Dieses mal zerlege ich einen Hornbach Smarthome Gateway und zeige euch alle Details,
die ich dazu technisch finden konnte.
Ziel dieses Projekts sollte sein die Firmware so zu modifizieren, dass ein lokales Webinterface
ohne die Hornbach-App möglich ist und weitere Geräte, die nicht integriert sind anzusprechen.
Starten wir mit ein paar Bildern: Hier zu sehen ist die Draufsicht des Gateways mit den Statusanzeigen für:
Power
Internet
Wifi
Z-Wave
Cloud
Zigbee
Bluetooth

In der Rückansicht sind ein LAN-Anschluss, Power und ein USB Port zu erkennen:

An der Gehäuseunterseite befindet sich die Seriennummer, die MAC-Addresse der LAN-Schnittstelle und der ID-Code, der für die Registrierung benötigt wird.

Das Gehäuse lässt sich mit einem Schraubenzieher leicht öffnen. Nach dem öffnen den Deckel vorsichtig anheben, damit die Antennen nicht abreißen. Anschließend sieht das Innenleben wie folgt aus:
Im Netzwerk antwortet das Gerät nur auf einen Ping und es ist lt. NMap-Portscan kein offener Port zu finden.
In der Rückansicht sind ein LAN-Anschluss, Power und ein USB Port zu erkennen:
An der Gehäuseunterseite befindet sich die Seriennummer, die MAC-Addresse der LAN-Schnittstelle und der ID-Code, der für die Registrierung benötigt wird.
(Wurde der ID-Code bereits bei einem anderen Hornbach Smarthome-Konto aktiviert, so kann dieser für eine weitere Person nicht hinzugefügt werden ehe der Vorbesitzer dieses Gateway aus seiner Smarthome-Konfiguration löscht oder ein Hornbach Support Mitarbeiter diesen Code aus dem Konto des Vorbesitzers löscht.)
Zudem enthält das Gateway einen QR-Code, der die MAC-Addresse und den ID-Code als Text enthält: "m=MM:MM:MM:MM:MM:MM;ID=AB1-CDE"
Das Gehäuse lässt sich mit einem Schraubenzieher leicht öffnen. Nach dem öffnen den Deckel vorsichtig anheben, damit die Antennen nicht abreißen. Anschließend sieht das Innenleben wie folgt aus:
Im Netzwerk antwortet das Gerät nur auf einen Ping und es ist lt. NMap-Portscan kein offener Port zu finden.
Aus der Seriellen Konsole lassen sich im Standard folgende Information am UART-Port (57600 Baud, DataBits: 8, StopBits: 1) auslesen:
[0D]===================================================================
[0D] [09][09]MT7621 stage1 code, 13:15:05 (ASIC)
[0D] [09][09]CPU=50000000 HZ BUS=16666666 HZ
[0D]==================================================================
[0D]Change MPLL source from XTAL to CR...
[0D]do MEMPLL setting..
[0D]MEMPLL Config : 0x11100000
[0D]3PLL mode + External loopback
[0D]=== XTAL-40Mhz === DDR-1200Mhz ===
[0D]PLL4 FB_DL: 0x13, 1/0 = 703/321 4D000000
[0D]PLL2 FB_DL: 0x18, 1/0 = 591/433 61000000
[0D]PLL3 FB_DL: 0x18, 1/0 = 623/401 61000000
[0D]do DDR setting..[00320381]
[0D]Apply DDR3 Setting...(use customer AC)
[0D] 0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
[0D] --------------------------------------------------------------------------------
[0D]0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1
[0D]000E:| 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1
[0D]000F:| 0 0 0 1 1 1 1 1 1 1 1 1 0 0 0 0
[0D]0010:| 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0
[0D]0011:| 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]001D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
[0D]rank 0 coarse = 15
[0D]rank 0 fine = 56
[0D]B:| 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0
[0D]opt_dle value:11
[0D]DRAMC_R0DELDLY[018]=00001C1C
