Differences

This shows you the differences between two versions of the page.

--- zyxel_xs1930_series [2020/10/26 12:43] – [XS1930-10] remove case picture of GS1920 svanheule
+++ zyxel_xs1930_series [2022/11/15 15:48] (current) – Remove trailing space pmenzel
@@ Line 6: / Line 6: @@
 | XS1930-10 | 8 | 2 | - |
 | XS1930-12HP | 10 | 2 | 8 |
+| XS1930-12F | 2 | 10 | - |
 ===== Models =====
@@ Line 11: / Line 12: @@
 === Hardware ===
   * SoC: RTL9313
-  * Ethernet:
+  * Ethernet: Aquantia AQR813
   * RAM: Winbond W632GU6MB 256MiB DDR3
   * Flash: Macronix MX25L25645G, 32MiB SPI NOR
   * GPIO: 1× RTL8231
-    * HC164 shift register for device status LEDs
+  * HC164 shift register for device status LEDs
   * 3-pin fan
-The serial port is accessible via pins from from the outside on the right side of the device. Pins are front to back: GND, TX, RX, Vcc.
+The serial port is accessible via pins from the outside on the right side of the device. Pins are front to back: GND, TX, RX, Vcc.
-Port settings are 115200 baud, 8n1, with 3.3 logic level.
+Port settings are 115200 baud, 8n1, with 3.3V logic level.
+If you are using a Raspberry Pi, ensure that the serial port is activated first, many guides list these steps, here is a decent guide: https://www.engineersgarage.com/articles-raspberry-pi-serial-communication-uart-protocol-ttl-port-usb-serial-boards/
+Once wired up, and the serial port is enabled test that this works.  Confirm the system can use the port.
+  $ setserial -g /dev/ttyS[0123]
+  /dev/ttyS0, UART: 16550A, Port: 0x03f8, IRQ: 4
+  /dev/ttyS1, UART: 16550A, Port: 0x02f8, IRQ: 3
+  /dev/ttyS2, UART: unknown, Port: 0x03e8, IRQ: 4
+  /dev/ttyS3, UART: unknown, Port: 0x02e8, IRQ: 3
+It's likely /dev/ttyS0, use Linux's cli, 'cu'
+  $ cu -l /dev/ttyS0 -s 115200
+If done correctly, you will be presented with a login prompt, the login credentials for the web interface and this serial interface are the same.  Test that the system is wired properly before restarting.  Quite from cu with ~.  , that's a tilde, followed by a period.
 === Photos ===
@@ Line 25: / Line 43: @@
 | Overview | {{:wiki:xs1930-10_overview.jpg?200|inside overview}} |
 | Main board | {{:wiki:xs1930-10_pcb.jpg?200|main board overview}} {{:wiki:xs1930-10_back.jpg?200|main board back side}}  |
+| Serial port location | {{:pxl_20220615_023152806.jpg?200|}} {{:pxl_20220615_023152806--highlight.jpg?200|}} |
+| Serial Port connected (raspi client) | {{:pxl_20220615_023958093--connected.jpg?200|}} |
+===== Firmware =====
+The firmware of the Zyxel 1930 devices is based on Zynos [[https://github.com/dev-zzo/router-tools/blob/master/zynos.md]], itself a descendant of ThreadX. There is no Linux Kernel running. The initial configuration of the hardware is performed by U-Boot, which then boots a second stage Zynos bootloader and finally ZynOS itself. The second stage bootloader is merely there for flashing the device, define capabilities and setting up Zynos in memory. There is no hardware configuration done at this point. Zynos seems to simply be a big blob loaded from flash to memory with all functionality linked together.
+The normal startup sequence is
+<code>
+Bootbase Version: V1.00 | 08/26/2019 16:03:22
+RAM: Size = 262144 Kbytes
+DRAM POST: Testing:  262144K
+OK
+DRAM Test SUCCESS !
+FLASH: 32M
+ZyNOS Version: V4.60(ABQE.0)C0 | 12/20/2019 14:53:53
+Press any key to enter debug mode within 1 second.
+.......
