Supporting EAP225 v5

For Developers
1

Hi,
is it possible to run OpenWrt on an EAP225 v5?
Seems to be MT7629 with 16MB flash and 128MB RAM.

Some output from the UART interface:

F0: 102B 0000

F1: 0000 0000

V0: 0000 0000 [0001]

00: 0000 0000

BP: 0000 0041 [0000]

G0: 0190 0000

T0: 0000 0203 [000F]

Jump to BL



U-Boot SPL 2014.04-rc1-00395-g1a24601 (May 28 2020 - 19:56:21)
Hello, MT7629 E2
SPM_PWR_STATUS(0x1000660c) = 0xb644, turn off cpu1.
SPM_PWR_STATUS(0x1000660c) = 0xa644, turn off cpu1 done.
RGU MODE:     4d
RGU LENGTH:   ffe0
RGU STA:      0
RGU: g_rgu_satus:0
PL P ON
WDT does not trigger reboot
RGU mtk_wdt_init:MTK_WDT_DEBUG_CTL(590200f3)
PCDDR3 type with 1600MHz.
R0 FINAL: WriteLeveling DQS:(2, 0) OEN:(1, 2) DQS0 delay =  30
R0 FINAL: WriteLeveling DQS:(2, 0) OEN:(1, 2) DQS1 delay =  30
R0 FINAL: GW best DQS0 P0 delay(2T, 0.5T, PI) = (1, 0, 0) [tap = 56]
R0 FINAL: GW best DQS1 P0 delay(2T, 0.5T, PI) = (1, 0, 0) [tap = 57]
R0 FINAL: RX Bit0 ( -3~ 34) 38 15,   Bit 8 ( -5~ 31) 37 13, 
R0 FINAL: RX Bit1 ( -2~ 34) 37 16,   Bit 9 ( -1~ 34) 36 16, 
R0 FINAL: RX Bit2 ( -5~ 34) 40 14,   Bit10 ( -1~ 33) 35 16, 
R0 FINAL: RX Bit3 ( -3~ 34) 38 15,   Bit11 ( -1~ 33) 35 16, 
R0 FINAL: RX Bit4 ( -8~ 29) 38 10,   Bit12 ( -3~ 31) 35 14, 
R0 FINAL: RX Bit5 (-10~ 27) 38  8,   Bit13 ( -1~ 33) 35 16, 
R0 FINAL: RX Bit6 ( -7~ 28) 36 10,   Bit14 ( -4~ 29) 34 12, 
R0 FINAL: RX Bit7 (-10~ 27) 38  8,   Bit15 ( -4~ 31) 36 13, 
R0 FINAL: DATLAT = 14 [12 ~ 17]
R0 FINAL: TX Bit 0 ( 35~ 59) 25 47,   Bit8 ( 35~ 60) 26 47, 
R0 FINAL: TX Bit 1 ( 35~ 58) 24 46,   Bit9 ( 37~ 61) 25 49, 
R0 FINAL: TX Bit 2 ( 34~ 58) 25 46,   Bit10 ( 36~ 61) 26 48, 
R0 FINAL: TX Bit 3 ( 35~ 58) 24 46,   Bit11 ( 37~ 61) 25 49, 
R0 FINAL: TX Bit 4 ( 33~ 56) 24 44,   Bit12 ( 35~ 60) 26 47, 
R0 FINAL: TX Bit 5 ( 31~ 54) 24 42,   Bit13 ( 38~ 61) 24 49, 
R0 FINAL: TX Bit 6 ( 33~ 56) 24 44,   Bit14 ( 36~ 60) 25 48, 
R0 FINAL: TX Bit 7 ( 33~ 55) 23 44,   Bit15 ( 37~ 60) 24 48, 
[MEM_TEST]  OK. 
[EMI]rank0 size auto detect: 0x8000000
SPL: Decompressing U-Boot image!
Actual U-Boot image size: 0x53ca8
image entry point: 0x41E00000


U-Boot 2014.04-rc1 (Jul 14 2022 - 10:49:30)

static declaration g_total_rank_size = 0x 8000000
DRAM:  128 MiB
NOR:  *** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
*** Warning - bad CRC, using default environment

