===================================================================
MT7621 stage1 code Oct 28 2018 20:39:32 (ASIC)
CPU=500000000 HZ BUS=166666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL3 FB_DL: 0x0, 1/0 = 1024/0 01000000
PLL4 FB_DL: 0xd, 1/0 = 586/438 35000000
PLL2 FB_DL: 0xe, 1/0 = 534/490 39000000
do DDR setting..[01F40000]
Apply DDR3 Setting...(use customer AC)
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
--------------------------------------------------------------------------------
0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1
000E:| 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1
000F:| 0 0 0 0 1 1 1 1 1 1 1 1 1 1 0 0
0010:| 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0
0011:| 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
DRAMC_DQSCTL1[0e0]=13000000
DRAMC_DQSGCTL[124]=80000033
rank 0 coarse = 15
rank 0 fine = 72
B:| 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0
opt_dle value:10
DRAMC_DDR2CTL[07c]=C287222D
DRAMC_PADCTL4[0e4]=000022B3
DRAMC_DQIDLY1[210]=0E0D0A0B
DRAMC_DQIDLY2[214]=06090B0A
DRAMC_DQIDLY3[218]=0C090808
DRAMC_DQIDLY4[21c]=0B090B09
DRAMC_R0DELDLY[018]=00001F21
==================================================================
RX DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 9 6 10 11 7 8 7 6 7 8
10 | 9 10 8 11 9 10
--------------------------------------
==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =33 DQS1 = 31
==================================================================
bit DQS0 bit DQS1
0 (1~62)31 8 (2~59)30
1 (1~57)29 9 (1~62)31
2 (1~60)30 10 (1~62)31
3 (1~60)30 11 (1~58)29
4 (1~60)30 12 (1~59)30
5 (1~60)30 13 (1~61)31
6 (1~62)31 14 (1~62)31
7 (1~65)33 15 (1~60)30
==================================================================
3.dq delay value last
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 11 10 13 14 10 11 9 6 8 8
10 | 9 12 9 11 9 11
==================================================================
==================================================================
TX perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15, finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15, finish count=2
DQ loop=15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=15, finish count=1
dqs_perbyte_dly.last_dqdly_pass[1]=15, finish count=2
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
DRAMC_DQODLY1[200]=88888888
DRAMC_DQODLY2[204]=88888888
20,data:88
[EMI] DRAMC calibration passed
===================================================================
MT7621 stage1 code done
CPU=500000000 HZ BUS=166666666 HZ
===================================================================
U-Boot 1.1.3 (Apr 8 2019 - 13:34:42)
Board: Ralink APSoC DRAM: 128 MB
Power on memory test. Memory size= 128 MB...OK!
relocate_code Pointer at: 87fb0000
Config XHCI 40M PLL
RT2880_RSTSTAT_REG 0xc0030000
***************************
Board power on Occurred
***************************
flash manufacture id: c8, device id 40 18
find flash: GD25Q128C
============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: SPI Flash
Date:Apr 8 2019 Time:13:34:42
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 880 MHZ ####
estimate memory size =128 Mbytes
#Reset_MT7530
set LAN/WAN LLLLW
restore_defaults:0
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
n3: System Boot system code via Flash.
Booting System 1
Erasing SPI Flash...
raspi_erase: offs:30000 len:10000
.
Writing to SPI Flash...
.
done
## Booting image at bc180000 ...
Image Name: MIPS OpenWrt Linux-3.10.14
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1855708 Bytes = 1.8 MB
Load Address: 81001000
Entry Point: 813ecce0
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Erasing SPI Flash...
raspi_erase: offs:30000 len:10000
.
Writing to SPI Flash...
.
done
commandline uart_en=0 factory_mode=0 mem=128m root=/dev/mtdblock9
No initrd
## Transferring control to Linux (at address 813ecce0) ...
## Giving linux memsize in MB, 128
1 Like
Got my SPI programmer today and have got my R3Gv2 on Openwrt and working perfectly.
Let's hope the patches make their way into offical builds.
Thx
Could you please share me a programmer firmware with Openwrt? Thx in advance.
1 Like
These are what I've compiled and used.
From stock Xiaomi firmware send the initramfs-kernel.bin over TFTP and once it's rebooted and Openwrt's running, flash the sysupgrade.bin with LUCI or CLI.
https://drive.google.com/open?id=1VafI6QbULi5tM8siIFj0uucBRNhiAd-A
2 Likes
Thx a lot for your help 
1 Like
how to send nitramfs-kernel.bin over TFTP ?
You can stop the boot progress and access the boot menu?
please show me how to do?
1 Like
Hello,
I would also like to know the procedure.
And the necessary equipment. Is it essential to have a ch341a programmer?
Or possibility to inject attached .bin files directly from the interface?
Thank you.
Yes you need a ch341a programmer as no other way has been found to interrupt the boot process.
1 Like
Thx... i order one, and i must patient.
@Gingernut, which program did you use to flash your router?
I have successfully read the chip numerous times with flashrom (on debian linux), AsProgrammer 1.4.1 and CH341A Programmer (both on Windows), but cannot write anything into the chip.
I'm using a CH341A programmer with black PCB and a new clip (my old one is rather flaky). Is my programmer broken? O.o
EDIT: Forgot to mention, my SPI is detected as GD25Q128C, but the physical marking is GD25Q127C. A commit for flashrom on chromiumos project mentioned this and it's likely a rename?
EDIT2: Seems to be a defective programmer, different md5sum for each read. Waiting for a new one...
Sorry to hear that.
I used Tftpd32 server on windows.
I also tried to use tftpd32 and tftpd64, but face with "wrong checksum" when providing the image (holding reset while powering the router).
I mean the app to dump the content of and write to the SPI flash...
I just followed Rogerpueyo's instructions on his Xiaomi Router 4A gigabit thread.
I did it all from Windows and used a USB 3 port to power the CH341A programmer, which to my superise, didn't need any additional power.
1 Like
Well Done, I have the same router and wasn't able to get uboot to pause for 5 seconds even with replacing off with " 5". Would have be willing to copy an spi dump of your flash?
I wrote to mine by setting chip type as
flashrom --programmer ch341a_spi -w image.bin -V -c GD25B128B/GD25Q128B
My new programmer arrived today, and I have successfully flashed it under a debian VM with flashrom.
I used this: flashrom --programmer ch341a_spi --read r3gv2.bin -c "GD25Q128C" to read, and flashrom --programmer ch341a_spi --write r3gv2-edited.bin -c "GD25Q128C" to write.
Using CH341A Programmer and AsProgrammer in Windows still produce different md5 for each readings, whereas flashrom produce the same md5...
2 Likes