Adding support for Belkin Netcam F7D7602v2

For Developers
1

Looking for some guidance on next steps for getting OpenWRT ported to this thing.

So far, I have:

  • UART (57600, 8N1)
  • Ethernet connectivity (soldered dupont pins to the empty header on the board and spliced an ethernet cable, no port on the device)
  • Identified supported CPU (MT7620A)
  • Tried to flash a few device images with similar specifications (8/64 with 1 ethernet port) to see if I could get lucky

Unfortunately, there is no kind of web interface for this device after Belkin put out a firmware update in 2020. The bootloader is also quite locked down and won't let me into the U-Boot command line option 4, only lets me flash via TFTP. I've also tried multiple passwords for the shell in the stock Linux image.

Wondering if there's enough information here to get the image working. Would trying to brute force the password in the stock environment be worth it? Am I going to have to resort to reading the stock image directly off the flash or something to get the information I need? Still pretty new to this but really interested to learn.

Internal images
Boot log
Flashing attempt log

1 Like
2

What do you expect if OpenWRT is running on a webcam?
There is a lot of stuff needed by the cam and I believe OpenWRT will not serve your needs...

Just my 0,02€

3

Fair question, I actually got 2 older models running just fine on my network (albeit there was already a bootable image) and bought this newer one on eBay out of curiosity.

Just video
Audio and video via image builder

4

Good luck for your project :+1:

5

I was able to get at least the SPL working from https://downloads.openwrt.org/releases/23.05.3/targets/ramips/mt7620/u-boot-mt7620_rfb/ but I get the error:

Trying to boot from NOR
SPL: Image overlaps SPL

Since then, I've purchased a flash programmer and have a firmware dump but am unsure of exactly what I need from it. I even tried slicing up the image to just u-boot to see if it would fallback to the command line but it didn't.

Any advice here? Am I on the right track?

6

More updates. I was able to build the newest u-boot from source and flash it via my programmer. I've been tftpbooting a ton of kernel images, some of which are from openwrt and some are ones I compiled myself and I've been getting lzma uncompress errors, bad gzipped data, bad checksums, and sometimes it just freezes at loading the kernel image.

I feel like I'm missing a step here. Now that I have a fully unlocked u-boot, should I be doing something else before just trying to tftp a bunch of images? Or should I revert back to the stock u-boot and start over? I feel like there's an answer somewhere because this SoC seems to be well supported by OpenWRT. Do I just need a proper DTS to compile the right image? Still very much a noob.

1 Like
7

So I got OpenWRT flashed by decompressing the https://archive.openwrt.org/releases/23.05.2/targets/ramips/mt7620/openwrt-23.05.2-ramips-mt7620-ralink_mt7620a-evb-initramfs-kernel.bin image, rebuilding the uimage header, and booting with tftpboot!

Ethernet is working as expected but my next challenge is USB. Per the stock bootlogs, there should be two USB devices, once of which being the UVC camera and the other I'm assuming is the wifi? When I install the OpenWRT kernel modules for usb, I do get an OHCI and EHCI root hub, but no devices.

[  283.314089] usbcore: registered new interface driver hub
[  283.324851] usbcore: registered new device driver usb
[  283.346342] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[  283.363164] fsl-ehci: Freescale EHCI Host controller driver
[  283.379462] ehci-platform: EHCI generic platform driver
[  283.400516] phy phy-usbphy.0: remote usb device wakeup disabled
[  283.412366] phy phy-usbphy.0: UTMI 16bit 30MHz
[  283.421213] ehci-platform 101c0000.ehci: EHCI Host Controller
[  283.432712] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1
[  283.448668] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000
[  283.470170] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00
[  283.487012] hub 1-0:1.0: USB hub found
[  283.510291] hub 1-0:1.0: 1 port detected
[  283.550433] kmodloader: done loading kernel modules from /etc/modules.d/*
[  283.783345] kmodloader: loading kernel modules from /etc/modules.d/*
[  283.811232] kmodloader: done loading kernel modules from /etc/modules.d/*
[  283.935132] kmodloader: loading kernel modules from /etc/modules.d/*
[  283.963057] kmodloader: done loading kernel modules from /etc/modules.d/*
[  315.718731] kmodloader: loading kernel modules from /etc/modules.d/*
[  315.742220] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[  315.757625] ohci-platform: OHCI generic platform driver
[  315.768621] ohci-platform 101c1000.ohci: Generic Platform OHCI controller
[  315.782257] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 2
[  315.798197] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000
[  315.844013] hub 2-0:1.0: USB hub found
[  315.865874] hub 2-0:1.0: 1 port detected

