Exploring Actiontec MI424WR Rev. I

For Developers
1

I have an Actiontec MI424WR Rev. I, and I'm trying to see what I can do with it, with the eventual goal of getting OpenWrt running. So far, I can get a shell over telnet and over serial, and I can use the serial connection to get a bootloader prompt, which looks like this:

BootROM 1.34
Booting from NAND flash
BootROM: Image checksum verification PASSED

 __   __                      _ _
|  \/  | __ _ _ ____   _____| | |
| |\/| |/ _` | '__\ \ / / _ \ | |
| |  | | (_| | |   \ V /  __/ | |
|_|  |_|\__,_|_|    \_/ \___|_|_|
         _   _     ____              _
        | | | |   | __ )  ___   ___ | |_ 
        | | | |___|  _ \ / _ \ / _ \| __| 
        | |_| |___| |_) | (_) | (_) | |_ 
         \___/    |____/ \___/ \___/ \__| 
 ** LOADER **


U-Boot 2009.08 (May 22 2014 - 18:26:38) Marvell version: 2.1.6_NQ

Board: MI424WR-I
SoC:   88F6560 A0
CPU:   Marvell Feroceon (Rev 1) - LE
       CPU @ 1200Mhz, L2 @ 480Mhz
       DDR3 @ 400Mhz, TClock @ 200Mhz
PEX 0: Root Complex Interface, Detected Link X1
PEX 1: Detected No Link.
DRAM:  128 MB
       CS 0: base 0x00000000 size 128 MB
       Addresses 10M - 0M are saved for the U-Boot usage.
NAND:  1bit HM ECC, Size: 128 MiB
USB 0: Host Mode
Shutting down unused interfaces:
       PON
       SATA
       3xFE-PHY
Modules Detected:
       No PON module.
       RGMIIA Module on Switch port #6.
       RGMIIB Module on MAC0.
       Ethernet Switch on MAC1.
       QSGMII Module.
Initialized 1545 PHY
Net:   egiga0, egiga1 [PRIME]
Hit any key to stop autoboot:  
Marvell>> help

?       - alias for 'help'
SatR    - Sample At Reset sub-system

autoscr - DEPRECATED - use "source" command instead
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootext2- bootext2    dev:boot_part1,boot_part2 addr boot_image linux_dev_name 

bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
bubt    - bubt	- Burn an image on the Boot Nand Flash.

cmp     - memory compare
cmpm    - cmpm	- Compare Memory

coninfo - print console devices and information
cp      - memory copy
cpumap  - cpumap - Display CPU memory mapping settings.

crc32   - checksum calculation
date    - get/set/reset date & time
dclk    - dclk	- Display the MV device CLKs.

dhcp    - boot image via network using DHCP/TFTP protocol
diskboot- diskboot- boot from IDE device

dualimage- sets openrg_start and openrg_size according to the current active image.

echo    - echo args to console
eeprom  - EEPROM sub-system
ethCounters- ethShow	- show the current ETH port counters

ethShow - ethShow	- scanning the PHYs status

ext2load- load binary file from a Ext2 filesystem
ext2ls  - list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fi      - fi	- Find value in the memory.

fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
g       - g	- start application at cached address 'addr'(default addr 0x40000)

go      - start application at address 'addr'
help    - print online help
i2c     - I2C sub-system
ide     - ide     - IDE sub-system

iminfo  - print header information for application image
imxtract- extract a part of a multi-image
ir      - ir	- reading and changing MV internal register values.

itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
ls      - list files in a directory (default /)
map     - map	- Diasplay address decode windows

md      - memory display
me      - me	- PCI master enable

mii_dump- Dump mii registers
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub-system
mp      - mp	- map PCI BAR

mpp     - mpp
mtest   - simple RAM read/write test
mux     - mux set
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nbubt   - nbubt	- Burn a boot loader image on the Boot Nand Flash.

nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
pciePhyRead- phyRead	- Read PCI-E Phy register

pciePhyWrite- pciePhyWrite	- Write PCI-E Phy register

phyRead - phyRead	- Read Phy register

phyWrite- phyWrite	- Write Phy register

ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
rcvr    - rcvr	- Satrt recovery process (Distress Beacon with TFTP server)

reset   - Perform RESET of the CPU
resetenv- resetenv	- earse environment sector to reset all variables to default.

run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
se      - se	- PCI Slave enable

setenv  - set environment variables
sg      - sg	- scanning the PHYs status

sleep   - delay execution for some time
source  - run script from memory
sp      - sp	- Scan PCI bus.

switchCountersRead- switchCntPrint	- Read switch port counters.

switchPhyRegRead- - Read switch register

switchPhyRegWrite- - Write switch register

switchRegRead- switchRegRead	- Read switch register

switchRegWrite- switchRegWrite	- Write switch register

tftpboot- boot image via network using TFTP protocol
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor version
Marvell>>

I know the Feroceon 88F6560 is not supported in the mainline Linux kernel, but it seems like there are some builds of PandoraBox available for this router, available here (mirror). Trying to boot one of these images gives me this:

BootROM 1.34
Booting from NAND flash
BootROM: Image checksum verification PASSED

 __   __                      _ _
|  \/  | __ _ _ ____   _____| | |
| |\/| |/ _` | '__\ \ / / _ \ | |
| |  | | (_| | |   \ V /  __/ | |
|_|  |_|\__,_|_|    \_/ \___|_|_|
         _   _     ____              _
        | | | |   | __ )  ___   ___ | |_ 
        | | | |___|  _ \ / _ \ / _ \| __| 
        | |_| |___| |_) | (_) | (_) | |_ 
         \___/    |____/ \___/ \___/ \__| 
 ** LOADER **


U-Boot 2009.08 (May 22 2014 - 18:26:38) Marvell version: 2.1.6_NQ

Board: MI424WR-I
SoC:   88F6560 A0
CPU:   Marvell Feroceon (Rev 1) - LE
       CPU @ 1200Mhz, L2 @ 480Mhz
       DDR3 @ 400Mhz, TClock @ 200Mhz
PEX 0: Root Complex Interface, Detected Link X1
PEX 1: Detected No Link.
DRAM:  128 MB
       CS 0: base 0x00000000 size 128 MB
       Addresses 10M - 0M are saved for the U-Boot usage.
NAND:  1bit HM ECC, Size: 128 MiB
USB 0: Host Mode
Shutting down unused interfaces:
       PON
       SATA
       3xFE-PHY
Modules Detected:
       No PON module.
       RGMIIA Module on Switch port #6.
       RGMIIB Module on MAC0.
       Ethernet Switch on MAC1.
       QSGMII Module.
Initialized 1545 PHY
Net:   egiga0, egiga1 [PRIME]
Hit any key to stop autoboot:  1  0 
Marvell>> tftpboot pandorabox.img

Using egiga1 device
TFTP from server 192.168.1.101; our IP address is 192.168.1.201
Filename 'pandorabox.img'.
Load address: 0x2000000
Loading: *T T T T T T T T #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ##################################################T ###############
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #########################################################
done
Bytes transferred = 13238272 (ca0000 hex)
Marvell>> bootm

## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   ARM PandoraBox Linux-3.14.79
   Created:      2019-01-01  16:41:16 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1652702 Bytes =  1.6 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.14.79 (jenkins@jenkins) (gcc version 5.5.0 (PandoraBox GCC 5.5.0 2018-12-31-git-4b6a3d5ca) ) #0 Mon Dec 31 13:03:10 2018
[    0.000000] CPU: Feroceon 88FR131 [56251311] revision 1 (ARMv5TE), cr=00053977
[    0.000000] CPU: VIVT data cache, VIVT instruction cache
[    0.000000] Machine model: Actiontec MI424WR-I
[    0.000000] Memory policy: Data cache writeback
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,115200n8 earlyprintk
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] allocated 262144 bytes of page_cgroup
[    0.000000] please try 'cgroup_disable=memory' option if you don't want memory cgroups
[    0.000000] Memory: 124332K/131072K available (3511K kernel code, 161K rwdata, 1256K rodata, 134K init, 197K bss, 6740K reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0xc8800000 - 0xff000000   ( 872 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
[    0.000000]     modules : 0xbf000000 - 0xc0000000   (  16 MB)
[    0.000000]       .text : 0xc0008000 - 0xc04afe2c   (4768 kB)
[    0.000000]       .init : 0xc04b0000 - 0xc04d183c   ( 135 kB)
[    0.000000]       .data : 0xc04d2000 - 0xc04fa544   ( 162 kB)
[    0.000000]        .bss : 0xc04fa544 - 0xc052bd00   ( 198 kB)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:114
[    0.000010] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 21474836475ns
[    0.000100] Calibrating delay loop... 1186.81 BogoMIPS (lpj=593408)
[    0.008042] pid_max: default: 32768 minimum: 301
[    0.008181] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.008192] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.009954] Initializing cgroup subsys memory
[    0.009983] Initializing cgroup subsys devices
[    0.009992] Initializing cgroup subsys freezer
[    0.010000] Initializing cgroup subsys net_cls
[    0.010008] Initializing cgroup subsys blkio
[    0.010015] Initializing cgroup subsys perf_event
[    0.010028] Initializing cgroup subsys net_prio
[    0.010110] CPU: Testing write buffer coherency: ok
[    0.010348] Setting up static identity map for 0x10eb8 - 0x10ef4
[    0.011739] pinctrl core: initialized pinctrl subsystem
[    0.012348] regulator-dummy: no parameters
[    0.012693] NET: Registered protocol family 16
[    0.012977] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.014433] cpuidle: using governor ladder
[    0.014464] Avanta: MV88F6560-Rev-2.
[    0.014549] Feroceon L2: Cache support initialised, in WT override mode.
[    0.026082] bio: create slab <bio-0> at 0
[    0.029260] Switched to clocksource orion_clocksource
[    0.029315] PandoraBox SPLICE initialized. rcv c78d0000 (sz:768) kvec c7811000 (sz:256) per 1 core
[    0.031591] NET: Registered protocol family 2
[    0.032364] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.032391] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.032414] TCP: Hash tables configured (established 1024 bind 1024)
[    0.032461] TCP: reno registered
[    0.032472] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.032498] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.032674] NET: Registered protocol family 1
[    0.032901] NetWinder Floating Point Emulator V0.97 (extended precision)
[    0.033300] GPIO Resource maped.
