My Koukaam NETIO4 is locked in a beeping loop of agony.
I was able to attach to the serial port of the MT7620. Obviously there is a problem with the MMC flash which damaged the Linux kernel.
Unfortunately the U-Boot bootloader is locked with a password. I was able to read out the SPI-NOR Flash and found the following:
password=00b4f2bb08a214ddbcdfe090a11df5155afd94b738e097bd8aea5bd8bbd4409c$ce2acc
Sadly I'm not able to decipher which hash algo is used and what the part after the dollar (ce2acc) stands for. If I were able to generate a new password hash I could inject a known password and then unlock the bootloader.
Flash u-boot_koukaam_netio4.bin to the SPI NOR flash. This should give you:
U-Boot 2024.01-rc2-00062-gda2e3196e4 (Dec 05 2023 - 20:59:34 +0100)
CPU: MediaTek MT7620A ver:2 eco:6
Boot: DDR2, SPI-NOR 3-Byte Addr
Clock: CPU: 580MHz, Bus: 193MHz, XTAL: 20MHz
Model: MediaTek MT7620 RFB (WS2120)
DRAM: 128 MiB
Core: 42 devices, 18 uclasses, devicetree: separate
MMC: mmc@10130000: 0
Loading Environment from SPIFlash... SF: Detected m25p40 with page size 256 Bytes, erase size 64 KiB, total 512 KiB
*** Warning - bad CRC, using default environment
In: uartlite@10000c00
Out: uartlite@10000c00
Err: uartlite@10000c00
Net:
Warning: eth@10100000 (eth0) using random MAC address - 46:02:e8:76:b6:d7
eth0: eth@10100000
=>
U-Boot is configured with a default IP: 192.168.8.210. From U-Boot you can boot the Linux Kernel over TFTP:
=> tftpboot 0x86400000 192.168.8.119:openwrt-ramips-mt7620-koukaam-initramfs-kernel.bin
Using eth@10100000 device
TFTP from server 192.168.8.119; our IP address is 192.168.8.210
Filename 'openwrt-ramips-mt7620-koukaam-initramfs-kernel.bin'.
Load address: 0x86400000
Loading: *^H#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
###########
4.7 MiB/s
done
Bytes transferred = 7786072 (76ce58 hex)
=> bootm 0x86400000
## Booting kernel from Legacy Image at 86400000 ...
Image Name: MIPS OpenWrt Linux-5.15.138
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 7786008 Bytes = 7.4 MiB
Load Address: 80000000
Entry Point: 80000000
Verifying Checksum ... OK
Working FDT set to 0
Uncompressing Kernel Image
[ 0.000000] Linux version 5.15.138 (robin@handy) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r24436-0f283ab4c9) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Tue Nov 21 06:36:08 2023
[ 0.000000] Board has DDR2
[ 0.000000] Analog PMU set to hw control
[ 0.000000] Digital PMU set to hw control
[ 0.000000] SoC Type: MediaTek MT7620A ver:2 eco:6
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[ 0.000000] MIPS: machine is Koukaam NETIO 4
[ eMMC debug output ]
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ eMMC debug output ]
[ 15.544995] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 16.019457] mtk_soc_eth 10100000.ethernet eth0: port 4 link down
[ 16.055048] procd: - early -
[ 16.061291] procd: - watchdog -
[ 16.415294] procd: - watchdog -
[ 16.423555] procd: - ubus -
[ 16.440684] random: ubusd: uninitialized urandom read (4 bytes read)
[ 16.464496] random: ubusd: uninitialized urandom read (4 bytes read)
[ 16.477981] random: ubusd: uninitialized urandom read (4 bytes read)
[ 16.495524] procd: - init -
Please press Enter to activate this console.
[ 17.368114] kmodloader: loading kernel modules from /etc/modules.d/*
[ 18.008127] Loading modules backported from Linux version v6.5-0-g2dde18cd1d8f
[ 18.022614] Backport generated by backports.git v5.15.92-1-56-g5fb2ccb6b9e8
[ 18.330797] PPP generic driver version 2.4.2
[ 18.358867] NET: Registered PF_PPPOX protocol family
[ 18.443118] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 6352, rev 0500 detected
[ 18.458693] ieee80211 phy0: rt2x00lib_read_eeprom_file: Info - Loading EEPROM data from 'soc_wmac.eeprom'.
[ 18.517769] rt2800_wmac 10180000.wmac: Direct firmware load for soc_wmac.eeprom failed with error -2
[ 18.536029] rt2800_wmac 10180000.wmac: Falling back to sysfs fallback for: soc_wmac.eeprom
[ 18.768874] ieee80211 phy0: rt2x00lib_read_eeprom_file: Error - Failed to request EEPROM.
[ 18.785266] ieee80211 phy0: rt2x00lib_probe_dev: Error - Failed to allocate device
[ 18.800401] rt2800_wmac: probe of 10180000.wmac failed with error -12
[ 18.898143] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 20.284854] random: jshn: uninitialized urandom read (4 bytes read)
[ 20.681256] random: jshn: uninitialized urandom read (4 bytes read)
[ 21.195346] random: jshn: uninitialized urandom read (4 bytes read)
[ 21.426235] random: jshn: uninitialized urandom read (4 bytes read)
[ eMMC debug output ]
root@OpenWrt:/#