aboutsummaryrefslogtreecommitdiff
path: root/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
Commit message (Collapse)AuthorAge
* ramips: add support for Z-ROUTER ZR-2660Mikhail Zhilkin2024-03-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds support for Z-ROUTER ZR-2660 (also known as Routerich AX1800) wireless WiFi 6 router. Specification ------------- - SoC : MediaTek MT7621AT, MIPS, 880 MHz - RAM : 256 MiB - Flash : NAND 128 MiB (AMD/Spansion S34ML01G2) - WLAN : - 2.4 GHz : MediaTek MT7905D/MT7975 (14c3:7916), b/g/n/ax, MIMO 2x2 - 5 GHz : MediaTek MT7915E (14c3:7915), a/n/ac/ax, MIMO 2x2 - Ethernet : 10/100/1000 Mbps x4 (1x WAN, 3x LAN) - USB : 1x 2.0 - UART : 3.3V, 115200n8, pins are silkscreened on the pcb - Buttons : 1x Reset - LEDs : 1x WiFi 2.4 GHz (green) 1x WiFi 5 GHz (green) 1x LAN (green) 1x WAN (green) 1x WAN no-internet (red) - Power : 12 VDC, 1 A Installation ------------ 1. Run tftp server on your PC (IP: 192.168.2.2) and put OpenWrt initramfs image (initramfs.bin) to the tftp root dir 2. Open the following link in the browser to enable telnet: http://192.168.2.1/cgi-bin/telnet_ssh 3. Connect to the router (default IP: 192.168.2.1) using telnet shell (credentials - user:admin) 4. Run the following commands in the telnet shell (this will install OpenWrt initramfs image on nand flash): cd /tmp tftp -g -r initramfs.bin 192.168.2.2 mtd write initramfs.bin firmware mtd erase firmware_backup reboot 5. Copy OpenWrt sysupgrade image (sysupgrade.bin) to the /tmp dir of the router 6. Connect to the router (IP: 192.168.1.1) using ssh shell and run sysupgrade command: sysupgrade -n /tmp/sysupgrade.bin Return to stock --------------- 1. Copy stock firmware (stock.bin) to the /tmp dir of the router using scp 2. Run following command in the router shell: cd /tmp mtd write stock.bin firmware reboot Recovery -------- Connect uart (pins are silkscreened on the pcb), interrupt boot process by pressing any key, use u-boot menu to flash stock firmware image or OpenWrt initramfs image. MAC addresses ------------- +---------+-------------------+-----------+ | | MAC | Algorithm | +---------+-------------------+-----------+ | LAN | 24:0f:5e:xx:xx:4c | label | | WAN | 24:0f:5e:xx:xx:4d | label+1 | | WLAN 2g | 24:0f:5e:xx:xx:4e | label+2 | | WLAN 5g | 24:0f:5e:xx:xx:4f | label+3 | +---------+-------------------+-----------+ The WLAN 2.4 MAC was found in 'factory', 0x4 The LAN MAC was found in 'factory', 0xfff4 The WAN MAC was found in 'factory', 0xfffa Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
* ramips: rename mtd partition of ipTIME NAND devicesSungbo Eo2024-03-10
| | | | | | | | | | | | Contrary to common ipTIME NOR devices, the "Config" partition of T5004 and AX2004M contain normal U-Boot environment variables. Renaming the partition into "u-boot-env" serves for better description, and it also conforms to common naming practice in OpenWrt. This patch might also be extended to A3004T, but its u-boot-env partition layout has not been confirmed yet. Signed-off-by: Sungbo Eo <mans0n@gorani.run>
* ramips: add support for D-Link COVR-X1860 A1Roland Reinl2023-11-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The COVR-X1860 are MT7621-based AX1800 devices (similar to DAP-X1860, but with two Ethernet ports and external power supply) that are sold in sets of two (COVR-X1862) and three (COVR-X1863). Specification: - MT7621 - MT7915 + MT7975 2x2 802.11ax (DBDC) - 256MB RAM - 128 MB flash - 3 LEDs (red, orange, white), routed to one indicator in the top of the device - 2 buttons (WPS in the back and Reset at the bottom of the device) MAC addresses: - LAN MAC (printed on the device) is stored in config2 partition as ASCII (entry factory_mac=xx:xx:xx:xx:xx:xx) - WAN MAC: LAN MAC + 3 - 2.4G MAC: LAN MAC + 1 - 5G MAC: LAN MAC + 2 The pins for the serial console are already labeled on the board (VCC, TX, RX, GND). Serial settings: 3.3V, 115200,8n1 Flashing via OEM Web Interface: - Download openwrt-ramips-mt7621-dlink_covr-x1860-a1-squashfs-factory.bin via the OEM web interface firmware update - The configuration wizard can be skipped by directly going to http://192.168.0.1/UpdateFirmware_Simple.html Flashing via Recovery Web Interface: - Set your IP address to 192.168.0.10, subnetmask 255.255.255.0 - Press the reset button while powering on the deivce - Keep the reset button pressed until the status LED blinks red - Open a Chromium based browser and goto http://192.168.0.1 - Download openwrt-ramips-mt7621-dlink_covr-x1860-a1-squashfs-recovery.bin Revert back to stock using the Recovery Web Interface: - Set your IP address to 192.168.0.10, subnetmask 255.255.255.25 - Press the reset button while powering on the deivce - Keep the reset button pressed until the status LED blinks red - Open a Chromium based browser and goto http://192.168.0.1 - Flash a decrypted firmware image from D-Link. Decrypting an firmware image is described below. Decrypting a D-Link firmware image: - Download https://github.com/openwrt/firmware-utils/blob/master/src/dlink-sge-image.c and https://raw.githubusercontent.com/openwrt/firmware-utils/master/src/dlink-sge-image.h - Compile a binary from the downloaded file, e.g. gcc dlink-sge-image.c -lcrypto -o dlink-sge-image - Run ./dlink-sge-image COVR-X1860 <OriginalFirmware> <OutputFile> -d - Example for firmware 102b01: ./dlink-sge-image COVR-X1860 COVR-X1860_RevA_Firmware_102b01.bin COVR-X1860_RevA_Firmware_102b01_Decrypted.bin -d The pull request is based on the discussion in https://forum.openwrt.org/t/add-support-for-d-link-covr-x1860 Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net> Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
* ramips: add support for MeiG SLT866 4G CPEDaniel Golle2023-11-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware: - SoC: Mediatek MT7621 (MT7621AT) - Flash: 32 MiB SPI-NOR (Macronix MX25L25635E) - RAM: 128 MiB - Ethernet: Built-in, 2 x 1GbE - 3G/4G Modem: MEIG SLM828 (currently only supported with ModemManager) - SLIC: Si32185 (unsupported) - Power: 12V via barrel connector - Wifi 2.4GHz: Mediatek MT7603BE 802.11b/g/b - Wifi 5GHz: Mediatek MT7613BE 802.11ac/n/a - LEDs: 8x (7 controllable) - Buttons: 2x (RESET, WPS) Installing OpenWrt: - sysupgrade image is compatible with vendor firmware. Recovery: - Connect to any of the Ethernet ports, configure local IP: 10.10.10.3/24 (or 192.168.10.19/24, depending on OEM) - Provide firmware file named 'mt7621.img' on TFTP server. - Hold down both, RESET and WPS, then power on the board. - Watch network traffic using tcpdump or wireshark in realtime to observe progress of device requesting firmware. Once download has completed, release both buttons and wait until firmware comes up. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ramips: add support for ZyXEL LTE5398-M904Milan Krstic2023-10-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ZyXEL LTE5398-M904 is a dual band 802.11ac indoor LTE/3G CPE with an FXS port. Specifications: * SoC: Mediatek MT7621AT * RAM: 256 MB * Flash: 128MB NAND (MX30LF1G18AC) * WiFi: MediaTek MT7603 2.4G + MediaTek MT7615 5G * Switch: 2 GbE ports MT7530 * LTE/3G: Quectel EG18-EA LTE-A Cat. 18 * SIM: 1 micro-SIM card slot * Buttons: Reset, WPS * LEDs: power (G/B), internet (G), LTE (R/G/Orange), WiFi (G), voice (G) * VoIP: 1 FXS RJ11 port * Power: 12V, 2A UART serial console: 57600,8N1 Unpopulated header J5: [o] GND [ ] key - no pin [o] RX [o] TX [o] 3.3V Vcc Installation: * Log in as root using ssh to 192.168.1.1 * scp OpenWrt initramfs-recovery.bin image to root@192.168.1.1:/tmp/ * Prepare bootloader config by running: nvram setro uboot DebugFlag 0x1 nvram setro uboot CheckBypass 0 nvram commit * Run "mtd_write -w write /tmp/initramfs-recovery.bin Kernel" and reboot * Wait for OpenWrt to boot and ssh to root@192.168.1.1 * Run sysupgrade with OpenWrt squashfs-sysupgrade.bin image For mode details about flashing see: 2449a63208 (ramips: mt7621: Add support for ZyXEL NR7101, 2021-04-19) Unsupported: * FXS/Voice Signed-off-by: Milan Krstic <milan.krstic@gmail.com>
* ramips: fix ZyXEL NR7101 bricking typoBjørn Mork2023-10-15
| | | | | | | | | | A typo snuck in with the addition of Cudy M1800, changing "nr7101" to "nt7101". The result is a default network config for NR7101 without the only ethernet interface on the NR7101, thereby soft bricking it. Fixes: f6d394e9f2fd ("ramips: add support for Cudy M1800") Signed-off-by: Bjørn Mork <bjorn@mork.no>