+Enter Debug Mode
+XS1930-10> athe
+======= Debug Command Listing =======
+AT            just answer OK
+ATHE          print help
+ATBAx         change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k
+ATENx,(y)     set BootExtension Debug Flag (y=password)
+ATSE          show the seed of password generator
+ATTI(h,m,s)   change system time to hour:min:sec or show current time
+ATDA(y,m,d)   change system date to year/month/day or show current date
+ATDS          dump RAS stack
+ATDT          dump Boot Module Common Area
+ATDUx,y       dump memory contents from address x for length y
+ATRBx         display the  8-bit value of address x
+ATRWx         display the 16-bit value of address x
+ATRLx         display the 32-bit value of address x
+ATGO(x)       run program at addr x or boot router
+ATGR          boot router
+ATGT          run Hardware Test Program
+ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations)
+ATSH          dump manufacturer related data in ROM
+ATDOx,y       download from address x for length y to PC via XMODEM
+ATTD          download router configuration to PC via XMODEM
+ATUR          upload router firmware to flash ROM
+< press any key to continue >
+ATLC          upload router configuration file to flash ROM
+ATXSx         xmodem select: x=0: CRC mode(default); x=1: checksum mode
+ATSR          system reboot
+ATFT(x,y,z)     offset, pattern, len
+ATPA(x)       Pause for x ms
+ATCP       show CPU
+ATGI         select boot image
+XS1930-10> aten1,C621E14A
+OK
+OKXS1930-10> atsh
+ZyNOS Version          : V4.60(ABQE.0)C0 | 12/20/2019 14:53:53
+Bootbase Version       : V1.00 | 08/26/2019 16:03:22
+Serial Number          : S202L10080128
+Vendor Name            : Zyxel
+Product Model          : XS1930-10
+ZyNOS ROM address      : 0xb40a0000
+System Type            : 8
+First MAC Address      : BCCFXXXXXXC7
+Last  MAC Address      : BCCFXXXXXXD2
+MAC Address Quantity   : 12
+Default Country Code   : FF
+Boot Module Debug Flag : 00
+CPLD Version           : N/A
+RomFile Version        : 67
+RomFile Checksum       : ebd1
+ZyNOS Checksum         : eeee
+SNMP MIB level & OID   : 060102030405060708091011121314151617181920
+Main Feature Bits      : C0
+Other Feature Bits     :
+74 00 00 00 00 00 00-00 00 00 00 00 00 00 00
+00 00 00 00 00 00 00-00 13 00 00 00 00
+OK
+XS1930-10> ATMP
+ROMIO image start at 0xb4280000
+code version:
+code start: 0x80220000
+code length: 5745CA
+memMapTab: 27 entries, start = 0xb42b0000, checksum = 75B9
+$RAM Section:
+: BootExt(RAMBOOT), start=0x80220000, len=50000
+: BootData(RAM), start=0x80270000, len=4000
+: RasCode(RAMCODE), start=0x80274000, len=4000000
+: RasData(RAM), start=0x84274000, len=9C8C000
+: BootExtA(RAMBOOT), start=0x80220000, len=50000
+: RasCodeA(RAMCODE), start=0x80274000, len=4000000
+$ROM Section:
+: BootBas(ROMIMG), start=0xb4000000, len=A0000
+: DbgArea(ROMIMG), start=0xb40a0000, len=20000
+: RomDir2(ROMDIR), start=0xb40c0000, len=120000
+: LogArea1(ROMIMG), start=0xb41e0000, len=20000
+: LogArea2(ROMIMG), start=0xb4200000, len=20000
+: License(ROMIMG), start=0xb4220000, len=10000
+: GenFS(ROMIMG), start=0xb4230000, len=10000
+: LogArea3(ROMIMG), start=0xb4240000, len=20000
