Zyxel p-2812 current state and updating wiki

Trying to install on a P-2812HNU-F3.
I can load u-boot.asc, but when trying the 'protect' command I get 'Unknown command'. I have tried mutilple versions of u-boot.asc, but with no luck. Can anyone lead me in the right direction?

as fa as i know f3 has a different flash structure so please use the correct instructions

Yes, there are two different Wikis. But as far as I can see F1 and F3 uses the same u-boot.asc. But the Wiki for F3 states the first command after loading u-boot.asc is 'protect off all', and this command seems not to be implemented.

hi all

i have f1 one. i flashed already 18.06. it worked. i tried to flash 19.07 but i did not success. i tried @Mafketel 's special firmware too. it has same kernel error.

please help me...

In spite of label telling my router is a F3, I will say it is a F1.
I can get UART mode by shorting R17 to ground, and it is a RT3062 on board (no RT3092). Succeded installing 18.06.8, then Mafketel's snapshot, and now 19.07.2

Can someone please share a printenv or something of a working 2812 with Telfort branded firmware? After restoring the 4 nand backups made following @Mafketel’s process, the modem boots but runs into a kernel panic, I think because uboot reverts to default environment somehow. I need the Telfort firmware to work again to troubleshoot DSL speeds on another 2812 running Openwrt (different topic).

if you had made the backup correctly and restored it correctly it should be identical. On the F1 EVERYTHING is in the nand and thus overwritten.
If yoiu have an F3 then there is an extra flash chip so you need to do some more things, but i do not have a F3 so I can't test.

I have an F1. I was also thinking that. I am open for suggestions, this is what I did, did I miss anything?

Backup:

nand read 81000000 0 2000000
tftpput 81000000 2000000 p2812backup-2000000.bin

nand read 81000000 2000000 2000000
tftpput 81000000 2000000 p2812backup-2000000-4000000.bin

nand read 81000000 4000000 2000000
tftpput 81000000 2000000 p2812backup-4000000-6000000.bin

nand read 81000000 6000000 2000000
tftpput 81000000 2000000 p2812backup-6000000-8000000.bin

And then, after messing with rootfs, my attempt to restore. I did not do a "nand erase.chip" because that seemed superfluous.

tftpboot 81000000 p2812new-2000000.bin
nand erase 0 $filesize && nand write $fileaddr 0 $filesize

tftpboot 81000000 p2812new-2000000-4000000.bin
nand erase 2000000 $filesize && nand write $fileaddr 2000000 $filesize

etc.

The result is a "bad crc or nand" error, "using default environment" at bootup. Afterwards, in the Zyxel loader, serial number is fake. But if I use the Zyxel command to copy from ROM into working memory, the serial number is correct. So the data is there, it's just that somehow, the boot loader refuses to load it, reverting to (not working) defaults.
:frowning:
So maybe the fastest is to set the correct environment again in the (original) u-boot from another 2812 running Telfort firmware...

Normally I'm not that organized, but in this case I found a minicom logfile from the end of 2013, which contains:

VR9 # printenv
bootcmd=nand read 0x86a80000 0x0001C000 10000; go 0x86a80000
bootdelay=0
baudrate=115200
mem=126M
phym=128M
ipaddr=192.168.1.1
serverip=192.168.1.33
ethaddr=00:E0:92:00:01:40
netdev=eth0
console=ttyS0
baudrate=115200
reset_ddr_config=prot off 0x0001ff34   0x0001ff4b;  erase 0x0001ff34 0x0001ff4b 1
mtdparts=ifx_nand:256k(uboot),-(rootfs)
reset_uboot_config=nand write.jffs 80400000 0x07040000 0x1000 
f_calibration_addr= IFX_CFG_FLASH_CALIBRATION_CFG_SIZE
f_calibration_size=IFX_CFG_FLASH_CALIBRATION_CFG_SIZE
stdin=serial
stdout=serial
stderr=serial
ethact=vr9 Switch

Environment size: 570/4092 bytes
VR9 #

Thanks @Mijzelf! I already had the same environment so I am stuck now. Below is what fully happens. Any thoughts on where I could have made a mistake in the nand backup/restore? I have downloaded the whole nand after this procedure and did a hash compare, it is identical to the nand backup of the working firmware :frowning:

ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK

ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK
DDR Access auto data-eye tuning Rev 0.3a
DDR size from 0xa0000000 - 0xa7ffffff
DDR check ok... start booting...



ZyU-F02-300-20AA003-V3.07|09/30|2011(TUE)

CLOCK CPU 500M RAM 250M
DRAM:  128 MB

 relocate_code start
 relocate_code finish.
128 MiB
*** Warning - bad CRC or NAND, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   fw_addr=0xa0200000
Internal phy(GE) firmware version: 0x020c
setup MDIO for new GPHY
vr9 Switch
Hit any key to stop autoboot:  0 

NAND read: device 0 offset 114688, size 65536 ...  65536 bytes read: OK
## Starting application at 0x86A80000 ...


Z-LOADER 3.0(Sep 30 2011)

NAND flash block size: 0x20000
Dual image: Both OK! upgcnt1=6 upgcnt2=7
Select 2nd zboot image...
go 0x86a90000
## Starting application at 0x86A90000 ...


Z-Boot 3.0.0(Oct  5 2015)

we get zloader version: 3.0
Hit any key to stop autoboot:   3 2 1 0
no ROMD partition
MRD_CERT_1 check=0
MRD_CERT_2 check=0


 Read Kernel to RAM from 2fe8000
bootargs=root=/dev/mtdblock1 rootfstype=yaffs2 console=ttyS0,115200 phym=128M mem=126M panic=1 vpe1_load_addr=0x87e00000M vpe1_mem=2M vpe1_wired_tlb_entries=0
## Booting image at 80800000 ...
   Image Name:   MIPS Linux-2.6.32
   Created:      2015-10-05   6:41:30 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1465690 Bytes =  1.4 MB
   Load Address: 80002000
   Entry Point:  800071f0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 800071f0) ...
## Giving linux memsize in MB, 128

Starting kernel ...