[0D]==================================================================
[0D][09][09]RX[09]DQS perbit delay software calibration
[0D]==================================================================
[0D]1.0-15 bit dq delay value
[0D]==================================================================
[0D]bit| 0 1 2 3 4 5 6 7 8 9
[0D]--------------------------------------
[0D]0 | 11 7 13 9 13 7 13 5 3 11
[0D]10 | 6 12 8 11 6 12
[0D]--------------------------------------
[0D]
[0D]==================================================================
[0D]2.dqs window
[0D]x=pass dqs delay value (min~max)center
[0D]y=0-7bit DQ of every group
[0D]input delay:DQS0 =28 DQS1 = 28
[0D]==================================================================
[0D]bit[09]DQS0[09] bit DQS1
[0D]0 (1~53)27 8 (1~53)27
[0D]1 (1~50)25 9 (1~54)27
[0D]2 (1~55)28 10 (1~55)28
[0D]3 (1~55)28 11 (1~51)26
[0D]4 (1~55)28 12 (1~56)28
[0D]5 (1~53)27 13 (1~52)26
[0D]6 (1~54)27 14 (1~54)27
[0D]7 (1~56)28 15 (1~55)28
[0D]==================================================================
[0D]3.dq delay value last
[0D]==================================================================
[0D]bit| 0 1 2 3 4 5 6 7 8 9
[0D]--------------------------------------
[0D]0 | 12 10 13 9 13 8 14 5 4 12
[0D]10 | 6 14 8 13 7 12
[0D]==================================================================
[0D]==================================================================
[0D] TX perbyte calibration
[0D]==================================================================
[0D]DQS loop = 15, cmp_err_1 = ffffba55
[0D]DQS loop = 14, cmp_err_1 = ffff0a55
[0D]DQS loop = 13, cmp_err_1 = ffff0a01
[0D]DQS loop = 12, cmp_err_1 = ffff0001
[0D]dqs_perbyte_dly.last_dqsdly_pass[1]=12, finish count=1
[0D]DQS loop = 11, cmp_err_1 = ffff0001
[0D]DQS loop = 10, cmp_err_1 = ffff0000
[0D]dqs_perbyte_dly.last_dqsdly_pass[0]=10, finish count=2
[0D]DQ loop=15, cmp_err_1 = ffff05aa
[0D]DQ loop=14, cmp_err_1 = ffff01aa
[0D]DQ loop=13, cmp_err_1 = ffff01aa
[0D]DQ loop=12, cmp_err_1 = ffff00aa
[0D]dqs_perbyte_dly.last_dqdly_pass[1]=12, finish count=1
[0D]DQ loop=11, cmp_err_1 = ffff0008
[0D]DQ loop=10, cmp_err_1 = ffff0000
[0D]dqs_perbyte_dly.last_dqdly_pass[0]=10, finish count=2
[0D]byte:0, (DQS,DQ)=(8,8)
[0D]byte:1, (DQS,DQ)=(8,8)
[0D]20,data:88
[0D][EMI] DRAMC calibration passed
[0D][0D]
[0D]===================================================================
[0D] [09][09]MT7621 stage1 code done
[0D] [09][09]CPU=50000000 HZ BUS=16666666 HZ
[0D]===================================================================
[0D]U-Boot 1.1.3 (Oct 31 2018 - 16:51:14)[0A]
[0D]Board: Ralink APSoC DRAM: 256 MB
relocate_code Pointer at: 8ffac000[0A]
[0D]Config XHCI 40M PLL
Allocate 16 byte aligned buffer: 8ffe0df0
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [C2 F1 80 95 02]
Device not found, ID: c2f1
Not Support this Device!
[0D]chip_mode=00000001
Support this Device in MTK table! c2f1
[0D]select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,[09]mtd->erasesize=131072 devinfo.iowidth=8
Env addr : 0x80000
..============================================
Ralink UBoot Version: 4.2.1.0
--------------------------------------------
ASIC MT7621AS (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Oct 31 2018 Time:16:51:14
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768 [0A]
[0D] ##### The CPU freq = 880 MHZ ####
estimate memory size =256 Mbytes[0A]
[0D]Reset switch ...