* ramips: cf-ew72-v2: Add support for COMFAST CF-EW72 V2Alexey D. Filimonov2023-09-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for COMFAST CF-EW72 V2 Hardware: - SoC: Mediatek MT7621 (MT7621DAT or MT7621AT) - Flash: 16 MiB NOR - RAM: 128 MiB - Ethernet: Built-in, 2 x 1GbE - Power: only 802.3af PD on any port, injector supplied in the box - PoE passthrough: No - Wifi 2.4GHz: Mediatek MT7603BE 802.11b/g/b - Wifi 5GHz: Mediatek MT7613BEN 802.11ac/n/a - LEDs: 8x (only 1 is both visible and controllable, see below) - Buttons: 1x (RESET) Installing OpenWrt: Flashing is done using Mediatek U-Boot System Recovery Mode - make wired connection with 2 cables like this: - - PC (LAN) <-> PoE Injector (LAN) - - PoE Injector (POE) <-> CF-EW72 V2 (LAN). Leave unconnected to CF-EW72 V2 yet. - configure 192.168.1.(2-254)/24 static ip address on your PC LAN - press and keep pressed RESET button on device - power the device by plugging PoE Injector (POE) <-> CF-EW72 V2 (LAN) cable - wait for about 10 seconds until wifi led stops blinking and release RESET button - navigate from your PC to http://192.168.1.1 and upload OpenWrt *-factory.bin firmware file - proceed until router starts blinking with wifi led again (flashing) and stops (rebooting to OpenWrt) MAC addresses as verified by OEM firmware: vendor OpenWrt address LAN lan\eth0 label WAN wan label + 1 2g phy0 label + 2 5g phy1 label + 3 The label MAC address was found in 0xe000. LEDs detailed: The only both visible and controllable indicator is blue:wlan LED. It is not bound by default to indicate activity of any wireless interfaces. Place (WAN->ANT) | Num | GPIO | LED name (LuCI) | Note -----------------|-----|----------------------------------------------------------------------------------------- power | 1 | | | POWER LED. Not controlled with GPIO. hidden_led_2 | 2 | 13 | blue:hidden_led_2 | This LED does not have proper hole in shell. wan | 3 | | | WAN LED. Not controlled with GPIO. hidden_led_4 | 4 | 16 | blue:hidden_led_4 | This LED does not have proper hole in shell. lan | 5 | | | LAN LED. Not controlled with GPIO. noconn_led_6 | 6 | | | Not controlled with GPIO, possibly not connected wlan | 7 | 15 | blue:wlan | WLAN LED. Wireless indicator. noconn_led_8 | 8 | | | Not controlled with GPIO, possibly not connected mt76-phy0 and mt76-phy1 leds also exist in OpenWrt, but do not exist on board. Signed-off-by: Alexey D. Filimonov <alexey@filimonic.net>
* ramips: fix Mercusys MR70X LAN port assignmentsAndreas Böhler2023-09-24
| | | | | | | | | A bug report in the forum found that the MR70X lists four LAN ports in LuCI while it has only three. This adds the device to the network setup file to fix the issue. Identified-by: Forum User "Lexeyko" Signed-off-by: Andreas Böhler <dev@aboehler.at>
* ramips: add support for WAVLINK WL-WN573HX1Sijia Huang2023-09-24
| | | | | | | | | | | | | | | | | | | | Hardware -------- Specifications: - Device: WAVLINK WL-WN573HX1 Outdoor AP - SoC: MT7621AT - Flash: 16MB - RAM: 256MB - Switch:1 LAN (10/100/1000 Mbps) - WiFi: MT7905 2x2 2.4G + MT7975 2x2 5G - LEDs: 1x STATUS (blue, configurable) 1x LAN (green) Product link: https://www.wavlink.com/en_us/product/WL-WN573HX1.html Signed-off-by: Sijia Huang <engineer31@win-star.com>
* ramips: add support for ALFA Network AX1800RMPiotr Dymacz2023-09-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ALFA Network AX1800RM (FCC ID: 2AB877621) is a dual-band Wi-Fi 6 (AX1800) router, based on MediaTek MT7621A + MT79x5D platform. Specifications: - SOC: MT7621A (880 MHz) - DRAM: DDR3 256 MiB (Nanya NT5CC128M16JR-EK) - Flash: 16 MiB SPI NOR (EN25QH128A-104HIP) - Ethernet: 4x 10/100/1000 Mbps (SOC's built-in switch) - Wi-Fi: 2x2:2 2.4/5 GHz (MT7905DAN + MT7975DN) (MT7905DAN doesn't support background DFS scan/BT) - LED: 6x green, 1x green/red - Buttons: 2x (reset, WPS) - Antenna: 4x external, non-detachable omnidirectional - UART: 1x 4-pin (2.54 mm pitch, J4, not populated) - Power: 12 V DC/1 A (DC jack) MAC addresses: LAN: 00:c0:ca:xx:xx:4e (factory 0x4, +2) WAN: 00:c0:ca:xx:xx:4f (factory 0x4, +3) 2.4 GHz: 00:c0:ca:xx:xx:4c (factory 0x4, device's label) 5 GHz: 00:c0:ca:xx:xx:4c (factory 0xa) Flash instructions for web-based U-Boot recovery: 1. Power the device with WPS button pressed and wait around 10 seconds. 2. Setup static IP 192.168.1.2/24 on your PC. 3. Go to 192.168.1.1 in browser and upload 'recovery' image. The device runs LEDE 17.01 (kernel 4.4.x) based firmware with 'failsafe' mode available which allows alternative upgrade method: 1. Run device in 'failsafe' mode and change password for default user. 2. SSH to the device, transfer 'sysupgrade' image and perform upgrade in forced mode, without preserving settings: 'sysupgrade -n -F ...'. Other notes: If you own early version of this device, the vendor firmware might refuse OpenWrt image because of missing custom header. In that case, ask vendor's customer support for stock firmware without custom header support/requirement. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* ramips: add support for D-Link DRA-1360Rani Hod2023-08-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The DRA-1360 rev A is a wall-plug AC1300 repeater. Hardware is identical (same FCC ID, black case instead of white) to D-Link DAP-1620 rev B, which is already supported, but a different model name, revision, and hardware ID are needed. Thus, the bulk of the DAP-1620 device tree is extracted to a common dtsi included by the two models' device trees. Repeating specs and installation instructions from e4c7703: (note that the RAM size mentioned there was incorrect, oops) Specs: - SoC: MT7621AT (880MHz dual-core MIPS1004Kc) - Memory: 128 MiB RAM, 16 MiB NOR SPI - WiFi: MT7615DN 2x2 802.11n + 2x2 802.11ac (DBDC) - Ethernet: 1 RJ45 port 10/100/1000 - Power/status LED: red+green - LED RSSI bargraph: 2x green, 1x red+green Installation: - Keep reset button pressed during plug-in - Web Recovery Updater is at 192.168.0.50 (pings are ignored, it listens only for http) - Upload factory.bin, confirm flashing (seems to work best with Chromium-based browsers) Revert to OEM firmware: - tail -c+117 DRA1360A1_FW112B03.bin | \ openssl aes-256-cbc -d -md md5 -out decrypted.bin \ -k c471706398cb147c6619f8a04a18d53e9c17ede8 - flash decrypted.bin via D-Link Web Recovery Signed-off-by: Rani Hod <rani.hod@gmail.com>
* ramips: add support for I-O DATA WN-DEAX1800GRINAGAKI Hiroshi2023-08-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I-O DATA WN-DEAX1800GR is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on MT7621A. Specification: - SoC : MediaTek MT7621A - RAM : DDR3 256 MiB (Nanya NT5CC128M16JR-EK) - Flash : RAW NAND 128 MiB (Winbond W29N01HVSINF) - WLAN : 2.4/5 GHz (MediaTek MT7915) - Ethernet : 5x 10/100/1000 Mbps - Switch : MT7530 (SoC) - LEDs/Keys : 6x/3x - UART : through-hole on PCB (J2) - assignment: 3.3V, GND, TX, RX from "1" marking - settings : 115200n8 - Power : 12 VDC, 1 A Flash instruction using initramfs-factory image: 1. Boot WN-DEAX1800GR normally 2. Access to "http://192.168.0.1/" and open firmware update page ("ファームウェア") 3. Select the OpenWrt initramfs-factory.bin image and click update ("更新") button to perform firmware update 4. On the initramfs image, perform sysupgrade with the squashfs-sysupgrade.bin image 5. Wait ~120 seconds to complete flashing Note: - This device has 2x OS images on the flash storage. In this support, the first one will be used. Warning: - Do not use "saveenv" command on U-Boot CLI. This device has wrong u-boot-env data. The actual length of individual env data installed to the device is 0x1000 (4 KiB), but installed U-Boot requires 0x20000 (128 KiB). So U-Boot determines the data is invalid. Then, if you perform saving environment data with saveenv on U-Boot CLI, installed env data will be overwritten with too few default values without individual values (SSID, password, MAC addresses, etc...). MAC addresses: LAN : 50:41:B9:xx:xx:F4 (Config, ethaddr (text)) WAN : 50:41:B9:xx:xx:F6 (Config, wanaddr (text)) 2.4 GHz: 50:41:B9:xx:xx:F4 (Config, rmac (text) / Factory, 0x4 (hex)) 5 GHz : 50:41:B9:xx:xx:F5 (none) Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
* ramips: add wan2 support for MQmaker WiTiArınç ÜNAL2023-07-12
| | | | | | | | | | | | | The PHY of the wan2 port on MQmaker WiTi is wired to the second MAC of the SoC. Rename the wan interface to wan1 and define it under the switch node, effectively disabling the PHY muxing of the MT7530 switch's phy4. Define the PHY of the wan2 port and adjust the gmac1 node accordingly. Now that the PHY muxing feature is not being used anymore, the wan2 port can be used to achieve 2 Gbps total bandwidth to the CPU. Tested-by: Demetris Ierokipides <ierokipides.dem@gmail.com> Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
