OpenWrt Forum Archive

Topic: AMPED 1900 AC (SoC RTL 8198C) Jtag Recovery

The content of this topic has been archived on 24 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hi,
after a firmare update my Ampedwireless RTA 1900 AC router got bricked and isn't IP accessible so I cannot recover it through tftp.

I'm considering recover it through JTAG, however I didn't find so far

- confirmation on what seems to be correct pinout (connectors close to J1 tag)
- RTL 8198C's datasheet

Of course is someone is aware on any backdoor of Ampedewireless RTA 1900 AC that would be the best option (already tried 30/30/30 reset but no way).

Can anybody help me?

Thanks, regards
jm

PS please note that D-Link Dir-879 which is more popular seems to have a similar board

JuanManuelCash wrote:

and isn't IP accessible so I cannot recover it through tftp.

It doesn't need to be IP accessible. In most cases some low level function tries to download a fixed filename from a fixed IP address. That doesn't mean it has to have open ports or reacts on ping.

If you connect the box directly to a PC running Wireshark, you can see if it tries to access a tftp server, and if yes, on which address.

Hi,
thanks for your feedback. Already tried Wireshark in order to browse for any tftp request addressing a static IP however was no way.
Thanks, regards
jm

JuanManuelCash wrote:

Hi,
thanks for your feedback. Already tried Wireshark in order to browse for any tftp request addressing a static IP however was no way.
Thanks, regards
jm

You have to open your router and search for a 4 wire (mostly empty) jumper layout
And you need a USB to serial tty (3.3Volts) cable
You can fiind this on ebay mostly with PL2303 or CP210X chipset.
DONT connect the red wire this (5 volt) this will dmage your board.

Will do this weekend and let you know, thank you very much.
Juan Manuel

For the testing :
Because I'm lazy to remember *all* of the layouts of this (empty) jumper thing.
I do first check which of these four pins is ground with a ohmmeter.

Then connect ground (mostly black) and test for the TX line on the board.
You do connect the red/blue cable (see manual of the converter for RX) to the rest of the pins with a running serial terminal on the computer side.
It's mostly Bandrate 115200 and plug the router in mains.
If you see garbage good, only the baudrate is wrong
if not next pin.

The TX line from the computer is easy and will normally "survive" if connected to 3.3volt on the board.

Goodmorning,
succeeded setting jtag connection (right baud value was 38,400)

Now when I connect to the console and boot the router, I see what follows. Do you have any clue to get it into load mode so I can apply firmware?

Thanks, regards
jm



BBoooottiinng.
DRAM Type: DDR3
        DRAM frequency: 580MHz
        DRAM Size = 128  MB
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@
@ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize
@ 0000000h 0c22017h 00000c2h 0000020h 0000017h 0000000h 0000017h 0800000h
@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName
@ 0010000h 0000080h 0001000h 0000800h 0000100h 0000010h 0000048h MX25L6405D
@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@


---Realtek RTL8198C boot code at 2015.07.18-13:15+0800 v1.5f (1000MHz) [C0 runni
ng][C1 sleep]
no sys signature at 00010000!
no sys signature at 00020000!
….
---Ethernet init Okay!
<RealTek>

JuanManuelCash wrote:

Goodmorning,
succeeded setting jtag connection (right baud value was 38,400)

Looking at your baudrate and log output you are using serial not jtag ..
plase post output from

printenv

and

help

Good morning,
find below output from Realtek's bootlader, the only thing of alive I have access to.

I have been sniffing with Wireshark ethernet connection traffic  from my Win10 PC to both LAN and Modem ports on the router, looks that nothing is coming from the router. I assume that IP/UDP are down so I'm looking if there is a mean to
- loading firmware image from the jtag connection
- erasing nvram from Realtesk's bootloader

Another test that I run was performing soft/hard router reset to understand if there was a different behaviour from standard power on boot. The only difference seems that with reset (only hard at power on works) the router looks only at the 2 first 2 blocks (addresses 10,000 and 20,000 hex) instead of probing any block and any sector (after address 2,000) up to block 80,000 (see A) as it does with standard boot.

