Reply
New Member
Posts: 28
Registered: ‎12-24-2015
Kudos: 10

Open source OpenWRT firmware for mFi mPower series (Updates!)

[ Edited ]

Hello Everyone,

 

I am working hard on making OpenWRT support the mFi-Platform.

I started building upon the Ubiquiti AirGateway support for OpenWRT, because it uses the same Atheros 9330

 

So far, I got a successfull build of the latest OpenWRT Chaos Calmer, which is booting until a certain point on the Platform:

 

 

32 MB
Flash:  8 MB
Net:   eth0, eth1
Hit any key to stop autoboot:  0 
## Booting image at 9f050000 ...
   Image Name:   MIPS OpenWrt Linux-3.18.23
   Created:      2016-03-03  15:20:24 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1136063 Bytes =  1.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f050040 ...OK
   Uncompressing Kernel Image ... OK

Enable WDT
Starting kernel ...

[    0.000000] Linux version 3.18.23 (build@build-mips) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r48884) ) #3 Thu Mar 3 18:20:01 MSK 2016
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Atheros AR9330 rev 1
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x01ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x01ffffff]
[    0.000000] Initmem setup node 0 [mem 0x00000000-0x01ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line:  board=UBNT-AGW console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,7552k(firmware),256k(cfg)ro,64k(EEPROM)ro rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 28456K/32768K available (2477K kernel code, 126K rwdata, 528K rodata, 252K init, 188K bss, 4312K reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Clocks: CPU:387.500MHz, DDR:387.500MHz, AHB:193.750MHz, Ref:25.000MHz
[    0.000000] Calibrating delay loop... 258.04 BogoMIPS (lpj=1290240)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.070000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.080000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.090000] NET: Registered protocol family 16
[    0.090000] MIPS: machine is Ubiquiti AirGateway
[    0.550000] Switched to clocksource MIPS
[    0.550000] NET: Registered protocol family 2
[    0.560000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.560000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.560000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.570000] TCP: reno registered
[    0.570000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.580000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.590000] NET: Registered protocol family 1
[    0.590000] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.620000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.620000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.630000] msgmni has been set to 55
[    0.640000] io scheduler noop registered
[    0.640000] io scheduler deadline registered (default)
[    0.640000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.650000] ar933x-uart: ttyATH0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a AR933X UART
[    0.660000] m25p80 spi0.0: found mx25l6405d, expected m25p80
[    0.670000] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    0.670000] 5 cmdlinepart partitions found on MTD device spi0.0
[    0.680000] Creating 5 MTD partitions on "spi0.0":
[    0.680000] 0x000000000000-0x000000040000 : "u-boot"
[    0.690000] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.690000] 0x000000050000-0x0000007b0000 : "firmware"
[    0.710000] 2 uimage-fw partitions found on MTD device firmware
[    0.720000] 0x000000050000-0x0000001655ff : "kernel"
[    0.720000] 0x0000001655ff-0x0000007b0000 : "rootfs"
[    0.730000] mtd: device 4 (rootfs) set to be root filesystem
[    0.730000] 1 squashfs-split partitions found on MTD device rootfs
[    0.740000] 0x000000360000-0x0000007b0000 : "rootfs_data"
[    0.740000] 0x0000007b0000-0x0000007f0000 : "cfg"
[    0.750000] 0x0000007f0000-0x000000800000 : "EEPROM"
[    0.770000] libphy: ag71xx_mdio: probed
[    1.370000] ag71xx-mdio.1: Found an AR7240/AR9330 built-in switch
[    1.400000] eth0: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
? (here device reset gets triggered)

 

After 1.4 Seconds, though, no matter what custom firmware I use, the device will reboot itself.

 

It seems this is due to the Atheros 9330 Reboot Watchdog timer, which seems to be configured by the custom u-boot.

 

I found a documentation for ar93x1, which might be identical to the 9330 and set the corresponding registers to _not_ reboot after watchdog timeout:

 

6.6.3 Watchdog Timer Control Register (RST_WATCHDOG_TIMER_CONTROL)
Address: 0x18060008
Access: See field description
Reset: 0x0
Sets the action to take when the watchdog
timer reaches zero. The options are reset, nonmaskable
interrupt and general p

But unfortunately the device keeps on rebooting.

 

Can somebody supply more info so we can get this to work? I'd love to run some custom firmware on this!

 

 

New Member
Posts: 11
Registered: ‎06-30-2016
Kudos: 4

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

[ Edited ]

Hi,

 

I don't have a solution for you unfortunately, just some questions.

 

Which mFi device are you using with, and how are you getting the boot log from the device?

 

I've been trying to modify my mPower device (using the original uboot, only modifying the rootfs) but it's hard to see what's going on if it doesn't work. I'm not aware if there's a serial port that's easily accessible and tried getting netcat logging to work on the original uboot but failed so far.