[    0.034603] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.048088] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.048101] jffs2: version 2.2 (SUMMARY) (ZLIB) (RTIME) (RUBIN) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.049059] msgmni has been set to 242
[    0.049982] io scheduler noop registered
[    0.049993] io scheduler deadline registered (default)
[    0.050025] io scheduler cfq registered
[    0.050339] io scheduler bfq registered
[    0.050347] BFQ I/O-scheduler: v7r8
[    0.051215] kirkwood-pinctrl f1018000.pinctrl: registered pinctrl driver
[    0.051966] mvebu-pcie pcie-controller.1: PCI host bridge to bus 0000:00
[    0.051985] pci_bus 0000:00: root bus resource [io  0x1000-0xfffff]
[    0.051998] pci_bus 0000:00: root bus resource [mem 0xf3000000-0xf4000000]
[    0.052010] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.052391] PCI: bus0: Fast back to back transfers disabled
[    0.052407] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.053089] PCI: bus1: Fast back to back transfers disabled
[    0.053175] pci 0000:00:01.0: BAR 8: assigned [mem 0xf3000000-0xf30fffff]
[    0.053194] pci 0000:01:00.0: BAR 0: assigned [mem 0xf3000000-0xf300ffff 64bit]
[    0.053216] pci 0000:00:01.0: PCI bridge to [bus 01]
[    0.053230] pci 0000:00:01.0:   bridge window [mem 0xf3000000-0xf30fffff]
[    0.136295] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.137864] f1012000.serial: ttyS0 at MMIO 0xf1012000 (irq = 33, base_baud = 12500000) is a 16550A
[    0.634459] console [ttyS0] enabled
[    0.639453] nand: device found, Manufacturer ID: 0x92, Chip ID: 0xf1
[    0.645857] nand: Eon NAND 128MiB 3,3V 8-bit
[    0.650161] nand: 128MiB, SLC, page size: 2048, OOB size: 64
[    0.655867] Scanning device for bad blocks
[    0.679230] Bad eraseblock 532 at 0x000004280000
[    0.701616] 3 ofpart partitions found on MTD device orion_nand
[    0.707490] Creating 3 MTD partitions on "orion_nand":
[    0.712673] 0x000000000000-0x000000200000 : "u-boot"
[    0.718784] 0x000000200000-0x000002200000 : "jffs2"
[    0.724776] 0x000003000000-0x000008000000 : "firmware"
[    0.741113] __nand_correct_data: uncorrectable ECC error
[    0.789244] __nand_correct_data: uncorrectable ECC error__nand_correct_data: uncorrectable ECC error
[    0.875141] libphy: Fixed MDIO Bus: probed
[    0.879756] libphy: orion_mdio_bus: probed
[    0.887082] mvneta f1074000.ethernet eth0: Using hardware mac address 00:50:43:00:02:02
[    0.897309] mvneta f1070000.ethernet eth1: Using hardware mac address 00:50:43:00:02:02
[    0.908190] TCP: cubic registered
[    0.912838] NET: Registered protocol family 10
[    0.918334] NET: Registered protocol family 17
[    0.922901] Bridge firewalling registered
[    0.927223] 8021q: 802.1Q VLAN Support v1.8
[    0.931490] PandoraBox Mass Storage accelerater v1.2 
[    0.937198] registered taskstats version 1
[    0.942091] regulator-dummy: disabling
[    0.946770] mvsw61xx 8.mvsw6171: Found MV88F6560 built-in at f1072004.mdio-bu:08
[    0.954226] mvsw61xx 8.mvsw6171: Using indirect addressing
[    0.979699] UBIFS error (pid 1): ubifs_mount: cannot open "ubi0:rootfs", error -19
[    0.987411] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    0.994949] Please append a correct "root=" boot option; here are the available partitions:
[    1.003359] 1f00            2048 mtdblock0  (driver?)
[    1.008473] 1f01           32768 mtdblock1  (driver?)
[    1.013582] 1f02           81920 mtdblock2  (driver?)
[    1.018691] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

