Set info->start[0]=BFC00000
flash_protect ON: from 0xBFC00000 to 0xBFC24E27
protect on 0
protect on 1
protect on 2
flash_protect ON: from 0xBFC30000 to 0xBFC3FFFF
protect on 3
============================================
Ralink UBoot Version: 3.1
--------------------------------------------
ASIC 3052_MP1 (MAC to GigaMAC Mode)
Product Name: ESR-9752-SC
DRAM COMPONENT: 128Mbits
DRAM BUS: 16BIT
Total memory: 16 MBytes
Flash: 4 MBytes
Date:Nov 25 2008 Time:10:57:31
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384
##### The CPU freq = 384 MHZ ####
SDRAM bus set to 16 bit
SDRAM size =16 Mbytes
SDRAM CAS = 3(d1835272)
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
3: System Boot system code via Flash.
## Booting image at bfc50000 ...
Image Name: Linux Kernel Image
Created: 2009-06-09 13:04:56 UTC
System Control Status = 0x21440000
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1031086 Bytes = 1006.9 kB
Load Address: 80000000
Entry Point: 80220000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80220000) ...
## Giving linux memsize in MB, 16
KernelApp/Ramdisk Ver:1.5.4.395 Date:2009/06/09
console> cat: can't open '/apps/lib/modules/2.6.21/modulesApp.dep': No such file or directory
ln: /sbin/./apps_init: File exists
The 'console' is kind of a dud, it doesn't seem to do any thing useful.
Hitting command line mode is somewhat more useful:
Quote:
RT3052 # help
? - alias for 'help'
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cp - memory copy
echo - echo args to console
erase - erase FLASH memory
help - print online help
loopback - Ralink eth loopback test !!
md - memory display
mdio - Ralink PHY register R/W command !!
mm - memory modify (auto-incrementing)
mw - memory write (fill)
nm - memory modify (constant address)
printenv- print environment variables
protect - enable or disable FLASH write protection
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
spicmd - read/write data from/to eeprom or vtss
tftpboot- boot image via network using TFTP protocol
version - print monitor version
RT3052 #
Joined: 06 Jun 2006 Posts: 7492 Location: Dresden, Germany
Posted: Mon Jul 13, 2009 23:02 Post subject:
a complete hardware spec would be usefull. i have some senao devices here and some are really strange(dual cpu rt3052 for instance)
if its a plain rt3052 router with 4 mb flash and 16 mb ram it can be supported if you are able to install it with serial comsole. senao has a firmware encryption which i dont know _________________ "So you tried to use the computer and it started smoking? Sounds like a Mac to me.." - Louis Rossmann https://www.youtube.com/watch?v=eL_5YDRWqGE&t=60s
#
# Machine selection
#
CONFIG_ZONE_DMA=y
# CONFIG_RALINK_RT2880 is not set
CONFIG_RALINK_RT3052=y
CONFIG_RT3052_ASIC=y
CONFIG_RALINK_RT3052_MP=y
# CONFIG_RALINK_RT3052_MP2 is not set
CONFIG_FLASH_REMAP_NEED=y
# CONFIG_RT2880_DRAM_8M is not set
CONFIG_RT2880_DRAM_16M=y
# CONFIG_RT2880_DRAM_32M is not set
# CONFIG_RT2880_DRAM_64M is not set
# CONFIG_RT2880_FLASH_2M is not set
CONFIG_RT2880_FLASH_4M=y
# CONFIG_RT2880_FLASH_8M is not set
# CONFIG_RT2880_FLASH_16M is not set
CONFIG_RALINK_RAM_SIZE=16
CONFIG_MTD_PHYSMAP_START=0xBFC00000
CONFIG_MTD_PHYSMAP_LEN=0x400000
CONFIG_MTD_PHYSMAP_BUSWIDTH=2
CONFIG_RT2880_ROOTFS_IN_RAM=y
# CONFIG_RT2880_ROOTFS_IN_FLASH is not set
CONFIG_BLK_DEV_RAM_SIZE=0
CONFIG_INITRAMFS_LZMA=y
CONFIG_RALINK_TIMER=m
CONFIG_RALINK_TIMER_WDG=y
CONFIG_RALINK_WDG_TIMER=10
CONFIG_RALINK_WDG_REFRESH_INTERVAL=4
CONFIG_RWSEM_GENERIC_SPINLOCK=y
CONFIG_GENERIC_FIND_NEXT_BIT=y
CONFIG_GENERIC_HWEIGHT=y
CONFIG_GENERIC_CALIBRATE_DELAY=y
CONFIG_GENERIC_TIME=y
CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
CONFIG_DMA_NONCOHERENT=y
CONFIG_DMA_NEED_PCI_MAP_STATE=y
CONFIG_CPU_LITTLE_ENDIAN=y
CONFIG_SYS_SUPPORTS_LITTLE_ENDIAN=y
CONFIG_IRQ_CPU=y
CONFIG_SWAP_IO_SPACE=y
CONFIG_BOOT_ELF32=y
CONFIG_MIPS_L1_CACHE_SHIFT=5
The device itself doesn't seem to be anything special. There's one 'large' chip with no markings on it and it's the one that gets hot. Can take pics if you need them.
