I am trying to add support to a board referred as "MediaTek MT7621 reference board" (as found in uboot). RuxTek is not the manufacturer but they re-sell it.
Here follows what I have done:
// --------------------- STEP 1: verify u-boot and flash layout -------------------
First of all I opened the case, connected the UART pins (115200 baud rate) and with access to u-boot console I verified the chipset and flash layout:
MT7621AT (SoC)
MT7975DN + MT7905DAN (WiFi)
MT7530 (switch)
Flash Layout
"Bootloader" - from 0x000000000000 to 0x000000040000.
"BootConfig" - from 0x000000040000 to 0x000000050000.
"Factory" - from 0x000000050000 to 0x000000060000.
"permanent_config" - from 0x000000060000 to 0x0000000e0000
"firmware" - from 0x0000000e0000 to 0x000001000000
I wonder what is stored in "factory" and "permanent_config". Perhaps wifi callibration in any of them...
// --------------------- STEP 2: boot menu -------------------
Interrupting the automatic sequence from boot, I reached the u-boot menu:
And then u-boot console:
U-Boot SPL 2018.09-g63a3496 (Sep 18 2019 - 17:31:41 +0800)
Trying to boot from NOR
U-Boot 2018.09-svn2945 (Aug 08 2022 - 12:23:33 +0800)
CPU: MediaTek MT7621AT ver 1, eco 3
Clocks: CPU: 880MHz, DDR: 1200MHz, Bus: 220MHz, XTAL: 40MHz
Model: MediaTek MT7621 reference board
DRAM: 256 MiB
Loading Environment from SPI Flash... SF: Detected w25q128bv with page size 256 Bytes, erase size 64 KiB, total 16 MiB
*** Warning - bad CRC, using default environment
In: uartlite0@1e000c00
Out: uartlite0@1e000c00
Err: uartlite0@1e000c00
Net:
Warning: eth@1e100000 (eth0) using random MAC address - ba:6e:8b:bd:30:cf
eth0: eth@1e100000
Hit any key to stop autoboot: 0
=> [B▒
Unknown command '[B▒▒' - try 'help'
=> help
? - alias for 'help'
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootmenu- ANSI terminal bootmenu
bootp - boot image via network using BOOTP/TFTP protocol
chpart - change active partition
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
echo - echo args to console
editenv - edit environment variable
env - environment handling commands
fdt - flattened device tree utility commands
go - start application at address 'addr'
gpio - query and control gpio pins
help - print command description/usage
httpd - Start failsafe HTTP server
iminfo - print header information for application image
itest - return true/false on integer compare
led - manage LEDs
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loadx - load binary file over serial line (xmodem mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mtkautoboot- Display MediaTek bootmenu
mtkboardboot- Boot MTK firmware
mtkload - MTK image loading utility
mtkupgrade- MTK firmware/bootloader upgrading utility
mw - memory write (fill)
nm - memory modify (constant address)
printenv- print environment variables
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
setexpr - set environment variable as the result of eval expression
sf - SPI flash sub-system
sleep - delay execution for some time
source - run script from memory
tftpboot- boot image via network using TFTP protocol
version - print monitor, compiler and linker version
// --------------------- STEP 3: failsafe mode, SSH to factory FW -------------------
By pressing "f" then "enter" interrupting the boot sequence, I could boot in failsafe mode, and then change the password (for a user called "mtc" not root but seems to be the same). Now I can access via SSH.
The firmware is based on OpenWRT/LEDE 17.01, with MTK drivers (closed source), I verified the flash layout again from here. Here is the /etc/board.json file:
{
"model": {
"id": "mt7621-rfb-ax-nor",
"name": "MediaTek MT7621 RFB (802.11ax,SNOR)"
},
"network": {
"lan": {
"ifname": "eth0",
"protocol": "static"
},
"wan": {
"ifname": "eth1",
"protocol": "dhcp"
}
},
"switch": {
"switch0": {
"enable": true,
"reset": true,
"ports": [
{
"num": 0,
"role": "lan"
},
{
"num": 1,
"role": "lan"
},
{
"num": 2,
"role": "lan"
},
{
"num": 4,
"role": "wan"
},
{
"num": 6,
"device": "eth0",
"need_tag": false,
"want_untag": false
},
{
"num": 5,
"device": "eth1",
"need_tag": false,
"want_untag": false
}
],
"roles": [
{
"role": "lan",
"ports": "0 1 2 6",
"device": "eth0"
},
{
"role": "wan",
"ports": "4 5",
"device": "eth1"
}
]
}
}
}
// --------------------- STEP 4: make a first FW and to test in RAM (failure) -------------------
I used as basis TP-Link Archer AX23 to edit the .mk and create a .dts.
I added to buildroot/target/linux/ramips/image/mt7621.mk
define Device/paicorp_sm-1
$(Device/dsa-migration)
$(Device/uimage-lzma-loader)
DEVICE_VENDOR := PaiCorp
DEVICE_MODEL := SM-1
DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
KERNEL := $(KERNEL_DTB) | uImage lzma
IMAGE_SIZE := 15744k
endef
TARGET_DEVICES += paicorp_sm-1
And I created buildroot/target/linux/ramips/dts/mt7621_paicorp_sm-1.dts , only editing the part related to the flash layout:
// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
#include "mt7621.dtsi"
#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>
/ {
compatible = "paicorp,sm-1", "mediatek,mt7621-soc";
model = "PaiCorp SM-1";
aliases {
led-boot = &led_power;
led-failsafe = &led_power;
led-running = &led_power;
led-upgrade = &led_power;
label-mac-device = &gmac0;
};
chosen {
bootargs = "console=ttyS0,115200";
};
keys {
compatible = "gpio-keys";
reset {
label = "reset";
gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
linux,code = <KEY_RESTART>;
};
wps {
label = "rfkill";
gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
linux,code = <KEY_RFKILL>;
};
};
leds {
compatible = "gpio-leds";
led_power: power {
label = "green:power";
gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
};
wifi2g {
label = "green:wifi2g";
gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
linux,default-trigger = "phy0tpt";
};
wifi5g {
label = "green:wifi5g";
gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
linux,default-trigger = "phy1tpt";
};
wan-green {
label = "green:wan";
gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
};
wan-orange {
label = "orange:wan";
gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
};
lan {
label = "green:lan";
gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
};
wps {
label = "green:wps";
gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
};
};
};
&spi0 {
status = "okay";
flash@0 {
compatible = "jedec,spi-nor";
reg = <0>;
spi-max-frequency = <25000000>;
partitions {
compatible = "fixed-partitions";
#address-cells = <1>;
#size-cells = <1>;
partition@0 {
label = "Bootloader";
reg = <0x000000000000 0x000000040000>;
read-only;
};
partition@40000 {
label = "BootConfig";
reg = <0x000000040000 0x000000050000>;
read-only;
};
config: partition@50000 {
label = "Factory";
reg = <0x000000050000 0x000000060000>;
read-only;
};
permanent_config: partition@60000 {
label = "permanent_config";
reg = <0x000000060000 0x0000000e0000>;
read-only;
};
partition@0e0000 {
compatible = "denx,uimage";
label = "firmware";
reg = <0x0000000e0000 0x000001000000>;
};
};
};
};
&pcie {
status = "okay";
};
&pcie1 {
wifi@0,0 {
compatible = "mediatek,mt76";
reg = <0x0000 0 0 0 0>;
mediatek,mtd-eeprom = <&permanent_config 0x0>;
nvmem-cells = <&macaddr_config_8>;
nvmem-cell-names = "mac-address";
mediatek,disable-radar-background;
};
};
&gmac0 {
nvmem-cells = <&macaddr_config_8>;
nvmem-cell-names = "mac-address";
};
&gmac1 {
status = "okay";
label = "wan";
phy-handle = <ðphy4>;
nvmem-cells = <&macaddr_config_8>;
nvmem-cell-names = "mac-address";
mac-address-increment = <1>;
};
&mdio {
ethphy4: ethernet-phy@4 {
reg = <4>;
};
};
&switch0 {
ports {
port@0 {
status = "okay";
label = "lan1";
};
port@1 {
status = "okay";
label = "lan2";
};
port@2 {
status = "okay";
label = "lan3";
};
port@3 {
status = "okay";
label = "lan4";
};
};
};
&state_default {
gpio {
groups = "i2c", "uart3", "jtag", "wdt";
function = "gpio";
};
};
&config {
compatible = "nvmem-cells";
#address-cells = <1>;
#size-cells = <1>;
macaddr_config_8: macaddr@8 {
reg = <0x8 0x6>;
};
};
Since at the moment I can not determine a precise board model, I user the names of my project provisionally.
But always when I try to boot the initramfs image in RAM (tftpboot + bootm from u-boot console) the result is the same (with this "custom" firmware, with a firmware for Archer AX23, also tested with Tenbay T-MB5EU V01). Here is an example:
tftpboot tenbay-initramfs-kernel.bin
Using eth@1e100000 device
TFTP from server 192.168.0.43; our IP address is 192.168.0.155
Filename 'tenbay-initramfs-kernel.bin'.
Load address: 0x80010000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##
6.5 MiB/s
done
Bytes transferred = 5749604 (57bb64 hex)
=> bootm 0x80010000
## Loading kernel from FIT Image at 80010000 ...
Using 'config@1' configuration
Trying 'kernel-1' kernel subimage
Description: MIPS OpenWrt Linux-5.15.137
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x800100e4
Data Size: 5735847 Bytes = 5.5 MiB
Architecture: MIPS
OS: Linux
Load Address: 0x80001000
Entry Point: 0x80001000
Hash algo: crc32
Hash value: 70aa4d8d
Hash algo: sha1
Hash value: b89ef9242eeeeb7b5c91138d91b42b423eecd77b
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 80010000 ...
Using 'config@1' configuration
Trying 'fdt-1' fdt subimage
Description: MIPS OpenWrt tenbay_t-mb5eu-v01 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x805887d0
Data Size: 11850 Bytes = 11.6 KiB
Architecture: MIPS
Hash algo: crc32
Hash value: b9b7ec00
Hash algo: sha1
Hash value: 55e4b8972804a60b5107e63e989387413a2a0917
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x805887d0
Uncompressing Kernel Image ... lzma compressed: uncompress error 1
Must RESET board to recover
Web failsafe UI started
Uncompressing Kernel Image ... lzma compressed: uncompress error 1 is the error, so I am stuck here, unavailable to get a firmware which can start to work.
Hope this is enough to start, thank you for your attention
