[SOLVED] MT76: MT7612E Firmware loading hangs (adding support for CUDY WR1000)

I am trying to add supporto for this device: CUDY WR1000 (but an internal sticker says JIR-AC681M... A JCG device)
I got everything working except for the 5GHz wifi MT7612E (and leds). It hangs during the firmware loading.

[    9.365061] mt76x2e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[    9.377585] mt76x2e 0000:01:00.0: ASIC revision: 76120044
[   10.044126] mt76x2e 0000:01:00.0: ROM patch build: 20141115060606a
[   10.061203] mt76x2e 0000:01:00.0: Firmware Version: 0.0.00
[   10.072122] mt76x2e 0000:01:00.0: Build: 1
[   10.080225] mt76x2e 0000:01:00.0: Build Time: 201507311614____

And here stops working....

I don't know if it's an MT76 problem or a wrong dts file

Adding some printk inside pci_mcu.c file, turns out that the problematic line is:
mt76_wr(dev, MT_MCU_INT_LEVEL, 2);

I also tried to load the firmware inside the original rom (Build Time: 201607111443____ vs Build Time: 201507311614____) but it doesn't work either.

[ 1389.510682] mt76x2e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[ 1389.523213] mt76x2e 0000:01:00.0: ASIC revision: 76120044
[ 1390.184125] mt76x2e 0000:01:00.0: ROM patch build: 20141115060606a
[ 1390.201171] mt76x2e 0000:01:00.0: Firmware Version: 0.0.00
[ 1390.212097] mt76x2e 0000:01:00.0: Build: 1
[ 1390.220201] mt76x2e 0000:01:00.0: Build Time: 201607111443____
[ 1390.231755] My Debugger is Printk 1
[ 1390.238667] My Debugger is Printk 1
[ 1390.245576] My Debugger is Printk 2
[ 1390.252485] My Debugger is Printk 2
[ 1390.259378] My Debugger is Printk 3
[ 1390.266285] My Debugger is Printk 3
[ 1390.273197] My Debugger is Printk 4
[ 1390.280096] My Debugger is Printk 4
[ 1390.289666] My Debugger is Printk 5
[ 1390.296588] My Debugger is Printk 5
[ 1390.303497] My Debugger is Printk 6
[ 1390.310388] My Debugger is Printk 6
[ 1390.317297] My Debugger is Printk 7
[ 1390.324207] My Debugger is Printk 7
[ 1390.331101] My Debugger is Printk 8
[ 1390.338008] My Debugger is Printk 8
[ 1390.344919] My Debugger is Printk 9
[ 1390.351813] My Debugger is Printk 9
[ 1390.359448] My Debugger is Printk 10
[ 1390.366533] My Debugger is Printk 10
[ 1390.373623] My Debugger is Printk 11
[ 1390.380689] My Debugger is Printk 11
[ 1390.387770] My Debugger is Printk 12
[ 1390.394850] My Debugger is Printk 12
[ 1390.401915] My Debugger is Printk 13
[ 1390.408993] My Debugger is Printk 13

And this is my edited pci_mcu.c file

        printk("My Debugger is Printk 13\n");
        printk("My Debugger is Printk 13\n");
        /* trigger firmware */
        mt76_wr(dev, MT_MCU_INT_LEVEL, 2);
        printk("My Debugger is Printk 14\n");
        printk("My Debugger is Printk 14\n");

This is the dts file that I am using:
https://github.com/DavideFioravanti/openwrt/commit/8505de6b8327e92cf92a9d84d6a485ce570793fb

This is the bootlog of the original firmware:

 [04010D07][04010D0A]

DDR Calibration DQS reg = 00008988



U-Boot U-Boot 1.1.3 (Jul  2 2018 - 11:39:55)


Board: Ralink APSoC DRAM:  64 MB

relocate_code Pointer at: 83fb8000

flash manufacture id: ef, device id 40 17

find flash: W25Q64BV

*** Warning - bad CRC, using default environment


============================================ 

Ralink UBoot Version: 4.3.0.0

-------------------------------------------- 

ASIC 7628_MP (Port5<->None)

DRAM component: 512 Mbits DDR, width 16

DRAM bus: 16 bit

Total memory: 64 MBytes

Flash component: SPI Flash

Date:Jul  2 2018  Time:11:39:55

============================================ 

icache: sets:512, ways:4, linesz:32 ,total:65536

dcache: sets:256, ways:4, linesz:32 ,total:32768 


 ##### The CPU freq = 575 MHZ #### 

 estimate memory size =64 Mbytes

RESET MT7628 PHY!!!!!!