#Reset_MT7530[0A]
[0D]Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
STANDALONE_LOAD_ADDR is 0xa0600000
..Example expects ABI version 2
Actual U-Boot ABI version 2[0A]
[0D][1B][31m******************************************
Uboot StandAlone Entry
******************************************[1B][0m
0, cmd
1, 0x0000000D
cmd : 0x0000000D[0A]
[0D][08][08][08] 0
Example expects ABI version 2
Actual U-Boot ABI version 2[0A]
[0D][1B][31m******************************************
Uboot StandAlone Entry
******************************************[1B][0m
0, boot
Flash Sector Number : 522.
[0D][0D]***************************************************
[0D] Sercomm Boot Version 2.00.1
[0D][0D]***************************************************
[0D]Entering Firmware : Everything is OK.
[0D]=================================================
Check image validation:
Image1 Header Magic Number --> OK
Image2 Header Magic Number --> Failed
Image1 Header Checksum --> OK
Image1 Data Checksum --> .......................OK[0A]
[0D]Image1: OK Image2: Broken
..Done![0A]
[0D]=================================================
..kernel addr :0xbfd40000 [0A]
[0D]flash base: 0xbfc00000, kernel addr :0xbfd40000, bootloader size: 0x80000, config size 0x80000, fac size : 0x40000
..Erasing NAND Flash...
.Writing to NAND Flash...
done
3: System Boot system code via Flash.
## Booting image at bfd40000 ...
Image Name: OpenWrt Linux-3.10.14
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1477721 Bytes = 1.4 MB
Load Address: 80001000
Entry Point: 80001000
....................... Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80001000) ...
## Giving linux memsize in MB, 256[0A]
[0D]Starting kernel ...[0A]
[0D]
LINUX started...
THIS IS ASIC
SDK 5.0.S.0
[ 0.000000] Linux version 3.10.14 (core3@ROCMAIN) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #18 SMP Fri Oct 30 11:04:49 UTC 2020
[ 0.000000]
[ 0.000000] The CPU feqenuce set to 880 MHz
[ 0.000000] GCMP present
[ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[ 0.000000] Software DMA cache coherency
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 10000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] DMA [mem 0x00000000-0x0bffffff]
[ 0.000000] Normal [mem 0x0c000000-0x0fffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x0fffffff]
[ 0.000000] avail: cpu2 is not ready
[ 0.000000] avail: cpu3 is not ready
[ 0.000000] Detected 1 available secondary CPU(s)
[ 0.000000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[ 0.000000] PERCPU: Embedded 7 pages/cpu @8c204000 s6464 r8192 d14016 u32768
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 65024
[ 0.000000] Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock5 rootfstype=squashfs,jffs2
[ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Writing ErrCtl register=0002424b
[ 0.000000] Readback ErrCtl register=0002424b
[ 0.000000] Memory: 255284k/262144k available (3257k kernel code, 6860k reserved, 835k data, 252k init, 0k highmem)
[ 0.000000] Hierarchical RCU implementation.
[ 0.000000] [09]RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[ 0.000000] NR_IRQS:128
[ 0.000000] console [ttyS1] enabled
[ 0.132000] Calibrating delay loop... 562.17 BogoMIPS (lpj=1124352)
[ 0.164000] pid_max: default: 32768 minimum: 301
[ 0.168000] Mount-cache hash table entries: 512
[ 0.172000] launch: starting cpu1
[ 0.176000] launch: cpu1 gone!
[ 0.176000] CPU1 revision is: 0001992f (MIPS 1004Kc)
[ 0.176000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[ 0.176000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.176000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[ 0.208000] Synchronize counters for CPU 1: done.