Net:   device is eap225, used inner mt7629ba connect to gmac2 
mtk_eth
Uip activated
reset button is not pressed for 20s.
e[?25le[2Je[1;1He[1;1He[2Ke[2;1H  *** U-Boot SPI NOR ***e[0Ke[3;1He[2Ke[15;1He[2Ke[16;1H  Press UP/DOWN to move or Press 1~9,a~` to choose, ENTER to selecte[0Ke[17;1He[2Ke[4;1H     1. System Load Linux to SDRAM via TFTP.e[5;1H     2. System Load Linux Kernel then write to Flash via TFTP.e[6;1H     e[7m3. Boot system code via Flash.e[0me[7;1H     4. System Load U-Boot then write to Flash via TFTP.e[8;1H     5. System Load U-Boot then write to Flash via Serial.e[9;1H     6. System Load CTP then write to Flash via TFTP.e[10;1H     7. Debugger load image then write to Flash.e[11;1H     8. System Load flashimage then write to Flash via TFTP.e[12;1H     9. Load rootfs then write to Flash via TFTP.e[13;1H     U-Boot consolee[15;1H  Hit Ctrl+b to stop autoboot:  1  0 e[15;1He[2Ke[?25he[2Je[1;1H[do_read_image_blks] This is a FIT image,img_size = 0x15ef2c
[do_read_image_blks] img_blks = 0x15ef2c
[do_read_image_blks] img_align_size = 0x15ef2c
bootm flag=0, states=70f
## Loading kernel from FIT Image at 42007f1c ...
   Using 'config@1' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM OpenWrt Linux-4.4.198
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x42008000
     Data Size:    1417344 Bytes = 1.4 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x40008000
     Entry Point:  0x40008000
     Hash algo:    crc32
     Hash value:   d33d0647
     Hash algo:    sha1
     Hash value:   e0fdb502b8459c653834dcb88d2ed6fba1cafc03
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 42007f1c ...
   Using 'config@1' configuration
   Trying 'fdt@1' fdt subimage
     Description:  ARM OpenWrt mt7629-lynx-rfb3 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x421621bc
     Data Size:    17290 Bytes = 16.9 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   7507480f
     Hash algo:    sha1
     Hash value:   d2c858aa3e8592503524fbbd87ea839ce2d86e81
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x421621bc
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 47b30000, end 47b37389 ... OK

Starting kernel ...

Output of dmesg (MAC adddresses replaced by xx::xx..., second mac was first mac +1 in last byet):

2

UART interface:

IMG-2260
IMG-2260756×1008 252 KB

3

Output of cat /proc/mtd

dev:    size   erasesize  name
mtd0: 00080000 00010000 "Bootloader"
mtd1: 00010000 00010000 "Partition"
mtd2: 00010000 00010000 "Factory"
mtd3: 00010000 00010000 "Radio"
mtd4: 00010000 00010000 "Extra"
mtd5: 001a0000 00010000 "Kernel"
mtd6: 00be0000 00010000 "rootfs"
mtd7: 001b0000 00010000 "Config"
4