I see they each have an irq of 26 vs 18 in the stock bootlog. I confirmed it seems like it should be 18 per the dtsi https://github.com/openwrt/openwrt/blob/main/target/linux/ramips/dts/mt7620a_ralink_mt7620a-evb.dts Any advice?

8

I got USB working! Looks like it's powered by GPIO0. If I set that to high on boot, USB connects and I can use mjpg-streamer to get an image from the camera! Installing alsa-utils and the modules doesn't find a sound card, though. And Wi-Fi is still not working. My best guess is the device tree is off? I feel like I just got lucky having most of the devices at the same addresses as the evaluation board this image is supposed to be for. I've also tried extracting the DTB from the image, but this device might have been built before those were popular. I'll attach the boot log below and continue my research.

[    0.000000] Linux version 5.15.134 (charlie@csslt-KUBUNTU) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23497-6637af95aa) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Mon Oct 9 21:45:35 2023
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620A ver:2 eco:6
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is Ralink MT7620a + MT7610e evaluation board
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=000545e2
[    0.000000] Readback ErrCtl register=000545e2
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 117792K/131072K available (5517K kernel code, 600K rwdata, 1184K rodata, 4400K init, 215K bss, 13280K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000002] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015552] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087787] pid_max: default: 32768 minimum: 301
[    0.098080] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.112500] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.136645] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.156148] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.169841] pinctrl core: initialized pinctrl subsystem
[    0.181591] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.682949] mt7620-pci 10140000.pcie: PCIE0 no card, disable it(RST&CLK)
[    0.696159] mt7620-pci: probe of 10140000.pcie failed with error -1
[    0.715437] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.726508] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.741138] clocksource: Switched to clocksource systick
[    0.753232] NET: Registered PF_INET protocol family
[    0.763157] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.778295] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.794880] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.810209] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.825451] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.839469] TCP: Hash tables configured (established 1024 bind 1024)
[    0.852282] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.865211] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.879517] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.890752] PCI: CLS 0 bytes, default 32
[    0.898772] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    1.609167] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    1.628542] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.640083] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.663174] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.677013] printk: console [ttyS0] disabled
[    1.685523] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[    1.705163] printk: console [ttyS0] enabled
[    1.705163] printk: console [ttyS0] enabled
[    1.721736] printk: bootconsole [early0] disabled
[    1.721736] printk: bootconsole [early0] disabled
[    1.747983] spi spi0.0: force spi mode3
[    1.756516] spi-nor spi0.0: w25q128 (16384 Kbytes)
[    1.766225] 4 fixed-partitions partitions found on MTD device spi0.0
[    1.778943] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    1.793559] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    1.808492] Creating 4 MTD partitions on "spi0.0":
[    1.818149] 0x000000000000-0x000000030000 : "u-boot"
[    1.829838] 0x000000030000-0x000000040000 : "u-boot-env"
[    1.841931] 0x000000040000-0x000000050000 : "factory"
[    1.853635] 0x000000050000-0x000000800000 : "firmware"
[    1.895820] gsw: ephy base address: 8
[    1.904568] mtk_soc_eth 10100000.ethernet: generated random MAC address 1e:a6:b6:50:bb:21
[    4.550119] mtk_soc_eth 10100000.ethernet eth0 (uninitialized): port 0 link up (100Mbps/Full duplex)
[    7.713726] mtk_soc_eth 10100000.ethernet: connected port 4 to PHY at mdio-bus:04 [uid=0000ffff, driver=Generic PHY]
[    7.735130] mtk_soc_eth 10100000.ethernet: connected port 5 to PHY at mdio-bus:05 [uid=0000ffff, driver=Generic PHY]
[    7.756377] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[    7.768931] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    7.786244] rt2880_wdt 10000120.watchdog: Initialized
