MT7603EN/MT7612EN Wifi Troubles on Netgear R6220

Hello, I'm the new to flash the lede.
After I flash the pb-boot to the bootloader, I flash the Netgear stock firmware (v 1.0.0.50) by using pb-boot. And then the wifi can not be use in stock firmware ( both 2.4g and 5g, the wifi config page become gray and can not be changed ). Can you upload the dump again because the link can not be reach.
Thanks!!

Ill look for the files and upload again.

https://router-sh.ptpt52.com/rom/
Try my lede build
try to flash one of these:
R6220
R6220A
R6220B

Until the mac address and device labels are the same

Do you have the scripts you used to build the images? I'd rather build my own than grab an image that I'm not sure about the build environment.

Also, I took the cover off the model I have and it's a v1.4. Loaded snapshot and things seem to be running fairly well. RAM shows full 128M available, but looks like the flash is smaller than the 128M spec'd. 2.4/5 work well and max out my 200Mbit upstream. Both cores show in the dmesg and /proc/cpuinfo shows both cores as well. The bit issue may be something on my internal network, but any direct hardwired connection is capped at 100Mbit. Not sure how to go about further debugging, but I'm setting up a build environment to dig in to it.

I have this issue as well with invalid mac addresses. How did you finally fix it? Did you return to stock then flash again?

I have the same problem with one of my R6220 after flashing OpenWrt 18.06. This is the part of the log file:

[   13.802824] mt76x2e 0000:01:00.0: ASIC revision: 76120044
[   13.815129] mt76x2e 0000:01:00.0: EEPROM data check failed: ffff
[   13.827968] mt76x2e 0000:01:00.0: Invalid MAC address, using random address d6:06:52:db:5b:d0
[   13.869483] mt76x2e 0000:01:00.0: ROM patch build: 20141115060606a
[   13.986357] mt76x2e 0000:01:00.0: Firmware Version: 0.0.00
[   13.997502] mt76x2e 0000:01:00.0: Build: 1
[   14.005787] mt76x2e 0000:01:00.0: Build Time: 201507311614____
[   14.038715] mt76x2e 0000:01:00.0: Firmware running!

5G Wifi is running stable but 2.4G connects break after authentication during association.

Any solution for this issue? I am happy to send more details as required.

I tried to use the instructions posted by @imwsy, installed the working stock firmware 1.1.0.68 and dumped mtd10 (factory mtd) to a file using
dd if=/dev/mtd10ro of=/tmp/10.bin

Afterwards I saved the file to a USB stick.

Next I installed OpenWrt using the default steps:

link: http://192.168.1.1/setup.cgi?todo=debug
(login if required, default: admin password)

  • You will see "Debug Enabled!"
  • Telnet 192.168.1.1 and login with "root"
  • ls /mnt/shares/ to find out path of your USB disk. 'myUdisk' for
    example.
  • cd /mnt/shares/myUdisk
  • mtd_write write rootfs.bin Rootfs
  • mtd_write write kernel.bin Kernel
  • reboot

OpenWrt started up and I copied the factory mtd backup to my router. But writing it to the factory mtd (mtd4) of OpenWrt didn't succeed:

root@OpenWrt:~# mtd -r write 10.bin mtd4
Could not open mtd device: mtd4
Can't open device for writing!

Any idea how I can flash my factory mtd with OpenWrt?

I continued searching for the reason why I cannot write to mtd4 and found the reason in the corresponding files used to build the image:

target/linux/ramips/dts/R6220.dts

The NAND configuration looks like this:

&nand {
	status = "okay";

	partition@0 {
		label = "u-boot";
		reg = <0x0 0x100000>;
		read-only;
	};

	partition@100000 {
		label = "SC PID";
		reg = <0x100000 0x100000>;
		read-only;
	};

	partition@200000 {
		label = "kernel";
		reg = <0x200000 0x400000>;
	};

	partition@600000 {
		label = "ubi";
		reg = <0x600000 0x1c00000>;
	};

	factory: partition@2e00000 {
		label = "factory";
		reg = <0x2e00000 0x100000>;
		read-only;
	};

	partition@4200000 {
		label = "reserved";
		reg = <0x4200000 0x3c00000>;
		read-only;
	};
};

The factory partition has been configured as read-only. That's the reason why the hint from @imwsy is not working anymore with the current pre-built image. If I have the time I will try to build the image without the read-only flag and then use mtd to write the original factory partition to mtd4.

If I understand the trx files (compared to bin) correctly I will have to cut the bin dump before flashing it with mtd.

If anyone in this forum has an understanding of what I would like to achieve and wants to comment on the approach please feel free to provide feedback. I am totally new to this topic, especially building an own image.

For those of you that are interested in the solution provided by @ptpt52 - he has provided his changes in order to workaround the issue with the different flash layouts:

I took his changes and applied them to 18.06 and created a pull request over here:

The R6220A image that I created using this patch works on my R6220 with alternative flash layout.

Currently the pull request is under review by OpenWrt developers. There are concerns that the design of this patch is not good as it is a workaround for the known flash layout in separate images (R6220, R6220A, R6220B). It would be prefered to have one image that automatically adjusts its behavior depending on the flash layout. With the three images users have to flash each image until they don't receive the MAC error message mentioned in the messages above.

I have no clue on how to create a single patch for all different flash layouts.

If the pull request gets denied you can still build your own image based on 18.06(.1) and the information of the pull request. At least this is a solution for everyone who wanted to read the image changes before using it. If anybody requires help with compiling it I can provide you with working images.

