Support for Xiaomi Wifi R3P Pro?

PeLLmEn · March 12, 2019, 8:13pm

@ilyas, please, check out my last faq for updating your drivers to @lukasz92 drivers. I guess I don't have mistakes)) https://4pda.ru/forum/index.php?showtopic=810698&view=findpost&p=82315996

I'm helping another tester now to upgrade from pandora to openwrt. I guess, that

dd if=factory.bin bs=1M count=4 | mtd write - kernel
dd if=factory.bin bs=1M skip=4 | mtd write - ubi

will be the same, as pandora have. Or it can be more easier:

cd /tmp
mtd write factory.bin firmware

So, if it will be so, I'll write faq about upgrading to openwrt from pandora and back. I think it can bring more testers)))

ilyas · March 13, 2019, 7:48am

@pellmen i read your post on 4pda. some corrections:

@lukasz92 didn't adapt the drivers the drivers are being developed by the mt76 team. he compiled them in a release for 18.06.2 ... i compiled them as packages for openwrt/r3p (what we've been testing)... neither of us gets the credit or the blame bugs should be filed against mt76 at https://github.com/LorenzoBianconi/mt76/tree/mt7615
The drivers(5.0.2.0 etc) I've been posting/compiling/testing aren't mine ... they're Mediatek's leaked drivers. I take no responsibility or credit for them (only for compiling them... which isn't rocket science).
This is important: github interpreted my shell syntax as text formatting and screwed it up (and I didn't read it after writing it). I just fixed it, if you wouldn't mind going back and fixing your post...
Pandorabox:

I'm assuming this is pandorabox's partition table (based on this post: https://4pda.ru/forum/index.php?showtopic=810698&view=findpost&p=82862585)

[ 3.160000] Creating 10 MTD partitions on "MT762x-NAND":
[ 3.168000] 0x000000000000-0x000000040000 : "Bootloader"
[ 3.172000] 0x000000040000-0x000000080000 : "Config"
[ 3.180000] 0x000000080000-0x0000000c0000 : "Bdata"
[ 3.188000] 0x0000000c0000-0x000000100000 : "Factory"
[ 3.192000] 0x000000100000-0x000000140000 : "crash"
[ 3.200000] 0x000000140000-0x0000001c0000 : "crash_syslog"
[ 3.208000] 0x0000001c0000-0x000000200000 : "reserved0"
[ 3.216000] 0x000000200000-0x000000600000 : "kernel_stock"
[ 3.220000] 0x000000200000-0x00000f200000 : "firmware"
[ 4.264000] 0x000000000000-0x00000f200000 : "fullflash"

That's a complete mess... (i mean... it talks of "kernel_stock" but that's part of "firmware"... so it's not saving stock firmware for recovery) if this really is pandorabox's partition table, though, to install openwrt you would do the following (download factory.bin ... also kernel0 from one of my releases pages ;))

cd /tmp
mtd erase firmware
mtd write kernel0 firmware
mtd -p 0x400000 write factory.bin firmware

This is because pandrabox's partition table (apparently) has different offsets than ours (because it doesn't save kernel0), so we have to move everything over by 0x400000

EDIT: @lukasz92 just very handsomely pointed out that some *.bin files are necessary for mt76/mt7615... I'll add them to the package... so wait about half an hour before installing them (if anyone is that impatient )

EDIT2: Added command to restore kernel_stock as well.. NB: I didn't test the commands I have above.. at least the first person to try it should have an UART

EDIT3: @pellmen firmware files uploaded and instructions updated. still untested.

lolyinseo · March 13, 2019, 8:46am

maybe i do something wrong, but it bootlooped with

[    4.468264] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    4.475753] Please append a correct "root=" boot option; here are the available partitions:
[    4.484092] 1f00             512 mtdblock0 
[    4.484099]  (driver?)
[    4.490602] 1f01             256 mtdblock1 
[    4.490605]  (driver?)
[    4.497130] 1f02             256 mtdblock2 
[    4.497135]  (driver?)
[    4.503655] 1f03             256 mtdblock3 
[    4.503660]  (driver?)
[    4.510159] 1f04             256 mtdblock4 
[    4.510162]  (driver?)
[    4.516688] 1f05             256 mtdblock5 
[    4.516693]  (driver?)
[    4.523214] 1f06             256 mtdblock6 
[    4.523219]  (driver?)
[    4.529718] 1f07            4096 mtdblock7 
[    4.529721]  (driver?)
[    4.536247] 1f08            4096 mtdblock8 
[    4.536252]  (driver?)
[    4.542770] 1f09          120320 mtdblock9 
[    4.542775]  (driver?)
[    4.549277] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    4.559376] Rebooting in 1 seconds..

