This is a mirror of discontinued 'WikiDevi'. Enjoy!

TP-LINK TL-MR6400 V5.2

From DeviWiki (ex WikiDevi)
(Redirected from TP-LINK TL-MR6400)
Jump to navigation Jump to search

TP-LINK TL-MR6400 V5.2
Availability: 2021

EAN: 6935364092764 (UPC DB, On eBay)
Country of manuf.: China

Amazon image

ASINs
B07RM95YFC (13px, On Amazon, On CCC)
B016ZWXYXG (13px, On Amazon, On CCC)
multiple revisions of this device, use caution

Type: wireless router

Power: 9 VDC, 0.85 A
Connector type: barrel

CPU1: MediaTek MT7628NN (580 MHz)
FLA1: 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> (Winbond W25Q64JVSIQ)
RAM1: 64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (ESMT M14D5121632A)

Expansion IFs: none specified
Serial: yes, 4-pin header, (115200 8N1)

WI1 chip1: MediaTek MT7628NN
WI1 802dot11 protocols: bgn
WI1 MIMO config: 2x2:2
WI1 antenna connector: soldered

ETH chip1: MediaTek MT7628NN
Switch: MediaTek MT7628NN
LAN speed: 10/100
LAN ports: 4
WAN speed: 10/100
WAN ports: 1

bgn

Stock bootloader: U-Boot:1.1.3 Ralink UBoot 4.3.0.0

Stock FW OS: Linux 2.6.36

Third party firmware supported: OpenWrt

Flags: 4G LTE modem

Default SSID: TP-LINK_XXXX (41 addl. devices)
Default IP address: 192.168.1.1
the IP 192.168.1.1 is used by 1171 additional devices
of which 95 are TP-LINK devices

802dot11 OUI: C0:06:C3
Ethernet OUI: C0:06:C3

 CPU1 brandWI1 chip1 brandWI1 chip2 brand
TP-LINK TL-MR6400 V1Qualcomm AtherosQualcomm Atheros
TP-LINK TL-MR6400 V4MediaTekMediaTek
TP-LINK TL-MR6400 V5MediaTekMediaTek
TP-LINK TL-MR6400 V5.2MediaTekMediaTek

For a list of all currently documented MediaTek chipsets with specifications, see MediaTek.



Images

Serial

LTE modem

LE.UM.3.4.1.r1-01800-8x09.0-9-g2f4a74c (hostname: mdm9607)

Chips:

  • Qualcomm MDM9207 - CPU, 3G/4G modem
  • ESMT FM6BD2G1GA - 256M NAND Flash (x8) + mobile 128M DDR2 SDRAM (x32)
  • PMD9607 Power IC
  • 7219M-41, WTR2965 Radio IC
lsusb output (LTE modem)
$ lsusb -v -d 05c6:

Bus 001 Device 002: ID 05c6:9025 Android Android
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x05c6 
  idProduct          0x9025 
  bcdDevice            3.18
  iManufacturer           1 Android
  iProduct                2 Android
  iSerial                 3 ffffffff
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x017b
    bNumInterfaces          9
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xa0
      (Bus Powered)
      Remote Wakeup
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 
      bInterfaceSubClass    255 
      bInterfaceProtocol    255 
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 
      bInterfaceSubClass     66 
      bInterfaceProtocol      1 
      iInterface              6 ADB Interface
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 
      bInterfaceSubClass      0 
      bInterfaceProtocol      0 
      iInterface              0 
      ** UNRECOGNIZED:  05 24 00 10 01
      ** UNRECOGNIZED:  05 24 01 00 00
      ** UNRECOGNIZED:  04 24 02 02
      ** UNRECOGNIZED:  05 24 06 00 00
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x000a  1x 10 bytes
        bInterval               9
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x03  EP 3 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 
      bInterfaceSubClass      0 
      bInterfaceProtocol      0 
      iInterface              0 
      ** UNRECOGNIZED:  05 24 00 10 01
      ** UNRECOGNIZED:  05 24 01 00 00
      ** UNRECOGNIZED:  04 24 02 02
      ** UNRECOGNIZED:  05 24 06 00 00
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x000a  1x 10 bytes
        bInterval               9
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        4
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 
      bInterfaceSubClass    255 
      bInterfaceProtocol    255 
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x88  EP 8 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval               9
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x87  EP 7 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x05  EP 5 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        5
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 
      bInterfaceSubClass      6 
      bInterfaceProtocol     80 
      iInterface              4 Mass Storage
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x89  EP 9 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x06  EP 6 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               1
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         6
      bInterfaceCount         3
      bFunctionClass          1 
      bFunctionSubClass       0 
      bFunctionProtocol       0 
      iFunction               0 
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        6
      bAlternateSetting       0
      bNumEndpoints           0
      bInterfaceClass         1 
      bInterfaceSubClass      1 
      bInterfaceProtocol      0 
      iInterface              9 AC Interface
      AudioControl Interface Descriptor:
        bLength                10
        bDescriptorType        36
        bDescriptorSubtype      1 (HEADER)
        bcdADC               1.00
        wTotalLength       0x0034
        bInCollection           2
        baInterfaceNr(0)        7
        baInterfaceNr(1)        8
      AudioControl Interface Descriptor:
        bLength                12
        bDescriptorType        36
        bDescriptorSubtype      2 (INPUT_TERMINAL)
        bTerminalID             1
        wTerminalType      0x0201 Microphone
        bAssocTerminal          2
        bNrChannels             1
        wChannelConfig     0x0003
          Left Front (L)
          Right Front (R)
        iChannelNames           0 
        iTerminal               0 
      AudioControl Interface Descriptor:
        bLength                 9
        bDescriptorType        36
        bDescriptorSubtype      3 (OUTPUT_TERMINAL)
        bTerminalID             2
        wTerminalType      0x0101 USB Streaming
        bAssocTerminal          1
        bSourceID               1
        iTerminal               0 
      AudioControl Interface Descriptor:
        bLength                12
        bDescriptorType        36
        bDescriptorSubtype      2 (INPUT_TERMINAL)
        bTerminalID             3
        wTerminalType      0x0101 USB Streaming
        bAssocTerminal          4
        bNrChannels             1
        wChannelConfig     0x0003
          Left Front (L)
          Right Front (R)
        iChannelNames          11 Channels
        iTerminal              10 Input terminal
      AudioControl Interface Descriptor:
        bLength                 9
        bDescriptorType        36
        bDescriptorSubtype      3 (OUTPUT_TERMINAL)
        bTerminalID             4
        wTerminalType      0x0301 Speaker
        bAssocTerminal          3
        bSourceID               3
        iTerminal              13 Output terminal
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        7
      bAlternateSetting       0
      bNumEndpoints           0
      bInterfaceClass         1 
      bInterfaceSubClass      2 
      bInterfaceProtocol      0 
      iInterface              0 
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        7
      bAlternateSetting       1
      bNumEndpoints           1
      bInterfaceClass         1 
      bInterfaceSubClass      2 
      bInterfaceProtocol      0 
      iInterface              0 
      AudioStreaming Interface Descriptor:
        bLength                 7
        bDescriptorType        36
        bDescriptorSubtype      1 (AS_GENERAL)
        bTerminalLink           2
        bDelay                  1 frames
        wFormatTag         0x0001 PCM
      AudioStreaming Interface Descriptor:
        bLength                11
        bDescriptorType        36
        bDescriptorSubtype      2 (FORMAT_TYPE)
        bFormatType             1 (FORMAT_TYPE_I)
        bNrChannels             1
        bSubframeSize           2
        bBitResolution         16
        bSamFreqType            1 Discrete
        tSamFreq[ 0]         8000
      Endpoint Descriptor:
        bLength                 9
        bDescriptorType         5
        bEndpointAddress     0x8a  EP 10 IN
        bmAttributes            5
          Transfer Type            Isochronous
          Synch Type               Asynchronous
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               4
        bRefresh                0
        bSynchAddress           0
        AudioStreaming Endpoint Descriptor:
          bLength                 7
          bDescriptorType        37
          bDescriptorSubtype      1 (EP_GENERAL)
          bmAttributes         0x01
            Sampling Frequency
          bLockDelayUnits         1 Milliseconds
          wLockDelay         0x0001
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        8
      bAlternateSetting       0
      bNumEndpoints           0
      bInterfaceClass         1 
      bInterfaceSubClass      2 
      bInterfaceProtocol      0 
      iInterface             14 AS Interface
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        8
      bAlternateSetting       1
      bNumEndpoints           1
      bInterfaceClass         1 
      bInterfaceSubClass      2 
      bInterfaceProtocol      0 
      iInterface             15 AS Interface
      AudioStreaming Interface Descriptor:
        bLength                 7
        bDescriptorType        36
        bDescriptorSubtype      1 (AS_GENERAL)
        bTerminalLink           3
        bDelay                  1 frames
        wFormatTag         0x0001 PCM
      AudioStreaming Interface Descriptor:
        bLength                11
        bDescriptorType        36
        bDescriptorSubtype      2 (FORMAT_TYPE)
        bFormatType             1 (FORMAT_TYPE_I)
        bNrChannels             1
        bSubframeSize           2
        bBitResolution         16
        bSamFreqType            1 Discrete
        tSamFreq[ 0]         8000
      Endpoint Descriptor:
        bLength                 9
        bDescriptorType         5
        bEndpointAddress     0x07  EP 7 OUT
        bmAttributes            9
          Transfer Type            Isochronous
          Synch Type               Adaptive
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               4
        bRefresh                0
        bSynchAddress           0
        AudioStreaming Endpoint Descriptor:
          bLength                 7
          bDescriptorType        37
          bDescriptorSubtype      1 (EP_GENERAL)
          bmAttributes         0x01
            Sampling Frequency
          bLockDelayUnits         1 Milliseconds
          wLockDelay         0x0001
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
can't get debug descriptor: Resource temporarily unavailable
Device Status:     0x0000
  (Bus Powered)