Lantiq xDSL CPE VR9
mips_hpt_frequency = 250000000, counter_resolution = 2
Linux version 2.6.32.42 (cjalee@ubuntu) (gcc version 4.3.3 (GCC) ) #25 Mon Oct 5 14:41:26 CST 2015
phym = 08000000, mem = 07e00000, max_pfn = 00007e00
Reserving memory for CP1 @0xa7e00000, size 0x00200000
CPU revision is: 00019556 (MIPS 34Kc)
Determined physical RAM map:
User-defined physical RAM map:
 memory: 07e00000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00007e00
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00007e00
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32004
Kernel command line: root=/dev/mtdblock1 rootfstype=yaffs2 console=ttyS0,115200 phym=128M mem=126M panic=1 vpe1_load_addr=0x87e00000M vpe1_mem=2M vpe1_wired_tlb_entries=0 
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=0007efd0
Readback ErrCtl register=0007efd0
Memory: 122580k/129024k available (3545k kernel code, 6264k reserved, 787k data, 204k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:185
Lantiq ICU driver, version 3.0.1, (c) 2001-2011 Lantiq Deutschland GmbH
console [ttyS0] enabled
Calibrating delay loop... 332.59 BogoMIPS (lpj=1662976)
Security Framework initialized
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Lantiq PCI host controller driver, version 1.2.0, (c) 2001-2011 Lantiq Deutschland GmbH
ifx_pcie_wait_phy_link_up port 0 timeout
ifx_pcie_wait_phy_link_up port 0 timeout
ifx_pcie_wait_phy_link_up port 0 timeout
ifx_pcie_wait_phy_link_up port 0 timeout
ifx_pcie_wait_phy_link_up port 0 timeout
pcie_rc_initialize port 0 link up failed!!!!!
Lantiq PCIe Root Complex driver, version 1.9.1, (c) 2001-2011 Lantiq Deutschland GmbH
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: PME# supported from D1 D2
pci 0000:00:00.0: PME# disabled
NET: Registered protocol family 8
NET: Registered protocol family 20
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
gptu: totally 6 16-bit timers/counters
gptu: misc_register on minor 63
gptu: succeeded to request irq 118
gptu: succeeded to request irq 119
gptu: succeeded to request irq 120
gptu: succeeded to request irq 121
gptu: succeeded to request irq 122
gptu: succeeded to request irq 123
IFX DMA driver, version ifxmips_dma_core.c:v1.1.5 
,(c)2009 Infineon Technologies AG
Lantiq CGU driver, version 1.1.38, (c) 2001-2011 Lantiq Deutschland GmbH
vpe1_mem = 200000
Wired TLB entries for Linux read_c0_wired() = 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
yaffs Oct  5 2015 14:37:09 Installing. 
msgmni has been set to 239
io scheduler noop registered (default)
ifx_pmu_init: Major 252
Lantiq PMU driver, version 1.2.6, (c) 2001-2011 Lantiq Deutschland GmbH
Lantiq GPIO driver, version 1.3.2, (c) 2001-2011 Lantiq Deutschland GmbH
Infineon Technologies RCU driver version 1.0.7 
Lantiq LED Controller driver, version 1.1.3, (c) 2001-2011 Lantiq Deutschland GmbH
Lantiq (VRX) DSL CPE MEI driver, version 1.4.4, (c) 2013 Lantiq Deutschland GmbH
ttyS0 at MMIO 0xbe100c00 (irq = 105) is a IFX_ASC
Register ASC (UART) to PMCU.
Lantiq ASC (UART) driver, version 1.0.14, (c) 2001-2011 Lantiq Deutschland GmbH
brd: module loaded
loop: module loaded
ifx_nand_init
Probe for NAND flash...
Checking if ONFI complient
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 731 at 0x000005b60000
Bad eraseblock 765 at 0x000005fa0000
Creating 7 MTD partitions on "ifx_nand":
0x0000000e0000-0x000001ee0000 : "rootfs,kernel1"
0x000001ee0000-0x000003ce0000 : "rootfs,kernel2"
0x000003ce0000-0x0000047a0000 : "reserve"
0x0000047a0000-0x000007460000 : "firmware"
0x000007460000-0x000007f00000 : "config"
0x000007f00000-0x000007f40000 : "mrd_cert1"
0x000007f40000-0x000007f80000 : "mrd_cert2"
enable TEMP sensor!!!!!!!!!!!!!!!!!
Lantiq SSC driver, version 2.4.2, (c) 2001-2011 Lantiq Deutschland GmbH
Lantiq SPI EERPOM driver, version 1.1.2, (c) 2001-2011 Lantiq Deutschland GmbH
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
IMQ driver loaded successfully.
Hooking IMQ after NAT on PREROUTING.
Hooking IMQ after NAT on POSTROUTING.
pegasus: v0.6.14 (2006/09/27), Pegasus/Pegasus II USB Ethernet driver
usbcore: registered new interface driver pegasus
IFX SWITCH API, Version 1.2.5
SWAPI: Registered character device [switch_api] with major no [81]
Switch API: PCE MicroCode loaded !!
Init GPHY Driver for A12 !!
Checking PHY LED States!!

GPHY FIRMWARE LOAD SUCCESSFULLY AT ADDR (GE MODE) : 80494000
IFX GPHY driver GE Mode, version ifxmips_xrx_gphy: V1.1.1 - Firmware: 8434 GPHY version: Gphy1_5
external GPHY version: 8304

@@@@@@ disable GPHY port 0, 1, 2, 4 and 5 @@@@@@@@@@@@@ !!
res = 87933680
Registered led device: broadband_led
Registered led device: internet_led
Registered led device: ledc_2
Registered led device: ledc_3
Registered led device: ledc_4
Registered led device: ledc_5
Registered led device: ledc_6
Registered led device: ledc_7
Registered led device: ledc_8
Registered led device: ledc_9
Registered led device: ledc_10
Registered led device: ledc_11
Registered led device: wps:green
Registered led device: ledc_13
Registered led device: ledc_14
Registered led device: usb2_link_led
Registered led device: ledc_16
Registered led device: ledc_17
Registered led device: usb1_link_led
Registered led device: fxo_act_led
Registered led device: internet_red_led
Registered led device: voip_led
Registered led device: warning_led
Registered led device: ledc_23
Lantiq LED driver, version 1.1.4, (c) 2001-2011 Lantiq Deutschland GmbH
Mirror/redirect action on
u32 classifier
    Performance counters on
    input device check on 
    Actions configured 
nf_conntrack version 0.5.0 (1918 buckets, 7672 max)
nf_conntrack_rtsp v0.6.21 loading
xt_time: kernel timezone is -0000
GRE over IPv4 tunneling driver
ip_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
lec.c: Oct  5 2015 14:38:45 initialized
mpc.c: Oct  5 2015 14:38:43 initialized
KOAM is loaded successfully.
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
yaffs: dev is 32505857 name is "mtdblock1"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.1, "mtdblock1"
yaffs_read_super: isCheckpointed 0
VFS: Mounted root (yaffs2 filesystem) readonly on device 31:1.
Freeing unused kernel memory: 204k freed
Please be patient, while OpenWrt loads ...
Kernel panic - not syncing: No init found.  Try passing init= option to kernel.
Rebooting in 1 seconds..
ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK
DDR Access auto data-eye tuning Rev 0.3a
DDR size from 0xa0000000 - 0xa7ffffff
DDR check ok... start booting...



ZyU-F02-300-20AA003-V3.07|09/30|2011(TUE)

CLOCK CPU 500M RAM 250M
DRAM:  128 MB

 relocate_code start
 relocate_code finish.
128 MiB
*** Warning - bad CRC or NAND, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   fw_addr=0xa0200000
Internal phy(GE) firmware version: 0x020c
setup MDIO for new GPHY
vr9 Switch
Hit any key to stop autoboot:  0 

NAND read: device 0 offset 114688, size 65536 ...  65536 bytes read: OK
## Starting application at 0x86A80000 ...


Z-LOADER 3.0(Sep 30 2011)

NAND flash block size: 0x20000
Dual image: Both OK! upgcnt1=6 upgcnt2=7
Select 2nd zboot image...
go 0x86a90000
## Starting application at 0x86A90000 ...


Z-Boot 3.0.0(Oct  5 2015)

we get zloader version: 3.0
Hit any key to stop autoboot:   3 2

I'm afraid I know the source of your problem, and I don't know how to solve it.

bootargs=root=/dev/mtdblock1 rootfstype=yaffs2

The root partition is a yaffs2 partition in an mtdblock. Yaffs2 is a lowlevel flash file system, which not only uses the addressable flash itself, but also the out-of-band bytes, to express the filesystem. I don't know what 'nand read' exactly does, but I think it omits the OOB data. Which means the restored filesystem is incomplete/inconsistent, and it cannot be mounted, causing this kernel panic.

Heh thanks. There is indeed a "nand read.oob" action which I did not do. So I could spend another €5 on yet another 2812. Or, figure out a way how to boot the other image?
By the way, right before the kernel panic, and after the successful YAFFS2 mount, see the "Please be patient, while OpenWrt loads"? Where the hell does that come from? This 2812 has not seen any OpenWrt as far as I can see.

So I have given up on restoring the Telfort firmware, following a "fix forward" approach, it seems that I was able to get a working OpenWRT with equivalent TCP WAN speeds. Still waiting to see if it is stable.

For reference, can I suggest the following for the wiki page of the F1:

  1. On Windows, the UART method worked the best in my case with PuTTY to the serial USB port. The 500k uboot ASC file I uploaded by simply putting it in the clipboard and right click pasting it inside PuTTY. Takes the loading time down to about a minute.
  2. The nand backup, in my case, failed to generate a working backup of the telco firmware. Maybe put a warning up.
  3. The latest stock firmware of Zyxel is basically unusable, it seemed to lack vectoring support so it was not an alternative in my case (VDSL with up- and downstream vectoring). Also there was no way to enter VPI/VPC numbers when selecting VDSL. I could not get it to work.

Cheers

I still think the image in itself is complete.
When I made my backup I opened it in linux as a loop device and I could read the root partition hence where I found the wireless firmware file.

Writing it might be tricky because of the oob data. But since this is a checksum you should be able to create it on the fly.

I did not react earlier since I forgot about testing and reading the "backup" as a loop device and about 10 minutes before I really read into the thread I actually erased my last telfort original in the hopes of getting the wifi working again.

good to see putty moves data faster I will try it the next time

What is the status of the U-boot for the P-2812 routers? The U-boot linked from the wiki page does not contain the fix that allows uncompressing kernel images up to 16 MB instead of 8 MB, which makes it impossible to try out a new firmware build without flashing.
The wiki page just says that "he recent openwrt releases do not include the proper bootloader files."

As I posted in another thread I've been trying to get OpenWrt running on a P-2812HNU-F1 vT from Telenor Sweden (They are ending support for them on February 11 and sending out replacement routers to all without wanting the old router back.)

Since I didn't know of the OOB data in the YAFFS2 root file system, I do not have a complete backup of the original firmware (3.10(TUL) updated December 19 2017). Since the F1 and F1 vT have different wireless chips, I've not yet been able to get Wireless working, and wanted to se if I could scrape some useful information from the stock firmware.

If anyone happens to have a F1 vT model, and have a copy of the OOB parts of the firmware I would like to get a copy of the root file system from there.

From my firmware backup I was able to extract the kernel image and the "firmware" squashfs partition, containing most of the specific stuff. However I am still missing the original root file system.

After some searching I did find TTelenor Norway firmware images for an unspecified P-2812 model, and were able to extract a root squashfs file system from there. Their images were at a different version than mine, (3.11(BLN.22)) but used the same kernel version (2.6.32).

From that image I've been able to extract a squashfs root partition @ 0x20000 of the latest firmware binary.

With that root file system as an initrd I've been able to boot the stock kernel from the OpwnWrt u-boot into a shell, but I've not restored the firmware partition to the flash yet, meaning I don't know if the rootfs I got has the correct init scripts for my router.