It seems that the tftp-firmware might not be encrypted. Following I got from their uploadscript:
Joined: 06 Jun 2006 Posts: 7492 Location: Dresden, Germany
Posted: Tue Jul 14, 2009 20:58 Post subject:
i have a working firmware for the ESR9750 since a long time. but again. a complete hardware spec would be nice. otherwise i cannot say if it would run. the dlf files are encrypted. thaty all what i can say. the normal ESR9750 is no RT3052, thats whats curious here. i dont have a ESR9752 here, so if the ESR9752, a standard whr g300n image would run on it if you extract the uimage from the webflash file _________________ "So you tried to use the computer and it started smoking? Sounds like a Mac to me.." - Louis Rossmann https://www.youtube.com/watch?v=eL_5YDRWqGE&t=60s
i have a working firmware for the ESR9750 since a long time. but again. a complete hardware spec would be nice. otherwise i cannot say if it would run. the dlf files are encrypted. thaty all what i can say. the normal ESR9750 is no RT3052, thats whats curious here. i dont have a ESR9752 here, so if the ESR9752, a standard whr g300n image would run on it if you extract the uimage from the webflash file
Ok, so I guess some pics would help?
And could you give some small pointers on extracting the uimage from that file?
Again, thanks sofar.
EDIT: Looking at the pic of the G300N, it looks awfully similar to this one. Minus the second ramchip. The chip itself seems covered by a large ceramic thingy.
## Booting image at 80800000 ...
Image Name: DD-WRT v24 Linux Kernel Image
Created: 2009-07-15 12:17:35 UTC
System Control Status = 0x21440000
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 856885 Bytes = 836.8 kB
Load Address: 80000000
Entry Point: 80267000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80267000) ...
## Giving linux memsize in MB, 16
Joined: 06 Jun 2006 Posts: 7492 Location: Dresden, Germany
Posted: Sat Jul 18, 2009 13:48 Post subject:
the reason could be that the WHR G300N image is made for 32 mb ram devices, this would crash the kernel if the device has just 16. i will work on it in the next days. contact me with email and i can send you a testimage early next week _________________ "So you tried to use the computer and it started smoking? Sounds like a Mac to me.." - Louis Rossmann https://www.youtube.com/watch?v=eL_5YDRWqGE&t=60s
Joined: 06 Jun 2006 Posts: 7492 Location: Dresden, Germany
Posted: Sat Jul 18, 2009 18:36 Post subject:
try this one. it has automatic ramsize detection _________________ "So you tried to use the computer and it started smoking? Sounds like a Mac to me.." - Louis Rossmann https://www.youtube.com/watch?v=eL_5YDRWqGE&t=60s
## Booting image at bfc50000 ...
Image Name: DD-WRT v24 Linux Kernel Image
Created: 2009-07-18 18:25:04 UTC
System Control Status = 0x21440000
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 856958 Bytes = 836.9 kB
Load Address: 80000000
Entry Point: 80267000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80267000) ...
## Giving linux memsize in MB, 16
Starting kernel ...
LINUX started...
THIS IS ASIC
Linux version 2.6.23.17 (root@dd-wrt) (gcc version 4.1.2) #572 Sat Jul 18 20:20:57 CEST 2009
The CPU frequency set to 384 MHz
16M RAM Detected!