Please choose the operation: 

   1: Load system code to SDRAM via TFTP. 

   2: Load system code then write to Flash via TFTP. 

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   7: Load Boot Loader code then write to Flash via Serial. 

   9: Load Boot Loader code then write to Flash via TFTP. 

   a: Load JCG firmware then write to Flash via TFTP. 

 4  3  2  1  0 

   

3: System Boot system code via Flash.

## Booting image at bc050000 ...

   Image Name:   Linux Kernel Image

   Image Type:   MIPS Linux Kernel Image (lzma compressed)

   Data Size:    4408425 Bytes =  4.2 MB

   Load Address: 80000000

   Entry Point:  8000c150

   Verifying Checksum ... OK

   Uncompressing Kernel Image ... OK

No initrd

## Transferring control to Linux (at address 8000c150) ...

## Giving linux memsize in MB, 64


Starting kernel ...


Linux version 2.6.36+ (root@devsrv3) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #450 Mon Jul 2 11:39:12 CST 2018

 The CPU feqenuce set to 580 MHz

 MIPS CPU sleep mode enabled.
CPU revision is: 00019655 (MIPS 24Kc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,57600n8 root=/dev/ram0 console=ttyS0
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=00020432
Readback ErrCtl register=00020432
Memory: 58140k/65536k available (2657k kernel code, 7336k reserved, 606k data, 3284k init, 0k highmem)
NR_IRQS:128
console [ttyS0] enabled
Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
RALINK_GPIOMODE = 54054404 
RALINK_GPIOMODE = 54044404 
***** Xtal 40MHz *****
start PCIe register access
RALINK_RSTCTRL = 2400000
RALINK_CLKCFG1 = fdbfffc0

*************** MT7628 PCIe RC mode *************
PCIE0 enabled
Port 0 N_FTS = 1b105000
init_rt2880pci done
bio: create slab <bio-0> at 0
pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff 64bit] (PCI address [0x20000000-0x200fffff]
pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0:   bridge window [io  disabled]
pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
BAR0 at slot 0 = 0
bus=0x0, slot = 0x0
res[0]->start = 0
res[0]->end = 0
res[1]->start = 20200000
res[1]->end = 2020ffff
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
bus=0x1, slot = 0x0
res[0]->start = 20000000
res[0]->end = 200fffff
res[1]->start = 0
res[1]->end = 0
res[2]->start = 0
res[2]->end = 0
res[3]->start = 0
res[3]->end = 0
res[4]->start = 0
res[4]->end = 0
res[5]->start = 0
res[5]->end = 0
Switching to clocksource Ralink Systick timer
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
Load Ralink Timer0 Module
Load Ralink Timer1 Module
Load Ralink Timer2 Module
msgmni has been set to 113
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered (default)
Ralink gpio driver initialized
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0x10000c00 (irq = 20) is a 16550A
serial8250: ttyS1 at MMIO 0x10000d00 (irq = 21) is a 16550A
brd: module loaded
flash manufacture id: ef, device id 40 17
W25Q64BV(ef 40170000) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 5 MTD partitions on "raspi":
0x000000000000-0x000000800000 : "ALL"
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config"
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x000000800000 : "Kernel"
rdm_major = 253
GMAC1_MAC_ADRH -- : 0x0000b44b
GMAC1_MAC_ADRL -- : 0xd6202aef
Ralink APSoC Ethernet Driver Initilization. v3.1  512 rx/tx descriptors allocated, mtu = 1500!
GMAC1_MAC_ADRH -- : 0x0000b44b
GMAC1_MAC_ADRL -- : 0xd6202aef
PROC INIT OK!
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
GACT probability NOT on
netem: version 1.2
u32 classifier
    Performance counters on
    input device check on
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (908 buckets, 3632 max)
matchsize=264
IPVS: Registered protocols ()
IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
IPVS: ipvs loaded.
GRE over IPv4 demultiplexor driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
TCP cubic registered
NET: Registered protocol family 10
NET: Registered protocol family 17
L2TP core driver, V2.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Freeing unused kernel memory: 3284k freed

init started: BusyBox v1.12.1 (Algorithmics/MIPS FPU Emulator v1.5
2018-07-02 11:24:13 CST)