(A)

BBoooottiinng.
DRAM Type: DDR3
        DRAM frequency: 580MHz
        DRAM Size = 128  MB
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@
@ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize
@ 0000000h 0c22017h 00000c2h 0000020h 0000017h 0000000h 0000017h 0800000h
@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName
@ 0010000h 0000080h 0001000h 0000800h 0000100h 0000010h 0000048h MX25L6405D
@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@


---Realtek RTL8198C boot code at 2015.07.18-13:15+0800 v1.5f (1000MHz) [C0 runni
ng][C1 sleep]
no sys signature at 00010000!
no sys signature at 00020000!


(B)
<RealTek>?
---------------- COMMAND MODE HELP ------------------
HELP (?)                                    : Print this help message
DB <Address> <Len>
DW <Address> <Len>
EB <Address> <Value1> <Value2>...
EW <Address> <Value1> <Value2>...
CMP: CMP <dst><src><length>
IPCONFIG:<TargetAddress>
AUTOBURN: 0/1
LOADADDR: <Load Address>
J: Jump to <TargetAddress>
FLI: Flash init
FLR: FLR <dst><src><length>
FLW <dst_ROM_offset><src_RAM_addr><length_Byte> <SPI cnt#>: Write to SPI
MDIOR:  MDIOR phyid reg
MDIOW:  MDIOW phyid reg data
PHYR: PHYR <PHYID><reg>
PHYW: PHYW <PHYID><reg><data>
PHYPR: PHYPR <PHYID><page><reg>
PHYPW: PHYPW <PHYID><page><reg><data>
XMOD <addr>  [jump]
TI : timer init
T : test
HRST: Host Pcie Reset <portnum> <mdio_rst>:
HINIT: Host init bar <portnum>
HLOOP: Test Pci-E data loopback <portnum> <cnt>
EPDN: PCIE Power Down test <portnum><mode>
EMDIOR: Reg Read <portnum>
EMDIOW <portnum> <reg> <val>:
ELOOP <portnum> <start/stop>:
EINT <portnum> <loops>:
PHY_BEGIN:
ETH : startup Ethernet
CPUClk:
C1Wake : Core 1 wake Up
GBIST: GPHY BIST
GDRF: GPHY DRF BIST
BISTALL:

JuanManuelCash wrote:

I have been sniffing with Wireshark ethernet connection traffic  from my Win10 PC to both LAN and Modem ports on the router, looks that nothing is coming from the router. I assume that IP/UDP are down

There is no network running in this stage ...
This *is* fairly normal.


---Realtek RTL8198C boot code at 2015.07.18-13:15+0800 v1.5f (1000MHz) [C0 runni
ng][C1 sleep]
no sys signature at 00010000!
no sys signature at 00020000!

JuanManuelCash wrote:

(B)
<RealTek>?
---------------- COMMAND MODE HELP ------------------
HELP (?)                                    : Print this help message
DB <Address> <Len>
DW <Address> <Len>
EB <Address> <Value1> <Value2>...
EW <Address> <Value1> <Value2>...
CMP: CMP <dst><src><length>
IPCONFIG:<TargetAddress>
AUTOBURN: 0/1
LOADADDR: <Load Address>
J: Jump to <TargetAddress>
FLI: Flash init
FLR: FLR <dst><src><length>
FLW <dst_ROM_offset><src_RAM_addr><length_Byte> <SPI cnt#>: Write to SPI
MDIOR:  MDIOR phyid reg
MDIOW:  MDIOW phyid reg data
PHYR: PHYR <PHYID><reg>
PHYW: PHYW <PHYID><reg><data>
PHYPR: PHYPR <PHYID><page><reg>
PHYPW: PHYPW <PHYID><page><reg><data>
XMOD <addr>  [jump]
TI : timer init
T : test
HRST: Host Pcie Reset <portnum> <mdio_rst>:
HINIT: Host init bar <portnum>
HLOOP: Test Pci-E data loopback <portnum> <cnt>
EPDN: PCIE Power Down test <portnum><mode>
EMDIOR: Reg Read <portnum>
EMDIOW <portnum> <reg> <val>:
ELOOP <portnum> <start/stop>:
EINT <portnum> <loops>:
PHY_BEGIN:
ETH : startup Ethernet
CPUClk:
C1Wake : Core 1 wake Up
GBIST: GPHY BIST
GDRF: GPHY DRF BIST
BISTALL:

Hmm there is maybe a way to flash via bootloader ...