 

 

Emerging Member
Posts: 53
Registered: ‎05-14-2014
Kudos: 16
Solutions: 5

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

[ Edited ]

I'm bumping this thread to let everyone know it is possible to get OpenWRT running on an mFi. I was able to flash it before I saw this post and ran into the same problem as OP with the reboot loop. I contacted OP directly and he told me what he did to fix it, unfortuanly, I don't have the knowhow to do it myself. I know how to connect serially and see the boot output, just have no idea how to implement this fix for it.

 


@syso wrote:

Yes, I did indeed! 

 

You need to write the Watchdog Register from the Atheros Chip at 0x18060008

 

Because you want physical memory access, you need to add KSEG1, so the adress becomes 

0xB8060008. You need to do something like following in the early init of the ARM (preferably init eeprom section, early hardware initialization).

 

(*(volatile uint32_t *)0xB8060008) = 0x00; // Disable WDT Reset Trigger

 

Let me know if you need any more help. If you're a developer yourself, we can join forces. My documentation got lost because I taken

my wiki down and forgot the backup. But I got OpenWRT running stable, but with some WiFi problems due to wrong PHY settings.

 

http://infocenter.arm.com/help/topic/com.arm.doc.dai0235c/AN235_migrating_from_mips_to_arm_files/ima...


 

 

With this ability, I'm thinking that someone or a group of people with the knowhow should be able to, somewhat easily I would think with the right skillset, develop a custom OpenWRT build that would allow us to improve the mFi and maybe even have it dump data to a USB stick. Another possibility is dump it to a server database. I know some people here have already gotten their own database solutions going. Combine that with firmware we have the source code for and I think we could make these things ok. Unfortunally, I haven't heard from syso again and it's been weeks so I'm posting this here.

 

New Member
Posts: 11
Registered: ‎06-30-2016
Kudos: 4

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

I'm not so sure about my skillset, but I'm stil interested in how to get serial boot output. Can you share how you did this, and on which type of mFi  device? 

Emerging Member
Posts: 53
Registered: ‎05-14-2014
Kudos: 16
Solutions: 5

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

[ Edited ]

I have the mPort. 

 

The pins are in the red square in the photo. The center two are Tx and Rx though I don't remember which is which; but that's easy enough to figure out. Buad rate is 115200, I believe. I think the pin hole in the square is voltage and the other end is ground. I used this FTDI cable: http://shop.clickandbuild.com/cnb/shop/ftdichip?productID=149&op=catalogue-product_info-null&prodCat...mport.jpg

 

New Member
Posts: 11
Registered: ‎06-30-2016
Kudos: 4

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

Thanks. My mPort has a slightly differen layout, there even is a header on the serial port. I now happily have serial boot log access.

 

FYI, I've been playing around with changing the standard filesystem by unpacking the standard firmware, unsquashing the rootfs, and resquashing and repacking again into a firmware update content package. All done using the fwsplit and ubnt-mkfwimage from the AirOS SDK (SDK.UBNT.v5.5.1).

Emerging Member
Posts: 53
Registered: ‎05-14-2014
Kudos: 16
Solutions: 5

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

That's awesome! I've heard of those tools but I have no idea what I'm doing with software dev so yeah, not even going to try. 

 

With that in mind, I'm happy to help anyway I can if you need it!

New Member
Posts: 39
Registered: ‎03-08-2015
Kudos: 22
Solutions: 1

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

Just keeping tabs on this thread.

Member
Posts: 151
Registered: ‎03-06-2013
Kudos: 56
Solutions: 1

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

[ Edited ]

Thank you for your diligent efforts with alternate mFi appliance firmware.

New Member
Posts: 11
Registered: ‎06-30-2016
Kudos: 4

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

Hi,

 

I'm not so sure about being diligent, but...

 

The openwrt image for the Air Gateway seems to work OK on the mPort S, without watchdog reboots. However the standard image has eth0 as LAN and eth1 as WAN port. As the mPort S ethernet port is eth1 you need to change the network config to disable eth0 and set eth1 as the LAN port, either via serial console access or by building your own image. E.g. change /etc/config/network to the one attached.

This will gove you a basic start to experiment with.

 

The same image doesn't seem to work on the mPower though.

New Member
Posts: 11
Registered: ‎06-30-2016
Kudos: 4

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

The network config file didn't attach, so here's the 'lan' section:

 

config interface 'lan'
           option ifname 'eth1'
           option force_link '1'
           option proto 'dhcp'
           option hostname 'mPort'

New Member
Posts: 11
Registered: ‎06-30-2016
Kudos: 4

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

Some more progress. The attached diff file (if attaching works this time) contains the changes against the current OpenWRT master trunk to support the mPort Serial and mPower. Or at least it works on mine... It includes the watchdog timer disabling as per the info above from syno and BobBelcher.