OEM firmware

Serial console login - admin:1234

OEM Boot log (+ cpuinfo, meminfo, netstat, busybox, etc output)

##

[05010B0F][05010C0B][8A880000][25243937][00252437]

DU Setting Cal Done

U-Boot 1.1.3 (Jan 15 2021 - 17:08:37)


Board: Ralink APSoC DRAM:  64 MB

relocate_code Pointer at: 83fb4000

gpiomode1 55154404.

gpiomode2 05550555.

######GPIO CTRL 0 for GPIO 0~31 OUTPUT tmp(0x00000030)#####

######GPIO CTRL 1 for GPIO 32~64 OUTPUT tmp(0x00000f80)#####

######GPIO CTRL 1 for GPIO 32~64 INPUT tmp(0x00000f80)#####

flash manufacture id: ef, device id 40 17

spi device id: ef 40 17 0 80 (40170080)

find flash: W25Q64BV

RALINK_GPIOMODE_REG_1(0xb0000060) old=0x55154404 new=0x55154404

RALINK_GPIO_CTRL_32_63(0xb0000604) old=0xf80 new=0xf90

RALINK_GPIO_DATA_32_63(0xb0000624) old=0x6f5f new=0x6f4f

============================================ 

Ralink UBoot Version: 4.3.0.0

-------------------------------------------- 

ASIC 7628_MP (Port5<->None)

DRAM component: 512 Mbits DDR, width 16

DRAM bus: 16 bit

Total memory: 64 MBytes

Flash component: SPI Flash

Date:Jan 15 2021  Time:17:08:37

============================================ 

icache: sets:512, ways:4, linesz:32 ,total:65536

dcache: sets:256, ways:4, linesz:32 ,total:32768 


 ##### The CPU freq = 580 MHZ #### 

 estimate memory size =64 Mbytes

RESET MT7628 PHY!!!!!!

continue to starting system.

### 0 

disable switch phyport...

   

3: System Boot system code via Flash.(0xbc020000)

do_bootm:argc=2, addr=0xbc020000

## Booting image at bc020000 ...

   Uncompressing Kernel Image ... OK

No initrd

## Transferring control to Linux (at address 8000c150) ...

## Giving linux memsize in MB, 64


Starting kernel ...


Linux version 2.6.36 (tp-link@Sohoidev) (gcc version 4.6.3 
 (Buildroot 2012.11.1) ) #1 Fri Jan 15 17:12:03 CST 2021

 The CPU feqenuce set to 575 MHz

 MIPS CPU sleep mode enabled.
CPU revision is: 00019655 (MIPS 24Kc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS1,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/sbin/init
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=0003f5f0
Readback ErrCtl register=0003f5f0
Memory: 61036k/65536k available (2920k kernel code, 4500k reserved, 544k data, 184k init, 0k highmem)
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
RALINK_GPIOMODE = 55154404 
RALINK_GPIOMODE = 55144404 
***** Xtal 40MHz *****
start PCIe register access
RALINK_RSTCTRL = 2400000
RALINK_CLKCFG1 = fdbfffc0