ilyas · March 13, 2019, 8:48am

@lolyinseo, @lukasz92 said he didn't test his binaries (because he doesn't have an R3P)... if you want to test mt76/mt7615 I'd recommend re-installing openwrt-latest and just installing the kernel packages (see my earlier post)... less risky.

lolyinseo · March 13, 2019, 9:01am

Already done. On first boot its reboot with

[    4.720000] Freeing unused kernel memory: 1568K (825a8000 - 82730000)
[    4.730000] csd: CSD deadlock debugging initiated!
[    4.770000] Loading essential drivers...
[    4.780000] Press Ctrl+C to enter RAMFS...
[    5.050000] usb 1-1: new high-speed USB device number 2 using xhci-hcd
[    5.070000] add_ep parameters, dev_speed 3, is_in 1, isTT 0, ep_type 2, maxp 512, interval 1, burst 0, mult 0, ep 0x9bfbec80, ep_ctx 0xa1c0d080, sch_ep 0x9bfe8080
[    5.080000] add_ep parameters, dev_speed 3, is_in 0, isTT 0, ep_type 2, maxp 512, interval 1, burst 0, mult 0, ep 0x9bfbecac, ep_ctx 0xa1c0d0a0, sch_ep 0x9bfe8300
[    5.100000] usb-storage 1-1:1.0: USB Mass Storage device detected
[    5.100000] scsi0 : usb-storage 1-1:1.0
[    5.790000] Check for USB recovery...
[    5.800000] Found usb storage, wait for ready
[    6.110000] scsi 0:0:0:0: Direct-Access     Kingston DataTraveler 111 PMAP PQ: 0 ANSI: 4
[    6.120000] sd 0:0:0:0: [sda] 15356160 512-byte logical blocks: (7.86 GB/7.32 GiB)
[    6.120000] sd 0:0:0:0: [sda] Write Protect is off
[    6.130000] sd 0:0:0:0: [sda] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA
[    6.840000] Bringup the system...
[    6.860000] flag_boot_rootfs=0 mounting /dev/mtd10
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00000800...
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x02800000...
[    7.240000]  sda: sda1
[    7.250000] sd 0:0:0:0: [sda] Attached SCSI removable disk
mount: mounting /dev/ram0 on /mnt failed: Invalid argument
[   19.580000] Restarting system.

maybe its ok )) who knows/.. second booting is ok. Start testing two mt6715 mod

PeLLmEn · March 13, 2019, 9:20am

So, if we want get back to the pandora, maybe we can make backup of firmware partition (sorry, I don't know with which command it would be better to do)? And than just overwrite our kernel0 and firmware???

Or maybe we just can do sysupgrade from openwrt to pandora? And after this manipulation we will have stock firmware for recover with pandora onboard?

ilyas · March 13, 2019, 9:43am

@pellmen haha excellent idea! and i was thinking how to restore back to pandorabox....

this should work:

pandorabox backup (i don't know the partition number of "firmware" on pandorabox so i'll extract it)

dd if=/dev/`cat /proc/mtd |grep firmware | cut -f1 -d:` of=pandorabox-backup.img

Obviously then pandorabox-backup.img needs to be copied to USB (or something)

from openwrt restore to pandorabox (assuming pandorabox-backup.img is in /tmp)

cd /tmp
dd if=pandorabox-backup.img bs=1M count=4 | mtd write - kernel_stock
dd if=pandorabox-backup.img bs=1M skip=4 count=4 | mtd write - kernel
mtd erase ubi
dd if=pandorabox-backup.img bs=1M skip=8 | mtd write - ubi

EDIT: based on the partition table provided by @pellmen below, the "backup" command above can be simplified as:

dd if=/dev/mtd7 of=pandorabox-backup.img

lolyinseo · March 13, 2019, 9:46am

opkg install kmod-mac80211*.ipk
Installing kmod-mac80211 (4.14.104+4.19.23-1-4) to root...
Collected errors:
 * satisfy_dependencies_for: Cannot satisfy the following dependencies for kmod-mac80211:
 *      kmod-cfg80211
 * opkg_install_cmd: Cannot install package kmod-mac80211.