* ramips: mt7621: add TP-Link EAP613 v1Sander Vanheule2023-07-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The TP-Link EAP613 v1 is a ceiling-mount 802.11ax access point. It can be powered via PoE or a DC barrel connector (12V). Connecting to the UART requires fine soldering and careful manipulation of any soldered wires. Device details: * SoC: MT7621AT * Flash: 16 MiB SPI NOR * RAM: 256 MiB DDR3L * Wi-Fi: * MT7905DA + MT7975D: 2.4 GHz + 5 GHz (DBDC), 2x2:2 * Two stamped metal antennas (ANT1, ANT2) * One PCB antenna (ANT3) * One unpopulated antenna (ANT4) * Ethernet: * 1× 10/100/1000 Mbps port with PoE * LEDs: * Array of four blue LEDs with one control line * Buttons: * Reset * Board test points: * UART: next to CPU RF-shield and power circuits * JTAG: under CPU RF-shield (untested) * Watchdog: 3PEAK TPV706 (not implemented) Althought three antennas are populated, the MT7905DA does not support the additional Rx chain for background DFS detection (or Bluetooth) according to commit 6cbcc34f50a3 ("ramips: disable unsupported background radar detection"). MAC addresses: * LAN: 48:22:54:xx:xx:a2 (device label) * WLAN 2.4 GHz: 48:22:54:xx:xx:a2 * WLAN 5 GHz: 48:22:54:xx:xx:a3 The radio calibration blob stored in flash also contains valid MAC addresses for both radio bands (OUI 00:0c:43). Factory install: 1. Enable SSH on the device via web interface 2. Log in with SSH, and run `cliclientd stopcs` 3. Upload -factory.bin image via web interface. It may be necessary to shorten the filename of the image to e.g. 'factory.bin'. Recovery: 1. Open the device by unscrewing four screws from the backside 2. Carefully remove board from the housing 3. Connect to UART (3.3V): * Find test points labelled "VCC", "GND", "UART_TX", "UART_RX" * Solder wires to test points or connect otherwise. Be careful not to damage the PCB e.g. by pulling on soldered wires. * Open console with 115200n8 settings 4. Interrupt bootloader and use tftpboot to start an initramfs: setenv ipaddr $DEVICE_IP setenv serverip $SERVER_IP tftpboot 84000000 openwrt-initramfs-kernel.bin bootm DO NOT use saveenv to store modified u-boot environment variables. The environment is saved at flash offset 0x30000, which erases part of the (secondary) bootloader. The device uses two bootloader stages. The first stage will load the second stage from a uImage stored at flash offset 0x10000. In case of a damaged second stage, the first stage should allow uploading a new image via y-modem (untested). Signed-off-by: Sander Vanheule <sander@svanheule.net>
* ramips: Add support for ComFast CF-E390AXUsama Nassir2023-07-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for ComFast CF-E390AX. It is a 802.11 wifi6 cieling AP, based on MediaTek MT7261AT. Specifications: SoC: MediaTek MT7621AT RAM: 128 MiB Flash: 16 MiB NOR (Macronix mx25l12805d) Wireless: MT7915E (2.4G) 802.11ax/b/g/n MT7915E (5G) 802.11ac/ax/n Ethernet: 2 x 1Gbs Button: 1 x "Reset" button LED: 1x Blue LED + 1x Red LED + 1x green LED Power: PoE Manufacturer Page: http://en.comfast.com.cn/index.php?m=content&c=index&a=show&catid=84&id=75 Flash Layout: 0x000000000000-0x000000030000 : "bootloader" 0x000000030000-0x000000040000 : "config" 0x000000050000-0x000000060000 : "factory" 0x000000090000-0x000001000000 : "firmware" First install: 1. Set device into http firmware fail safe upload mode by pressing the reset button for 10 seconds while powering it on. Once the LED stops flashing, safe mode will be running. 2. Set PC IP address to 192.168.1.2 3. Browse to 192.168.1.1 and upload the factory image using the web interface. Signed-off-by: Usama Nassir <usama.nassir@gmail.com>
* ramips: add support for Netgear EAX12 seriesWenli Looi2023-07-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Netgear EAX12, EAX11v2, EAX15v2 are wall-plug 802.11ax (Wi-Fi 6) extenders that share the SoC, WiFi chip, and image format with the WAX202. Specifications: * MT7621, 256 MiB RAM, 128 MiB NAND * MT7915: 2.4/5 GHz 2x2 802.11ax (DBDC) * Ethernet: 1 port 10/100/1000 * UART: 115200 baud (labeled on board) All LEDs and buttons appear to work without state_default. Installation: * Flash the factory image through the stock web interface, or TFTP to the bootloader. NMRP can be used to TFTP without opening the case. Revert to stock firmware: * Flash the stock firmware to the bootloader using TFTP/NMRP. References in GPL source: https://www.downloads.netgear.com/files/GPL/EAX12_EAX11v2_EAX15v2_GPL_V1.0.3.34_src.tar.gz * target/linux/ramips/dts/mt7621-rfb-ax-nand.dts DTS file for this device. Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
* ramips: fix first boot network configuration for TOZED ZLT S12 PROArınç ÜNAL2023-06-09
| | | | | | | | | | | The network configuration at first boot for TOZED ZLT S12 PRO lacks setting up the LAN and WAN network interfaces. Address this. The WAN port is advertised as WAN/LAN on the device and is put on LAN on stock firmware so put it on LAN here as well. Fixes: ce1f9fa625 ("ramips: add support for TOZED ZLT S12 PRO") Reported-by: Andre Cruz <me@1conan.com> Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
* ramips: add support for TOZED ZLT S12 PROArınç ÜNAL2023-05-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The TOZED ZLT S12 PRO is an AC1200 router featuring 4 Ethernet ports with a TOZED TL70-C cellular modem which supports the NCM mode. The stock firmware does SIM locking on the modem by stopping dialing when a different PLMN is detected. This is not the case on OpenWrt. Specifications: - CPU: MediaTek MT7621AT - RAM: 256MB DDR3 - NOR Flash: MX25L12833FM2I 16MB SPI Flash - Wi-Fi 2.4Ghz: MT7603E - Wi-Fi 5Ghz: MT7612E - Switch: MT7530 4x 1Gbit Ports - WWAN: Unisoc SL8563 based TOZED TL70-C LTE CAT6 cellular modem - USB: 1x optional USB2.0 external port - Switches/Buttons: WPS, Reset, Power Switch - LEDs: Power, Wi-Fi, Data, Signal 1-5, Phone Installation and TFTP Recovery: - Connect to serial console. - Boot initramfs image by choosing option 1 when U-Boot prompts. - Install sysupgrade image via OpenWrt. Serial Pins: Located at the bottom right when looking from the front, right under the Reset/WPS buttons. The pinout from the left is: - RX - GND - TX Baudrate is 115200. When connecting from a powered off state, disconnect RX as it blocks the boot process. Link: http://www.sztozed.com/en/contents/58/84.html Co-developed-by: Andre Cruz <me@1conan.com> Signed-off-by: Andre Cruz <me@1conan.com> Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
* ramips: add support for Linksys RE7000Christoph Krapp2023-05-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware specification: - SoC: MediaTek MT7621AT (880 MHz) - Flash: 16 MB (Macronix MX25L12835FM2I-10G) - RAM: 128 MB (Nanya NT5CC64M16GP-DI) - WLAN 2.4 GHz: 2x2 MediaTek MT7603EN - WLAN 5 GHz: 2x2 MediaTek MT7615N - Ethernet: 1x 10/100/1000 Mbps - LED: Power, Wifi, WPS - Button: Reset, WPS - UART: 1:VCC, 2:GND, 3:TX, 4:RX (from LAN port) Serial console @ 57600,8n1 Flash instructions: Connect to serial console and start up the device. As the bootloader got locked you need to type in a password to unlock U-Boot access. When you see the following output on the console: relocate_code Pointer at: 87f1c000 type in the super secure password: 1234567890 Then select TFTP boot from RAM by selecting option 1 in the boot menu. As Linksys decided to leave out a basic TFTP configuration you need to set server- & client ip as well as the image filename the device will search for. You need to use the initramfs openwrt image for the TFTP boot process. Once openwrt has booted up, upload the sysupgrade image via scp and run sysupgrade as normal. Signed-off-by: Christoph Krapp <achterin@gmail.com>
* ramips: TP-Link EC330-G5u v1: switch to mac-address-asciiMikhail Zhilkin2023-04-29
| | | | | | | | | | | | | The TP-Link EC330-G5u v1 router has MAC address that stored in factory mtd in ascii format. This commit makes the router use of "mac-address-ascii" in dts. After the change: 1. All MAC addresses are explicitly assigned in dts (the workarounds in network scripts are no longer needed); 2. gmac0 (eth0) MAC address is no longer random. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
* ramips: add support for D-Link DAP-1620 B1Rani Hod2023-04-29
