Add support for Beeline SmartBox TURBO+

For Developers
28

Layout dynamic partition map - part_map - mtd1

Start Size Comment
0x0 0xa SCFLMAPOK (SerComm Flash Map OK)
0xa 0x7f6 FF FF FF FF FF FF FF
0x800 0x78 Schema partitions mtd
0x878 0x1F788 FF FF FF FF FF FF FF
0x20000 0xa SCFLMAPOK
0x20800 0x78 Schema partitions mtd
0x20878 0xDF788 FF FF FF FF FF FF FF
Schema partitions mtd

little-endian dump

❯ xxd -e -c 12 -s $((0x800)) -l $((0x78)) mtd1
00000800: 00000000 00000000 00100000  ............
0000080c: 00000001 00100000 00100000  ............
00000818: 00000002 00200000 00100000  ...... .....
00000824: 00000003 00300000 00100000  ......0.....
00000830: 00000004 00400000 00600000  ......@...`.
0000083c: 00000005 00a00000 00600000  ..........`.
00000848: 00000006 01000000 02000000  ............
00000854: 00000007 03000000 02000000  ............
00000860: 00000008 05000000 01400000  ..........@.
0000086c: 00000009 06400000 01b80000  ......@.....
Comment-->	№ mtd	Start	Size
29

Layout factory-data (Factory) - mtd2

0x4 - MAC Wi-Fi 2.4 GHz
0x8004 - MAC Wi-Fi 5 GHz
It is possible to make a script that takes from the factory-data SSID, Pass & PIN.

30

Layout dual-flag (Boot Flag) - mtd3

boot_flag indicates which slot to load.
boot_count counts the number of times one slot is started.

Slot Flag kernel rootfs Counter
1 Sercomm0 uImage1 (Kernel 1) rootfs1 (File System 1) boot_count1
2 Sercomm1 uImage2 (Kernel 2) rootfs2 (File System 2) boot_count2

When the U-boot of the specified slot is loaded, its counter is incremented (example FF-> 01). When the stock firmware boots successfully, it will write to the FF counter. If the boot_count = 03 when loading the slot, then the flag will be toggled. if boot_count1 = 03 and boot_count2 = 03 then the device will switch to Emergency mode (start sc_dl).

View flag:
# hexdump -Cn 8 /dev/mtd3                                                       
00000000  53 65 72 63 6f 6d 6d 31                           |Sercomm1|          
00000008
Set flag:
  • Sercomm0 - # printf 0 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
  • Sercomm1 - # printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3
FW OEM v2.0.xx 
~ # bootflag_utility --help
bootflag_utility: invalid option -- -
Usage: ./bootflag_utility [-g] [-s value] [-S]
-g get bootflag
-s set bootflag 0 or 1
-S switch bootflag
View flag:
# bootflag_utility -g    
[bootflag_utility.c:get_bootflag:52] bootflag=Sercomm0
get_bootflag=0
Set flag:
  • Sercomm0 - # bootflag_utility -s 0
  • Sercomm1 - # bootflag_utility -s 1
View counter

$((0x20001))=131073

  • boot_count1 - # hexdump -s 131073 -Cn 1 /dev/mtd3
  • boot_count2 - # hexdump -s 131074 -Cn 1 /dev/mtd3
# hexdump -s 131073 -Cn 2 /dev/mtd3                                             
00020001  ff ff                                             |..|                
00020003
Reset counter
  • boot_count1 - # printf '\xFF' | dd bs=1 count=1 seek=131073 of=/dev/mtdblock3
  • boot_count2 - # printf '\xFF' | dd bs=1 count=1 seek=131074 of=/dev/mtdblock3
Algorithm from MTK SDK

g399
g3992277×1469 167 KB

Reference

APSoC SDK 4.3.0.0 User’s Manual - 209 Page.