[ 0.216000] Brought up 2 CPUs
[ 0.220000] NET: Registered protocol family 16
[ 0.512000] release PCIe RST: RALINK_RSTCTRL = 7000000
[ 0.516000] PCIE PHY initialize
[ 0.520000] ***** Xtal 40MHz *****
[ 0.524000] start MT7621 PCIe register access
[ 1.100000] RALINK_RSTCTRL = 7000000
[ 1.104000] RALINK_CLKCFG1 = 77ffeff8
[ 1.108000]
[ 1.108000] *************** MT7621 PCIe RC mode *************
[ 1.588000] PCIE0 no card, disable it(RST&CLK)
[ 1.592000] pcie_link status = 0x6
[ 1.596000] RALINK_RSTCTRL= 6000000
[ 1.600000] *** Configure Device number setting of Virtual PCI-PCI bridge ***
[ 1.604000] RALINK_PCI_PCICFG_ADDR = 21007f2 -> 10207f2
[ 1.608000] PCIE1 enabled
[ 1.612000] PCIE2 enabled
[ 1.616000] interrupt enable status: 600000
[ 1.620000] Port 1 N_FTS = 1b105000
[ 1.624000] Port 0 N_FTS = 1b105000
[ 1.628000] config reg done
[ 1.632000] init_rt2880pci done
[ 1.656000] bio: create slab <bio-0> at 0
[ 1.660000] usbcore: registered new interface driver usbfs
[ 1.664000] usbcore: registered new interface driver hub
[ 1.668000] usbcore: registered new device driver usb
[ 1.672000] PCI host bridge to bus 0000:00
[ 1.676000] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[ 1.680000] pci_bus 0000:00: root bus resource [io 0x1e160000-0x1e16ffff]
[ 1.684000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 1.688000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 1.704000] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 1.720000] pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
[ 1.732000] pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000)
[ 1.748000] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[ 1.760000] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref]
[ 1.776000] pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff]
[ 1.788000] pci 0000:00:00.0: BAR 1: assigned [mem 0x60300000-0x6030ffff]
[ 1.800000] pci 0000:00:01.0: BAR 1: assigned [mem 0x60310000-0x6031ffff]
[ 1.816000] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
[ 1.828000] pci 0000:01:00.0: BAR 6: assigned [mem 0x60100000-0x6010ffff pref]
[ 1.844000] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 1.852000] pci 0000:00:00.0: bridge window [mem 0x60000000-0x600fffff]
[ 1.868000] pci 0000:00:00.0: bridge window [mem 0x60100000-0x601fffff pref]
[ 1.880000] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff]
[ 1.896000] pci 0000:00:01.0: PCI bridge to [bus 02]
[ 1.904000] pci 0000:00:01.0: bridge window [mem 0x60200000-0x602fffff]
[ 1.920000] PCI: Enabling device 0000:00:00.0 (0004 -> 0006)
[ 1.928000] PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
[ 1.940000] BAR0 at slot 0 = 0
[ 1.948000] bus=0x0, slot = 0x0
[ 1.952000] res[0]->start = 0
[ 1.960000] res[0]->end = 0
[ 1.964000] res[1]->start = 60300000
[ 1.972000] res[1]->end = 6030ffff
[ 1.980000] res[2]->start = 0
[ 1.984000] res[2]->end = 0
[ 1.988000] res[3]->start = 0
[ 1.996000] res[3]->end = 0
[ 2.000000] res[4]->start = 0
[ 2.008000] res[4]->end = 0
[ 2.012000] res[5]->start = 0
[ 2.020000] res[5]->end = 0
[ 2.024000] BAR0 at slot 1 = 0
[ 2.028000] bus=0x0, slot = 0x1
[ 2.036000] res[0]->start = 0
[ 2.040000] res[0]->end = 0
[ 2.048000] res[1]->start = 60310000
[ 2.056000] res[1]->end = 6031ffff
[ 2.060000] res[2]->start = 0
[ 2.068000] res[2]->end = 0
[ 2.072000] res[3]->start = 0
[ 2.080000] res[3]->end = 0
[ 2.084000] res[4]->start = 0
[ 2.092000] res[4]->end = 0
[ 2.096000] res[5]->start = 0
[ 2.100000] res[5]->end = 0
[ 2.108000] bus=0x1, slot = 0x0, irq=0x18
[ 2.116000] res[0]->start = 60000000
[ 2.124000] res[0]->end = 600fffff
[ 2.128000] res[1]->start = 0
[ 2.136000] res[1]->end = 0
[ 2.140000] res[2]->start = 0
[ 2.148000] res[2]->end = 0
[ 2.152000] res[3]->start = 0
[ 2.156000] res[3]->end = 0
[ 2.164000] res[4]->start = 0
[ 2.168000] res[4]->end = 0
[ 2.176000] res[5]->start = 0
[ 2.180000] res[5]->end = 0
[ 2.184000] bus=0x2, slot = 0x1, irq=0x19
[ 2.192000] res[0]->start = 60200000
[ 2.200000] res[0]->end = 602fffff
[ 2.208000] res[1]->start = 0
[ 2.212000] res[1]->end = 0