The kernel does not understand if uboot tires to pass the initrd from an UImage so I have to do that manually:

ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK

U-Boot SPL 2013.10-openwrt5 (Nov 18 2014 - 19:54:01)
SPL: initializing NAND flash
SPL: checking U-Boot image
SPL: loading U-Boot to RAM
SPL: decompressing U-Boot with LZO
SPL: jumping to U-Boot


U-Boot 2013.10-openwrt5 (Nov 18 2014 - 19:54:01) P-2812HNU-Fx

Board: ZyXEL P-2812HNU-Fx
SoC:   Lantiq VRX288 v1.2
CPU:   500 MHz
IO:    250 MHz
BUS:   250 MHz
BOOT:  NAND
DRAM:  128 MiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
Net:   ltq-eth
Hit any key to stop autoboot:  2  0 
P-2812HNU-Fx #   tftpboot 81000000 telenor-kernel.bin
ltq_phy: addr 0, link 1, speed 1000, duplex 1
ltq_phy: addr 1, link 0, speed 10, duplex 0
ltq_phy: addr 17, link 0, speed 100, duplex 0
ltq_phy: addr 19, link 0, speed 100, duplex 0
ltq_phy: addr 5, link 0, speed 10, duplex 0
Using ltq-eth device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'telenor-kernel.bin'.
Load address: 0x81000000
Loading: *#################################################################
 ###################################
 6 MiB/s
done
Bytes transferred = 1457244 (163c5c hex)
P-2812HNU-Fx # tftpboot 84000000 20000.squashfs
ltq_phy: addr 0, link 1, speed 1000, duplex 1
ltq_phy: addr 1, link 0, speed 10, duplex 0
ltq_phy: addr 17, link 0, speed 100, duplex 0
ltq_phy: addr 19, link 0, speed 100, duplex 0
ltq_phy: addr 5, link 0, speed 10, duplex 0
Using ltq-eth device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename '20000.squashfs'.
Load address: 0x84000000
Loading: *########################################################
 5.8 MiB/s
done
Bytes transferred = 818235 (c7c3b hex)
P-2812HNU-Fx # setenv  bootargs root=/dev/ram0 console=ttyS0,115200 phym=128M mem=126M  vpe1_load_addr=0x87e00000M vpe1_mem=2M vpe1_wired_tlb_entries=0 init=/bin/sh rd_start=0x84000000  rd_size=0x$filesize loglevel=7 
P-2812HNU-Fx # bootm 0x81000000
## Booting kernel from Legacy Image at 81000000 ...
   Image Name:   MIPS Linux-2.6.32
   Created:      2017-12-19   8:39:25 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1455981 Bytes = 1.4 MiB
   Load Address: 80002000
   Entry Point:  80006f30
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Lantiq xDSL CPE VR9
mips_hpt_frequency = 250000000, counter_resolution = 2
Linux version 2.6.32.32 (weilin@msgsw2-214) (gcc version 4.3.3 (GCC) ) #24 Tue Dec 19 16:39:19 CST 2017
phym = 08000000, mem = 07e00000, max_pfn = 00007e00
Reserving memory for CP1 @0xa7e00000, size 0x00200000
CPU revision is: 00019556 (MIPS 34Kc)
Determined physical RAM map:
User-defined physical RAM map:
 memory: 07e00000 @ 00000000 (usable)
Initial ramdisk at: 0x84000000 (818235 bytes)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00007e00
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00007e00
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32004
Kernel command line: root=/dev/ram0 console=ttyS0,115200 phym=128M mem=126M vpe1_load_addr=0x87e00000M vpe1_mem=2M vpe1_wired_tlb_entries=0 init=/bin/sh rd_start=0x84000000 rd_size=0xc7c3b loglevel=7 
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00048440
Readback ErrCtl register=00048440
Memory: 61340k/129024k available (3528k kernel code, 67500k reserved, 781k data, 204k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:185
Lantiq ICU driver, version 3.0.1, (c) 2001-2011 Lantiq Deutschland GmbH
console [ttyS0] enabled
Calibrating delay loop... 332.59 BogoMIPS (lpj=1662976)
Security Framework initialized
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Lantiq PCI host controller driver, version 1.2.0, (c) 2001-2011 Lantiq Deutschland GmbH
Lantiq PCIe Root Complex driver, version 1.6.5, (c) 2001-2011 Lantiq Deutschland GmbH
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: PME# supported from D1 D2
pci 0000:00:00.0: PME# disabled
ifx_pcie_rc_class_early_fixup port 0: fixed pcie host bridge to pci-pci bridge
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:01:00.0: PME# disabled
pci 0000:01:00.0: PCI bridge, secondary bus 0000:02
pci 0000:01:00.0:   IO window: disabled
pci 0000:01:00.0:   MEM window: 0x1c000000-0x1c0fffff
pci 0000:01:00.0:   PREFETCH window: disabled
NET: Registered protocol family 8
NET: Registered protocol family 20
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
Trying to unpack rootfs image as initramfs...
rootfs image is not initramfs (junk in compressed archive); looks like an initrd
Freeing initrd memory: 799k freed
gptu: totally 6 16-bit timers/counters
gptu: misc_register on minor 63
gptu: succeeded to request irq 118
gptu: succeeded to request irq 119
gptu: succeeded to request irq 120
gptu: succeeded to request irq 121
gptu: succeeded to request irq 122
gptu: succeeded to request irq 123
IFX DMA driver, version ifxmips_dma_core.c:v1.0.24 
,(c)2009 Infineon Technologies AG
Lantiq CGU driver, version 1.1.32, (c) 2001-2011 Lantiq Deutschland GmbH
vpe1_mem = 200000
Wired TLB entries for Linux read_c0_wired() = 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
yaffs Dec  7 2017 14:18:50 Installing. 
msgmni has been set to 121
io scheduler noop registered (default)
ifx_pmu_init: Major 252
Lantiq PMU driver, version 1.2.6, (c) 2001-2011 Lantiq Deutschland GmbH
Lantiq GPIO driver, version 1.3.2, (c) 2001-2011 Lantiq Deutschland GmbH
Infineon Technologies RCU driver version 1.0.7 
Lantiq LED Controller driver, version 1.1.3, (c) 2001-2011 Lantiq Deutschland GmbH
MEI CPE Driver, Version 1.2.0