1 Like
31

Device OEM picture/photo

SmartBoxTURBO-min
SmartBoxTURBO-min720×490 28.6 KB

SmartBoxTURBO-min
SmartBoxTURBO-min805×900 17 KB
40340
40340933×900 60.9 KB

SmartBoxTURBO2-min
SmartBoxTURBO2-min1135×900 78.2 KB

Referance
1 Like
32

SSH for FirmWare OEM v1.0.12 on Beeline SmartBox TURBO+

  1. Login to the web interface http://192.168.1.1/ (by default) under SuperUser (root) credentials. Password: SDXXXXXXXXXX, where SDXXXXXXXXXX is serial number of the device written on the backplate stick.
Login:		SuperUser
Password:	SDXXXXXXXXXX
  1. Turning on SSH. Navigate to:
-> Advanced settings 
	-> Others 
		-> Access Control 
			-> Users Root Select 
				-> SSH Admin - Enable LAN 
					-> Save 
						-> Apply
  1. Connect SSH
    $ ssh SuperUser@192.168.1.1
  2. Start shell
    view @ Smart Box TURBO+> sh
Referance:

SmartBOX Pro / SmartBOX Turbo+ – обсуждение | [wifirouter] : 300Mb\s - 1200Mb\s + 5x1Gb | x1

1 Like
33

SFTP for FirmWare OEM (v1.0.12)

  1. Connect via SSH.
  2. Edit:
    vi /etc/ssh/sshd_config 
# override default of no subsystems
Subsystem       sftp    /usr/sbin/sftp-server

(dd, i) Replace string

# override default of no subsystems                           
Subsystem       sftp    internal-sftp

ESC
:wq

  1. Restart SSHd:
    kill -HUP $(ps | grep /usr/sbin/sshd | grep -v grep | awk '{print $1}')
  2. Connect via SFTP with a client on a PC, example:
    $ sftp SuperUser@192.168.1.1
    $ mc sftp://SuperUser@192.168.1.1
    $ thunar sftp://SuperUser@192.168.1.1
Referance
Notes

Point № 2, can / should be automated (sed, awk).
In point № 3, there was another option, killall sshd; /usr/sbin/sshd -p 22, but the command was interrupted via SSH, but worked via the UART.

1 Like
34

Generic NAND backup FW OEM

  1. Connect via SSH or via UART
  2. Create dump
    CSN=$(hexdump -e '/2 "%1s"' -n $((0xC)) -s $((0x21010)) /dev/mtd2)
mkdir /tmp/$CSN; cd /tmp/$CSN;
for i in 0 1 2 3 4 5 6 7; do
echo "===Dump mtd$i.bin backup===";
nanddump -f mtd$i.bin /dev/mtd$i;
done
pwd
  3. Copy the directory via SFTP or via TFTP, USB or any other method convenient for you. Example:
    $ scp -r SuperUser@192.168.1.1:/tmp/SD2134F98765 SD2134F98765 with a client on a PC
  4. Delete backup images from RAM router.
    rm -r /tmp/$CSN
  5. Create the remaining backups
    mkdir /tmp/$CSN; cd /tmp/$CSN;
for i in 8 9 10; do
echo "===Dump mtd$i.bin backup===";
nanddump -f mtd$i.bin /dev/mtd$i;
done
  6. Copy the directory via SFTP on PC.
  7. Delete backup images from RAM.
Reference
Memoirs

The creation of a backup takes place in several stages due to the fact that the size of RAM and NAND are the same (128 MiB).
CSN - Serial Number Device.
A directory will be created with the name in the form of the serial number of the device in the /tmp directory with the images of the partitions.
Can be improved. Tried using GZ but no TAR. It turned out the wrong action, there is one combined file in the archive.

