPE_LEVEL_HIGH
				GIC_SHARED 24 IRQ_TYPE_LEVEL_HIGH
				GIC_SHARED 25 IRQ_TYPE_LEVEL_HIGH>;

		status = "disabled";

		resets = <&rstctrl 24 &rstctrl 25 &rstctrl 26>;
		reset-names = "pcie0", "pcie1", "pcie2";
		clocks = <&clkctrl 24 &clkctrl 25 &clkctrl 26>;
		clock-names = "pcie0", "pcie1", "pcie2";

		reset-gpios = <&gpio0 19 1>;
		reset-gpio-names = "pcie";

		pcie0 {
			reg = <0x0000 0 0 0 0>;

			#address-cells = <3>;
			#size-cells = <2>;

			device_type = "pci";
		};

		pcie1 {
			reg = <0x0800 0 0 0 0>;

			#address-cells = <3>;
			#size-cells = <2>;

			device_type = "pci";
		};

		pcie2 {
			reg = <0x1000 0 0 0 0>;

			#address-cells = <3>;
			#size-cells = <2>;

			device_type = "pci";
		};
	};

	xhci: usb@1e1c0000 {
		compatible = "mediatek,mt7621-xhci", "mediatek,mt2701-xhci";
		reg = <0x1e1c0000 0x0001000>,
		      <0x1e1d0700 0x0000100>;
		reg-names = "mac", "ippc";
		interrupt-parent = <&gic>;
		interrupts = <GIC_SHARED 22 IRQ_TYPE_LEVEL_HIGH>;
		/* power-domains = <&scpsys MT7622_POWER_DOMAIN_HIF1>; */
		clocks = <&sysclock125M>, <&sysclock125M>,
			 <&sysclock125M>, <&sysclock125M>;
		clock-names = "sys_ck", "free_ck", "ahb_ck", "dma_ck";
		phys =	<&u2port0 PHY_TYPE_USB2>,
			<&u3port0 PHY_TYPE_USB3>,
			<&u2port1 PHY_TYPE_USB2>;
		status = "disabled";
	};

	u3phy1: usb-phy@1e1d0000 {
		compatible = "mediatek,mt7621-u3phy", "mediatek,mt2701-u3phy";
		#address-cells = <1>;
		#size-cells = <1>;
		ranges;
		reg = <0x1e1d0000 0x00000300>;
		status = "disabled";

		u2port0: usb-phy@0x1e1d0800 {
			reg = <0x1e1d0800 0x00000100>;
			#phy-cells = <1>;
			clocks = <&sysclock125M>;
			clock-names = "ref";
		};

		u3port0: usb-phy@0x1e1d0900 {
			reg = <0x1e1d0900 0x00000700>;
			#phy-cells = <1>;
			clocks = <&sysclock125M>;
			clock-names = "ref";
		};

		u2port1: usb-phy@0x1e1d1000 {
			reg = <0x1e1d1000 0x00000100>;
			#phy-cells = <1>;
			clocks = <&sysclock125M>;
			clock-names = "ref";
		};

	};

	gic: interrupt-controller@1fbc0000 {
		compatible = "mti,gic";
		reg = <0x1fbc0000 0x2000>;

		interrupt-controller;
		#interrupt-cells = <3>;

		mti,reserved-cpu-vectors = <7>;

		timer {
			compatible = "mti,gic-timer";
			interrupts = <GIC_LOCAL 1 IRQ_TYPE_NONE>;
			clocks = <&cpuclock>;
		};
	};

	pinctrl: pinctrl {
		compatible = "mtk,mtkmips-pinmux";
		pinctrl-names = "default";
		pinctrl-0 = <&state_default>;

		state_default: pinctrl0 {
		};

		i2c_pins: i2c {
			i2c {
				mtk,group = "i2c";
				mtk,function = "gpio";
			};
		};

		mdio_pins: mdio {
			mdio {
				mtk,group = "mdio";
				mtk,function = "mdio";
			};
		};

		nand_pins: nand {
			spi-nand {
				mtk,group = "spi";
				mtk,function = "nand1";
			};