| | | | | | | | | | | | | | | | | | | | | | | | | The DAP-1620 rev B is a wall-plug AC1300 repeater. Specifications: - MT7621AT, 256 MiB RAM, 16 MiB SPI NOR - MT7615DN 2x2 802.11n +2x2 802.11ac (DBDC) - Ethernet: 1 port 10/100/1000 - Status LEDs (1x red+green) - LED RSSI bargraph (2x green, 1x red+green) Installation: - Keep reset button pressed during plug-in - Web Recovery Updater is at 192.168.0.50 - Upload factory.bin, confirm flashing (seems to work best with Chromium-based browsers) Revert to OEM firmware: - tail -c+117 DAP1620B1_FW212B03.bin | \ openssl aes-256-cbc -d -md md5 -out decrypted.bin \ -k 905503a4e0c3cd3c1ce062246de427a68962347e - flash decrypted.bin via D-Link Web Recovery Signed-off-by: Rani Hod <rani.hod@gmail.com>
* ramips: mt7621: add support for ZyXEL WSM20Andreas Böhler2023-04-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ZyXEL WSM20 aka Multy M1 is a cheap mesh router system by ZyXEL based on the MT7621 CPU. Specifications ============== SoC: MediaTek MT7621AT (880MHz) RAM: 256MiB Flash: 128MiB NAND Wireless: 802.11ax (2x2 MT7915E DBDC) Ethernet: 4x 10/100/1000 (MT7530) Button: 1x WPS, 1x Reset, 1x LED On/Off LED: 7 LEDs (3x white, 2x red, 2x green) MAC address assignment ====================== The MAC address assignment follows stock: The label MAC address is the LAN MAC address, the WAN address is read from flash. The WiFi MAC addresses are set in userspace to label MAC + 1 and label MAC + 2. Installation (web interface) ============================ The device is cloud-managed, but there is a hidden local firmware upgrade page in the OEM web interface. The device has to be registered in the cloud in order to be able to access this page. The system has a dual firmware design, there is no way to tell which firmware is currently booted. Therefore, an -initramfs version is flashed first. 1. Log into the OEM web GUI 2. Access the hidden upgrade page by navigating to https://192.168.212.1/gui/#/main/debug/firmwareupgrade 3. Upload the -initramfs-kernel.bin file and flash it 4. Wait for OpenWrt to boot and log in via SSH 5. Transfer the sysupgrade file via SCP 6. Run sysupgrade to install the image 7. Reboot and enjoy NB: If the initramfs version was installed in RAS2, the sysupgrade script sets the boot number to the first partition. A backup has to be performed manually in case the OEM firwmare should be kept. Installation (UART method) ========================== The UART method is more difficult, as the boot loader does not have a timeout set. A semi-working stock firmware is required to configure it: 1. Attach UART 2. Boot the stock firmware until the message about failsafe mode appears 3. Enter failsafe mode by pressing "f" and "Enter" 4. Type "mount_root" 5. Run "fw_setenv bootmenu_delay 3" 6. Reboot, U-Boot now presents a menu 7. The -initramfs-kernel.bin image can be flashed using the menu 8. Run the regular sysupgrade for a permanent installation Changing the partition to boot is a bit cumbersome in U-Boot, as there is no menu to select it. It can only be checked using mstc_bootnum. To change it, issue the following commands in U-Boot: nand read 1800000 53c0000 800 mw.b 1800004 1 1 nand erase 53c0000 800 nand write 1800000 53c0000 800 This selects FW1. Replace "mw.b 1800004 1 1" by "mw.b 1800004 2 1" to change to the second slot. Back to stock ============= It is possible to flash back to stock, but a OEM firmware upgrade is required. ZyXEL does not provide the link on its website, but the link can be acquired from the OEM web GUI by analyzing the transferred JSON objects. It is then a matter of writing the firmware to Kernel2 and setting the boot partition to FW2: mtd write zyxel.bin Kernel2 echo -ne "\x02" | dd of=/dev/mtdblock7 count=1 bs=1 seek=4 conv=notrunc Signed-off-by: Andreas Böhler <dev@aboehler.at> Credits to forum users Annick and SirLouen for their initial work on this device
* ramips: MSG1500 X.00: switch to mac-address-ascii dtsChukun Pan2023-04-21
| | | | | | | | The Config partition of some machines is special, and the openwrt script cannot read the protest_lan_mac correctly. This problem can be solved by reading the mac address (ascii) in dts. Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
* ramips: add support for TP-Link Deco M4R v4Mark Ceeha2023-02-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds support for the V4 hardware revision of the Deco M4R. V4 is a complete overhaul of the hardware compared to V1 and V2, and is much more similar to the Archer C6 V3 and C6U V1. Specifications: SoC: MediaTek MT7621AT (2 cores at 880 MHz, 4 threads) RAM: Kingston D1216ECMDXGJD (256 MB) Wireless 2.4 GHz: MediaTek MT7603EN Wireless 5 GHz: MediaTek MT7613BEN Flash: 16 MB SPI NOR Installation: Flash the *-factory.bin image in the U-Boot recovery webserver. You can trigger this webserver by holding the reset button until the LED flashes yellow, or by hooking up to serial pads on the board (clearly labeled GND, RX and TX) and pressing `x` early in boot. Once the factory image has been flashed, you can use the regular upgrade procedure with sysupgrade images for subsequent flashes. Signed-off-by: Mark Ceeha <hi@shiz.me> Tested-by: Mark Ceeha <hi@shiz.me>
* ramips: mt7621: add support for Xiaomi Mi Router 4A Gigabit v2Dmitry Sokolov2023-01-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device is the same as Xiaomi Mi Router 4A Gigabit, except of: - 5G WiFi is MT7663 - addresses of leds, wifi and eth ports are slightly changed Specs: SoC: MT7621 CPU: 2 x 880 MHz ROM: 16 MB RAM: 128 MB WLAN: MT7603, MT7663 MAC addresses: WAN **** factory 0xe006 (label) LAN *:f7 factory 0xe000 2.4 GHz *:f8 factory 0x0000+0x4 (mtd-eeprom+0x4) 5 GHz *:f9 factory 0x8000+0x4 (mtd-eeprom+0x4) Installation: Factory firmware is based on a custom OpenWrt 17.x. Installation is the same as for Xiaomi Mi Router 4A Gigabit. Probably the easiest way to install is to use the script from this repository: https://github.com/acecilia/OpenWRTInvasion/pull/155 In a more advanced case, you can do everything yourself: - gain access to the device through one of the exploits described in the link above - upload sysupgrade image to /tmp - overwrite stock firmware: # mtd -e OS1 -r write /tmp/sysupgrade.bin OS1 Recovery: Recovery procedure is the same as for Xiaomi Mi Router 4A Gigabit. Possible options can be found here: https://openwrt.org/inbox/toh/xiaomi/xiaomi_mi_router_4a_gigabit_edition One of the ways is to use another router with OpenWrt: - connect both routers by their LAN ports - download stock firmware from [1] - place it inside /tmp/test.bin on the main router - configure PXE/TFTP on the main router - power off 4Av2, hold Reset button, power on - as soon as image download via TFTP starts, Reset can be released - blinking blue wan LED will indicate the end of the flashing process, now router can be rebooted [1] http://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/r4av2/miwifi_r4av2_firmware_release_2.30.28.bin Signed-off-by: Dmitry Sokolov <e323w@proton.me>
* ramips: mt7621: Add Arcadyan WE420223-99 supportHarm Berntsen2023-01-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Arcadyan WE420223-99 is a WiFi AC simultaneous dual-band access point distributed as Experia WiFi by KPN in the Netherlands. It features two ethernet ports and 2 internal antennas. Specifications -------------- SOC : Mediatek MT7621AT ETH : Two 1 gigabit ports, built into the SOC WIFI : MT7615DN BUTTON: Reset BUTTON: WPS LED : Power (green+red) LED : WiFi (green+blue) LED : WPS (green+red) LED : Followme (green+red) Power : 12 VDC, 1A barrel plug Winbond variant: RAM : Winbond W631GG6MB12J, 1GBIT DDR3 SDRAM Flash : Winbond W25Q256JVFQ, 256Mb SPI U-Boot: 1.1.3 (Nov 23 2017 - 16:40:17), Ralink 5.0.0.1 Macronix variant: RAM : Nanya NT5CC64M16GP-DI, 1GBIT DDR3 SDRAM Flash : MX25l25635FMI-10G, 256Mb SPI U-Boot: 1.1.3 (Dec 4 2017 - 11:37:57), Ralink 5.0.0.1 Serial ------ The serial port needs a TTL/RS-232 3V3 level converter! The Serial setting is 57600-8-N-1. The board has an unpopulated 2.54mm straight pin header. The pinout is: VCC (the square), RX, TX, GND. Installation ------------ See the Wiki page [1] for more details, it comes down to: 1. Open the device, take off the heat sink 2. Connect the SPI flash chip to a flasher, e.g. a Raspberry Pi. Also connect the RESET pin for stability (thanks @FPSUsername for reporting) 3. Make a backup in case you want to revert to stock later 4. Flash the squashfs-factory.trx file to offset 0x50000 of the flash 5. Ensure the bootpartition variable is set to 0 in the U-Boot environment located at 0x30000 Note that the U-Boot is password protected, this can optionally be removed. See the forum [2] for more details. MAC Addresses(stock) -------------------- +----------+------------------+-------------------+ | use | address | example | +----------+------------------+-------------------+ | Device | label | 00:00:00:11:00:00 | | Ethernet | + 3 | 00:00:00:11:00:03 | | 2g | + 0x020000f00001 | 02:00:00:01:00:01 | | 5g | + 1 | 00:00:00:11:00:01 | +----------+------------------+-------------------+ The label address is stored in ASCII in the board_data partition Notes ----- - This device has a dual-boot partition scheme, but OpenWRT will claim both partitions for more storage space. Known issues ------------ - 2g MAC address does not match stock due to missing support for that in macaddr_add - Only the power LED is configured by default References ---------- [1] https://openwrt.org/inbox/toh/arcadyan/astoria/we420223-99 [2] https://forum.openwrt.org/t/adding-openwrt-support-for-arcadyan-we420223-99-kpn-experia-wifi/132653 Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com> Signed-off-by: Harm Berntsen <git@harmberntsen.nl>