Old example for GIGA 
CSN=$(hexdump -e '/2 "%1s"' -n $((0xC)) -s $((0x21010)) /dev/mtd2)
for i in 0 1 2 3 4 5 6 7 8 9 10; do
echo "===Dump mtd$i.bin backup===";
nanddump -f mtd$i.bin /dev/mtd$i;
md5sum mtd$i.bin >> mtd.md5;
gzip -c mtd$i.bin >> $CSN.gz;
done
gzip -c mtd.md5 >> $CSN.gz
1 Like
35

Image's OEM Stock FirmWare

SmartBox TURBO+

SmartBox TURBO

  • v. 1.0.02 - (build @ 2020-06-05, 19:08:35)
  • v. 1.0.03 - (build @ 2020-07-08, 02:15:32) - No URL

Etisalat S3

  • v. 2.0.05 - (build @ 2020-04-10, 23:52:54) - t.me
  • v. 3.0.04 - (build @ 2020-09-27, 06:31:51) - t.me

If there are more versions and/or links, let me know I will add it.

Example
wget -P /tmp https://static.beeline.ru/upload/images/Smart_Box_Turbo_v2.img
Notification of the Eurasian Economic Union
URL
2 Likes
36

OpenWRT images for testing on a device

Have not yet accepted a Pull Request in OpenWRT

Development Snapshot builds

Old

Stable Release builds

  • Sercomm S3 CQR - Beeline SmartBox TURBO+
  • Sercomm S3 DF3 - Beeline SmartBox TURBO
  • Sercomm S3 DDK - Etisalat Sercomm S3
  • Sercomm S3 DKG - Rostelecom Sercomm RT-SF-1
  • Sercomm S3 CX4 - Rostelecom Sercomm RT-FE-1(A)
1 Like
37

Beeline SmartBox TURBO (not +)

There is information about the existence of another Sercomm S3 clone - Beeline SmartBox Turbo. There is not much known information yet.

Differences

  • NAND flash: 256 MiB
  • Ethetnet interfaces have LEDs (Green)
  • CSN: SN2F********
  • MAC LAN: E0:0E:E4:**:**:**
  • Manufacturer's code: 0DF30500QW1
  • NFS? code (Код НФС): 930000610

Thank neopiten [1] [2].
NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Micron NAND 256MiB 3,3V 8-bit), 128MiB, page size: 2048, OOB size: 128

Photo Device

Hide

IMG_20210908_202913
IMG_20210908_2029131920×1440 445 KB

IMG_20210908_202925
IMG_20210908_2029251920×1440 314 KB

Screenshot of the stock firmware web interface

Hide

20211127_155624
20211127_1556241920×2147 603 KB

20211120_210938
20211120_2109381920×1974 315 KB

Thank MellonMike [1] [2].

Firmware
  • In web interface - TURBO+
view @ Smart Box TURBO> show sysinfo 
	Vendor:                       Sercomm
	Model:                        Smart Box TURBO
	CPU:                          MT7621
	Firmware Version:             v1.0.03
	Build Time:                    (build @ 2020-07-08, 02:15:32)
	Hardware Version:             v1
	Bootloader Version:           2.0.1.0
	Serial Number:                SN2F********
	Time Since Last Boot:          0:48:09
	Reboot Cause:                 
	Product Class:                Smart Box TURBO
	Current Time:                 2020-07-08 03:03:02
1 Like
38
1 Like
40

ZigBee on SmartBox TURBO+

  • EFR32MG1B232GG
  • Baudrate - 57600
  • UART-EZSP Gateway Protocol
Probe CLI 
opkg update
opkg install git-http python3-pip
cd /tmp
git clone https://github.com/Elelabs/elelabs-zigbee-ezsp-utility.git
cd elelabs-zigbee-ezsp-utility
pip3 install -r requirements.txt
python3 Elelabs_EzspFwUtility.py probe -p /dev/ttyS1 -b 57600

