I am looking for OpenWRT support for TOTOLINK A6000R.
SoC: MediaTek MT7621DAT, PHY: MediaTek MT7615N and MediaTek MT7603EN.
Antennas are soldered directly onto the board, no serial port described on the PCB silkscreen - it may be problematic in case of bricking.
Without serial I think it would be hard to observe the bootloader operations?
4 pins on lower left side, or 4 solder tin covered holes on upper right side?
1 Like
Yup. The header on left has 4 resistors so it may be rather the top right one, but as soldered antennas and not enough wires to flip board, it may be tricky to solder there.
get/create a 90 deg connector, push the pins through from the bottom, solder on this side of the PCB.
LINUX started…
THIS IS ASIC
SDK 5.0.S.0
[ 0.000000] Linux version 3.10.108 (root@localhost.localdomain) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #531 SMP Fri Dec 18 21:26:05 CST 2020
[ 0.000000]
[ 0.000000] The CPU feqenuce set to 880 MHz
[ 0.000000] GCMP present
[ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[ 0.000000] Software DMA cache coherency
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] DMA [mem 0x00000000-0x00ffffff]
[ 0.000000] Normal [mem 0x01000000-0x07ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x07ffffff]
[ 0.000000] avail: cpu2 is not ready
[ 0.000000] avail: cpu3 is not ready
[ 0.000000] Detected 1 available secondary CPU(s)
[ 0.000000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[ 0.000000] PERCPU: Embedded 7 pages/cpu @81925000 s6144 r8192 d14336 u32768
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
[ 0.000000] Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 rootfstype=squashfs,jffs2
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Writing ErrCtl register=0001202b
[ 0.000000] Readback ErrCtl register=0001202b
[ 0.000000] Memory: 121548k/131072k available (5914k kernel code, 9524k reserved, 2004k data, 268k init, 0k highmem)
[ 0.000000] Hierarchical RCU implementation.
[ 0.000000] RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[ 0.000000] NR_IRQS:128
[ 0.000000] console [ttyS1] enabled
[ 0.132000] Calibrating delay loop… 577.53 BogoMIPS (lpj=1155072)
[ 0.172000] pid_max: default: 32768 minimum: 301
[ 0.176000] Mount-cache hash table entries: 512
[ 0.180000] launch: starting cpu1
[ 0.184000] launch: cpu1 gone!
[ 0.184000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[ 0.184000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.184000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[ 0.184000] CPU1 revision is: 0001992f (MIPS 1004Kc)
[ 0.216000] Synchronize counters for CPU 1: done.
[ 0.220000] Brought up 2 CPUs
[ 0.224000] NET: Registered protocol family 16
[ 0.524000] release PCIe RST: RALINK_RSTCTRL = 7000000
[ 0.528000] PCIE PHY initialize
[ 0.532000] ***** Xtal 40MHz *****
[ 0.536000] start MT7621 PCIe register access
[ 1.132000] RALINK_RSTCTRL = 7000000
[ 1.136000] RALINK_CLKCFG1 = 77ffeff8
[ 1.140000]
[ 1.140000] *************** MT7621 PCIe RC mode *************
[ 1.636000] PCIE2 no card, disable it(RST&CLK)
[ 1.640000] pcie_link status = 0x3
[ 1.644000] RALINK_RSTCTRL= 3000000
[ 1.648000] *** Configure Device number setting of Virtual PCI-PCI bridge ***
[ 1.652000] RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2
[ 1.656000] PCIE0 enabled
[ 1.660000] PCIE1 enabled
[ 1.664000] interrupt enable status: 300000
[ 1.668000] Port 1 N_FTS = 1b105000
[ 1.672000] Port 0 N_FTS = 1b105000