+: Reserved(ROMIMG), start=0xb4260000, len=10000
+: ramParam(ROMIMG), start=0xb4270000, len=10000
+: BootExt(ROMIMG), start=0xb4280030, len=2FFD0
+: MemMapT(ROMMAP), start=0xb42b0000, len=1400
+: termcap(ROMIMG), start=0xb42b1400, len=400
+: RomDefa(ROMBIN), start=0xb42b1800, len=180000
+     (Compressed)
+     Version: RAS XS1930, start: 0xb42b1830
+     Length: 160000, Checksum: 962F
+     Compressed Length: 53D1, Checksum: FCC0
+: RasCode(ROMBIN), start=0xb4431800, len=BCE800
+     (Compressed)
+     Version: XS1930, start: 0xb4431830
+     Length: 1F06778, Checksum: 6F84
+     Compressed Length: 3C2DC9, Checksum: E874
+: RomDir2A(ROMDIR), start=0xb50c0000, len=120000
+: BootExtA(ROMIMG), start=0xb5280030, len=2FFD0
+: MemMapTA(ROMMAP), start=0xb52b0000, len=1400
+: termcapA(ROMIMG), start=0xb52b1400, len=400
+: RomDefaA(ROMBIN), start=0xb52b1800, len=180000
+     (Compressed)
+     Version: RAS XS1930, start: 0xb52b1830
+     Length: 160000, Checksum: 962F
+     Compressed Length: 53D1, Checksum: FCC0
+: RasCodeA(ROMBIN), start=0xb5431800, len=BCE800
+     (Compressed)
+     Version: XS1930, start: 0xb5431830
+     Length: 1F06778, Checksum: 6F84
+     Compressed Length: 3C2DC9, Checksum: E874
+$USER Section:
+Msecs 128
+Heap0 16 34816 4096
+Heap1 32 24576 2048
+Heap2 64 65520 8192
+Heap3 128 16384 1024
+Heap4 192 8192 1024
+Heap5 256 2048 128
+Heap6 320 2048 128
+Heap7 384 576 128
+Heap8 448 512 64
+Heap9 512 256 128
+Heap10 576 1536 64
+Heap11 1024 1088 64
+Heap12 1536 1280 128
+Heap13 2048 512 128
+Heap14 4096 542 64
+Heap15 8192 158 8
+Heap16 10496 606 32
+Heap17 12288 94 16
+Heap18 13312 320 5
+Heap19 17408 158 5
+Heap20 26944 1200 5
+Heap21 36864 30 3
+Heap22 64000 20 3
+MbufInt 400 400 400
+MbufIO  256 2048 2048 0 0
+Queue   128
+Cbuf    40960
+FuncId  50
+Proc    128
+Timer   1024
+DNS     128
+FilterSet 12
+IpRoute 33
+IpxRoute 4
+IpMaxRt 128
+IpxMaxRt 128
+IpxMaxSap 128
+FwTos 1200 10 10 10
+AclType0 51200 9 400
+AclType1 2048 4 100
+AclType2 2048 4 20
+AclType3 2048 4 128
+AclType4 2048 4 128
+AclType5 32768 8 128
+AppleTalkRoute 0
+Bridge 4
+RemoteNode 1
+Profile 1
+Endpoint 4
+NATServerSet 1
+DHCPEntry 253
+PoeSvrCnt 4
+ScheduleSet 12
+AclBuffer 1
+IPSecManualSA 120
+IPSecIkePeer 120
+IPSecIkeSA 120
+IPSecAclBuffer 1
+IPSecSPD 120
+NatAclBuffer 1
+CustomPort 10
+NatSessions 1024
+IpPolicySet 12
+PoeSvrCnt 0
+ScheduleSet 0
+MiscFirewallBuffer 1
+AveBuffer 1
+CyberPatrolBuffer 1
+CyberPatrolListBuffer 1
+TrustedIPNum 0
+IPBUFixpart 1
+NatRulePerSet 12
+DHCPMacNum 8
+UPNPNum 1
+IPSecExtendNum 120
+Model 2 29698 29954
+CoeFixedPart    1
+CbqSpecialClass         1
+AccessSecHost 16
+SwitchStpPort   52
+Switch1QPort    52
+Switch1QStaticEntry     1024
+WebManagementUser 5
+snmpManager     4
+dot1xProfileEntry       5
+swStaticMacEntry        256
+swFilterEntry   256
+swMirrorEntry   52
+swBWEntry       52
+swTrunkEntry    24
+bcastDmEntry    17
+CMMemberEntry   24
+swDSMarkEntry   0
+OSPFArea        0
+OSPFVL          0
+VrrpRouterEntry 0
+swClassifierEntry   256
+swFilterActionEntry 256
+sptFSGen 128 1024
+genBuffer 1
+rmonEventTable 64
+rmonAlarmTable 64
+l2InbandIpdrvIfEntry    64
+IGMPMVREntry 5