Sending Ctrl+B via UART during boot enables the boot menu:
image

In the uBoot console, I get the following output for env print

arch=arm
baudrate=115200
board=leopard_evb
board_name=leopard_evb
boot0=download_setting kernel;tftpboot ${loadaddr} ${kernel_filename};bootm
boot1=download_setting kernel;tftpboot ${loadaddr} ${kernel_filename};run boot_w                                                                              r_img;run boot_rd_img;bootm
boot2=run boot_rd_img;bootm
boot3=download_setting uboot;tftpboot ${loadaddr} ${uboot_filename};run wr_uboot                                                                              ;invaild_env
boot4=loadb;run wr_uboot;invaild_env
boot5=download_setting ctp;tftpboot ${loadaddr} ${ctp_filename};run wr_ctp
boot6=run wr_cumstom_image;invaild_env
boot7=download_setting flashimage;tftpboot ${loadaddr} ${flashimage_filename};ru                                                                              n wr_flashimage;invaild_env
boot8=download_setting rootfs;tftpboot ${loadaddr} ${rootfs_filename};run wr_roo                                                                              tfs;invaild_env
boot_rd_ctp=snor read 0x40000000 0xB0000 0xF20000
boot_rd_img=snor read ${loadaddr} 0xC0000 2000;image_blks 1;snor read ${loadaddr                                                                              } 0xC0000 ${img_align_size}
boot_wr_img=filesize_check 0x1A0000;if test ${filesize_result} = good; then snor                                                                               erase 0xC0000 ${file_align_size};snor write ${loadaddr} 0xC0000 ${filesize};fi
bootcmd=No
bootdelay=1
bootfile=lede_uImage
bootmenu_0=1. System Load Linux to SDRAM via TFTP.=run boot0
bootmenu_1=2. System Load Linux Kernel then write to Flash via TFTP.=run boot1
bootmenu_2=3. Boot system code via Flash.=run boot2
bootmenu_3=4. System Load U-Boot then write to Flash via TFTP.=run boot3
bootmenu_4=5. System Load U-Boot then write to Flash via Serial.=run boot4
bootmenu_5=6. System Load CTP then write to Flash via TFTP.=run boot5
bootmenu_6=7. Debugger load image then write to Flash.=run boot6
bootmenu_7=8. System Load flashimage then write to Flash via TFTP.=run boot7
bootmenu_8=9. Load rootfs then write to Flash via TFTP.=run boot8
bootmenu_delay=30
cpu=armv7
ctp_filename=ctp.bin
ethact=mtk_eth
ethaddr=00:0C:E7:11:22:33
flashimage_filename=flashimage.bin
invaild_env=no
ipaddr=192.168.1.3
kernel_filename=mt7629-lynx-rfb3-kernel.bin
loadaddr=0x42007F1C
rootfs_filename=squashfs
serverip=192.168.1.110
soc=leopard
stderr=serial
stdin=serial
stdout=serial
uboot_filename=u-boot-mtk.bin
vendor=mediatek
wr_ctp=filesize_check 0xF20000;if test ${filesize_result} = good; then snor eras                                                                              e 0xB0000 0xB0000;snor write ${loadaddr} 0xB0000 0xF20000;fi
wr_cumstom_image=custom_image_check 0x1000000;if test ${img_result} = good; then                                                                               snor erase 0x0 0x1000000;snor write 0x40000000 0x0 0x1000000;fi
wr_flashimage=filesize_check 0x1000000;if test ${filesize_result} = good; then s                                                                              nor erase 0x0 0x1000000;snor write ${loadaddr} 0x0 ${filesize};fi
wr_rootfs=filesize_check 0xbe0000;if test ${filesize_result} = good; then snor e                                                                              rase 0x260000 0xbe0000;snor write ${loadaddr} 0x260000 ${filesize};fi
wr_uboot=filesize_check 0x60000;if test ${filesize_result} = good; then snor era                                                                              se 0x00000 0x60000;snor write ${loadaddr} 0x00000 0x60000;fi

Environment size: 2902/4092 bytes
5

Output in uBoot for help

?       - alias for 'help'
backup_message- print backup message.
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootmenu- ANSI terminal bootmenu
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
custom_image_check- check if image in load_addr is normal.
dialog  - echo args to console, and get yes or no response from user
download_setting- set download image file name , and device IP , server IP before upgrade
echo    - echo args to console
editenv - edit environment variable
env     - environment handling commands
esw_read- esw_read   - Dump external switch/GMAC status !!

exit    - exit script
false   - do nothing, unsuccessfully
fdt     - flattened device tree utility commands
filesize_check- check if filesize of the image that you want to upgrade is normal.
go      - start application at address 'addr'
gpio    - gpio debug function.
gpio_dump- enable utif debug function.
help    - print command description/usage
httpd   - httpd - start web server for firmware recovery

image_blks- read image size from img_size or image header if no specifying img_size, and divided by blk_size and save image blocks in image_blks variable.
image_check- check if image in load_addr is normal.
iminfo  - print header information for application image
imxtract- extract a part of a multi-image
invaild_env- need to invaild env.
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loadx   - load binary file over serial line (xmodem mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mdio    - mdio   - Mediatek PHY register R/W command !!