IPCONFIG:<TargetAddress>
LOADADDR: <Load Address>
J: Jump to <TargetAddress>
FLI: Flash init
FLR: FLR <dst><src><length>
FLW <dst_ROM_offset><src_RAM_addr><length_Byte> <SPI cnt#>: Write to SPI
ETH : startup Ethernet

Pictures of PCB ??
If these are already somewhere else please post the link.

If I read correctly they must be the Flash (SPI) chip near the SoC
Normally this is an 8 pin device.

Missed this in last post :
is there an firmware image downloadable on the interweb ?
maybe an SDK ??

Hi,
thanks for your feedback.
You're right, at bootloader time it is normal to don't have tcp/ip started, I was hoping that the router itself was embedding some networking services.
I have the pictures of both sides of my board but don't know how to embedd them in this thread (I don't use any dropbox to provide a url), if you provide me an e-mail address I will attach them to my mail (juanmanuel.cash@gmail.com).

Image of the firmware to be loaded is available at ampedwireless' site at support tab by selecting downloads of RTA_1900 router (firmware version is 1.45)

Regards,
jm

pictures are not needed yet, because of the bad CPU on the SoC.
This is a broken MIPS, which needs some software emulation in certain instructions.

This "thing" is (to my knowledge) based on Realtek's design with RTL8812AE/RTL8814AE wifi chipset.

Hmm,
do you have some computer ready with wireshark ??
So you can sniff data from ethernet.

I assume

ETH

will start ethernet and

ifconfig

will configure the device (maybe like ifconfig on linux)

But I have no clue with command transfer data via TFTP

Hi,
at the end I was able to revive my router. To explain in a few words a complex troubleshooting (will document it when will find time and a mean to publish picture on this thread)
- Set a serial connection to AMPED RTA1900 by soldering the motherboard and having a CP2103 usb converter at the other end (my PC). This way I got serial access at 38,400 baud rate
- connect both my PC  and dead router to a Netgear router acting as an hub. While my PC wasn't able to recognize Amped'e ethernet set to 192.168.1.6 and no activity was captured by Wireshark, Netgear router was able to recognize it as connected device. Tried IPCONFIG command with different IPs in Amped's console to make sure it was properly identified at Ethernet level.  I set a static route from my PC (192.168.1.77) to Amped router (defaults to 192.168.1.6) and viceversa
- set AUTOBURN to 1 in Amped's console and run TFTP from my pc against 192.168.1.6
- done, got the following very usefull boot log on serial console (see below)
-Thanks, regards
jm
R  E  V  I  V  E  D   ! ! !

BBoooottiinng.

DRAM Type: DDR3

               DRAM frequency: 580MHz

               DRAM Size = 128  MB

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@

@ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize

@ 0000000h 0c22017h 00000c2h 0000020h 0000017h 0000000h 0000017h 0800000h

@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName

@ 0010000h 0000080h 0001000h 0000800h 0000100h 0000010h 0000048h MX25L6405D

@

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@



---Realtek RTL8198C boot code at 2015.07.18-13:15+0800 v1.5f (1000MHz) [C0 running][C1 sleep]

no sys signature at 00010000!

no sys signature at 00020000!

no rootfs signature at 000E0000!

no rootfs signature at 000F0000!

no rootfs signature at 00130000!

no rootfs signature at 00100000!

no rootfs signature at 00110000!

no rootfs signature at 00120000!

no rootfs signature at 00140000!

no rootfs signature at 00150000!

no rootfs signature at 00160000!

no rootfs signature at 00170000!

no rootfs signature at 00180000!

no rootfs signature at 00190000!

no rootfs signature at 001A0000!

no rootfs signature at 001B0000!

no rootfs signature at 001C0000!

no rootfs signature at 001D0000!

no rootfs signature at 001E0000!