(c) Copyright 2009, Infineon Technologies AG


### MEI CPE - MEI CPE - MEI CPE - MEI CPE ###


ttyS0 at MMIO 0xbe100c00 (irq = 105) is a IFX_ASC
Register ASC (UART) to PMCU.
Lantiq ASC (UART) driver, version 1.0.11, (c) 2001-2011 Lantiq Deutschland GmbH
brd: module loaded
loop: module loaded
ifx_nand_init
Probe for NAND flash...
Checking if ONFI complient
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 602 at 0x000004b40000
Creating 8 MTD partitions on "ifx_nand":
0x0000000e0000-0x000001ee0000 : "rootfs,kernel1"
0x000001ee0000-0x000003ce0000 : "rootfs,kernel2"
0x000003ce0000-0x0000046a0000 : "reserve"
0x0000046a0000-0x000007360000 : "firmware"
0x000007360000-0x000007e00000 : "config"
0x000007e00000-0x000007e80000 : "romd"
0x000007e80000-0x000007f00000 : "mrd_cert1"
0x000007f00000-0x000007f80000 : "mrd_cert2"
enable TEMP sensor!!!!!!!!!!!!!!!!!
Lantiq SSC driver, version 2.3.9, (c) 2001-2011 Lantiq Deutschland GmbH
Lantiq SPI EERPOM driver, version 1.1.1, (c) 2001-2011 Lantiq Deutschland GmbH
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
IMQ driver loaded successfully.
Hooking IMQ after NAT on PREROUTING.
Hooking IMQ after NAT on POSTROUTING.
pegasus: v0.6.14 (2006/09/27), Pegasus/Pegasus II USB Ethernet driver
usbcore: registered new interface driver pegasus
IFX SWITCH API, Version 1.1.8.5
SWAPI: Registered character device [switch_api] with major no [81]
Switch API: PCE MicroCode loaded !!
GPHY FW load for G.Hn !!
GPHY FW load for A12 !!
GPHY FIRMWARE LOAD SUCCESSFULLY AT ADDR (VR9) : 48c000
GPHY FIRMWARE LOAD SUCCESSFULLY AT ADDR (GHN) : 48c000
external GPHY version: 8430

IFX GPHY driver GE Mode, version ifxmips_vr9_gphy: V1.0.1 - Firmware: 40b
@@@@@@ disable GPHY port 0, 1, 2, 4 and 5 @@@@@@@@@@@@@ !!
Checking PHY LED States!!


Registered led device: broadband_led
Registered led device: internet_led
Registered led device: ledc_2
Registered led device: ledc_3
Registered led device: ledc_4
Registered led device: ledc_5
Registered led device: ledc_6
Registered led device: ledc_7
Registered led device: ledc_8
Registered led device: ledc_9
Registered led device: ledc_10
Registered led device: ledc_11
Registered led device: wps:green
Registered led device: ledc_13
Registered led device: ledc_14
Registered led device: usb2_link_led
Registered led device: ledc_16
Registered led device: ledc_17
Registered led device: usb1_link_led
Registered led device: fxo_act_led
Registered led device: internet_red_led
Registered led device: voip_led
Registered led device: warning_led
Registered led device: ledc_23
Lantiq LED driver, version 1.1.4, (c) 2001-2011 Lantiq Deutschland GmbH
Mirror/redirect action on
u32 classifier
    Performance counters on
    input device check on 
    Actions configured 
nf_conntrack version 0.5.0 (3750 buckets, 15000 max)
ip_conntrack_rtsp v0.6.21 loading
xt_time: kernel timezone is -0000
ZLD: zy_sm_init() register hooks successful.
GRE over IPv4 tunneling driver
ip_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
lec.c: Dec  7 2017 14:21:15 initialized
mpc.c: Dec  7 2017 14:21:11 initialized
KOAM is loaded successfully.
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
RAMDISK: squashfs filesystem found at block 0
RAMDISK: Loading 800KiB [1 disk] into ram disk... |/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/done.
VFS: Mounted root (squashfs filesystem) readonly on device 1:0.
Freeing unused kernel memory: 204k freed
/bin/sh: can't access tty; job control turned off
# 

I'm not sure exactly what would be my next step, but did collect some information from the sysfs partition regarding pci devices:

# cat /sys/devices/pci0000\:00/0000\:00\:00.0/uevent
PCI_CLASS=28000
PCI_ID=1BEF:0019
PCI_SUBSYS_ID=1BEF:0019
PCI_SLOT_NAME=0000:00:00.0
MODALIAS=pci:v00001BEFd00000019sv00001BEFsd00000019bc02sc80i00

# cat /sys/devices/pci0000\:01/0000\:01\:00.0/uevent
DRIVER=pcieport
PCI_CLASS=60400
PCI_ID=1BEF:0011
PCI_SUBSYS_ID=0000:0000
PCI_SLOT_NAME=0000:01:00.0
MODALIAS=pci:v00001BEFd00000011sv00000000sd00000000bc06sc04i00
# cat /sys/devices/pci0000\:01/0000\:01\:00.0/resource
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x000000001c000000 0x000000001c0fffff 0x0000000000000200
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000

# cat /sys/devices/pci0000\:01/0000\:01\:00.0/0000\:02\:00.0/uevent
PCI_CLASS=28000
PCI_ID=1814:3092
PCI_SUBSYS_ID=1814:3092
PCI_SLOT_NAME=0000:02:00.0
MODALIAS=pci:v00001814d00003092sv00001814sd00003092bc02sc80i00
# cat /sys/devices/pci0000\:01/0000\:01\:00.0/0000\:02\:00.0/resource
0x000000001c000000 0x000000001c00ffff 0x0000000000020200
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 0x0000000000000000

I think that my next step might be to flash back the 'firmware' partition to the nand and actually see if I can get the stock firmware back up in a running state with wifi using OpenWrt uboot and that bastard root fs from the Norwegian firmware.

But I'm interested in some suggestions on how to create a proper device tree for my device based on information I can extract from the old running kernel. I think the last pci device I listed is the wireless module, so already in this minimal booted state the stock kernel is able to identify it.