[    7.798165] NET: Registered PF_INET6 protocol family
[    7.817004] Segment Routing with IPv6
[    7.824543] In-situ OAM (IOAM) with IPv6
[    7.832562] NET: Registered PF_PACKET protocol family
[    7.842780] 8021q: 802.1Q VLAN Support v1.8
[    7.878769] Freeing unused kernel image (initmem) memory: 4400K
[    7.890625] This architecture does not have kernel memory protection.
[    7.903482] Run /init as init process
[    8.507990] init: Console is alive
[    8.515578] init: - watchdog -
[    8.557455] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    8.589167] usbcore: registered new interface driver usbfs
[    8.600286] usbcore: registered new interface driver hub
[    8.611058] usbcore: registered new device driver usb
[    8.629801] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    8.647198] fsl-ehci: Freescale EHCI Host controller driver
[    8.660458] ehci-platform: EHCI generic platform driver
[    8.681523] phy phy-usbphy.0: remote usb device wakeup disabled
[    8.693363] phy phy-usbphy.0: UTMI 16bit 30MHz
[    8.702218] ehci-platform 101c0000.ehci: EHCI Host Controller
[    8.713696] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1
[    8.729620] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000
[    8.752662] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00
[    8.766438] hub 1-0:1.0: USB hub found
[    8.774953] hub 1-0:1.0: 1 port detected
[    8.791580] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    8.805766] ohci-platform: OHCI generic platform driver
[    8.816763] ohci-platform 101c1000.ohci: Generic Platform OHCI controller
[    8.830389] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 2
[    8.846309] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000
[    8.886035] hub 2-0:1.0: USB hub found
[    8.894665] hub 2-0:1.0: 1 port detected
[    8.909487] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    8.928583] init: - preinit -
[    9.064978] usb 1-1: new high-speed USB device number 2 using ehci-platform
[    9.260517] random: jshn: uninitialized urandom read (4 bytes read)
[    9.287446] random: procd: uninitialized urandom read (4 bytes read)
[    9.407716] random: jshn: uninitialized urandom read (4 bytes read)
[   10.092552] 8021q: adding VLAN 0 to HW filter on device eth0
[   10.104684] mtk_soc_eth 10100000.ethernet eth0: port 4 link up (100Mbps/Full duplex)
[   10.122043] mtk_soc_eth 10100000.ethernet eth0: port 5 link up (100Mbps/Full duplex)
[   10.151606] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   10.552708] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   11.043102] mtk_soc_eth 10100000.ethernet eth0: port 4 link down
[   11.055264] mtk_soc_eth 10100000.ethernet eth0: port 5 link down
[   11.091003] procd: - early -
[   11.097250] procd: - watchdog -
[   11.452069] procd: - watchdog -
[   11.460256] procd: - ubus -
[   11.477350] random: ubusd: uninitialized urandom read (4 bytes read)
[   11.500904] random: ubusd: uninitialized urandom read (4 bytes read)
[   11.514298] random: ubusd: uninitialized urandom read (4 bytes read)
[   11.531393] procd: - init -
Please press Enter to activate this console.
[   12.364205] kmodloader: loading kernel modules from /etc/modules.d/*
[   12.991891] videodev: Linux video capture interface: v2.00
[   13.048956] Loading modules backported from Linux version v6.1.24-0-g0102425ac76b
[   13.063966] Backport generated by backports.git v5.15.92-1-44-gd6ea70fafd36
[   13.407931] PPP generic driver version 2.4.2
[   13.431548] NET: Registered PF_PPPOX protocol family
[   13.510570] usb 1-1: Found UVC 1.00 device <unnamed> (114d:8433)
[   13.543747] input: UVC Camera (114d:8433): USB2.0  as /devices/platform/101c0000.ehci/usb1/1-1/1-1:1.0/input/input0
[   13.564951] usbcore: registered new interface driver uvcvideo
[   13.714150] ieee80211 phy0: rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'soc_wmac.eeprom'.
[   13.750409] rt2800_wmac 10180000.wmac: Direct firmware load for soc_wmac.eeprom failed with error -2
[   13.768667] rt2800_wmac 10180000.wmac: Falling back to sysfs fallback for: soc_wmac.eeprom
[   13.991499] ieee80211 phy0: rt2x00lib_request_eeprom_file: Error - Failed to request EEPROM.
[   14.008450] rt2800_wmac: probe of 10180000.wmac failed with error -12
[   14.086109] kmodloader: done loading kernel modules from /etc/modules.d/*
[   15.487425] random: jshn: uninitialized urandom read (4 bytes read)
[   15.878933] random: jshn: uninitialized urandom read (4 bytes read)
[   16.408103] random: jshn: uninitialized urandom read (4 bytes read)
[   16.628911] random: jshn: uninitialized urandom read (4 bytes read)
[   30.570335] random: crng init done
[   30.577139] random: 69 urandom warning(s) missed due to ratelimiting
9