mm      - memory modify (auto-incrementing address)
mtk_image_blks- read image size from image header (MTK format) located at load_addr, divided by blk_size and save image blocks in image_blks variable.
mw      - memory write (fill)
n9_jtag - switch GPIO to AUX6 for N9 jtag debug.
n9_uart - switch GPIO to AUX6 for N9 UART output.
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reco_message- print recovery message.
reg     - reg   - Mediatek PHY register R/W command !!

reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
serious_image_check- seriously check if image in load_addr is normal.
setenv  - set environment variables
showvar - print local hushshell variables
sleep   - delay execution for some time
snor    - snor   - spi-nor flash command

source  - run script from memory
switch_rxcal- Re-cal PHY Rx DC offset of mt7531 switch !!
switch_txcal- Re-cal PHY Tx offset of mt7531 switch !!
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
tftpput - TFTP put command, for uploading files to a server
true    - do nothing, successfully
uboot_check- check if uboot in load_addr is normal.
uid     - uid    - Read Unique ID from spi-nor flash

utif_debug- enable utif debug function.
version - print monitor, compiler and linker version
6

Downloading openwrt-mediatek-mt7629-mediatek_mt7629-rfb-initramfs-kernel.bin via TFTP to RAM seems to work:

 Please Input new setting /or enter to choose the default setting
        Input kernel file name (mt7629-lynx-rfb3-kernel.bin) ==:
        Input server IP (192.168.1.110) ==:
        Input device IP (192.168.1.3) ==:
ETH already turn on and power on flow will be skipped...

