What happened to the D-Link DIR-510L?

s_2 · November 22, 2018, 6:27pm

Found the device
Here's my mtd7: http://sebastianschaper.net/openwrt/dir510l_mtd7.bin

There was also a link (actually still working) in the old archived thread from a post by lowmaster, where he uploaded his mtd0 (full flash), that also included mtd7.
Comparing the two there's many differences, so I wonder which part will be MT7610 EEPROM...

0xE000 is apparently for MT7620 ethernet, according to the .dts in your github

Looking at the DIR-810L pull request for MT76x0, I guess we will be needing something like this?! (with the correct offset and adding package kmod-mt76x0e)

&pcie0 {
	mt76@0,0 {
		reg = <0x0000 0 0 0 0>;
		mediatek,mtd-eeprom = <&config 0x????>;
		ieee80211-freq-limit = <5000000 6000000>;
	};
};

CHKDSK88 · November 22, 2018, 6:31pm

Here You can find my changes.

s_2 · November 22, 2018, 7:15pm

okay apparently I was too slow with dumping the mtd partition

MT7610 looks good actually, iw wlan0 scan works perfectly and will list 5GHz networks

Serial bootlog until console is disabled:


CDM56CDL_U03 Jboot B796
JRecovery Version R1.2 2013/10/04 18:32
SPI FLASH: MX25l12805d 16M
.
...Boot addr = 0x80400000
...................
Starting kernel @80000000...
[    0.000000] Linux version 4.14.78 (krolik@ubuntu-VirtualBox) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r6894+1283-547042398a)) #0 Thu Nov 22 17:21:22 2018
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620A ver:2 eco:4
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is D-Link dir-510l
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] random: get_random_bytes called from start_kernel+0x8c/0x474 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00075952
[    0.000000] Readback ErrCtl register=00075952
[    0.000000] Memory: 124832K/131072K available (3611K kernel code, 172K rwdata, 840K rodata, 168K init, 207K bss, 6240K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000010] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015471] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087711] pid_max: default: 32768 minimum: 301
[    0.097105] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.110123] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.129658] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.149139] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.161306] pinctrl core: initialized pinctrl subsystem
[    0.172141] NET: Registered protocol family 16
[    0.663935] PCI host bridge /pcie@10140000 ranges:
[    0.673327]  MEM 0x0000000020000000..0x000000002fffffff
[    0.683700]   IO 0x0000000010160000..0x000000001016ffff
[    0.711681] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.722715] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.735746] PCI host bridge to bus 0000:00
[    0.743743] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.757462] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    0.769187] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.782687] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.798868] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.815730] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.828786] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.842593] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[    0.856094] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.869604] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
[    0.883099] pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff]
[    0.896596] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.906447] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
[    0.923779] clocksource: Switched to clocksource systick
[    0.935360] NET: Registered protocol family 2
[    0.944754] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.958528] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.971115] TCP: Hash tables configured (established 1024 bind 1024)
[    0.983938] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.995443] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.008121] NET: Registered protocol family 1
[    1.019475] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    1.032182] Crashlog allocated RAM at address 0x3f00000
[    1.044285] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[    1.062264] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.073768] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.103241] io scheduler noop registered
[    1.110947] io scheduler deadline registered (default)
[    1.122089] gpio-export gpio_export: 3 gpio(s) exported
[    1.132660] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.146131] console [ttyS0] disabled
[    1.153122] 10000500.uart: ttyS0 at MMIO 0x10000500 (irq = 13, base_baud = 2500000) is a Palmchip BK-3103
[    1.172205] console [ttyS0] enabled
[    1.185907] bootconsole [early0] disabled

Connecting via ssh:

login as: root


BusyBox v1.29.3 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r6719+1661-a656ea0bdb
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~# dmesg
[    0.000000] Linux version 4.14.78 (krolik@ubuntu-VirtualBox) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r6894+1283-547042398a)) #0 Thu Nov 22 17:21:22 2018
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620A ver:2 eco:4
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is D-Link dir-510l
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] On node 0 totalpages: 32768
[    0.000000] free_area_init_node: node 0, pgdat 80483730, node_mem_map 81000040
[    0.000000]   Normal zone: 256 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 32768 pages, LIFO batch:7
[    0.000000] random: get_random_bytes called from start_kernel+0x8c/0x474 with crng_init=0
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00075952
[    0.000000] Readback ErrCtl register=00075952
[    0.000000] Memory: 124832K/131072K available (3611K kernel code, 172K rwdata, 840K rodata, 168K init, 207K bss, 6240K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000010] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015471] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087711] pid_max: default: 32768 minimum: 301
[    0.097105] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.110123] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.129658] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.149139] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.161306] pinctrl core: initialized pinctrl subsystem
[    0.172141] NET: Registered protocol family 16
[    0.663935] PCI host bridge /pcie@10140000 ranges:
[    0.673327]  MEM 0x0000000020000000..0x000000002fffffff
[    0.683700]   IO 0x0000000010160000..0x000000001016ffff
[    0.711681] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.722715] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.735746] PCI host bridge to bus 0000:00
[    0.743743] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.757462] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    0.769187] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.782687] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.798474] pci 0000:00:00.0: [1814:0801] type 01 class 0x060400
[    0.798513] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    0.798527] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[    0.798600] pci 0000:00:00.0: supports D1
[    0.798610] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.798868] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.814869] pci 0000:01:00.0: [14c3:7650] type 00 class 0x028000
[    0.814919] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff]
[    0.815048] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[    0.815290] pci 0000:01:00.1: [14c3:8650] type 00 class 0x0d1100
[    0.815333] pci 0000:01:00.1: reg 0x10: [mem 0x00000000-0x000fffff]
[    0.815459] pci 0000:01:00.1: supports D1
[    0.815469] pci 0000:01:00.1: PME# supported from D0 D1 D3hot D3cold
[    0.815664] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    0.815681] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[    0.815730] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.828786] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.842593] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[    0.856094] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.869604] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
[    0.883099] pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff]
[    0.896596] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.906447] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
[    0.923779] clocksource: Switched to clocksource systick
[    0.935360] NET: Registered protocol family 2
[    0.944754] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.958528] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.971115] TCP: Hash tables configured (established 1024 bind 1024)
[    0.983938] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.995443] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.008121] NET: Registered protocol family 1
[    1.016752] PCI: CLS 0 bytes, default 32
[    1.019475] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    1.032182] Crashlog allocated RAM at address 0x3f00000
[    1.044285] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[    1.062264] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.073768] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.103241] io scheduler noop registered
[    1.110947] io scheduler deadline registered (default)
[    1.122089] gpio-export gpio_export: 3 gpio(s) exported
[    1.132660] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.146131] console [ttyS0] disabled
[    1.153122] 10000500.uart: ttyS0 at MMIO 0x10000500 (irq = 13, base_baud = 2500000) is a Palmchip BK-3103
[    1.172205] console [ttyS0] enabled
[    1.185907] bootconsole [early0] disabled
[    1.202360] 10000c00.uartlite: ttyS1 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[    1.222703] cacheinfo: Failed to find cpu0 device node
[    1.232976] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    1.250682] spi spi0.0: force spi mode3
[    1.259141] m25p80 spi0.0: mx25l12805d (16384 Kbytes)
[    1.269311] 4 fixed-partitions partitions found on MTD device spi0.0
[    1.281970] Creating 4 MTD partitions on "spi0.0":
[    1.291521] 0x000000000000-0x000000010000 : "jboot"
[    1.302113] 0x000000010000-0x000000210000 : "recovery"
[    1.313221] 0x000000210000-0x000000ff0000 : "firmware"