[ 2.220000] res[2]->start = 0
[ 2.224000] res[2]->end = 0
[ 2.232000] res[3]->start = 0
[ 2.236000] res[3]->end = 0
[ 2.240000] res[4]->start = 0
[ 2.248000] res[4]->end = 0
[ 2.252000] res[5]->start = 0
[ 2.260000] res[5]->end = 0
[ 2.264000] Bluetooth: Core ver 2.16
[ 2.268000] NET: Registered protocol family 31
[ 2.272000] Bluetooth: HCI device and connection manager initialized
[ 2.276000] Bluetooth: HCI socket layer initialized
[ 2.280000] Bluetooth: L2CAP socket layer initialized
[ 2.284000] Bluetooth: SCO socket layer initialized
[ 2.288000] Switching to clocksource MIPS
[ 2.292000] NET: Registered protocol family 2
[ 2.300000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[ 2.316000] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[ 2.328000] TCP: Hash tables configured (established 2048 bind 2048)
[ 2.340000] TCP: reno registered
[ 2.348000] UDP hash table entries: 256 (order: 1, 8192 bytes)
[ 2.360000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[ 2.372000] NET: Registered protocol family 1
[ 2.468000] 4 CPUs re-calibrate udelay(lpj = 1167360)
[ 2.480000] ======= sercomm_button_init =======
[ 2.488000] mt7621_register_gpio_keys_polled start!
[ 2.500000] mt7621_register_gpio_keys_polled ends!
[ 2.512000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 2.524000] jffs2: version 2.2. (NAND) (SUMMARY) (ZLIB) (LZO) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 2.544000] io scheduler noop registered (default)
[ 2.556000] ======== sercomm_gpio_init ========
[ 2.564000] ===== sercomm_gpio_ioctl_init =====
[ 2.572000] ====== sercomm_led_ioctl_init =====
[ 2.588000] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[ 2.600000] serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A
[ 2.616000] serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A
[ 2.628000] serial8250: ttyS2 at MMIO 0x1e000e00 (irq = 28) is a 16550A
[ 2.644000] MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
[ 2.656000] Allocate 16 byte aligned buffer: 80451d50
[ 2.668000] Enable NFI Clock
[ 2.672000] # MTK NAND # : Use HW ECC
[ 2.680000] NAND ID [C2 F1 80 95 02, 00809502]
[ 2.688000] Device not found, ID: c2f1
[ 2.696000] Not Support this Device! [0D]
[ 2.704000] chip_mode=00000001
[ 2.712000] Support this Device in MTK table! c2f1 [0D]
[ 2.720000] NAND device: Manufacturer ID: 0xc2, Chip ID: 0xf1 (Macronix NAND 128MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 64
[ 2.744000] [NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
[ 2.756000] Scanning device for bad blocks
[ 3.008000] Signature matched and data read!
[ 3.016000] load_fact_bbt success 1023
[ 3.024000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 3.044000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 3.064000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 3.084000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 3.104000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 3.124000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 3.144000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 3.164000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 3.184000] Creating 10 MTD partitions on "MT7621-NAND":
[ 3.192000] 0x000000000000-0x000007f80000 : "ALL"
[ 3.204000] 0x000000000000-0x000000080000 : "Bootloader"
[ 3.216000] 0x000000080000-0x000000100000 : "Config"
[ 3.228000] 0x000000100000-0x000000140000 : "Factory"
[ 3.236000] 0x000000140000-0x000001540000 : "Firmware1"
[ 3.252000] 0x0000002a8c99-0x000001540000 : "rootfs"
[ 3.260000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[ 3.296000] mtd: partition "rootfs_data" created automatically, ofs=0xa40000, len=0xb00000
[ 3.312000] 0x000000a40000-0x000001540000 : "rootfs_data"
[ 3.324000] 0x000001540000-0x000002940000 : "Firmware2"
[ 3.336000] 0x000002940000-0x000002a40000 : "user_storage"
[ 3.348000] 0x000002a40000-0x000003a40000 : "data"
[ 3.360000] 0x000003a40000-0x000006c40000 : "storage"
[ 3.368000] 0x000006c40000-0x000007f80000 : "backup"
[ 3.380000] [mtk_nand] probe successfully!