My repository is located over here:

It's a fork of the github OpenWrt repository with the changes applied.

[Update]
The pull request got rejected. You can read through the justification on the website of the pull request.
I can understand the decision that has been taken to keep the code clean. But for the moment it means that the OpenWrt project is not going to support WIFI on the R6220s with alternative flash layout. I will add some hints to the device page for new users who don't know about this limitation for certain devices. This may reduce at least some headaches for new users.

Everyone who wants to invest time and has the skills to analyse this issue further is very welcome. I am happy to support as I have two different models of the R6220 at home.

Hi there,
first of all, thanks for all the hard work. Unfortunately, it seems there's a difference between your github clone with the patch applied and @ptpt52 "a" release. With my router, the latter works all right, while yours still presents the same issue of the official release.
Any pointers? There's nothing wrong with @ptpt52 release, besides being in chinese by default (grrr), but I too preferred compiling the thing from clean sources myself.

EDIT: actually, I want to add a few comments as to why @ptpt52 release is really bad. It's been built in a strange way, with different logos and the web interface doesn't have the package installation module so everything you want to add you need to do it via command line. On top of that, if you ever upload his image with the reset config to default option, your router becomes a brick. I wouldn't suggest using that image at all.

For now, I'm back to stock firmware, which is really bad. I hope to hear from you soon.

I got it to work, in the end. I now have a 18.06.1 release correctly working. All it takes is, just before compiling, to edit the R6220 dts file and replace both occurrencies of "0x2e00000" with "0x2de0000". Compile, install and it just works!
If anybody needs an already compiled one, I can provide it.

1 Like

ALL IN ONE SOLUTION:

  1. Make sure your router runs STOCK firmware, download BREED bootloader from https://breed.hackpascal.net/, download install images from OpenWRT, put them in a FAT-32 usb stick.

  2. Telnet to the Router, backup stock EEPROM. (To enable telnet, paste http://192.168.1.1/setup.cgi?todo=debug in your browser)
    cd /mnt/U/ #enter usb stick path
    dd if=/dev/mtd10 of=./mtd10.bin #backup EEPROM

  3. Flash BREED bootloader
    mtd_write write breed-mt7621-r6220.bin Bootloader

  4. Flash OpenWRT
    mtd_write write rootfs.bin Rootfs
    mtd_write write kernel.bin Kernel

  5. Reboot and check if OpenWRT is installed.
    reboot

  6. Cut the power off and then power it on with the reset button pressed. In BREED bootloader, flash your stock EEPROM (mtd10.bin).

  7. Reboot and Enjoy!

This solution is based on the hard work of the friends on chinese forums and hier @rsterz , cretids to them!

Edit: @realopty tested on his device and it doesnt work. Maybe its not a final solution...

source code link?
link to the forum discussion thread?
also is there any documentation?

If you clicked the link and do some research by yourself you will notice that breed is a closed source project.
The link to chinese forum is here:http://www.right.com.cn/forum/thread-208580-1-1.html and https://lengzzz.com/note/install-lede-on-netgear-r6220#4-刷-lede-官方固件.
As for documentation, what kind of documentation are you looking for?

I did and failed thanks for the leg work

Hi papaf76,

sorry for the late reply. There was a faulty line in platform.sh. I commented it on Github but didn't change the source code anymore as the pull request was rejected.

Details can be found here (comment on Sep, 3rd):

If you would like to have a corrected diff or patch file please send a PN to me.

1 Like

An English translation mainly.

so after trying your method on the breed bootload i still get the same problem
[ 14.754133] mt76x2e 0000:01:00.0: EEPROM data check failed: ffff
[ 14.767008] mt76x2e 0000:01:00.0: Invalid MAC address, using random address ae:e9:40:32:1f:83
I even set the mac address from the breed web interface.
I think my factory partition is corrupt. does anyone have an original backup?

is it possible for the devs of breed to reorder the flash layout so we can utilize all free space. my best guess is to make 4 partitions on the device bootloader eeprom kernel rootfs that would make it work if it could be done

@realopty
I have no idea, but I can tell you that you can rearrange the partitions when building openwrt.
As for the backup here you go: https://quickfileshare.org/SVy/mtd4.bak. Keep in mind that I am not sure if they are compatible. Also your MAC address will become my MAC address.
As for the Breed bootloader I gotta say, I'm not really a fan of this approach. What we're doing is essentially flashing the factory partition to a different spot than where it was earlier on top of using some closed source thing from the web. So if I understand correctly you won't be able to revert to stock firmware afterwards and you may overwrite something depending on whether the "unused" parts of flash are actually used for something. It looks to me like a hack more than a solution.

1 Like

Thanks for the help. I was the original person to build OpenWRT with a different partition mapping. I'll make sure to change your mac address too.

I agree with you on the breed bootloader. my thinking is that I have to patch every build why not get more space to do it with lol.

In the past i replaced this section of flash with an extended rootfs
partition@2200000 {
label = "ENG UI";
reg = <0x2200000 0x200000>;
read-only;
};

partition@2400000 {
	label = "ML1";
	reg = <0x2400000 0x200000>;
	read-only;
};

partition@2600000 {
	label = "ML2";
	reg = <0x2600000 0x200000>;
	read-only;
};

partition@2800000 {
	label = "ML3";
	reg = <0x2800000 0x200000>;
	read-only;
};

partition@2a00000 {
	label = "ML4";
	reg = <0x2a00000 0x200000>;
	read-only;
};

And was able to safely recover to stock