Jump to image start=0x80c00000...

decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x80003ca0
Linux version 3.10.24-svn1198 (root@wise-linux) (gcc version 4.4.7 (Realtek MSDK-4.4.7 Build 1459) ) #24 Thu Aug 18 11:44:17 CST 2016
bootconsole [early0] enabled
CPU revision is: 00019a24 (MIPS 1074Kc)
Determined physical RAM map:
memory: 08000000 @ 00000000 (usable)
Zone ranges:
  Normal   [mem 0x00000000-0x07ffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x07ffffff]
Detected 1 available secondary CPU(s)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 512kB, 8-way, linesize 32 bytes.
PERCPU: Embedded 2 pages/cpu @825e4000 s6720 r0 d26048 u32768
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8176
Kernel command line: console=ttyS0,38400 root=/dev/mtdblock1
PID hash table entries: 512 (order: -3, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 2, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 1, 32768 bytes)
Writing ErrCtl register=00000d70
Readback ErrCtl register=00000d70
Memory: 92096k/131072k available (4037k kernel code, 38976k reserved, 1410k data, 240k init, 0k highmem)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:128
CPU0: status register was 1000ff00
CPU0: status register now 1000ff00
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Calibrating delay loop... 498.89 BogoMIPS (lpj=2494464)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 2048
GOCPU revision is: 00019a24 (MIPS 1074Kc)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 512kB, 8-way, linesize 32 bytes.
Synchronize counters for CPU 1: done.
Brought up 2 CPUs
NET: Registered protocol family 16
INFO: initializing USB devices ...
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 0, 16384 bytes)
TCP bind hash table entries: 2048 (order: 0, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 512 (order: 0, 16384 bytes)
UDP-Lite hash table entries: 512 (order: 0, 16384 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse init (API version 7.22)
msgmni has been set to 179
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered (default)
io scheduler deadline registered
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x18002000 (irq = 26) is a 16550A
Realtek GPIO Driver for Flash Reload Default
SPI INIT
------------------------- Force into Single IO Mode ------------------------
|No chipID  Sft chipSize blkSize secSize pageSize sdCk opCk      chipName    |
| 0 c22017h  0h  800000h  10000h   1000h     100h   50    0   MX6405D/05E/45E|
----------------------------------------------------------------------------
SPI flash(MX6405D/05E/45E) was found at CS0, size 0x800000
Creating 3 MTD partitions on "flash_bank_1":
0x000000000000-0x000000800000 : "boot+cfg+linux+rootfs"
0x0000001f0000-0x000000800000 : "root fs"
0x000000030000-0x000000800000 : "Uimage"
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
PPP generic driver version 2.4.2
NET: Registered protocol family 24
MPPE/MPPC encryption/compression module registered
Realtek WLAN driver - version 1.6 (2013-02-21)(SVN:1224)
Adaptivity function - version 8.3.1
UPHY: 8198c ASIC u2 of u3 25M phy patch
Find Port=1 Device:Vender ID=881310ec


#######################################################
SKB_BUF_SIZE=9232 MAX_SKB_NUM=1024
#######################################################

UPHY: 8198c ASIC u2 of u3 25M phy patch
Find Port=0 Device:Vender ID=881310ec


#######################################################
SKB_BUF_SIZE=9232 MAX_SKB_NUM=1024
#######################################################