 Waitting for RX_DMA_BUSY status Start... done

Disable pause ability
 0x1b000014 = 0x00110214
Using mtk_eth device
TFTP from server 192.168.1.110; our IP address is 192.168.1.3
Filename 'mt7629-lynx-rfb3-kernel.bin'.
Load address: 0x42007f1c
Loading: T #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #########################################
         811.5 KiB/s
done
Bytes transferred = 5363724 (51d80c hex)
get filesize 0x51d80c
bootm flag=0, states=70f
## Loading kernel from FIT Image at 42007f1c ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM OpenWrt Linux-5.15.89
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x42008000
     Data Size:    5348354 Bytes = 5.1 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x40008000
     Entry Point:  0x40008000
     Hash algo:    crc32
     Hash value:   641c64dc
     Hash algo:    sha1
     Hash value:   5271c5af6286da7cdc71bc0dd24a9083f0664735
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 42007f1c ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM OpenWrt mediatek_mt7629-rfb device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x42521d44
     Data Size:    13472 Bytes = 13.2 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   4cafdcec
     Hash algo:    sha1
     Hash value:   2b6336f3e9b6d857c0181eb8b098d74e8053c7a3
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x42521d44
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 47b31000, end 47b3749f ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.15.89 (builder@buildhost) (arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 12.2.0 r21887-fb7f4d4b54) 12.2.0, GNU ld (GNU Binutils) 2.39) #0 SMP Sun Jan 22 16:30:42 2023
[    0.000000] CPU: ARMv7 Processor [410fc073] revision 3 (ARMv7), cr=10c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt: Machine model: MediaTek MT7629 reference board
[    0.000000] earlycon: uart8250 at MMIO32 0x11002000 (options '')
[    0.000000] printk: bootconsole [uart8250] enabled
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000040000000-0x0000000047ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000047ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x0000000047ffffff]
[    0.000000] percpu: Embedded 12 pages/cpu s16460 r8192 d24500 u49152
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n8
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 109364K/131072K available (6669K kernel code, 588K rwdata, 1656K rodata, 10240K init, 222K bss, 21708K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] arch_timer: cp15 timer(s) running at 20.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x49cd42e20, max_idle_ns: 440795202120 ns
[    0.000001] sched_clock: 56 bits at 20MHz, resolution 50ns, wraps every 4398046511100ns
[    0.008132] Switching to timer-based delay loop, resolution 50ns
[    0.014538] Calibrating delay loop (skipped), value calculated using timer frequency.. 40.00 BogoMIPS (lpj=200000)
[    0.025068] pid_max: default: 32768 minimum: 301
[    0.029903] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.037350] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.045931] CPU: Testing write buffer coherency: ok
[    0.051214] CPU0: update cpu_capacity 1024
[    0.055382] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[    0.061895] Setting up static identity map for 0x40100000 - 0x4010003c
[    0.068632] rcu: Hierarchical SRCU implementation.
[    0.073723] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.081644] smp: Bringing up secondary CPUs ...
[    1.136736] CPU1: failed to come online
[    1.140698] smp: Brought up 1 node, 1 CPU
[    1.144771] SMP: Total of 1 processors activated (40.00 BogoMIPS).
[    1.151074] CPU: All CPU(s) started in SVC mode.
[    1.158532] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    1.168597] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    1.175627] pinctrl core: initialized pinctrl subsystem
[    1.181797] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    1.188082] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    1.195756] thermal_sys: Registered thermal governor 'step_wise'
[    1.195835] cpuidle: using governor menu
[    1.207778] OF: /soc/ethernet@1b100000/mac@0: could not get #nvmem-cell-cells for /soc/spi@11014000/flash@0/partitions/partition@70000/macaddr@2a
[    1.221112] OF: /soc/ethernet@1b100000/mac@1: could not get #nvmem-cell-cells for /soc/spi@11014000/flash@0/partitions/partition@70000/macaddr@24
[    1.254786] SCSI subsystem initialized
[    1.258767] usbcore: registered new interface driver usbfs
[    1.264368] usbcore: registered new interface driver hub
[    1.269826] usbcore: registered new device driver usb
[    1.276042] clocksource: Switched to clocksource arch_sys_counter
[    1.283020] NET: Registered PF_INET protocol family