* ramips: add basic support for TP-Link EC330-G5u v1Mikhail Zhilkin2023-01-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds basic support for TP-Link EC330-G5u Ver:1.0 router (also known as TP-Link Archer C9ERT). Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 128 MiB, Nanya NT5CC64M16GP-DI Flash: 128 MiB NAND, ESMT F59L1G81MA-25T Wireless 2.4 GHz (MediaTek MT7615N): b/g/n, 4x4 Wireless 5 GHz (MediaTek MT7615N): a/n/ac, 4x4 Ethernet: 5xGbE (WAN, LAN1, LAN2, LAN3, LAN4) USB ports: 1xUSB3.0 Button: 4 (Led, WiFi On/Off, Reset, WPS) LEDs: 7 blue LEDs, 1 orange(amber) LED, 1 white(non-gpio) LED Power: 12 VDC, 2 A Connector type: Barrel Bootloader: First U-Boot (1.1.3), Main U-Boot (1.1.3). Additionally, original TP-Link firmware contains Image U-Boot (1.1.3). Serial console (UART) --------------------- V +-------+-------+-------+-------+ | +3.3V | GND | TX | RX | +---+---+-------+-------+-------+ | J2 | +--- Don't connect Installation ------------ 1. Rename OpenWrt initramfs image to test.bin and place it on tftp server with IP 192.168.0.5 2. Attach UART, switch on the router and interrupt the boot process by pressing 't' 3. Load and run OpenWrt initramfs image: tftpboot bootm 4. Once inside OpenWrt, switch to the first boot image: fw_setenv BootImage 0 5. Run 'sysupgrade -n' with the sysupgrade OpenWrt image Back to Stock ------------- 1. Run in the OpenWrt shell: fw_setenv BootImage 1 reboot Recovery -------- 1. Press Reset button and power on the router 2. Navigate to U-Boot recovery web server (http://192.168.0.1/) and upload the OEM firmware MAC addresses ------------- +---------+-------------------+-------------------+-------------+ | | MAC example 1 | MAC example 2 | Algorithm | +---------+-------------------+-------------------+-------------+ | label | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | LAN | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WAN | 72:ff:7b:xx:xx:f5 | 54:d4:f7:xx:xx:db | label+1 [1] | | WLAN 2g | 68:ff:7b:xx:xx:f4 | 50:d4:f7:xx:xx:da | label | | WLAN 5g | 68:ff:7b:xx:xx:f6 | 50:d4:f7:xx:xx:dc | label+2 | +---------+-------------------+-------------------+-------------+ label MAC address was found in factory at 0x165 (text format xx:xx:xx:xx:xx:xx). Notes ----- [1] WAN MAC address: a. First octet of WAN MAC is differ than others and OUI is not related to TP-Link company. This probably should be fixed. b. Flipping bits in first octet and hex delta are different for the different MAC examples: +-----------------+----------------+----------------+ | | Example 1 | Example 2 | +-----------------+----------------+----------------+ | LAN | 68 = 0110 1000 | 50 = 0101 0000 | | MAC (1st octet) | ^ ^ ^ | | +-----------------+----------------+----------------+ | WAN | 72 = 0111 0010 | 54 = 0101 0100 | | MAC (1st octet) | ^ ^ ^ | ^ | +-----------------+----------------+----------------+ | HEX delta | 0xa | 0x4 | +-----------------+----------------+----------------+ | DEC delta | 4 | 4 | +-----------------+----------------+----------------+ c. DEC delta is a constant (4). This looks like a mistake in OEM firmware and probably should be fixed. Based on the above, I decided to keep correct OUI and make WAN MAC = label + 1. [2] Bootloaders The device contains 3 bootloaders: - First U-Boot: U-Boot 1.1.3 (Mar 18 2019 - 12:50:24). The First U-Boot located on NAND Flash to load next full-feature Uboot. - Main U-Boot + its backup: U-Boot 1.1.3 (Mar 18 2019 - 12:50:29). This bootloader includes recovery webserver. Requires special uImages to continue the boot process: 0x00 (os0, os1) - firmware uImage 0x40 (os0, os1) - standalone uImage (OpenWrt kernel is here) - Additionally, both slots of the original TP-Link firmware contains Image U-Boot: U-Boot 1.1.3 (Oct 16 2019 - 08:14:45). It checks image magics and CRCs. We don't use this U-Boot with OpenWrt. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
* ramips: add support for ELECOM WRC-2533GHBK2-TINAGAKI Hiroshi2023-01-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ELECOM WRC-2533GHBK2-T is a 2.4/5 GHz band 11ac (Wi-Fi 5) router, based on MT7621A. Specification: - SoC : MediaTek MT7621A - RAM : DDR3 128 MiB - Flash : SPI-NOR 16 MiB (Macronix MX25L12835FM2I-10G) - WLAN : 2.4/5 GHz 4T4R (2x MediaTek MT7615) - Ethernet : 10/100/1000 Mbps x5 - Switch : MediaTek MT7530 (SoC) - LED/keys : 4x/3x (2x buttons, 1x slide-switch) - UART : through-hole on PCB - J4: 3.3V, RX, GND, TX from SoC side - 57600n8 - Power : 12 VDC, 1.5 A Flash instruction using factory image: 1. Boot WRC-2533GHBK2-T normally 2. Access to "http://192.168.2.1/" and open firmware update page ("ファームウェア更新") 3. Select the OpenWrt factory image and click apply ("適用") button 4. Wait ~150 seconds to complete flashing MAC addresses: LAN : BC:5C:4C:xx:xx:FD (Config, "ethaddr" (text)) WAN : BC:5C:4C:xx:xx:FC (Config, "wanaddr" (text), Label) 2.4 GHz: BC:5C:4C:xx:xx:FE (Factory, 0x4 (hex)) 5 GHz : BC:5C:4C:xx:xx:FF (Factory, 0x8004 (hex)) Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
* ramips: add support for D-Link DAP-X1860 A1Sebastian Schaper2023-01-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | The DAP-X1860 is a wall-plug AX1800 repeater. Specifications: - MT7621, 256 MiB RAM, 128 MiB SPI NAND - MT7915 + MT7975 2x2 802.11ax (DBDC) - Ethernet: 1 port 10/100/1000 - LED RSSI bargraph (2x green, 1x red/orange), status and RSSI LEDs are incorrectly populated red/orange (should be red/green according to documentation) Installation: - Keep reset button pressed during plug-in - Web Recovery Updater is at 192.168.0.50 - Upload factory.bin, confirm flashing (seems to work best with Chromium-based browsers) Revert to OEM firmware: - tar -xvf DAP-X1860_RevA_Firmware_101b94.bin - openssl enc -d -md md5 -aes-256-cbc -in FWImage.st2 \ -out FWImage.st1 -k MB0dBx62oXJXDvt12lETWQ== - tar -xvf FWImage.st1 - flash kernel_DAP-X1860.bin via Recovery Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
* ramips: add support for Cudy M1800Leon M. Busch-George2023-01-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications SoC: MT7621 CPU: 880 MHz Flash: 32 MiB RAM: 256 MiB WLAN: MT7915 WiFi 6 (2.4/5 GHz) Ethernet: 2x Gbit ports MAC LAN b4:4b:d6:2e:c7:b0 (label) WAN b4:4b:d6:2e:c7:b1 WiFi 2.4 00:0c:43:26:46:08 WiFi 5 00:0c:43:26:59:97 Installation There are two known options: 1) The Luci-based UI. 2) Press and hold the reset button during power up. The router will request 'recovery.bin' from a TFTP server at 192.168.1.88. Both options require a signed firmware binary. The openwrt image supplied by cudy is signed and can be used to install unsigned images. Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