Bad idevpts: called with bogus options
nittab entry at line 2
mount: mounting none on /proc/bus/usb failed: No such file or directory
Welcome to
      _  ____ ____   _     ___ _   _ _   ___  __
     | |/ ___/ ___| | |   |_ _| \ | | | | \ \/ /
  _  | | |  | |  _  | |    | ||  \| | | | |\  / 
 | |_| | |___ |_| | | |___ | || |\  | |_| |/  \ 
  \___/ \____\____| |_____|___|_| \_|\___//_/\_\

-------------------------------------------------
For OEM/ODM, please check:
http://www.jcgcom.com/
FFFFFFB4:4B:FFFFFFD6:20:2A:FFFFFFEF
Raeth v3.1 (Tasklet)

phy_tx_ring = 0x0295c000, tx_ring = 0xa295c000

phy_rx_ring0 = 0x0295e000, rx_ring[0] = 0xa295e000

phy_rx_ring0 = 0x0295e000, rx_ring[0] = 0xa295e000
GMAC1_MAC_ADRH -- : 0x0000b44b
GMAC1_MAC_ADRL -- : 0xd6202aef
device eth2.1 entered promiscuous mode
device eth2 entered promiscuous mode


=== pAd = c04e0000, size = 1396448 ===

<-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
<-- RTMPAllocAdapterBlock, Status=0
RtmpChipOpsHook(492): Not support for HIF_MT yet!
mt7628_init()-->
mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
e2.bin mt7628_init(1135)::(2), pChipCap->fw_len(63888)
mt_bcn_buf_init(218): Not support for HIF_MT yet!
<--mt7628_init()
register rt2860


=== pAd = c0b02000, size = 1776800 ===

<-- RTMPAllocTxRxRingMemory, Status=0
<-- RTMPAllocAdapterBlock, Status=0
pAd->CSRBaseAddress =0xc0a00000, csr_addr=0xc0a00000!
device_id =0x7662
==>rlt_wlan_chip_onoff(): OnOff:1, Reset= 1, pAd->WlanFunCtrl:0x0, Reg-WlanFunCtrl=0x20a
chip_id1="7628", chip_id2="7612", pAd->MACVersion=0x76623000
chip_id1=0x0, chip_id2=0x0, pAd->MACVersion=0x76623000
RtmpChipOpsEepromHook::e2p_type=0, inf_Type=5
RtmpEepromGetDefault::e2p_dafault=2
NVM is efuse and the information is too less to bring up the interface
Force to use Flash mode
NVM is FLASH mode (pAd->flash_offset = 0x48000)
get_dev_name_prefix(): dev_idx = 1, dev_name_prefix=rai
TX_BCN DESC a2b6c000 size = 320
RX[0] DESC a2b6f000 size = 1024
RX[1] DESC a2b70000 size = 1024
E2pAccessMode=2
cfg_mode=9
cfg_mode=9
wmode_band_equal(): Band Equal!
AndesSendCmdMsg: Could not send in band command due to diable fRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
default ApCliAPSDCapable[0]=0
RTMPSetDefaultChannel() : default channel to 1 
load fw image from fw_header_image
AndesMTLoadFwMethod1(2182)::pChipCap->fw_len(63888)
FW Version:20151201
FW Build Date:20151201183641
CmdAddressLenReq:(ret = 0)
CmdFwStartReq: override = 1, address = 1048576
CmdStartDLRsp: WiFI FW Download Success
MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
efuse_probe: efuse = 10000002
RtmpChipOpsEepromHook::e2p_type=2, inf_Type=4
RtmpEepromGetDefault::e2p_dafault=2
RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
NVM is FLASH mode
1. Phy Mode = 14
Country Region from e2p = ffff
tssi_1_target_pwr_g_band = -95
2. Phy Mode = 14
3. Phy Mode = 14
NICInitPwrPinCfg(11): Not support for HIF_MT yet!
NICInitializeAsic(651): Not support rtmp_mac_sys_reset () for HIF_MT yet!
mt_mac_init()-->
MtAsicInitMac()-->
mt7628_init_mac_cr()-->
MtAsicSetMacMaxLen(1276): Set the Max RxPktLen=1024!
<--mt_mac_init()
	WTBL Segment 1 info:
		MemBaseAddr/FID:0x28000/0
		EntrySize/Cnt:32/128
	WTBL Segment 2 info:
		MemBaseAddr/FID:0x40000/0
		EntrySize/Cnt:64/128
	WTBL Segment 3 info:
		MemBaseAddr/FID:0x42000/64
		EntrySize/Cnt:64/128
	WTBL Segment 4 info:
		MemBaseAddr/FID:0x44000/128
		EntrySize/Cnt:32/128
AntCfgInit(2947): Not support for HIF_MT yet!
MCS Set = ff ff 00 00 01
MtAsicSetChBusyStat(861): Not support for HIF_MT yet!
MtAsicSetRalinkBurstMode(3047): Not support for HIF_MT yet!
MtAsicSetPiggyBack(796): Not support for HIF_MT yet!
reload DPD from flash , 0x9F = [c600] doReload bit7[0]
CmdLoadDPDDataFromFlash: Channel = 1, DoReload = 0
MtAsicSetTxPreamble(3026): Not support for HIF_MT yet!
CmdSlotTimeSet:(ret = 0)
MtAsicAddSharedKeyEntry(1343): Not support for HIF_MT yet!
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
Main bssid = b4:4b:d6:20:2a:f0
<==== rt28xx_init, Status=0
@@@ ed_monitor_init : ===>
@@@ ed_monitor_init : <===
mt7628_set_ed_cca: TURN ON EDCCA mac 0x10618 = 0xd7c87d0f, EDCCA_Status=1
WiFi Startup Cost (ra0): 0.904s

