Mosaic Powerstream PSTR2 (MT7628) - OpenWrt support

Hello, I recently got a small power bank with an integrated 2.4GHz Wi-Fi repeater from Canada/USA: Mosaic Powerstream PSTR2

After extensive research to find out more information about the system, I found out the following.

A port scan on 192.168.10.1 brought the following results:

0-22
- State: closed

23
- State: open
- Service Name: telnet
- Service Description: Telnet

24-52
- State: closed

53
- State: open
- Service Name: domain
- Service Description: Domain Name Server

54-79
- State: closed

80
- State: open
- Service Name: http
- Service Description: HTTP

81-119
- State: closed

120
- State: open
- Service Name: cfdptkt
- Service Description: CFDPTKT

121-8659
- State: closed

8660
- State: open

8661-65535
- State: closed

So Telnet runs on port 23:

Trying 192.168.10.1...
Connected to 192.168.10.1.
Escape character is '^]'.

Mediatek login: admin
Password:


BusyBox v1.12.1 (2017-04-03 08:58:23 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

CPU information:

Trying 192.168.10.1...
# cat /proc/cpuinfo
system type             : MT7628
processor               : 0
cpu model               : MIPS 24Kc V5.5
BogoMIPS                : 386.04
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0b18, 0x0338, 0x0bb8]
ASEs implemented        : mips16 dsp
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

I have already made a dump of the firmware via Telnet (mtd0ro, mtd1ro, mtd2ro, mtd3ro, mtd4ro) to USB flashdrive.

Can anyone provide further information on the compatibility of the system with OpenWrt? From what I have read, the MT7628 is apparently not yet properly supported? I also see the available interfaces as problematic; apart from USB (media server, etc.) and Wi-Fi, there are no other interfaces, no LAN. I probably have no way of accessing via TFTP either. Therefore, OpenWrt should already be available after flashing with Wi-Fi activated.

Can anyone help with my project? :thinking:

https://youtu.be/wJ26AZKimWQ this?

mt76x8 is well supported, but absence of ethernet port makes it quite useless as a router. Probably you can mash together some USB networking host to pretend it has that network.
How much flash cat /proc/mtd ; 8MB is too small
How much ram cat /proc/meminfo ; free ; 64MB is minimim but there should be some wonder in device like 4G modem to work on it
What wifi lspci ; yet unsupported device is a no-go.

Also worth finding FCC-ID on the casing which may give free inside look at the device.

1 Like

A few days ago I was working with an mt7628. The chip is very well supported.

It helps a lot if you attach the output of the “dmesg” command, to know more how the device is internally. As they said, 8 MB of flash and 64 MB of RAM is the practical minimum: not ideal, but enough for several basic tasks and well supported by OpenWrt for now.

Developing firmware on hardware where you have hardly any documentation is not easy and you will create many broken firmwares in the process. That's why you need a secure method to be able to get into the router even if you bricked it.

Therefore, consider disassembling the device. Since you don't have Ethernet I imagine there is also no TFTP recovery or something similar. In those cases you really need UART (serial) access using a Raspberry Pi, an ESP32 or a cheap USB UART 3.3V adapter on eBay.

The lack of Ethernet port indicates to me that you may also need to buy an SPI programmer to install firmware directly to the SPI chip. Future users could use another simpler method for install OpenWrt, but in development you have fewer options.

Besides that you should look for a GPL dump, if the manufacturer left one.

1 Like

8MB will have problems getting filesystem driver for extra storage in device. Likely no space for luci in 1-2 years.

Good point

Exactly this device. I will try to get more information about the flash and RAM. Various commands such as lspci didn't work, I tried them. I still have cat /proc/mtd and cat /proc/meminfo ; free open.

And dmesg and FCC ID

Its the novelty device, probably made cheaper than cheap filled with glue.