Wi-Fi is working! I found this old post with a solution. After pulling the "factory" partition out of the stock firmware dump, I got it to mount and was able to pull the EEPROM data out of it! Very happy with the progress so far, but there's still three more issues left to tackle.

1: The GPIOs. I've found GPIOs for the USB, the button, and switch, but I haven't found anything else. I'm thinking there has to be GPIO for all of the lights, the IR led, and the light sensor. I've tried setting all of these to high and low through u-boot and OpenWRT but I haven't been able to find them. I'm thinking a device tree is off, then?

2: Sound. I identified the sound module as a Nuvoton NAU8810YG which should be communicating through i2c per documentation I looked at. Of course, this isn't in the device tree either I don't think and even if it was, I'm not sure how to control it. Nowhere in the firmware did I find any strings mentioning alsa, so do I have to write my own driver? Were they doing something custom? I couldn't find any related binaries.

3: Storage. I tried messing with the DTBs and got plenty of errors. I feel like it shouldn't be too tough to change the flash size from 8MB in the image I'm using to 16MB like my device. Could anyone give me a hint there?

Thanks so much for any help.

10

I've added instructions on how to flash along with some configuration files here: https://github.com/csev1755/openwrt-f7d7602v2

11

I have one of these on hand, it's an MT7620 so it should be pretty easy to port in theory, but you will never be able to get perfect OpenWrt support out of the box due to a caveat: this device has no usable Ethernet ports.

Historically WiFi-only devices are very problematic for OpenWrt, because having WiFi enabled by default can potentially break local regulations and put users at risk. Such topics have been discussed again and again and so far there has been no result over the years. For more context you can search for Zsun-SD100 on the OpenWrt GitHub repo.

With that said, since this device is easy to disassemble for serial access, I think it is still worth a shot to send in a pull request without touching the controversial WiFi default topic, and let the user configure the device over serial instead.

The audio codec is hooked up via I2S, the I2C interface is only for control. The chip has a kernel driver nau8810.c so it should more or less just work once you add it to the dt and enable the kernel driver.

For other dt related stuff I can't really help you without being able to test on the hardware myself. I may be able to dig up mine and take a closer look in the upcoming weeks.

12

Thanks so much for the additional insight! I had no idea there would be a problem with enabling Wi-Fi by default.

Not sure where to go from here to try and find those i2s/i2c addresses. Looked through my firmware dump but didn't find anything. Would be very interested to see what you can come up with! Glad there's at least one other person around with one of these who might care enough to get it working :slight_smile:.