CPU revision is: 0001964c
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
Built 1 zonelists in Zone order. Total pages: 4064
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4 rootfstype=squashfs noinitrd
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 800074, status = 1100ff00
PID hash table entries: 64 (order: 6, 256 bytes)
calculating r4koff... 003a9800(3840000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
console [ttyS1] enabled
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13260k/16384k available (2141k kernel code, 3124k reserved, 315k data, 120k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Generic PHY: Registered new driver
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
Load RT2880 Timer Module(Wdg/Soft)
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ralink flash device: 0x800000 at 0xbf000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
Ralink SoC physically mapped flash: Swapping erase regions for broken CFI table.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
found squashfs at 122000
Creating 6 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00030000 : "uboot"
0x00030000-0x00040000 : "uboot-config"
0x00040000-0x00050000 : "factory-defaults"
0x00050000-0x003f0000 : "linux"
0x00122000-0x003f0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x003f0000-0x00400000 : "nvram"
u32 classifier
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
ctnetlink v0.93: registering with nfnetlink.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
IPP2P v0.8.2 loading
ClusterIP Version 0.8 loaded successfully
TCP bic registered
TCP cubic registered
TCP westwood registered
TCP highspeed registered
TCP hybla registered
TCP htcp registered
TCP vegas registered
TCP scalable registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Welcome to PF_RING 3.2.1
(C) 2004-06 L.Deri <deri@ntop.org>
NET: Registered protocol family 27
PF_RING: bucket length 128 bytes
PF_RING: ring slots 4096
PF_RING: sample rate 1 [1=no sampling]
PF_RING: capture TX No [RX only]
PF_RING: transparent mode Yes
PF_RING initialized correctly.
PF_RING: registered /proc/net/pf_ring/
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v2.00 256 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 0, Tx Ring = 256, Rx Ring = 256
GDMA1_MAC_ADRH -- : 0x0000000c
GDMA1_MAC_ADRL -- : 0x43305277
PROC INIT OK!
decode /dev/mtdblock4
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 120k freed
starting Architecture code for rt2880
rt2860v2_ap: module license 'unspecified' taints kernel.
CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 80062e84, ra == 80062d1c
Oops[#1]:
Cpu 0
$ 0 : 00000000 0000006f 00000000 00000000
$ 4 : 00000000 00000000 00000034 00000000
$ 8 : 0000003c 80c85000 ffffffff 80c8501c
$12 : 80315a80 ffffffff 00000001 00080000
$16 : 80316c00 8030df60 00000000 8030df60
$20 : 00000001 00000000 80290000 802552f0
$24 : 00000000 00200200
$28 : 803c6000 803c7c88 802857e0 80062d1c
Hi : 00000000
Lo : 00000000
epc : 80062e84 Tainted: P
ra : 80062d1c Status: 1100fc02 KERNEL EXL
Cause : 0080000c
BadVA : 00000000
PrId : 0001964c
Modules linked in: rt2860v2_ap(P)
Process insmod (pid: 600, threadinfo=803c6000, task=803eda98)
Stack : 80292a84 803c7ca8 803c7d00 800d9a24 000000d0 00000010 00000001 80259eb8
000080d0 8030df60 80a43ef4 00000000 80290000 802349fc 000081a4 80062d1c
8007f5d8 80290000 80290000 80c8513c 00000000 80259eb8 80259ecc 80c85414
800acc54 800acc7c 803c7d18 8026a880 00000000 8007f888 80c85414 803c7d40
00000000 80259eb8 80259ecc 80c85414 80a43ef4 80a43eb8 00000000 0000000b
...
Call Trace:[<800d9a24>][<80062d1c>][<8007f5d8>][<800acc54>][<800acc7c>][<8026a880>][<8007f888>][<800abd34>][<800ff668>][<801006a8>][<80100ab0>][<801007a8>][<800ffe80>][<80145318>][<80145548>][<800e12e0>][<80145ab0>][<80145318>][<80b5fe4c>][<8026a980>][<80145318>][<80a3e094>][<80a3e070>][<8026ab80>][<80b623d4>][<80b6252c>][<80b61f18>][<80b61c88>][<80b61af4>][<80042378>][<8004231c>][<8026ab00>][<8000a6c4>]
Joined: 06 Jun 2006 Posts: 7492 Location: Dresden, Germany
Posted: Sun Jul 19, 2009 12:18 Post subject:
please remove the cpu cooler. i need to know the exact cpu model _________________ "So you tried to use the computer and it started smoking? Sounds like a Mac to me.." - Louis Rossmann https://www.youtube.com/watch?v=eL_5YDRWqGE&t=60s
Set info->start[0]=BFC00000
flash_protect ON: from 0xBFC00000 to 0xBFC24E27
protect on 0
protect on 1
protect on 2
flash_protect ON: from 0xBFC30000 to 0xBFC3FFFF
protect on 3
============================================
Ralink UBoot Version: 3.1
--------------------------------------------
ASIC 3052_MP1 (MAC to GigaMAC Mode)
Product Name: ESR-9752-SC
DRAM COMPONENT: 128Mbits
DRAM BUS: 16BIT
Total memory: 16 MBytes
Flash: 4 MBytes
Date:Nov 25 2008 Time:10:57:31
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384
##### The CPU freq = 384 MHZ ####
SDRAM bus set to 16 bit
SDRAM size =16 Mbytes
SDRAM CAS = 3(d1835272)
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
4 3 2 1 0
3: System Boot system code via Flash.
