SmartBOX Pro / SmartBOX Turbo + - discussion -savagemessiahzine.com

> savagemessiahzine.com >Computers and peripherals >Internet and network equipment

SmartBOX Pro / SmartBOX Turbo + - discussion | [wifirouter]: 300Mb \ s - 1200Mb \ s + 5x1Gb | x1

28.02.19, 20:36 | #1
●
Moderators
Rep: (256)

Description

Smart Box Pro

Router Beeline Smart Box Pro is equipped with a dual-band Wi-Fi transmitter (2.4GHz + 5GHz) with two internal antennas, which allows you to receive a reliable signal all over the apartment. It has four gigabit LAN outputs for connecting devices via cable. Provides speed in a wireless network up to 867 Mbps. And also has two USB ports for connecting external devices.

SmartBox TURBO +

Beeline WiFi-router вЂњSmartBox TURBO +вЂќ was created specifically for simultaneous connection of several users at high speed. With it, you can create your own home network and access the Internet from an unlimited number of devices. The built-in Wi-Fi wireless access point of the new generation with an increased radius of operation and the number of antennas provides connection to вЂњSmartBoxTURBO +вЂќ laptops, game consoles, media players and other network devices. A convenient quick setup interface will help set up Internet access and connect the Beeline TV prefix without asking for help from specialists.

Specifications

Smartbox pro

Manuf / OEM / ODM SerComm
PCB ID: AWI00E-1.6
Power: 12 VDC, 1.5 A
CPU: MediaTek MT7621AT (880 MHz, 2 cores)
FLA: 256 MiB (ESMT F59L2G81A-25T)
RAM: 256 MiB (Nanya NT5CB128M16FP-DI)
USB: x2 3.0
Mini PCIe slots: x1
JTAG: 14-pin header, J3
Serial: 4-pin header, J4
WI1 chip: MediaTek MT7602EN bgn MIMO 2x2: 2
WI2 chip: MediaTek MT7612EN an + ac MIMO 2x2: 2
ETH / Switch: MediaTek MT7621AT x5 10/100/1000
LAN ports: x4 10/100/1000
WAN ports: x1 10/100/1000
Stock bootloader: U-Boot UBI
Stock FW OS: Linux

SmartBOX Turbo +

Manuf / OEM / ODM SerComm
PCB ID: CQR00B-1.6
Power: 12 VDC, 1.5 A
CPU: MediaTek MT7621AT (880 MHz, 2 cores)
FLA: 128 MiB .....
RAM: 128 MiB (NANYA nt5cc64m16gp-di)
USB: x1 3.0
JTAG: .....
Serial: 4-pin header, J4
WI1 chip: MediaTek MT7603EN bgn MIMO 2x2: 2
WI2 chip: MediaTek MT7615N an + ac MIMO 2x2: 2
ETH / Switch: MediaTek MT7621AT x5 10/100/1000
LAN ports: x4 10/100/1000
WAN ports: x1 10/100/1000
Stock bootloader: U-Boot
Stock FW OS: Linux

Photo board

Smartbox pro

SmartBOX Turbo +

Firmware

Smartbox pro

Stock 2.0.19

SmartBOX Turbo +

Stock 1.0.12
Collection of information on alternative firmware
Running Beeline stock firmware on Breed loader, for SmartBOX Turbo +

Useful information

#IMPORTANT [Cooling] Information about finalization.

Smartbox pro

# Account of SuperUser ... Login: SuperUser Password: Beeline $ martB0x or serial number (according to the article in Muska)
# Blog Beeline on HabrГ©

Dump SmartBox Pro, firmware stock.

Full dump SmartBox Pro, firmware stock, TSOP-48 NAND. Courtesy ofmilov_valentin.

Dump_SB-Pro_Nand.7z(28.17 MB)
According to the author: "To verify all the rules. ProMan programmer. The firmware is merged on the working machine"

SmartBOX Turbo +

# SuperUser account ... Login: SuperUser Password: Serial number (verified by hand)

Command execution results:

cat / proc / mtd

dev: size erasesize name
mtd0: 00100000 00020000 "Boot Loader"
mtd1: 00100000 00020000 "dynamic partition map"
mtd2: 00100000 00020000 "Factory"
mtd3: 00100000 00020000 "Boot Flag"
mtd4: 00600000 00020000 "Kernel 1"
mtd5: 00640000 00020000 "Kernel 2"
mtd6: 02000000 00020000 "File System 1"
mtd7: 02000000 00020000 "File System 2"
mtd8: 01400000 00020000 "Configuration / log"
mtd9: 01b40000 00020000 "application tmp buffer (Ftool)"
mtd10: 00000000 00000000 "bad block reserved" cat / proc / mtd-

cat / proc / cpuinfo

system type: MT7621
machine: Unknown
processor: 0
cpu model: MIPS 1004Kc V2.15
BogoMIPS: 583.68
wait instruction: yes
microsecond timers: yes
tlb_entries: 32
extra interrupt vector: yes
hardware watchpoint: yes, count: 4, address / irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa: mips1 mips2 mips32r1 mips32r2
ASEs implemented: mips16 dsp mt
shadow register sets: 1
kscratch registers: 0
core: 0
VPE: 0
VCED exceptions: not available
VCEI exceptions: not available

processor: 1
cpu model: MIPS 1004Kc V2.15
BogoMIPS: 583.68
wait instruction: yes
microsecond timers: yes
tlb_entries: 32
extra interrupt vector: yes
hardware watchpoint: yes, count: 4, address / irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa: mips1 mips2 mips32r1 mips32r2
ASEs implemented: mips16 dsp mt
shadow register sets: 1
kscratch registers: 0
core: 0
VPE: 1
VCED exceptions: not available
VCEI exceptions: not available

processor: 2
cpu model: MIPS 1004Kc V2.15
BogoMIPS: 583.68
wait instruction: yes
microsecond timers: yes
tlb_entries: 32
extra interrupt vector: yes
hardware watchpoint: yes, count: 4, address / irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa: mips1 mips2 mips32r1 mips32r2
ASEs implemented: mips16 dsp mt
shadow register sets: 1
kscratch registers: 0
core: 1
VPE: 0
VCED exceptions: not available
VCEI exceptions: not available

processor: 3
cpu model: MIPS 1004Kc V2.15
BogoMIPS: 583.68
wait instruction: yes
microsecond timers: yes
tlb_entries: 32
extra interrupt vector: yes
hardware watchpoint: yes, count: 4, address / irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa: mips1 mips2 mips32r1 mips32r2
ASEs implemented: mips16 dsp mt
shadow register sets: 1
kscratch registers: 0
core: 1
VPE: 1
VCED exceptions: not available
VCEI exceptions: not available

cat / proc / meminfo

MemTotal: 119368 kB
MemFree: 61748 kB
Buffers: 0 kB
Cached: 11916 kB
SwapCached: 0 kB
Active: 11896 kB
Inactive: 6472 kB
Active (anon): 7080 kB
Inactive (anon): 0 kB
Active (file): 4816 kB
Inactive (file): 6472 kB
Unevictable: 808 kB
Mlocked: 808 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 7292 kB
Mapped: 2652 kB
Shmem: 0 kB
Slab: 21584 kB
SReclaimable: 776 kB
SUnreclaim: 20808 kB
KernelStack: 752 kB
PageTables: 576 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 59684 kB
Committed_AS: 24016 kB
VmallocTotal: 1048372 kB
VmallocUsed: 12272 kB
VmallocChunk: 978816 kB

UART pinout and port settings

J4>GND - TX -~~VCC~~- rx. . . 57600 - 8 - N - 1
R53 R54 finish at your own risk:SmartBOX Pro / SmartBOX Turbo + - discussion [Searching] (Post evzomsk # 83527064)

Log UART

Normal download - "explosive mixture"

===================================================================
MT7621 stage1 code 10:33:11 (ASIC)
CPU = 50000000 HZ BUS = 16666666 HZ
==================================================================
Change MPLL source from XTAL to CR ...
do MEMPLL setting ..
MEMPLL Config: 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL3 FB_DL: 0x0, 1/0 = 952/72 01000000
PLL4 FB_DL: 0xe, 1/0 = 534/490 39000000
PLL2 FB_DL: 0x15, 1/0 = 600/424 55000000
do DDR setting .. [00320381]
Apply DDR3 Setting ... (use customer AC)
0 8 16 24 32 40 48 56 64 72 80 88 96 104 11 2 120
-------------------------------------------------------------------------- ------
0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000E: | 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1
000F: | 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1
0010:| 1 1 1 1 1 1 1 1 1 1 1 0 0 0 0 0
0011:| 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001A: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001B: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001C: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001D: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001E: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001F: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
rank 0 coarse = 16
rank 0 fine = 40
B: | 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0
opt_dle value: 9
DRAMC_R0DELDLY [018] = 00002121
==================================================================
RX DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit | 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 12 6 13 9 11 6 13 5 1 11
10 | 6 12 7 11 5 10
--------------------------------------

==================================================================
2.dqs window
x = pass dqs delay value (min ~ max) center
y = 0-7bit DQ of every group
input delay: DQS0 = 33 DQS1 = 33
==================================================================
bit DQS0 bit DQS1
0 (1~63)32 8 (1~60)30
1 (1~61)31 9 (1~63)32
2 (1~64)32 10 (2~65)33
3 (1~60)30 11 (1~61)31
4 (1~62)31 12 (1~65)33
5 (1~64)32 13 (1~63)32
6 (1~64)32 14 (1~65)33
7 (1~66)33 15 (1~62)31
==================================================================
3.dq delay value last
==================================================================
bit | 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 13 8 14 12 13 7 14 5 4 12
10 | 6 14 7 12 5 12
==================================================================
==================================================================
TX perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass [0] = 15, finish count = 1
dqs_perbyte_dly.last_dqsdly_pass [1] = 15, finish count = 2
DQ loop = 15, cmp_err_1 = ffff0080
dqs_perbyte_dly.last_dqdly_pass [1] = 15, finish count = 1
DQ loop = 14, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass [0] = 14, finish count = 2
byte: 0, (DQS, DQ) = (8.8)
byte: 1, (DQS, DQ) = (8.8)
20, data: 88
[EMI] DRAMC calibration passed

===================================================================
MT7621 stage1 code done
CPU = 50000000 HZ BUS = 16666666 HZ
===================================================================

U-Boot 1.1.3 (Mar 6 2018 - 19:39:59)

Board: Ralink APSoC DRAM: 128 MB
rt2880 uboot v0.00e04 05/25/2006
SERIAL_CLOCK_DIVISOR = 16
kaiker , CONFIG_BAUDRATE = 57600
SDRAM SIZE: 08000000
Top of RAM usable for U-Boot at: 88000000
Reserving 426k for U-Boot at: 87f94000
Reserving 1028k for malloc () at: 87e93000
Reserving 44 Bytes for Board Info at 87e92fd4
Reserving 36 Bytes for Global Data at: 87e92fb0
Reserving 128k for boot params () at: 87e72fb0
Stack Pointer at: 87e72f98
relocate_code Pointer at: 87f94000

Config XHCI 40M PLL
Now running in RAM - U-Boot at: 87f94000

monitor_flash_len = 117844
Command "mdio": 0xa0206b28 =>0x87f9ab28
Command "nand": 0xa020c460 =>0x87fa0460
Command "reset": 0xa0215ecc =>0x87fa9ecc
Command "go": 0xa020de0c =>0x87fa1e0c
Command "bootm": 0xa020e668 =>0x87fa2668
Command "loadb": 0xa020f328 =>0x87fa3328
Command "tftpboot": 0xa020f958 =>0x87fa3958
Command "nm": 0xa020ffe4 =>0x87fa3fe4
Command "mm": 0xa0210048 =>0x87fa4048
Command "md": 0xa02100ac =>0x87fa40ac
Command "saveenv": 0xa0210624 =>0x87fa4624
Command "setenv": 0xa0210f94 =>0x87fa4f94
Command "printenv": 0xa0210674 =>0x87fa4674
Command "?": 0xa0211268 =>0x87fa5268
Command "help": 0xa0211268 =>0x87fa5268
Command "version": 0xa0211128 =>0x87fa5128
Command "sc_boot": 0xa0213ed4 =>0x87fa7ed4
Command "sc_nand": 0xa0213f0c =>0x87fa7f0c
Command "sc_eth_test": 0xa0213f48 =>0x87fa7f48
Command "sc_phy": 0xa0213f84 =>0x87fa7f84
Command "sc_time": 0xa0213fc0 =>0x87fa7fc0
Command "sc_btver": 0xa0213ff8 =>0x87fa7ff8
Command "sc_fl_map": 0xa0214034 =>0x87fa8034
Command "sc_endian": 0xa0214070 =>0x87fa8070
Command "sc_ramtest": 0xa02140ac =>0x87fa80ac
Command "sc_gpio": 0xa02140e8 =>0x87fa80e8
Command "sc_led": 0xa0214124 =>0x87fa8124
Command "sc_dl": 0xa0214160 =>0x87fa8160
Allocate 16 byte aligned buffer: 87fca810
Enable NFI Clock
# MTK NAND #: Use HW ECC
NAND ID [C2 F1 80 95 02]
Device found in MTK table, ID: c2f1, EXT_ID: 809502
Support this Device in MTK table! c2f1
select_chip
[NAND] select ecc bit: 4, sparesize: 64 spare_per_sector = 16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
[mtk_nand] probe successfully!
mtd->writesize = 2048 mtd->oobsize = 64, mtd->erasesize = 131072 devinfo.iowidth = 8
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode = 3 OCP Ratio = 1/3
Flash component: NAND Flash
Date: Mar 6 2018 Time: 19: 39: 59
============================================
icache: sets: 256, ways: 4, linesz: 32, total: 32768
dcache: sets: 256, ways: 4, linesz: 32, total: 32768

##### The CPU freq = 880 MHZ ####
estimate memory size = 128 Mbytes
# Reset_MT7530
set LAN / WAN WLLLL

Load Standalone from 40000
SC_DEBUG: Nand Partition Table Magic Found at 100,000.

******************************************
Uboot StandAlone Entry
******************************************
GPIO init
*********************************************************
Boot Command Interface
********************************************************* 0
SC_DEBUG: Nand Partition Table Magic Found at 100,000.

******************************************
Uboot StandAlone Entry
******************************************

***************************************************
Sercomm Boot Version 2.0.0.0, at Mar 6 2018, 19:39:56

***************************************************
SC_DEBUG: Nand Partition Table Magic Found at 100,000.
Entering Firmware: Everything is OK.

*************************************
Boot Flag: Sercomm1-
*************************************

Kernel image header:
Image Addr: 00A00100
Image Len: 003A9C2F
Image CRC: 18227026
Start to calculate kernel_crc from 0x00a00100 ....
Bad block detected at 0xa80000, first byte of oob is 0x00
Bad block detected at 0xac0000, first byte of oob is 0x00
Kernel CRC verify OK!
Kernel Addr: 0xbca00100
## Booting image at bca00100 ...
Image Name: Linux Kernel Image
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 3841007 Bytes = 3.7 MB
Load Address: 81001000
Entry Point: 8162c9e0
ranand_read: skip reading a fact bad block a80000 ->aa0000
ranand_read: skip reading a fact bad block ac0000 ->ae0000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
boot_count2 is FF
write 1 to boot_count2
ranand_erase: start: 320000, len: 20000
.kernel addr: 0xBCA00100
No initrd
## Transferring control to Linux (at address 8162c9e0) ...
## Giving linux memsize in MB, 128

Starting kernel ...

LINUX started ...

THIS IS ASIC

SDK 5.0.S.0
Linux version 3.10.14+ (phil @ ubuntu) (gcc version 4.6.3 (Buildroot 2012.11.1))
...

Loader Commands

******************************************
Uboot StandAlone Entry
******************************************
GPIO init
*********************************************************
Boot Command Interface
********************************************************* 0

U-Boot 1.1.3 (Mar 6 2018 - 19:39:59)
MT7621 #?
? - alias for 'help'
bootm - boot application image from memory
go - start application at address 'addr'
help - print online help
loadb - load binary file over serial line (kermit mode)
md - memory display
mdio - Ralink PHY register R / W command !!
mm - memory modify (auto-incrementing)
nand - nand command
nm - memory modify (constant address)
printenv- print environment variables
reset - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
sc_boot - Sercomm boot kernel command
sc_btver- Sercomm display bootloader version command
sc_dl - Sercomm upgrade command
sc_endian - Sercomm debug command to test current system endian
sc_eth_test - Sercomm: ethernet test command
sc_fl_map - Sercomm dump flash map command
sc_gpio - Sercomm gpio command
sc_led - Sercomm led command
sc_nand - Sercomm nand command
sc_phy - Sercomm R / W PHY register
sc_ramtest - Sercomm DRAM test command
sc_time - Sercomm timer command
setenv - set environment variables
tftpboot boot image via network using TFTP protocol
version - print monitor version
MT7621 #

tftp:almost as in Ralinka, BUT ... ??? test.bin

MT7621 # tftpboot

NetLoop, call eth_halt!

NetLoop, call eth_init!
Trying Eth0 (10/100-M)

Waitting for RX_DMA_BUSY status Start ... done

ETH_STATE_ACTIVE !!
*** Warning: no boot file name; using 'test.bin'
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'test.bin'.

TIMEOUT_COUNT = 10, Load address: 0x84000000

With a clamped reset

===================================================================
MT7621 stage1 code 10:33:11 (ASIC)
CPU = 50000000 HZ BUS = 16666666 HZ
==================================================================
Change MPLL source from XTAL to CR ...
do MEMPLL setting ..
MEMPLL Config: 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL3 FB_DL: 0x0, 1/0 = 941/83 01000000
PLL4 FB_DL: 0xe, 1/0 = 580/444 39000000
PLL2 FB_DL: 0x15, 1/0 = 547/477 55000000
do DDR setting .. [00320381]
Apply DDR3 Setting ... (use customer AC)
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
--------------------------------------------------------------------------------
0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000E: | 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1
000F: | 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1
0010:| 1 1 1 1 1 1 1 1 1 1 1 0 0 0 0 0
0011:| 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001A: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001B: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001C: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001D: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001E: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001F: | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
rank 0 coarse = 16
rank 0 fine = 40
B: | 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0
opt_dle value: 9
DRAMC_R0DELDLY [018] = 00002121
==================================================================
RX DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit | 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 12 6 13 9 11 6 13 5 1 11
10 | 6 12 7 11 5 10
--------------------------------------

==================================================================
2.dqs window
x = pass dqs delay value (min ~ max) center
y = 0-7bit DQ of every group
input delay: DQS0 = 33 DQS1 = 33
==================================================================
bit DQS0 bit DQS1
0 (1~64)32 8 (1~60)30
1 (1~60)30 9 (1~64)32
2 (1~64)32 10 (2~65)33
3 (1~60)30 11 (1~61)31
4 (1~62)31 12 (1~65)33
5 (1~64)32 13 (1~63)32
6 (1~64)32 14 (1~65)33
7 (1~65)33 15 (1~63)32
==================================================================
3.dq delay value last
==================================================================
bit | 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 13 9 14 12 13 7 14 5 4 12
10 | 6 14 7 12 5 11
==================================================================
==================================================================
TX perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass [0] = 15, finish count = 1
dqs_perbyte_dly.last_dqsdly_pass [1] = 15, finish count = 2
DQ loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass [0] = 15, finish count = 1
dqs_perbyte_dly.last_dqdly_pass [1] = 15, finish count = 2
byte: 0, (DQS, DQ) = (8.8)
byte: 1, (DQS, DQ) = (8.8)
20, data: 88
[EMI] DRAMC calibration passed

===================================================================
MT7621 stage1 code done
CPU = 50000000 HZ BUS = 16666666 HZ
===================================================================

U-Boot 1.1.3 (Mar 6 2018 - 19:39:59)

Board: Ralink APSoC DRAM: 128 MB
rt2880 uboot v0.00e04 05/25/2006
SERIAL_CLOCK_DIVISOR = 16
kaiker , CONFIG_BAUDRATE = 57600
SDRAM SIZE: 08000000
Top of RAM usable for U-Boot at: 88000000
Reserving 426k for U-Boot at: 87f94000
Reserving 1028k for malloc () at: 87e93000
Reserving 44 Bytes for Board Info at 87e92fd4
Reserving 36 Bytes for Global Data at: 87e92fb0
Reserving 128k for boot params () at: 87e72fb0
Stack Pointer at: 87e72f98
relocate_code Pointer at: 87f94000

Config XHCI 40M PLL
Now running in RAM - U-Boot at: 87f94000

monitor_flash_len = 117844
Command "mdio": 0xa0206b28 =>0x87f9ab28
Command "nand": 0xa020c460 =>0x87fa0460
Command "reset": 0xa0215ecc =>0x87fa9ecc
Command "go": 0xa020de0c =>0x87fa1e0c
Command "bootm": 0xa020e668 =>0x87fa2668
Command "loadb": 0xa020f328 =>0x87fa3328
Command "tftpboot": 0xa020f958 =>0x87fa3958
Command "nm": 0xa020ffe4 =>0x87fa3fe4
Command "mm": 0xa0210048 =>0x87fa4048
Command "md": 0xa02100ac =>0x87fa40ac
Command "saveenv": 0xa0210624 =>0x87fa4624
Command "setenv": 0xa0210f94 =>0x87fa4f94
Command "printenv": 0xa0210674 =>0x87fa4674
Command "?": 0xa0211268 =>0x87fa5268
Command "help": 0xa0211268 =>0x87fa5268
Command "version": 0xa0211128 =>0x87fa5128
Command "sc_boot": 0xa0213ed4 =>0x87fa7ed4
Command "sc_nand": 0xa0213f0c =>0x87fa7f0c
Command "sc_eth_test": 0xa0213f48 =>0x87fa7f48
Command "sc_phy": 0xa0213f84 =>0x87fa7f84
Command "sc_time": 0xa0213fc0 =>0x87fa7fc0
Command "sc_btver": 0xa0213ff8 =>0x87fa7ff8
Command "sc_fl_map": 0xa0214034 =>0x87fa8034
Command "sc_endian": 0xa0214070 =>0x87fa8070
Command "sc_ramtest": 0xa02140ac =>0x87fa80ac
Command "sc_gpio": 0xa02140e8 =>0x87fa80e8
Command "sc_led": 0xa0214124 =>0x87fa8124
Command "sc_dl": 0xa0214160 =>0x87fa8160
Allocate 16 byte aligned buffer: 87fca810
Enable NFI Clock
# MTK NAND #: Use HW ECC
NAND ID [C2 F1 80 95 02]
Device found in MTK table, ID: c2f1, EXT_ID: 809502
Support this Device in MTK table! c2f1
select_chip
[NAND] select ecc bit: 4, sparesize: 64 spare_per_sector = 16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
[mtk_nand] probe successfully!
mtd->writesize = 2048 mtd->oobsize = 64, mtd->erasesize = 131072 devinfo.iowidth = 8
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode = 3 OCP Ratio = 1/3
Flash component: NAND Flash
Date: Mar 6 2018 Time: 19: 39: 59
============================================
icache: sets: 256, ways: 4, linesz: 32, total: 32768
dcache: sets: 256, ways: 4, linesz: 32, total: 32768

##### The CPU freq = 880 MHZ ####
estimate memory size = 128 Mbytes
# Reset_MT7530
set LAN / WAN WLLLL

Load Standalone from 40000
SC_DEBUG: Nand Partition Table Magic Found at 100,000.

******************************************
Uboot StandAlone Entry
******************************************
GPIO init
*********************************************************
Boot Command Interface
********************************************************* 0
SC_DEBUG: Nand Partition Table Magic Found at 100,000.

******************************************
Uboot StandAlone Entry
******************************************

***************************************************
Sercomm Boot Version 2.0.0.0, at Mar 6 2018, 19:39:56

***************************************************
SC_DEBUG: Nand Partition Table Magic Found at 100,000.
Reset Button is pressed!
DEBUG_INF: =============================================== ===
DEBUG_INF: Sercomm Upgrade (Module Ver 2.16.01.31) Start!
DEBUG_INF: =============================================== ===
Trying Eth0 (10/100-M)

Waitting for RX_DMA_BUSY status Start ... done

ETH_STATE_ACTIVE !!
ECC bytes for page: 28
DEBUG_INF: ecc bytes 28
DEBUG_DBG:<boot-version>has been read before erased!
DEBUG_DBG:<boot-pid>has been read before erased!
DEBUG_DBG:<calibration1>has been read before erased!
DEBUG_DBG:<calibration2>has been read before erased!
DEBUG_DBG:<mac>has been read before erased!
DEBUG_DBG:<CSN>has been read before erased!
DEBUG_DBG:<language ID>has been read before erased!
DEBUG_DBG:<Domain ID>has been read before erased!
DEBUG_DBG:<PCBASN>has been read before erased!
DEBUG_DBG:<PIN>has been read before erased!
DEBUG_DBG:<SSID>has been read before erased!
DEBUG_DBG:<Passphrase>has been read before erased!
DEBUG_DBG:<boot_flag>has been read before erased!
DEBUG_DBG:<boot_count1>has been read before erased!
DEBUG_DBG:<boot_count2>has been read before erased!
DEBUG_DBG:<header_mian_kernel>has been read before erased!
DEBUG_DBG:<header_bk_kernel>has been read before erased!
DEBUG_DBG: ============================================
DEBUG_DBG: All parameters information listed:
DEBUG_DBG: ============================================
DEBUG_DBG: Partition Index 0, Name<u-boot>:
DEBUG_DBG: -----------------------------------
DEBUG_DBG: Param Name good_blk_idx offs_in_blk length Action of Erase-All
DEBUG_DBG: boot-version 4 ffb0 4 UPDATED
DEBUG_DBG: boot-pid 4 ffba 46 UPDATED
DEBUG_DBG:
DEBUG_DBG: Partition Index 2, Name<factory-data>:
DEBUG_DBG: -----------------------------------
DEBUG_DBG: Param Name good_blk_idx offs_in_blk length Action of Erase-All
DEBUG_DBG: calibration1 0 0 1000 KEPT
DEBUG_DBG: calibration2 0 8000 1000 KEPT
DEBUG_DBG: mac 1 1000 6 KEPT
DEBUG_DBG: CSN 1 1010 with KEPT
DEBUG_DBG: language ID 1 1040 4 KEPT
DEBUG_DBG: Domain ID 1 1050 4 KEPT
DEBUG_DBG: PCBASN 1 1060 with KEPT
DEBUG_DBG: PIN 1 1070 8 KEPT
DEBUG_DBG: SSID 1 1080 20 KEPT
DEBUG_DBG: Passphrase 1 10a0 40 KEPT
DEBUG_DBG:
DEBUG_DBG: Partition Index 3, Name<dual-flag>:
DEBUG_DBG: -----------------------------------
DEBUG_DBG: Param Name good_blk_idx offs_in_blk length Action of Erase-All
DEBUG_DBG: boot_flag 0 0 8 UPDATED
DEBUG_DBG: boot_count1 1 1 1 UPDATED
DEBUG_DBG: boot_count2 1 2 1 UPDATED
DEBUG_DBG:
DEBUG_DBG: Partition Index 4, Name<uImage1>:
DEBUG_DBG: -----------------------------------
DEBUG_DBG: Param Name good_blk_idx offs_in_blk length Action of Erase-All
DEBUG_DBG: header_mian_kernel 0 0 100 UPDATED
DEBUG_DBG:
DEBUG_DBG: Partition Index 5, Name<uImage2>:
DEBUG_DBG: -----------------------------------
DEBUG_DBG: Param Name good_blk_idx offs_in_blk length Action of Erase-All
DEBUG_DBG: header_bk_kernel 0 0 100 UPDATED
DEBUG_DBG:
DEBUG_DBG: ============================================
DEBUG_DBG: init state, listening
DEBUG_DBG: state, listening
DEBUG_DBG: event, assign / set erase mode / console break
DEBUG_DBG: state, exit

Then the red diodes start flashing, the system stops.

DEBUG_INF: Console Ctrl C breaks dl process!
After sending Ctrl + C, the standard menu of the Ralink / Mediatek loader appears:

Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
It flies instantly - nothing can be chosen

default: 3

3: System Boot system code via Flash.
## Booting image at bc400000 ...

Current changes in the header

03/19/2019 Info 3.0 USB Corrected
03/20/2019 Added UART SB Turbo + logs, pinout and port settings
04/02/2019 Added information about the refinement [Cooling]
04/08/2019 Dump of SmartBox Pro nand tsop-48 stock added

For questions about filling the caps, please contact the section moderators via the buttonA COMPLAINTunder the messages

Post has been editedAndrewP_1 - 07.07.19, 10:57

Reason for editing: Running Beeline stock firmware on Breed loader, for SmartBOX Turbo +

01.03.19, 17:59 | #2
●
Friendssavagemessiahzine.com
Rep: (19)

evzomsk as soon as I recover my burned food, I will put the experience on the connection to uart

01.03.19, 22:08 | #3
●
Active users
Rep: (0)

U43 1F = 255

I have so...

Post has been editeddemibot - 01.03.19, 22:09

01.03.19, 22:44 | #4
●
Friendssavagemessiahzine.com
Rep: (19)

This is of course not bad, but I need its parameters (

08.03.19, 20:18 | #5
●
Users
Rep: (0)

I understand that in the wireless client mode, without alternative firmware, can not it be inserted? (talking about SmartBOX Turbo +)

Post has been editedxiwetofewe - 08.03.19, 20:18

09.03.19, 19:57 | #6
●
Friendssavagemessiahzine.com
Rep: (19)

evzomsk If you find out how our kernel is built, then you can build the same kernel through the cross-compile-toolchain by including support for modems if it is not there (but then if it dies with ends), or modules separately. console utilities for establishing a connection via a modem can be checked, and a basic understanding of php is enough to modify the webmord and add parameters to homemade scripts to connect. The whole webmord files are in / tmp.
it would be possible without simply changing the file to the same place, and the modem config page should not be entered in the face, but called somehow like mdmcfg.htm - protection against a fool. I can not raise my brick, I would have tested it for you. as I said before, we have the mipsel (little endian) architecture, and the console binaries for this architecture are executed on turbo plus with a bang. we will need some pppdial thread and pppd. invent a shell script that initiates the launch of modem support, and let the page show dmesg | tail on the button and launch this unwritten enablemodem.sh and allow text fields to pass the "dialing" string parameters - apn there and login / password.
damn converter, how do i need to know its properties (

Post has been editedsmkjudas - 09.03.19, 20:05

Reason for editing: forgot to add, and spelling

09.03.19, 23:02 | #7
●
Users
Rep: (0)

The question is removed. Carefully read the cap.

Post has been editedRim1985 - 09.03.19, 23:07

09.03.19, 23:15 | #8
●
Friendssavagemessiahzine.com
Rep: (19)

evzomsk , and what does the bootloader have to do with this task, if the whole system of our task is to pull up the modem modules from the root rights with the insmod command and start the connection on demand, also at the level of console applications? I'm just not catching up, in what a complication. well, maybe we have some selinux will not allow to write to the root file system, but the binaries are successfully executed from / tmp
when I started my corpse, I could test the whole "Egor's theorem" and if it works, I would even have installed the installer on the shell

15.03.19, 19:17 | #9
●
Friendssavagemessiahzine.com
Rep: (1)

I noticed in the header not accuracy on SmartBOX Turbo +:
1) It is stated that the router has one USB 3.0, here it goes like 2.0.
2) In the range of Wi Fi 5 GHz on the latest firmware there is no such mode "bgn + ac", on 5 GHz "bg" there is not a single drop-down line.

Well, I have such a question, is there a udpproxy on the router in the Superuser mode to enable multicast on playlists on the IPTV set-top box, which cannot play udp / rtp links by itself?

15.03.19, 21:35 | #10
●
Friendssavagemessiahzine.com
Rep: (1)

[email protected], 09:55

The work plan is as follows: 1.To find / finish entry points TX / RX.

Maybe of course I will interfere with my question, but I did not understand a bit about вЂњfindingвЂќ. The photo shows that the resistors R53, R54, R73
There is no OK on the board.
The tracks from R53, R54 lead to percent, getting confused where Rx is, and where Tx is at the UART, it is not so important. But if you connect a needle to the output of a disabled router, even without soldering R53, R54 input (let's forget about its output for now) USB<-->A COM converter, for example, on PL2303HX with the right circuit, without a difference of 3.3V or 5V. Maybe not the first time since the second, (well, with whom this does not happen), unless in the window of the hyperterminal, it will not show us the download progress of the router when it is turned on?
Or is the problem much deeper, and I wrote that something was wrong?

Post has been editedBismark1 - 15.03.19, 21:40

16.03.19, 10:12 | #11
●
Friendssavagemessiahzine.com
Rep: (12)

SmartBOX Pro haspadawan, and the manual on the alteration clack. Unfortunately, I do not have a turbo on hand. Isn't turbo usb 3.0?

Post has been editedVRamir - 20.03.19, 16:43

Reason for editing: Completed

16.03.19, 11:04 | #12
●
Active users
Rep: (1)

Offtop probably:
If you hold<Reset>and then connect the power of the router, holding<Reset>another 5 seconds, the router flashes red LED.
What is this "emergency" mode and what is it for?
ps On dir-300 (B5) from Beeline, this mode was also turned on. But then there was the opportunity to enter the web page and the ability to flash the binary.

17.03.19, 16:33 | #13
●
Active users
Rep: (1)

Or does it just look like?
http: //www.sercomm.com...d=2&L3id=33&Prodid=676

18.03.19, 07:25 | #14
●
Friendssavagemessiahzine.com
Rep: (12)

MaxSoniX It looks like the layout of the board is different, but it may just be a render. With the pro version was the same, but there was no sense

19.03.19, 19:03 | #15
●
Friendssavagemessiahzine.com
Rep: (187)

Bismark1 @ 03/16/19, 00:35

Maybe of course I will interfere with my question, but I did not understand a bit about the "find".

Yet on the topic, of course you will not interfere. Naturally, one can see where they are and what is missing, the question was rather about "finishing" (resistors ratings).
Taki happened. In ind. No. 1 (I have two of them) came around 5 volts, so I was originally thinking about adding resistors. Then free time appeared - on ind. Number 2 checked - there is 3.5-3.7 volts (paradox !!!). In a quick snot short-circuited R53 and R54 (all too small - not up to aesthetics :)). Logs ran,~~later add to the cap~~ added.

smkjudas @ 03/10/19, 02:15

what does the downloader have to do with this task

There are thoughts to cut Padawan / OpenWRT into it (message No. 2). IMHO for me (I think for many) more attractive. BUT! parallel decisions also will not be superfluous, respect in advance;)

VRamir @ 03/16/19, 2:52 PM

Deer 300 had a percentage of broadcom ... and then the media library

So that you understand: DIR-300 has never been on broadcastshttps://wikidevi.com/wiki/D-Link_DIR-300Ralink is the predecessor of the Media Library, and the Media Library doesnвЂ™t fit even with a candle. Realtek is generally a separate issue with its pluses and minuses - but not in this topic.

VRamir, Dim666mid, hare offtopic / spamming (And then I'll sign up as fierce curators ... :) - a joke). USB 3.0 corrected.

PS: For starters: we smoke mana by XiaoMi (there are similar MT7621 + NAND) for some reason;)

Post has been editedevzomsk - 19.03.19, 21:21

23.03.19, 20:48 | #16
●
Active users
Rep: (1)

[email protected], 10:54

Later I will check or check it myself with the Shark (WireShark), maybe at this moment he is waiting for something via tftp. There is no DHCP, muzzles on 192.168.1 / 0.1 too (I set the appropriate IP network card).

Alas, did not deal neither with uart, nor with tftp. And I used wireshark only 1 time .. I have no experience.

Judging by the "emergency" mode log, the debugger informs about the upcoming erasure (update on).

\\ After sending Ctrl + C, the standard menu of the Ralink / Mediatek loader appears:
It flies instantly - nothing can be chosen \\
For what is it done, the choice. Likely, automatically entered or need to find some kind of 'other' interrupt. In the absence of uart, I can not reproduce it in myself. There is nothing to help.

\\ tftp:almost as in Ralinka, BUT ... ??? test.bin \\
Apparently, the tftp client is waiting for a file named 'test.bin'.

Post has been editedCrashERR - 23.03.19, 20:54

Reason for editing: fix

28.03.19, 23:39 | #17
●
Curators
Rep: (22)

Is there any hope that turbo + will have a normal way of flashing without replacing and soldering flash memory?

30.03.19, 00:19 | #18
●
Friendssavagemessiahzine.com
Rep: (31)

There is a Smart Box Turbo + router; tell me how you can configure remote access so that if you have an Internet connection, you can access it from anywhere?

30.03.19, 09:56 | #19
●
Active users
Rep: (1)

spider-man666 @ 03/29/19, 02:39

Is there any hope that turbo + will have a normal way of flashing without replacing and soldering flash memory?

Try creating a TFTP server on your computer. Set the server IP address: 10.10.10.3. (The router must have the address: 10.10.10.123)
In the root of the "shared" folder put the file of the beeline firmware named "test.bin".
Connect the patch cord to the ports of the LAN computer and the WAN router. Finally, run the router with the sandwiched<Reset>.
Wait for any signs from the router, in the form of a change in the glow of the LED or reboot.
!!! Perform this procedure at your own risk.

By the way: IPTV-prefixes from Beeline, similarly use tftp-connection for the initial software download. (Yes, this is the gray screen with gear and boot bar). Alas, but no one managed to defeat the console.

Post has been editedCrashERR - 30.03.19, 09:59

30.03.19, 11:08 | #20
●
Active users
Rep: (1)

I have done the above. Result: no result. uart'a not, absolutely nothing is visible.

30.03.19, 11:19 | #21
●
Active users
Rep: (1)

Evzomsk @ 03/30/19, 14

He waits for this file when running the tftpboot command from the bootloader (via UART). When loading with a clamped rezetom stupidly locks

Probably. But what about the following lines:

Command "tftpboot": 0xa020f958 =>0x87fa3958

Trying Eth0 (10/100-M)
Waitting for RX_DMA_BUSY status Start ... done
ETH_STATE_ACTIVE !!

That is, the Ethernet ports are active. And indeed, in this mode they work.
The mode is waiting for something like this "RX_DMA_BUSY". And what is it is unknown.

Post has been editedCrashERR - 30.03.19, 11:27

11 pages
1 2 3 4 5 6 > »

Full version

Help rules

Now: 07/11/19 9:59 PM

©savagemessiahzine.com2005-2019. All rights reserved.
savagemessiahzine.com^®- registered trademark.
Terms of Use | Denial of responsibility | Advertising placement

Forum IP.Board © 2019 IPS, Inc .