*************** MT7628 PCIe RC mode *************
PCIE0 no card, disable it(RST&CLK)
bio: create slab <bio-0> at 0
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource Ralink Systick timer
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
RT3xxx EHCI/OHCI init.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse init (API version 7.15)
msgmni has been set to 119
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
i2cdrv_major = 218
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A

create tplink/console_ctl

create tplink/console_ctl done
brd: module loaded
flash manufacture id: ef, device id 40 17
W25Q64BV(ef 40170000 flash_version = 1) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 6 MTD partitions on "raspi":
0x000000000000-0x000000020000 : "boot"
0x000000020000-0x000000160000 : "kernel"
0x000000160000-0x0000007d0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
0x0000007d0000-0x0000007e0000 : "config"
0x0000007e0000-0x0000007f0000 : "romfile"
0x0000007f0000-0x000000800000 : "radio"
Register flash device:flash0
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 149(0x00000095)
FM detection done! loop = 1
SR calibration value u1SrCalVal = 5
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Mirror/redirect action on
u32 classifier
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (953 buckets, 3812 max)
GRE over IPv4 demultiplexor driver
gre: can't add protocol
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 184k freed

starting pid 35, tty '': '/etc/init.d/rcS'
cp: can't stat '/etc/SingleSKU_FCC.dat': No such file or directory
SCSI subsystem initialized
insmod: can't insert '/lib/modules/kmdir/kernel/drivers/usb/core/usbcore.ko': No such file or directory
Started WatchDog Timer.
Ralink APSoC Hardware Watchdog Timer
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
insmod: can't insert '/lib/modules/kmdir/kernel/drivers/usb/host/ifxusb_host.ko': No such file or directory
rdm_major = 253
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Read MAC from flash(0x7EF100) ffffffc0-06-ffffffc3-ffffffe1-ffffff81-28
GMAC1_MAC_ADRH -- : 0x0000c006
GMAC1_MAC_ADRL -- : 0xc3ffffff
Ralink APSoC Ethernet Driver Initilization. v3.1  256 rx/tx descriptors allocated, mtu = 1500!
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Read MAC from flash(0x7EF100) ffffffc0-06-ffffffc3-ffffffe1-ffffff81-28
GMAC1_MAC_ADRH -- : 0x0000c006
GMAC1_MAC_ADRL -- : 0xc3ffffff
PROC INIT OK!
usbcore: registered new interface driver cdc_wdm
dns_init
domain_name:tplinkmodem.net
Backtrace parameters (ver: 0.9 build time: Jan 15 2021 17:13:36):
----------------------------------------------------------------------
        regbtsig: enable to hook signals. =1
         sigmask: signals mask to be hooked. =0x60000688
        maxdepth: calltrace depth. =16
        showregs: enable to show regs. =0
       showstack: enable to show stack. =0
    showallstack: enable to show all stacks. =0
        showmaps: enable to show maps. =0
          reboot: enable to reboot when cos/httpd exit unusual. =0
       showgroup: enable to show each thread's backtrace. =0
         testcos: enable to hook more signals for cos. =1
----------------------------------------------------------------------
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0

Please press Enter to activate this console. [err] syslogd[main --1001] syslogd : syslogd_init

[ dm_readFile ] 2042:  can not open xml file /var/tmp/pc/reduced_data_model.xml!, about to open file /etc/reduced_data_model.xml
spiflash_ioctl_read, Read from 0x007d0000 length 0x10000, ret 0, retlen 0x10000
spiflash_ioctl_read, Read from 0x007d0000 length 0x100, ret 0, retlen 0x100
[ dm_loadCfg ] 2411:  software version is not match, in config, version = 0
[ dm_loadCfg ] 2504:  currSwRevision = 55aa0100 currSwRevision = 0
[ dm_readFile ] 2042:  can not open xml file /var/tmp/pc/default_config.xml!, about to open file /etc/default_config.xml
[ parseConfigNode ] 551:  Meet unrecognized object node "PhDDNSCfg", skip the node
[ parseConfigNode ] 556:  Meet unrecognized parameter node "PhDDNSCfg", skip the node
[ parseConfigNode ] 551:  Meet unrecognized object node "X_TP_WDSBridge", skip the node
[ parseConfigNode ] 556:  Meet unrecognized parameter node "X_TP_PreSharedKey", skip the node
[ parseConfigNode ] 551:  Meet unrecognized object node "WLANSyncConfig", skip the node
[ parseConfigNode ] 556:  Meet unrecognized parameter node "WLANSyncConfig", skip the node
[ parseConfigNode ] 551:  Meet unrecognized object node "X_TP_IPv6Cfg", skip the node
usbcore: registered new interface driver qmi_wwan
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
[ prepareForQmi ] 062:  wait for lte to recognize count:0

[ prepareForQmi ] 062:  wait for lte to recognize count:1

[ prepareForQmi ] 062:  wait for lte to recognize count:2

[ prepareForQmi ] 062:  wait for lte to recognize count:3

[ prepareForQmi ] 062:  wait for lte to recognize count:4

[ prepareForQmi ] 062:  wait for lte to recognize count:5

[ prepareForQmi ] 062:  wait for lte to recognize count:6

[ prepareForQmi ] 062:  wait for lte to recognize count:7

[ prepareForQmi ] 062:  wait for lte to recognize count:8

[ prepareForQmi ] 062:  wait for lte to recognize count:9

[ prepareForQmi ] 062:  wait for lte to recognize count:10

[ prepareForQmi ] 062:  wait for lte to recognize count:11

[ prepareForQmi ] 062:  wait for lte to recognize count:12

usb 1-1: new high speed USB device using rt3xxx-ehci and address 2
[zc] qmi_wwan_bind: in
[zc] change dtr 1
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Init mac c0-06-c3-ff-ff-ff
qmi_wwan: probe of 1-1:1.0 failed with error -22
usbserial_generic 1-1:1.0: generic converter detected
usb 1-1: generic converter now attached to ttyUSB0
[zc] qmi_wwan_bind: in
[zc] change dtr 1
[ prepareForQmi ] 062:  wait for lte to recognize count:13

[ prepareForQmi ] 062:  wait for lte to recognize count:14

spiflash_ioctl_read, Read from 0x007ef500 length 0x29, ret 0, retlen 0x29
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
spiflash_ioctl_read, Read from 0x007ef200 length 0x4, ret 0, retlen 0x4
spiflash_ioctl_read, Read from 0x007ef700 length 0x18, ret 0, retlen 0x18
spiflash_ioctl_read, Read from 0x007ef300 length 0x29, ret 0, retlen 0x29
spiflash_ioctl_read, Read from 0x007ef400 length 0x29, ret 0, retlen 0x29
spiflash_ioctl_read, Read from 0x007ef800 length 0x48, ret 0, retlen 0x48
read model:spiflash_ioctl_read, Read from 0x007ef900 length 0x20, ret 0, retlen 0x20
spiflash_ioctl_read, Read from 0x00020000 length 0x200, ret 0, retlen 0x200
spiflash_ioctl_read, Read from 0x007ef700 length 0x18, ret 0, retlen 0x18
spiflash_ioctl_read, Read from 0x007ef300 length 0x29, ret 0, retlen 0x29
spiflash_ioctl_read, Read from 0x007ef400 length 0x29, ret 0, retlen 0x29
spiflash_ioctl_read, Read from 0x007ef800 length 0x48, ret 0, retlen 0x48
read model:spiflash_ioctl_read, Read from 0x007ef900 length 0x20, ret 0, retlen 0x20
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
22 ERROR: Post event to MOBILE server failed, errno = 2 (No such file or directory).
22 ERROR: Client communication with server failed.
[ rsl_getWanLteLinkCfgObj ] 2660:  Fail to get lte module status...
[ rsl_getObj ] 1265:  perror:1
[ rsl_getNextObj ] 1413:  perror:1
[err] syslogd[syslogd_msg_process_thread --881] begin to lost!, msg = ERROR: 
Post event to MOBILE server failed, errno = 2 (No such file or directory).