			sdhci-nand {
				mtk,group = "sdhci";
				mtk,function = "nand2";
			};
		};

		pcie_pins: pcie {
			pcie {
				mtk,group = "pcie";
				mtk,function = "gpio";
			};
		};

		rgmii1_pins: rgmii1 {
			rgmii1 {
				mtk,group = "rgmii1";
				mtk,function = "rgmii1";
			};
		};

		rgmii2_pins: rgmii2 {
			rgmii2 {
				mtk,group = "rgmii2";
				mtk,function = "rgmii2";
			};
		};

		sdhci_pins: sdhci {
			sdhci {
				mtk,group = "sdhci";
				mtk,function = "sdhci";
			};
		};

		spi_pins: spi {
			spi {
				mtk,group = "spi";
				mtk,function = "spi";
			};
		};

		uart1_pins: uart1 {
			uart1 {
				mtk,group = "uart1";
				mtk,function = "uart1";
			};
		};

		uart2_pins: uart2 {
			uart2 {
				mtk,group = "uart2";
				mtk,function = "uart2";
			};
		};

		uart3_pins: uart3 {
			uart3 {
				mtk,group = "uart3";
				mtk,function = "uart3";
			};
		};
	};

	crypto: crypto@1e004000 {
		status = "okay";

		compatible = "mediatek,mtk-eip93";
		reg = <0x1E004000 0x1000>;

		interrupt-parent = <&gic>;
		interrupts = <GIC_SHARED 19 IRQ_TYPE_LEVEL_HIGH>;
	};
};

hi @nicefile, what step can i take now ?

atErik · March 22, 2022, 9:18am

hi @nicefile , thanks for pointing at similarities with other cases, & thanks for pointing at further steps for this zr-2660 router.

to all dev-community,

a. please see previous post , i have posted more info, gpio info & dtsi file, etc.

b. what step do i need to do now , to load+run the latest+stable openwrt in this router ?

c. if possible please kindly elaborate some steps (or post links), to make it easier for me to understand+follow.

d. how do i boot into initramfs-kernel.bin in router, is it available via bootmenu during router startup ?

e. during router-boot via serial cable/adapter interface , i can go into these : "U-Boot Boot Menu : 1. Startup system (Default) , 2. Upgrade firmware , 3. Upgrade bootloader , 4. Upgrade bootloader (advanced mode) , 5. Load image , 0. U-Boot console."
... which one i can/should use ? and then do what ?
collect boot log, mtd etc again ? make backup again ?

f. wanted to inform you / dev-community , i do not want to backup or keep any existing/old/earlier partitions / data, etc, ... i want to load last+stable openwrt , load last+stable U-boot or breed bootloader, load latest kernel, etc, ... by erasing all earlier info/settings,etc ... only the router manufacturer's name "Z-Router", model number "ZR-2660", HW version, etc can be kept intact, ... all other data can be different/new data.

g. is there an existing source or branch for such router in openwrt site ? what needs to be done or be added there, to add support for this router ?

h. do i need to disclose MAC address here ?

i. i want all/other users who has this router, be able to download openwrt firmware from openwrt site & upgrade into the latest+stable openwrt.

atErik · March 23, 2022, 12:24pm

after obtaining+applying Add.New.Device page's gpio-test.sh & gpio-dump.sh scripts (inside router) , i have received below output:

telecomadmin@LEDE:/#  vi  /tmp/gpio-test.sh
telecomadmin@LEDE:/#  vi  /tmp/gpio-dump.sh
telecomadmin@LEDE:/#  chmod  +x  /tmp/gpio-test.sh
telecomadmin@LEDE:/#  chmod  +x  /tmp/gpio-dump.sh
telecomadmin@LEDE:/#  /tmp/gpio-test.sh
[GPIO0] Trying value 0
[GPIO0] Trying value 1
[GPIO1] Trying value 0
[GPIO1] Trying value 1
[GPIO2] Trying value 0
[GPIO2] Trying value 1
[GPIO3] Trying value 0
[GPIO3] Trying value 1
sh: write error: Resource busy
[GPIO5] Trying value 0
[GPIO5] Trying value 1
[GPIO6] Trying value 0
[GPIO6] Trying value 1
[GPIO7] Trying value 0
[GPIO7] Trying value 1
[GPIO8] Trying value 0
[GPIO8] Trying value 1
[GPIO9] Trying value 0
[GPIO9] Trying value 1
[GPIO10] Trying value 0
[GPIO10] Trying value 1
[GPIO11] Trying value 0
[GPIO11] Trying value 1
[GPIO12] Trying value 0
[GPIO12] Trying value 1
sh: write error: Resource busy
sh: write error: Resource busy
sh: write error: Resource busy
sh: write error: Resource busy
sh: write error: Resource busy
sh: write error: Resource busy
sh: write error: Resource busy
[GPIO20] Trying value 0
[GPIO20] Trying value 1
[GPIO21] Trying value 0
[GPIO21] Trying value 1
[GPIO22] Trying value 0
[GPIO22] Trying value 1
[GPIO23] Trying value 0
[GPIO23] Trying value 1
[GPIO24] Trying value 0
[GPIO24] Trying value 1
[GPIO25] Trying value 0
[GPIO25] Trying value 1
[GPIO26] Trying value 0
[GPIO26] Trying value 1
[GPIO27] Trying value 0
[GPIO27] Trying value 1
[GPIO28] Trying value 0
[GPIO28] Trying value 1
[GPIO29] Trying value 0
[GPIO29] Trying value 1
[GPIO30] Trying value 0
[GPIO30] Trying value 1
[GPIO31] Trying value 0
[GPIO31] Trying value 1

telecomadmin@LEDE:/#  /tmp/gpio-dump.sh
[GPIO0] value 1
[GPIO1] value 1
[GPIO2] value 1
[GPIO3] value 1
sh: write error: Resource busy
[GPIO5] value 1
[GPIO6] value 0
[GPIO7] value 1
[GPIO8] value 0
[GPIO9] value 1
[GPIO10] value 0
[GPIO11] value 1
[GPIO12] value 0
sh: write error: Resource busy
sh: write error: Resource busy
sh: write error: Resource busy
sh: write error: Resource busy
sh: write error: Resource busy
sh: write error: Resource busy
sh: write error: Resource busy
[GPIO20] value 1
[GPIO21] value 0
[GPIO22] value 0
[GPIO23] value 0
[GPIO24] value 0
[GPIO25] value 0
[GPIO26] value 0
[GPIO27] value 0
[GPIO28] value 0
[GPIO29] value 0
[GPIO30] value 0
[GPIO31] value 0

this ZR-2660 pcb only has 5 LEDs , LAN/WAN/USB ports do not have LEDs,
and i have not noticed any changes during these test.

Posting other info, (recommended in this page page):

telecomadmin@LEDE:/tmp#  cat /proc/cmdline
console=ttyS0,115200 rootfstype=squashfs,jffs2

telecomadmin@LEDE:/tmp#  cat /proc/cpuinfo
system type		: MediaTek MT7621 ver:1 eco:3
machine			: MediaTek MT7621 RFB (802.11ax,NAND)
processor		: 0
cpu model		: MIPS 1004Kc V2.15
BogoMIPS		: 586.13
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 32
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa			: mips1 mips2 mips32r1 mips32r2
ASEs implemented	: mips16 dsp mt
shadow register sets	: 1
kscratch registers	: 0
package			: 0
core			: 0
VCED exceptions		: not available
VCEI exceptions		: not available
VPE			: 0

processor		: 1
cpu model		: MIPS 1004Kc V2.15
BogoMIPS		: 586.13
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 32
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa			: mips1 mips2 mips32r1 mips32r2
ASEs implemented	: mips16 dsp mt
shadow register sets	: 1
kscratch registers	: 0
package			: 0
core			: 0
VCED exceptions		: not available
VCEI exceptions		: not available
VPE			: 1

processor		: 2
cpu model		: MIPS 1004Kc V2.15
BogoMIPS		: 586.13
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 32
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa			: mips1 mips2 mips32r1 mips32r2
ASEs implemented	: mips16 dsp mt
shadow register sets	: 1
kscratch registers	: 0
package			: 0
core			: 1
VCED exceptions		: not available
VCEI exceptions		: not available
VPE			: 0