[    1.326570] 2 jimage-fw partitions found on MTD device firmware
[    1.338450] 0x000000210000-0x00000038c261 : "kernel"
[    1.349194] 0x00000038c261-0x000000ff0000 : "rootfs"
[    1.359907] mtd: device 4 (rootfs) set to be root filesystem
[    1.372692] 1 squashfs-split partitions found on MTD device rootfs
[    1.385077] 0x000000600000-0x000000ff0000 : "rootfs_data"
[    1.396704] 0x000000ff0000-0x000001000000 : "config"
[    1.408156] libphy: Fixed MDIO Bus: probed
[    1.425470] gsw: setting port4 to ephy mode
[    1.433884] mtk_soc_eth 10100000.ethernet: generated random MAC address 66:7d:5b:55:cf:d9
[    1.450264] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[    1.462721] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    1.479731] rt2880_wdt 10000120.watchdog: Initialized
[    1.491033] NET: Registered protocol family 10
[    1.503585] Segment Routing with IPv6
[    1.511053] NET: Registered protocol family 17
[    1.519978] 8021q: 802.1Q VLAN Support v1.8
[    1.534811] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    1.549823] Freeing unused kernel memory: 168K
[    1.558701] This architecture does not have kernel memory protection.
[    2.447472] init: Console is alive
[    2.454579] init: - watchdog -
[    2.783774] random: fast init done
[    3.615593] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.763072] usbcore: registered new interface driver usbfs
[    3.774164] usbcore: registered new interface driver hub
[    3.784888] usbcore: registered new device driver usb
[    3.800974] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    3.815781] ehci-platform: EHCI generic platform driver
[    3.836579] phy phy-usbphy.0: remote usb device wakeup disabled
[    3.848378] phy phy-usbphy.0: UTMI 16bit 30MHz
[    3.857248] ehci-platform 101c0000.ehci: EHCI Host Controller
[    3.868742] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1
[    3.884650] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000
[    3.906285] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00
[    3.919766] hub 1-0:1.0: USB hub found
[    3.927697] hub 1-0:1.0: 1 port detected
[    3.939584] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.958142] init: - preinit -
[    4.609919] usb 1-1: new high-speed USB device number 2 using ehci-platform
[    4.863514] random: procd: uninitialized urandom read (4 bytes read)
[    4.876757] hub 1-1:1.0: USB hub found
[    4.889951] hub 1-1:1.0: 4 ports detected
[    5.276640] 8021q: adding VLAN 0 to HW filter on device eth0
[    6.633544] jffs2: notice: (386) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (0 unchecked, 2 orphan) and 2 of xref (2 dead, 0 orphan) found.
[    6.666535] mount_root: switching to jffs2 overlay
[    6.705703] overlayfs: upper fs does not support tmpfile.
[    6.722555] urandom-seed: Seeding with /etc/urandom.seed
[    6.845356] procd: - early -
[    6.852048] procd: - watchdog -
[    7.269637] procd: - watchdog -
[    7.276300] procd: - ubus -
[    7.392472] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.406963] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.420285] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.433977] procd: - init -
[    7.937281] kmodloader: loading kernel modules from /etc/modules.d/*
[    7.956607] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    7.980297] Loading modules backported from Linux version v4.19-rc5-0-g6bf4ca7fbc85
[    7.995641] Backport generated by backports.git v4.19-rc5-1-0-g05571dcd
[    8.013209] ip_tables: (C) 2000-2006 Netfilter Core Team
[    8.033227] nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
[    8.113236] xt_time: kernel timezone is -0000
[    8.201432] PPP generic driver version 2.4.2
[    8.212887] NET: Registered protocol family 24
[    8.237754] mt76x0e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[    8.250331] mt76x0e 0000:01:00.0: ASIC revision: 76100002
[    8.263440] mt76x0e 0000:01:00.0: Firmware Version: 0.1.00
[    8.359140] mt76x0e 0000:01:00.0: EEPROM ver:01 fae:00
[    8.373358] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[    8.420436] ieee80211 phy1: rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'soc_wmac.eeprom'.
[    8.510539] ieee80211 phy1: rt2x00_set_rt: Info - RT chipset 6352, rev 0500 detected
[    8.526063] ieee80211 phy1: rt2x00_set_rf: Info - RF chipset 7620 detected
[    8.540465] ieee80211 phy1: Selected rate control algorithm 'minstrel_ht'
[    8.546221] kmodloader: done loading kernel modules from /etc/modules.d/*
[    9.753034] urandom_read: 5 callbacks suppressed
[    9.753044] random: jshn: uninitialized urandom read (4 bytes read)
[   18.211186] 8021q: adding VLAN 0 to HW filter on device eth0
[   18.260918] device eth0 entered promiscuous mode
[   18.303450] br-lan: port 1(eth0.1) entered blocking state
[   18.314288] br-lan: port 1(eth0.1) entered disabled state
[   18.325561] device eth0.1 entered promiscuous mode
[   18.430200] br-lan: port 1(eth0.1) entered blocking state
[   18.441028] br-lan: port 1(eth0.1) entered forwarding state
[   18.452344] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   19.263824] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   37.279832] mtk_soc_eth 10100000.ethernet eth0: port 0 link up (100Mbps/Full duplex)
[   54.399779] random: crng init done
[   56.395857] mtk_soc_eth 10100000.ethernet eth0: port 0 link down
[   56.409874] br-lan: port 1(eth0.1) entered disabled state
[   57.157870] mtk_soc_eth 10100000.ethernet eth0: port 0 link up (100Mbps/Full duplex)
[   57.174706] br-lan: port 1(eth0.1) entered blocking state
[   57.185536] br-lan: port 1(eth0.1) entered forwarding state
root@OpenWrt:~#

So I guess the only remaining issue now would be telling MSP430 to shutdown the device without detaching battery. I will check whether I can fix my UART traces and try to capture the transmission again

CHKDSK88 · November 22, 2018, 7:47pm

I forgot about lowmaster dump.

I need some info:

ifconfig -a (For wifi 5GHz MAC. At this moment is not implemented. My PR for mt76 driver is pending.)
How many serials You see in system?
Is status LED working?
Are USB working?
What (except MSP) isn't working?

s_2 · November 22, 2018, 8:04pm

Curiously, when I try to scan 5GHz with LuCI it will not finish scanning, also the radio0 shows "Wireless not associated".
If I try to disable and enable via LuCI, I will only have 2.4 GHz (showing as wlan0), so it's probably just an issue with ifconfig for 5GHz.

After rebooting, both interfaces are back:

// edit: after rebooting both of them even work in LuCI, status is shown and Channels can be scanned apparently needed one more restart after flashing (or I shouldn't have ifconfig wlan0 up outside of LuCI!?)

root@OpenWrt:~# ifconfig -a
br-lan    Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7D
          inet addr:192.168.7.222  Bcast:192.168.7.255  Mask:255.255.255.0
          inet6 addr: fe80::7a54:2eff:fe9d:277d/64 Scope:Link
          inet6 addr: fdf3:32be:2ffe::1/60 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:76 errors:0 dropped:0 overruns:0 frame:0
          TX packets:68 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:8803 (8.5 KiB)  TX bytes:8450 (8.2 KiB)

eth0      Link encap:Ethernet  HWaddr 6E:2F:E3:F6:89:03
          inet6 addr: fe80::6c2f:e3ff:fef6:8903/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:82 errors:0 dropped:0 overruns:0 frame:0
          TX packets:81 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:11473 (11.2 KiB)  TX bytes:11073 (10.8 KiB)
          Interrupt:5

eth0.1    Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7D
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:76 errors:0 dropped:0 overruns:0 frame:0
          TX packets:68 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:8803 (8.5 KiB)  TX bytes:8450 (8.2 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:16 errors:0 dropped:0 overruns:0 frame:0
          TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1621 (1.5 KiB)  TX bytes:1621 (1.5 KiB)

wlan0     Link encap:Ethernet  HWaddr 00:0C:43:26:60:F8
          inet6 addr: fe80::20c:43ff:fe26:60f8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:19 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:3368 (3.2 KiB)

wlan1     Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7D
          inet6 addr: fe80::7a54:2eff:fe9d:277d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:20 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:3601 (3.5 KiB)

root@OpenWrt:~#

There's two serials, however no more console after booting.

root@OpenWrt:~# ls /dev/tty*
/dev/tty    /dev/ttyS0  /dev/ttyS1
root@OpenWrt:~#

Status LED works, flashing while booting, steady when done. (except for LED2 which is controlled by MSP)

USB is working too:slight_smile:

CHKDSK88 · November 22, 2018, 8:59pm

Support for 7610 is a new thing. It could have bugs. Please try turn on 7610 in AP mode and connect to router.

Things to do:

Repair console
Prepare for wlan 0 MAC setting
Check communication with MSP

Please let me know if You repair uart.

There is not many things to do. Maybe it will be supported before 19.01.

s_2 · November 22, 2018, 10:27pm

It is connecting and I can use it for any traffic (LuCI, Web) when it's configured in AP mode.

However it seems to be connecting at only 54 MBit; when iperf3 server is running on OpenWRT, I can get about 20 MBit/s, when the server is on the PC instead it will vary a lot around 13 MBit/s.

I tried switching to 2.4 GHz then for comparison, but did not work (do I have to enable WPA2 PSK first? only did this for 5 GHz), had to restart after changing configuration etc.
So it's probably the driver not yet running smoothly, but great to have some support at all

Soldered some wires to the UART pins, hope I'll find time for more testing next week, maybe even at the weekend

xabolcs · November 23, 2018, 12:45am

This is because firmware loading, IMHO.

On the very first boot the system formats /overlay and the user helper script which loads the wifi's firmware is delayed until the storage gets ready to store the blob extracted from the flash.

psyborg · November 23, 2018, 12:15pm

if you run again in such issue, it can happen when luci or driver is slow and there is many channels, an easy solution is to increase Maximum wait time for network activity in uhttpd settings

CHKDSK88 · November 23, 2018, 1:28pm

I not recommend use luci at this moment. Can You turn off wlan1 and set only wlan0 to ac mode?

s_2 · November 24, 2018, 9:28pm

This device is driving me nuts...

Yesterday I was still able to capture some ASCII that the MSP sends to MT7620;
every three seconds it would transmit (probably because not receiving an answer) at 600 Baud a sequence like

<LF><CR>1.01b01-993-0-1-991-on<LF>

which seems very familiar now that I remember it from the old thread, apparently I had not made any further notes aside from the forum post back then...

991 is the battery state of charge here, it goes up to 1023 when attaching PSU at about 4.3 Volts. Values vary a lot though. The first one seems to be some historic value, seems to rise slower. Probably both come directly from bq24195, or just some simple linearized ADC measurement?

0-1 turns into 0-5 when the battery is dead (at 3.0 V, and stays like that even when increasing the voltage, until charger is plugged in or battery / PSU re-attached, then it goes back to 0-1).

Next step was trying to read the same data via MT7620 instead.
Sounds trivial, but is there any simple way of just reading from a serial port in Linux? Tried cat /dev/ttyS0 but apparently had to set the baud rate to 600 first.
It seems like there is nothing included with OpenWRT to do this, so I tried to install some packages (stty, screen, ...?) but had to change IP settings first since I'm not at home over the weeked...

Turns out even just trying to change IP address with LuCI wrecks everything after a short while (starts to listen on new address, but very soon no more connection. I guess changing br0 address also involves the mt76x0 driver, so it really was a bad idea in the first place ).

Without serial console, used recovery Web UI, which is cumbersome with modern browsers. But working (it's irritating though when nothing happens after successful flash, normally it should reboot; seems to be due to my broken UART connection).

Couldn't find anything helpful regarding MSP430 from the stock firmware though, not even reproduce capturing above-mentioned traffic via USB UART anymore...
But here is ifconfig from stock firmware, maybe it could help finding the 5GHz MAC offset from my mtd7 dump?