sendto /var/tmp/7 msg 2001 error No such file or directory ,pid 87
[ ntpc ] 979:  Get time zone, g_timeZone = 720
Raeth v3.1 (Tasklet,SkbRecycle)

phy_tx_ring = 0x031fa000, tx_ring = 0xa31fa000

phy_rx_ring0 = 0x031fb000, rx_ring0 = 0xa31fb000
[fe_sw_init:4982]rt305x_esw_init.
disable switch phyport...
GMAC1_MAC_ADRH -- : 0x0000c006
GMAC1_MAC_ADRL -- : 0xc3ffffff
RT305x_ESW: Link Status Changed
/bin/sh: can't create /proc/tplink/eth_vlan: nonexistent directory
ioctl: No such device
brctl: bridge br0: Invalid argument
set if eth0.1 to *not wan dev
device eth0.1 entered promiscuous mode
device eth0 entered promiscuous mode
br0: port 1(eth0.1) entering forwarding state
br0: port 1(eth0.1) entering forwarding state
set if eth0.2 to *not wan dev
device eth0.2 entered promiscuous mode
br0: port 2(eth0.2) entering forwarding state
br0: port 2(eth0.2) entering forwarding state
set if eth0.3 to *not wan dev
device eth0.3 entered promiscuous mode
br0: port 3(eth0.3) entering forwarding state
br0: port 3(eth0.3) entering forwarding state
set if eth0.4 to *not wan dev
device eth0.4 entered promiscuous mode
br0: port 4(eth0.4) entering forwarding state
br0: port 4(eth0.4) entering forwarding state
[ vlan_addLanPortsIntoBridge ] 550:  add lan Port 255 from br0
brctl: bridge br0: Device or resource busy
brctl: bridge br0: Device or resource busy
brctl: bridge br0: Device or resource busy
[ rsl_initVlanObj ] 993:  
+++++++++++++rsl_initVlanObj done!
ra0       no private ioctls.

MT7628-->

=== pAd = c0b52000, size = 1071264 ===

<-- RTMPAllocAdapterBlock, Status=0
MT7628-->RtmpChipOpsHook(494): Not support for HIF_MT yet!
MT7628-->mt7628_init()-->
MT7628-->mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
MT7628-->e2.bin mt7628_init(1143)::(2), pChipCap->fw_len(64736)
MT7628-->mt_bcn_buf_init(218): Not support for HIF_MT yet!
MT7628--><--mt7628_init()
1538352023 ERROR: Post event to MOBILE server failed, errno = 2 (No such file or directory).
1538352023 ERROR: Client communication with server failed.
[ oal_wlan_ra_lteCoexistence ] 7757:  Fail to get lte module status...
[ oal_wlan_ra_lteCoexistence ] 7831:  AutoChannelSkipList : 
Interface doesn't accept private ioctl...
set (sht:pAd->ApBootFlag = TRUE
8BE2): Network iMT7628-->s down
InterfacTX_BCN DESC a32a8000 size = 320
e doesn't acceptMT7628--> private ioctl..RX[0] DESC a32ac000 size = 4096
.
set (8BE2): NMT7628-->etwork is down
RX[1] DESC a32ad000 size = 2048
[ oal_wlan_ra_lteCoexistence ] 7868:  
AutoChannelSkipList = 12;13

MT7628-->cfg_mode=9
MT7628-->cfg_mode=9
MT7628-->wmode_band_equal(): Band Equal!
MT7628-->AndesSendCmdMsg: Could not send in band command due to diable fRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD
MT7628-->APSDCapable[0]=1
MT7628-->APSDCapable[1]=1
MT7628-->APSDCapable[2]=1
MT7628-->APSDCapable[3]=1
MT7628-->APSDCapable[4]=1
MT7628-->APSDCapable[5]=1
MT7628-->APSDCapable[6]=1
MT7628-->APSDCapable[7]=1
MT7628-->APSDCapable[8]=1
MT7628-->APSDCapable[9]=1
MT7628-->APSDCapable[10]=1
MT7628-->APSDCapable[11]=1
MT7628-->APSDCapable[12]=1
MT7628-->APSDCapable[13]=1
MT7628-->APSDCapable[14]=1
MT7628-->APSDCapable[15]=1
MT7628-->Key1Str is Invalid key length(0) or Type(0)
MT7628-->Key1Str is Invalid key length(0) or Type(0)
MT7628-->Key2Str is Invalid key length(0) or Type(0)
MT7628-->Key2Str is Invalid key length(0) or Type(0)
MT7628-->Key3Str is Invalid key length(0) or Type(0)
MT7628-->Key3Str is Invalid key length(0) or Type(0)
MT7628-->Key4Str is Invalid key length(0) or Type(0)
MT7628-->Key4Str is Invalid key length(0) or Type(0)
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Init mac c0-06-c3-ff-ff-ff
qmi_wwan: probe of 1-1:1.1 failed with error -22
qmi_wwan 1-1:1.2: bogus CDC Union: master=0, slave=0
qmi_wwan: probe of 1-1:1.2 failed with error -1
qmi_wwan 1-1:1.3: bogus CDC Union: master=0, slave=0
qmi_wwan: probe of 1-1:1.3 failed with error -1
MT7628-->load fw image from fw_header_image
MT7628-->AndesMTLoadFwMethod1(2264)::pChipCap->fw_len(64736)
MT7628-->FW Version:1MT7628-->
MT7628-->FW Build Date:20170411104110MT7628-->
MT7628-->CmdAddressLenReq:(ret = 0)
MT7628-->CmdFwStartReq: override = 1, address = 1048576
MT7628-->CmdStartDLRsp: WiFI FW Download Success
qmi_wwan 1-1:1.4: cdc-wdm0: USB WDM device
[zc] qmi_wwan_bind: in
[zc] change dtr 1
MT7628-->MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
efuse_probe: efuse = 10000012
MT7628-->RtmpChipOpsEepromHook::e2p_type=2, inf_Type=4
MT7628-->RtmpEepromGetDefault::e2p_dafault=2
MT7628-->RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
MT7628-->NVM is FLASH mode
MT7628-->1. Phy Mode = 14
exec!
spiflash_ioctl_read, Read from 0x007f0000 length 0x400, ret 0, retlen 0x400
eeFlashId = 0x7628!
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Init mac c0-06-c3-ff-ff-ff

LTE has booted, tell cos to start qmuxd and mobile
[ qmiReconnectChangedHandler ] 516:  receive qmi connect msg!