Probing RTL819X NIC-kenel stack size order[0]...
eth0 added. vid=9 Member port 0x1...
eth1 added. vid=8 Member port 0x10...
eth2 added. vid=9 Member port 0x2...
eth3 added. vid=9 Member port 0x4...
eth4 added. vid=9 Member port 0x8...
eth5 added. vid=9 Member port 0x0...
[peth0] added, mapping to [eth1]...
xhci_plat_probe
UPHY: 8198c ASIC u3 of u3 25M phy patch
UPHY: 8198c ASIC u2 of u3 25M phy patch
dump 0x430=2a0
dump 0x420=2a0
Do Warm Reset for U3
try Port Reset for U2
dwc_usb3 dwc_usb3: xHCI Host Controller
dwc_usb3 dwc_usb3: new USB bus registered, assigned bus number 1
dwc_usb3 dwc_usb3: irq 42, io mem 0x18040000
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: xHCI Host Controller
usb usb1: Manufacturer: Linux 3.10.24-svn1198 xhci-hcd
usb usb1: SerialNumber: dwc_usb3
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
dwc_usb3 dwc_usb3: xHCI Host Controller
dwc_usb3 dwc_usb3: new USB bus registered, assigned bus number 2
usb usb2: New USB device found, idVendor=1d6b, idProduct=0003
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: xHCI Host Controller
usb usb2: Manufacturer: Linux 3.10.24-svn1198 xhci-hcd
usb usb2: SerialNumber: dwc_usb3
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver usb-storage
-------8196D OTG init
b8000010=a4397908

b8000090=288f49

reg e0=44
reg e1=e9
reg e2=9a
reg e3=a1
reg e4=3
reg e5=95
reg e6=98
reg e7=0
dwc_otg: version 2.60a 22-NOV-2006
[S0] lmdev=870e6300
device_register :register pass
=>probe
  [S2]  otg_dev=8719ea20
----init hcd-----
  [S3] hcd==87718c00
DWC_otg: Using DMA mode
dwc_otg logicmodule: DWC OTG Controller
dwc_otg logicmodule: new USB bus registered, assigned bus number 3
dwc_otg logicmodule: irq 41, io mem 0xb8030000
set OTG host to high speed !
DWC_otg: Init: Port Power? op_state=1
DWC_otg: Init: Power Port (0)
usb usb3: New USB device found, idVendor=1d6b, idProduct=0002
usb usb3: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb3: Product: DWC OTG Controller
usb usb3: Manufacturer: Linux 3.10.24-svn1198 dwc_otg_hcd
usb usb3: SerialNumber: logicmodule
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 1 port detected
----enable irq-----
  [S1] dwc_otg_driver, lmdriver=8054ae24
pktgen: Packet Generator for packet performance testing. Version: 2.74
u32 classifier
nf_conntrack version 0.5.0 (1439 buckets, 5756 max)
xt_time: kernel timezone is -0000
gre: GRE over IPv4 demultiplexor driver
ip_gre: GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: cubic registered
NET: Registered protocol family 10
mip6: Mobile IPv6
ip6_tables: (C) 2000-2006 Netfilter Core Team
sit: IPv6 over IPv4 tunneling driver
ip6_gre: GRE over IPv6 tunneling driver
NET: Registered protocol family 17
l2tp_core: L2TP core driver, V2.0
Realtek FastPath:v1.03
VFS: Mounted root (squashfs filesystem) readonly on device 31:1.
Freeing unused kernel memory: 240K (80554000 - 80590000)