## Booting image at bfc50000 ...
Image Name: DD-WRT v24 Linux Kernel Image
Created: 2009-07-18 18:25:04 UTC
System Control Status = 0x21440000
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 856958 Bytes = 836.9 kB
Load Address: 80000000
Entry Point: 80267000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80267000) ...
## Giving linux memsize in MB, 16
Starting kernel ...
LINUX started...
THIS IS ASIC
Linux version 2.6.23.17 (root@dd-wrt) (gcc version 4.1.2) #572 Sat Jul 18 20:20:57 CEST 2009
The CPU frequency set to 384 MHz
16M RAM Detected!
CPU revision is: 0001964c
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
Built 1 zonelists in Zone order. Total pages: 4064
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4 rootfstype=squashfs noinitrd
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 80007c, status = 1100ff00
PID hash table entries: 64 (order: 6, 256 bytes)
calculating r4koff... 003a9800(3840000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
console [ttyS1] enabled
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13260k/16384k available (2141k kernel code, 3124k reserved, 315k data, 120k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Generic PHY: Registered new driver
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
Load RT2880 Timer Module(Wdg/Soft)
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ralink flash device: 0x800000 at 0xbf000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
Ralink SoC physically mapped flash: Swapping erase regions for broken CFI table.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
found squashfs at 122000
Creating 6 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00030000 : "uboot"
0x00030000-0x00040000 : "uboot-config"
0x00040000-0x00050000 : "factory-defaults"
0x00050000-0x003f0000 : "linux"
0x00122000-0x003f0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x003f0000-0x00400000 : "nvram"
u32 classifier
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
ctnetlink v0.93: registering with nfnetlink.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
IPP2P v0.8.2 loading
ClusterIP Version 0.8 loaded successfully
TCP bic registered
TCP cubic registered
TCP westwood registered
TCP highspeed registered
TCP hybla registered
TCP htcp registered
TCP vegas registered
TCP scalable registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Welcome to PF_RING 3.2.1
(C) 2004-06 L.Deri <deri@ntop.org>
NET: Registered protocol family 27
PF_RING: bucket length 128 bytes
PF_RING: ring slots 4096
PF_RING: sample rate 1 [1=no sampling]
PF_RING: capture TX No [RX only]
PF_RING: transparent mode Yes
PF_RING initialized correctly.
PF_RING: registered /proc/net/pf_ring/
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v2.00 256 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 0, Tx Ring = 256, Rx Ring = 256
GDMA1_MAC_ADRH -- : 0x0000000c
GDMA1_MAC_ADRL -- : 0x43305277
PROC INIT OK!
decode /dev/mtdblock4
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 120k freed
starting Architecture code for rt2880
rt2860v2_ap: module license 'unspecified' taints kernel.
Further success! Seems to be some issues with saving settings and some LAN-ports, though.
At one time I managed to get to the webif. It asked to change my username/password (as usual) and on committing the username/password everything went to hell in a hand basket
Currently it seems in a crash/reboot loop after "nvram was changed, needs commit, waiting 10 sec."
Set info->start[0]=BFC00000
flash_protect ON: from 0xBFC00000 to 0xBFC24E27
protect on 0
protect on 1
protect on 2
flash_protect ON: from 0xBFC30000 to 0xBFC3FFFF
protect on 3
============================================
Ralink UBoot Version: 3.1
--------------------------------------------
ASIC 3052_MP1 (MAC to GigaMAC Mode)
Product Name: ESR-9752-SC
DRAM COMPONENT: 128Mbits
DRAM BUS: 16BIT
Total memory: 16 MBytes
Flash: 4 MBytes
Date:Nov 25 2008 Time:10:57:31
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384
##### The CPU freq = 384 MHZ ####
SDRAM bus set to 16 bit
SDRAM size =16 Mbytes
SDRAM CAS = 3(d1835272)
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
4 3 2 1 0
3: System Boot system code via Flash.
## Booting image at bfc50000 ...
Image Name: DD-WRT v24 Linux Kernel Image
Created: 2009-07-19 12:54:03 UTC
System Control Status = 0x21440000
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 856920 Bytes = 836.8 kB
Load Address: 80000000
Entry Point: 80267000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80267000) ...