* ramips: add basic support for tp-link er605-v2Nikolay Martynov2023-01-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a MT7621-based device with 128MB NAND flash, 256MB RAM, and a USB port. The board has headers to attach console. In order for them to work two solder bridges near those pads need to be made. The defice has the following partition table: ``` 0x000000000000-0x000000080000 : "u-boot" 0x000000080000-0x000000100000 : "u-boot-env" 0x000000100000-0x000000140000 : "factory" 0x000000140000-0x000007e00000 : "firmware" 0x000007e00000-0x000008000000 : "panic-ops" ``` `firmware` partition contains UBI volumes. Unfortunately I accidentally wiped partition and I no longer have access to it. `firmware` partition contains 'secondary' U-Boot which is run by 'first' u-boot. It also contains various configuration partitions that include device info and MAC address. There also seems to be 'primary' and 'backup' set of 'main' volumes. U-boot has `mtkupgrade` command that just overrides data on firmware partitions. Firmware file provided by TP-Link cannot be used with that command. U-boot also has 'recovery' http server. Unfortunately I was not able to make it work with manufacturer's firmware. Manufacturer's firmware essentially contains multiple UBI volumes along with 'partition table'. Unfortunately I no longer can properly run manufacturer's firmware so I cannot at the moment try to a support for building 'factory' images. This patch adds support for initramfs image as well as sysupgrade image. This seems to be pretty standard MT7621 board otherwise. Things that work: * network * leds * usb * factory MAC detection Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
* ramips: add support for Wavlink WS-WN572HP3 4GJan-Niklas Burfeind2022-12-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Wavlink WS-WN572HP3 4G is an 802.11ac dual-band outdoor router with LTE support. Specifications; * Soc: MT7621DAT * RAM: 128MiB * Flash: NOR 16MiB GD-25Q128ESIG3 * Wi-Fi: * MT7613BEN: 5GHz * MT7603EN: 2.4GHz * Ethernet: 2x 1GbE * USB: None - only used internally * LTE Modem: Quectel EC200T-EU * UART: 115200 baud * LEDs: * 7 blue at the front * 1 Power * 2 LAN / WAN * 1 Status * 3 RSSI (annotated 4G) * 1 green at the bottom (4G LED) * Buttons: 1 reset button Installation: * press and hold the reset button while powering on the device * keep it pressed for ten seconds * connect to 192.168.10.1 via webbrowser (chromium/chrome works, at least Firefox 106.0.3 does not) * upload the sysupgrade image, confirm the checksum, wait 2 minutes until the device reboots Revert to stock firmware: * same as installation but use the recovery image for WL-WN572HP3 Signed-off-by: Jan-Niklas Burfeind <git@aiyionpri.me> Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com>
* ramips: fix MAC address assignment for rt1800, e7350Arne Zachlod2022-11-13
| | | | | | | | previous commit ffa4b5283b introduced a bug which broke the MAC address assignment for belkin,rt1800 and linksys,e7350. Fixes: ffa4b5283b39 ("ramips: add support for Mikrotik LtAP-2HnD") Signed-off-by: Arne Zachlod <arne@nerdkeller.org>
* ramips: add support for Mikrotik LtAP-2HnDArne Zachlod2022-11-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mikrotik LtAP-2HnD is a outdoor/automotive WLAN 4 router with integrated GPS receiver and two mPCIe slots. Specifications: * SoC: MT7621A * RAM: 128 MiB Nanya NT5CC64M16GP-DI * Flash: 16 MiB winbond W25Q128JV * WLAN: * Atheros AR9382 with power amplifier SKY 85330 (2x2 internal antennas, with RF switches for external connectors) * Ethernet: 1 Gbps, single port * USB Host: USB 2.0 Speeds * Serial: 115200 baud * LEDs: Power, System, GPS, 5* RSSI * mPCIe: * miniPCIe slot 1: PCIe and USB 2.0 Host (via switch shared with USB Host) * miniPCIe slot 2: USB 2.0 and 3.0 * SIM Cards: * Slot 1 Connected to mPCIe slot 1 * Slot 2 and 3 connected to mPCIe slot 2 via switch * GPS: MTK 3333 on serial port 2 (/dev/ttyS1), 115200 baud and PPS on gpio 14 gpios are exposed to /sys/class/gpio: * usb-select: swithes USB 2.0 interface between external port and internal mPCIe slot 1 default is the external USB interface * gps-reset: resets the GPS interface chip * sim-select: switches between sim slot 2 and 3 connected to mPCIe slot 2 * gps-ant-select: switches GPS antenna between internal antenna and SMA connected antenna * lte-reset: resets mPCIe slot 2 Flashing: TFTP boot initramfs image and then perform sysupgrade. Follow common MikroTik procedure as in https://openwrt.org/toh/mikrotik/common. Signed-off-by: Arne Zachlod <arne@nerdkeller.org>
* ramips: add support for TP-Link MR600 V2(EU)Linos Giannopoulos2022-11-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MR600 V2(EU) is an LTE router that also supports 4G+ band aggregation etc. and can reportedly achieve higher bandwidth with it. - Specifications: * SoC: Mediatek MT7621DAT 880MHz * RAM: 128MB DDR3 * Flash: 16MB SPI NOR flash (GD25Q128C) * LTE Modem: Qualcomm MDM9240 * WiFi 5GHz: Mediatek MT7613BEN * WiFi 2.4GHz: Mediatek MT7603EN * Ethernet: MT7530, 4x 1000Base-T. * UART: Serial console (115200 8n1), J1(GND:3) * Buttons: Reset, WPS. * LED: Power, WAN, LTE, WiFi 2GHz and 5GHz, LAN, Signal1, Signal2, Signal3 - MAC Addresses: OEM firmware configuration: 54:af:97:xx:xx:7b : 2.4G 54:af:97:xx:xx:7a : 5G 54:af:97:xx:xx:7c : LTE 54:af:97:xx:xx:7b : LAN (label) 54:af:97:xx:xx:7c : WAN - Installation: 1. Download the OpenWrt initramfs-image. Place it into a TFTP server root directory and rename it to openwrt.img Configure the TFTP server to listen at 192.168.0.5/24. 3. Connect to the serial console. Attach power and interrupt the boot procedure when prompted (type `tpl`). Credentials are admin / 1234 4. Configure U-Boot for booting OpenWrt from ram $ tftpboot $ bootm 5. Transfer the OpenWrt sysupgrade image to the device. - LTE: In order to setup the wwan0 interface: 1. Add a `qmi` proto interface under `/etc/config/network`, e.g.: ``` config interface 'wwan0' option device '/dev/cdc-wdm0' option proto 'qmi' option pincode 'XXXX' option apn 'your_isp_apn' ``` 2. Add `wwan0` interface to the `wan` firewall zone 3. `/etc/init.d/network restart` Signed-off-by: Linos Giannopoulos <linosgian00@gmail.com>
* ramips: add support for SIM SIMAX1800T and Haier HAR-20S2U1Shiji Yang2022-11-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SIM AX18T and Haier HAR-20S2U1 Wi-Fi6 AX1800 routers are designed based on Tenbay WR1800K. They have the same hardware circuits and u-boot. SIM AX18T has three carrier customized models: SIMAX1800M (China Mobile), SIMAX1800T (China Telecom) and SIMAX1800U (China Unicom). All of these models run the same firmware. Specifications: SOC: MT7621 + MT7905 + MT7975 ROM: 128 MiB RAM: 256 MiB LED: status *3 R/G/B Button: reset *1 + wps/mesh *1 Ethernet: lan *3 + wan *1 (10/100/1000Mbps) TTL Baudrate: 115200 TFTP Server: 192.168.1.254 TFTP IP: 192.168.1.28 or 192.168.1.160 (when envs is broken) MAC Address: use address source label 30:xx:xx:xx:xx:62 wan lan 30:xx:xx:xx:xx:65 factory.0x8004 wan 30:xx:xx:xx:xx:62 factory.0x8004 -3 wlan2g 30:xx:xx:xx:xx:64 factory.0x0004 wlan5g 32:xx:xx:xx:xx:64 factory.0x0004 set 7th bit TFTP Installation (initramfs image only & recommend): 1. Set local tftp server IP: 192.168.1.254 and NetMask: 255.255.255.0 2. Rename initramfs-kernel.bin to "factory.bin" and put it in the root directory of the tftp server. (tftpd64 is a good choice for Windows) 3. Start the TFTP server, plug in the power supply, and wait for the system to boot. 4. Backup "firmware" partition and rename it to "firmware.bin", we need it to back to stock firmware. 5. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 6. Apply sysupgrade.bin in OpenWrt LuCI. Web UI Installation: 1. Apply update by uploading initramfs-factory.bin to the web UI. 2. Use "fw_printenv" command to list envs. If "firmware_select=2" is observed then set u-boot enviroment: /# fw_setenv firmware_select 1 3. Apply squashfs-sysupgrade.bin in OpenWrt LuCI. Recovery to stock firmware: a. Upload "firmware.bin" to OpenWrt /tmp, then execute: /# mtd -r write /tmp/firmware.bin firmware b. We can also write factory image "UploadBrush-bin.img" to firmware partition to recovery. Upload image file to /tmp, then execute: /# mtd erase firmware /# mtd -r write /tmp/UploadBrush-bin.img firmware How to extract stock firmware image: Download stock firmware, then use openssl: openssl aes-256-cbc -d -salt -in [Downloaded_Firmware] \ -out "firmware.tar.tgz" -k QiLunSmartWL Signed-off-by: Chen Minqiang <ptpt52@gmail.com> Signed-off-by: Shiji Yang <yangshiji66@qq.com>
* ramips: add support for YunCore FAP690Volodymyr Puiul2022-10-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is an in-wall 802.11ax (Wi-Fi 6) router, based on MediaTek MT7621A. Specifications: - SoC: MT7621AT (880MHz, 2 Cores) - RAM: 128 MB - Flash: 16 MB SPI NOR - Wi-Fi: - MT7915DN + MT7905DAN: 2.4/5 GHz - Ethernet: 1x 1GiE via MT7530 - UART: J4 (115200 baud) - Pinout: [3V3] (TXD) (RXD) (GND) - Bootloader: U-Boot - Buttons: - SW1 - no label on the box, combined with led - Led: Status. RGB controlled by - GPIO 14 - green color - GPIO 15 - red color - GPIO 16 - blue color Installation: OEM firmware is based on LEDE with custom UI and support standard sysupgrade variant of firmware. However it requires "*.ubin" extension for sysupgrade file. Always select "Factory reset" switch on upgrade to OpenWRT, otherwise it will not boot. MAC addresses as verified by OEM firmware: vendor source LAN factory 0x4 (label) 5g factory 0x4 (label) 2g label with flipped bits bit in 1-st byte and bits 5, 6, 7 in 4-th byte Example label: 44:xx:xx:b7:xx:xx lan: 44:xx:xx:b7:xx:xx 2g 46:xx:xx:c7:xx:xx 5g 44:xx:xx:b7:xx:xx Signed-off-by: Volodymyr Puiul <volodymyr.puiul@gmail.com>
* ramips: fix switch setup for ASUS RT-AX53UMatthias Schiffer2022-10-03
| | | | | | | The device has only 1 WAN + 3 LAN ports. Remove "lan4" interface corresponding to the non-existing port. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* ramips: update MAC address configuration for Buffalo WSR-1166DHPKazuhiro Ito2022-09-28
| | | | | | | | | | | | Convert MAC address and label_mac configuration of Buffalo WSR-1166DHP to use the generic function of OpenWrt. Apply commit 770cfe9 for WCR-1166DS to WSR-1166DHP too. Tested on the device and MAC address is kept before and after this change. Signed-off-by: Kazuhiro Ito <kzhr@d1.dion.ne.jp>
* ramips: add support for Ubiquiti UniFi FlexHDSven Wegener2022-09-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware -------- - SoC: MediaTek MT7621AT with 128 MiB RAM and 32 MiB Flash - Wi-Fi: MediaTek MT7603 (b/g/n, 2x2) and MediaTek MT7615 (ac, 4x4) - Bluetooth: CSR8811 (internal USB, install kmod-bluetooth) Installation ------------ 1. Connect to the booted device at 192.168.1.20 using username/password "ubnt". 2. Update the bootloader environment. $ fw_setenv devmode TRUE $ fw_setenv boot_openwrt "fdt addr \$(fdtcontroladdr); fdt rm /signature; bootubnt" $ fw_setenv bootcmd "run boot_openwrt" 3. Transfer the OpenWrt sysupgrade image to the device using SCP. 4. Check the mtd partition number for bs / kernel0 / kernel1 $ cat /proc/mtd 5. Set the bootselect flag to boot from kernel0 $ dd if=/dev/zero bs=1 count=1 of=/dev/mtdblock4 6. Write the OpenWrt sysupgrade image to both kernel0 as well as kernel1 $ dd if=openwrt.bin of=/dev/mtdblock6 $ dd if=openwrt.bin of=/dev/mtdblock7 7. Reboot the device. It should boot into OpenWrt. Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
* ramips: add support for Linksys E7350Rosen Penev2022-09-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | Linksys E7350 is an 802.11ax (Wi-Fi 6) router, based on MediaTek MT7621A. Specifications: - SoC: MT7621 (880MHz, 2 Cores) - RAM: 256 MB - Flash: 128 MB NAND - Wi-Fi: - MT7915D: 2.4/5 GHz (DBDC) - Ethernet: 5x 1GiE MT7530 - USB: 1x USB 3.0 - UART: J4 (57600 baud) - Pinout: [3V3] (TXD) (RXD) (blank) (GND) Notes: * This device has a dual-boot partition scheme, but this firmware works only on boot partition 1. Installation: Upload the generated factory.bin image via the stock web firmware updater. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* ramips: add support for Belkin RT1800Rosen Penev2022-09-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | Belkin RT1800 is an 802.11ax (Wi-Fi 6) router, based on MediaTek MT7621A. Specifications: - SoC: MT7621 (880MHz, 2 Cores) - RAM: 256 MB - Flash: 128 MB NAND - Wi-Fi: - MT7915D: 2.4/5 GHz (DBDC) - Ethernet: 5x 1GiE MT7530 - USB: 1x USB 3.0 - UART: J4 (57600 baud) - Pinout: [3V3] (TXD) (RXD) (blank) (GND) Notes: * This device has a dual-boot partition scheme, but this firmware works only on boot partition 1. Installation: Upload the generated factory.bin image via the stock web firmware updater. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* ramips: fix GB-PC1 and GB-PC2 device supportArınç ÜNAL2022-08-20
| | | | | | | | | | | | | | | | Change switch port labels to ethblack & ethblue. Change lan1 & lan2 LEDs to ethblack_act & ethblue_act and fix GPIO pins. Add the external phy with ethyellow label on the GB-PC2 devicetree. Do not claim rgmii2 as gpio, it's used for ethernet with rgmii2 function. Enable ICPlus PHY driver for IP1001 which GB-PC2 has got. Update interface name and change netdev function. Enable lzma compression to make up for the increased size of the kernel. Make spi flash bindings on par with mainline Linux to fix read errors. Tested on GB-PC2 by Petr. Tested-by: Petr Louda <petr.louda@outlook.cz> Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
* ramips: get MAC addr from the encrypted partition (WG4хх223)Mikhail Zhilkin2022-08-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit resolves #10062. Adds decryption of the Arcadyan WG4xx223 configuration partition (board_data)to get base MAC address from it. As a result, after this change the hack with saving MAC addressees to u-boot-env before installation of OpenWrt is no longer necessary. This is necessary for the following devices: - Beeline Smartbox Flash (Arcadyan WG443223) - MTS WG430223 (Arcadyan WG430223) Example: +----------------+-------------------+------------------------+ | | MTS WG430223 | Beeline Smartbox Flash | +----------------+-------------------+------------------------+ | base mac (mtd) | A4:xx:xx:51:xx:F4 | 30:xx:xx:51:xx:06 | | label | A4:xx:xx:51:xx:F4 | 30:xx:xx:51:xx:09 | | LAN | A4:xx:xx:51:xx:F6 | 30:xx:xx:51:xx:09 | | WAN | A4:xx:xx:51:xx:F4 | 30:xx:xx:51:xx:06 | | WLAN_2g | A4:xx:xx:51:xx:F5 | 30:xx:xx:51:xx:07 | | WLAN_5g | A6:xx:xx:21:xx:F5 | 32:xx:xx:41:xx:07 | +----------------+-------------------+------------------------+ Collected statistic shows that the 2-4th bits of the 7th byte of the WLAN_5g MAC are the constant (see #10062 for more details): - Beeline Smartbox Flash - 100 - MTS WG430223 - 010 Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
* ramips: add support for ZyXEL LTE3301-PlusAndré Valentin2022-08-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ZyXEL LTE3301-PLUS is an 4G indoor CPE with 2 external LTE antennas. Specifications: - SoC: MediaTek MT7621AT - RAM: 256 MB - Flash: 128 MB MB NAND (MX30LF1G18AC) - WiFi: MediaTek MT7615E - Switch: 4 LAN ports (Gigabit) - LTE: Quectel EG506 connected by USB3 to SoC - SIM: 1 micro-SIM slot - USB: USB3 port - Buttons: Reset, WPS - LEDs: Multicolour power, internet, LTE, signal, Wifi, USB - Power: 12V, 1.5A The device is built as an indoor ethernet to LTE bridge or router with Wifi. UART Serial: 57600N1 Located on populated 5 pin header J5: [o] GND [ ] key - no pin [o] RX [o] TX [o] 3.3V Vcc MAC assignment: lan: 98:0d:67:ee:85:54 (base, on the device back) wlan: 98:0d:67:ee:85:55 Installation from web GUI: - Log in as "admin" on http://192.168.1.1/ - Upload OpenWrt initramfs-recovery.bin image on the Maintenance -> Firmware page - Wait for OpenWrt to boot and ssh to root@192.168.1.1 - format ubi device: ubiformat /dev/mtd6 - attach ubi device: ubiattach -m6 - create rootfs volume: ubimkvol /dev/ubi0 -n0 -N rootfs -s 1MiB - rootfs_data volume: ubimkvol /dev/ubi0 -n1 -N rootfs_data -s 1MiB - run sysupgrade with sysupgrade image For more details about flashing see commit 2449a632084b ("ramips: mt7621: Add support for ZyXEL NR7101"). Please note that this commit is needed: firmware-utils: add marcant changes for ZyXEL NBG6716 and LTE3301-PLUS Signed-off-by: André Valentin <avalentin@marcant.net>
* ramips: adding support for Asus RP-AC56Lea Teuberth2022-08-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications: CPU: MT7621A dual-core 880MHz RAM: 64MB DDR2 FLASH: 16MB MX25L12805D NOR SPI WIFI: 2.4GHz 2x2 MT7603 b/g/n PCI WIFI: 5GHz 2x2 MT7662 a/b/ac PCI ETH: 1xLAN 1000base-T integrated SWITCH: MT7530 Port 0: LAN, Port 6: CPU LED: Power, 2.4GHz WiFi, 5GHz WiFi BTN: WPS, Reset UART: Near ETH port, from ETH: 3V3-TxD-GND-RxD 57600 8n1 MISC: Audio support Installation: 1. Update using recovery mode - while holdig "reset" button, power on the device - keep holding "reset" until power led is flashing yellow - set own IP to 192.168.1.75, subnet mask: 255.255.255.0 - push firmware image (can be factory.bin or sysupgrade.bin) using tftp client in binary mode to 192.168.1.1 Notes: This board has only two MAC addresses programmed in the "factory" partition: - MAC for wlan0 (2.4GHz) at offset 0x0004 - MAC for wlan1 (5GHz) at offset 0x8004 - stock firmware re-uses wlan0 MAC for ethernet - no valid addresses found in 0x28, 0x2e, 0xe000 and 0xe006 Signed-off-by: Lea Teuberth <lea.teuberth@outlook.com>