[ 1.676000] config reg done
[ 1.680000] init_rt2880pci done
[ 1.704000] bio: create slab <bio-0> at 0
[ 1.708000] vgaarb: loaded
[ 1.712000] PCI host bridge to bus 0000:00
[ 1.716000] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[ 1.720000] pci_bus 0000:00: root bus resource [io 0x1e160000-0x1e16ffff]
[ 1.724000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 1.728000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 1.744000] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 1.760000] pci 0000:00:00.0: BAR 0: can’t assign mem (size 0x80000000)
[ 1.772000] pci 0000:00:01.0: BAR 0: can’t assign mem (size 0x80000000)
[ 1.788000] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[ 1.800000] pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff]
[ 1.812000] pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff]
[ 1.828000] pci 0000:00:01.0: BAR 1: assigned [mem 0x60210000-0x6021ffff]
[ 1.840000] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff]
[ 1.856000] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 1.864000] pci 0000:00:00.0: bridge window [mem 0x60000000-0x600fffff]
[ 1.876000] pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff 64bit]
[ 1.892000] pci 0000:00:01.0: PCI bridge to [bus 02]
[ 1.900000] pci 0000:00:01.0: bridge window [mem 0x60100000-0x601fffff]
[ 1.916000] PCI: Enabling device 0000:00:00.0 (0004 -> 0006)
[ 1.928000] PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
[ 1.936000] BAR0 at slot 0 = 0
[ 1.944000] bus=0x0, slot = 0x0
[ 1.952000] res[0]->start = 0
[ 1.956000] res[0]->end = 0
[ 1.960000] res[1]->start = 60200000
[ 1.968000] res[1]->end = 6020ffff
[ 1.976000] res[2]->start = 0
[ 1.980000] res[2]->end = 0
[ 1.988000] res[3]->start = 0
[ 1.992000] res[3]->end = 0
[ 2.000000] res[4]->start = 0
[ 2.004000] res[4]->end = 0
[ 2.008000] res[5]->start = 0
[ 2.016000] res[5]->end = 0
[ 2.020000] BAR0 at slot 1 = 0
[ 2.028000] bus=0x0, slot = 0x1
[ 2.032000] res[0]->start = 0
[ 2.040000] res[0]->end = 0
[ 2.044000] res[1]->start = 60210000
[ 2.052000] res[1]->end = 6021ffff
[ 2.060000] res[2]->start = 0
[ 2.064000] res[2]->end = 0
[ 2.072000] res[3]->start = 0
[ 2.076000] res[3]->end = 0
[ 2.080000] res[4]->start = 0
[ 2.088000] res[4]->end = 0
[ 2.092000] res[5]->start = 0
[ 2.100000] res[5]->end = 0
[ 2.104000] bus=0x1, slot = 0x0, irq=0x4
[ 2.112000] res[0]->start = 60000000
[ 2.120000] res[0]->end = 600fffff
[ 2.128000] res[1]->start = 0
[ 2.132000] res[1]->end = 0
[ 2.136000] res[2]->start = 0
[ 2.144000] res[2]->end = 0
[ 2.148000] res[3]->start = 0
[ 2.156000] res[3]->end = 0
[ 2.160000] res[4]->start = 0
[ 2.168000] res[4]->end = 0
[ 2.172000] res[5]->start = 0
[ 2.180000] res[5]->end = 0
[ 2.184000] bus=0x2, slot = 0x1, irq=0x18
[ 2.192000] res[0]->start = 60100000
[ 2.200000] res[0]->end = 601fffff
[ 2.204000] res[1]->start = 0
[ 2.212000] res[1]->end = 0
[ 2.216000] res[2]->start = 0
[ 2.224000] res[2]->end = 0
[ 2.228000] res[3]->start = 0
[ 2.236000] res[3]->end = 0
[ 2.240000] res[4]->start = 0
[ 2.244000] res[4]->end = 0
[ 2.252000] res[5]->start = 0
[ 2.256000] res[5]->end = 0
[ 2.264000] Switching to clocksource Ralink Systick timer
[ 2.268000] NET: Registered protocol family 2
[ 2.276000] Clockevents: could not switch to one-shot mode:
[ 2.276000] Clockevents: could not switch to one-shot mode: MIPS is not functional.
[ 2.276000] Could not switch to high resolution mode on CPU 1
[ 2.276000] MIPS is not functional.
