Meross MSS310

Serial Interface

The board exposes a serial interface. Parameters are 57800,8N1. The board draws about 250mA and I even had to increase the current limit of my power supply to 500mA before it booted. Which means you need a separate power supply as most cheap USB serial adapters are only capable of delivering 100mA.

The output during boot shows, that it’s actually booting u-boot:

[04060C0D][04060B0F]
DDR Calibration DQS reg = 00007E89


U-Boot 1.1.3 (Jan 24 2018 - 12:18:18)

Board: Ralink APSoC DRAM:   8 MB
relocate_code Pointer at: 807b8000
flash manufacture id: c2, device id 20 15
find flash: MX25L1605D
============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 64 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 8 MBytes
Flash component: SPI Flash
Date:Jan 24 2018  Time:12:18:18
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =8 Mbytes
RESET MT7628 PHY!!!!!!
Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
default: 3

You choosed 3

3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   zxrouter
   Image Type:   MIPS Linux Standalone Program (uncompressed)
   Data Size:    742084 Bytes = 724.7 kB
   Load Address: 80500000
   Entry Point:  80500000
   Verifying Checksum ... OK
OK

The board then drops into command line mode. Hitting ‘4’ during the boot process takes us to the u-boot prompt:

You choosed 4

4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Jan 24 2018 - 12:18:18)
MT7628 # help
?       - alias for 'help'
bootm   - boot application image from memory
cp      - memory copy
erase   - erase SPI FLASH memory
go      - start application at address 'addr'
help    - print online help
loadb   - load binary file over serial line (kermit mode)
md      - memory display
mdio   - Ralink PHY register R/W command !!
mm      - memory modify (auto-incrementing)
nm      - memory modify (constant address)
printenv- print environment variables
reset   - Perform RESET of the CPU
rf      - read/write rf register
saveenv - save environment variables to persistent storage
setenv  - set environment variables
spi  - spi command
tftpboot- boot image via network using TFTP protocol
version - print monitor version
MT7628 # print
bootcmd=tftp
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
ipaddr=10.10.10.123
serverip=10.10.10.3
BootType=3
bootdelay=1
stdin=serial
stdout=serial
stderr=serial

Now, tftpboot would be fine, but of course we have no network connection here. However, the ‘loadb’ command looks promising.