MT7628-->Country Region from e2p = ffff
tssi_1_target_pwr_g_band = 32
MT7628-->2. Phy Mode = 14
MT7628-->3. Phy Mode = 14
MT7628-->NICInitPwrPinCfg(11): Not support for HIF_MT yet!
MT7628-->NICInitializeAsic(651): Not support rtmp_mac_sys_reset () for HIF_MT yet!
MT7628-->mt_mac_init()-->
MT7628-->MtAsicInitMac()-->
MT7628-->mt7628_init_mac_cr()-->
MT7628-->MtAsicSetMacMaxLen(1277): Set the Max RxPktLen=450!
MT7628--><--mt_mac_init()
MT7628-->	WTBL Segment 1 info:
MT7628-->		MemBaseAddr/FID:0x28000/0
MT7628-->		EntrySize/Cnt:32/128
MT7628-->	WTBL Segment 2 info:
MT7628-->		MemBaseAddr/FID:0x40000/0
MT7628-->		EntrySize/Cnt:64/128
MT7628-->	WTBL Segment 3 info:
MT7628-->		MemBaseAddr/FID:0x42000/64
MT7628-->		EntrySize/Cnt:64/128
MT7628-->	WTBL Segment 4 info:
MT7628-->		MemBaseAddr/FID:0x44000/128
MT7628-->		EntrySize/Cnt:32/128
MT7628-->AntCfgInit(2978): Not support for HIF_MT yet!
MT7628-->MCS Set = ff ff 00 00 01
MT7628-->MtAsicSetChBusyStat(861): Not support for HIF_MT yet!
umount: can't forcibly umount /tmp/udisk: Invalid argument
[ qmiReconnectChangedHandler ] 522:  mount /tmp/udisk
open DNS error: No such file or directory
[ oal_sys_getOldTZInfo ] 854:  Open TZ file error!
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
* daemon not running. starting it now on port 5037 *
cannot bind 'tcp:5037'
ADB server didn't ACK
* failed to start daemon *
error: cannot connect to daemon
MT7628-->[PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0
MT7628-->[PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
mtk_band_steering_netlink_init 245 band steering netlink init ok

MT7628-->[PMF]ap_pmf_init:: apidx=1, MFPC=0, MFPR=0, SHA256=0
mtk_band_steering_netlink_init 245 band steering netlink init ok

MT7628-->MtAsicSetRalinkBurstMode(3143): Not support for HIF_MT yet!
MT7628-->MtAsicSetPiggyBack(796): Not support for HIF_MT yet!
MT7628-->reload DPD from flash , 0x9F = [c000] doReload bit7[0]
MT7628-->CmdLoadDPDDataFromFlash: Channel = 11, DoReload = 0
MT7628-->MtAsicSetTxPreamble(3122): Not support for HIF_MT yet!
MT7628-->CmdSlotTimeSet:(ret = 0)
MT7628-->MtAsicAddSharedKeyEntry(1344): Not support for HIF_MT yet!
MT7628-->MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
MT7628-->Main bssid = c0:06:c3:ff:ff:ff
<==== rt28xx_init, Status=0
MT7628-->@@@ ed_monitor_init : ===>
MT7628-->@@@ ed_monitor_init : <===
MT7628-->mt7628_set_ed_cca: TURN ON EDCCA mac 0x10618 = 0xd7c87d0f, EDCCA_Status=1
sht:pAd->ApBootFlag = FALSE
MT7628-->WiFi Startup Cost (ra0): 4.000s
scsi0 : usb-storage 1-1:1.5
[zc] qmi_wwan_bind: in
[zc] change dtr 1
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Init mac c0-06-c3-ff-ff-ff
qmi_wwan: probe of 1-1:1.6 failed with error -22
[zc] qmi_wwan_bind: in
[zc] change dtr 1
MT7628-->AddTxSType: already registered TxSType (PID = 32, Format = 0
##### mbss_cr_enable, BssId = 1
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Init mac c0-06-c3-ff-ff-ff
qmi_wwan: probe of 1-1:1.7 failed with error -22
[zc] qmi_wwan_bind: in
[zc] change dtr 1
spiflash_ioctl_read, Read from 0x007ef100 length 0x6, ret 0, retlen 0x6
Init mac c0-06-c3-ff-ff-ff
qmi_wwan: probe of 1-1:1.8 failed with error -22
MT7628-->MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0x0
MT7628-->MtAsicSetPiggyBack(796): Not support for HIF_MT yet!
MT7628-->[PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0
MT7628-->[PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
mtk_band_steering_netlink_init 245 band steering netlink init ok

MT7628-->[PMF]ap_pmf_init:: apidx=1, MFPC=0, MFPR=0, SHA256=0
mtk_band_steering_netlink_init 245 band steering netlink init ok

MT7628-->MtAsicSetRalinkBurstMode(3143): Not support for HIF_MT yet!
MT7628-->MtAsicSetPiggyBack(796): Not support for HIF_MT yet!
MT7628-->reload DPD from flash , 0x9F = [c000] doReload bit7[0]
MT7628-->CmdLoadDPDDataFromFlash: Channel = 11, DoReload = 0
MT7628-->MtAsicSetTxPreamble(3122): Not support for HIF_MT yet!
MT7628-->MtAsicAddSharedKeyEntry(1344): Not support for HIF_MT yet!
MT7628-->AddTxSType: already registered TxSType (PID = 32, Format = 0
MT7628-->AddTxSType: already registered TxSType (PID = 33, Format = 0
MT7628-->AddTxSType: already registered TxSType (PID = 6, Format = 0
MT7628-->AddTxSType: already registered TxSType (PID = 8, Format = 0
MT7628-->MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
MT7628-->Main bssid = c0:06:c3:ff:ff:ff
MT7628-->MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0x0
MT7628-->MtAsicSetPiggyBack(796): Not support for HIF_MT yet!
MT7628-->[PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0
MT7628-->[PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
mtk_band_steering_netlink_init 245 band steering netlink init ok

MT7628-->[PMF]ap_pmf_init:: apidx=1, MFPC=0, MFPR=0, SHA256=0
mtk_band_steering_netlink_init 245 band steering netlink init ok