[ 3.388000] rootfs = 2a8c99 to a40000
[ 3.396000] rdm_major = 253
[ 3.404000] GMAC1_MAC_ADRH -- : 0x0000xxxx
[ 3.412000] GMAC1_MAC_ADRL -- : 0xdeexxxx
[ 3.420000] Ralink APSoC Ethernet Driver Initilization. v3.1 1024 rx/tx descriptors allocated, mtu = 1500!
[ 3.440000] GMAC1_MAC_ADRH -- : 0x0000xxxx
[ 3.448000] GMAC1_MAC_ADRL -- : 0xdeexxxx
[ 3.456000] PROC INIT OK!
[ 3.460000] *****run project phy.
[ 3.476000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.492000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.508000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.524000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.540000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.556000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.572000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.588000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.604000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.620000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.652000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.668000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.684000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.700000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.716000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.732000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.748000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.764000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.780000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.796000] FM_OUT value: u4FmOut = 0(0x00000000)
[ 3.924000] xhci-hcd xhci-hcd: xHCI Host Controller
[ 3.932000] xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 1
[ 3.948000] xhci-hcd xhci-hcd: irq 22, io mem 0x1e1c0000
[ 3.960000] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[ 3.972000] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 3.988000] usb usb1: Product: xHCI Host Controller
[ 3.996000] usb usb1: Manufacturer: Linux 3.10.14 xhci-hcd
[ 4.008000] usb usb1: SerialNumber: xhci-hcd
[ 4.016000] hub 1-0:1.0: USB hub found
[ 4.024000] hub 1-0:1.0: 2 ports detected
[ 4.032000] xhci-hcd xhci-hcd: xHCI Host Controller
[ 4.044000] xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 2
[ 4.056000] usb usb2: New USB device found, idVendor=1d6b, idProduct=0003
[ 4.072000] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 4.084000] usb usb2: Product: xHCI Host Controller
[ 4.096000] usb usb2: Manufacturer: Linux 3.10.14 xhci-hcd
[ 4.104000] usb usb2: SerialNumber: xhci-hcd
[ 4.116000] hub 2-0:1.0: USB hub found
[ 4.120000] hub 2-0:1.0: 1 port detected
[ 4.132000] usbcore: registered new interface driver usbserial
[ 4.144000] usbcore: registered new interface driver usbserial_generic
[ 4.156000] usbserial: USB Serial support registered for generic
[ 4.168000] usbcore: registered new interface driver cp210x
[ 4.180000] usbserial: USB Serial support registered for cp210x
[ 4.192000] usbcore: registered new interface driver usb_debug
[ 4.204000] usbserial: USB Serial support registered for debug
[ 4.216000] usbcore: registered new interface driver ftdi_sio
[ 4.228000] usbserial: USB Serial support registered for FTDI USB Serial Device
[ 4.240000] usbcore: registered new interface driver pl2303
[ 4.252000] usbserial: USB Serial support registered for pl2303
[ 4.264000] TCP: cubic registered
[ 4.272000] NET: Registered protocol family 10
[ 4.280000] NET: Registered protocol family 17
[ 4.292000] Bluetooth: RFCOMM TTY layer initialized
[ 4.300000] Bluetooth: RFCOMM socket layer initialized
[ 4.312000] Bluetooth: RFCOMM ver 1.11
[ 4.320000] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[ 4.328000] Bluetooth: BNEP filters: protocol multicast
[ 4.340000] Bluetooth: BNEP socket layer initialized
[ 4.348000] 8021q: 802.1Q VLAN Support v1.8
[ 4.364000] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[ 4.380000] Freeing unused kernel memory: 252K (80401000 - 80440000)
[ 4.420000] usb 1-2: new high-speed USB device number 2 using xhci-hcd
[ 4.452000] usb 1-2: New USB device found, idVendor=0e8d, idProduct=7662
[ 4.464000] usb 1-2: New USB device strings: Mfr=4, Product=5, SerialNumber=6
[ 4.480000] usb 1-2: Product: Wireless
[ 4.488000] usb 1-2: Manufacturer: MediaTek Inc.