For what it's worth: that is a Ralink RT3092 Wireless 802.11n 2T/2R PCIe, while my 'proper' P2812 has a Ralink RT3062. No idea what is the difference. The RT3062 uses some rt2800* and rt2x00* kernel modules. And it loads a file /lib/firmware/RT3062.eeprom
The RT3092 might need another file, which (thanks to @Mafketel) might be stored in /etc/wireless/rt2860ap/ in the original firmware. The bootlog of OpenWrt might tell which filename it is seeking for. The corresponding lines in my bootlog:

[   11.527225] PCI: Enabling device 0000:00:0e.0 (0000 -> 0002)
[   11.531819] ieee80211 phy0: rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'RT3062.eeprom'.
[   11.542182] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 3572, rev 0223 detected
[   11.549188] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 0008 detected
[   11.557380] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'

I got the OpenWrt bootlog as well:

ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK

U-Boot SPL 2013.10-openwrt5 (Nov 18 2014 - 19:54:01)
SPL: initializing NAND flash
SPL: checking U-Boot image
SPL: loading U-Boot to RAM
SPL: decompressing U-Boot with LZO
SPL: jumping to U-Boot


U-Boot 2013.10-openwrt5 (Nov 18 2014 - 19:54:01) P-2812HNU-Fx

Board: ZyXEL P-2812HNU-Fx
SoC:   Lantiq VRX288 v1.2
CPU:   500 MHz
IO:    250 MHz
BUS:   250 MHz
BOOT:  NAND
DRAM:  128 MiB
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
Net:   ltq-eth
Hit any key to stop autoboot:  2  1  0 

NAND read: device 0 offset 0x60000, size 0x300000
 3145728 bytes read: OK
## Booting kernel from Legacy Image at 80800000 ...
   Image Name:   MIPS OpenWrt Linux-5.4.94
   Created:      2021-02-03  15:19:14 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2506361 Bytes = 2.4 MiB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 5.4.94 (viktor@vanimelde) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r15676-c3959cd54f)) #0 SMP Wed Feb 3 15:19:14 2021

[    0.000000] SoC: xRX200 rev 1.2

[    0.000000] printk: bootconsole [early0] enabled

[    0.000000] CPU0 revision is: 00019556 (MIPS 34Kc)

[    0.000000] MIPS: machine is ZyXEL P-2812HNU-F1 vT

[    0.000000] Initrd not found or empty - disabling initrd

[    0.000000] Detected 1 available secondary CPU(s)

[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.

[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes

[    0.000000] Zone ranges:

[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]

[    0.000000] Movable zone start for each node

[    0.000000] Early memory node ranges

[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]

[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]

[    0.000000] percpu: Embedded 14 pages/cpu s26224 r8192 d22928 u57344

[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480

[    0.000000] Kernel command line: console=ttyLTQ0,115200

[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)

[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)

[    0.000000] Writing ErrCtl register=00048440

[    0.000000] Readback ErrCtl register=00048440

[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off

[    0.000000] Memory: 120460K/131072K available (5949K kernel code, 215K rwdata, 1528K rodata, 1252K init, 221K bss, 10612K reserved, 0K cma-reserved)

[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=2, Nodes=1

[    0.000000] rcu: Hierarchical RCU implementation.

[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.

[    0.000000] NR_IRQS: 256

[    0.000000] random: get_random_bytes called from start_kernel+0x33c/0x554 with crng_init=0

[    0.000000] CPU Clock: 500MHz

[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041786 ns

[    0.000010] sched_clock: 32 bits at 250MHz, resolution 4ns, wraps every 8589934590ns

[    0.007896] Calibrating delay loop... 332.54 BogoMIPS (lpj=665088)

[    0.045943] pid_max: default: 32768 minimum: 301

[    0.050867] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)

[    0.058057] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)

[    0.069305] rcu: Hierarchical SRCU implementation.

[    0.074856] smp: Bringing up secondary CPUs ...

[    0.080490] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.

[    0.080504] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes

[    0.080628] CPU1 revision is: 00019556 (MIPS 34Kc)

[    0.111500] Synchronize counters for CPU 1: done.

[    0.135847] smp: Brought up 1 node, 2 CPUs

[    0.146005] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns

[    0.155655] futex hash table entries: 512 (order: 2, 16384 bytes, linear)

[    0.162718] pinctrl core: initialized pinctrl subsystem

[    0.169843] NET: Registered protocol family 16

[    0.187515] dcdc-xrx200 1f106a00.dcdc: Core Voltage : 1016 mV

[    0.200766] pinctrl-xway 1e100b10.pinmux: Init done

[    0.207634] dma-xway 1e104100.dma: Init done - hw rev: 7, ports: 7, channels: 28

[    0.220815] PCI host bridge /fpi@10000000/pci@e105400 ranges:

[    0.226476]  MEM 0x0000000018000000..0x0000000019ffffff

[    0.231743]   IO 0x000000001ae00000..0x000000001affffff

[    0.275585] gpio-stp-xway 1e100bb0.stp: Init done

[    0.282674] usbcore: registered new interface driver usbfs

[    0.288241] usbcore: registered new interface driver hub

[    0.293595] usbcore: registered new device driver usb

[    0.299421] PCI host bridge to bus 0000:00

[    0.303447] pci_bus 0000:00: root bus resource [mem 0x18000000-0x19ffffff]

[    0.310344] pci_bus 0000:00: root bus resource [io  0x1ae00000-0x1affffff]

[    0.317319] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]

[    0.324137] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]

[    0.334577] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00

[    0.341220] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512

[    0.352877] clocksource: Switched to clocksource MIPS

[    0.360368] NET: Registered protocol family 2

[    0.365966] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)

[    0.374300] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)

[    0.381975] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)

[    0.389080] TCP: Hash tables configured (established 1024 bind 1024)

[    0.395699] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)

[    0.402162] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)

[    0.409511] NET: Registered protocol family 1

[    0.413835] PCI: CLS 0 bytes, default 32

[    0.418312] gptu: totally 6 16-bit timers/counters

[    0.423370] gptu: misc_register on minor 63

[    0.427531] gptu: succeeded to request irq 126

[    0.428888] random: fast init done

[    0.432117] gptu: succeeded to request irq 127

[    0.439985] gptu: succeeded to request irq 128

[    0.444525] gptu: succeeded to request irq 129

[    0.449045] gptu: succeeded to request irq 130

[    0.453523] gptu: succeeded to request irq 131

[    0.458231] No VPEs reserved for AP/SP, not initialize VPE loader

[    0.458231] Pass maxvpes=<n> argument as kernel argument

[    0.469585] No TCs reserved for AP/SP, not initializing RTLX.