And this is logical. It is needed for configuration.

ilyas · March 13, 2019, 10:09am

@lolyinseo ... yeah. you're right. i just uploaded it.

PeLLmEn · March 13, 2019, 10:15am

Here's cat /proc/mtd

[root@PandoraBox_0745:/root]#cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "Bootloader"
mtd1: 00040000 00020000 "Config"
mtd2: 00040000 00020000 "Bdata"
mtd3: 00040000 00020000 "Factory"
mtd4: 00040000 00020000 "crash"
mtd5: 00080000 00020000 "crash_syslog"
mtd6: 00040000 00020000 "reserved0"
mtd7: 0fd80000 00020000 "firmware"
mtd8: 00200000 00020000 "kernel"
mtd9: 0fb40000 00020000 "ubi"
mtd10: 00040000 00020000 "panic_oops"
mtd11: 00080000 00020000 "factory_bbt"

Router get crashed after the installation, that you've posted above))) these partition are not the same to log from 4pda...

lolyinseo · March 13, 2019, 10:19am

nope (

/etc/init.d/mt7615e start
[  533.912453] bus=0x1, slot = 0x0, irq=0x17
[  533.918768] mt7615e 0000:01:00.0: Invalid MAC address, using random address 36:60:25:8d:6b:86
[  544.554523] mt7615e 0000:01:00.0: Message -16 (seq 1) timeout
[  544.560265] mt7615e 0000:01:00.0: Failed to get patch semaphore
[  544.566359] mt7615e: probe of 0000:01:00.0 failed with error -11
[  544.572412] bus=0x2, slot = 0x1, irq=0x18
[  544.578673] mt7615e 0000:02:00.0: Invalid MAC address, using random address 46:05:4d:24:75:93
[  554.794520] mt7615e 0000:02:00.0: Message -16 (seq 1) timeout
[  554.800262] mt7615e 0000:02:00.0: Failed to get patch semaphore
[  554.806440] mt7615e: probe of 0000:02:00.0 failed with error -11
ifconfig: SIOCGIFFLAGS: No such device
brctl: iface ra0: No such device
ifconfig: SIOCGIFFLAGS: No such device
brctl: iface rai0: No such device

ilyas · March 13, 2019, 10:21am

@lolyinseo ok i guess i'll look at the source code now that I know it doesn't panic on load
maybe it names its interfaces differently (not ra0 or rai0)... what does ifconfig -a show you?

lolyinseo · March 13, 2019, 10:23am

br-lan    Link encap:Ethernet  HWaddr 78:11:DC:05:39:69
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::7a11:dcff:fe05:3969/64 Scope:Link
          inet6 addr: fda1:16e6:913e::1/60 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:15 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:2306 (2.2 KiB)

eth0      Link encap:Ethernet  HWaddr 78:11:DC:05:39:68
          inet6 addr: fe80::7a11:dcff:fe05:3968/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:312 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:98861 (96.5 KiB)
          Interrupt:21

eth0.1    Link encap:Ethernet  HWaddr 78:11:DC:05:39:69
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:15 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:2306 (2.2 KiB)

eth0.2    Link encap:Ethernet  HWaddr 78:11:DC:05:39:68
          inet6 addr: fe80::7a11:dcff:fe05:3968/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:283 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:91730 (89.5 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:224 errors:0 dropped:0 overruns:0 frame:0
          TX packets:224 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:15232 (14.8 KiB)  TX bytes:15232 (14.8 KiB)

ilyas · March 13, 2019, 10:32am

@pellmen not at all surprised it crashed can you give me the partition table from the boot log (that gives the offsets, not just the sizes) also... any bad blocks? any messages during installation i should be aware of? (and just to make sure, you're saying it crashes when "installing" openwrt from pandorabox, right?)