+IGMPMVRAddrEntry 261
+IGMPFilteringPort 52
+IGMPFilteringRecEntry 256
+SyslogTypeEntry 5
+SyslogServerEntry       4
+swPBVlanEntry   0
+swVlanProtoBasedEntry 364
+cardTypeEntry   0
+swMRStpEntry    2
+radiusServer    1
+SwitchMRStpPort 52
+IGMPMVlanEntry 16
+swVlanSubnetBasedEntry 16
+TrTCMEntry 52
+tacPlusAuthSvr 2
+tacPlusAcctSvr 2
+enablePassword 15
+authTypeEntry 2
+acctTypeEntry 4
+dhcpSnpEntry 1
+arpInspectEntry 1
+ipSrcGuardEntry 512
+authorTypeEntry 2
+SnmpManagementUser 5
+displayConf 1
+FwVersion       VHello%world%|%12/20/2019
+FwVersion0      29698,V4.60(ABQE.0)C0%|%12/20/2019
+FwVersion1      29954,V4.60(ABQF.0)C0%|%12/20/2019
+OK
+</code>
+In the above sequence, the second stage ZynOS loader was interrupted by pressing a key. In order to get into the initial U-Boot, the "$" key needs to be pressed until the end of the DRAM test routine. Both U-Boot and the ZynOS loader have crippled functionality until they are unlocked. For this, there is an unlock code, which depends on the last digit of the MAC-Address, as described here: [[http://www.ixo.de/info/zyxel_uclinux/]]. In the above example, the ZynOS bootloader was unlocked with the ''aten1,C621E14A'' command, unlocking U-Boot is done by ''aten 1 C621E14A'' for this MAC address. Unfortunately U-Boot is not able to set up the Aquantia PHY, nor does it set up the fibre ports, even though ''rtk network on'' does seem to do something. Therefore development needs to be done through uploading images via the serial connection. Once U-Boot is unlocked, the following information is available:
+<code>
+XS1930$ flshow
+=============== FLASH Partition Layout ===============
+Index  Name       Size       Address
+------------------------------------------------------
+     BootLoader 0x9e000    0xb4000000-0xb409dfff
+     BootEnvCfg 0x1000     0xb409e000-0xb409efff
+     MRD        0x1000     0xb409f000-0xb409ffff
+     DbgArea    0x20000    0xb40a0000-0xb40bffff
+     RomDir2    0x120000   0xb40c0000-0xb41dffff
+     LogArea1   0x20000    0xb41e0000-0xb41fffff
+     LogArea2   0x20000    0xb4200000-0xb421ffff
+     License    0x10000    0xb4220000-0xb422ffff
+     GenFS      0x10000    0xb4230000-0xb423ffff
+     LogArea3   0x20000    0xb4240000-0xb425ffff
+    Reserved   0x10000    0xb4260000-0xb426ffff
+    RamParam   0x10000    0xb4270000-0xb427ffff
+    BootExt    0x30000    0xb4280000-0xb42affff
+    MemMapT    0x1400     0xb42b0000-0xb42b13ff
+    Termcap    0x400      0xb42b1400-0xb42b17ff
+    RomDefa    0x180000   0xb42b1800-0xb44317ff
+    RasCode    0xbce800   0xb4431800-0xb4ffffff
+    RomDir2A   0x120000   0xb50c0000-0xb51dffff
+    BootExtA   0x30000    0xb5280000-0xb52affff
+    MemMapTA   0x1400     0xb52b0000-0xb52b13ff
+    TermcapA   0x400      0xb52b1400-0xb52b17ff
+    RomDefaA   0x180000   0xb52b1800-0xb54317ff
+    RasCodeA   0xbce800   0xb5431800-0xb5ffffff
+======================================================
+XS1930$ gobootext # starts the second stage ZynOS bootloader
+</code>
+The unlocked U-Boot allows disabling autoboot of the second stage. The flash layout is also found in the memory layout information obtained by the atmp command in the ZynOS bootloader.