[    0.469585] Pass maxtcs=<n> argument as kernel argument

[    0.483279] workingset: timestamp_bits=14 max_order=15 bucket_order=1

[    0.507379] squashfs: version 4.0 (2009/01/31) Phillip Lougher

[    0.513125] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.

[    0.534454] 1e100c00.serial: ttyLTQ0 at MMIO 0x1e100c00 (irq = 112, base_baud = 0) is a lantiq,asc

[    0.543414] printk: console [ttyLTQ0] enabled
[    0.543414] printk: console [ttyLTQ0] enabled

[    0.552096] printk: bootconsole [early0] disabled
[    0.552096] printk: bootconsole [early0] disabled

[    0.565941] nand: device found, Manufacturer ID: 0xec, Chip ID: 0xf1
[    0.570858] nand: Samsung NAND 128MiB 3,3V 8-bit
[    0.575464] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    0.583137] Scanning device for bad blocks
[    0.639937] Bad eraseblock 602 at 0x000004b40000
[    0.679951] 4 fixed-partitions partitions found on MTD device 10000000.flash
[    0.685592] Creating 4 MTD partitions on "10000000.flash":
[    0.691102] 0x000000000000-0x000000040000 : "uboot"
[    0.698043] 0x000000040000-0x000000060000 : "u-boot-env"
[    0.704055] 0x000000060000-0x000000360000 : "kernel"
[    0.709812] 0x000000360000-0x000008000000 : "ubi"
[    0.718365] libphy: Fixed MDIO Bus: probed
[    0.734323] NET: Registered protocol family 10
[    0.741991] Segment Routing with IPv6
[    0.744333] NET: Registered protocol family 17
[    0.748931] 8021q: 802.1Q VLAN Support v1.8
[    0.759389] pcie-xrx200 1d900000.pcie: failed to get the PCIe PHY
[    0.871894] libphy: lantiq,xrx200-mdio: probed
[    0.882278] Intel XWAY PHY11G (PEF 7071/PEF 7072) v1.5 / v1.6 0:00: attached PHY driver [Intel XWAY PHY11G (PEF 7071/PEF 7072) v1.5 / v1.6] (mii_bus:phy_addr=0:00, irq=POLL)
[    0.897289] Intel XWAY PHY11G (PEF 7071/PEF 7072) v1.5 / v1.6 0:01: attached PHY driver [Intel XWAY PHY11G (PEF 7071/PEF 7072) v1.5 / v1.6] (mii_bus:phy_addr=0:01, irq=POLL)
[    0.912597] Intel XWAY PHY11G (xRX v1.2 integrated) 0:11: attached PHY driver [Intel XWAY PHY11G (xRX v1.2 integrated)] (mii_bus:phy_addr=0:11, irq=POLL)
[    0.926352] Intel XWAY PHY11G (xRX v1.2 integrated) 0:13: attached PHY driver [Intel XWAY PHY11G (xRX v1.2 integrated)] (mii_bus:phy_addr=0:13, irq=POLL)
[    0.940098] Intel XWAY PHY11G (PEF 7071/PEF 7072) v1.5 / v1.6 0:05: attached PHY driver [Intel XWAY PHY11G (PEF 7071/PEF 7072) v1.5 / v1.6] (mii_bus:phy_addr=0:05, irq=POLL)
[    0.957321] pcie-xrx200 1d900000.pcie: failed to request gpio 500
[    0.962053] pcie-xrx200: probe of 1d900000.pcie failed with error -16
[    0.969300] UBI: auto-attach mtd3
[    0.971739] ubi0: attaching mtd3
[    1.137393] ubi0: scanning is finished
[    1.153566] ubi0: attached mtd3 (name "ubi", size 124 MiB)
[    1.157693] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytes
[    1.164563] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 512
[    1.171224] ubi0: VID header offset: 512 (aligned 512), data offset: 2048
[    1.178022] ubi0: good PEBs: 996, bad PEBs: 1, corrupted PEBs: 0
[    1.184040] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    1.191257] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 2140935702
[    1.200391] ubi0: available PEBs: 0, total reserved PEBs: 996, PEBs reserved for bad PEB handling: 19
[    1.209788] ubi0: background thread "ubi_bgt0d" started, PID 475
[    1.213422] block ubiblock0_0: created from ubi0:0(rootfs)
[    1.221178] ubiblock: device ubiblock0_0 (rootfs) set to be root fil[    1.235602] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    1.245332] Freeing unused kernel memory: 1252K
[    1.248402] This architecture does not have kernel memory protection.
[    1.254883] Run /sbin/init as init process
[    1.830847] init: Console is alive
[    1.833262] init: - watchdog -
[    2.900216] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.020598] dwc2 1e101000.usb: 1e101000.usb supply vusb_d not found, using dummy regulator
[    3.027657] dwc2 1e101000.usb: 1e101000.usb supply vusb_a not found, using dummy regulator
[    3.137318] dwc2 1e101000.usb: DWC OTG Controller
[    3.140643] dwc2 1e101000.usb: new USB bus registered, assigned bus number 1
[    3.147750] dwc2 1e101000.usb: irq 62, io mem 0x1e101000
[    3.154330] hub 1-0:1.0: USB hub found
[    3.156798] hub 1-0:1.0: 1 port detected
[    3.162019] dwc2 1e106000.usb: 1e106000.usb supply vusb_d not found, using dummy regulator
[    3.169119] dwc2 1e106000.usb: 1e106000.usb supply vusb_a not found, using dummy regulator
[    3.279168] dwc2 1e106000.usb: DWC OTG Controller
[    3.282557] dwc2 1e106000.usb: new USB bus registered, assigned bus number 2
[    3.289561] dwc2 1e106000.usb: irq 91, io mem 0x1e106000
[    3.296229] hub 2-0:1.0: USB hub found
[    3.298944] hub 2-0:1.0: 1 port detected
[    3.304942] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.314020] init: - preinit -
[    4.402547] lantiq,xrx200-net 1e108000.eth eth0: port 0 got link
[    4.407741] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    4.432578] random: procd: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    8.600171] UBIFS (ubi0:1): Mounting in unauthenticated mode
[    8.605044] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 557
[    8.658418] UBIFS (ubi0:1): recovery needed
[    8.762951] UBIFS (ubi0:1): recovery completed
[    8.766238] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[    8.773828] UBIFS (ubi0:1): LEB size: 129024 bytes (126 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    8.783750] UBIFS (ubi0:1): FS size: 119863296 bytes (114 MiB, 929 LEBs), journal size 6064128 bytes (5 MiB, 47 LEBs)
[    8.794414] UBIFS (ubi0:1): reserved for root: 4952683 bytes (4836 KiB)
[    8.801014] UBIFS (ubi0:1): media format: w4/r0 (latest is w5/r0), UUID 3EB803B4-B9EB-4FD4-BEAA-62BCA5385A2D, small LPT model
[    8.815198] mount_root: switching to ubifs overlay
[    8.829235] urandom-seed: Seeding with /etc/urandom.seed
[    9.013337] lantiq,xrx200-net 1e108000.eth eth0: port 0 lost link
[    9.033181] procd: - early -
[    9.034806] procd: - watchdog -
[    9.679378] procd: - watchdog -
[    9.682674] procd: - ubus -
[    9.769572] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.777057] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.782647] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.790709] procd: - init -
Please press Enter to activate this console.
[   10.949773] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.958859] IFXOS, Version 1.5.19 (c) Copyright 2009, Lantiq Deutschland GmbH
[   10.972340] NET: Registered protocol family 8
[   10.975308] NET: Registered protocol family 20
[   10.990631] PPP generic driver version 2.4.2
[   11.066237] Lantiq (VRX) DSL CPE MEI driver, version 1.5.17.6, (c) 2007-2015 Lantiq Beteiligungs-GmbH & Co. KG
[   11.084920] 
[   11.084920] 
[   11.084920] Lantiq CPE API Driver version: DSL CPE API V4.17.18.6
[   11.102594] 
[   11.102594] Predefined debug level: 3
[   11.117646] Loading modules backported from Linux version v5.8.18-0-gab435ce49bd1
[   11.123844] Backport generated by backports.git v5.8.18-1-0-ga630fd46
[   11.176665] Infineon Technologies DEU driver version 2.0.0 
[   11.183480] IFX DEU DES initialized (multiblock).
[   11.188790] IFX DEU AES initialized (multiblock).
[   11.193176] IFX DEU ARC4 initialized (multiblock).
[   11.197438] IFX DEU SHA1 initialized.
[   11.201251] IFX DEU MD5 initialized.
[   11.204575] IFX DEU SHA1_HMAC initialized.
[   11.208740] IFX DEU MD5_HMAC initialized.
[   11.229211] NET: Registered protocol family 24
[   11.252084] xt_time: kernel timezone is -0000
[   11.258855] urngd: v1.0.2 started.
[   11.589388] kmodloader: done loading kernel modules from /etc/modules.d/*
[   11.648545] random: crng init done
[   11.650571] random: 6 urandom warning(s) missed due to ratelimiting
[   27.042400] device eth0 entered promiscuous mode
[   27.047246] br-lan: port 1(eth0.1) entered blocking state
[   27.051457] br-lan: port 1(eth0.1) entered disabled state
[   27.057437] device eth0.1 entered promiscuous mode
[   30.105140] lantiq,xrx200-net 1e108000.eth eth0: port 0 got link
[   30.109944] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   30.117361] br-lan: port 1(eth0.1) entered blocking state
[   30.121447] br-lan: port 1(eth0.1) entered forwarding state
[   30.127861] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready



BusyBox v1.31.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r15676-c3959cd54f
 -----------------------------------------------------
root@(none):/#

I think that the error that I have to solve is the kernel not finding/loading the PCIe bus:

[    0.759389] pcie-xrx200 1d900000.pcie: failed to get the PCIe PHY
[    0.957321] pcie-xrx200 1d900000.pcie: failed to request gpio 500
[    0.962053] pcie-xrx200: probe of 1d900000.pcie failed with error -16

But I'm not really sure of where to start with that.

Hi gramphos,

You mean wifi working on stock-firmware, not working on OpenWrt?
Did you try rename (or copy) the file RT3092_PCIe_LNA_2T2R_ALC_V1_2.bin to RT3092.eeprom, and place it into OpenWrt folder /lib/firmware ?
This does the trick for the RT3062.eeprom and corresponding Wifi on 'normal'P-2812HNU-F1 boxes.

You also can build OpenWrt with (or install) pciutils command to get more (CLI) info about Wifi.
On F1 with RT3062:

/# lspci  -vv
00:0e.0 Network controller: Ralink corp. RT3062 Wireless 802.11n 2T/2R
        Subsystem: Ralink corp. RT3062 Wireless 802.11n 2T/2R
        Device tree node: /sys/firmware/devicetree/base/fpi@10000000/pci@e105400/wifi@1814,3062
        Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV+ VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
        Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=slow >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
        Latency: 64 (500ns min, 1000ns max), Cache Line Size: 32 bytes
        Interrupt: pin A routed to IRQ 30
        Region 0: Memory at 18000000 (32-bit, non-prefetchable) [size=64K]
        Capabilities: [40] Power Management version 3
                Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=0 PME-
        Kernel driver in use: rt2800pci
lspci: Unable to load libkmod resources: error -12

I have to tell that there are strange behaviours on 'almost' dead wifi. Seen 1814:3592 in some of my old logs.
http://dolfgeerdink.nl/phpbb/viewtopic.php?p=261#p261
Not sure if that box's wifi survived...

DG.

For anyone out there with an F3, I've compiled some images with the same changes Mafketel used for their F1 images. I've also written some info about installing, since the wiki is quite outdated.

I'll get around to updating the wiki with some of this too, but put it on GitLab for now.

Can find the stuff here: https://gitlab.com/Jakkar/installing-openwrt-on-zyxel-p-2812hnu-f3


Also, does anyone have any info on compiling the openwrt-lantiq-p2812hnufx_nor-u-boot.img image? Since currently the wiki says to use one ScApis repo, but there should be an option to compile one manually.

Same goes for the openwrt-lantiq-xrx200-P2812HNUF3-uImage really.

I'm fairly new to this, so I'm not sure where these images come from, and had a hard time finding info about em.

1 Like