 

However both the mPort Serial and the mPower use custom hardware that is not supported by OpenWRT:

  • mPort Serial uses the ISL81334 RS-232/RS-485 transceiver for its external serial port. Documentation for this is freely available so in theory it could be supported if someone built a driver. This would also need some research into which SoC GPIO pin is connected to which pin on the ISL81334.  
  • mPower uses the PL7223 power switching/usage metering IC (6 of them) and the LV138A 3-line to 8-line demultiplexer. Documentation of the PL7223 is under NDA (though some details can be found on the internet), documentation for the LV138A is freely available. So supporting this is a bigger challenge.

Without support for the specific hardware the mPort and mPower are nice generic OpenWRT boxes but won't perform the functions that we actually bought them for. However I hope that this is a start for others to experiment as well. 

 

To use the diff file:

  1. Check out the current OpenWRT trunk as described in the OpenWRT wiki
  2. At the openwrt/ directory apply the patch: patch -p1 <openwrt-ubnt-mfi-diff.txt
  3. For the make menuconfig configuration select:
    • Target System (Atheros AR7xxx/AR9xxx)
    • Target Profile (Ubiquiti Products)
  4. make

This should build the images of the mport-s and mpower that you can upload as firmware update (openwrt-ar71xx-generic-ubnt-mport-serial-squashfs-factory.bin or openwrt-ar71xx-generic-ubnt-mpowerl-squashfs-factory.bin) and also the images that you can flash using the 'unbrick' method. I recommend you first test (using a standard mFi firmware for your device) if you can actually flash a standard firmware this way, my mPort Serial didn't respond to the button. If you have serial access to the uboot console then you can also interrupt the boot process and use the urescue command instead of keeping the button pressed during boot.

New Member
Posts: 28
Registered: ‎12-24-2015
Kudos: 10

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

Hey jj_0,

 

Thanks for putting my work back together.

Maybe we should work on this together. Sent you a PM with some interesting Info I think.

 

Cheers

New Member
Posts: 11
Registered: ‎06-30-2016
Kudos: 4

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

Hey syso,

 

Thanks. It was your watchdog tip and BobBelchers 'here's the serial port' hint that got me started, it's been a nice (and occasionally frustrating) OpenWRT learning curve to get to this point.

 

In case there are any smart low-level I/O programmers out there, I found the PL7223 datasheet and some sample code so maybe there is hope yet.

Emerging Member
Posts: 53
Registered: ‎05-14-2014
Kudos: 16
Solutions: 5

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

This is awesome. Now I just need to figure out how to get out of the boot loop and reflash these changes.

New Member
Posts: 11
Registered: ‎06-30-2016
Kudos: 4

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

Easiest way is to interrupt the boot (using the serial console). Then connect to wired ethernet and at the uboot prompt type urescue and press enter. You will see that the mPort is now listening for a new firmware on IP address 192.168.1.20.

On your PC/laptop set your IP address to e.g 192.168.1.2 and then use a tftp program to send the new firmware over to the mPort. The best thing to do is to use an original mPort firmware. When that works you know you have the process under control. When that works you can just use the Firmware upgrade page on the mPort for the next upgrade to your freshly-compiled OpenWRT. Smiley Happy

Highlighted
New Member
Posts: 28
Registered: ‎12-24-2015
Kudos: 10

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

[ Edited ]

Please note that firmware "de-bricking" on the non-ethernet models, which just have WiFi, will not be so easy.

You can load the firmware using Kermit via Serial Port - It takes 20 minutes, though and I wasn't able to build a "raw" flash image yet which can be just flashed onto the NAND.

 

Here's my Kermit config:

 

set line /dev/tty.usbserial-XXXXXX
set speed 115200
set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set file name lit
set rec pack 1000
set send pack 1000
set window 5
send firmware-nand.bin

 

I am happy to see that my work of implementing an open-source firmware for the mFi switches has been also considered by others and that actually someone has made my changes into a proper patch.

 

 

 

Regular Member
Posts: 610
Registered: ‎09-17-2013
Kudos: 144
Solutions: 5

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

Great to see this. My doubt is regarding the dsp chip. They must to have custom firmware for that, and you need a driver for the main unit to grab that info. Have you gotten to that stage, or still trying to get the openwrt to work the basic unit funtions?

New Member
Posts: 28
Registered: ‎12-24-2015
Kudos: 10

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

That is right. We are right now working on kernel drivers with some good progress!
New Member
Posts: 4
Registered: ‎03-08-2017

Re: Open OpenWRT-based Firmware for mFi-Switches (WiP)

Any progress updates on this?
A working OpenWRT would be epic!
Reply