I'm not sure how to get any further with PandoraBox. Do I need to write the PandoraBox firmware to NAND in order to get it to boot? I'm hesitant to do that without a working copy of the original firmware, which is not available anywhere as far as I can tell.

I've also explored Actiontec's GPL code. They post kernel sources for the router's stock firmware, and I did get a kernel to build. However, booting it gives me this:

BootROM 1.34
Booting from NAND flash
BootROM: Image checksum verification PASSED

 __   __                      _ _
|  \/  | __ _ _ ____   _____| | |
| |\/| |/ _` | '__\ \ / / _ \ | |
| |  | | (_| | |   \ V /  __/ | |
|_|  |_|\__,_|_|    \_/ \___|_|_|
         _   _     ____              _
        | | | |   | __ )  ___   ___ | |_ 
        | | | |___|  _ \ / _ \ / _ \| __| 
        | |_| |___| |_) | (_) | (_) | |_ 
         \___/    |____/ \___/ \___/ \__| 
 ** LOADER **


U-Boot 2009.08 (May 22 2014 - 18:26:38) Marvell version: 2.1.6_NQ

Board: MI424WR-I
SoC:   88F6560 A0
CPU:   Marvell Feroceon (Rev 1) - LE
       CPU @ 1200Mhz, L2 @ 480Mhz
       DDR3 @ 400Mhz, TClock @ 200Mhz
PEX 0: Root Complex Interface, Detected Link X1
PEX 1: Detected No Link.
DRAM:  128 MB
       CS 0: base 0x00000000 size 128 MB
       Addresses 10M - 0M are saved for the U-Boot usage.
NAND:  1bit HM ECC, Size: 128 MiB
USB 0: Host Mode
Shutting down unused interfaces:
       PON
       SATA
       3xFE-PHY
Modules Detected:
       No PON module.
       RGMIIA Module on Switch port #6.
       RGMIIB Module on MAC0.
       Ethernet Switch on MAC1.
       QSGMII Module.
Initialized 1545 PHY
Net:   egiga0, egiga1 [PRIME]
Hit any key to stop autoboot:  1  0
Marvell>> tftpboot openrg.img

Using egiga1 device
TFTP from server 192.168.1.101; our IP address is 192.168.1.201
Filename 'openrg.img'.
Load address: 0x2000000
Loading: *T T T T T T T T #################################################################
	 ########################################
done
Bytes transferred = 1532168 (176108 hex)
Marvell>> bootm

## Booting kernel from Legacy Image at 02000000 ...
   Image Name:   OpenRG
   Created:      2021-01-07  17:57:50 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1532104 Bytes =  1.5 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux.......................................................................................................... done, booting the kernel.

At this point, every LED on the router turns on, and there is no more output over serial. I don't know what to do next down this path either. Actiontec's makefiles have configurations for compiling more fully-featured firmwares, but they all give an error when I run make config.

I'm trying to figure out if this device can be supported by OpenWrt in the future. Although the CPU isn't yet supported by the mainline linux kernel, it is ARMv5, so maybe a modified version of a kirkwood firmware could work. PandoraBox (supposedly) works, so it must be possible to get OpenWrt going.

Do you guys have any suggestions for working on the following short-term goals?

  1. Get Actiontec's GPL kernel working
  2. Dump the stock firmware.
  3. Get PandoraBox booting.
1 Like
2

I think I've gotten a dump of the stock firmware. I tftped out openrg1.img and openrg2.img from /mnt/jffs2. These are both uImages bootable from U-Boot, and they both seem to boot the router into the stock firmware. Does anyone know what the difference would be between these two images?

Also, I found the flash layout in the boot menu, accessible by holding escape during kernel boot. It looks like this:

Flash layout:



Section 00 Type FACTORY    Range 0x00000000-0x00020000 MaxSize 0x0001FF6C

Flash file: /mnt/jffs2/rg_factory

	Size 0x0000040A Name 'Downloaded at: Fri Dec 14 19:02:44 2007'

	Checksum 0x0000EB9E Counter 0x0000000B Start Offset 0x00000000



Section 01 Type CONF       Range 0x00000000-0x00020000 MaxSize 0x0001FF6C

Flash file: /mnt/jffs2/rg_conf1

	Size 0x000075B6 Name 'rg_conf'

	Checksum 0x003A4EAB Counter 0x00012CED Start Offset 0x00000000



Section 02 Type CONF       Range 0x00000000-0x00020000 MaxSize 0x0001FF6C

Flash file: /mnt/jffs2/rg_conf2

	Size 0x000075B6 Name 'rg_conf'

	Checksum 0x003A1A25 Counter 0x00012CE9 Start Offset 0x00000000



Section 03 Type BACKUP_CONF Range 0x00000000-0x00020000 MaxSize 0x0001FF6C

Flash file: /mnt/jffs2/backup_rg_conf

	Size 0x00007E70 Name 'rg_conf'

	Checksum 0x003F08CB Counter 0x000095EE Start Offset 0x00000000



Section 04 Type IMAGE      Range 0x00000000-0x00F00000 MaxSize 0x00EFFF6C

Flash file: /mnt/jffs2/openrg1.img

	Size 0x00636110 Name 'FEROCEON Version 4.7.5.3.31.2.19.40.21.24 Downloaded at: Fri Aug 12 00:32:36 2016'