init started: BusyBox v1.14.4 (2016-07-28 10:26:41 CST)
Sat May 28 19:46:23 UTC 2016
killall: ftp_and_samba.sh: no process killed
killall: internet_detection_dashboard.sh: no process killed
Close Wan Interface!!
********************************************
*
* Initialize wlan0 interface
*
********************************************
********************************************
*
* Initialize wlan1 interface
*
********************************************
-----> IsVAP=wlan1 VAP=
Initialize wlan1 interface
dns_hijack_enabled = 1
Setup BRIDGE interface
------> bridge.sh br0 eth0 wlan0 wlan1 wlan0-va0 wlan0-va1 wlan0-va2 wlan0-va3 wlan1-va0 wlan1-va1 wlan1-va2 wlan1-va3
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: SIOCGIFFLAGS: No such device
brctl: bridge br0: No such device or address
Setup bridge...
device eth0 entered promiscuous mode
device eth2 entered promiscuous mode
device eth3 entered promiscuous mode
device eth4 entered promiscuous mode
device wlan0 entered promiscuous mode
PHY paratemters: RFE type 3 APA2+ALNA2+GPA2+GLNA2
0: Reg0x0: 0x73c0a7f3, Reg0x4: 0x22020002, Reg0x1C: 0x860
1: Reg0x0: 0x73c0a7f3, Reg0x4: 0x22020002, Reg0x1C: 0x187800
2: Reg0x0: 0x73c0a7f3, Reg0x4: 0x22020002, Reg0x1C: 0x187800
3: Reg0x0: 0xfbc033f2, Reg0x4: 0x22020002, Reg0x1C: 0x281800
InitPON8814AE(64): 0x1000:0x30000
REG_SYS_FUNC_EN = fbc0
[GetHwReg88XX][size PHY_REG_PG_8814Amp_Type3]
[GetHwReg88XX][PHY_REG_PG_8814Amp_Type3]
RL6302_MAC_PHY_Parameter_v054_20141124
[GetHwReg88XX][rtl8814AfwMP]
[GetHwReg88XX][size TXPWR_LMT_8814Amp_Type3]
[GetHwReg88XX][TXPWR_LMT_8814Amp_Type3]
5G RFE TYPE
TRSWITCH: RFE TYPE 3 or 5
Doing LCK: PHY_LCCalibrate_8814A
Spread Spectrum set in slot1
device wlan1 entered promiscuous mode
PHY paratemters: RFE type 3 APA2+ALNA2+GPA2+GLNA2
0: Reg0x0: 0x73c0a7f3, Reg0x4: 0x22020002, Reg0x1C: 0x860
1: Reg0x0: 0x73c0a7f3, Reg0x4: 0x22020002, Reg0x1C: 0x187800
2: Reg0x0: 0x73c0a7f3, Reg0x4: 0x22020002, Reg0x1C: 0x187800
3: Reg0x0: 0xfbc033f2, Reg0x4: 0x22020002, Reg0x1C: 0x281800
InitPON8814AE(64): 0x1000:0x30000
REG_SYS_FUNC_EN = fbc0
[GetHwReg88XX][size PHY_REG_PG_8814Amp_Type3]
[GetHwReg88XX][PHY_REG_PG_8814Amp_Type3]
RL6302_MAC_PHY_Parameter_v054_20141124
[GetHwReg88XX][rtl8814AfwMP]
[GetHwReg88XX][size TXPWR_LMT_8814Amp_Type3]
[GetHwReg88XX][TXPWR_LMT_8814Amp_Type3]
2G RFE TYPE
TRSWITCH: RFE TYPE 3 or 5
Doing LCK: PHY_LCCalibrate_8814A
Spread Spectrum set in slot0
br0: port 6(wlan1) entered forwarding state
br0: port 6(wlan1) entered forwarding state
br0: port 5(wlan0) entered forwarding state
br0: port 5(wlan0) entered forwarding state
br0: port 4(eth4) entered forwarding state
br0: port 4(eth4) entered forwarding state
br0: port 3(eth3) entered forwarding state
br0: port 3(eth3) entered forwarding state
br0: port 2(eth2) entered forwarding state
br0: port 2(eth2) entered forwarding state
br0: port 1(eth0) entered forwarding state
br0: port 1(eth0) entered forwarding state
Setup WAN interface
Close Wan Interface!!
brctl: bridge br0: Invalid argument
brctl: bridge br0: Device or resource busy
brctl: bridge br0: Device or resource busy
brctl: bridge br0: Device or resource busy
brctl: bridge br0: Device or resource busy
br0: port 6(wlan1) entered disabled state
old mode is PPPoE
arg1=pppoe arg2= arg3=
killall pppd