processor		: 3
cpu model		: MIPS 1004Kc V2.15
BogoMIPS		: 586.13
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 32
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa			: mips1 mips2 mips32r1 mips32r2
ASEs implemented	: mips16 dsp mt
shadow register sets	: 1
kscratch registers	: 0
package			: 0
core			: 1
VCED exceptions		: not available
VCEI exceptions		: not available
VPE			: 1

telecomadmin@LEDE:/tmp#  cat /proc/meminfo
MemTotal:         246248 kB
MemFree:          151772 kB
MemAvailable:     142912 kB
Buffers:            7180 kB
Cached:            24424 kB
SwapCached:            0 kB
Active:            19816 kB
Inactive:          13784 kB
Active(anon):       2468 kB
Inactive(anon):     2180 kB
Active(file):      17348 kB
Inactive(file):    11604 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          2016 kB
Mapped:             3580 kB
Shmem:              2652 kB
Slab:              19868 kB
SReclaimable:       4252 kB
SUnreclaim:        15616 kB
KernelStack:         640 kB
PageTables:          316 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:      123124 kB
Committed_AS:       7952 kB
VmallocTotal:    1048372 kB
VmallocUsed:           0 kB
VmallocChunk:          0 kB

telecomadmin@LEDE:/tmp#  cat /proc/devices
Character devices:
  1 mem
  4 ttyS
  5 /dev/tty
  5 /dev/console
  5 /dev/ptmx
 10 misc
 21 sg
 90 mtd
108 ppp
128 ptm
136 pts
180 usb
189 usb_device
252 BT_chrdevfwlog
253 watchdog
254 rtc

Block devices:
259 blkext
  8 sd
 31 mtdblock
 65 sd
 66 sd
 67 sd
 68 sd
 69 sd
 70 sd
 71 sd
128 sd
129 sd
130 sd
131 sd
132 sd
133 sd
134 sd
135 sd
179 mmc
254 ubiblock

telecomadmin@LEDE:/tmp#  ls /sys/devices/platform
1e000000.ethsys                cpuclock@0
1e000000.palmbus               cpuintc@0
1e004000.crypto                gpio-keys-polled
1e100000.ethernet              gpio-leds
1e100000.hnat                  gsw
1e140000.pcie                  pinctrl
1e1c0000.usb                   reg-dummy
1e1d0000.usb-phy               rstctrl
1fbc0000.interrupt-controller  serial8250
Fixed MDIO bus.0               sysbusclock@0
alarmtimer                     sysclock125M@0
apll@0                         sysclock50M@0
clkctrl                        uevent

telecomadmin@LEDE:/tmp#  cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00020000 "Bootloader"
mtd1: 00080000 00020000 "Config"
mtd2: 00080000 00020000 "Factory"
mtd3: 05800000 00020000 "firmware"
mtd4: 00380000 00020000 "kernel"
mtd5: 05480000 00020000 "rootfs"
mtd6: 049e0000 00020000 "rootfs_data"
mtd7: 02000000 00020000 "firmware_backup"
mtd8: 00100000 00020000 "zrsave"
mtd9: 00100000 00020000 "config2"

telecomadmin@LEDE:/tmp#  cat /sys/class/mtd/mtd*/offset 
0
524288
1048576
1572864
1572864
5242880
16384000
93847552
128974848
130023424

telecomadmin@LEDE:/tmp#  ifconfig -a
apcli0    Link encap:Ethernet  HWaddr H2:H5:HC:80:00:11  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

apclix0   Link encap:Ethernet  HWaddr HE:H5:HC:80:00:11  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br-lan    Link encap:Ethernet  HWaddr H4:H5:HC:80:00:10  
          inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0
          inet6 addr: fe80::H6H5:Hcff:fe80:10/64 Scope:Link
          inet6 addr: fd82:d9c:e345::1/60 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:16317 errors:0 dropped:0 overruns:0 frame:0
          TX packets:15490 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1413134 (1.3 MiB)  TX bytes:4514191 (4.3 MiB)