@brada4 @enmaskarado

I have just executed a few more commands that provide information about the system. I will try to find out the FCC ID also. Here you go:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00400000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 003b0000 00010000 "Kernel"
# cat /proc/meminfo ; free
MemTotal:          59960 kB
MemFree:           41976 kB
Buffers:               0 kB
Cached:             8196 kB
SwapCached:            0 kB
Active:             3256 kB
Inactive:           5884 kB
Active(anon):        944 kB
Inactive(anon):        0 kB
Active(file):       2312 kB
Inactive(file):     5884 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:           960 kB
Mapped:             1104 kB
Shmem:                 0 kB
Slab:               6932 kB
SReclaimable:       2216 kB
SUnreclaim:         4716 kB
KernelStack:         280 kB
PageTables:          168 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       29980 kB
Committed_AS:       3508 kB
VmallocTotal:    1048372 kB
VmallocUsed:        1508 kB
VmallocChunk:    1045804 kB
              total         used         free       shared      buffers
  Mem:        59960        18004        41956            0            0
 Swap:            0            0            0
Total:        59960        18004        41956
# lspci
-sh: lspci: not found
# dmesg
Linux version 2.6.36 (track@track) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #588 Sat Mar 10 21:06:58 CST 2018

 The CPU feqenuce set to 575 MHz

 MIPS CPU sleep mode enabled.
CPU revision is: 00019655 (MIPS 24Kc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
On node 0 totalpages: 16384
free_area_init_node: node 0, pgdat 8049cea0, node_mem_map 81000000
  Normal zone: 128 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 16256 pages, LIFO batch:3
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 console=ttyS0
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=0006a2ce
Readback ErrCtl register=0006a2ce
Memory: 58116k/65536k available (3648k kernel code, 7368k reserved, 1080k data, 1844k init, 0k highmem)
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
RALINK_GPIOMODE = 54050404
RALINK_GPIOMODE = 54040404
***** Xtal 40MHz *****
start PCIe register access
RALINK_RSTCTRL = 2400000
RALINK_CLKCFG1 = fdbfffc0

*************** MT7628 PCIe RC mode *************
PCIE0 no card, disable it(RST&CLK)
bio: create slab <bio-0> at 0
vgaarb: loaded
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource Ralink Systick timer
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
PCI: CLS 0 bytes, default 32
RT3xxx EHCI/OHCI init.
fuse init (API version 7.15)
msgmni has been set to 113
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
io scheduler noop registered (default)
Ralink gpio driver initialized
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
brd: module loaded
flash manufacture id: ef, device id 40 16
deice id : ef 40 16 80 20 (40168020)
W25Q32BV(ef 40160000) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 5 MTD partitions on "raspi":
0x000000000000-0x000000400000 : "ALL"
0x000000000000-0x000000030000 : "Bootloader"
0x000000030000-0x000000040000 : "Config"
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x000001000000 : "Kernel"
mtd: partition "Kernel" extends beyond the end of device "raspi" -- size truncated to 0x3b0000
rdm_major = 253
GMAC1_MAC_ADRH -- : 0x00007820
GMAC1_MAC_ADRL -- : 0x061b0ca9
Ralink APSoC Ethernet Driver Initilization. v3.1  256 rx/tx descriptors allocated, mtu = 1500!
GMAC1_MAC_ADRH -- : 0x00007820
GMAC1_MAC_ADRL -- : 0x061b0ca9
PROC INIT OK!