(also.. their kernel partition is half the size of ours... i've noticed problems booting with a kernel larger than 2MB... maybe they know something about the bootloader that i don't....)

ilyas · March 13, 2019, 10:33am

@lolyinseo ... i'm going to need some time to see what the error message corresponds to in code... you made sure you installed the mt7615-firmware package, right?

lolyinseo · March 13, 2019, 10:36am

Package mt7615-firmware (f809470c-1) installed in root is up to date.

PeLLmEn · March 13, 2019, 10:37am

They are using their own pbboot, as you can see here: https://downloads.pangubox.com/刷机说明/小米路由器Pro/

I'm working now on boot log)) so we can see all)

[    2.252000] nand: NAND use hardware ECC
[    2.256000] Device not found, ID: 2cda
[    2.260000] Not Support this flash! apply bootstrap config!
[    2.264000] nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xda
[    2.272000] nand: Micron NAND 256MiB 3,3V 8-bit
[    2.276000] nand: 256MiB, SLC, page size: 2048, OOB size: 64
[    2.280000] Scanning device for bad blocks
[    2.812000] Creating 9 MTD partitions on "MT762x-NAND":
[    2.820000] 0x000000000000-0x000000040000 : "Bootloader"
[    2.824000] 0x000000040000-0x000000080000 : "Config"
[    2.832000] 0x000000080000-0x0000000c0000 : "Bdata"
[    2.840000] 0x0000000c0000-0x000000100000 : "Factory"
[    2.844000] 0x000000100000-0x000000140000 : "crash"
[    2.852000] 0x000000140000-0x0000001c0000 : "crash_syslog"
[    2.860000] 0x0000001c0000-0x000000200000 : "reserved0"
[    2.868000] 0x000000200000-0x00000ff80000 : "firmware"
[    6.360000] 3 uimage-fw partitions found on MTD device firmware
[    6.364000] 0x000000200000-0x000000400000 : "kernel"
[    6.372000] 0x000000400000-0x00000ff40000 : "ubi"
[    6.380000] 0x00000ff40000-0x00000ff80000 : "panic_oops"
[    6.420000] mtdoops: Attached to MTD device 10
[    6.428000] 0x000007f80000-0x000008000000 : "factory_bbt"
[    6.436000] Signature matched and data read!
[    6.440000] load_fact_bbt success 2047

Full log - https://yadi.sk/i/ZsLT4a2TKfO_lQ

lolyinseo · March 13, 2019, 11:15am

looks like it stops on mt7615_load_patch() (cant find patch file ?)
also i'm worried about

 0000:01:00.0: Message -16 (seq 1) timeout

		skb = mt76_mcu_get_response(&dev->mt76, expires);
		if (!skb) {
			dev_err(dev->mt76.dev, "Message %d (seq %d) timeout\n",
				cmd, seq);
			ret = -ETIMEDOUT;
			break;
		}

ilyas · March 13, 2019, 11:39am

@pellmen OK i can't see anything obviously wrong.. is this your system? are you using pb-boot instead of uboot? and how did it "crash" (ie, bootlog).... if they compiled their own bootloader, it might be hard-coded to boot from 0x200000 (ie, no "kernel0" and "kernel1" magic)... assuming that (and guessing at how it " crashed") here's a hack:

dd if=factory.bin of=kernel1.bin bs=1M count=4
cat kernel1.bin factory.bin | mtd write - firmware

in other words, assuming the bootloader will always load from 0x200000, we'll put our openwrt kernel there (overwriting "kernel_stock"), then copy the factory.bin over so we'll end up with kernel1 + kernel1 + ubi on disk... at boot the bootloader will load the kernel from 0x200000 and then the kernel will mount rootfs at 0xa00000 ... at least, that's the idea. it's a hack. try it

ilyas · March 13, 2019, 11:56am

@lolyinseo well it can't load the mac address either... what i hope is that the dts file is all busted up and this will give me an opportunity to discover the bugs... but then... maybe the mt7615 code is all bogus and untested remember, they didn't come out and say "hey we'd love you to test this code we think it's great..." we just grabbed their code, so it's not fair to expect it to work

but of course... maybe it's something as simple as "the package doesn't put the eeprom files in the right place"