[    1.288187] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    1.296038] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    1.304545] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    1.312433] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    1.320229] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    1.327415] TCP: Hash tables configured (established 1024 bind 1024)
[    1.333946] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    1.340617] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    1.347876] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    1.353651] PCI: CLS 0 bytes, default 64
[    1.423299] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    1.432886] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.438871] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.449830] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    2.462295] mtk-scpsys 10006000.power-controller: Failed to power on domain wb
[    2.469664] ------------[ cut here ]------------
[    2.474347] WARNING: CPU: 0 PID: 1 at drivers/soc/mediatek/mtk-scpsys.c:535 scpsys_probe+0x304/0x38c
[    2.483652] Modules linked in:
[    2.486764] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.15.89 #0
[    2.492863] Hardware name: Mediatek Cortex-A7 (Device Tree)
[    2.498525] [<c0108234>] (unwind_backtrace) from [<c0104c30>] (show_stack+0x10/0x14)
[    2.506400] [<c0104c30>] (show_stack) from [<c040ceb8>] (dump_stack_lvl+0x40/0x4c)
[    2.514094] [<c040ceb8>] (dump_stack_lvl) from [<c0119368>] (__warn+0xc0/0x11c)
[    2.521523] [<c0119368>] (__warn) from [<c011942c>] (warn_slowpath_fmt+0x68/0x78)
[    2.529127] [<c011942c>] (warn_slowpath_fmt) from [<c04703a0>] (scpsys_probe+0x304/0x38c)
[    2.537440] [<c04703a0>] (scpsys_probe) from [<c049bbb0>] (platform_probe+0x5c/0xb0)
[    2.545314] [<c049bbb0>] (platform_probe) from [<c0499b00>] (really_probe.part.0+0x9c/0x32c)
[    2.553888] [<c0499b00>] (really_probe.part.0) from [<c0499e38>] (__driver_probe_device+0xa8/0x13c)
[    2.563079] [<c0499e38>] (__driver_probe_device) from [<c0499f04>] (driver_probe_device+0x38/0x11c)
[    2.572270] [<c0499f04>] (driver_probe_device) from [<c049a588>] (__driver_attach+0x90/0x170)
[    2.580932] [<c049a588>] (__driver_attach) from [<c0497c9c>] (bus_for_each_dev+0x64/0x90)
[    2.589240] [<c0497c9c>] (bus_for_each_dev) from [<c0498ea4>] (bus_add_driver+0xfc/0x1ec)
[    2.597548] [<c0498ea4>] (bus_add_driver) from [<c049abe8>] (driver_register+0x88/0x118)
[    2.605768] [<c049abe8>] (driver_register) from [<c010172c>] (do_one_initcall+0x54/0x1e8)
[    2.614077] [<c010172c>] (do_one_initcall) from [<c0a013d0>] (kernel_init_freeable+0x22c/0x280)
[    2.622924] [<c0a013d0>] (kernel_init_freeable) from [<c077bc90>] (kernel_init+0x14/0x124)
[    2.631324] [<c077bc90>] (kernel_init) from [<c0100110>] (ret_from_fork+0x14/0x24)
[    2.639014] Exception stack(0xc1827fb0 to 0xc1827ff8)
[    2.644141] 7fa0:                                     00000000 00000000 00000000 00000000
[    2.652444] 7fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    2.660747] 7fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[    2.667510] ---[ end trace 289752a40c242fa6 ]---
[    2.672752] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    2.680805] printk: console [ttyS0] disabled
[    2.705369] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 112, base_baud = 2500000) is a ST16650V2
[    2.714807] printk: console [ttyS0] enabled
[    2.714807] printk: console [ttyS0] enabled
[    2.723182] printk: bootconsole [uart8250] disabled
[    2.723182] printk: bootconsole [uart8250] disabled
[    2.739241] mtk_rng 1020f000.rng: registered RNG driver
[    2.744963] random: crng init done
[    2.749174] Loading iSCSI transport class v2.0-870.
[    2.756122] SCSI Media Changer driver v0.25
[    2.760844] mtk-ecc 1100e000.ecc: probed
[    2.768494] mtk-spi-nor 11014000.spi: IRQ not available.
[    2.775423] spi-nor spi1.0: w25q128 (16384 Kbytes)
[    2.785683] 4 fixed-partitions partitions found on MTD device spi1.0
[    2.792200] OF: Bad cell count for /soc/spi@11014000/flash@0/partitions
[    2.798865] OF: Bad cell count for /soc/spi@11014000/flash@0/partitions
[    2.805727] OF: Bad cell count for /soc/spi@11014000/flash@0/partitions
[    2.812385] OF: Bad cell count for /soc/spi@11014000/flash@0/partitions
[    2.819149] Creating 4 MTD partitions on "spi1.0":
[    2.823938] 0x000000000000-0x000000060000 : "u-boot"
[    2.830509] 0x000000060000-0x000000070000 : "u-boot-env"
[    2.837262] 0x000000070000-0x0000000b0000 : "factory"
[    2.842976] 0x0000000b0000-0x000000c00000 : "firmware"
[    2.850006] 2 fit-fw partitions found on MTD device firmware
[    2.855678] Creating 2 MTD partitions on "firmware":
[    2.860716] 0x000000010000-0x000000170000 : "kernel"
[    2.866906] 0x0000001b0000-0x000000b50000 : "rootfs"