# ifconfig -a
apcli0    Link encap:Ethernet  HWaddr 7A:54:2E:9D:27:7D
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

apclii0   Link encap:Ethernet  HWaddr 7A:54:2E:9D:27:7E
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br0       Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7D
          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::7a54:2eff:fe9d:277d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:66 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:10
          RX bytes:0 (0.0 B)  TX bytes:15546 (15.1 KiB)

eth2      Link encap:Ethernet  HWaddr 00:0C:43:28:80:F1
          inet6 addr: fe80::20c:43ff:fe28:80f1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:96 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:18606 (18.1 KiB)
          Interrupt:3

eth2.1    Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7D
          inet6 addr: fe80::7a54:2eff:fe9d:277d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:72 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:16366 (15.9 KiB)

eth2.2    Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7C
          inet6 addr: fe80::7a54:2eff:fe9d:277c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:1372 (1.3 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:52 errors:0 dropped:0 overruns:0 frame:0
          TX packets:52 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:5766 (5.6 KiB)  TX bytes:5766 (5.6 KiB)

ra0       Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7D
          inet6 addr: fe80::7a54:2eff:fe9d:277d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:4

ra1       Link encap:Ethernet  HWaddr 7A:54:2E:9C:27:7D
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

rai0      Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7E
          inet6 addr: fe80::7a54:2eff:fe9d:277e/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:13

rai1      Link encap:Ethernet  HWaddr 7A:54:2E:9C:27:7E
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wds0      Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7D
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wds1      Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7D
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wds2      Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7D
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wds3      Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7D
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wdsi0     Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7E
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wdsi1     Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7E
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wdsi2     Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7E
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wdsi3     Link encap:Ethernet  HWaddr 78:54:2E:9D:27:7E
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

#

Besides, it took me quite a while to figure out that stock firmware does not configure the ethernet port to be part of br0, but would rather use DHCP / PPPoE for NAT routing...
(That's the problem of just wanting OpenWRT without ever RTFM / using the device as intended by manufacturer )

Back to OpenWRT:

root@OpenWrt:~# uci show wireless
wireless.radio0=wifi-device
wireless.radio0.type='mac80211'
wireless.radio0.channel='36'
wireless.radio0.hwmode='11a'
wireless.radio0.path='pci0000:00/0000:00:00.0/0000:01:00.0'
wireless.radio0.htmode='VHT80'
wireless.radio0.disabled='1'
wireless.default_radio0=wifi-iface
wireless.default_radio0.device='radio0'
wireless.default_radio0.network='lan'
wireless.default_radio0.mode='ap'
wireless.default_radio0.ssid='OpenWrt'
wireless.default_radio0.encryption='none'
wireless.radio1=wifi-device
wireless.radio1.type='mac80211'
wireless.radio1.channel='11'
wireless.radio1.hwmode='11g'
wireless.radio1.path='platform/10180000.wmac'
wireless.radio1.htmode='HT20'
wireless.radio1.disabled='1'
wireless.default_radio1=wifi-iface
wireless.default_radio1.device='radio1'
wireless.default_radio1.network='lan'
wireless.default_radio1.mode='ap'
wireless.default_radio1.ssid='OpenWrt'
wireless.default_radio1.encryption='none'

Is it correct that .hwmode is '11a' or is there also 11ac? However .htmode VHT looks good.

Don't have any ac adapters here though, will continue testing during next week...

I'm done with this device for today, many hours wasted but still no progress

CHKDSK88 · November 25, 2018, 7:56pm

ttyS0 should be serial console. IMO ttyS1 should be connected to MSP. But I dont't have a device, so it's only guessing. or maybe serial console uart and MSP uart are the same?

You can install coreutils-stty or minicom from regular repo.

Did You try curl? In other JBOOT devices this method work.

It help.
MAC is stored in 0xe05d. But at this moment it must wait for mt76 PR apply.

In OpenWRT WLAN is disabled by default. So Ethernet port is the only way to router. That way is more safety. You can change LAN port to WAN.

In other mt7610 I use 11a too and it work.

Maybe progress is little but work is very good. We are very close.

s_2 · November 26, 2018, 12:53am

I could neither find any of

coreutils-stty, mgetty, screen, picocom, minicom, ...

to install via opkg, LuCI will list 2261 packages, am I missing something here?

root@OpenWrt:~# opkg update
Downloading http://downloads.openwrt.org/snapshots/targets/ramips/mt7620/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_core
Downloading http://downloads.openwrt.org/snapshots/targets/ramips/mt7620/packages/Packages.sig
Signature check passed.
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_base
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/Packages.sig
Signature check passed.
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/luci/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_luci
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/luci/Packages.sig
Signature check passed.
root@OpenWrt:~#

Reading from MSP via USB UART was not working sometimes since those CP2102 converters pull RX too high, apparently the line is very high impedance (RX LED on USB-UART converter was flashing only very dim):

Without the converter attached, the level will go down to 0 V.

MSP is on ttyS0, same as in stock firmware; if I send some garbage to > /dev/ttyS0 it will show up on Pin 7 of the MSP (not on 4 as expected, though that would be the corresponding pin for hardware UART).

Also in between there will be some bytes like:

I'm currently too tired to figure out the baud rate and data, will solder some real wire to it tomorrow and check with USB UART rather than oscilloscope probes, and also see what happens on that pin when running stock firmware.

But it seems like the kernel is probing for some device / terminal here?

