So I have this Totolink A3 device, and wanted to try and load a LEDE firmware on it.
Seems there is very little information about the brand, device comes from AliExpress Web update rejected the images from https://downloads.lede-project.org/releases/17.01.4/targets/ramips/mt7688/ and the totolink bootloader's tftp update rejected even the original images as well as the LEDE images.
The device also has U-Boot 1.1.3 which isn't locked. So I guess this is where my quest begins - what do I put in google to find out how to back up the existing flash and try to boot a kernel and get the bootlog? This is new territory for me, and my google fu was weak.
Is md.b 0xBC040000 0x007C0000 the correct uboot command to dump the flash to serial? If not, is it possible to determine the flash address from the available output, and what do I look for?
(I'm not too worried about wrecking the device as it slipped past me it didn't have gigabit network to go with the AC1200 wifi, so it was pointless to use as a dumb bridge, and it has been replaced.)
OEM U-boot:
[04020D08][04020C0D]
DDR Calibration DQS reg = 00008789
U-Boot 1.1.3 (May 31 2016 - 09:57:25)
Board: Ralink APSoC DRAM: 64 MB
relocate_code Pointer at: 83fb8000
flash manufacture id: c8, device id 40 17
find flash: GD25Q64B
*** Warning - bad CRC, using default environment
============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:May 31 2016 Time:09:57:25
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 575 MHZ ####
estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!GPIO_MODE -> 54050404
GPIO_MODE -> 55054411
RT2880_REG_PIODIR -> 00000000
Please choose the operation: (t:tftp server/b(boot now)/f(flash test))
0
MAC Address: f4:28:53:7c:21:c0
4: System Enter Boot Command Line Interface.
U-Boot 1.1.3 (May 31 2016 - 09:57:25)
MT7628 # printenv
bootcmd=tftp
bootdelay=2
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
ipaddr=10.10.10.123
serverip=10.10.10.3
stdin=serial
stdout=serial
stderr=serial
Environment size: 149/4092 bytes
MT7628 #
Full OEM bootlog:
[04020D08][04020C0E] DDR Calibration DQS reg = 00008889 U-Boot 1.1.3 (May 31 2016 - 09:57:25) Board: Ralink APSoC DRAM: 64 MB relocate_code Pointer at: 83fb8000 flash manufacture id: c8, device id 40 17 find flash: GD25Q64B *** Warning - bad CRC, using default environment ============================================ Ralink UBoot Version: 4.3.0.0 -------------------------------------------- ASIC 7628_MP (Port5<->None) DRAM component: 512 Mbits DDR, width 16 DRAM bus: 16 bit Total memory: 64 MBytes Flash component: SPI Flash Date:May 31 2016 Time:09:57:25 ============================================ icache: sets:512, ways:4, linesz:32 ,total:65536 dcache: sets:256, ways:4, linesz:32 ,total:32768 ##### The CPU freq = 575 MHZ #### estimate memory size =64 Mbytes RESET MT7628 PHY!!!!!!GPIO_MODE -> 54050404 GPIO_MODE -> 55054411 RT2880_REG_PIODIR -> 00000000 Please choose the operation: (t:tftp server/b(boot now)/f(flash test)) 10 3: System Boot system code via Flash. ## Booting image at bc040000 ... Image Name: za3 Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 3507509 Bytes = 3.3 MB Load Address: 80000000 Entry Point: 8000c150 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 8000c150) ... ## Giving linux memsize in MB, 64 Starting kernel ... LINUX started... THIS IS ASIC Linux version 2.6.36 (mt7621@ski) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #188 Thu Feb 23 17:26:54 KST 2017 The CPU feqenuce set to 575 MHz MIPS CPU sleep mode enabled. CPU revision is: 00019655 (MIPS 24Kc) Software DMA cache coherency Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00004000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00004000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 console= PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes. Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes Writing ErrCtl register=0000000f Readback ErrCtl register=0000000f Memory: 60460k/65536k available (3222k kernel code, 5016k reserved, 815k data, 160k init, 0k highmem) NR_IRQS:128 console [ttyS1] enabled Calibrating delay loop... 381.95 BogoMIPS (lpj=763904) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 NET: Registered protocol family 16 RALINK_GPIOMODE = 55054411 RALINK_GPIOMODE = 55044411 ***** Xtal 25MHz ***** start PCIe register access RALINK_RSTCTRL = 2400000 RALINK_CLKCFG1 = fdbfffc0 *************** MT7628 PCIe RC mode ************* PCIE0 enabled Port 0 N_FTS = 1b105000 init_rt2880pci done bio: create slab <bio-0> at 0 pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000) pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff] pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit] pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff 64bit] (PCI address [0x20000000-0x200fffff] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref] pci 0000:00:00.0: PCI bridge to [bus 01-01] pci 0000:00:00.0: bridge window [io disabled] pci 0000:00:00.0: bridge window [mem 0x20000000-0x200fffff] pci 0000:00:00.0: bridge window [mem 0x20100000-0x201fffff pref] BAR0 at slot 0 = 0 bus=0x0, slot = 0x0 res[0]->start = 0 res[0]->end = 0 res[1]->start = 20200000 res[1]->end = 2020ffff res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 bus=0x1, slot = 0x0 res[0]->start = 20000000 res[0]->end = 200fffff res[1]->start = 0 res[1]->end = 0 res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 Switching to clocksource Ralink Systick timer NET: Registered protocol family 2 --> ipconflict proc OK !!!!!!!!!! IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 squashfs: version 4.0 (2009/01/31) Phillip Lougher msgmni has been set to 118 io scheduler noop registered io scheduler deadline registered io scheduler cfq registered (default) Ralink gpio driver initialized Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A brd: module loaded flash manufacture id: c8, device id 40 17 GD25Q64B(c8 40170000) (8192 Kbytes) mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0 Creating 7 MTD partitions on "raspi": 0x000000040000-0x000000800000 : "Firmware" 0x000000000000-0x000000020000 : "Bootloader" 0x000000020000-0x000000030000 : "Config" 0x000000030000-0x000000040000 : "Factory" 0x000000040000-0x000000196575 : "Kernel" mtd: partition "Kernel" doesn't end on an erase block -- force read-only 0x000000196575-0x000001000000 : "RootFS" mtd: partition "RootFS" extends beyond the end of device "raspi" -- size truncated to 0x669a8b mtd: partition "RootFS" doesn't start on an erase block boundary -- force read-only 0x000000040000-0x000001000000 : "Kernel_RootFS" mtd: partition "Kernel_RootFS" extends beyond the end of device "raspi" -- size truncated to 0x7c0000 rdm_major = 253 GMAC1_MAC_ADRH -- : 0x0000000c GMAC1_MAC_ADRL -- : 0x4347d329 Ralink APSoC Ethernet Driver Initilization. v3.1 256 rx/tx descriptors allocated, mtu = 1500! GMAC1_MAC_ADRH -- : 0x0000000c GMAC1_MAC_ADRL -- : 0x4347d329 PROC INIT OK! PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered PPP MPPE Compression module registered NET: Registered protocol family 24 === pAd = c0003000, size = 1458368 === <-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x <-- RTMPAllocAdapterBlock, Status=0 RtmpChipOpsHook(492): Not support for HIF_MT yet! mt7628_init()--> mt7628_init(FW(8a00), HW(8a01), CHIPID(7628)) e2.bin mt7628_init(1135)::(2), pChipCap->fw_len(63888) mt_bcn_buf_init(218): Not support for HIF_MT yet! <--mt7628_init() Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (944 buckets, 3776 max) NETDETECT target register ip_nat_bnet: Trying to register for port 6112 ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux TCP cubic registered Twin IP Module Init --> Init Smart QoS Monitor NET: Registered protocol family 17 L2TP core driver, V2.0 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> SQUASHFS