	Checksum 0x32418435 Counter 0x00009601 Start Offset 0x00000000



Section 05 Type IMAGE      Range 0x00000000-0x00F00000 MaxSize 0x00EFFF6C

Flash file: /mnt/jffs2/openrg2.img

	Size 0x00636110 Name 'FEROCEON Version 4.7.5.3.31.2.19.40.21.24 Downloaded at: Fri Aug 12 00:34:32 2016'

	Checksum 0x3241843E Counter 0x0000960C Start Offset 0x00000000



Section 06 Type LOG        Range 0x00000000-0x00040000 MaxSize 0x0003FF6C

Flash file: /mnt/jffs2/persistent_log

	Size 0x00004A54 Name 'Persistent_log'

	Checksum 0x00243A30 Counter 0x00012CEC Start Offset 0x00000000



Total 7 sections found.

Does backing up these 7 flash files constitute backing up the original firmware? How would I go about restoring these files from U-Boot?

3

  1. I got Actiontec's GPL versions of OpenRG below version 50 working. The solution boiled down to "never use the -j options with make." 50.0.16.6.2 and 52.0.7 both won't boot, and I don't know why. They compile fine, but the router gets stuck at "booting the kernel" and every LED turns on, like I said earlier.

  2. I'm still not sure about backing up the original firmware, but I found an update link that gives me some kind of firmware update called MI424WR-GEN3I.rmt. It has a uImage header but won't boot through U-Boot. I backed up the 7 files in /mnt/jffs2 and I'm hoping that's enough to restore to stock. I still have no idea why there are two openrg images included with the stok installation. Does anybody know anything about that?

  3. PandoraBox works, I just needed to run these commands from U-Boot:

tftpboot PandoraBox-avanta-mi424-wr-2018-12-31-git-4b6a3d5ca-squashfs-factory.bin
nand erase 0x000003000000
nand write 0x2000000 0x000003000000 0x1000000
bootm

The default root password was admin.
Although this does involve writing to NAND, the router still boots to the stock firmware by default. Subsequent boots to PandoraBox can be done like this:

tftpboot PandoraBox-avanta-mi424-wr-2018-12-31-git-4b6a3d5ca-squashfs-factory.bin
bootm

I'm not really sure what's going on here. It seems like tftpboot sticks the pandorabox image at 0x2000000 in memory, then we erase 0x5000000 bytes on the NAND starting from 0x3000000, and then we write 0x1000000 bytes (all, since the image is 13MB) of the pandorabox image to address 0x3000000 on the NAND.

My next goal is to get PandoraBox building. The PandoraBox imagebuilder is posted with the images I linked up above, so that's what I'll try first. I also found this github repository and this github repository. (EDIT: These won't be useful, since both of these repositories are from before avanta was added as a target for pandorabox, which I think was in version 18.09) If I can get PandoraBox to build, then maybe porting their patches over to OpenWrt is within reach.

Useful resources (Google Translate does a good job with these):

4

Looking at Google's code for the Google Fiber Network Box (GFRG110) which uses the same 88F6560 SOC might be helpful. The source is located at https://storage.googleapis.com/google-code-archive-source/v2/code.google.com/gfiber-gfrg100/source-archive.zip.

5

Thanks! Seems like it's another OpenRG firmware based on a 2.6 kernel. It is a newer version of OpenRG, though. I'll see if I can get this to boot.

6

I couldn't get that Google Fiber image to even build. I'm missing a jpkg and I don't know where to get it.

Anyway, bodhi over at doozan.com has been a huge help. He adapted the device tree sources from pandorabox to work with his build of debian for kirkwood devices, and I now have Debian with a 5.2 kernel working on my router! This is big news; as far as I can tell, the newest kernel that would boot on avanta was 3.x. I think this is the first step toward getting the avanta SoCs some much-needed attention. Here's the doozan thread with instructions for isntalling Debian on an MI424WR Rev. I.

7

Using bodhi's modifications to the pandorabox dts files, I was able to build and boot OpenWrt on this device. It seems like the wifi and ethernet aren't working, though. I'm assuming I'm missing some packages needed for the wifi to work, and I doubt the ethernet will work until bodhi figures out which changes are necessary to make to the dts to get it to work in Debian.

