OpenWrt support for Linksys MX4200

Should probably do DD if=/mtd/(whatever of=(whatever).img

That would create imgs

It seems invalid/corrupted can you try to grab it in a .img format

Also could you run the 2 bash script here and send the results (guide on how Todo it is there too)

ah apologies, the new_mtd.7z are labelled bin but from what you said they were created via dd so should be named .img can you rename one to test else I am a bit stumped as did them all 1 by 1

also, these files are from the generic isp locked ones which show as V2 unit fw 2.0.5.210476

both fail

/tmp/mnt/sda1/mx4200 # sh gpio-test.sh
/base': No such file or directorygpiochip0
/ngpio': No such file or directorypiochip0
gpio-test.sh: line 5: arithmetic syntax error


/tmp/mnt/sda1/mx4200 # sh gpio-dump.sh
/base': No such file or directorygpiochip0
/ngpio': No such file or directorypiochip0
gpio-dump.sh: line 5: arithmetic syntax error

There are 2 buttons on the base and one multi colour LED on the top

Yeah that didn't work

Ah damn, so I've just use DTS from V2, well ig it should be fine

Well I'm attempting to build the Openwrt Firmware as we are speaking, I doubt WiFi will work since we are missing the 2 files

Well here we go (untested)

Initramfs Factory

https://file.io/Kak7yX3rFDbd

Initramfs uImage

https://file.io/T68GdgFnOh4v

SquashFS factory

https://file.io/0J4iDqyqTVCu

SysUpgrade

https://file.io/acc2vj43VeoO

I can't guarantee that it won't brick you, id recommend testing Initramfs first and ALWAYS make backup first

If you do want to flash Openwrt just download SquashFS factory and flash it via the Linksys web interface

(ONLY FOR V2, V1 will come when my laptop gets fixed)

ok so neither of the initramfs worked
standard bootup which is interrupted then tftpboot via ethernet

IPQ807x# tftpboot 50000000 192.168.1.76:openwrt-ipq807x-generic-linksys_mx4200-initramfs-uImage.itb; bootm
ipq807x_eth_halt: done
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 up Speed :1000 Full duplex
eth0 PHY4 Down Speed :10 Half duplex
10M speed not supported
ipq807x_eth_init: done
Using eth0 device
TFTP from server 192.168.1.76; our IP address is 192.168.1.1
Filename 'openwrt-ipq807x-generic-linksys_mx4200-initramfs-uImage.itb'.
Load address: 0x50000000
Loading: *
Got TFTP_OACK: TFTP remote port: changes from 69 to 60314
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ############################################
         4 MiB/s
done
Bytes transferred = 12085228 (b867ec hex)
ipq807x_eth_halt: done
## Loading kernel from FIT Image at 50000000 ...
   Using 'config@ac04' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.127
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x500000ec
     Data Size:    12000501 Bytes = 11.4 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41000000
     Entry Point:  0x41000000
     Hash algo:    crc32
     Hash value:   6b1e7ec1
     Hash algo:    sha1
     Hash value:   b99dbf522f68f3784999b76c684590e3167ca2a3
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 50000000 ...
   Using 'config@ac04' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt linksys_mx4200 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x50b71f24
     Data Size:    82818 Bytes = 80.9 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   2311b75f
     Hash algo:    sha1
     Hash value:   98ff844cfd8750b6afc63c5c6a7fb20b130d84c0
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x50b71f24
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 4a3e8000, end 4a3ff381 ... OK
Unable to update property /soc/dp6:mac-address, err=FDT_ERR_NOTFOUND
Unable to update property /soc/dp6:local-mac-address, err=FDT_ERR_NOTFOUND
Unable to update property /soc/dp6:mac-address, err=FDT_ERR_NOTFOUND
Unable to update property /soc/dp6:local-mac-address, err=FDT_ERR_NOTFOUND
Using machid 0x801000d from environment

Starting kernel ...

tried the same with the ubi file and it just errors

IPQ807x# tftpboot 50000000 192.168.1.76:openwrt-ipq807x-generic-linksys_mx4200-initramfs-factory.ubi; bootm
ipq807x_eth_halt: done
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 up Speed :1000 Full duplex
eth0 PHY4 Down Speed :10 Half duplex
10M speed not supported
ipq807x_eth_init: done
Using eth0 device
TFTP from server 192.168.1.76; our IP address is 192.168.1.1
Filename 'openwrt-ipq807x-generic-linksys_mx4200-initramfs-factory.ubi'.
Load address: 0x50000000
Loading: *
Got TFTP_OACK: TFTP remote port: changes from 69 to 55389
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###############################
         4 MiB/s
done
Bytes transferred = 12845056 (c40000 hex)
ipq807x_eth_halt: done
Wrong Image Format for bootm command
ERROR: can't get kernel image!
IPQ807x#