====
@@@ ed_status_read: EDCCA TH - H
pAd->ed_trigger_cnt : 0 > 20 ||  pAd->ed_big_rssi_stat : 0 < 50
====
==>SetSCSEnable_Proc (ON)
device ra0 entered promiscuous mode
ioctl: Cannot assign requested address
route: ioctl 0x890b failed: Network is down
ioctl: Cannot assign requested address
build time = 
20141115060606a
rom patch for E3 IC

platform = 
ALPS
hw/sw version = 
ŠŠ
patch version = 

FW Version:0.0.00 Build:1
Build Time:201607111443____
fw for E3 IC
RX[0] DESC a2aab000 size = 4096
RX[1] DESC a2aac000 size = 4096
E2pAccessMode=2
cfg_mode=14
cfg_mode=14
wmode_band_equal(): Band Not Equal!
1. Phy Mode = 49
get_chl_grp:illegal channel (167)
get_chl_grp:illegal channel (167)
get_chl_grp:illegal channel (169)
get_chl_grp:illegal channel (169)
get_chl_grp:illegal channel (171)
get_chl_grp:illegal channel (171)
Country Region from e2p = ffff
mt76x2_read_temp_info_from_eeprom:: is_temp_tx_alc=0, temp_tx_alc_enable=0
mt76x2_read_tx_alc_info_from_eeprom:: is_ePA_mode=0, ePA_type=3
mt76x2_read_tx_alc_info_from_eeprom:: [5G band] high_temp_slope=0, low_temp_slope=0
mt76x2_read_tx_alc_info_from_eeprom:: [2G band] high_temp_slope=0, low_temp_slope=0
mt76x2_read_tx_alc_info_from_eeprom:: [5G band] tc_lower_bound=0, tc_upper_bound=0
mt76x2_read_tx_alc_info_from_eeprom:: [2G band] tc_lower_bound=0, tc_upper_bound=0
mt76x2_get_external_lna_gain::LNA type=0x11, BLNAGain=0x0, ALNAGain0=0x0, ALNAGain1=0x0, ALNAGain2=0x0
2. Phy Mode = 49
3. Phy Mode = 49
andes_pci_fw_init
0x1300 = 00073200
AntCfgInit: primary/secondary ant 0/1
andes_load_cr:cr_type(2)
ChipStructAssign(): MT76x2 hook !
@@@ BuildChannel # 36 :: Pwr0 = 26, Pwr1 =26, Flags = c0, RemainingTimeForUse=0
 @@@ BuildChannel # 40 :: Pwr0 = 26, Pwr1 =26, Flags = c0, RemainingTimeForUse=0
 @@@ BuildChannel # 44 :: Pwr0 = 26, Pwr1 =26, Flags = c0, RemainingTimeForUse=0
 @@@ BuildChannel # 48 :: Pwr0 = 26, Pwr1 =26, Flags = c0, RemainingTimeForUse=0
 RTMPSetPhyMode: channel is out of range, use first channel=0 
MCS Set = ff ff 00 00 01
TX0 power compensation = 0x38
TX1 power compensation = 0x38
mt76x2_bbp_adjust():rf_bw=2, ext_ch=1, PrimCh=36, HT-CentCh=38, VHT-CentCh=42
APStartUp(): AP Set CentralFreq at 42(Prim=36, HT-CentCh=38, VHT-CentCh=42, BBP_BW=2)
mt76x2_calibration(channel = 42)
Main bssid = b4:4b:d6:20:2a:f4
mt76x2_reinit_agc_gain:original agc_vga0 = 0x5c, agc_vga1 = 0x5c
mt76x2_reinit_agc_gain:updated agc_vga0 = 0x5c, agc_vga1 = 0x5c
mt76x2_reinit_hi_lna_gain:original hi_lna0 = 0x27, hi_lna1 = 0x27
mt76x2_reinit_hi_lna_gain:updated hi_lna0 = 0x27, hi_lna1 = 0x27
original vga value(chain0) = 5c
original vga value(chain1) = 5c
<==== rt28xx_init, Status=0
device rai0 entered promiscuous mode
ioctl: Cannot assign requested address
ioctl: Cannot assign requested address
ipt_account 0.1.21 : Piotr Gasidlo <quaker@barbara.eu.org>, http://code.google.com/p/ipt-account/
br0: port 3(rai0) entering learning state
br0: port 3(rai0) entering learning state
br0: port 2(ra0) entering learning state
br0: port 2(ra0) entering learning state
br0: port 1(eth2.1) entering learning state
br0: port 1(eth2.1) entering learning state
reload DPD from flash , 0x9F = [c600] doReload bit7[0]
CmdLoadDPDDataFromFlash: Channel = 1, DoReload = 0
reload DPD from flash , 0x9F = [c600] doReload bit7[0]
CmdLoadDPDDataFromFlash: Channel = 1, DoReload = 0
reload DPD from flash , 0x9F = [c600] doReload bit7[0]
CmdLoadDPDDataFromFlash: Channel = 13, DoReload = 0
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0x0
MtAsicSetPiggyBack(796): Not support for HIF_MT yet!
MtAsicSetRalinkBurstMode(3047): Not support for HIF_MT yet!
MtAsicSetPiggyBack(796): Not support for HIF_MT yet!
reload DPD from flash , 0x9F = [c600] doReload bit7[0]
CmdLoadDPDDataFromFlash: Channel = 13, DoReload = 0
MtAsicSetTxPreamble(3026): Not support for HIF_MT yet!
MtAsicAddSharedKeyEntry(1343): Not support for HIF_MT yet!
AddTxSType: already registered TxSType (PID = 32, Format = 0
AddTxSType: already registered TxSType (PID = 6, Format = 0
AddTxSType: already registered TxSType (PID = 8, Format = 0
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0

This is the OpenWrt bootlog:

[04010C0E][04010D09]
DDR Calibration DQS reg = 00008987


U-Boot U-Boot 1.1.3 (Jul  2 2018 - 11:39:55)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
******************************
Software System Reset Occurred
******************************
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Jul  2 2018  Time:11:39:55
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 575 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
   a: Load JCG firmware then write to Flash via TFTP.
 4
You choosed 1