root@OpenWrt:/tmp/elelabs-zigbee-ezsp-utility# python3 Elelabs_EzspFwUtility.py 
restart -m btl -p /dev/ttyS1 -b 57600
2022/01/22 19:36:32 Elelabs_EzspFwUtility:   Generic Zigbee EZSP adapter detected:
2022/01/22 19:36:32 Elelabs_EzspFwUtility:   Firmware: 6.2.0-147
2022/01/22 19:36:32 Elelabs_EzspFwUtility:   EZSP v6
2022/01/22 19:36:32 Elelabs_EzspFwUtility:   Launch in bootloader mode
2022/01/22 19:36:43 Elelabs_EzspFwUtility:   EZSP adapter in bootloader mode detected:
2022/01/22 19:36:43 Elelabs_EzspFwUtility:   EFR32 Serial Btl v6.2.1.3 b0
On Home Assistant
Example 
opkg install ser2net luci-i18n-ser2net-ru
vi /etc/ser2net.conf
5000:raw:0:/dev/ttyS1:57600 NONE 1STOPBIT 8DATABITS XONXOFF LOCAL -RTSCTS remctl
# on Host
sudo socat pty,raw,link=/dev/ttyVS1 tcp:192.168.1.1:5000

Снимок экрана_2022-01-23_17-28-40

Thank Harwest & lmahmutov

URLs:
1 Like
41

SSH for FirmWare OEM v1.0.03 on Beeline SmartBox TURBO

  1. Login to the web interface http://192.168.1.1/ (by default) under SuperUser (root) credentials. Password: SDXXXXXXXXXX, where SDXXXXXXXXXX is serial number of the device written on the backplate stick.
Login:		SuperUser
Password:	SNXXXXXXXXXX
  1. Configure WAN. Navigate to:
->Setting 
	-> WAN 
		-> ADD
			* Name - WAN1
			* Connection Type - Static
			* IP Address - 172.16.0.1
			* Netmask - 255.255.255.0
				-> Save 
					-> Apply
Default WAN1
  1. Enable SSH and HTTP on WAN.
->Setting 
	-> Remote control 
		-> ADD
			* Protocol - SSH
			* Port - 22
			* IP Address - 172.16.0.1
			* Netmask - 255.255.255.0
			* WAN Interface - WAN1
				-> Save 
					-> Apply
		-> ADD
			* Protocol - HTTP
			* Port - 80
			* IP Address - 172.16.0.1
			* Netmask - 255.255.255.0
			* WAN Interface - WAN1
				-> Save 
					-> Apply
  1. Set up on PC
	* Connection Type - Static
	* IP Address - 172.16.0.2
	* Netmask - 255.255.255.0
	* Gateway - 172.16.0.1
  1. Connect PC cable to WAN TURBO
  2. Connect SSH. Example on Linux without key saving.
    $ ssh -o "UserKnownHostsFile /dev/null" SuperUser@172.16.0.1
  3. Start shell
    view @ Smart Box TURBO+> sh
Referance:
1 Like
42

Generic NAND backup FW OEM via TFTP

  1. Prepare TFTP server* on PC - Setting up a TFTP server for TFTP Recovery/Install
  2. Connect via SSH
  3. Create dump mtd. Enter your address in the "IP=" variable.
CSN=$(hexdump -e '/2 "%1s"' -n $((0xC)) -s $((0x21010)) /dev/mtd2)
IP=172.16.0.2
cd /tmp
echo $CSN >> mtd.md5
for i in 0 1 2 3 4 5 6 7 8 9 10; do 
echo "===Dump mtd$i.bin backup===";
nanddump -f mtd$i.bin /dev/mtd$i;
tftp -l mtd$i.bin -p $IP;
md5sum mtd$i.bin >> mtd.md5;
rm mtd$i.bin; 
done
tftp -l mtd.md5 -p $IP
rm mtd.md5
echo "=== Finish backup ==="

Thank @csharper2005

*People are reporting that dnsmasq is not working. 
tftp: server error: (4) unsupported request from 172.16.0.1

Version

Dnsmasq version 2.86  Copyright (c) 2000-2021 Simon Kelley
Compile time options: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset auth cryptohash DNSSEC loop-detect inotify dumpfile

The method seems to be universal for the entire CPE Sercomm mt7621, only the number of required mtd partitions differs.