Data written to /dev/ttyS1 will show up at the serial console, but I cannot receive anything by just typing cat /dev/ttyS1, maybe the baudrate needs to match exactly for the MT7620 UART to receive anything at all? (would have expected at least to see some garbage when connecting MSP output to ttyS1 input)

So I still need to figure out how to set baud rate
Could you include coreutils-stty or screen in your next image?

rim · November 26, 2018, 3:47am

Hi, why did you keep original kernel?

rim · November 26, 2018, 3:57am

mtd-mac-address = <&config 0xe490>;

CHKDSK88 · November 26, 2018, 7:38pm

https://openwrt.org/packages/pkgdata/coreutils-stty -> Maybe snapshot doesn't have this package.

I'm little confused. Which S* is connected to MSP and which to serial console connector?

No problem:

I use stock OpenWRT kernel.

Exactly.

s_2 · November 26, 2018, 9:20pm

ttyS0 is connected to MSP, ttyS1 is serial console (just like in the stock firmware).

root@OpenWrt:~# stty -F /dev/ttyS0 600 && cat /dev/ttyS0

1.01b1-906-0-2-906-on


1.01b01-906-0-2-906-on


1.01b01-906-0-2-907-on


1.01b01-906-0-2-907-on


1.01b01-906-0-2-907-on


1.01b01-906-0-2-907-on

It's one line every 3 seconds. Initially some of the first bytes seem to get lost after opening the port.

Charger plugged in:

1.01b01-906-2-2-907-on


1.01b01-907-2-2-924-on


1.01b01-908-2-2-934-on


1.01b01-908-2-2-935-on

Charger removed:

1.01b01-909-0-2-932-on


1.01b01-910-0-2-917-on


1.01b01-909-0-2-907-on

Slide switch from Router to OFF:

1.01b01-909-0-5-908-on

After that, only garbage is received; however if you switch the slider to "OFF" and back to "Router" very quickly, it will go back from 0-5 to 0-2 and everything is fine (i.e. will continue to transmit every 3 seconds).

During the bootloader, as well as in stock frimware, the slider can switch it back off with no problems.
However as soon as OpenWRT kernel is loading (green LED starts flashing), the slider can not switch it off without detaching the battery. It seems like the shutdown actually uses some GPIO aside from UART.

Either the pin state is overwritten (driven as output / wrong level) by the kernel, or there needs to be some daemon running in bootloader and stock firmware to constantly observe the UART and set that GPIO for shutdown, as soon as 0-5 is received (apparently the "commander" binary that is executed on startup, since searching through the binwalk-extracted file contents of the stock firmware for the string mcuinfo_cdm56, it's only few files that contain the string, e.g. commander and httpd).

What is the default state the kernel will set GPIOs to if they are not explicity stated as button / led / export in the .dts file, I guess it should just leave all the registers like they were (i.e. as the bootloader initialised them)?

When OpenWRT is running, I can see mostly garbage on MSP Pin7 (RX), and occasionally the line "Press Enter to activate this console" at 57600. So the kernel apparently tries to receive data from MSP at 57600, which is transmitting at 600, so it detects random bytes and tells the user to press enter (send newline) at 57600.

One more thing before turning back to stock firmware:

root@OpenWrt:~# uci set wireless.radio0.disabled='0' && uci commit wireless && wifi reload

It now shows the network using 80 MHz and 324.9 MBits, which would be MCS index 7 rather than 9 (433 MBit at 80 MHZ, Short GI).

BSS 00:0c:43:26:60:f8(on wlp62s0)
	TSF: 27852888 usec (0d, 00:00:27)
	freq: 5180
	beacon interval: 100 TUs
	capability: ESS ShortPreamble (0x0021)
	signal: -78.00 dBm
	last seen: 3924 ms ago
	Information elements from Probe Response frame:
	SSID: OpenWrt
	Supported rates: 6.0* 9.0 12.0* 18.0 24.0* 36.0 48.0 54.0 
	DS Parameter set: channel 36
	TIM: DTIM Count 0 DTIM Period 2 Bitmap Control 0x0 Bitmap[0] 0x0
	BSS Load:
		 * station count: 0
		 * channel utilisation: 0/255
		 * available admission capacity: 0 [*32us]
	HT capabilities:
		Capabilities: 0x16e
			HT20/HT40
			SM Power Save disabled
			RX HT20 SGI
			RX HT40 SGI
			RX STBC 1-stream
			Max AMSDU length: 3839 bytes
			No DSSS/CCK HT40
		Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
		Minimum RX AMPDU time spacing: 4 usec (0x05)
		HT TX/RX MCS rate indexes supported: 0-7
	HT operation:
		 * primary channel: 36
		 * secondary channel offset: above
		 * STA channel width: any
		 * RIFS: 0
		 * HT protection: no
		 * non-GF present: 0
		 * OBSS non-GF present: 0
		 * dual beacon: 0
		 * dual CTS protection: 0
		 * STBC beacon: 0
		 * L-SIG TXOP Prot: 0
		 * PCO active: 0
		 * PCO phase: 0
	Extended capabilities:
		 * Operating Mode Notification
		 * Max Number Of MSDUs In A-MSDU is unlimited
	VHT capabilities:
		VHT Capabilities (0x01800120):
			Max MPDU length: 3895
			Supported Channel Width: neither 160 nor 80+80
			short GI (80 MHz)
		VHT RX MCS set:
			1 streams: MCS 0-7
			2 streams: not supported
			3 streams: not supported
			4 streams: not supported
			5 streams: not supported
			6 streams: not supported
			7 streams: not supported
			8 streams: not supported
		VHT RX highest supported: 0 Mbps
		VHT TX MCS set:
			1 streams: MCS 0-7
			2 streams: not supported
			3 streams: not supported
			4 streams: not supported
			5 streams: not supported
			6 streams: not supported
			7 streams: not supported
			8 streams: not supported
		VHT TX highest supported: 0 Mbps
	VHT operation:
		 * channel width: 1 (80 MHz)
		 * center freq segment 1: 42
		 * center freq segment 2: 0
		 * VHT basic MCS set: 0xfffc
	WMM:	 * Parameter version 1
		 * BE: CW 15-1023, AIFSN 3
		 * BK: CW 15-1023, AIFSN 7
		 * VI: CW 7-15, AIFSN 2, TXOP 3008 usec
		 * VO: CW 3-7, AIFSN 2