* ramips: add support for H3C TX1800 Plus / TX1801 Plus / TX1806Shiji Yang2022-07-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | H3C TX180x series WiFi6 routers are customized by different carrier. While these three devices look different, they use the same motherboard inside. Another minor difference comes from the model name definition in the u-boot environment variable. Specifications: SOC: MT7621 + MT7915 ROM: 128 MiB RAM: 256 MiB LED: status *2 Button: reset *1 + wps/mesh *1 Ethernet: lan *3 + wan *1 (10/100/1000Mbps) TTL Baudrate: 115200 TFTP server IP: 192.168.124.99 MAC Address: use address(sample 1) address(sample 2) source label 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 u-boot-env@ethaddr lan 88:xx:xx:98:xx:13 88:xx:xx:a2:xx:a6 $label +1 wan 88:xx:xx:98:xx:12 88:xx:xx:a2:xx:a5 $label WiFi4_2G 8a:xx:xx:58:xx:14 8a:xx:xx:52:xx:a7 (Compatibility mode) WiFi5_5G 8a:xx:xx:b8:xx:14 8a:xx:xx:b2:xx:a7 (Compatibility mode) WiFi6_2G 8a:xx:xx:18:xx:14 8a:xx:xx:12:xx:a7 WiFi6_5G 8a:xx:xx:78:xx:14 8a:xx:xx:72:xx:a7 Compatibility mode is used to guarantee the connection of old devices that only support WiFi4 or WiFi5. TFTP + TTL Installation: Although a TTL connection is required for installation, we do not need to tear down it. We can find the TTL port from the cooling hole at the bottom. It is located below LAN3 and the pins are defined as follows: |LAN1|LAN2|LAN3|----|WAN| -------------------- |GND|TX|RX|VCC| 1. Set tftp server IP to 192.168.124.99 and put initramfs firmware in server's root directory, rename it to a simple name "initramfs.bin". 2. Plug in the power supply and wait for power on, connect the TTL cable and open a TTL session, enter "reboot", then enter "Y" to confirm. Finally push "0" to interruput boot while booting. 3. Execute command to install a initramfs system: # tftp 0x80010000 192.168.124.99:initramfs.bin # bootm 0x80010000 4. Backup nand flash by OpenWrt LuCI or dd instruction. We need those partitions if we want to back to stock firmwre due to official website does not provide download link. # dd if=/dev/mtd1 of=/tmp/u-boot-env.bin # dd if=/dev/mtd4 of=/tmp/firmware.bin 5. Edit u-boot env to ensure use default bootargs and first image slot: # fw_setenv bootargs # fw_setenv bootflag 0 6. Upgrade sysupgrade firmware. 7. About restore stock firmware: flash the "firmware" and "u-boot-env" partitions that we backed up in step 4. # mtd write /tmp/u-boot-env.bin u-boot-env # mtd write /tmp/firmware.bin firmware Additional Info: The H3C stock firmware has a 160-byte firmware header that appears to use a non-standard CRC32 verification algorithm. For this part of the data, the u-boot does not check it so we can just directly replace it with a placeholder. Signed-off-by: Shiji Yang <yangshiji66@qq.com>
* ramips: add support for ZyXEL NWA50AX / NWA55AXEDavid Bauer2022-07-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Hardware -------- CPU: Mediatek MT7621 RAM: 256M DDR3 FLASH: 128M NAND ETH: 1x Gigabit Ethernet WiFi: Mediatek MT7915 (2.4/5GHz 802.11ax 2x2 DBDC) BTN: 1x Reset (NWA50AX only) LED: 1x Multi-Color (NWA50AX only) UART Console ------------ NWA50AX: Available below the rubber cover next to the ethernet port. NWA55AXE: Available on the board when disassembling the device. Settings: 115200 8N1 Layout: <12V> <LAN> GND-RX-TX-VCC Logic-Level is 3V3. Don't connect VCC to your UART adapter! Installation Web-UI ------------------- Upload the Factory image using the devices Web-Interface. As the device uses a dual-image partition layout, OpenWrt can only installed on Slot A. This requires the current active image prior flashing the device to be on Slot B. If the currently installed image is started from Slot A, the device will flash OpenWrt to Slot B. OpenWrt will panic upon first boot in this case and the device will return to the ZyXEL firmware upon next boot. If this happens, first install a ZyXEL firmware upgrade of any version and install OpenWrt after that. Installation TFTP ----------------- This installation routine is especially useful in case * unknown device password (NWA55AXE lacks reset button) * bricked device Attach to the UART console header of the device. Interrupt the boot procedure by pressing Enter. The bootloader has a reduced command-set available from CLI, but more commands can be executed by abusing the atns command. Boot a OpenWrt initramfs image available on a TFTP server at 192.168.1.66. Rename the image to owrt.bin $ atnf owrt.bin $ atna 192.168.1.88 $ atns "192.168.1.66; tftpboot; bootm" Upon booting, set the booted image to the correct slot: $ zyxel-bootconfig /dev/mtd10 get-status $ zyxel-bootconfig /dev/mtd10 set-image-status 0 valid $ zyxel-bootconfig /dev/mtd10 set-active-image 0 Copy the OpenWrt ramboot-factory image to the device using scp. Write the factory image to NAND and reboot the device. $ mtd write ramboot-factory.bin firmware $ reboot Signed-off-by: David Bauer <mail@david-bauer.net>
* ramips: add support for Netgear WAX202Wenli Looi2022-07-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Netgear WAX202 is an 802.11ax (Wi-Fi 6) router. Specifications: * SoC: MT7621A * RAM: 512 MiB NT5CC256M16ER-EK * Flash: NAND 128 MiB F59L1G81MB-25T * Wi-Fi: * MT7915D: 2.4/5 GHz (DBDC) * Ethernet: 4x 1GbE * Switch: SoC built-in * USB: None * UART: 115200 baud (labeled on board) Load addresses (same as ipTIME AX2004M): * stock * 0x80010000: FIT image * 0x81001000: kernel image -> entry * OpenWrt * 0x80010000: FIT image * 0x82000000: uncompressed kernel+relocate image * 0x80001000: relocated kernel image -> entry Installation: * Flash the factory image through the stock web interface, or TFTP to the bootloader. NMRP can be used to TFTP without opening the case. * Note that the bootloader accepts both encrypted and unencrypted images, while the stock web interface only accepts encrypted ones. Revert to stock firmware: * Flash the stock firmware to the bootloader using TFTP/NMRP. References in WAX202 GPL source: https://www.downloads.netgear.com/files/GPL/WAX202_V1.0.5.1_Source.rar * openwrt/target/linux/ramips/dts/mt7621-ax-nand-wax202.dts DTS file for this device. Signed-off-by: Wenli Looi <wlooi@ucalgary.ca>
* ramips: add support for Beeline SmartBox GIGAMikhail Zhilkin2022-07-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Beeline SmartBox GIGA is a wireless WiFi 5 router manufactured by Sercomm company. Device specification -------------------- SoC Type: MediaTek MT7621AT RAM: 256 MiB, Nanya NT5CC128M16JR-EK Flash: 128 MiB, Macronix MX30LF1G18AC Wireless 2.4 GHz (MT7603EN): b/g/n, 2x2 Wireless 5 GHz (MT7613BE): a/n/ac, 2x2 Ethernet: 3 ports - 2xGbE (WAN, LAN1), 1xFE (LAN2) USB ports: 1xUSB3.0 Button: 1 button (Reset/WPS) PCB ID: DBE00B-1.6MM LEDs: 1 RGB LED Power: 12 VDC, 1.5 A Connector type: barrel Bootloader: U-Boot Installation ----------------- 1. Downgrade stock (Beeline) firmware to v.1.0.02; 2. Give factory OpenWrt image a shorter name, e.g. 1001.img; 3. Upload and update the firmware via the original web interface. Remark: You might need make the 3rd step twice if your running firmware is booted from the Slot 1 (Sercomm0 bootflag). The stock firmware reverses the bootflag (Sercomm0 / Sercomm1) on each firmware update. Revert to stock --------------- 1. Change the bootflag to Sercomm1 in OpenWrt CLI and then reboot: printf 1 | dd bs=1 seek=7 count=1 of=/dev/mtdblock3 2. Optional: Update with any stock (Beeline) firmware if you want to overwrite OpenWrt in Slot 0 completely. MAC Addresses ------------- +-----+-----------+---------+ | use | address | example | +-----+-----------+---------+ | LAN | label | *:16 | | WAN | label + 1 | *:17 | | 2g | label + 4 | *:1a | | 5g | label + 5 | *:1b | +-----+-----------+---------+ The label MAC address was found in Factory 0x21000 Notes ----- 1. The following scripts are required for the build: sercomm-crypto.py - already exists in OpenWrt sercomm-partition-tag.py - already exists in OpenWrt sercomm-payload.py - already exists in OpenWrt sercomm-pid.py - new, the part of this pull request sercomm-kernel-header.py - new, the part of this pull request 2. This device (same as other Sercomm S2,S3-based devices) requires special LZMA and LOADADDR settings for successful boot: LZMA_TEXT_START=0x82800000 KERNEL_LOADADDR=0x81001000 LOADADDR=0x80001000 3. This device (same as several other Sercomm-based devices - Beeline, Netgear, Etisalat, Rostelecom) has partition map (mtd1) containing real partition offsets, which may differ from device to device depending on the number and location of bad blocks on NAND. "fixed-partitions" is used if the partition map is not found or corrupted. This behavour (it's the same as on stock firmware) is provided by MTD_SERCOMM_PARTS module. Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Powered by cgit, Themed by Ted Yin.