eth0      Link encap:Ethernet  HWaddr H4:H5:HC:80:00:10  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:21559 errors:0 dropped:0 overruns:0 frame:0
          TX packets:21917 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:2303069 (2.1 MiB)  TX bytes:7458599 (7.1 MiB)
          Interrupt:10 

eth1      Link encap:Ethernet  HWaddr H4:H5:HC:80:00:01  
          inet6 addr: fe80::H6H5:Hcff:fe80:1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:37 errors:0 dropped:0 overruns:0 frame:0
          TX packets:169525 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:4421 (4.3 KiB)  TX bytes:58639442 (55.9 MiB)
          Interrupt:10 

gre0      Link encap:UNSPEC  HWaddr 00-00-00-00-66-65-38-30-00-00-00-00-00-00-00-00  
          NOARP  MTU:1476  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

gretap0   Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1462  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ifb0      Link encap:Ethernet  HWaddr HH:HH:HH:4E:9C:2E  
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ifb1      Link encap:Ethernet  HWaddr HH:HH:HH:48:17:29  
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:832564 errors:0 dropped:0 overruns:0 frame:0
          TX packets:832564 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:49128924 (46.8 MiB)  TX bytes:49128924 (46.8 MiB)

ra0       Link encap:Ethernet  HWaddr H4:H5:HC:80:00:11  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:31 

ra1       Link encap:Ethernet  HWaddr H6:H5:HC:10:00:11  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ra2       Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ra3       Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ra4       Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

rax0      Link encap:Ethernet  HWaddr H4:H5:HC:80:00:12  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

rax1      Link encap:Ethernet  HWaddr H6:H5:HC:60:00:11  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

rax2      Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

rax3      Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

teql0     Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

telecomadmin@LEDE:/tmp#  ls /sys/class/net
apcli0   eth0     gretap0  lo       ra2      rax0     rax3
apclix0  eth1     ifb0     ra0      ra3      rax1     teql0
br-lan   gre0     ifb1     ra1      ra4      rax2

telecomadmin@LEDE:/tmp#  brctl show
bridge name	bridge id		STP enabled	interfaces
br-lan		7fff.H4H5Hc800010	no		eth0
							ra0
							rax0

telecomadmin@LEDE:/tmp#  cat /sys/kernel/debug/gpio
GPIOs 0-31, platform/1e000600.gpio, 1e000600.gpio:
 gpio-4   (                    |?                   ) out hi    
 gpio-13  (                    |?                   ) out hi    
 gpio-14  (                    |?                   ) out lo    
 gpio-15  (                    |?                   ) out hi    
 gpio-16  (                    |?                   ) out hi    
 gpio-17  (                    |?                   ) out lo    
 gpio-18  (                    |reset               ) in  hi    
 gpio-19  (                    ||                   ) out hi    

GPIOs 32-63, platform/1e000600.gpio, 1e000600.gpio:

GPIOs 64-95, platform/1e000600.gpio, 1e000600.gpio:

temporarily for now, i have changed few hexadecimals into H in above data.

please also see earlier/previous 2 posts.

atErik · April 2, 2022, 6:45am

please see previous posts/messages , any detail pointers/instructions from community ?

( you can post linux instructions, i can convert into compatible macOS/darwin )

atErik · April 11, 2022, 9:22am

it appears , no one has any interest to elaborate next steps or any steps that are required to change the existing firmware into OpenWRT firmware , for me !!

atErik · April 21, 2022, 4:42am

still, no one has elaborated next steps
or any steps
that are required to change the existing firmware into OpenWRT firmware in this router !!

vollkommenheit · April 21, 2022, 5:42am

If you want to compile OpenWrt firmware for this router on macOS, it's called "cross-compiling". Do your search based on that.

One approach would be to use Docker on macOS, with a dedicated sparse-bundle disk image that you mount on-demand for compiling OpenWrt, because the OpenWrt SDK requires a case-sensitive file system. Do "docker search openwrt" on the Docker CLI to find an existing OpenWrt SDK image someone else has created and been using for cross-compiling OpenWrt on whatever OS that Docker is available.

Or, as someone suggested elsewhere on the intraweb, you could use QEMU on macOS to compile OpenWrt.