PHY paratemters: RFE type 3 APA2+ALNA2+GPA2+GLNA2
0: Reg0x0: 0x73c0a7f3, Reg0x4: 0x22020002, Reg0x1C: 0x29380e
1: Reg0x0: 0x73c0a7f3, Reg0x4: 0x22020002, Reg0x1C: 0x187800
2: Reg0x0: 0x73c0a7f3, Reg0x4: 0x22020002, Reg0x1C: 0x187800
3: Reg0x0: 0xfbc033f2, Reg0x4: 0x22020002, Reg0x1C: 0x281800
InitPON8814AE(64): 0x1000:0x30000
REG_SYS_FUNC_EN = fbc0
[GetHwReg88XX][size PHY_REG_PG_8814Amp_Type3]
[GetHwReg88XX][PHY_REG_PG_8814Amp_Type3]
RL6302_MAC_PHY_Parameter_v054_20141124
[GetHwReg88XX][rtl8814AfwMP]
[GetHwReg88XX][size TXPWR_LMT_8814Amp_Type3]
[GetHwReg88XX][TXPWR_LMT_8814Amp_Type3]
2G RFE TYPE
TRSWITCH: RFE TYPE 3 or 5
Doing LCK: PHY_LCCalibrate_8814A
Spread Spectrum set in slot0
br0: port 6(wlan1) entered forwarding state
br0: port 6(wlan1) entered forwarding state
Close Wan Interface!!
br0: port 5(wlan0) entered disabled state
PHY paratemters: RFE type 3 APA2+ALNA2+GPA2+GLNA2
0: Reg0x0: 0x73c0a7f3, Reg0x4: 0x22020002, Reg0x1C: 0x29380e
1: Reg0x0: 0x73c0a7f3, Reg0x4: 0x22020002, Reg0x1C: 0x187800
2: Reg0x0: 0x73c0a7f3, Reg0x4: 0x22020002, Reg0x1C: 0x187800
3: Reg0x0: 0xfbc033f2, Reg0x4: 0x22020002, Reg0x1C: 0x281800
InitPON8814AE(64): 0x1000:0x30000
REG_SYS_FUNC_EN = fbc0
[GetHwReg88XX][size PHY_REG_PG_8814Amp_Type3]
[GetHwReg88XX][PHY_REG_PG_8814Amp_Type3]
RL6302_MAC_PHY_Parameter_v054_20141124
[GetHwReg88XX][rtl8814AfwMP]
[GetHwReg88XX][size TXPWR_LMT_8814Amp_Type3]
[GetHwReg88XX][TXPWR_LMT_8814Amp_Type3]
5G RFE TYPE
TRSWITCH: RFE TYPE 3 or 5
Doing LCK: PHY_LCCalibrate_8814A
Spread Spectrum set in slot1
br0: port 5(wlan0) entered forwarding state
br0: port 5(wlan0) entered forwarding state
**********************************************************************
*                          Enable WSC_UPnP                           *
**********************************************************************
old mode is PPPoE
arg1=pppoe arg2=0 arg3=
killall pppd
**********************************************************************
*                            Enable LLTD                             *
**********************************************************************
**********************************************************************
*                       Enable GPIO Interrupt                        *
**********************************************************************
Close Wan Interface!!
killall: radiusd: no process killed
RADIUS server disable !!

WiFi Simple Config v2.16-wps2.0 (2015.05.29-06:25+0000).

loading pppoe plugin ...
RP-PPPoE plugin version 3.3 compiled against pppd 2.4.2b1
Register to wlan0
Register to wlan1
iwcontrol RegisterPID to (wlan0)
iwcontrol RegisterPID to (wlan1)
route: SIOCDELRT: No such process
**********************************************************************
*                       FREE Page,Dentries and Inodes Cache          *
**********************************************************************
IEEE 802.11f (IAPP) using interface br0 (v1.8)
MemFree:           69968 kB
Cached:             5296 kB
boa: server version Boa/0.94.14rc21
boa: server built Aug 18 2016 at 11:46:18.
boa: starting server pid=2316, port 80

Please press Enter to activate this console. cat: can't open '/etc/resolv.conf': No such file or directory

rlxlinux login:

The discussion might have continued from here.