Skip to content

Instantly share code, notes, and snippets.

@corny
Created August 4, 2016 11:17
Show Gist options
  • Save corny/3b6d751c0deaf83c10f96913bc08bc45 to your computer and use it in GitHub Desktop.
Save corny/3b6d751c0deaf83c10f96913bc08bc45 to your computer and use it in GitHub Desktop.
ER-X booting from stock firmware
===================================================================
MT7621 stage1 code 10:33:11 (ASIC)
CPU=50000000 HZ BUS=16666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL4 FB_DL: 0xc, 1/0 = 747/277 31000000
PLL3 FB_DL: 0x14, 1/0 = 619/405 51000000
PLL2 FB_DL: 0x16, 1/0 = 522/502 59000000
do DDR setting..[00320381]
Apply DDR3 Setting...(use customer AC)
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
--------------------------------------------------------------------------------
0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1
000E:| 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1
000F:| 0 0 0 0 1 1 1 1 1 1 1 1 1 1 0 0
0010:| 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0
0011:| 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
rank 0 coarse = 15
rank 0 fine = 72
B:| 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0
opt_dle value:9
DRAMC_R0DELDLY[018]=00001A1B
==================================================================
RX DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 11 7 11 9 11 6 11 6 5 9
10 | 7 10 6 9 6 9
--------------------------------------
==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =27 DQS1 = 26
==================================================================
bit DQS0 bit DQS1
0 (2~50)26 8 (1~50)25
1 (2~50)26 9 (1~52)26
2 (2~50)26 10 (1~52)26
3 (1~49)25 11 (1~50)25
4 (2~51)26 12 (2~48)25
5 (1~50)25 13 (1~52)26
6 (2~52)27 14 (1~52)26
7 (1~52)26 15 (1~52)26
==================================================================
3.dq delay value last
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 12 8 12 11 12 8 11 7 6 9
10 | 7 11 7 9 6 9
==================================================================
==================================================================
TX perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15, finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15, finish count=2
DQ loop=15, cmp_err_1 = ffff00aa
dqs_perbyte_dly.last_dqdly_pass[1]=15, finish count=1
DQ loop=14, cmp_err_1 = ffff00a8
DQ loop=13, cmp_err_1 = ffff00a0
DQ loop=12, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=12, finish count=2
byte:0, (DQS,DQ)=(9,8)
byte:1, (DQS,DQ)=(8,8)
20,data:89
[EMI] DRAMC calibration passed
===================================================================
MT7621 stage1 code done
CPU=50000000 HZ BUS=16666666 HZ
===================================================================
U-Boot 1.1.3 (Nov 2 2015 - 16:39:31)
Board: Ralink APSoC DRAM: 256 MB
relocate_code Pointer at: 8ffb0000
Config XHCI 40M PLL
Allocate 16 byte aligned buffer: 8ffe1960
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [01 DA 90 95 46]
Device found in MTK table, ID: 1da, EXT_ID: 909546
Support this Device in MTK table! 1da
select_chip
[NAND]select ecc bit:12, sparesize :112 spare_per_sector=28
Signature matched and data read!
load_fact_bbt success 2047
load fact bbt success
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=112, mtd->erasesize=131072 devinfo.iowidth=8
..
UBNT e50 13-02079-18 802AA81E80A5
UBNT BD type=e50, mac=802AA81E80A5, s/n=802AA81E80A5, mrev=18, k_idx=0
============================================
Ralink UBoot Version: 4.3.S.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Nov 2 2015 Time:16:39:31
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 880 MHZ ####
estimate memory size =256 Mbytes
#Reset_MT7530
set port isolation
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
default: 3
0
3: System Boot system code via Flash.
## Booting image at bfd40000 ...
Image Name: Linux Kernel Image
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1675773 Bytes = 1.6 MB
Load Address: 80001000
Entry Point: 803654d0
.......................... Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 803654d0) ...
## Giving linux memsize in MB, 256
Starting kernel ...
LINUX started...
THIS IS ASIC
Linux version 3.10.14-UBNT (root@edgeos-builder2) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 SMP Mon Nov 2 16:45:25 PST 2015
The CPU feqenuce set to 880 MHz
GCMP present
CPU0 revision is: 0001992f (MIPS 1004Kc)
Software DMA cache coherency
Determined physical RAM map:
memory: 10000000 @ 00000000 (usable)
Zone ranges:
Normal [mem 0x00000000-0x0fffffff]
Movable zone start for each node
Early memory node ranges
node 0: [mem 0x00000000-0x0fffffff]
Detected 3 available secondary CPU(s)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
PERCPU: Embedded 7 pages/cpu @81203000 s6656 r8192 d13824 u32768
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 65024
Kernel command line: console=ttyS1,57600n8 ubi.mtd=7 root=ubi0_0 rootfstype=ubifs rootsqimg=squashfs.img rootsqwdir=w rw
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Writing ErrCtl register=0001c055
Readback ErrCtl register=0001c055
Memory: 254860k/262144k available (3507k kernel code, 7284k reserved, 1010k data, 212k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 577.53 BogoMIPS (lpj=1155072)
pid_max: default: 32768 minimum: 301
Security Framework initialized
Mount-cache hash table entries: 512
launch: starting cpu1
launch: cpu1 gone!