 0


1: System Load Linux to SDRAM via TFTP.
 Please Input new ones /or Ctrl-C to discard
        Input device IP (192.168.1.123) ==:192.168.1.123
        Input server IP (192.168.1.100) ==:192.168.1.100
        Input Linux Kernel filename (openwrt-ramips-mt76x8-wr1000-initramfs-kern
el.bin) ==:openwrt-ramips-mt76x8-wr1000-initramfs-kernel_WIFI.bin

 netboot_common, argc= 3

 NetTxPacket = 0x83FE6500

 KSEG1ADDR(NetTxPacket) = 0xA3FE6500

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!!
TFTP from server 192.168.1.100; our IP address is 192.168.1.123
Filename 'openwrt-ramips-mt76x8-wr1000-initramfs-kernel_WIFI.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (00:0e:c6:a9:90:e6)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##############################################################
done
Bytes transferred = 3975132 (3ca7dc hex)
NetBootFileXferSize= 003ca7dc
Erasing SPI Flash...
.
Writing to SPI Flash...
.
done
Automatic boot of image at addr 0x80A00000 ...
## Booting image at 80a00000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.82
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    3975068 Bytes =  3.8 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 4.14.82 (root@NGC1) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r8614-78ca6a5578)) #0 Fri Nov 30 08:04:29 2018
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is Cudy WR1000
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] random: get_random_bytes called from start_kernel+0x8c/0x474 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=0006a210
[    0.000000] Readback ErrCtl register=0006a210
[    0.000000] Memory: 57504K/65536K available (3616K kernel code, 164K rwdata,840K rodata, 2540K init, 200K bss, 8032K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] intc: using register map from devicetree
[    0.000000] CPU Clock: 580MHz
[    0.000000] timer_probe: no matching timers found
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000011] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015373] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087588] pid_max: default: 32768 minimum: 301
[    0.096937] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.109894] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.129397] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.148775] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.160874] pinctrl core: initialized pinctrl subsystem
[    0.171658] NET: Registered protocol family 16
[    0.288145] mt7620-pci 10140000.pcie: Port 0 N_FTS = 1b105000
[    0.449147] PCI host bridge /pcie@10140000 ranges:
[    0.458489]  MEM 0x0000000020000000..0x000000002fffffff
[    0.468800]   IO 0x0000000010160000..0x000000001016ffff
[    0.495933] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.507163] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.518313] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.530060] PCI host bridge to bus 0000:00
[    0.538026] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.551658] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    0.563313] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.576729] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.593584] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.606578] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.620300] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    0.633716] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[    0.647992] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.661420] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[    0.675875] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[    0.690132] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.699925] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
[    0.713352] pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
[    0.732005] clocksource: Switched to clocksource MIPS
[    0.743089] NET: Registered protocol family 2