## Giving linux memsize in MB, 16
Starting kernel ...
LINUX started...
THIS IS ASIC
Linux version 2.6.23.17 (root@dd-wrt) (gcc version 4.1.2) #577 Sun Jul 19 14:50:22 CEST 2009
The CPU frequency set to 384 MHz
16M RAM Detected!
CPU revision is: 0001964c
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
Built 1 zonelists in Zone order. Total pages: 4064
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4 rootfstype=squashfs noinitrd
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 80007c, status = 1100ff00
PID hash table entries: 64 (order: 6, 256 bytes)
calculating r4koff... 003a9800(3840000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
console [ttyS1] enabled
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 13260k/16384k available (2141k kernel code, 3124k reserved, 315k data, 120k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Generic PHY: Registered new driver
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
Load RT2880 Timer Module(Wdg/Soft)
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ralink flash device: 0x800000 at 0xbf000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
Ralink SoC physically mapped flash: Swapping erase regions for broken CFI table.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
found squashfs at 122000
Creating 6 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00030000 : "uboot"
0x00030000-0x00040000 : "uboot-config"
0x00040000-0x00050000 : "factory-defaults"
0x00050000-0x003f0000 : "linux"
0x00122000-0x003f0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x003f0000-0x00400000 : "nvram"
u32 classifier
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
ctnetlink v0.93: registering with nfnetlink.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
IPP2P v0.8.2 loading
ClusterIP Version 0.8 loaded successfully
TCP bic registered
TCP cubic registered
TCP westwood registered
TCP highspeed registered
TCP hybla registered
TCP htcp registered
TCP vegas registered
TCP scalable registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Welcome to PF_RING 3.2.1
(C) 2004-06 L.Deri <deri@ntop.org>
NET: Registered protocol family 27
PF_RING: bucket length 128 bytes
PF_RING: ring slots 4096
PF_RING: sample rate 1 [1=no sampling]
PF_RING: capture TX No [RX only]
PF_RING: transparent mode Yes
PF_RING initialized correctly.
PF_RING: registered /proc/net/pf_ring/
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v2.00 256 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 0, Tx Ring = 256, Rx Ring = 256
GDMA1_MAC_ADRH -- : 0x0000000c
GDMA1_MAC_ADRL -- : 0x43305277
PROC INIT OK!
decode /dev/mtdblock4
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 120k freed
starting Architecture code for rt2880
switch reg write offset=14, value=405555
switch reg write offset=50, value=2001
switch reg write offset=98, value=7f3f
switch reg write offset=e4, value=3f
switch reg write offset=40, value=1001
switch reg write offset=44, value=1001
switch reg write offset=48, value=1002
switch reg write offset=70, value=ffff506f
wland: No such file or directory
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
nvram was changed, needs commit, waiting 10 sec.
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
Oops[#1]:
Cpu 0
$ 0 : 00000000 00441074 00000075 00000000
$ 4 : 00000000 80233249 fffffffe 8048ddf8
$ 8 : ffffffff 800e1324 80076290 fffffff8
$12 : 0000037e 00705aac 2ab85088 2ab817e8
$16 : 00000000 80c89f00 80c80075 80c8fffe
$20 : 80230000 802cd004 802d0000 80c80000
$24 : 00000001 8012f924
$28 : 8048c000 8048ddf0 80c80014 8012f200
Hi : 00001fff
Lo : 00000008
epc : 800de238 Tainted: P
ra : 8012f200 Status: 1100fc02 KERNEL EXL
Cause : 00800008
BadVA : 00000000
PrId : 0001964c
Modules linked in: nf_nat_pptp nf_conntrack_pptp nf_nat_proto_gre nf_conntrack_proto_gre etherip rt2860v2_ap(P)
Process nvram (pid: 1019, threadinfo=8048c000, task=803c34f0)
Stack : 80b8fe20 00400890 8035458c 802cf000 80bdbe74 8048de50 00000001 8048dea8
80290000 00000000 00000001 00000000 48534c46 80c80000 7f917e14 802e0000
00000002 00010000 802d0000 8012f5a8 80bd3ba8 80cff040 00000000 00000000
00441070 00000004 80bd3ba8 80cff040 00000000 00000001 ffffffff 00000000
803c34f0 8001c92c 00000000 00000000 803c34f0 00000001 00000000 00000000
...
Call Trace:[<8012f5a8>][<8001c92c>][<80039378>][<8005d0ac>][<80075fc4>][<80064644>][<800762e0>][<8006625c>][<8000a6c4>][<8000a6c4>]