error: Xattrs in filesystem, these will be ignored VFS: Mounted root (squashfs filesystem) readonly on device 31:5. Freeing unused kernel memory: 160k freed Checking System Requirements ******************************************* DRAM SIZE : Requirement->64 Mbytes / Mounted->64 Mbytes -----------> [OK] FLASH SIZE : Requirement->4 Mbytes / Mounted->8 Mbytes -----------> [OK] Bigger Flash memory is used. alias:za3 version:9.990 Restore Config ( 8522 bytes ) Init LED ->[ Blinking ] switch reg write offset=14, value=405555 switch reg write offset=50, value=2001 switch reg write offset=98, value=7f3f switch reg write offset=e4, value=3f switch reg write offset=40, value=1002 switch reg write offset=44, value=1001 switch reg write offset=48, value=1001 switch reg write offset=70, value=ffff417e Bridge Init PinCode : 12514625 Regulated Power for 149 Channel -> 100 device apclii0 is not a slave of br0 PinCode : 12514625 Regulated Power for 5 Channel -> 100 device apcli0 is not a slave of br0 2.4GHz UUID => len:37 / 28802880-2880-1880-a880-f428537c21c0 5GHz UUID => len:37 / 28802880-2880-1880-a880-f428537c21c0 ================================================================= press magic key to change default setting ... LAN MAC : F4:28:53:7C:21:C0 WAN MAC : F4:28:53:7C:21:C1 iptables: No chain/target/match by that name ==> Restart AUTO Negotiation for all ports iptables: No chain/target/match by that name iptables: No chain/target/match by that name iptables: No chain/target/match by that name iptables: No chain/target/match by that name iptables: No chain/target/match by that name Restart HTTPD Kill httpdkillall: httpd: no process killed Start httpdkillall: pptpd: no process killed PPTP Server Start!! insmod: /lib/modules/2.6.36: No such file or directory insmod: ppp_mppe.ko: module not found iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) SIGNAL -> Config Update signal progress SIGNAL -> WAN ip changed ez_ipupdate callback --> time_elapsed: 0 iptables: Bad rule (does a matching rule exist in that chain?) Led Silent Callback Turn ON All LED switch reg write offset=a4, value=5 switch reg write offset=a8, value=5 switch reg write offset=ac, value=5 switch reg write offset=b0, value=5 switch reg write offset=b4, value=5 Dynamic Channel Search for ra0 is OFF Dynamic Channel Search for rai0 is OFF 8021x Start by WAN IP CHANGED Callback killall: rt2860apd: no process killed killall: rtinicapd: no process killed iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) signalling Update SIGNAL -> Config Update signal progress Check DHCP PID Elapsed Time: 1 SIGNAL -> WAN ip changed Reaped 306 ez_ipupdate callback --> time_elapsed: 45 Reaped 382 Led Silent Callback Turn ON All LED switch reg write offset=a4, value=5 switch reg write offset=a8, value=5 switch reg write offset=ac, value=5 switch reg write offset=b0, value=5 switch reg write offset=b4, value=5 Dynamic Channel Search for ra0 is OFF Dynamic Channel Search for rai0 is OFF 8021x Start by WAN IP CHANGED Callback killall: rt2860apd: no process killed killall: rtinicapd: no process killed iptables: Bad rule (does a matching rule exist in that chain?) signalling Update SIGNAL -> Config Update signal progress [DHCPC:Check IP] : Check WAN IP : 10.10.0.109 , 255.255.255.0 [DHCPC:Check IP] : Same network Check DHCP PID Elapsed Time: 1 SIGNAL -> WAN ip changed Reaped 384 ez_ipupdate callback --> time_elapsed: 25 iptables: Bad rule (does a matching rule exist in that chain?) Led Silent Callback Turn ON All LED switch reg write offset=a4, value=5 switch reg write offset=a8, value=5 switch reg write offset=ac, value=5 switch reg write offset=b0, value=5 switch reg write offset=b4, value=5 Dynamic Channel Search for ra0 is OFF Dynamic Channel Search for rai0 is OFF 8021x Start by WAN IP CHANGED Callback killall: rt2860apd: no process killed killall: rtinicapd: no process killed