[    0.752480] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.766180] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.778700] TCP: Hash tables configured (established 1024 bind 1024)
[    0.791411] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.802880] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.815471] NET: Registered protocol family 1
[    2.712012] random: fast init done
[    4.041116] Crashlog allocated RAM at address 0x3f00000
[    4.053047] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    4.071427] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    4.082876] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    4.178307] io scheduler noop registered
[    4.185982] io scheduler deadline registered (default)
[    4.196900] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    4.210530] console [ttyS0] disabled
[    4.217556] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud= 2500000) is a 16550A
[    4.235385] console [ttyS0] enabled
[    4.235385] console [ttyS0] enabled
[    4.249115] bootconsole [early0] disabled
[    4.249115] bootconsole [early0] disabled
[    4.265446] cacheinfo: Failed to find cpu0 device node
[    4.275658] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    4.288430] spi-mt7621 10000b00.spi: sys_freq: 193333333
[    4.312477] m25p80 spi0.0: s25fl064k (8192 Kbytes)
[    4.322033] 4 fixed-partitions partitions found on MTD device spi0.0
[    4.334619] Creating 4 MTD partitions on "spi0.0":
[    4.344119] 0x000000000000-0x000000030000 : "u-boot"
[    4.354892] 0x000000030000-0x000000040000 : "u-boot-env"
[    4.366335] 0x000000040000-0x000000050000 : "factory"
[    4.377258] 0x000000050000-0x000000800000 : "firmware"
[    4.426905] libphy: Fixed MDIO Bus: probed
[    4.445248] rt3050-esw 10110000.esw: link changed 0x00
[    4.457073] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    4.475251] NET: Registered protocol family 10
[    4.488051] Segment Routing with IPv6
[    4.495489] NET: Registered protocol family 17
[    4.504356] 8021q: 802.1Q VLAN Support v1.8
[    4.528703] Freeing unused kernel memory: 2540K
[    4.537701] This architecture does not have kernel memory protection.
[    4.564608] init: Console is alive
[    4.571577] init: - watchdog -
[    4.600448] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.618037] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.642902] init: - preinit -
[    4.830281] rt3050-esw 10110000.esw: link changed 0x00
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    8.007854] procd: - early -
[    8.013757] procd: - watchdog -
[    8.574883] procd: - watchdog -
[    8.581394] procd: - ubus -
[    8.594620] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.636959] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.650149] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.663811] procd: - init -
Please press Enter to activate this console.
[    8.849898] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.866754] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    8.888916] Loading modules backported from Linux version v4.19-rc5-0-g6bf4ca7fbc85
[    8.904163] rt3050-esw 10110000.esw: link changed 0x04
[    8.914346] Backport generated by backports.git v4.19-rc5-1-0-g05571dcd
[    8.930729] ip_tables: (C) 2000-2006 Netfilter Core Team
[    8.950026] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[    9.025112] xt_time: kernel timezone is -0000
[    9.092963] mt76_wmac 10300000.wmac: ASIC revision: 76280001
[    9.108520] mt76_wmac 10300000.wmac: Firmware Version: 20151201
[    9.120309] mt76_wmac 10300000.wmac: Build Time: 20151201183641
[    9.152011] mt76_wmac 10300000.wmac: firmware init done
[    9.365061] mt76x2e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[    9.377585] mt76x2e 0000:01:00.0: ASIC revision: 76120044
[   10.044126] mt76x2e 0000:01:00.0: ROM patch build: 20141115060606a
[   10.061203] mt76x2e 0000:01:00.0: Firmware Version: 0.0.00
[   10.072122] mt76x2e 0000:01:00.0: Build: 1
[   10.080225] mt76x2e 0000:01:00.0: Build Time: 201507311614____