CPU1 revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Synchronize counters for CPU 1: done.
launch: starting cpu2
launch: cpu2 gone!
CPU2 revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Synchronize counters for CPU 2: done.
launch: starting cpu3
launch: cpu3 gone!
CPU3 revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Synchronize counters for CPU 3: done.
Brought up 4 CPUs
devtmpfs: initialized
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
4 CPUs re-calibrate udelay(lpj = 1167360)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering unionfs 2.5.13 (for 3.10.34)
aufs 3.10.x-20140915
msgmni has been set to 497
io scheduler noop registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A
serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A
Ralink gpio driver initialized
i2cdrv_major = 218
loop: module loaded
flash manufacture id: 1c, device id 70 15
EN25QH16(1c 70151c70) (2048 Kbytes)
mtd .name = raspi, .size = 0x00200000 (2M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 1 MTD partitions on "raspi":
0x000000000000-0x000000080000 : "SPI_FLASH"
MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
Allocate 16 byte aligned buffer: 804b0430
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [01 DA 90 95 46, 00909546]
Device found in MTK table, ID: 1da, EXT_ID: 909546
Support this Device in MTK table! 1da
NAND device: Manufacturer ID: 0x01, Chip ID: 0xda (AMD/Spansion NAND 256MiB 3,3V 8-bit), 256MiB, page size: 2048, OOB size: 112
[NAND]select ecc bit:12, sparesize :112 spare_per_sector=28
Scanning device for bad blocks
Signature matched and data read!
load_fact_bbt success 2047
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Creating 7 MTD partitions on "MT7621-NAND":
0x000000000000-0x00000ff80000 : "ALL"
0x000000000000-0x000000080000 : "Bootloader"
0x000000080000-0x0000000e0000 : "Config"
0x0000000e0000-0x000000140000 : "eeprom"
0x000000140000-0x000000440000 : "Kernel"
0x000000440000-0x000000740000 : "Kernel2"
0x000000740000-0x00000ff00000 : "RootFS"
[mtk_nand] probe successfully!
UBNT BD mac 802aa81e80a5 kidx 0 mrev 18 serial 802AA81E80A5 type e50
rdm_major = 253
GMAC1_MAC_ADRH -- : 0x0000802a
GMAC1_MAC_ADRL -- : 0xa81e80a5
Ralink APSoC Ethernet Driver Initilization. v3.1 512 rx/tx descriptors allocated, mtu = 1500!
GMAC1_MAC_ADRH -- : 0x0000802a
GMAC1_MAC_ADRL -- : 0xa81e80a5
PROC INIT OK!
Ralink I2C Init
TCP: cubic registered
NET: Registered protocol family 17
NET: Registered protocol family 15
UBI: attaching mtd7 to ubi0
UBI: scanning is finished
UBI: attached mtd7 (name "RootFS", size 247 MiB) to ubi0
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 1982, bad PEBs: 0, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 72129621
UBI: available PEBs: 0, total reserved PEBs: 1982, PEBs reserved for bad PEB handling: 40
UBI: background thread "ubi_bgt0d" started, PID 51
UBIFS: background thread "ubifs_bgt0_0" started, PID 52
UBIFS: mounted UBI device 0, volume 0, name "troot"
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 244428800 bytes (233 MiB, 1925 LEBs), journal size 12189696 bytes (11 MiB, 96 LEBs)
UBIFS: reserved for root: 4952683 bytes (4836 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID 913D4C21-EA24-4122-B8D5-D09B7C8F0D89, small LPT model
VFS: Mounted root (aufs filesystem) on device 0:12.
devtmpfs: mounted
Freeing unused kernel memory: 212K (8046b000 - 804a0000)
Algorithmics/MIPS FPU Emulator v1.5
INIT: version 2.88 booting
mkdir: can't create directory '/dev/shm/network': No such file or directory
INIT: Entering runlevel: 2
Unable to open file: /dev/tpm0
can't open any entropy source
Maybe RNG device modules are not loaded
[ ok ] Starting routing daemon: rib.
[ ok ] Starting EdgeOS router: migrate rl-system configure.
Welcome to EdgeOS ubnt ttyS1
By logging in, accessing, or using the Ubiquiti product, you
acknowledge that you have read and understood the Ubiquiti
License Agreement (available in the Web UI at, by default,
http://192.168.1.1) and agree to be bound by its terms.
ubnt login:
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment