WAVLINK WL-WN570HA1


 * Product page

Dissasembly

 * Detatch antenna, remove silicone grommet and unscew nut on RP-SMA connector
 * to slide the card out the bottom of the unit after removing the bottom cap.
 * There is a block of silicone thermal interface material over the CPU.

Serial

 * J1 is a serial header. Pinout on silkscreen, no holes just pads.
 * Connect with 57600/8/N/1 3.3v TTL
 * Root access without password on serial.

Console output
{{SCollapse|Boot log • >> U-Boot 1.1.3 (Jun 24 2016 - 10:18:38)

Board: Ralink APSoC DRAM: 64 MB

relocate_code Pointer at: 83fb8000

flash manufacture id: c8, device id 40 17

find flash: GD25Q64B


 * Warning - bad CRC, using default environment

=
===============================

Ralink UBoot Version: 4.3.0.0

ASIC 7628_MP (Port5<->None)

DRAM component: 512 Mbits DDR, width 16

DRAM bus: 16 bit

Total memory: 64 MBytes

Flash component: SPI Flash

Date:Jun 24 2016 Time:10:18:38

=
===============================

icache: sets:512, ways:4, linesz:32 ,total:65536

dcache: sets:256, ways:4, linesz:32 ,total:32768


 * 1) The CPU freq = 575 MHZ ####

estimate memory size =64 Mbytes

RESET MT7628 PHY!!!!!!

Please choose the operation:

1: Load system code to SDRAM via TFTP.

2: Load system code then write to Flash via TFTP.

3: Boot system code via Flash (default).

4: Entr boot command line interface.

7: Load Boot Loader code then write to Flash via Serial.

9: Load Boot Loader code then write to Flash via TFTP.

You choosed 3

��� 0

3: System Boot system code via Flash.


 * 1) Booting image at bc050000 ...

Image Name:  Linux Kernel Image

Image Type:  MIPS Linux Kernel Image (lzma compressed)

Data Size:   4565528 Bytes =  4.4 MB

Load Address: 80000000

Entry Point: 8000c150

Verifying Checksum ... OK

Uncompressing Kernel Image ... OK

No initrd


 * 1) Transferring control to Linux (at address 8000c150) ...


 * 1) Giving linux memsize in MB, 64

Starting kernel ...

LINUX started...

THIS IS ASIC Linux version 2.6.36 (root@ubuntusvr1) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #243 Thu Feb 16 13:55:26 CST 2017

The CPU feqenuce set to 575 MHz

MIPS CPU sleep mode enabled. CPU revision is: 00019655 (MIPS 24Kc) Software DMA cache coherency Determined physical RAM map: memory: 04000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal  0x00000000 -> 0x00004000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00004000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 console=ttyS0 PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Primary instruction cache 64kB, VIPT,, 4-waylinesize 32 bytes. Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes Writing ErrCtl register=0007a431 Readback ErrCtl register=0007a431 Memory: 56840k/65536k available (3904k kernel code, 8696k reserved, 1035k data, 2884k init, 0k highmem) NR_IRQS:128 console [ttyS1] enabled Calibrating delay loop... 386.04 BogoMIPS (lpj=772096) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 NET: Registered protocol family 16 RALINK_GPIOMODE = 570544d4 RALINK_GPIOMODE = 570444d4 start PCIe register access RALINK_RSTCTRL = 2400000 RALINK_CLKCFG1 = fdbfffc0
 * Xtal 40MHz *****

PCIE0 enabled Port 0 N_FTS = 1b105000 init_rt2880pci done bio: create slab  at 0 vgaarb: loaded SCSI subsystem initialized pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000) pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff] pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI address [0x20200000-0x2020ffff] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff] pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff] (PCI address [0x20000000-0x200fffff] pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff] pci 0000:01:00.1: BAR 0: set to [mem 0x20100000-0x201fffff] (PCI address [0x20100000-0x201fffff] pci 0000:00:00.0: PCI bridge to [bus 01-01] pci 0000:00:00.0:  bridge window [io  disabled] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff] pci 0000:00:00.0:   bridge window [mem pref disabled] BAR0 at slot 0 = 0 bus=0x0, slot = 0x0 res[0]->start = 0 res[0]->end = 0 res[1]->start = 20200000 res[1]->end = 2020ffff res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 bus=0x1, slot = 0x0 res[0]->start = 20000000 res[0]->end = 200fffff res[1]->start = 0 res[1]->end = 0 res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 bus=0x1, slot = 0x0 res[0]->start = 20100000 res[0]->end = 201fffff res[1]->start = 0 res[1]->end = 0 res[2]->start = 0 res[2]->end = 0 res[3]->start = 0 res[3]->end = 0 res[4]->start = 0 res[4]->end = 0 res[5]->start = 0 res[5]->end = 0 Switching to clocksource Ralink Systick timer NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered UDP hash table entries: 256 (order: 0, 4096 bytes) UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) NET: Registered protocol family 1 fuse init (API version 7.15) msgmni has been set to 111 Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254) io scheduler noop registered (default) gpiomode one 0000  = 0x571444d0 Ralink gpio driver initialized = 73 Ralink gpio driver initialized Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A brd: module loaded flash manufacture id: c8, device id 40 17 Wavlink Encryption System... Wavlink Encryption System is installing GD25Q64B(c8 40170000) (8192 Kbytes) mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0 Creating 5 MTD partitions on "raspi": 0x000000000000-0x000000800000 : "ALL" 0x000000000000-0x000000030000 : "Bootloader" 0x000000030000-0x000000040000 : "Config" 0x000000040000-0x000000050000 : "Factory" 0x000000050000-0x000001000000 : "Kernel" mtd: partition "Kernel" extends beyond the end of device "raspi" -- size truncated to 0x7b0000 rdm_major = 253 GMAC1_MAC_ADRH -- : 0x000080FF GMAC1_MAC_ADRL -- : 0x5db783FF Ralink APSoC Ethernet Driver Initilization. v3.1 512 rx/tx descriptors allocated, mtu = 1500! GMAC1_MAC_ADRH -- : 0x000080FF GMAC1_MAC_ADRL -- : 0x5db783FF PROC INIT OK! my_net_link_3: create netlink socket ok. PPP generic driver version 2.4.2 PPP MPPE Compression module registered NET: Registered protocol family 24 PPTP driver version 0.8.5
 * MT7628 PCIe RC mode *************

pAd = c0147000, size = 1354720
<-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x <-- RTMPAllocAdapterBlock, Status=0 RtmpChipOpsHook(492): Not support for HIF_MT yet! mt7628_init--> mt7628_init(FW(8a00), HW(8a01), CHIPID(7628)) e2.bin mt7628_init(1133)::(2), pChipCap->fw_len(63888) mt_bcn_buf_init(218): Not support for HIF_MT yet! <--mt7628_init GACT probability on Mirror/redirect action on Simple TC action Loaded netem: version 1.2 u32 classifier Performance counters on   input device check on    Actions configured Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (888 buckets, 3552 max) ctnetlink v0.93: registering with nfnetlink. nf_conntrack_rtsp v0.6.21 loading NF_TPROXY: Transparent proxy support initialized, version 4.1.0 NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd. matchsize=264 xt_time: kernel timezone is -0000 IPVS: Registered protocols IPVS: Connection hash table configured (size=4096, memory=32Kbytes) IPVS: ipvs loaded. GRE over IPv4 demultiplexor driver gre: can't add protocol nf_nat_rtsp v0.6.21 loading ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully arp_tables: (C) 2002 David S. Miller TCP cubic registered NET: Registered protocol family 10 NET: Registered protocol family 17 L2TP core driver, V2.0 PPPoL2TP kernel driver, V2.0 802.1Q VLAN Support v1.8 Ben Greear  All bugs added by David S. Miller  Warning: unable to open an initial console. Freeing unused kernel memory: 2884k freed Algorithmics/MIPS FPU Emulator v1.5 Welcome to    __   ___  _____  _____   _  _______ ______  _____  _   ___ | \ /   ||  ___||  __ \ | ||  __  ||__  __||  ___|| | /  /    |   ^    || |__  | |  \ \| || |  | |  | |   | |__  | |/  /    |  | |   ||  ___|| |  | || || |__| |  | |   |  ___||    \    |  | |   || |___ | |__/ /| ||  __  |  | |   | |___ | |\  \    |__| |___||_____||_____/ |_||_|  |_|  |_|   |_____||_| \__\

= Everyday Genius = The timer is still in use... Wavlink Encryption System is unlocked. led=37, on=4000, off=1, blinks,=1, reset=1, time=4000 Password for 'admin' changed


 * 1) disable 1st wireless interface #####

rmmod: MT7610_ap: No such file or directory RootMacAddress:00:11:22:33:44:55
 * 1) disable 2nd wireless interface #####

RootMacAddress:00:11:22:33:44:55

insmod: rt_timer.ko: module not found

pAd = c0782000, size = 1786192
<-- RTMPAllocTxRxRingMemory, Status=0 <-- RTMPAllocAdapterBlock, Status=0 device_id =0x7650 ==>MT76x0_WLAN_ChipOnOff: OnOff:1, pAd->WlanFunCtrl:0x0, Reg-WlanFunCtrl=0xff000002 MACVersion = 0x76502000 TX_BCN DESC a285b000 size = 320 RX[0] DESC a285f000 size = 2048 RX[1] DESC a2862000 size = 1 GiB E2pAccessMode=0 cfg_mode=9 cfg_mode=9 wmode_band_equal: Band Equal! AndesSendCmdMsg: Could not send in band command due to diable fRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD APSDCapable[0]=0 APSDCapable[1]=0 APSDCapable[2]=0 APSDCapable[3]=0 APSDCapable[4]=0 APSDCapable[5]=0 APSDCapable[6]=0 APSDCapable[7]=0 APSDCapable[8]=0 APSDCapable[9]=0 APSDCapable[10]=0 APSDCapable[11]=0 APSDCapable[12]=0 APSDCapable[13]=0 APSDCapable[14]=0 APSDCapable[15]=0 default ApCliAPSDCapable[0]=0 Key1Str is Invalid key length(0) or Type(0) Key2Str is Invalid key length(0) or Type(0) Key3Str is Invalid key length(0) or Type(0) Key4Str is Invalid key length(0) or Type(0) load fw image from fw_header_image AndesMTLoadFwMethod1(2174)::pChipCap->fw_len(63888) FW Version:20151201 FW Build Date:20151201183641 CmdAddressLenReq:(ret = 0) CmdFwStartReq: override = 1, address = 1048576 CmdStartDLRsp: WiFI FW Download Success MtAsicDMASchedulerInit: DMA Scheduler Mode=0(LMAC) efuse_probe: efuse = 10000012 RtmpChipOpsEepromHook::e2p_type=2, inf_Type=4 RtmpEepromGetDefault::e2p_dafault=2 RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2 NVM is FLASH mode 1. Phy Mode = 14 Country Region from e2p = ffff tssi_1_target_pwr_g_band = 2 2. Phy Mode = 14 3. Phy Mode = 14 NICInitPwrPinCfg(11): Not support for HIF_MT yet! NICInitializeAsic(651): Not support rtmp_mac_sys_reset for HIF_MT yet! mt_mac_init--> MtAsicInitMac--> mt7628_init_mac_cr--> MtAsicSetMacMaxLen(1241): Set the Max RxPktLen=1024! <--mt_mac_init WTBL Segment 1 info: MemBaseAddr/FID:0x28000/0 EntrySize/Cnt:32/128 WTBL Segment 2 info: MemBaseAddr/FID:0x40000/0 EntrySize/Cnt:64/128 WTBL Segment 3 info: MemBaseAddr/FID:0x42000/64 EntrySize/Cnt:64/128 WTBL Segment 4 info: MemBaseAddr/FID:0x44000/128 EntrySize/Cnt:32/128 AntCfgInit(2893): Not support for HIF_MT yet! MCS Set = ff 00 00 00 01 MtAsicSetChBusyStat(826): Not support for HIF_MT yet! [PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0 [PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0 MtAsicSetRalinkBurstMode(2919): Not support for HIF_MT yet! MtAsicSetPiggyBack(763): Not support for HIF_MT yet! reload DPD from flash, 0x9F = [c600] doReload bit7[0] CmdLoadDPDDataFromFlash: Channel = 11, DoReload = 0 MtAsicSetTxPreamble(2898): Not support for HIF_MT yet! CmdSlotTimeSet:(ret = 0) MtAsicAddSharedKeyEntry(1308): Not support for HIF_MT yet! MtAsicSetPreTbtt: bss_idx=0, PreTBTT timeout = 0xf0 Main bssid = 00:11:22:33:44:55 <==== rt28xx_init, Status=0 The 7628 UUID MacAddress = 00:11:22:33:44:55

The 7628 UUID MacAddress = 00:11:22:33:44:55

mt7628_set_ed_cca: TURN OFF EDCCA mac 0x10618 = 0xd7083f0f, EDCCA_Status=0 WiFi Startup Cost (ra0): 0.892s load fw spent 12ms RX DESC a2a91000 size = 2048 RX1 DESC a2a92000 size = 2048 cfg_mode=14 cfg_mode=14 wmode_band_equal: Band Not Equal! 1. Phy Mode = 49 2. Phy Mode = 49 ext_pa_current_setting = 1 3. Phy Mode = 49 AntCfgInit: primary/secondary ant 0/1 ChipStructAssign: RALINK6590 hook ! bAutoTxAgcG = 0 MCS Set = ff 00 00 00 01 MT76x0_ChipBBPAdjust:rf_bw=2, ext_ch=3, PrimCh=40, HT-CentCh=38, VHT-CentCh=42 result [0]!! APStartUp: AP Set CentralFreq at 42(Prim=40, HT-CentCh=38, VHT-CentCh=42, BBP_BW=2) Main bssid = 00:11:22:33:44:55 <==== rt28xx_init, Status=0 result [0]!! result [0]!! result [0]!! result [0]!! result [0]!! result [0]!! result [0]!! result [0]!! 0x1300 = 00064300 RTMPDrvOpen(1):Check if PDMA is idle! RTMPDrvOpen(2):Check if PDMA is idle! The 7610 UUID MacAddress = 00:11:22:33:44:55

The 7610 UUID MacAddress = 00:11:22:33:44:55

The 7610 UUID MacAddress = 00:11:22:33:44:55

ifconfig: ioctl 0x8913 failed: No such device brctl: bridge br0: No such device or address killall: wandaemRaeth v3.1 (on: no process kTaskletilled )
 * 1) configVIF #####

phy_tx_ring = 0x02198000, tx_ring = 0xa2198000

phy_rx_ring0 = 0x0219a000, rx_ring0 = 0xa219a000 GMAC1_MAC_ADRH -- : 0x000080FF GMAC1_MAC_ADRL -- : 0x5db783FF RT305x_ESW: Link Status Changed ======>>>>> RT305x_ESW: Link Status Changed ======>>>>> p0 = 0 p1 = 0 p2 = 0 p3 = 0 p4 = 0 hotplug 0

vconfig: ioctl error for rem: No such device vconfig: ioctl error for rem: No such device rmmod: 8021q: No such file or directory device eth2 entered promiscuous mode switch reg write offset=14, value=405555 switch reg write offset=50, value=2001 switch reg write offset=98, value=7f3f switch reg write offset=e4, value=3f switch reg write offset=40, value=1002 switch reg write offset=44, value=1001 switch reg write offset=48, value=1001 switch reg write offset=70, value=ffff417e done. device ra0 entered promiscuous mode device eth2.1 entered promiscuous mode device rai0 entered promiscuous mode
 * 1) 999999 config Ralink ESW vlan partition (WLLLL) #####
 * 2) config-vlan.sh 2 WLLLL config Ralink ESW vlan partition (WLLLL) #####

br0: port 3(rai0) entering learning state br0: port 3(rai0) entering learning state br0: port 2(eth2.1) entering learning state br0: port 2(eth2.1) entering learning state br0: port 1(ra0) entering learning state br0: port 1(ra0) entering learning state route: ioctl 0x890c failed: No such process BusyBox v1.12.1 (2017-02-15 17:34:25 CST) multi-call binary
 * 1) enable 2nd wireless interface #####

Usage: route [{add|del|delete}]

ifconfig: ioctl 0x8914 failed: Cannot assign requested address ifconfig: ioctl 0x8914 failed: Cannot assign requested address route: ioctl 0x890c failed: No such process device eth2.2 entered promiscuous mode br0: port 4(eth2.2) entering learning state br0: port 4(eth2.2) entering learning state ifconfig: ioctl 0x8913 failed: No such device rm: cannot remove '/etc/radvd.conf': No such file or directory /sbin/internet.sh: line 1271: long_loop: not found route: ioctl 0x890c failed: No such process Unknown option: -I Unknown option: ra0 Jan 1 00:00:17 miniupnpd[1137]: WPS listening on port 7777

killall: rt2860apd: no process killed Jan 1 00:00:17 miniupnpd[1137]: received signal 15, good-bye

br0: port 3(rai0) entering forwarding state br0: port 2(eth2.1) entering forwarding state br0: port 1(ra0) entering forwarding state Unknown option: -I Unknown option: ra0 Jan 1 00:00:17 miniupnpd[1472]: WPS listening on port 7777

killall: rtinicapd: no process killed iptables v1.4.10: Couldn't load target `macipport_filter':File not found

Try `iptables -h' or 'iptables --help' for more information. iptables: No chain/target/match by that name. iptables v1.4.10: Couldn't load target `web_filter':File not found

Try `iptables -h' or 'iptables --help' for more information. iptables: No chain/target/match by that name. iptables v1.4.10: Couldn't load target `malicious_filter':File not found

Try `iptables -h' or 'iptables --help' for more information. iptables: No chain/target/match by that name. iptables v1.4.10: Couldn't load target `malicious_input_filter':File not found

Try `iptables -h' or 'iptables --help' for more information. iptables: No chain/target/match by that name. iptables v1.4.10: Couldn't load target `port_trigger':File not found

Try `iptables -h' or 'iptables --help' for more information. iptables: No chain/target/match by that name. iptables v1.4.10: Couldn't load target `trigger_prerouting':br0: port 4(eth2.2) entering forwarding state File not found

Try `iptables -h' or 'iptables --help' for more information. iptables: No chain/target/match by that name. sh: /bin/super_dmz: not found iptables v1.4.10: Couldn't load target `port_forward':File not found

Try `iptables -h' or 'iptables --help' for more information. iptables: No chain/target/match by that name. iptables v1.4.10: Couldn't load target `DMZ':File not found

Try `iptables -h' or 'iptables --help' for more information. iptables: No chain/target/match by that name. 30 0 432000 0 sh: ddns.sh: not found led=11, on=4000, off=1, blinks,=1, reset=1, time=4000 dut mac=00:11:22:33:44:55 Filter_State=1 led=5, on=4000, off=1, blinks,=1, reset=1, time=4000 led=4, on=4000, off=1, blinks,=1, reset=1, time=4000 0 webs: Listening for HTTP requests at address 10.10.0.225

QoSInit warning, can't get bandwidth string from UI. warning, can't get bandwidth string from UI. iptables: No chain/target/match by that name. iptables: No chain/target/match by that name. ifconfig: ioctl 0x8913 failed: No such device ifconfig: ioctl 0x8913 failed: No such device 1970-01-01 00:00:21: (log.c.97) server started init: can't log to /dev/tty5

starting pid 3576, tty '/dev/ttyS1': '/bin/sh'

BusyBox v1.12.1 (2017-02-15 17:34:25 CST) built-in shell (ash) Enter 'help' for a list of built-in commands.

}}