Installing on Devolo Wifi Repeater AC (probably identical to Edimax EW-7476RPC)

Installing and Using OpenWrt
#1

Hello,

I somehow managed to flash 21.02 rc1/2 to a Devolo Wifi Repeater AC, probably identical to EW-7476RPC). But I cannot make it boot automatically.

U-Boot insists in loading a kernel from 0xbc050000, the cimage partition. After installation of OpenWrt, this partion is truncated to 0x20000, the firmware partion, which contains kernel and rootfs, starts at 0xbc070000. So, booting from 0xbc050000 fails as expected. Manually booting the installed kernel using

bootm 0xbc070014

works fine and boots up the system successfully. For some reason, alternatively to manually booting from the U-Boot shell, I can also enter "5" to interrupt the boot process (probably just some invalid selection) to have U-Boot execute the "bootcmd" I have set, which is ignored otherwise ...

Booting from 0xbc070000 fails as well, U-Boot will complain of an invalid magic, which corresponds to the ASCII values of "CSYS".

I am stuck.

Does this sound familar to anybody?

Kind regards,

Mali

#2

Is the bootcmd not set/saved or is it reset?

#3

It is saved ... this is the output of printenv at the U-Boot console:

MT7620 # printenv
baudrate=57600
ethaddr="B8:BE:F4:3D:D1:18"
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
u-boot=u-boot.bin
load=tftp 8A100000 $(u-boot)
u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
loadfs=tftp 8A100000 root.cramfs
u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
test_tftp=tftp 8A100000 root.cramfs;run test_tftp
ethact=Eth0 (10/100-M)
language_code=uk
hw_id=0116001f
domain=1
pincode=42519409
wlanaddr=00:aa:bb:cc:dd:10
kver=1.0.5
sn=5052800502
usboot=0
dom2=2
wanaddr=00:aa:bb:cc:dd:20
bootdelay=2
bver=4.0.1.6
op_mode=0
filesize=3dd000
fileaddr=80A00000
bootfile=uImage_DEVOLO-7476DRC-v005
ipaddr=192.168.9.165
bootcmd=bootm 0xbc070014
kernel_addr=BC070014
loadaddr=BC070014
autostart=no
serverip=192.168.9.137
stdin=serial
stdout=serial
stderr=serial

Environment size: 1081/4092 bytes
MT7620 #

As explained, it does not execute my "bootcmd" when I let is start without interruption, but tries to load from 0xbc050000 ... the beginning of the cimage partition, an address however, I do not find in the U-Boot environment ...

U-Boot 1.1.3 (Apr 24 2015 - 18:11:06)

Board: Ralink APSoC DRAM:  64 MB
gpiomode===>1a301c
after:gpiomode===>1a341c
Ralink UBoot ver: 4.0.1.0
ELX UBoot ver: 1.0.0 (Apr 24 2015 18:11:06)
Date:Apr 24 2015  Time:18:11:06
CPU: 580 MHz, MEM: 64 MB
Reset Phy by gpio 39

Please choose the operation: 1, 2, 3, 4, 9                                    0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   Linux Kernel Image
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1459090 Bytes =  1.4 MB
   Load Address: 80000000
   Entry Point:  802593c0
   Verifying Checksum ... Bad Data CRC
Enter edimax Recovery Mode

.......Start http..............

However, if I enter "5" ... the bootloader chooses to execute my bootcmd:

U-Boot 1.1.3 (Apr 24 2015 - 18:11:06)

Board: Ralink APSoC DRAM:  64 MB
gpiomode===>1a301c
after:gpiomode===>1a341c
Ralink UBoot ver: 4.0.1.0
ELX UBoot ver: 1.0.0 (Apr 24 2015 18:11:06)
Date:Apr 24 2015  Time:18:11:06
CPU: 580 MHz, MEM: 64 MB
Reset Phy by gpio 39

Please choose the operation: 1, 2, 3, 4, 9

You choosed 5
                                                                              0


System Boot Linux via Flash.
## Booting image at bc070014 ...
   Image Name:   MIPS OpenWrt Linux-5.4.111
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1978112 Bytes =  1.9 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 5.4.111 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16046-59980f7aaf)) #0 Sun Apr 18 10:06:57 2021
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620A ver:2 eco:6

Where does it get the address of 0xbc050000 from? Why would it ignore my "bootcmd" when left alone? Why would it execute it when I enter "5" (which is not a valid selection)? Why do I need to add that offset of 0x14 (length of CSYS header)?

Too many questions :wink:

Mali

#4

how did you manage to install openwrt?

#5

Hello Yurkila,

to be honest: I do not remember in detail ... I have access to the serial console and to the boot loader console. I can interrupt the boot of the stock firmware, get an image over tftp and boot it:

setenv ipaddr 192.168.9.165
setenv serverip 192.168.9.137
setenv netmask 255.255.255.0
tftpboot 0x800000 openwrt-21.02.0-rc1-ramips-mt7620-edimax_ew-7476rpc-initramfs-kernel.bin
bootm 0x800000

I assume I transferred the sysupgrade image to /tmp and performed an installation using sysupgrade.

I am wondering whether it is possibe to have either the stock firmware or the "Edimax Recovery Mode" install an OpenWrt sysupgrade.bin file. However, Devolo seems to use a different file format that uses some "obfuscation" ...

Kind regards,

Mali

#6

I have managed to load it, but I see that it loads everything in tmp, if there was some way to make it permanent it would be very good, I am investigating to see what can be done, I have managed to install luci, but of course, at the first reboot everything is deleted and it has started again zero.

#7

Have you managed to enter the edimax recovery? I can't get in and I can't go back to the original firmware either.