OpenWrt support for Linksys MX4200

For Developers
238

Is it possible to restore the firmware using TFTP for this router without access to the console? There is this entry in the logs:

#################################

######### auto_recovery #########

#################################

===  enabled:1,  ===  boot_part:1,    ===  maxpartialboots:3 

boot_count_buffer_size = 2048, total number = 64 

i=10, offset = 0x1045000, last_offset = 0x1044800 

Updating boot_count... 

boot->Count:1 ,boot->CheckSum:20110812, offset:0x1045000

#### ~~~~~~~~~~~~~ ####

Auto-update from TFTP: failed, env. variable 'updatefile' not found

#### auto_recovery check ####

Hit any key to stop autoboot:  2  1  0 

Normal boot
239

Yes you can restore via tftp

240

Without access to the console?

241

Have you tried analyzing how fwupd works in the original firmware? The libnand-writer.so library is used there.

242

Hmm I have not

243

hey all, how did we go with this? been following for a while. has mx4200 v1 be completely built? all download links are dead

244

Did you manage to restore the original firmware? If so did you use the backup file you created or flashed it with the latest available firmware. Curious to know if the process of going back to stock was easy

245

I don't have this model exactly. If you have serial access it should be easy.
There are some env variables with tftpboot:

altkern=a680000
filesize=24a0000
flashimg=tftpboot $loadaddr $image && nand erase $prikern $imgsize && nand write $loadaddr $prikern $filesize
flashimg2=tftpboot $loadaddr $image && nand erase $altkern $imgsize && nand write $loadaddr $altkern $filesize
image=FW_MX4200TR_2.0.5.210476_prod.img
imgsize=9600000
loadaddr=44000000
prikern=1080000

So this command should work for kernel partition:
tftpboot 44000000 192.168.1.76:FW_MX4200TR_2.0.5.210476_prod.img && nand erase 1080000 9600000 && nand write 44000000 1080000 2600000
and for alt_kernel partition:
tftpboot 44000000 192.168.1.76:FW_MX4200TR_2.0.5.210476_prod.img && nand erase a680000 9600000 && nand write 44000000 a680000 2600000
The last value 2600000 need to be adjusted to actual OEM firmware size.

You can do the same by loading a file from USB:
usb start && fatload usb 0:1 44000000 FW_MX4200TR_2.0.5.210476_prod.img && nand erase 1080000 9600000 && nand write 44000000 1080000 2600000
usb start && fatload usb 0:1 44000000 FW_MX4200TR_2.0.5.210476_prod.img && nand erase a680000 9600000 && nand write 44000000 a680000 2600000

These two commands are only run when updating OEM firmware:

flash_erase /dev/mtd21 0 0
nandwrite -p /dev/mtd21 FW_MX4200TR_2.0.5.210476_prod.img

I'm not sure how the rootfs UBI volume is transferred from the kernel partition to the rootfs partition.

246

thanks for the info, very helpful. I really appreciate your time. Im keen to try update my firmware as its running a very old version and fails to update using the app and webpage so Ill try the method you mentioned.

flash_erase /dev/mtd21 0 0
nandwrite -p /dev/mtd21 FW_MX4200TR_2.0.5.210476_prod.img

before I do that, what's the command to backup the partition? I have tried tftpboot put command but it fails

247

Do you have access using serial console? What firmware is loaded? OEM or OpenWrt initramfs?

In OpenWrt you can use mtd dump, dd or nanddump.
In OEM firmware mtd_debug read or dd.

248

Check this for sysupgrade issue: Adding OpenWrt support for Linksys MX5300 - #15 by lytr

249

It's not fully ready, updates are dead

250

Can anyone share a dump of the mtd19 (s_env) partition?

251

did you get one as I have one backed up from openwrt initramfs when running ? Was a bit sceptical of validity fo them as not pulled via valid nanddump

252

I don't think I need it anymore.

253

I'd like to run past you my plan to test the firmware on a MX4200v2. I'm an experienced Linux user but I have zero experience with OpenWrt.

I've forked OpenWrt's GitHub's repo, added your repo as remote and cherry-picked your commit adding support for the MX4200. Luckily there was only one conflict with the comments on package/firmware/ipq-wifi/Makefile. The results are here: https://github.com/innovara/openwrt/tree/linksys_mx4200

I've compiled the firmware and I believe I can flash it onto my MX4200v2 which is currently running stock firmware.

Since sysupgrade isn't working at present, could I, from time to time, flash back the stock firmware and flash a newly built version of OpenWrt like the first time? This would be through the command line or the web, I won't have serial access to the router.

At the moment I can't do any of this anyway because I don't have a backup router. I'll be having one soon though so I would like to know if this approach is flawed or it could work.

Thanks.

254

thanks heaps legend

255

Yeah you can do that

1 Like
256

After the first installation, you can set these env variables to easy recovery from USB using the initramfs image:

fw_setenv usbimage 'openwrt-qualcommax-ipq807x-linksys_mx4200-initramfs-uImage.itb'
fw_setenv bootusb 'usb start && fatload usb 0:1 $loadaddr $usbimage && bootm $loadaddr'
fw_setenv bootcmd 'run bootusb; if test $auto_recovery = no; then bootipq; elif test $boot_part = 1; then run bootpart1; else run bootpart2; fi'
1 Like
257

@SpectreDev, can you confirm that the first 5GHz radio is limited to 36-48 channels (80MHz) only?