[    2.872461] mtd: setting mtd5 (rootfs) as root device
[    2.878151] 1 squashfs-split partitions found on MTD device rootfs
[    2.884343] 0x0000008a0000-0x000000b50000 : "rootfs_data"
[    2.892335] mtk-spi-nor 11014000.spi: spi frequency: 46666666 Hz
[    2.898880] mt7629-pinctrl 10217000.pinctrl: pin SPI_CLK already requested by 11014000.spi; cannot claim for 1100d000.spi
[    2.909870] mt7629-pinctrl 10217000.pinctrl: pin-62 (1100d000.spi) status -22
[    2.917013] mt7629-pinctrl 10217000.pinctrl: could not request pin 62 (SPI_CLK) from group snfi  on device pinctrl_moore
[    2.927881] mtk-snand 1100d000.spi: Error applying setting, reverse things back
[    2.956278] mtk_soc_eth 1b100000.ethernet: generated random MAC address 0e:3e:6f:2b:40:9f
[    2.965399] mtk_soc_eth 1b100000.ethernet eth0: mediatek frame engine at 0xc8900000, irq 119
[    2.974007] mtk_soc_eth 1b100000.ethernet: generated random MAC address c6:17:ee:49:4a:9e
[    2.983121] mtk_soc_eth 1b100000.ethernet eth1: mediatek frame engine at 0xc8900000, irq 119
[    2.998026] mtk-wdt 10212000.watchdog: IRQ index 0 not found
[    3.003845] mtk-wdt 10212000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    3.012477] NET: Registered PF_INET6 protocol family
[    3.021808] Segment Routing with IPv6
[    3.025504] In-situ OAM (IOAM) with IPv6
[    3.029586] NET: Registered PF_PACKET protocol family
[    3.034710] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    3.047905] 8021q: 802.1Q VLAN Support v1.8
[    3.052158] Registering SWP/SWPB emulation handler
[    3.069473] mtk-pcie 1a145000.pcie: host bridge /soc/pcie@1a145000 ranges:
[    3.076488] mtk-pcie 1a145000.pcie:      MEM 0x0020000000..0x002fffffff -> 0x0020000000
[    3.296082] mtk-pcie 1a145000.pcie: Port1 link down
[    3.301217] mtk-pcie 1a145000.pcie: PCI host bridge to bus 0000:00
[    3.307422] pci_bus 0000:00: root bus resource [bus 00-ff]
[    3.312906] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    3.320507] PCI: bus0: Fast back to back transfers enabled
[    3.328160] xhci-mtk 1a0c0000.usb: xHCI Host Controller
[    3.333430] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 1
[    3.342633] xhci-mtk 1a0c0000.usb: hcc params 0x01403f98 hci version 0x110 quirks 0x0000000000210010
[    3.351866] xhci-mtk 1a0c0000.usb: irq 117, io mem 0x1a0c0000
[    3.357767] xhci-mtk 1a0c0000.usb: xHCI Host Controller
[    3.362999] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 2
[    3.370418] xhci-mtk 1a0c0000.usb: Host supports USB 3.1 Enhanced SuperSpeed
[    3.378168] hub 1-0:1.0: USB hub found
[    3.382387] hub 1-0:1.0: 1 port detected
[    3.387039] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    3.396109] hub 2-0:1.0: USB hub found
[    3.400308] hub 2-0:1.0: 1 port detected
[    3.416585] Freeing unused kernel image (initmem) memory: 10240K
[    3.426281] Run /init as init process
[    3.613008] init: Console is alive
[    3.617250] init: - watchdog -
[    3.625228] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.637402] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.655045] init: - preinit -
[    3.741427] mtk_soc_eth 1b100000.ethernet eth0: configuring for fixed/2500base-x link mode
[    3.751877] mtk_soc_eth 1b100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    3.760619] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    5.846845] procd: - early -
[    5.849869] procd: - watchdog -
[    6.415715] procd: - watchdog -
[    6.419171] procd: - ubus -
[    6.473744] procd: - init -
Please press Enter to activate this console.
[    6.800827] kmodloader: loading kernel modules from /etc/modules.d/*
[    6.825662] urngd: v1.0.2 started.
[    6.921180] PPP generic driver version 2.4.2
[    6.936716] NET: Registered PF_PPPOX protocol family
[    6.968568] kmodloader: done loading kernel modules from /etc/modules.d/*
[   15.495099] mtk_soc_eth 1b100000.ethernet eth0: Link is Down
[   15.537514] mtk_soc_eth 1b100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   15.549214] mtk_soc_eth 1b100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   15.562733] br-lan: port 1(eth0.1) entered blocking state
[   15.568280] br-lan: port 1(eth0.1) entered disabled state
[   15.573915] device eth0.1 entered promiscuous mode
[   15.578731] device eth0 entered promiscuous mode
[   15.605906] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   15.653551] br-lan: port 1(eth0.1) entered blocking state
[   15.659029] br-lan: port 1(eth0.1) entered forwarding state
[   15.773237] mtk_soc_eth 1b100000.ethernet eth1: PHY [mdio-bus:00] driver [Generic PHY] (irq=POLL)
[   15.782232] mtk_soc_eth 1b100000.ethernet eth1: configuring for phy/gmii link mode
[   20.056237] mtk_soc_eth 1b100000.ethernet eth1: Link is Up - 1Gbps/Full - flow control off
[   20.064546] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready




BusyBox v1.36.0 (2023-01-22 16:30:42 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r21887-fb7f4d4b54
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
7

FCC: https://fcc.report/FCC-ID/2AXJ4EAP225V5

8

So they switched to Mediatek for the EAP225 too now. Maybe have a look at the EAP615-Wall port, could very well be that TP-Link uses a similar configuration here for the FIT images.

The board appears to have MT7761N and MT7762N as radios, which is the first time I've seen these used in the EAP series. Curiously enough, these are 3×3 radios, and there are three antennas in the FCC photos. Only two of the three are labelled with "5G" however, and the antenna test report only lists two for the 5GHz range too.

9

The firwmware images look similar:
EAP615-WALLv1_1.1.3_[20220921-rel73949]_up_signed.bin:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
8370          0x20B2          Flattened device tree, size: 2557580 bytes, version: 17
8598          0x2196          LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 8442048 bytes
1013725       0xF77DD         COBALT boot rom data (Flat boot rom or file system)
2552886       0x26F436        Flattened device tree, size: 10754 bytes, version: 17
2565950       0x27273E        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 4927314 bytes, 634 inodes, blocksize: 262144 bytes, created: 2022-09-21 12:32:29

EAP225v5_1.1.1_[20220908-rel31725]_up_signed.bin:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
8464          0x2110          Flattened device tree, size: 1437644 bytes, version: 17
8692          0x21F4          LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 4105860 bytes
1426512       0x15C450        Flattened device tree, size: 17290 bytes, version: 17
1446108       0x1610DC        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 7245418 bytes, 684 inodes, blocksize: 262144 bytes, created: 2022-09-08 00:48:45

But EAP615 additionally contains "COBALT boot rom data (Flat boot rom or file system)", not sure what it is for.

10

The GPL code for this AP is available here:
https://static.tp-link.com/upload/gpl-code/2023/202306/20230626/mtk7629_eap245v4_eap225v5_common.tar.gz

As far as I see, the wifi chips of this devices are not (yet) supported by OpenWrt.

11

Hello,

thx for your work! I got accidentally the same device, also loaded the recommended kernel.
Interesting: eth1 is the Lan-Port, eth0 respective br-lan points to nirwana
could install luci for user friendly inspection

2023-07-10 18_03_10-OpenWrt - LuCI – Mozilla Firefox
2023-07-10 18_03_10-OpenWrt - LuCI – Mozilla Firefox968×813 84.1 KB

Didn´t have the nerve to install the system into flash. Now must I study the developer documentation for injection of wireless drivers. Any hints are welcome

12

Hello @Gotthard, would be great if this device will support OpenWrt. Is there meanwhile support in OpenWrt for MT7761N and MT7762N wireless? I didn't find any device with this chips in the ToH.
Regarding there network configuration, I assume that the DTS for the RFB doesn't match the EAP255 regarding ethernet, probably the simplest problem to solve.

13

Hi Rolando,
I have no expieriences in patching dts files nor in injecting drivers into buildroot. All I did in the last years is compiling kernels for bananapi. I will see, what I can do. I have the device, a running uart cable and a buildroot. That are the basics for hacking :slight_smile:

14

There are already pull requests for similar devices (same WiFi):

Maybe it's a good starting point, but they also mention that WiFi doesn't work. Seems also tricky to get the second core running.

15

I have copied dts file for netgear, altered the mk file and now I´m stuck in the compile process, something with BPF-tools. Couldn´t figure out, which options are necessary for this.
Meanwhile I found this for starting the wifi hacking.

16

Building from https://github.com/RolandoMagico/openwrt/tree/EAP225v5 worked for me, but just basic setup of the DTS. Initramfs can be booted and network communication is working.

17

How to get our repo working? Usual steps failing (git clone...)

Go

18

Do you get an error message? Usually this steps should work:

git clone https://github.com/RolandoMagico/openwrt.git -b EAP225v5
cd openwrt
./scripts/feeds/update -a
./scripts/feeds/install -a
make menuconfig
=> Select the correct target and and additional packages, if required
make
19

got it.
I tried "git clone https://github.com/RolandoMagico/openwrt" and missed the correct syntax below the green button in upper right corner.

Build is running atm w/o errors

20

Ok. Recommendation inbetween: If you start the initramfs, make a backup of all partitions (can easily be done with LuCI). It's currently the only way to get back to stock firmware in case flahsing OpenWrt to the flash fails. I just bricked my device some minutes ago. The dumped saved me.