+The Flash chip can be read out via a SOIC-clamp when the device is off. After splitting the image into the partitions, the ZynOS kernel and all the user-land code sit in
+<code>
+$ hd 16_RasCode.bin|head
+00000000  00 00 00 00 00 00 53 49  47 04 01 f0 67 78 00 3c  |......SIG...gx.<|
+00000010  2d c9 e0 00 6f 84 e8 74  58 53 31 39 33 30 00 00  |-...o..tXS1930..|
+00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000030  5d 00 00 80 00 78 67 f0  01 00 00 00 00 00 20 02  |]....xg....... .|
+00000040  08 61 15 9e dc b2 69 e3  6d 0a d6 19 ab 9f 87 dd  |.a....i.m.......|
+00000050  60 1f b5 d1 d0 e4 62 e8  0a 8a 8b 58 c4 9d fa 3c  |`.....b....X...<|
+00000060  e6 b9 60 2b 3a 06 fb a2  98 bd 0d f0 b4 30 46 b8  |..`+:........0F.|
+00000070  a9 2c 67 f7 97 9d 56 51  44 f6 e5 c9 df 6c 2f 51  |.,g...VQD....l/Q|
+00000080  47 1d 24 9c e7 c8 82 97  9e 3f 9a 6c 6a fc 2f 30  |G.$......?.lj./0|
+00000090  a3 2c cb b7 b0 b3 85 1d  aa 0b 48 ab 9c 01 cd d3  |.,........H.....|
+a: 01f06778 Length (uncompressed)
+e: 003c2dc9 Length
+: 6f84 Checksum (before uncompression)
+: e874 Other Checksum
+</code>
+You can compare the header informtion in the first 0x30 bytes with the output of ATMP in the ZynOS bootloader to identify some data fields. The image is lzma compressed, but there seem to be some trailer that cannot be decompressed with standard tools, nevertheless the RAM image can be obtained by:
+<code>
+$ dd if=16_RasCode.bin bs=16 skip=3 of=16_RasCode_headerless.bin
+$ mv 16_RasCode_headerless.bin 16_RasCode_headerless.lzma
+$ xz -c -d 16_RasCode_headerless.lzma >RasCode_image.bin # ignore errors
+</code>
+You can directly load RasCode_image.bin into a disassembler at memory location 0x80274000 for analysis (see above: 2: RasCode(RAMCODE), start=0x80274000, len=4000000). Add a RAM segment after this: (3: RasData(RAM), start=0x84274000, len=9C8C000).
+===== OpenWrt =====
+A very initial boot of OpenWrt looks like this:
+<code>
+    [    0.000000] Calling smp_setup_processor_id
+    [    0.000000] Calling boot_cpu_init
+    [    0.000000] Linux version 5.4.70 (birger@AMDDesktop) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r14727-627da9a38c)) #0 Thu Oct 29 18:33:33 2020
+    [    0.000000] prom_init called
+    [    0.000000] RTL838X model is 0
+    [    0.000000] RTL839X model is 0
+    [    0.000000] RTL93XX model is 93130001
+    [    0.000000] SoC Type: RTL9313
+    [    0.000000] Kernel command line:
+    [    0.000000] printk: bootconsole [early0] enabled
+    [    0.000000] CPU0 revision is: 0001a120 (MIPS interAptiv (multi))
+    [    0.000000] plat_mem_setup called
+    [    0.000000] MIPS: machine is Zyxel XS1900-10
+    [    0.000000] Registering _machine_restart
+    [    0.000000] NO PCI device found
+    [    0.000000] Initrd not found or empty - disabling initrd
+    [    0.000000] device_tree_init called
+    [    0.000000] Using appended Device Tree.
+    [    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
+    [    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
+    [    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
+    [    0.000000] Zone ranges:
+    [    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
+    [    0.000000] Movable zone start for each node
+    [    0.000000] Early memory node ranges
+    [    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
+    [    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
+    [    0.000000] On node 0 totalpages: 32768
+    [    0.000000]   Normal zone: 288 pages used for memmap
+    [    0.000000]   Normal zone: 0 pages reserved
+    [    0.000000]   Normal zone: 32768 pages, LIFO batch:7
+    [    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
+    [    0.000000] pcpu-alloc: [0] 0
+    [    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
+    [    0.000000] Kernel command line: console=ttyS0,115200
+    [    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
+    [    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
+    [    0.000000] Writing ErrCtl register=00000000
+    [    0.000000] Readback ErrCtl register=00000000
+    [    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
+    [    0.000000] Memory: 114840K/131072K available (4758K kernel code, 167K rwdata, 1056K rodata, 8732K init, 199K bss, 16232K reserved, 0K cma-reserved)
+    [    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
+    [    0.000000] NR_IRQS: 64
+    [    0.000000] Found Interrupt controller: cpuintc (cpuintc)
+    [    0.000000] ICU Memory: b8003000
+    [    0.000000] random: get_random_bytes called from start_kernel+0x398/0x580 with crng_init=0
+    [    0.000000] CPU frequency from device tree: 700000000
+    [    0.000000] CPU Clock: 700 MHz