[ 2.324000] Could not switch to high resolution mode on CPU 0
[ 2.336000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[ 2.348000] TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
[ 2.360000] TCP: Hash tables configured (established 1024 bind 1024)
[ 2.372000] TCP: reno registered
[ 2.380000] UDP hash table entries: 256 (order: 1, 8192 bytes)
[ 2.392000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[ 2.404000] NET: Registered protocol family 1
[ 2.412000] RPC: Registered named UNIX socket transport module.
[ 2.424000] RPC: Registered udp transport module.
[ 2.436000] RPC: Registered tcp transport module.
[ 2.444000] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 2.460000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 2.472000] jffs2: version 2.2. (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 2.492000] io scheduler noop registered (default)
[ 2.500000] reg_int_mask=0, INT_MASK= 0
[ 2.508000] HSDMA_init
[ 2.516000]
[ 2.516000] hsdma_phy_tx_ring0 = 0x00c00000, hsdma_tx_ring0 = 0xa0c00000
[ 2.532000]
[ 2.532000] hsdma_phy_rx_ring0 = 0x00c04000, hsdma_rx_ring0 = 0xa0c04000
[ 2.548000] TX_CTX_IDX0 = 0
[ 2.552000] TX_DTX_IDX0 = 0
[ 2.560000] RX_CRX_IDX0 = 3ff
[ 2.564000] RX_DRX_IDX0 = 0
[ 2.572000] set_fe_HSDMA_glo_cfg
[ 2.576000] HSDMA_GLO_CFG = 465
[ 2.588000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 2.604000] serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A
[ 2.616000] serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A
[ 2.628000] Ralink gpio driver initialized
[ 2.640000] Enable Ralink GDMA Controller Module
[ 2.648000] GDMA IP Version=3
[ 2.656000] flash manufacture id: 20, device id 70 18
[ 2.664000] Warning: un-recognized chip ID, please update SPI driver!
[ 2.676000] N25Q128A13ESE40F(20 ba181000) (16384 Kbytes)
[ 2.688000] mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
[ 2.708000] Creating 5 MTD partitions on „raspi”:
[ 2.716000] 0x000000000000-0x000001000000 : „ALL”
[ 2.728000] 0x000000000000-0x000000030000 : „Bootloader”
[ 2.740000] 0x000000030000-0x000000040000 : „Config”
[ 2.748000] 0x000000040000-0x000000050000 : „Factory”
[ 2.760000] 0x000000050000-0x000001000000 : „firmware”
[ 2.772000] 0x000000339509-0x000001000000 : „rootfs”
[ 2.780000] mtd: partition „rootfs” must either start or end on erase block boundary or be smaller than an erase block — forcing read-only
[ 2.808000] mtd: partition „rootfs_data” created automatically, ofs=0x920000, len=0x6e0000
[ 2.824000] 0x000000920000-0x000001000000 : „rootfs_data”
[ 2.836000] IMQ driver loaded successfully. (numdevs = 2, numqueues = 1)
[ 2.852000] Hooking IMQ after NAT on PREROUTING.
[ 2.860000] Hooking IMQ before NAT on POSTROUTING.
[ 2.872000] register mt_drv
[ 2.896000]
[ 2.896000] == pAd = c0181000, size = 7620032, Status=0 ==
[ 2.912000] pAd->PciHif.CSRBaseAddress =0xc0080000, csr_addr=0xc0080000!
[ 2.924000] RTMPInitPCIeDevice():device_id=0x7615
[ 2.932000] mt_pci_chip_cfg(): HWVer=0x8a10, FWVer=0x8a10, pAd->ChipID=0x7615
[ 2.948000] mt_pci_chip_cfg(): HIF_SYS_REV=0x76150001
[ 2.956000] AP Driver version-5.0.4.0
[ 2.964000] RtmpChipOpsHook(223): Not support for HIF_MT yet! MACVersion=0x0
[ 2.980000] mt7615_init()—>
[ 2.984000] Use 1st iPAiLNA default bin.
[ 2.992000] Use 0st /etc_ro/wlan/MT7615E_EEPROM1.bin default bin.