Vendor Label MTD**
Sercomm S1500 AWI Beeline SmartBox PRO 12
Sercomm S1500 BUC WiFire S1500.NBN 10
Sercomm S3 CQR Beeline SmartBox TURBO+ 9
Sercomm S3 DF3 Beeline SmartBox TURBO 10
Sercomm S3 DDK Etisalat Sercomm S3 9
Sercomm S2 DBE Beeline SmartBox GIGA 10

** The number of the last required mtd from mtd0 (skipping the section if there is one with BBT).

An alternative way using gz & tar on TURBO sends as a single file. 
CSN=$(hexdump -e '/2 "%1s"' -n $((0xC)) -s $((0x21010)) /dev/mtd2)
IP=10.10.10.3
mkdir /tmp/$CSN; cd /tmp/$CSN;
for i in 0 1 2 3 4 5 6 7 8 9 10; do
echo "===Dump mtd$i.bin backup===";
nanddump -f mtd$i.bin /dev/mtd$i;
md5sum mtd$i.bin >> mtd.md5;
gzip -c mtd$i.bin >> mtd$i.gz;
rm mtd$i.bin;
done
tar -cvf $CSN.gz.tar .
tftp -l $CSN.gz.tar -p $IP
cd /tmp; rm -r /tmp/$CSN
echo "=== Finish backup ==="
Reference
1 Like
43

Installing OpenWRT on SmartBox TURBO via mtd-utils

  1. Generic NAND backup
  2. Prepare TFTP server on PC (Or directly from a USB flash drive)
    • Example on Linux
    sudo atftpd --daemon --no-fork --user $USER.users --logfile - CatalogFolderOpenWRT
  3. Connect via SSH (Or directly with UART)
cd /tmp
tftp -r openwrt-21.02.2-ramips-mt7621-beeline_smartbox-turbo-squashfs-kernel.bin -g 172.16.0.1
tftp -r openwrt-21.02.2-ramips-mt7621-beeline_smartbox-turbo-squashfs-rootfs.bin -g 172.16.0.1
mtd_debug erase /dev/mtd4 0x0 0x600000
mtd_debug write /dev/mtd4 0 $(ls -l openwrt-21.02.2-ramips-mt7621-beeline_smartbox-turbo-squashfs-kernel.bin | awk -F' ' '{print $5}') openwrt-21.02.2-ramips-mt7621-beeline_smartbox-turbo-squashfs-kernel.bin
mtd_debug erase /dev/mtd6 0x0 0x2000000
mtd_debug write /dev/mtd6 0 $(ls -l openwrt-21.02.2-ramips-mt7621-beeline_smartbox-turbo-squashfs-rootfs.bin | awk -F' ' '{print $5}') openwrt-21.02.2-ramips-mt7621-beeline_smartbox-turbo-squashfs-rootfs.bin
printf 0 | dd of=/dev/mtdblock3 bs=1 seek=7 count=1 
reboot
2 Likes
44

Repository for ongoing development and testing

  • Branch - sercomm_s3x

United devices on the same S3 platform:

  • Beeline SmartBox TURBO+
  • Beeline SmartBox TURBO
  • Etisalat Sercomm S3
45
For which device do you expect support to be added to OpenWRT?
  • Sercomm S3 CQR - Beeline SmartBox TURBO+
  • Sercomm S3 DF3 - Beeline SmartBox TURBO
  • Sercomm S3 DDK - Etisalat Sercomm S3
  • Sercomm S3 DKG - Rostelecom Sercomm RT-SF-1
  • Sercomm S3 CX4 - Rostelecom Sercomm RT-FE-1
  • Sercomm S3 CX4 - Rostelecom Sercomm RT-FE-1A

0 voters

46

A little bump for the best value router aka SmartBox TURBO+. When is it gonna be added to the official openwrt repo?

47

Also wanted to point out that your patches have been working very well so far, I've been using TURBO+ for almost a year now. It's kinda sad that getting them in mainstream is taking so long.

1 Like
48

I wonder if Turbo+ can benefit from this Users needed to test 2 Gbps WAN/LAN NAT Routing on ramips MT7621 devices . I really hope maintainers would approve Turbo+ PR so the mux switch dev could look into our device.

1 Like