+    [    0.000000] PLL control register: 0
+    [    0.000000] Found NS16550a: uart (uart@b8002000)
+    [    0.000000] Using default baud rate: 38400
+    b[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5460744132 ns
+    [    0.000011] sched_clock: 32 bits at 350MHz, resolution 2ns, wraps every 6135667710ns
+    [    2.733736] printk: console [ttyS0] enabled
+    [    2.733736] printk: console [ttyS0] enabled
+    [    4.214661] printk: bootconsole [early0] disabled
+    [    4.214661] printk: bootconsole [early0] disabled
+    [    5.880845] Calibrating delay loop... 464.38 BogoMIPS (lpj=928768)
+    [    5.918555] pid_max: default: 32768 minimum: 301
+    [    5.926097] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
+    [    5.937684] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
+    [    5.956103] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
+    [    5.971604] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
+    [    5.982629] pinctrl core: initialized pinctrl subsystem
+    [    5.991980] NET: Registered protocol family 16
+    [    5.999926] cpuidle: using governor ladder
+    [    6.053678] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
+    [    6.074570] clocksource: Switched to clocksource MIPS
+    [    6.084551] NET: Registered protocol family 2
+    [    6.092686] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
+    [    6.106015] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
+    [    6.118152] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
+    [    6.129314] TCP: Hash tables configured (established 1024 bind 1024)
+    [    6.139640] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
+    [    6.150064] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
+    [    6.161582] NET: Registered protocol family 1
+    [    6.623572] workingset: timestamp_bits=14 max_order=15 bucket_order=1
+    [    6.642136] squashfs: version 4.0 (2009/01/31) Phillip Lougher
+    [    6.651435] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
+    [    6.701133] Probing RTL838X GPIOs
+    [    6.706472] Unknown GPIO chip id (9313)
+    [    6.763285] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
+    [    6.773669] serial8250: ttyS0 at MMIO 0x0 (irq = 0, base_baud = 12442400) is a 16550A
+    [    6.787719] b8002100.uart: ttyS1 at MMIO 0xb8002100 (irq = 30, base_baud = 12500000) is a 16550A
+    [    7.029159] brd: module loaded
+    [    7.034875] Initializing rtl838x_nor_driver
+    [    7.041589] SPI resource base is b8001200
+    [    7.047936] Address mode is 3 bytes
+    [    7.053441] rtl838x_nor_init called
+    [    7.060984] rtl838x-nor b8001200.spi: mx25l25635e (32768 Kbytes)
+    [    7.070668] 7 fixed-partitions partitions found on MTD device rtl838x_nor
+    [    7.081412] Creating 7 MTD partitions on "rtl838x_nor":
+    [    7.089693] 0x000000000000-0x000000040000 : "u-boot"
+    [    7.099307] 0x000000040000-0x000000050000 : "u-boot-env"
+    [    7.109428] 0x000000050000-0x000000060000 : "u-boot-env2"
+    [    7.119797] 0x000000060000-0x000000160000 : "jffs"
+    [    7.129070] 0x000000160000-0x000000260000 : "jffs2"
+    [    7.138489] 0x000000260000-0x000000930000 : "runtime"
+    [    7.168966] 0x000000930000-0x000001000000 : "runtime2"
+    [    7.179185] Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
+    [    7.196034] libphy: Fixed MDIO Bus: probed
+    [    7.202776] Probing RTL838X switch device
+    [    7.209210] Chip-Info: 0
+    [    7.213223] Chip version A
+    [    7.217499] In rtl838x_mdio_probe
+    [    7.222783] Found compatible MDIO node!
+    [    7.228843] Deferring probe of mdio bus
+    [    7.235606] Probing RTL838X eth device pdev: 87c6c200, dev: 87c6c210
+    [    7.267380] Found SoC ID: 9313: RTL9313, family 9310
+    [    7.275232] rtl8380_init_mac
+    [    7.279842] rtl838x-eth bb00a300.ethernet (unnamed net_device) (uninitialized): Invalid MAC address, using random
+    [    7.296077] In rtl838x_set_mac_hw
+    [    7.301315] Using MAC 0000d2270eff996a
+    [    7.307244] Using MAC 0000d2270eff996a
+    [    7.313159] rtl838x_mdio_init called
+    [    7.319118] libphy: rtl839x-eth-mdio: probed
+    [    7.706251] In rtl838x_validate
+    [    7.711393] In rtl838x_validate
+    [    7.716632] i2c /dev entries driver
+    [    7.724338] NET: Registered protocol family 10
+    [    7.740036] Segment Routing with IPv6
+    [    7.746079] NET: Registered protocol family 17
+    [    7.753816] 8021q: 802.1Q VLAN Support v1.8
+    [    7.761510] Probing RTL838X switch device
+    [    7.767996] Chip-Info: 0
+    [    7.772015] Chip version A
+    [    7.776292] In rtl838x_mdio_probe
+    [    7.781572] Found compatible MDIO node!