MT7628-->MtAsicSetRalinkBurstMode(3143): Not support for HIF_MT yet!
MT7628-->MtAsicSetPiggyBack(796): Not support for HIF_MT yet!
MT7628-->reload DPD from flash , 0x9F = [c000] doReload bit7[0]
MT7628-->CmdLoadDPDDataFromFlash: Channel = 11, DoReload = 0
MT7628-->MtAsicSetTxPreamble(3122): Not support for HIF_MT yet!
MT7628-->MtAsicAddSharedKeyEntry(1344): Not support for HIF_MT yet!
MT7628-->AddTxSType: already registered TxSType (PID = 32, Format = 0
MT7628-->AddTxSType: already registered TxSType (PID = 33, Format = 0
MT7628-->AddTxSType: already registered TxSType (PID = 6, Format = 0
MT7628-->AddTxSType: already registered TxSType (PID = 8, Format = 0
MT7628-->MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
MT7628-->Main bssid = c0:06:c3:ff:ff:ff
MT7628-->Set_ed_chk_proc()::ed_chk=0
MT7628-->mt7628_set_ed_cca: TURN OFF EDCCA  mac 0x10618 = 0xd7083f0f, EDCCA_Status=0
MT7628-->dutylv0 = 100, dutylv1 = 80, dutylv2 = 40, dutylv3 = 20, admiten = 1
MT7628-->Regdutylv0 = 0xfe, Regdutylv1 = 0xcb, Regdutylv2 = 0x65, Regdutylv3 = 0x32
MT7628-->set_thermal_protection_criteria_proc: high_en=1, high_thd = 130, low_en = 1, low_thd = 122, checktimer = 30
MT7628-->set_thermal_protection_criteria_proc: high_en=1, high_thd = 130, low_en = 1, low_thd = 122
[ oal_wlan_ra_set_thermal_protect ] 7900:  set 2.4G thermal protect ok
MT7628-->AddTxSType: already registered TxSType (PID = 32, Format = 0
device ra0 entered promiscuous mode
br0: port 5(ra0) entering forwarding state
br0: port 5(ra0) entering forwarding state
device ra1 entered promiscuous mode
Checking 2.4G caspiflash_ioctl_read, Read from 0x007f0000 length 0x2, ret 0, retlen 0x2
l data...
/bin/sh: wlNetlinkTool: not found
scsi 0:0:0:0: Direct-Access     Linux    File-Stor Gadget 0318 PQ: 0 ANSI: 2
wscd: SSDP UDP PORT = 1900
sd 0:0:0:0: [sda] 143360 512-byte logical blocks: (73.4 MB/70.0 MiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Assuming drive cache: write through
[ checkUdiskReadsd 0:0:0:0: [sda] Assuming drive cache: write through
y ] 398:  [cos] times:5, mount cmd:mount -t auto -o ro /dev/sda /tmp/udisk

 sda:
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Attached SCSI removable disk
FAT: utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
mount: mounting /dev/sdb on /tmp/udisk failed: No such device or address
mount: mounting /dev/sdc on /tmp/udisk failed: No such device or address
killall: flowstat: no process killed
mmmInit():Total mem size=51364, addr=0x0x44f150.
*************************************************************
*************************MMM TABLE DUMP**********************
-------------------------------------------------------------
 poolhead(40)  poolnum  dynamictimes  chainhead  poolend     
-------------------------------------------------------------
 0x44f150        8          0         (nil)     0x45b9f4  
-------------------------------------------------------------
 index  poolhead(20)    size    blocks    free     usage  
-------------------------------------------------------------
  1     0x44f178        32          256       256       0         
  2     0x451590        64          128       128       0         
  3     0x4537a8        128         64        64        0         
  4     0x4558c0        256         32        32        0         
  5     0x457958        512         8         8         0         
  6     0x458990        1024        4         4         0         
  7     0x4599b8        2048        2         2         0         
  8     0x45a9d8        4096        1         1         0         
-------------------------------------------------------------
 index  chainnode(16)   magic    length    prev    next      
-------------------------------------------------------------
(nil)
*************************************************************
killall: mobile: no process killed
killall: qmuxd: no process killed
[ qmiReconnectChangedHandler ] 542:  disconnect... LTE ip connection.

**************************************************
********************config dump*******************
--------------------------------------------------
sef domain                      : n-deventry-gw.tplinkcloud.com
sef port                        : 443
cloud svr default port          : 443
default svr                     : n-devs-gw.tplinkcloud.com
default port                    : 443
default valid time              : 172800
heartbeat interval              : 235000
request timeout                 : 5000
reconnect timewait max          : 1024000
reconnect cachedsvr max times   : 5
reconnect defaultsvr max times  : 5
reconnect random time min       : 2000
reconnect random time max       : 256000
short connect interval          : 259200000
max message number              : 1000
max client number               : 20
service file                    : /tmp/cloud_service.cfg
cer file                        : /etc/cloud/2048_newroot.cer
ssl verify CN                   : 
ssl verify time                 : 1
**************************************************
Mon Oct  1 00:00:27 UTC 2018

[ qmiReconnectChangedHandler ] 552:  start qmuxd
linux_qmi_qmux_io_pwr_up_init.c: Unable to open wakelock file = /sys/power/wake_lock, error [2:No such file or directory]

qmuxd: linux_qmi_read_sysfs_config: couldn't open file /sys/module/f_rmnet/parameters/rmnet_ctl_chqmuxd: 
linux_qmi_read_sysfs_config: couldn't open /sys/module/rmnet/parameters/rmnet_ctl_chlinux_qmi_qmux_if_configure_port_
timeout: failed to open SMD timeout config=/sys/devices/virtual/smdpkt/cdc-wdm0/open_timeout errno [2:No such file or 
directory]linux_qmi_qmux_if_configure_port_timeout: failed to open SMD timeout config=/sys/devices/virtual/smdpkt/cdc-
wdm0/open_timeout errno [2:No such file or directory]qmi_qmux_open_connection: connection is disabled for conn_id=1
qmuxd: opening connection for conn_id=1 [DATA6_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=2
qmuxd: opening connection for conn_id=2 [DATA7_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=3
qmuxd: opening connection for conn_id=3 [DATA8_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=4
qmuxd: opening connection for conn_id=4 [DATA9_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=5
qmuxd: opening connection for conn_id=5 [DATA12_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=6
qmuxd: opening connection for conn_id=6 [DATA13_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=7
qmuxd: opening connection for conn_id=7 [DATA14_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=9
qmuxd: opening connection for conn_id=9 [DATA15_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=10
qmuxd: opening connection for conn_id=10 [DATA16_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=11
qmuxd: opening connection for conn_id=11 [DATA17_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=21
qmuxd: opening connection for conn_id=21 [SDIO_DATA1_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=22
qmuxd: opening connection for conn_id=22 [SDIO_DATA2_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=23
qmuxd: opening connection for conn_id=23 [SDIO_DATA3_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=24
qmuxd: opening connection for conn_id=24 [SDIO_DATA4_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=25
qmuxd: opening connection for conn_id=25 [SDIO_DATA5_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=26
qmuxd: opening connection for conn_id=26 [SDIO_DATA6_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=27
qmuxd: opening connection for conn_id=27 [SDIO_DATA7_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=28
qmuxd: opening connection for conn_id=28 [SDIO_DATA8_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=29
qmuxd: opening connection for conn_id=29 [MDM_DATA1_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=30
qmuxd: opening connection for conn_id=30 [MDM_DATA2_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=31
qmuxd: opening connection for conn_id=31 [MDM_DATA3_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=32
qmuxd: opening connection for conn_id=32 [MDM_DATA4_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=33
qmuxd: opening connection for conn_id=33 [MDM_DATA5_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=34
qmuxd: opening connection for conn_id=34 [MDM_DATA6_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=35
qmuxd: opening connection for conn_id=35 [MDM_DATA7_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=36
qmuxd: opening connection for conn_id=36 [MDM_DATA8_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=48
qmuxd: opening connection for conn_id=48 [SMUX0] failed
qmi_qmux_open_connection: connection is disabled for conn_id=49
qmuxd: opening connection for conn_id=49 [MDM2_DATA1_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=50
qmuxd: opening connection for conn_id=50 [MDM2_DATA2_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=51
qmuxd: opening connection for conn_id=51 [MDM2_DATA3_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=52
qmuxd: opening connection for conn_id=52 [MDM2_DATA4_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=53
qmuxd: opening connection for conn_id=53 [MDM2_DATA5_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=54
qmuxd: opening connection for conn_id=54 [MDM2_DATA6_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=55
qmuxd: opening connection for conn_id=55 [MDM2_DATA7_CNTL] failed
qmi_qmux_open_connection: connection is disabled for conn_id=56
qmuxd: opening connection for conn_id=56 [MDM2_DATA8_CNTL] failed
sendto /var/tmp/9 msg 2004 error No such file or directory ,pid 87
insmod: can't insert '/lib/modules/kmdir/kernel/drivers/net/tun.ko': No such file or directory
insmod: can't insert '/lib/modules/kmdir/kernel/drivers/net/ppp_mppe.ko': No such file or directory
[rsl_initWanLteIntfCfgObj 3596] init LTE module, set flowstat [enableDataLimit 0, enablePaymentDay 0, 
paymentDay 1, limitation 0, warningPercent 90]
iptables: Bad rule (does a matching rule exist in that chain?).
radvd starting
[initProfileList 431] LTE Module: profile num [1], default profile [1], active profile [0]
[initProfileList 433] DM: profile num [0], default profile [0], active profile [0]
[oal_setLteModuleNetworkParam 3007] [band scan] band_support_mask: 1a0000800c5
[oal_setLteModuleNetworkParam 3008] [band scan] lte_category = 4.
[oal_setLteModuleNetworkParam 3032] [band scan] now will set band :0x1a0000800c5.
1538352031 ERROR: Post event to MOBILE server failed, errno = 2 (No such file or directory).
1538352031 ERROR: Client communication with server failed.
[ qmiReconnectChangedHandler ] 556:  start mobile
2018-10-01 00:00:31.600|pid:0|level:0|src/cloud_https.c:131|main | - cloud https client start.
********************config dump*******************
----------------------status----------------------
processid                     : 438
---------------------configure--------------------
loglevel                      : 3
verify host                   : n-device-api.tplinkcloud.com
verify port                   : 0
verify path                   : /v1/validate
post connect timeout          : 20
post transfer timeout         : 20
get connect timeout           : 20
get transfer timeout          : 20
session debug                 : off
cer file                      : /etc/cloud/2048_newroot.cer
cer type                      : 
**************************************************
/var/run/dhcp6c_wwan0.pid: No such file or directory
[ qmiReconnectChangedHandler ] 560:  killall flowstat
1538352032 ERROR: Init raw table success.
killall: flowstat: no process killed
[ qmiReconnectChangedHandler ] 562:  start flowstat
[ qmiReconnectChangedHandler ] 567:  start qmuxd and mobile done.