[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec  2.36 MBytes  19.8 Mbits/sec   63   65.6 KBytes
[  5]   1.00-2.00   sec  1.61 MBytes  13.5 Mbits/sec   24   44.2 KBytes
[  5]   2.00-3.00   sec  1.50 MBytes  12.5 Mbits/sec   27   32.8 KBytes
[  5]   3.00-4.00   sec  1.87 MBytes  15.7 Mbits/sec    4   49.9 KBytes
[  5]   4.00-5.00   sec  1.85 MBytes  15.5 Mbits/sec   25   42.8 KBytes
[  5]   5.00-6.00   sec  2.42 MBytes  20.3 Mbits/sec   11   54.2 KBytes
[  5]   6.00-7.00   sec  1.26 MBytes  10.6 Mbits/sec   48   32.8 KBytes
[  5]   7.00-8.00   sec  1.89 MBytes  15.8 Mbits/sec   10   49.9 KBytes
[  5]   8.00-9.00   sec  1.67 MBytes  14.0 Mbits/sec   15   57.0 KBytes
[  5]   9.00-10.00  sec  1.81 MBytes  15.2 Mbits/sec   39   37.1 KBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec  18.2 MBytes  15.3 Mbits/sec  266             sender
[  5]   0.00-10.00  sec  18.0 MBytes  15.1 Mbits/sec                  receiver

However is still somewhat flaky, eventually connection will drop and SSID is gone so even wifi reload will not help, only reboot.
Also ethernet behaves strange, sysupgrade took a while to download the new image via http. Could there be any issue with duplicate MAC addresses being used for wired/wireless?

s_2 · November 26, 2018, 10:38pm

Back to stock, MCS 9 supported:

BSS 78:54:2e:9d:27:7e(on wlp62s0)
	TSF: 436053374 usec (0d, 00:07:16)
	freq: 5180
	beacon interval: 100 TUs
	capability: ESS Privacy (0x0011)
	signal: -52.00 dBm
	last seen: 3860 ms ago
	Information elements from Probe Response frame:
	SSID: DIR510L-277D-5GHz
	Supported rates: 6.0* 9.0 12.0* 18.0 24.0* 36.0 48.0 54.0 
	DS Parameter set: channel 36
	HT capabilities:
		Capabilities: 0x16e
			HT20/HT40
			SM Power Save disabled
			RX HT20 SGI
			RX HT40 SGI
			RX STBC 1-stream
			Max AMSDU length: 3839 bytes
			No DSSS/CCK HT40
		Maximum RX AMPDU length 32767 bytes (exponent: 0x002)
		Minimum RX AMPDU time spacing: 4 usec (0x05)
		HT RX MCS rate indexes supported: 0-7, 32
		HT TX MCS rate indexes are undefined
	HT operation:
		 * primary channel: 36
		 * secondary channel offset: above
		 * STA channel width: any
		 * RIFS: 0
		 * HT protection: no
		 * non-GF present: 0
		 * OBSS non-GF present: 0
		 * dual beacon: 0
		 * dual CTS protection: 0
		 * STBC beacon: 0
		 * L-SIG TXOP Prot: 0
		 * PCO active: 0
		 * PCO phase: 0
	WPA:	 * Version: 1
		 * Group cipher: TKIP
		 * Pairwise ciphers: TKIP CCMP
		 * Authentication suites: PSK
	RSN:	 * Version: 1
		 * Group cipher: TKIP
		 * Pairwise ciphers: TKIP CCMP
		 * Authentication suites: PSK
		 * Capabilities: 1-PTKSA-RC 1-GTKSA-RC (0x0000)
	WMM:	 * Parameter version 1
		 * BE: CW 15-1023, AIFSN 3
		 * BK: CW 15-1023, AIFSN 7
		 * VI: CW 7-15, AIFSN 2, TXOP 3008 usec
		 * VO: CW 3-7, AIFSN 2, TXOP 1504 usec
	BSS Load:
		 * station count: 0
		 * channel utilisation: 6/255
		 * available admission capacity: 31250 [*32us]
	VHT capabilities:
		VHT Capabilities (0x31c00020):
			Max MPDU length: 3895
			Supported Channel Width: neither 160 nor 80+80
			short GI (80 MHz)
			+HTC-VHT
			RX antenna pattern consistency
			TX antenna pattern consistency
		VHT RX MCS set:
			1 streams: MCS 0-9
			2 streams: not supported
			3 streams: not supported
			4 streams: not supported
			5 streams: not supported
			6 streams: not supported
			7 streams: not supported
			8 streams: not supported
		VHT RX highest supported: 292 Mbps
		VHT TX MCS set:
			1 streams: MCS 0-9
			2 streams: not supported
			3 streams: not supported
			4 streams: not supported
			5 streams: not supported
			6 streams: not supported
			7 streams: not supported
			8 streams: not supported
		VHT TX highest supported: 292 Mbps
	VHT operation:
		 * channel width: 1 (80 MHz)
		 * center freq segment 1: 42
		 * center freq segment 2: 0
		 * VHT basic MCS set: 0xfffe
	WPS:	 * Version: 1.0
		 * Wi-Fi Protected Setup State: 2 (Configured)
		 * Response Type: 3 (AP)
		 * UUID: bc329e00-1dd8-11b2-8601-78542e9d277e
		 * Manufacturer: Amit
		 * Model: 3G Router
		 * Model Number: WBR-0001
		 * Serial Number: 12345678
		 * Primary Device Type: 6-0050f204-1
		 * Device name: DIR510L-277D-5GHz
		 * Config methods: Label, Display
		 * RF Bands: 0x2
		 * Unknown TLV (0x1049, 6 bytes): 00 37 2a 00 01 20

What happens on Pin 7 (MSP RX) when Slider is switched to Off in stock firmware:
DIR510L_MSP430_Pin7

Someone reacts to the level decreasing below threshold value by switching something off, no clue from which side.

The line will rise from 0 to 3.3V after bootloader, when the kernel is executed. There's no further communication on this pin whatsover

Can we somehow use hardware UART in OpenWRT only for RX Pin but leave TX as a regular GPIO?

CHKDSK88 · November 27, 2018, 7:40pm

s_2:

During the bootloader, as well as in stock frimware, the slider can switch it back off with no problems.
However as soon as OpenWRT kernel is loading (green LED starts flashing), the slider can not switch it off without detaching the battery. It seems like the shutdown actually uses some GPIO aside from UART.

Either the pin state is overwritten (driven as output / wrong level) by the kernel, or there needs to be some daemon running in bootloader and stock firmware to constantly observe the UART and set that GPIO for shutdown, as soon as 0-5 is received (apparently the "commander" binary that is executed on startup, since searching through the binwalk-extracted file contents of the stock firmware for the string mcuinfo_cdm56, it's only few files that contain the string, e.g. commander and httpd).

Maybe reset_request gpio?

I set only discovered gpios. If MSP require additional GPIO, it should be added to fdt.

In new image I set serial console to S1. That should end MSP Pin7 problem.

JBOOT devices have very slow flash. That is a huge issue durring sysupgrade,

I also added full wpad and rebased my branch to fresh openwrt master. Maybe wifi will work better.

s_2 · November 27, 2018, 9:19pm

Meanwhile, I had the stock firmware eventually show me the battery status again

All I had to do was apparently charge the battery to 100% (so it could better estimate the real capacity based on voltage?), it just didn't like the battery to be detached that often.
Otherwise, it would have been weird, since I could receive serial data from MSP within OpenWRT already, thus it could not be damage to the UART line as I thought initially.

Spent some time with the multimeter and microscope to add even more chaos to the schematic I had started back in may:
DIR510L_MSP430

So there's an LDO voltage regulator (U19) that supplies MSP with 3.0 Volts generated from VBAT.
It will actually be shutdown when the switch is set to "off" in the stock firmware - there's three diodes connected to the enable line, that allow three lines to separately enable the regulator for MSP, if any of them is set to high. Two come from the slider switch (Router / Charge), the third one I suppose must be connected to some GPIO - the other side of R127 vanishes into the inner layers of the PCB.
In stock firmware, this line is always low, so I wonder why D5 and R127 are populated at all (maybe for update, so you cannot brick the device by switching off? I will check).

AP2127
Sorry for the low quality, the LEDs are blinding the camera (should try to add some diffusor), looks way sharper through the eyepieces (including the damage to Pins 3-5, but they're actually fine (again) ).

// edit: ok screw it when writing all this I just wondered whether the MSP wouldn't be needed while charging... and yep, that's where the other end of R127 goes, the line will go high when the charger is plugged in. So the info above actually just turned useless