[ 3.004000] <—mt7615_init()
[ 3.012000] <— RTMPAllocTxRxRingMemory, Status=0
[ 3.024000] GMAC1_MAC_ADRH haha write mac reg— : 0x00005c92
[ 3.036000] GMAC1_MAC_ADRL — : 0x5e5d0138
[ 3.044000] Ralink APSoC Ethernet Driver Initilization. v3.1 1024 rx/tx descriptors allocated, mtu = 1500!
[ 3.064000] GMAC1_MAC_ADRH haha write mac reg— : 0x00005c92
[ 3.076000] GMAC1_MAC_ADRL — : 0x5e5d0138
[ 3.084000] PROC INIT OK!
[ 3.088000] i2c /dev entries driver
[ 3.096000] GACT probability on
[ 3.104000] Simple TC action Loaded
[ 3.112000] netem: version 1.3
[ 3.116000] TCP: cubic registered
[ 3.124000] NET: Registered protocol family 10
[ 3.132000] NET: Registered protocol family 17
[ 3.148000] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[ 3.164000] Freeing unused kernel memory: 268K
[ 3.576000] init: Console is alive
[ 4.280000] SCSI subsystem initialized
[ 4.588000] init: - preinit -
[ 5.144000] 5C:FFFFFF92:5E:5D: 1:38
[ 5.152000] Raeth v3.1 (Tasklet)
[ 5.164000] set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1
[ 5.176000] phy_free_head is 0xc18000!!!
[ 5.184000] phy_free_tail_phy is 0xc19ff0!!!
[ 5.192000] txd_pool=a0c20000 phy_txd_pool=00C20000
[ 5.204000] ei_local->skb_free start address is 0x873626e0.
[ 5.212000] free_txd: 00c20010, ei_local->cpu_ptr: 00C20000
[ 5.224000] POOL HEAD_PTR | DMA_PTR | CPU_PTR
[ 5.236000] ————————+————+————
[ 5.244000] 0xa0c20000 0x00C20000 0x00C20000
[ 5.252000]
[ 5.252000] phy_qrx_ring = 0x00c1a000, qrx_ring = 0xa0c1a000
[ 5.268000]
[ 5.268000] phy_rx_ring0 = 0x00c1c000, rx_ring[0] = 0xa0c1c000
[ 5.304000] MT7530 Reset Completed!!
[ 5.316000] change HW-TRAP to 0x17c8f
[ 5.324000] set LAN/WAN LLLLW
[ 5.336000] GMAC1_MAC_ADRH haha write mac reg———— : 0x00005c92
[ 5.348000] GMAC1_MAC_ADRL — : 0x5e5d0138
[ 5.356000] lllll+++++++ RAETH_Init_PSEUDO: the gmac2_offset:222
[ 5.368000] lllll+++++++ RAETH_Init_PSEUDO: the gmac2_offset:57350, read flash ret:0
[ 5.384000] the mac REG:be101508
[ 5.392000] GDMA2_MAC_ADRH — : 0x00005c92
[ 5.400000] lll set GDMA2_MAC_ADRL — : 0x5e5d0139
[ 5.408000] eth1: ===> VirtualIF_open
[ 5.416000] MT7621 GE2 link rate to 1G
[ 5.432000] CDMA_CSG_CFG = 81000000
[ 5.440000] GDMA1_FWD_CFG = 20710000
[ 5.448000] GDMA2_FWD_CFG = 20710000
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
mount_root.
emmc_partition_find(0x67e008, rootfs_data)
(null) is not created by block2mtd, skip.
[ 8.784000] block: attempting to load /etc/config/fstab
[ 8.796000] block: unable to load configuration (fstab: Entry not found)
[ 8.808000] block: no usable configuration
jffs2 is ready
No jffs2 marker was found
[ 8.884000] jffs2: notice: (296) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 36 of xref (0 dead, 0 orphan) found.