Query new SMS count success.1538352032 ERROR: New sms count is 0
1538352032 INFO: src/flowstat_main.c(18) main(): LTE flowstat process starts working!
1538352032 ERROR: Post event to MOBILE server failed, errno = 2 (No such file or directory).
1538352032 ERROR: Client communication with server failed.
1538352032 ERROR: src/flowstat_manage.c(77) flowstat_get_wwan_tx_rx_statistics(): Get Rx/Tx flow from qmi failed!
1538352032 ERROR: src/flowstat_manage.c(545) flowstat_start_timer(): +++flowstat: missCount:1 +++

[ getPidFromPidFile ] 112:  Cann't open file: /var/run/zebra.pid.
[ getPidFromPidFile ] 112:  Cann't open file: /var/run/zebra.pid.
[ getPidFromPidFile ] 112:  Cann't open file: /var/run/ripd.pid.
Generating key, this may take a while...
1538352033 USER: Mobile device manager (qmi) initialized OK.
Init QMI services......
[ getPidFromPidFile ] 112:  Cann't open file: /var/run/ripd.pid.
Generating key, this may take a while...
1538352033 USER: Start get voice service object.
1538352033 USER: VOICE Service Object got.
1538352033 USER: VOICE QMI Client Init successfully, handle is 0x00490700.
iptables: Bad rule (does a matching rule exist in that chain?).
1538352033 USER: Mobile device manager (qmi) initialized OK.
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
nf_nat_rtsp v0.6.21 loading
insmod: can't insert '/lib/modules/kmdir/kernel/net/nat/hw_nat/hw_nat.ko': No such file or directory
iptables: Bad rule (does a matching rule exist in that chain?).
ip6tables: Bad rule (does a matching rule exist in that chain?).
ip6tables: Bad rule (does a matching rule exist in that chain?).
enable switch phyport...
Set: phy[0].reg[0] = 3900
Set: phy[1].reg[0] = 3900
Set: phy[2].reg[0] = 3900
Set: phy[3].reg[0] = 3900
Set: phy[4].reg[0] = 3900
Set: phy[0].reg[0] = 3300
Set: phy[1].reg[0] = 3300
Set: phy[2].reg[0] = 3300
Set: phy[3].reg[0] = 3300
Set: phy[4].reg[0] = 3300
resetMiiPortV over.
Set: phy[0].reg[4] = 01e1
Set: phy[0].reg[0] = 3300
Set: phy[1].reg[4] = 01e1
Set: phy[1].reg[0] = 3300
Set: phy[2].reg[4] = 01e1
Set: phy[2].reg[0] = 3300
Set: phy[3].reg[4] = 01e1
Set: phy[3].reg[0] = 3300
Set: phy[4].reg[4] = 01e1
Set: phy[4].reg[0] = 3300
turn off flow control over.
[ cos_init ] 550:  Start ok, enable console input and output!
pidof mobile > /var/tmp/tmppidof
echo -1000 > /proc/517/oom_score_adj
1538352036 USER: Not registered, searching!
Public key portion is:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQCAaLnayaG24kygsE+wjEIw69Oo60FctXmTvZMVmTcgin3U4OzFmQyz/
EgbLYHVrpMIfOHmHKezsMxyyyPqKqyoH9RqFWyCVX+QzjNf4ZNNf7Ed/f1j4PTDU/hIgLqOiQF2lZv1i9I2J8H2PH8qpGC/
GnAhtDH/VIhmYk9lbzvtaw== admin@TL-MR6400
Fingerprint: md5 4d:31:34:bd:6c:67:da:5a:19:f7:93:9b:b1:92:2e:e9
pidof qmuxd > /var/tmp/tmppidof
echo -1000 > /proc/481/oom_score_adj
pidof httpd > /var/tmp/tmppidof
echo -1000 > /proc/474/oom_score_adj
1538352037 ERROR: 0x0000002F QMI_ERR_UNKNOWN
1538352037 ERROR: Failed to set the primary client (0).
pidof dhcpd > /var/tmp/tmppidof
1538352037 ERROR: 0x00000034 QMI_ERR_DEVICE_NOT_READY
1538352037 ERROR: Failed to get smsc address (0).
echo -1000 > /proc/505/oom_score_adj
1538352038 USER: The service status is limited.
1538352038 USER: Network type is WCDMA.
/bin/sh: can't create /proc/tplink/led_4g+: nonexistent directory
spiflash_ioctl_read, Read from 0x007ef600 length 0xf, ret 0, retlen 0xf
Public key portion is:
ssh-dss AAAAB3NzaC1kc3MAAACBAOt0cGiUn1GWl5npBoDPfDmsnWyA6E07tSyzR41atOUpdEagBXdPTIupXwAwAk/jDp43z7bHM87T6bFVw94N2Ab5dJzj
VRmF194b16RgpBdIe7eCFqBt8utrAHYYk06veG/naAG5I8diXFc1TbkaJMTRL9l3Dzj5BgC7yBPGagQPAAAAFQDMC/dW93k/0CbwVVDHcMT/Oj4LcQAAAIBSH5T
cWx70msaCH7q7cgZr2UX9sIMKCAPQL4Sy99Sj61fNL4ubRHKsiu+7GLJ0+e/pbN5GZAJZ8Rmleg1qj2NFLakMXq/i6uPdoPlOzq3RzX/CI95I3VPYo5+43taqgv
Ys1YpLxfEH2Gq4EIUVpmZiN+Gep4v+fWQgImsKEB9c2gAAAIBxVkrbJOo0Ripj7xXCqMzvlvT1MsSk29fFIO1FWgIQAkFD2sEZo/Voie/0EUAOnBm13LlTtEUf
MgTAEPAiP5IisrDyg2MC5XKCrwVnAXMTvtJIHOnikDiTcGFceEtHLZIExScpe8faTekY+voFRyzQJs8jpKGJE+Iir5RW83NQIw== admin@TL-MR6400