+    [    7.891354] rtl838x-switch: probe of 0.switch failed with error -5
+    [    7.927723] Freeing unused kernel memory: 8732K
+    [    7.934917] This architecture does not have kernel memory protection.
+    [    7.945087] Run /init as init process
+    [    8.075879] init: Console is alive
+    [    8.117882] kmodloader: loading kernel modules from /etc/modules-boot.d/*
+    [    8.133249] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
+    [    8.159197] init: - preinit -
+    [    8.475963] random: jshn: uninitialized urandom read (4 bytes read)
+    [    8.573223] random: jshn: uninitialized urandom read (4 bytes read)
+    ls: /sys/class/net/*/dsa: No such file or directory
+    [    8.713165] random: jshn: uninitialized urandom read (4 bytes read)
+    Press the [f] key and hit [enter] to enter failsafe mode
+    Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
+    [   11.991619] procd: - early -
+    [   13.883957] procd: - ubus -
+    [   13.902292] urandom_read: 2 callbacks suppressed
+    [   13.902306] random: ubusd: uninitialized urandom read (4 bytes read)
+    [   13.939781] random: ubusd: uninitialized urandom read (4 bytes read)
+    [   13.950929] random: ubusd: uninitialized urandom read (4 bytes read)
+    [   13.963796] procd: - init -
+    Please press Enter to activate this console.
+    [   14.728783] kmodloader: loading kernel modules from /etc/modules.d/*
+    [   14.799004] Mirror/redirect action on
+    [   14.842726] u32 classifier
+    [   14.847072]     input device check on
+    [   14.852861]     Actions configured
+    [   14.975248] xt_time: kernel timezone is -0000
+    [   15.038988] PPP generic driver version 2.4.2
+    [   15.060796] NET: Registered protocol family 24
+    [   15.098664] urngd: v1.0.2 started.
+    [   15.113580] kmodloader: done loading kernel modules from /etc/modules.d/*
+    [   15.298600] random: crng init done
+    [   15.304005] random: 2 urandom warning(s) missed due to ratelimiting
+    BusyBox v1.31.1 () built-in shell (ash)
+      _______                     ________        __
+     |       |.-----.-----.-----.|  |  |  |.----.|  |_
+     |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
+     |_______||   __|_____|__|__||________||__|  |____|
+              |__| W I R E L E S S   F R E E D O M
+     -----------------------------------------------------
+     OpenWrt SNAPSHOT, r14727-627da9a38c
+     -----------------------------------------------------
+    === WARNING! =====================================
+    There is no root password defined on this device!
+    Use the "passwd" command to set up a new password
+    in order to prevent unauthorized SSH logins.
+    --------------------------------------------------
+root@OpenWrt:/# cat /proc/cpuinfo
+system type             : RTL9313
+machine                 : Zyxel XS1900-10
+processor               : 0
+cpu model               : MIPS interAptiv (multi) V2.0
+BogoMIPS                : 464.38
+wait instruction        : yes
+microsecond timers      : yes
+tlb_entries             : 64
+extra interrupt vector  : yes
+hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
+isa                     : mips1 mips2 mips32r1 mips32r2
+ASEs implemented        : mips16 dsp mt eva
+Options implemented     : tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal perf_cntr_intr_bit cdmm ebase_wg perf
+shadow register sets    : 1
+kscratch registers      : 0
+package                 : 0
+core                    : 0
+VCED exceptions         : not available
+VCEI exceptions         : not available
+root@OpenWrt:/# cat /proc/interrupts
+           CPU0
+:          0      MIPS   2  IRQ cascade 1
+:          0      MIPS   3  IRQ cascade 2
+:          0      MIPS   4  IRQ cascade 3
+:          0      MIPS   5  IRQ cascade 4
+:          0      MIPS   6  IRQ cascade 5
+:          0      MIPS   7  timer
+ERR:          0
+</code>