[ 8.936000] block: attempting to load /etc/config/fstab
[ 8.948000] block: unable to load configuration (fstab: Entry not found)
[ 8.960000] block: no usable configuration
switching to overlay
[ 8.980000] ra2880stop()…Done
[ 8.988000] eth1: ===> VirtualIF_close
[ 8.996000] Free TX/RX Ring Memory!
[ 9.008000] procd: - early -
[ 9.660000] procd: - ubus -
[ 10.668000] procd: - init -
[ 11.716000] 8021q: 802.1Q VLAN Support v1.8
[ 11.732000] tun: Universal TUN/TAP device driver, 1.6
[ 11.744000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[ 11.760000] l2tp_core: L2TP core driver, V2.0
[ 11.768000] l2tp_netlink: L2TP netlink interface
[ 11.788000] gre: GRE over IPv4 demultiplexor driver
[ 11.800000] ip_gre: GRE over IPv4 tunneling driver
[ 11.828000] u32 classifier
[ 11.832000] Performance counters on
[ 11.840000] input device check on
[ 11.848000] Actions configured
[ 11.856000] Mirror/redirect action on
[ 11.964000] Failed to load ipt action
[ 11.992000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 12.004000] Type=Restricted Cone
[ 12.968000] register rlt_drv
[ 12.980000]
[ 12.980000]
[ 12.980000] === pAd = c1101000, size = 2176376 ===
[ 12.980000]
[ 13.000000] <— RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
[ 13.012000] <— RTMPAllocAdapterBlock, Status=0
[ 13.020000] pAd->CSRBaseAddress =0xc1000000, csr_addr=0xc1000000!
[ 13.032000] device_id =0x7603
[ 13.040000] RtmpChipOpsHook(474): Not support for HIF_MT yet!
[ 13.048000] mt7603_init()—>
[ 13.056000] mt_bcn_buf_init(224): Not support for HIF_MT yet!
[ 13.068000] <—mt7603_init()
[ 13.072000] load_dev_l1profile()—>
[ 13.080000] match_index_by_chipname() MT7603 found as INDEX0
[ 13.092000] l1set_profile_path() profile remain /etc/wireless/mt7603/mt7603.dat
[ 13.104000] l1set_eeprom_offset() eeprom offset remain 0x0
[ 13.116000] l1set_eeprom_size() eeprom size remain 0x200
[ 13.128000] l1set_ifname() ifname rename from ra0 to ra
[ 13.136000] l1set_ifname() ifname remain ra
[ 13.144000] l1set_ifname() ifname remain ra
[ 13.156000] l1set_ifname() ifname remain apcli
[ 13.168000] —>mtfwd_init()<—
[ 13.184000] nf_conntrack version 0.5.0 (1903 buckets, 7612 max)
[ 13.288000] Netfilter messages via NETLINK v0.30.
[ 13.300000] Ralink APSoC Hardware Watchdog Timer
[ 13.312000] rdm_major = 253
[ 13.364000] xt_time: kernel timezone is -0000
[ 13.380000] ctnetlink v0.93: registering with nfnetlink.
[ 13.400000] PPP generic driver version 2.4.2
[ 13.408000] PPP MPPE Compression module registered
[ 13.420000] NET: Registered protocol family 24
[ 13.432000] PPTP driver version 0.8.5
[ 13.444000] l2tp_ppp: PPPoL2TP kernel driver, V2.0
Original firmware: https://www.totolink.net/data/upload/20201223/c6f14c302d0430e6a25722dd4d1b803f.zip
binwalk TOTOLINK-A6000R-Ng-V1.0.1-B20201211.2000.web
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
16 0x10 uImage header, header size: 64 bytes, header CRC: 0xD531E361, created: 2020-12-18 13:26:41, image size: 3052745 bytes, Data Address: 0x81001000, Entry Point: 0x81001000, data CRC: 0x7BC597BB, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt Linux-3.10.108"
80 0x50 LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 8325120 bytes
3052825 0x2E9519 Squashfs filesystem, little endian, version 4.0, compression:xz, size: 6151502 bytes, 2076 inodes, blocksize: 262144 bytes, created: 2020-12-18 13:26:36