Fingerprint: md5 a3:3b:ee:e8:93:0a:14:39:21:88:3e:9e:48:cb:b2:0a
open DNS error: No such file or directory
Mon Oct  1 00:01:02 UTC 2018

Mon Oct  1 00:01:02 UTC 2018

starting pid 88, tty '': '/sbin/getty -L ttyS1 115200 vt100'

TL-MR6400 login: admin
Password: 
Oct  1 00:01:25 login[88]: root login on 'ttyS1'

~ # df
Filesystem           1024-blocks    Used Available Use% Mounted on
/dev/root                 6400      6400         0 100% /
/dev/sda                 70574      2590     67984   4% /tmp/udisk
~ # free
             total         used         free       shared      buffers
Mem:         61220        29096        32124            0         1772
-/+ buffers:              27324        33896
Swap:            0            0            0
~ # cat /proc/cpuinfo 
system type		: MT7628
processor		: 0
cpu model		: MIPS 24Kc V5.5
BogoMIPS		: 386.04
wait instruction	: yes
microsecond timers	: yes
tlb_entries		: 32
extra interrupt vector	: yes
hardware watchpoint	: yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
ASEs implemented	: mips16 dsp
shadow register sets	: 1
core			: 0
VCED exceptions		: not available
VCEI exceptions		: not available

~ # 
~ # 
QLog                 flowstat             ping6
[                    free                 poweroff
[[                   fuser                pppd
adb                  gen_key              pptpctrl
arping               getty                pptpd
ash                  grep                 ps
ated                 halt                 qmuxd
ated_tp              head                 radvd
backupcfg            httpd                reboot
basename             ifconfig             reg
bcrelay              igmpd                ripd
blkid                init                 rm
brctl                insmod               rmmod
busybox              ip                   route
cat                  ip6tables            rt2860apd
cert_write           ipcrm                rtinicapd
chmod                ipcs                 scp
cli                  iptables             sed
cloud-brd            iqos-db-loader       sh
cloud_client         iqos-db-parser       sleep
cloud_https          iwconfig             snmpd
cmmsyslogc           iwpriv               ssl_test
cmmsyslogd           kill                 switch
config-mii.sh        killall              systemd
cos                  ln                   tail
cp                   logger               tar
crypto_test          login                taskset
cut                  ls                   tc
cwmp                 lsmod                tdpd
date                 mbedtls_aes-128-ecb  telnet
df                   md5sum               telnetd
dhcp6c               mii_mgr              test
dhcp6ctl             mii_mgr_cl45         tftp
dhcp6s               mkdir                tmpd
dhcpc                mldProxy             top
dhcpd                mobile               touch
diagTool             mobile_cli           tr
dnsProxy             mount                umount
dropbear             mpstat               uname
dropbearkey          netstat              unzip
dropbearmulti        noipdns              upnpd
dyndns               npd6                 uptime
ebtables             ntpc                 vconfig
echo                 openvpn              wportalctrl
egrep                ovpn_keyGen          wscd
env                  pfcached             xl2tpd
fgrep                pidof                xtables-multi
find                 ping                 zebra

~ # #busybox
BusyBox v1.23.2 (2021-01-15 17:13:42 CST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2012.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
   or: busybox --list
   or: function [arguments]...

	BusyBox is a multi-call binary that combines many common Unix
	utilities into a single executable.  Most people will create a
	link to busybox for each function they wish to use and BusyBox
	will act like whatever it was invoked as.

Currently defined functions:
	[, [[, arping, ash, basename, blkid, brctl, cat, chmod, cp, cut, date,
	df, echo, egrep, env, fgrep, find, free, fuser, getty, grep, halt,
	head, ifconfig, init, insmod, ipcrm, ipcs, kill, killall, linuxrc, ln,
	logger, login, ls, lsmod, md5sum, mkdir, mount, mpstat, netstat, pidof,
	ping, ping6, poweroff, ps, reboot, rm, rmmod, route, sed, sh, sleep,
	tail, tar, taskset, telnet, telnetd, test, tftp, top, touch, tr,
	umount, uname, unzip, uptime, vconfig

~ # 
~ # netstat -atup
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:20002         0.0.0.0:*               LISTEN      575/tmpd
tcp        0      0 0.0.0.0:1900            0.0.0.0:*               LISTEN      485/upnpd
tcp        0      0 127.0.0.1:5037          0.0.0.0:*               LISTEN      389/adb
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN      700/dropbear
tcp        0      0 :::http                 :::*                    LISTEN      474/httpd
tcp        0      0 :::ssh                  :::*                    LISTEN      700/dropbear
tcp        0      0 :::telnet               :::*                    LISTEN      80/telnetd
tcp        0      0 ::1:5531                :::*                    LISTEN      568/dhcp6c
udp        0      0 127.0.0.1:52750         0.0.0.0:*                           485/upnpd
udp        0      0 0.0.0.0:20002           0.0.0.0:*                           531/tdpd
udp        0      0 0.0.0.0:40375           0.0.0.0:*                           485/upnpd
udp        0      0 0.0.0.0:bootps          0.0.0.0:*                           505/dhcpd
udp        0      0 0.0.0.0:1900            0.0.0.0:*                           485/upnpd
udp        0      0 :::dhcpv6-client        :::*                                568/dhcp6c
~ # 

See also