https://file.io/RMNpiIZfwmZg

Try this

Same result, file saved as uimage2

IPQ807x# tftpboot 50000000 192.168.1.76:openwrt-ipq807x-generic-linksys_mx4200-initramfs-uImage2.itb; bootm
ipq807x_eth_halt: done
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 up Speed :1000 Full duplex
eth0 PHY4 Down Speed :10 Half duplex
10M speed not supported
ipq807x_eth_init: done
Using eth0 device
TFTP from server 192.168.1.76; our IP address is 192.168.1.1
Filename 'openwrt-ipq807x-generic-linksys_mx4200-initramfs-uImage2.itb'.
Load address: 0x50000000
Loading: *
Got TFTP_OACK: TFTP remote port: changes from 69 to 61733
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ############################################
         4.2 MiB/s
done
Bytes transferred = 12085228 (b867ec hex)
ipq807x_eth_halt: done
## Loading kernel from FIT Image at 50000000 ...
   Using 'config@ac04' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.127
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x500000ec
     Data Size:    12000501 Bytes = 11.4 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41000000
     Entry Point:  0x41000000
     Hash algo:    crc32
     Hash value:   6b1e7ec1
     Hash algo:    sha1
     Hash value:   b99dbf522f68f3784999b76c684590e3167ca2a3
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 50000000 ...
   Using 'config@ac04' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt linksys_mx4200 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x50b71f24
     Data Size:    82818 Bytes = 80.9 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   2311b75f
     Hash algo:    sha1
     Hash value:   98ff844cfd8750b6afc63c5c6a7fb20b130d84c0
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x50b71f24
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 4a3e8000, end 4a3ff381 ... OK
Unable to update property /soc/dp6:mac-address, err=FDT_ERR_NOTFOUND
Unable to update property /soc/dp6:local-mac-address, err=FDT_ERR_NOTFOUND
Unable to update property /soc/dp6:mac-address, err=FDT_ERR_NOTFOUND
Unable to update property /soc/dp6:local-mac-address, err=FDT_ERR_NOTFOUND
Using machid 0x801000d from environment

Starting kernel ...

Jumping to AARCH64 kernel via monitor

Just going back to dumping the flash, seems DD wont work due to the ecc data on a nand chip.
Looking at Linksys EA8500 uboot damaged after wrongly flashing with empty $loadaddr - #35 by GloooM it can be done via the main console though so currently looking at that method.
Is there a specific partition you need for files other than a whole backup to be useful ?

Nah not really, full back would be most useful to us

The real Question is why isn't the kernel starting

Ok, have revised the filesystem with start and end values in HEX as I will try and grab them again shortly via the console dump command.
There seems some discussion whether the u_env and ART partitions can be retrieved correctly in this manner but will test and see.

Part:	Start:		Size: 		End:	erase	name
mtd0:	0			100000		100000	20000	0:SBL1
mtd1:	100000		100000		200000	20000	0:MIBIB
mtd2:	200000		80000		280000	20000	0:BOOTCONFIG
mtd3:	280000		80000		300000	20000	0:BOOTCONFIG1
mtd4:	300000		300000		600000	20000	0:QSEE
mtd5:	600000		300000		900000	20000	0:QSEE_1
mtd6:	900000		80000		980000	20000	0:DEVCFG
mtd7:	980000		80000		A00000	20000	0:DEVCFG_1
mtd8:	A00000		80000		A80000	20000	0:APDP
mtd9:	A80000		80000		B00000	20000	0:APDP_1
mtd10:	B00000		80000		B80000	20000	0:RPM
mtd11:	B80000		80000		C00000	20000	0:RPM_1
mtd12:	C00000		80000		C80000	20000	0:CDT
mtd13:	C80000		80000		D00000	20000	0:CDT_1
mtd14:	D00000	:	80000	:	D80000	20000	0:APPSBLENV
mtd15:	D80000		100000		E80000	20000	0:APPSBL
mtd16:	E80000		100000		F80000	20000	0:APPSBL_1
mtd17:	F80000		80000		1000000	20000	0:ART
mtd18:	1000000		40000		1040000	20000	u_env
mtd19:	1040000		20000		1060000	20000	s_env
mtd20:	1060000		20000		1080000	20000	devinfo
mtd21:	1080000		9600000		A680000	20000	kernel
mtd22:	A680000		9000000		13680000	20000	rootfs
mtd23:	13680000	9600000		1CC80000	20000	alt_kernel
mtd24:	1CC80000	9000000		25C80000	20000	alt_rootfs
mtd25:	25C80000	200000		25E80000	20000	sysdiag
mtd26:	25E80000	80000		25F00000	20000	0:ETHPHYFW
mtd27:	25F00000	0b800000:	31700000	20000	syscfg
mtd28:	31700000	900000		32000000	20000	0:WIFIFW

Try this

https://file.io/mI9NcJPVQ3em

Trying to add support for a device that you don't own and rely on other people to possibly brick their devices is rather unusual.

Yeah, I do own the device but this issue is Linksys Made a V2, I would do it all myself but my laptop died waiting for that to get fixed and I'll do V1 without asking anyone to test, I just wanted kernel up and running through initramfs