Openwrt for MT7628nn with extended tools for homebase 2

For Developers
1

Dears, I was able to install in the flash a basic openWrt image in a Eufy homebase 2, but the image has very basic functionality and not able to upgrade loading using tftp an update as have limitted tools. It would be helpfull a based image with at least tftp and stty tools + others that can help to continue dig further on the hardware. There is an annouing watchdog that reset every 60 seconds, so I do not have too much chance to do anything. thanks in advance.

[04060C0A][04060C09]
DDR Calibration DQS reg = 00008788

U-Boot 1.1.3 (Jun 14 2023 - 16:18:56)

Board: Ralink APSoC DRAM: 128 MB
relocate_code Pointer at: 87fa0000
flash manufacture id: ef, device id 40 19
find flash: W25Q256FV
raspi_read: from:40035 len:1
raspi_read: from:40036 len:1
raspi_read: from:30000 len:1000
*** Warning - bad CRC, using default environment

============================================

Ralink UBoot Version: 5.0.0.0

ASIC 7628_MP (Port5<->None)

DRAM component: 1024 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 128 MBytes
Flash component: SPI Flash
Date:Jun 14 2023 Time:16:18:56

icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

##### The CPU freq = 575 MHZ ####
estimate memory size =128 Mbytes
RESET MT7628 PHY!!!!!!

normal mode.

……

3: System Boot system code via Flash.

Booting image at bc050000 ...

raspi_read: from:50000 len:40
Image Name: MIPS OpenWrt Linux-6.6.119
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 5660299 Bytes = 5.4 MB
Load Address: 80000000
Entry Point: 80000000
raspi_read: from:50040 len:565e8b
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK lzmaBuffToBuffDecompress() at 812.
OK
No initrd

Transferring control to Linux (at address 80000000) ...

Giving linux memsize in MB, 128

Starting kernel ...