=== pAd = c0105000, size = 1476032 ===

 RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
 RTMPAllocAdapterBlock, Status=0
RtmpChipOpsHook(492): Not support for HIF_MT yet!
mt7628_init()-->
mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
e2.bin mt7628_init(1117)::(2), pChipCap->fw_len(63056)
mt_bcn_buf_init(218): Not support for HIF_MT yet!
mt7628_init()
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
FM_OUT value: u4FmOut = 0(0x00000000)
FM_OUT value: u4FmOut = 124(0x0000007C)
FM detection done! loop = 1
SR calibration value u1SrCalVal = 7
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
Ralink APSoC Hardware Watchdog Timer
nf_conntrack version 0.5.0 (908 buckets, 3632 max)
IPVS: Registered protocols ()
IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
IPVS: ipvs loaded.
GRE over IPv4 demultiplexor driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
TCP cubic registered
NET: Registered protocol family 10
NET: Registered protocol family 17
L2TP core driver, V2.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Warning: unable to open an initial console.
Freeing unused kernel memory: 1844k freed
Algorithmics/MIPS FPU Emulator v1.5
usb 1-1: new high speed USB device using rt3xxx-ehci and address 2
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 4 ports detected
TX_BCN DESC a330a000 size = 320
RX[0] DESC a330c000 size = 2048
RX[1] DESC a330d000 size = 1024
E2pAccessMode=0
cfg_mode=9
cfg_mode=9
wmode_band_equal(): Band Equal!
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
default ApCliAPSDCapable[0]=0
default ApCliAPSDCapable[1]=0
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
RTMPSetDefaultChannel() : default channel to 1
load fw image from fw_header_image
AndesMTLoadFwMethod1(2174)::pChipCap->fw_len(63056)
FW Version:_e2_mp
FW Build Date:20150211175503
CmdAddressLenReq:(ret = 0)
CmdFwStartReq: override = 1, address = 1048576
CmdStartDLRsp: WiFI FW Download Success
MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
efuse_probe: efuse = 10000012
RtmpChipOpsEepromHook::e2p_type=2, inf_Type=4
RtmpEepromGetDefault::e2p_dafault=2
RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
NVM is FLASH mode
1. Phy Mode = 14
Country Region from e2p = ffff
tssi_1_target_pwr_g_band = 31
2. Phy Mode = 14
3. Phy Mode = 14
NICInitPwrPinCfg(11): Not support for HIF_MT yet!
NICInitializeAsic(651): Not support rtmp_mac_sys_reset () for HIF_MT yet!
mt_mac_init()-->
MtAsicInitMac()-->
mt7628_init_mac_cr()-->
MtAsicSetMacMaxLen(1241): Set the Max RxPktLen=1024!
mt_mac_init()
        WTBL Segment 1 info:
                MemBaseAddr/FID:0x28000/0
                EntrySize/Cnt:32/128
        WTBL Segment 2 info:
                MemBaseAddr/FID:0x40000/0
                EntrySize/Cnt:64/128
        WTBL Segment 3 info:
                MemBaseAddr/FID:0x42000/64
                EntrySize/Cnt:64/128
        WTBL Segment 4 info:
                MemBaseAddr/FID:0x44000/128
                EntrySize/Cnt:32/128
AntCfgInit(2876): Not support for HIF_MT yet!
MCS Set = ff 00 00 00 00
MtAsicSetChBusyStat(826): Not support for HIF_MT yet!
[PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0
[PMF]RTMPMakeRsnIeCap: RSNIE Capability MFPC=0, MFPR=0
MtAsicSetRalinkBurstMode(2921): Not support for HIF_MT yet!
MtAsicSetPiggyBack(763): Not support for HIF_MT yet!
MtAsicSetTxPreamble(2900): Not support for HIF_MT yet!
CmdSlotTimeSet:(ret = 0)
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
Main bssid = 78:20:06:1b:0c:a8
== rt28xx_init, Status=0
mt7628_set_ed_cca: TURN OFF EDCCA  mac 0x10618 = 0xd7083f0f
WiFi Startup Cost (ra0): 0.860s
Raeth v3.1 (Tasklet)

phy_tx_ring = 0x02dd0000, tx_ring = 0xa2dd0000

phy_rx_ring0 = 0x02dd1000, rx_ring0 = 0xa2dd1000
GMAC1_MAC_ADRH -- : 0x00007820
GMAC1_MAC_ADRL -- : 0x061b0ca9
RT305x_ESW: Link Status Changed
device eth2 entered promiscuous mode
device ra0 entered promiscuous mode
AddTxSType: already registered TxSType (PID = 32, Format = 0
br0: port 2(eth2) entering learning state
br0: port 2(eth2) entering learning state
br0: port 1(ra0) entering learning state
br0: port 1(ra0) entering learning state
br0: port 2(eth2) entering forwarding state
br0: port 1(ra0) entering forwarding state
ra0: no IPv6 routers present
eth2: no IPv6 routers present
eth2.1: no IPv6 routers present
eth2.2: no IPv6 routers present
apcli0: no IPv6 routers present
br0: no IPv6 routers present
AP SETKEYS DONE - WPA2, AuthMode(7)=WPA2PSK, WepStatus(6)=AES, GroupWepStatus(6)=AES

AndesSendCmdMsg: Command type = ed, Extension command type = 27
BUG: AndesSendCmdMsg is called from invalid context
Rcv Wcid(1) AddBAReq
Start Seq = 00000010
#

4MB flash size (0x400000 is end of line, device is unsupportable.

I also have various inspection and test documents for the device, but I can't find an FCC ID anywhere. I can't find any information on the device itself either. Does anyone have any idea where I can find this? :thinking:

That's what I feared...

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.