[ 4.496000] usb 1-2: SerialNumber: 000000000
[ 4.504000] add_ep parameters, dev_speed 3, is_in 1, isTT 0, ep_type 3, maxp 16, interval 1, burst 0, mult 0, ep 0x8ff8ba80, ep_ctx 0xbbc10080, sch_ep 0x8f413e80
[ 4.536000] add_ep parameters, dev_speed 3, is_in 1, isTT 0, ep_type 2, maxp 512, interval 1, burst 0, mult 0, ep 0x8ff8baac, ep_ctx 0xbbc100c0, sch_ep 0x8f413c00
[ 4.564000] add_ep parameters, dev_speed 3, is_in 0, isTT 0, ep_type 2, maxp 512, interval 1, burst 0, mult 0, ep 0x8ff8bad8, ep_ctx 0xbbc100a0, sch_ep 0x8f413980
[ 4.592000] add_ep parameters, dev_speed 3, is_in 1, isTT 0, ep_type 1, maxp 0, interval 8, burst 0, mult 0, ep 0x8ffff280, ep_ctx 0xbbc10100, sch_ep 0x8f413780
[ 4.620000] add_ep parameters, dev_speed 3, is_in 0, isTT 0, ep_type 1, maxp 0, interval 8, burst 0, mult 0, ep 0x8ffff2ac, ep_ctx 0xbbc100e0, sch_ep 0x8f413500
[ 4.652000]
[ 4.652000]
[ 4.652000] Unsupported Device!
[ 4.652000] Vendor=e8d ProdID=7662
[ 4.652000] Manufacturer=MediaTek Inc. Product=Wireless
[ 4.652000]
procd: Console is alive
[ 5.992000] Button Hotplug driver version 0.4.1
[ 6.024000] SCSI subsystem initialized
[ 6.040000] usbcore: registered new interface driver usb-storage
procd: - preinit -
[ 6.528000] 7F:FFFFFF8F:FFFFFFDF:FFFFFFE2:15:FFFFFF8B
[ 6.540000] Raeth v3.1 (Tasklet)
[ 6.552000] phy_free_head is 0x1bc1e000!!!
[ 6.560000] phy_free_tail_phy is 0x1bc1fff0!!!
[ 6.568000] txd_pool=bbc20000 phy_txd_pool=1BC20000
[ 6.576000] ei_local->skb_free start address is 0x8fe8a6dc.
[ 6.588000] free_txd: 1bc20010, ei_local->cpu_ptr: 1BC20000
[ 6.600000] POOL HEAD_PTR | DMA_PTR | CPU_PTR
[ 6.608000] ----------------+---------+--------
[ 6.620000] 0xbbc20000 0x1BC20000 0x1BC20000
[ 6.628000]
[ 6.628000] phy_qrx_ring = 0x1bc07000, qrx_ring = 0xbbc07000
[ 6.644000]
[ 6.644000] phy_rx_ring0 = 0x1bc28000, rx_ring0 = 0xbbc28000
[ 6.680000] MT7530 Reset Completed!!
[ 6.688000] change HW-TRAP to 0x17ccf
[ 6.696000] set LAN/WAN LLLLW
[ 6.708000] GMAC1_MAC_ADRH -- : 0x0000xxxx
[ 6.716000] GMAC1_MAC_ADRL -- : 0xdeexxxx
[ 6.728000] CDMA_CSG_CFG = 81000000
[ 6.736000] GDMA1_FWD_CFG = 20710000
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 9.308000] block: attempting to load /etc/config/fstab
[ 9.368000] block: extroot: not configured
jffs2 is ready
jffs2 is ready
[ 9.472000] jffs2: Empty flash at 0x001a097c ends at 0x001a1000
[ 9.640000] jffs2: notice: (329) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 12 of xref (0 dead, 1 orphan) found.
[ 10.024000] block: attempting to load /etc/config/fstab
[ 10.036000] block: ext
Die Fett markierten Bereiche werden im Laufe der Tage noch genauer getestet, ob hier eine
Serielle Konsole und der Debug über angeschlossene Tastatur aktiviert werden kann.