EDIT:
WiFi is now functional. It looks like this is shaping up to be a sort of usable build, so I'll probably post it soon.

8

Ken,

That's great! I have one of these units. There was absolutely no love for this router anywhere, and I started hoping I could leverage some info from doozan. It seemed to pick up speed from there. My hope, though, was to learn how to do what you just did! I'm familiar with voiding warranties, but not so much with building firmware and reconfiguring it as you just did. I also want to use that old router as an AP in my garage, so I'm looking forward to you posting the build.

Dave

9

Hi Dave!

It's posted here. It's a snapshot that's a few weeks old now, and I haven't yet updated it with bodhi's new device tree sources (which will fix rebooting). The semester just started, so I have way less time than I did a few weeks ago, but I'll make sure to upload a new build in the next few days, since you're interested. There are also instructions for building it yourself in the readme, if you feel like learning.

I'm very happy to see that someone else is interested in getting OpenWrt on this thing.

1 Like
10

Ben,

It's not a bad router, but the factory firmware wasn't flexible enough for me. And, there was no hope of ever updating it past the known vulnerabilities. I had to trash a cheapie AP that died, so I wanted to use the Actiontec. It wouldn't let me replicate my wireless settings to replace the dead one with the factory firmware. It had some arbitrary "input filter" rule.

I hope to become more adept at working issues like this, so thanks for the info. I want to begin migrating my other devices off DD-WRT to OpenWRT.

Dave

11

I rebuilt the image with today's snapshot and bodhi's updated device tree sources. The new images are available in the github repo. This build still doesn't have ethernet support, so for now it's just for fun.

12

That's great, thanks for the update. I'll take a few days to look it over.

Dave

13

Regarding the networking: I used to use one of these (rented to me by Verizon) with my DD-WRT router behind it. One day, I thought it was odd to see that my router had negotiated a half duplex connection to the Actiontec router. So, I forced it to full duplex. It barely worked at all. So I noticed this DTS forces full duplex. Am I crazy to suggest it be tested with half-duplex? I got great results from "speed test" sites operating my router-to-router connection in half duplex.

14

Unfortunately, I don't know anything about anything when it comes to messing with the device tree. As I understand it, the ethernet device isn't recognized because the driver specified in Claudio Leite's dts (which is used in the old PandoraBox build for this router) is no longer part of the kernel, so someone needs to rewrite that portion of the dts to use the modern equivalent. It seems unlikely to me that switching from full to half duplex would solve that problem.

But feel free to prove me wrong!

15

I'm getting ahead of myself, forgetting it's the driver that isn't there. You're not wrong. I am puzzled when I think back to the full/half duplex issue, and wonder if it will pop up in the future. As for device trees, I don't know much about them either, except what I see in the comments. It's code, so it makes a little bit of sense, but I don't know the syntax well enough to make changes or write anything from scratch.

1 Like
16

This was the sort of info I was looking for to get an idea about what's going on and why it's there. For your reading pleasure:

Device Tree - Wiki - Open Source Software and Platforms - Arm Community

17

Just use this code.

Remember to change to the avanta branch.

18

bodhi's work is based on that code.

19

Hey Ken - I stumbled upon this thread after finding my old MI424WR-I during cleaning and was excited to see that there's some action happening with this router.

I was able to boot your image from GitHub, as well as build and boot from the current master branch from git. The ethernet still doesn't work, but I'm not surprised since it's been only a few months and progress seems to have slowed.

Since I also have one of these, I'm wondering how I could be of service? I know next to nothing about embedded/low level system development, but I am a software dev (just of other things lol) and willing/able to test anything that anyone else might make.

2 Likes
20

I was looking for information on the rev I routers. I know for a long time the C and D versions had working images. Definitely going to have some fun in the next week or two. These devices are pretty powerful devices for an ISP product. Have always liked the ActionTec routers over the Arris and Westell they use to have.