[ 0.000000] Linux version 6.6.119 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r29087-d9c5716d1d) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 Wed Dec 17 21:08:22 2025
[ 0.000000] Board has DDR2
[ 0.000000] Analog PMU set to hw control
[ 0.000000] Digital PMU set to hw control
[ 0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[ 0.000000] MIPS: machine is Mediatek MT7628AN evaluation board
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Writing ErrCtl register=00035353
[ 0.000000] Readback ErrCtl register=00035353
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32512
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 118520K/131072K available (4988K kernel code, 583K rwdata, 812K rodata, 4744K init, 201K bss, 12552K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 256
[ 0.000000] intc: using register map from devicetree
[ 0.000000] CPU Clock: 575MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6647862422 ns
[ 0.000002] sched_clock: 32 bits at 288MHz, resolution 3ns, wraps every 7469508094ns
[ 0.007631] Calibrating delay loop... 380.92 BogoMIPS (lpj=1904640)
[ 0.073513] pid_max: default: 32768 minimum: 301
[ 0.086891] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.093950] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.112284] RCU Tasks Trace: Setting shift to 0 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=1.
[ 0.128905] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.138459] futex hash table entries: 256 (order: 0, 3072 bytes, linear)
[ 0.145010] pinctrl core: initialized pinctrl subsystem
[ 0.153859] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.160610] thermal_sys: Registered thermal governor 'step_wise'
[ 0.164066] /pinctrl: Fixed dependency cycle(s) with /pinctrl/pinctrl0
[ 0.191443] clocksource: Switched to clocksource MIPS
[ 0.210122] NET: Registered PF_INET protocol family
[ 0.215193] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.224356] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.232597] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.240041] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.247459] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.254277] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.260599] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.266963] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.274669] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.280169] PCI: CLS 0 bytes, default 32
[ 1.033174] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[ 1.040121] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 1.045789] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 1.063869] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[ 1.072933] mt7621_gpio 10000600.gpio: registering 32 gpios
[ 1.078723] mt7621_gpio 10000600.gpio: registering 32 gpios
[ 1.084583] mt7621_gpio 10000600.gpio: registering 32 gpios
[ 1.090736] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 1.105317] printk: console [ttyS0] disabled
[ 1.110223] 10000c00.uart0: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
[ 1.119054] printk: console [ttyS0] enabled
[ 1.119054] printk: console [ttyS0] enabled
[ 1.135487] printk: bootconsole [early0] disabled
[ 1.135487] printk: bootconsole [early0] disabled
[ 1.168298] spi-mt7621 10000b00.spi: sys_freq: 191666666
[ 1.187049] spi-nor spi0.0: w25q256 (32768 Kbytes)
[ 1.196862] 4 fixed-partitions partitions found on MTD device spi0.0
[ 1.209566] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[ 1.224121] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[ 1.239061] Creating 4 MTD partitions on "spi0.0":
[ 1.248632] 0x000000000000-0x000000030000 : "u-boot"
[ 1.261339] 0x000000030000-0x000000040000 : "u-boot-env"
[ 1.273063] 0x000000040000-0x000000050000 : "factory"
[ 1.284225] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[ 1.299263] 0x000000050000-0x000000800000 : "firmware"
[ 1.331392] rt3050-esw 10110000.esw: mediatek esw at 0xb0110000, irq 25 initialized
[ 1.346804] mtk_soc_eth 10100000.ethernet: generated random MAC address c2:a7:7c:39:79:88
[ 1.364149] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[ 1.384592] NET: Registered PF_INET6 protocol family
[ 1.423941] Segment Routing with IPv6
[ 1.431377] In-situ OAM (IOAM) with IPv6
[ 1.439459] NET: Registered PF_PACKET protocol family
[ 1.449551] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 2.110007] 8021q: 802.1Q VLAN Support v1.8
[ 2.146137] clk: Disabling unused clocks
[ 8.450595] Freeing unused kernel image (initmem) memory: 4744K
[ 8.462390] This architecture does not have kernel memory protection.
[ 8.475168] Run /init as init process
[ 9.426288] init: Console is alive
[ 9.433788] init: - watchdog -
[ 9.465293] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 9.496925] usbcore: registered new interface driver usbfs
[ 9.508038] usbcore: registered new interface driver hub
[ 9.518737] usbcore: registered new device driver usb
[ 9.533348] gpio_button_hotplug: loading out-of-tree module taints kernel.
[ 9.569340] phy phy-10120000.usbphy.0: remote usb device wakeup disabled
[ 9.582671] phy phy-10120000.usbphy.0: UTMI 16bit 30MHz
[ 9.593032] ehci-platform 101c0000.ehci: EHCI Host Controller
[ 9.604464] ehci-platform 101c0000.ehci: new USB bus registered, assigned bus number 1
[ 9.620423] ehci-platform 101c0000.ehci: irq 26, io mem 0x101c0000
[ 9.661512] ehci-platform 101c0000.ehci: USB 2.0 started, EHCI 1.00
[ 9.675479] hub 1-0:1.0: USB hub found
[ 9.684443] hub 1-0:1.0: 1 port detected
[ 9.704638] ohci-platform 101c1000.ohci: Generic Platform OHCI controller
[ 9.718240] ohci-platform 101c1000.ohci: new USB bus registered, assigned bus number 2
[ 9.734123] ohci-platform 101c1000.ohci: irq 26, io mem 0x101c1000
[ 9.817553] hub 2-0:1.0: USB hub found
[ 9.825994] hub 2-0:1.0: 1 port detected
[ 9.840762] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 9.865991] init: - preinit -
[ 12.611529] random: crng init done
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 16.676194] procd: - early -
[ 16.682463] procd: - watchdog -
[ 17.359720] procd: - watchdog -
[ 17.366547] procd: - ubus -
[ 17.431422] procd: - init -
Please press Enter to activate this console.
[ 18.458776] kmodloader: loading kernel modules from /etc/modules.d/*

login[549]: root login on 'ttyS0'

BusyBox v1.36.1 (2025-12-17 21:08:22 UTC) built-in shell (ash)

_*_ __ __

| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|__|| __|__|__|__||_____||__| |_*_|
|__| W I R E L E S S F R E E D O M

OpenWrt 24.10.5, r29087-d9c5716d1d

=== WARNING! ===================[ 19.790529] Loading modules backported from Linux version v6.12.61-0-gdcbeffaf66d0
================[ 19.807531] Backport generated by backports.git v6.1.110-1-35-g410656ef

There is no root password defined on this device!

Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.

root@(none):~# [ 20.051121] mt76_wmac 10300000.wmac: ASIC revision: 76280001
[ 20.102365] mt76_wmac 10300000.wmac: Firmware Version: 20151201
[ 20.114186] mt76_wmac 10300000.wmac: Build Time: 20151201183641
[ 20.171503] mt76_wmac 10300000.wmac: firmware init done
[ 20.341617] mt76_wmac 10300000.wmac: registering led 'mt76-phy0'
[ 20.585381] PPP generic driver version 2.4.2
[ 20.619150] NET: Registered PF_PPPOX protocol family
[ 20.668648] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 21.922100] urngd: v1.0.2 started.

2

not entirely true - Eufy HomeBase 2 teardown.

dnsmasq have a TFTP server built in.
which stty tools ?

you flashed a random image onto an (AFAIK) unsupported device, you're not really in a position where you can make demands.

you can add whichever packets you need to the images you're flashing, using https://firmware-selector.openwrt.org/.

3

Thanks frollic, for the quick answer, I’m just doing research to reuse a old HW. The watchdog workaround described in these article has 5 years old, are not valid anymore. I would need to get control of the UART2 and deal with watchdog, so better tools to change port speed, and configuration rather than “printf” will be required.

I fully understand, this is not a supported system, just wondering if I can continue, please disregard this ask if not helping or contributing to the community.

Thanks.

4

You have to dd, download, then hexdump system partitions and find real MAC address offset in those, usually seek 1st 2 bytes of MAC - one place has "base mac" . mighe be +-3 from one on the label. other places wih XX:XX:XX:000000 FFFFFF etc are start of wifi calibration data or similar.

5

I need to stabilize external watchdog first…

1 Like
6

Can you post a link where I can download OEM firmware to de-compile DTS and hopefully find a gpio pin to silence wdt?

7

It is not a pin. It is a communication in the internal uart2 y guess /dev/ttyS1, so I have to manage via basics commands from command line

04060C0A][04060C09]
DDR Calibration DQS reg = 00008788

U-Boot 1.1.3 (Jun 14 2023 - 16:18:56)

Board: Ralink APSoC DRAM: 128 MB
relocate_code Pointer at: 87fa0000
flash manufacture id: ef, device id 40 19
find flash: W25Q256FV
raspi_read: from:40035 len:1
raspi_read: from:40036 len:1
raspi_read: from:30000 len:1000
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0

ASIC 7628_MP (Port5<->None)
DRAM component: 1024 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 128 MBytes
Flash component: SPI Flash
Date:Jun 14 2023 Time:16:18:56

icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

The CPU freq = 575 MHZ

estimate memory size =128 Mbytes
RESET MT7628 PHY!!!!!!

normal mode.

** send data to uart2 **
FE 01 21 58 00 78

++ read from uart2 data:
FE 02 61 58 00 10 2B

success to get respance.
get response from app. code:0x00.
in normal mode.
** send data to uart2 **
FE 01 21 51 00 71

++ read from uart2 data:
FE 01 61 51 00 31

success to get respance.

8

The additional package can only be updated in a system already running openwrt. Difficult to copy and upgrade the update.bin due to time limitations. Can I compile the rootfs + additional packages? So I can upload and flash directly

9

You're wrong.

1 Like
10

There is some more info (from a different poster) here:

And possibly a file system dump linked at the end of the blog post.

1 Like
11

If you drop to the recovery mode busybox the watchdog resets every 60 seconds, but if you manage to hit "u" again about three times in a row, the watchdog goes to an hour and you'll actually have some time to get things done.

12

That was already linked to (and dismissed) yesterday, reread the early replies.

13

This is from few years back. I will load OPenWrt with extended packages and try to feed the dog dealing with UART. As soon as I’m able to configure 115200 that is the speed, de dog speak.

1 Like