Removing the pcie section inside the dts file works without problems...

Can someone help me?

Hi, I'm not an expert developer, but maybe the problem it's in the address
mediatek,mtd-eeprom = <&factory 0x8000>;

Could you verify that indeed, the factory partition has at address 0x8000 the mt7612e eeprom?. To verify it, Remove the pcie section from your dts, boot your openwrt tftp image, dump the factory partition from luci in System menu -> Backup / Flash Firmware
Pantallazo-2018-12-03%2014-21-32
And open it in a hex editor like HxD.

Then go to offset 8000 a verify that you have something like this at this offset
Pantallazo-2018-12-03%2014-53-15
(this is the mt7612 truncated eeprom example from mediatek, please don't post your eeprom if you are concern about security, it contains sensible data about your device like your wireless mac address).
MT7612e eeprom starts with hex value 62 76 01

In case that you don't have your mt7612e eeprom in offset 8000 you need to find the correct offset in your factory partition and correct it on your dts file.

Hope it helps.

Edit: I'm not sure if you need

pcie-bridge { }
device_type = "pci";

Other dts files seem to don't need it

3 Likes

Thank you so much!! :grinning: That line was the problem! Because of the the kernel correctly detected the card, I thought that the problem was caused by the driver... or at least some misconfigured GPIO. But I was wrong! :slight_smile:Thank you again! :slight_smile:

Just one tip: you can do the same thing within OpenWrt by running hexdump -C /dev/mtd2

Did that fix the LED too?

If it did not, I have seen it done like this once before

        pcie1 {
	        mt76@0,0 {
		        reg = <0x0000 0 0 0 0>;
		        mediatek,mtd-eeprom = <&factory 0x8000>;
		        ieee80211-freq-limit = <5000000 6000000>;
		        
		        led {
			        led-sources = <2>;
			        led-active-low;
		        };
	        };
        };
1 Like

Now everything is working fine, but 5G led and POWER led can't be controlled by the user.

However this is my latest commit. As soon as I have some spare time to tidy up the commit and test the flashing procedure I will create the PR.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.